Harris Law Firm PC
AUSTIN    HOUSTON      Telephone 713.781.1156  or  512.732.7377     Fax 877.876.8913
THE BANK REGULATORY BLOG



We e-mail each new entry in the Bank Regulatory Blog to our clients and friends.  If you would like to be added to our mailing list, send an e-mail to alan.harris@harrislawusa.com.

Can We Turn That Piece of ORE Into a Theme Park? 

 
April 2013

Maybe not.   But depository institutions do have some latitude for making expenditures and engaging in additional transactions to enhance the marketability and value of their other real estate (ORE).   
The ability to pay for repairs and other costs to maintain a property in its current condition is generally inherent in banks’ authority to hold ORE.  But questions often arise about the extent to which a bank can incur expense to modify or improve ORE, acquire additional rights related to the parcel, or even  exchange it for other property.    The type and extent of expenses and transactions that are authorized vary to some degree depending on the type of charter and regulator that a bank has.  But generally there is support for the following actions under applicable law and regulatory interpretations:

  • Extinguishing other liens, clearing title problems, and acquiring rights of access or other easements.
  • Operating an existing business on the property.
  • Purchasing a third party’s partial interest in the property.
  • Acquiring an adjoining tract of land to add to the property.
  • Exchanging the property for another parcel, or for real property, that is more readily marketable.
  • Trading the property for ownership interests in an entity formed to hold the property.
  • Refitting a building for occupancy.
  • Completing an unfinished residential or office development.
  • In some cases, developing  raw land “from the ground up.”

The key to supporting a bank’s authority for any of these endeavors is to demonstrate how the action is not speculative, but will likely enhance the bank’s ability to sell the property and fetch a reasonable price for it – thereby helping the bank reduce or avoid a loss on the underlying loan.  It is also important to show how the bank’s plan is consistent with safety and soundness overall.

In some cases, again depending on the charter and regulator, a bank must obtain clearance from its regulator before engaging in the types of activities listed above.   Here’s a brief overview of the approval requirements for several types of charters:

A national bank must give the OCC prior notice of a plan to improve or complete development of ORE when the cost (including the recorded investment in the property) will exceed 10% of the bank’s capital and surplus.  (Refitting an existing building for new tenants is exempt from this requirement).   Unless informed otherwise by the OCC after 31 days, the bank can proceed with the plan.  The OCC generally discourages plans to initiate development of raw land but has acknowledged that some such plans could be permissible.  Although applicable regulations do not specifically require it, OCC interpretive letters indicate that a national bank should consult with the OCC before exchanging property or acquiring adjoining parcels. 

A federal thrift has relatively broad authority to modify or develop ORE (including from the ground up) when the actions are part of a reasonable plan and do not contravene other specific legal prohibitions.  A thrift intending to make expenditures that (together with the recorded investment in the property) would exceed its lending limit must file a request for non-objection from the OCC. 

A Texas state bank must obtain the Texas Department of Banking’s prior approval in order to improve ORE, exchange ORE for other real or personal property, or acquire additional parcels to add to ORE.  A development plan should not go so far as to change or alter the property’s current status or intended use.  In acting on a proposal, the Department will evaluate among other things the bank’s previous good faith efforts to dispose of the original property and the bank’s specific marketing plan for the new or improved property. 

A Texas state savings bank has broad powers to improve ORE (including development of law land) and take other actions reasonably necessary to help avoid a loss.  Although there are no prior approval requirements for an SSB’s plan, the Texas Department of Savings and Mortgage Lending encourages an SSB to conduct a careful cost-benefit analysis and ensure that anticipated expenditures will not strain the bank’s capital or otherwise compromise safety and soundness.

While you may not end up with that theme park, there is room in the law for innovative yet prudent plans that can bring results worth celebrating.

After Financial Reform, Texas Family Trust Companies May Be Attractive Vehicles for Family Offices 

 
November 19, 2010

Recent financial reform legislation will require many “family offices “  to register as investment advisers under federal law.   Those faced with the need to register do have an alternative to consider – operating through a Texas family trust company.  Chartered and regulated by the Texas Department of Banking, Texas family trust companies offer a supervisory framework that may be less burdensome and more compatible with the operations of family offices – even those outside of Texas. 

The Dodd-Frank Wall Street Reform and Consumer Protection Act has eliminated  the exemption from federal investment adviser registration for persons and entities providing investment advice to 15 or fewer clients.  Congress’ purpose for this change, which takes effect on July 21, 2011, was to subject advisers to private investment funds to federal regulatory supervision. 

However, many family offices -- entities established by families to manage their investments and provide financial advice and other services to family members – have relied on the “15 client” exemption to avert the extensive regulatory requirements that apply to registered investment advisers.  

Recognizing the impact this change could have on family offices, Congress carved out a new exemption from investment adviser registration specifically for family offices – and left for the Securities and Exchange Commission to define what constitutes a family office.    The SEC recently issued proposed new regulations for this purpose.  But many family offices will no doubt be dismayed to find their activities outside the scope of the relatively narrow proposed SEC definition.   

Under the proposed regulations, a family office entitled to the exemption provides services only to:  the person for whose benefit the office was established and his or her spouse (the “founders”); family members of the founders; trusts for the benefit of family members; corporate entities controlled by and operating for the benefit of family members; charitable organizations and foundations established and funded by family members;  and certain key employees of the office.   A family office must be owned by family members and cannot hold itself out to the public as providing advisory services.

Critical to this definition is who constitutes a family member.  The SEC has proposed that family members include the founders; the lineal descendants of the founders and their spouses;  the siblings of the founders, their spouses, their lineal descendants, and the spouses of the lineal descendants; and the parents of the founders.   
Family offices that provide services to a broader group of family relations – such as aunts and uncles, cousins, or grandparents of the founders, and entities owned by these persons – will fall outside the SEC’s proposed definition.   Unless the SEC expands the universe of family members in the final regulations, many family offices will be faced with some difficult choices before next July – among them, relying on some limited grandfathering provisions in the new law, seeking individual exemptive orders from the SEC, or resigning themselves to the onus of registration and regulation as investment advisers .    

But another exemption may be of help.  Trust companies that are regulated by state or federal authorities are not considered investment advisers under federal law.   Thus, reorganizing as a trust company is another way that a family office can avoid registering as an investment adviser.  Hence the Texas family trust company as an attractive alternative to consider.  

A Texas family trust company – also sometimes known as a “exempt” trust company -- can provide services to individuals who are related within the “fourth degree of affinity or consanguinity” to an individual who owns the trust company.  This encompasses a  broader web of family relationships than does the SEC’s  proposal for family offices, and includes  grandparents, aunts and uncles, first cousins and their spouses, great grandparents, great aunts and uncles, and even great grandparents of the owners/founders.  A Texas family trust company can also serve as trustee for trusts established for the benefit of any of these persons, and provide services to corporate entities owned by these persons.   A family trust company cannot hold itself out as doing business with the public.

A family trust company must maintain at least $250,000 in capital and provide periodic financial and other reports to the Texas Department of Banking.  The Department conducts an annual onsite examination of each family trust company, reviewing not only the financial and corporate affairs of the company but also the company’s administration of trusts for which it is trustee. 

A family trust company must have a minimum three-member board of directors, at least one of which must be a Texas resident.  Although a family trust company must have a home office in Texas where an executive officer is located and company records are kept, it is possible for the core of the company’s operations to be out of state.  This can make the Texas family trust company a viable vehicle even for out of state family offices.

Forming a family trust company requires an application for the Department’s prior approval, including the submission of background information for the company’s proposed directors and officers.   This author served as counsel to the first family trust company to be formed under modern Texas law.

Although supervision of family trust companies by the Department is rigorous, most family trust companies would find their regulatory compliance responsibilities to be less onerous than those applicable to registered investment advisers.   Another benefit that a family trust company offers is enhanced confidentiality for family members and their assets.  Information reported to the Department about the company’s clients and the trust assets it administers is not available to the public.  In contrast, information about the owners, business activities, and amount of assets under management of each registered investment adviser is publicly available on the SEC’s website.

A Texas family trust company also can offer tax planning opportunities for trustors or trust beneficiaries  located out of state.  For example, some states impose franchise taxes on trust assets when the trustee is domiciled in that state.  These taxes often can be avoided by appointing a trustee in another state, such as Texas, where trust assets are not subject to such taxes.  Utilizing a family trust company allows an out-of-state trustor to harness the tax benefits of having a Texas trustee while still allowing the trustor to control the trustee and thus the property of the trust.

One potential comparative drawback to a family trust company:  It is not clear under Texas law whether a family trust company could provide services to charitable organizations or foundations chartered and funded by family members, as could a family office under the proposed SEC definition.  A ruling by the Department or a statute amendment by the Texas legislature may be necessary to include such entities in the clientele of family trust companies.  Also, Texas law does not authorize family trust companies to provide services to key employees who are not family members, as does the proposed SEC definition for family offices. 

In this ever-changing regulatory climate, family offices would do well to evaluate the Texas family trust company as a potentially useful vehicle for conducting their operations.


Alert!  Eleventh Hour Addition to Stimulus Bill Imposes Onerous New Executive Pay Restrictions on TARP Recipients


February 14, 2009

The maxim that those who take the king's coin must follow the king's rules is taking on increasingly painful relevance for TARP fund recipients.  A last-minute tack-on to the economic stimulus bill approved by Congress on February 13 creates unprecedented limits on executive compensation for TARP participants.  These restrictions even apply retroactively to institutions that have already received Treasury funds.

The number of a TARP participant's executives to whom the restrictions apply depends on the amount of government funds the institution receives.

Among the new restrictions:

President Obama reportedly plans to sign the bill into law on February 17.  Treasury will issue new regulations interpreting and adding more details to these provisions, so only time will tell whether the restrictions in practice will be as bad as, or even worse than, they now appear. 

In what may be the silver lining in these provisions, most of the restrictions on an institution's ability to redeem its TARP preferred stock during the first three years of issuance have been removed. 
Still, input from an institution's primary federal regulator - and probably the regulator's affirmative approval - will be required before the institution pays back its TARP funds.

This bill will no doubt incentivize many institutions to seek just such an early exit from TARP.

Banks' Use of Program-Related Funds: to Lend or Not to Lend?

January 14, 2009

A frequent question from financial institutions participating in the new government guarantee and capital programs has been, “What ‘s the catch they haven’t told us about?”  State nonmember banks may already have an answer. 

A new FDIC letter, FIL 1-2009, is calling for FDIC-supervised banks to document how they are using funds in connection with the these programs.  Funds for which the FDIC wants an accounting include capital obtained from Treasury under the TARP Capital Purchase Program, borrowings and transaction account deposits guaranteed by the FDIC under the Temporary Liquidity Guarantee Program, and the proceeds of commercial paper sold to the Federal Reserve under the Commercial Paper Funding Facility.   

The letter also reveals an expectation that banks will deploy funding received under these programs prudently to support the needs of creditworthy borrowers and to strengthen bank capital.   The FDIC references efforts to help existing mortgage borrowers avoid foreclosures as a component of meeting credit needs.  

The FDIC is asking banks to describe their utilization of these funds during the examination process and to include such information in their annual reports and financial statements. 

The regulations and terms governing these programs do not mandate that the related funds be earmarked for a specific purpose (although it appears likely that legislation to release a new round of TARP funds will do so for future recipients).    

So will an FDIC-supervised bank be subject to examiner criticism if it cannot point to an uptick in lending  after joining in one or more of these programs?  For a variety of reasons, the answer should not be an automatic “yes.”   How precisely, for example, can a bank really quantify the extent to which it the FDIC guarantee programs have brought it deposits or funding that it would not otherwise have?   As for TARP proceeds, a January 13, 2009 speech by Interim Assistant Secretary Neel Kashkari confirms Treasury’s concurrence with use of the funds to make acquisitions, or to absorb losses due to loan writedowns or restructurings.  

Mr. Kashkari pointed out that banks have strong economic incentives to deploy their capital profitably, and that because they are in the business of lending, they will provide credit to sound borrowers whenever possible.  Although he did say that Treasury would be analyzing the lending activity of TARP recipients, he also emphasized that banks should not be pressured into lending practices entailing risks with which they are not comfortable.  

The FDIC letter itself can be cited against a simplistic "increase lending or else" supervisory approach.  As mentioned above, the letter mentions using program proceeds not only to support lending but also to strengthen capital.  This point is expanded in another document that the FDIC letter references - last November's Interagency Statement on Meeting the Needs of Creditworthy Borrowers.  That issuance, which encourages banks to continue making loans that are in their economic interest, contains a lot of "preaching to the choir."   But the Interagency Statement also is instructive in highlighting the relationship between capital planning and lending.  The statement points out that maintaining a strong capital position complements and facilitates a bank's ability to lend.  

In this light, the FDIC arguably should not find fault with a bank that utilizes program-related funds to shore up its capital so that it can carry on its customary lending practices in a prudent manner. 

Three New Government Plans – What They Mean for Community Banks

October 15, 2008

Regulators announced details yesterday of three new measures designed to help depository institutions shore up their capital and attract new deposits.   These opportunities may be attractive to many community banks and their holding companies, but they do come with strings attached. 

FDIC Insurance Coverage for All Non-Interest Bearing Transaction Deposits

The FDIC will provide full insurance coverage – over and above the $250,000 already insured – for non-interest bearing transaction accounts at participating institutions until December 31, 2009.  This measure is geared to help smaller and mid-sized banks attract accounts in which commercial customers frequently maintain large balances, for transactions such as payroll processing.

After the first 30 days of the program, participating banks will pay the FDIC a 10 basis point surcharge – added to the deposit insurance premium that already applies -- on the portion of the deposits covered by the additional insurance.

All depository institutions will be part of the program for the first 30 days.  Institutions that notify the FDIC before the end of that 30 day period can opt out of the enhanced coverage.   A bank not opting out apparently still must be deemed eligible by the FDIC in consultation with the bank’s primary regulator, but it is not yet clear what standards may apply. 

Now for the catch -- banks participating in the program will be subject to enhanced supervisory oversight designed to prevent excess risk taking and rapid growth.   The FDIC has not elaborated on what that open-ended phrase might entail. 

FDIC Guarantee of Senior Debt
The FDIC will guarantee senior unsecured debt issued by qualifying banks and holding companies between October 14, 2008 and June 30, 2009.  The types of debt covered may include commercial paper, promissory notes, or inter-bank funding.  The guarantees will terminate on June 30, 2012, even if the qualifying debt matures at a later time.

There is a limit on the amount of an institution’s debt covered by the guarantee – 125% of any debt that the institution had outstanding as of September 30, 2008 and that was scheduled to mature before June 30, 2009.  With this limit, the program seems aimed at institutions that desire to roll over existing debt.  Institutions with no debt outstanding as of September 30, 2008 do not appear eligible for the guarantee.

Participants will incur an annualized fee of 75 basis points, multiplied by the amount of debt issued under the program.  

Like those desiring additional deposit insurance coverage, institutions opting for the guarantee will be subject to eligibility requirements – as well as the same type of enhanced supervisory oversight targeting risk taking and rapid growth.

Treasury Purchase of Preferred Stock

The Treasury Department will invest up to $250 billion in non-voting preferred stock of U.S. depository institutions or their holding companies.  Holding companies with investments or activities that are not financial in nature (such as some “grandfathered” unitary thrift holding companies and many corporate owners of ILCs) are not eligible.  Treasury has already allocated $125 billion of investments in nine of the nation’s largest institutions, with the remaining $125 billion purportedly intended for smaller and regional institutions. 

The amount of preferred stock that Treasury acquires generally will be between 1% and 3% of a participant’s risk-weighted assets.   The preferred stock will qualify as Tier 1 capital.  With these investments, Treasury also will acquire warrants to purchase an institution’s common stock having an aggregate market value equal to 15% of the preferred stock investment. The exercise price for the warrants generally will based on the market price for common stock on the date of Treasury’s initial investment, subject to various adjustments.

The preferred stock will pay 5% cumulative dividends for the first five years of issuance, and 9% thereafter.  However, dividends on preferred stock issued by banks that are not in a holding company structure will be non-cumulative.  The preferred stock will have a $1,000 liquidation preference.   The stock will rank senior to an institution’s common stock and at least equal to other existing series of preferred stock.

The institution is free to redeem the preferred stock in whole or in part at any time after three years.  During the first three years, the issuer can redeem the stock only with the proceeds of equity offerings that meet certain requirements.  Following redemption of all the preferred stock, the institution also can redeem any common stock held by Treasury at fair market value. 

Treasury will have the right to transfer the preferred stock and warrants to third parties.  To facilitate such transfers, Treasury will obtain piggyback registration rights and (presumably only as to public issuers) will require shelf registration of the securities, and actual registration at appropriate times.

The catch to this program involves limits on executive compensation.   Participating institutions must ensure that incentive compensation for senior executives does not encourage unnecessary and excessive risks;  must require a “clawback” of any bonus or incentive compensation paid to senior executives that is based on statements of earnings, gains or other criteria that later prove to be materially inaccurate; cannot make golden parachute payments to senior executives; and must agree not to deduct for tax purposes any senior executive’s compensation exceeding $500,000.

Institutions desiring to participate must act quickly and notify Treasury by November 14, 2008.  Treasury will determine eligibility and the amount of investment allocated to a particular participant after consultation with the appropriate regulator.

Interested institutions should ensure that their charters authorize the issuance of preferred stock, or take steps now to amend them accordingly.   Some entities that cannot issue preferred stock, such as subchapter S banks and most mutual institutions, appear ineligible to participate in the Treasury’s program. 

Conclusion

Many more details of these programs have yet to be fleshed out.   Bankers and their boards are well advised to watch for coming developments as they weigh the potential benefits and burdens of participating.  Harris Law Firm PC stands ready to help clients understand how these programs may mesh with their particular circumstances and goals.   


Third Party Risk – Do Your Service Contracts Need an Overhaul?

J
uly 15, 2008

The FDIC last month released updated guidance on managing third party risk – the operational, reputational, compliance, and other risk that banks can face when utilizing the services of third party providers to carry out certain bank functions.   These activities may include IT services, support of lending operations, marketing, human resources administration, and even major construction projects, among others.

The FDIC’s guidance emphasizes that a bank’s board and officers are responsible for managing activities conducted through third parties to the same extent as if the functions were handled within the institution.  The FDIC also spells out detailed standards for a bank’s assessment of the risks posed by a third party relationship, due diligence in selecting potential third party providers, structure and review of contracts with third parties, and ongoing oversight of third parties and their performance.  
 

As if to demonstrate its resolve in this area, just days after the guidance the FDIC announced enforcement actions against three banks and CompuCredit Corporation, a third party that each of the banks utilized to promote credit card products.  The FDIC alleged that CompuCredit had engaged in deceptive marketing practices.  What’s more, the FDIC asserted that the banks had engaged in unsafe and unsound practices by ineffective oversight of CompuCredit’s marketing programs.   One of the banks consented to a $7.5 million civil monetary penalty, while the other two banks vowed to contest the actions. 

Even though the FDIC’s guidance applies only to state-chartered nonmember banks, it is quite similar to bulletins issued several years ago by the OCC for national banks and the OTS for thrifts.  The Federal Reserve does not appear to have issued a comprehensive pronouncement on third party risk, but its examination guidance in various areas for state member banks – such as the sale of securities and insurance on bank premises – incorporates similar principles.   

So whatever your charter, your institution is well advised to assess its third party risk management practices against the regulators’ expectations.  This should include a focus on your bank’s contracts with significant third party service providers. 

Of course, these contracts should clearly delineate the activities that the contract covers, the respective rights and obligations of the bank and the third party, the length of the contract term, and events constituting a party’s default or triggering early termination.  

At a minimum, the contracts also should address the following:

 

  • Obligation of the third party to comply with all applicable laws and regulations, and not to take actions that would result in violations of law by the bank.
  • The frequency and type of management information reports that the third party will provide the bank.
  • The bank’s right to audit the third party, including review of the third party’s financial statements, internal controls, security program and business continuity program.
  • Acknowledgement by the third party that its performance is subject to examination and oversight by the appropriate banking regulators.
  • Restriction on the third party’s use of bank confidential information to that necessary to provide the contracted services.
  • The third party’s obligation to safeguard nonpublic personal financial information concerning the bank’s customers, and its responsibility to notify the bank of any breaches in security or unauthorized data access that may affect the bank or its customers.  
  • The third party’s obligation to back up data files and maintain disaster recovery and business resumption contingency plans.
  • Extent of the third party’s rights to use the bank’s premises, personnel and equipment, as well as its logo, trademarks and other intellectual property.
  • Types and amount of insurance coverage that the third party must maintain.
  • Allocation of responsibility to handle customer complaints relating to the contracted service, if applicable. 
  • Indemnification of the bank for any claims, losses or damages attributable to the actions or inaction of the third party.
  • Especially for services provided overseas, specification of what jurisdiction’s laws will apply to the contract, and the method and location for resolving any disputes.
  • Prohibition of subcontracting or assignment of the third party’s responsibilities to another party without the bank’s advance approval.
  • Extent of the bank’s right to terminate early upon a substantial increase in costs, the third party’s failure to perform or to comply with law, or a change of control or merger involving either party.  
  • Obligation of the third party to return the bank’s data, documents and other property upon termination of the contract. 

Bankers who are negotiating contracts with third parties – or who may be unsure if their existing contracts will withstand examiners’ scrutiny – should consider having them reviewed by competent legal counsel.   Retooling agreements where necessary could help make the next regulatory exam less painful and benefit both the bank and its service provider in the process. 


It’s the Little Things:  OCC Regulatory Revisions Make Life Easier for National Banks

 June 13, 2008

The adage that much of life is made of “the little things” could be said to fit the OCC’s recent revisions to a host of its regulations.   Momentous the changes are not, and they will leave many national banks largely unaffected.  But banks planning to embark on certain activities or investments will find that life has gotten a bit easier for them.  State chartered institutions that enjoy parity statutes also should benefit from those updates relating to the substantive powers of national banks. 

Emanating from the regulatory relief legislation passed in 2006, the changes take effect on July 1, 2008.  Among other things, the revisions:

·         Clarify that organizers of a new national bank do not have to obtain preliminary OCC approval of the charter application before raising capital.  Rather, the bank in organization can launch a stock offering after filing articles of association, an organization certificate, and a completed charter application.    

 

·         Eliminate the requirement to file a Form D with the OCC following a private stock offering.

 

·         Affirm that national banks can invest in funds holding bank-permissible assets other than securities, such as loan funds.

 

·         Clarify that an operating subsidiary can be in the form of a limited partnership, as long as certain conditions are met.

 

·         Expand the availability of after-the-fact notice procedures for conducting new activities in an operating subsidiary.  Additions to the list of qualifying activities include merchant processing, billing and collection services, data processing for unaffiliated customers, and branch management services.

 

·         Open to banks that are not “well-capitalized” or “well-managed” the opportunity to make non-controlling investments in subsidiaries, subject to an application process.

 

·         Eliminate the need to file subsequent applications after first-time regulatory approval to operate an “intermittent” branch serving the same site at regular intervals, such as a branch at a state fair, an annual festival, or a college campus during student registration.

 

·         Simplify the rules for paying dividends and provide boards of directors greater flexibility for declaring dividends as they deem appropriate.

 

·         Expand a national bank’s authority to guarantee the obligations of a customer, subsidiary or affiliate.

 

·         Add the issuance of electronic letters of credit to the list of activities that a national bank can conduct by electronic means.

 

·         Increase the limit on a national bank’s public welfare investments from 10% to 15% of capital and surplus, and simplify the process for obtaining OCC approval of investments exceeding the limit. 

Payment Processors –  Pariahs?

April 30, 2008

The OCC has set its scope on another player in the “beware the company you keep” category: payment processors.   In a Bulletin 2008-12 released last week, the OCC urged national banks to take extra care in their relationships with customers who are in the payment processing business. 

The bulletin explains that providing banking services to a payment processor can expose a bank to risks not usually found in other customer relationships.  A payment processor typically uses its bank as a vehicle for executing transactions for merchants who are the processor’s clients.  For example, a processor may generate remotely-created checks drawn on customers of merchants and deposit them into the processor’s account at the bank.   A processor might also use the bank to originate ACH debits to the accounts of a merchant’s customers.  

 

In these situations, the bank has no direct customer relationship with the merchant, and there are risks to the bank if neither the processor nor the bank has performed due diligence on the merchants for whom the processor is originating payments.   If these merchants obtain payments from consumers by unfair or fraudulent practices, the bank can suffer reputational, transactional, legal and other harm.  The OCC goes so far as to say that banks without appropriate controls to address the risks in these relationships could be viewed as facilitating unlawful activity perpetrated by its customer processor or any of the processor’s merchant clients. 

 

The bulletin calls for banks to implement a due diligence and underwriting policy when taking on payment processors as customers.   Such a policy should require a background check not only of the processor – but also of all the processor’s merchant clients – in order to verify their creditworthiness, business practices, and business legitimacy.    Certain merchants such as telemarketers warrant even higher scrutiny.

 

Banks also must monitor deposit accounts of payment processors for high levels of returns and chargebacks and other unusual patterns of activity that may suggest unscrupulous practices by a processor or its merchant clients. 

 

The day after issuing the bulletin, the OCC showed its resolve in this area by entering into an order and agreement with Wachovia Bank, National Association.  Under the order, Wachovia must pay up to $125 million in restitution to consumers who were victims of unauthorized transactions by payment processors and telemarketers that were customers of the bank.  The OCC characterized Wachovia as engaging in “a pattern of misconduct” owing to alleged shortcomings in its customer due diligence and account monitoring.   A fine and other costs bring Wachovia’s total potential liability to nearly $144 million. 

 

This is not the first time that the federal banking regulators have identified payment processors as posing special risks to banks.  But the OCC’s heightened focus on processors is reminiscent of the scrutiny that the regulators began applying to banks’ relationships with money services businesses (MSBs) several years ago.   The regulators began holding banks accountable to ensure that their MSB customers had effective policies and procedures in place to combat money laundering.   This led many in the industry to claim that banks were being made the “de facto” regulator of MSBs.   As a result, many banks cut MSBs from their customer ranks, and MSBs began encountering difficulty obtaining banking services.

 

Could payment processors be the next “MSBs” for banks?  Bankers can expect their examiners to take a close look at how they initiate and monitor relationships with these customers.

Will Your Business Continuity Plan Hold Water?

April 17, 2008

Banks wanting to ensure their readiness for a catastrophic event – as well as the next visit by examiners – should review the new Business Continuity Planning Booklet released last month by the FFIEC.  The booklet, which forms part of the FFIEC IT Examination Handbook, replaces a previous version from 2003.

Since the time of the earlier booklet, we have experienced hurricanes Katrina and Rita and heightened our awareness of possible pandemic and terrorist threats. The new booklet contains numerous additions and revisions owing to recent “lessons learned.”   

The booklet addresses the need for banks to adopt a business continuity plan (BCP) that outlines procedures for resuming critical functions following a disruptive event.  Even though the booklet is part of a series focusing on IT matters, a BCP must cover all important elements of an institution’s (and any affiliates’) business, not just the technology components.

Before preparing its BCP, a bank should perform a business impact analysis (BIA).  The BIA assesses the potential effects of a catastrophic event on the institution.  It prioritizes the institution’s various functions, estimates the maximum downtime that those functions could sustain without irreparable loss, and sets objectives for recovery of critical operations.  

Next, the institution should perform a risk assessment.  The risk assessment evaluates the assumptions of the BIA by gauging the impact of various threat scenarios, including malicious activity, natural disasters, technical disasters and pandemics.  Threats that are assessed should range from those with high probability but low impact, such as a brief power outage, to those with low probability but high impact, such as a terrorist attack.  The institution should consider its locations, lines of business, and other relevant factors when determining the likelihood of specific types of threats.

The final part of the risk assessment is a “gap analysis.”  This entails comparing the policies and procedures that the institution should adopt for recovery from threats it may face, compared to those currently in place at the bank.  The difference between the two highlights additional risk exposure that management should address when developing the BCP. 

Among other things, the BCP should specify what events or conditions will set the plan in motion and lay out steps for maintaining safety of personnel and minimizing damage incurred by the institution.  The BCP also should detail procedures for recovery of each critical business function; specify how personnel will communicate with one other and with outside parties; and provide for relocation to alternate facilities where appropriate.  In addition, the BCP should outline procedures for approving unanticipated expenses.  Once written, the BCP should be reviewed and approved by the bank’s board and senior management at least annually and disseminated to employees for timely implementation.  

An institution should test its BCP at least once per year through a program established by the board.  Tabletop exercises, walk-through drills, and simulations are all important testing methodologies.   How well the BCP holds up during testing should be evaluated by bank personnel, independently assessed by internal audit or qualified third parties, and reported to the board and senior management.  Finally, management and the board should update and modify the BCP as needed according to test results, changes in business operations, and recommendations of auditors and examiners. 

With the regulators expected to give heightened scrutiny to business continuity issues, bankers are well advised to batten down their BCP hatches.
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Web Hosting Companies