The Office of the Comptroller released its Semiannual Risk Perspective on July 7. The “Spring 2017” edition of the report details strategic, credit, operational, and compliance risks that are top concerns for the federal banking system.
A key takeaway from the report is that strategic risk remains elevated “as banks make decisions to expand into new products or services or consider new delivery channels and continue merger and acquisition activity.”
Banks face competition from nonfinancial firms, including financial technology companies entering the traditional banking industry. “This competition is causing changes in the way customers and financial institutions approach banking,” the report says.
Credit underwriting standards and practices across commercial and retail portfolios also remain an area of OCC emphasis. During the past two years, commercial and retail credit underwriting has loosened, “showing a transition from a conservative to an increasing risk appetite as banks strive to achieve loan growth and maintain or grow market share,” the OCC says.
Operational risk continues to challenge banks “because of increasing cyber threats, reliance on concentrations in significant third-party service providers, and the need for sound governance over product service and delivery.”
Compliance risk also vexes institutions as banks continue to manage money-laundering risks and implement changes to comply with the amended customer protection requirements under the Military Lending Act and integrated mortgage disclosure rules.
The OCC charters, regulates, and supervises national banks and federal savings associations and licenses, regulates, and supervises the federal branches and agencies of foreign banks. The regulator’s National Risk Committee monitors the condition of the federal banking system and emerging threats to the system’s safety and soundness. Its members include senior agency officials who supervise banks of all sizes, as well as officials from the law, policy, accounting, and economics departments.
The NRC meets quarterly and issues guidance to examiners that provides perspective on industry trends and highlights issues requiring attention. The new Semiannual Risk Perspective covers risks facing national banks and federal savings associations based on data for the 12 months ending December 31, 2016.
Among the matters addressed in the report:
- Strategic risk remains elevated as banks make decisions to expand into new products or services or consider new delivery channels and continue merger and acquisition activity.
- Banks face competition from nonfinancial firms, including financial technology (FinTech) companies entering the traditional banking industry. This competition is causing changes in the way customers and financial institutions approach banking.
- Credit underwriting standards and practices across commercial and retail portfolios remain an area of OCC emphasis.
- During the past two years, commercial and retail credit underwriting has loosened, showing a transition from a conservative to an increasing risk appetite as banks strive to achieve loan growth and maintain or grow market share.
- Some banks continue to face challenges complying with Bank Secrecy Act requirements as money laundering and terrorism-financing methods evolve.
- Consumer compliance risk management in some banks has not kept pace with the increasing complexity of the regulatory and risk environment.
Multiple new or amended regulations are posing challenges to change management processes and increasing operational, compliance, and other risks, the report says. These regulations include the integrated mortgage disclosures under the Truth in Lending Act and Real Estate Settlement Procedures Act, the new requirements under the amended regulation implementing the Military Lending Act, and pending changes to the data collection and processing rules for the Home Mortgage Disclosure Act.
The NRC says it is monitoring other risks that warrant awareness among bankers and examiners. “These risks have the potential to develop into broader system-wide issues or have risk characteristics that warrant close attention because of the possible effect on certain banks,” the report says. Among these risks is a heavy reliance on third-party service providers for critical activities and the increasing changes driven by new products offered by emerging FinTech companies create increased risk relating to third-party risk management.
Credit risk in banks with high concentrations in agricultural lending is increasing, the OCC says. Commodity prices for grain crops have declined over the past three years and livestock, and dairy prices have declined over the last two years, resulting in lower income and cash flow for agriculture industry borrowers.
Changes in interest rates and the yield curve are raising interest rate risk. This increased risk is evident in changes in unrealized gains and losses in bank investment portfolios with long duration assets.
The United Kingdom’s planned departure from the European Union may pose operational and strategic risks to some U.S. banks, the report notes. These banks are reassessing staffing and legal entity structures and risk management processes associated with the potential implementation of organizational and geographic change.
Strategic risk continues to be concentrated in midsize and community banks searching for revenue and market niches. The increased pressure for revenue, challenging external economic drivers, and the changing regulatory environment continue to increase strategic risk. “While strategic risk remains elevated for the majority of large banks, these banks continue to improve the effectiveness of their processes and controls to address strategic risk,” the report says.
“Strategic planning remains important for all banks as they adopt and implement innovative products, services, and processes in response to the evolving demands for financial services and the entrance of new competitors, such as out-of-market banks and nonbanks,” it adds. “Boards of directors and management should comprehensively understand the benefits and risks of strategic changes before implementation. Banks involved in responsible innovation should use new products, services, and processes to meet the needs of consumers, businesses, and communities in a manner that is consistent with sound risk management and business strategies.”
As detailed in previous OCC reports, a historically low interest rate environment has resulted in some banks’ asset managers reaching for return by extending credit and liquidity risk exposures, investing in alternative and structured products, or lengthening asset duration. As rates increase, banks should be aware of the implication for earnings. Competitive pressures and strong credit risk appetites have also driven easing in underwriting standards and increased credit risk for some loan portfolios.
“Banks continue to incrementally ease underwriting practices across a variety of commercial and retail credit products to boost or maintain loan volume and respond to competition from bank and nonbank lenders,” the report says. “While easing in underwriting standards slowed in the second half of 2016, credit risk is increasing because of increased risk layering, rising loan policy exceptions, increasing loan-to-value ratios, weaker loan controls or covenant protections, and higher concentrations in commercial real estate loans.
Increased auto-lending risk from several years of strong growth and eased underwriting standards is now materializing in the lagging delinquency and loss severity indicators, the OCC noted. These lagging indicators are likely to continue to increase as loans with more aggressive underwriting mature.
A finding that should surprise no one is that cyber-threats are increasing in speed and sophistication. Timely and thorough software patch and update management, strong risk-based authentication, sound controls, and effective user awareness campaigns and training can help banks avoid phishing, ransomware attacks, and viruses and mitigate other risks, the report recommends.
The number, nature, and complexity of third-party relationships continue to expand, increasing risk management challenges for banks. Consolidation among service providers has increased third-party concentration risk, where a limited number of providers service large segments of the banking industry for certain products and services.
Control breakdowns in the governance of product sales, delivery, and service continue to elevate levels of operational risk and can erode trust in the banking system, the report says. Effective risk management, including effective management processes, promotes timely detection, response and escalation of operational issues to reduce customer impact due to product failures, possible fraud, and potential unfair or deceptive acts or practices.
The volume of products and services and the complexity of end-to-end processes for delivery in large, complex banks is a key driver of high operational risk. “Insufficient monitoring and limited internal testing have failed to detect product and service delivery disruptions resulting in slowed response by banks and elongated impact for customers,” the OCC wrote.
"Compliance risk remains high as banks continue to manage money laundering risks subject to resource constraints in an increasingly complex risk environment and implement changes to policies and procedures to comply with amended consumer protection requirements,” the report adds. “An inability to develop and maintain requisite expertise to successfully implement BSA/AML controls increases the scale of vulnerabilities created by technological developments and innovation.”
Keith Noreika, acting Comptroller of the Currency, introduced the Semiannual Risk Perspective at a press conference last week. “The Semiannual Risk Perspective has become a “must-read” report for our industry since the agency began issuing the report publicly five years ago,” he said.