OCC sets sights on big banks in updated penalty guidance

The OCC’s new CMP guidance, released Tuesday, provides agency supervisors with an updated matrix that significantly increases potential fines for offending institutions. In the 2018 CMP guidance, penalties were largely capped at $150 million for any institution with assets over $100 billion.

The new CMP guidance sets significantly higher penalties for large banks by creating two new categories: institutions with assets from $500 billion to $1 trillion and those with $1 trillion or more in assets.

Fines levied against the worst offenders within those two new categories of banks could total more than $200 million or $400 million, respectively. Banks with assets between $100 billion and $500 billion could still be fined more than $150 million for the most egregious violations of OCC regulations.

This is not to say the OCC has ever really considered a cap on fines, particularly against large banks. As an example, the agency fined Wells Fargo $250 million in 2021 for continued risk management failings and violations of a 2018 consent order. Accompanying that 2018 order was a fine of $500 million against the bank for “unsafe and unsound” practices.

The new matrix contains the same 11 types of aggravating factors for misconduct as the 2018 matrix. Intent is still considered the most important factor in determining the level of severity of the infraction and therefore the size of the fine.

A bank would be considered to have clearly intended to commit misconduct if it is determined to have “deliberately engaged in the conduct that supports the finding of a violation, unsafe or unsound practice, or breach of fiduciary duty.”

Lesser intent “can be demonstrated if, for example, the bank’s policies and procedures explained the correct conduct,” but the bank “disregarded policies or procedures or otherwise failed to ensure that the policies were followed,” according to the OCC.

Intent is assigned a factor of seven in the CMP matrix. Other aggravating factors heavily weighed include concealment (six), loss or harm to consumers or the public (five), previous concern or action for similar violation (five), and continuation of misconduct after notification (five).

The matrix assigns effectiveness of internal controls and an organization’s compliance program an aggravating factor of four. Unlike the other aggravating factors, internal controls and compliance is arranged so that a strong compliance program receives a small aggravating factor score while a poor program receives a higher score.

The OCC supervisor would assign a score in the internal controls/compliance program category by evaluating “whether and how a bank’s internal controls or compliance programs, or lack thereof, contributed to the violation or deficiency in question.”

“Internal control systems or compliance programs that are so lacking as to permit the violation or deficiency to occur and remain undetected should be accorded the most severe score,” the guidance said. “Internal control systems or compliance programs that identified the violation or deficiency, which allowed the bank to initiate timely corrective measures, may receive a lower score.”

Mitigating factors in the new matrix are weighed more favorably than in the 2018 matrix, with self-identification and remediation each a five and restitution a three. In 2018, mitigating factors included good faith before notification (two), full cooperation (two), and restitution (one).

The OCC stressed the new matrices are not the only method by which an agency supervisor should arrive at a fine amount for an offending institution.

“The CMP matrix is a tool to guide the OCC’s decision-making in assessing CMPs in specific cases, but it does not reduce supervisory decision making to a mathematical process,” the agency stated in a bulletin. “The CMP matrix is not a substitute for sound supervisory judgment, and the OCC may depart from the CMP matrix suggestions when appropriate.”