Category: Financial Institutions and Banking

Categories
Financial Institutions and Banking

7 Ways AI is Transforming the Banking Industry

Abstract:   Artificial intelligence (AI) is impacting businesses in virtually every industry today, and banking is no exception. This article notes that banks of all sizes increasingly recognize AI’s potential to help them improve efficiency, reduce costs, enhance the customer experience and combat fraud. It offers seven examples of how banks are using AI, including in customer service, fraud prevention and underwriting decisions.

7 ways AI is transforming the banking industry

Artificial intelligence (AI) is impacting businesses in virtually every industry today, and banking is no exception. Banks of all sizes increasingly recognize AI’s potential to help them improve efficiency, reduce costs, enhance the customer experience and combat fraud. Here are seven examples of how banks are using AI:

  1. Customer service. Banks are using natural language processing and other AI applications to create conversational interfaces, or “chatbots,” that can improve the customer experience. These applications are available to customers 24/7. Plus, with access to troves of data and the ability to learn about specific customers’ behavior and usage patterns, they can offer highly personalized customer support at a fraction of the cost, and often more effectively, than humans.

Among other things, chatbots can answer account inquiries, reset passwords, assist with fund transfers and automatic payments, and assist with loan applications. Some banks also are using AI to recommend financial services and products, though the Consumer Financial Protection Bureau (CFPB) has been critical of the use of AI and chatbots in underwriting in some instances.

  1. Fraud prevention and detection. Traditional approaches to combating fraud are becoming more challenging due to the number of daily transactions and the many customer behaviors that need to be monitored to identify anomalies. AI applications can quickly detect even subtle deviations from customers’ usual account activity and behavior patterns. These trends can alert bank personnel to potentially fraudulent activities that warrant further investigation.

AI also has the ability to monitor bank systems and provide early warnings of cyberthreats, enabling bank personnel to respond quickly and minimize the damage. Examples of cyberattacks include phishing scams, ransomware and other malware, and identity theft.

  1. Underwriting decisions. Banks are beginning to use AI to improve their loan and credit decisions. AI-based systems are able to sift through vast amounts of data to analyze customer behavior and activity patterns that evince creditworthiness. They can also help spot, and flag, behaviors or characteristics that might increase the chances an applicant will default.
  2. Collections. By analyzing customer data, AI can spot warning signs that indicate potential delinquencies or defaults. It also can communicate with customers and offer personalized solutions for helping them get current on their payments and avoid default.
  3. Automation. Strictly speaking, robotic process automation (RPA) isn’t AI, but it has a similar impact on banking processes. RPA refers to software tools that automate time-consuming, repetitive tasks.

Not only does RPA free up bank personnel to focus on higher-value activities, but it also can improve productivity and reduce errors. Examples of the many uses of RPA include inputting data and documents, opening accounts, and processing address changes. In addition, it can be used to automate and standardize many tasks related to customer communications and regulatory compliance.

  1. BSA/AML compliance. AI can be invaluable to Bank Secrecy Act/Anti-Money Laundering (BSA/AML) compliance efforts. It can sift through enormous amounts of transaction data and identify suspicious activities that would be difficult, if not impossible, to detect using traditional methods.
  2. Marketing. By processing and analyzing huge amounts of data, AI can help banks track and even predict market trends. And by collecting data about a bank’s customers, it can reveal untapped sales and cross-selling opportunities.

Here to stay

For banks interested in taking advantage of AI, significant challenges remain, including implementing and maintaining the systems and the extensive data needed to support it. However, as this technology becomes more commonplace and cheaper, its benefits will be difficult to ignore.

© 2023

Categories
Financial Institutions and Banking

Learn From Past Mistakes

 “Postmortems” on failed institutions are instructive for community banks

In the aftermath of three notable bank failures in 2023, federal banking regulators issued comprehensive reports detailing the underlying causes of those failures. These postmortems are must-reads for banks of all sizes because they point out management shortcomings that led to the bank failures — as well as regulators’ plans to become more proactive in addressing bank risks. Here are some highlights of the three reports.

  1. Silicon Valley Bank

According to the Federal Reserve (Fed) report, Silicon Valley Bank (SVB) was “a textbook case” of bank mismanagement. Its senior leadership failed to manage basic interest rate and liquidity risk, which led to a run by depositors. The causes of SVB’s failure were tied to 1) its business model, which was highly concentrated in early-stage and start-up technology companies and relied heavily on uninsured deposits, and 2) its failure to sufficiently address interest rate and liquidity risk. These factors left SVB “acutely exposed to the specific combination of rising interest rates and slowing activity in the technology sector that materialized in 2022 and early 2023,” observed the Fed. Also, SVB had accumulated substantial unrealized losses on available-for-sale (AFS) securities.

In addition to the fact that SVB’s directors didn’t receive adequate risk-related information from management, SVB:

  • Didn’t hold management accountable for effective risk management,
  • Failed its own internal liquidity stress tests and had no workable plan to access liquidity in times of stress, and
  • Managed interest rate risk with a focus on short-term profits, rather than on managing long-term risks and the risk of rising rates.

The Fed also took some of the blame, noting that supervisors didn’t fully appreciate the extent of SVB’s vulnerabilities as it grew rapidly in size and complexity. Thus, it failed to take sufficient steps to ensure that SVB addressed those problems quickly.

  1. Signature Bank

According to the Federal Deposit Insurance Corporation (FDIC) postmortem, the primary cause of Signature Bank’s failure was “illiquidity precipitated by contagion effects in the wake of” deposit runs that led to the failure of SVB and the self-liquidation of Silvergate Bank. The FDIC noted other causes of Signature Bank’s failure included its:

  • Pursuit of “rapid, unrestrained growth” without developing risk management practices and controls appropriate for its size and complexity,
  • Failure to prioritize good corporate governance and heed FDIC examiner concerns,
  • Overreliance on uninsured deposits to fund its rapid growth, without implementing fundamental liquidity risk management practices and controls, and
  • Failure to understand the risks associated with reliance on cryptocurrency deposits.

Like the Fed, the FDIC accepted some responsibility for Signature Bank’s failure, noting that it “could have escalated supervisory actions sooner,” its “examination work products could have been timelier,” and it could have communicated more effectively with the bank’s board and management.

  1. First Republic Bank

According to the FDIC, First Republic Bank failed primarily because of “a loss of market and depositor confidence” in the wake of the SVB and Signature Bank failures, resulting in a bank run. Notably, the FDIC found that First Republic Bank was well run, responsive to supervisory feedback, and implemented appropriate infrastructure, controls and risk management processes as it grew. Nevertheless, specific attributes of its business model and management strategies made it vulnerable to interest rate changes and the contagion effects of previous bank failures, including:

  • Rapid growth,
  • Loan and funding concentrations,
  • Overreliance on uninsured deposits and depositor loyalty, and
  • Failure to sufficiently mitigate interest rate risk.

Again, the FDIC examined its own possible role in First Republic Bank’s failure. Although it was unclear whether earlier supervisory action would have made a difference, the report noted that “meaningful action to mitigate interest rate risk and address funding concentrations would have made the bank more resilient and less vulnerable.”

Stay tuned

To help avoid future bank failures, regulators are considering several changes, including rethinking stress testing requirements; imposing additional capital or liquidity requirements on banks with inadequate capital planning, liquidity risk management, or governance and controls; incorporating unrealized losses and gains into regulatory capital rules; and encouraging banks to avoid concentrations on both sides of the balance sheet.

The extent to which these changes will trickle down to community banks is uncertain. But expect greater regulatory scrutiny in the future, particularly with respect to capital, liquidity risk and interest rate risk.

Sidebar: Role of social media in liquidity risk

An interesting takeaway from the regulators’ postmortems (see main article) is the role that social media, together with banking technology, plays in liquidity risk. In its postmortem on Silicon Valley Bank (SVB), the Federal Reserve (Fed) commented that “social media enabled depositors to instantly spread concerns about a bank run, and technology enabled immediate withdrawals of funding.”

On March 8, 2023, for example, SVB announced a balance sheet restructuring, including a sale of certain securities and an intention to raise capital. The next day, SVB experienced deposit outflows totaling over $40 billion, as uninsured depositors, interpreting the announcement as a signal of financial distress, began withdrawing their funds “in a coordinated manner with unprecedented speed.” According to the Fed, the run appeared to be fueled by social media and the bank’s concentrated network of venture capital investors and technology firms.

© 2023

Categories
Financial Institutions and Banking

Bank Wire

Crypto-assets: Handle with care

In January 2023, the federal banking agencies published “Joint Statement on Crypto-Asset Risks to Banking Organizations.” The statement cautions banks to be aware of — and, if applicable, mitigate — the risks associated with crypto-assets. According to the statement, these risks include:

  • Fraud and scams,
  • Legal uncertainties regarding custody practices, redemptions and ownership rights,
  • Inaccurate or misleading representations or disclosures, including misrepresentations regarding FDIC coverage,
  • Significant volatility, including potential impacts on deposit flows,
  • Stablecoins’ susceptibility to run risk,
  • Contagion risk resulting from interconnections among crypto-asset participants,
  • Lack of mature, robust risk management and governance practices in the crypto-asset sector, and
  • Heightened risks associated with open, public or decentralized networks (for example, lack of governance mechanisms, absence of contracts, or standards to clearly establish roles, responsibilities and liabilities).

The statement instructs banks to “ensure that crypto-asset-related activities can be performed in a safe and sound manner, are legally permissible, and comply with applicable laws and regulations,” including consumer protection laws. Notably, the statement opines that “issuing or holding as principal crypto-assets that are issued, stored, or transferred on an open, public, and/or decentralized network, or similar system is highly likely to be inconsistent with safe and sound banking practices.”

Be prepared to report computer security incidents

As concerns over cybersecurity intensify, banks should be prepared to report computer security incidents to federal regulators quickly. Under a rule that took effect last spring, banks must report computer security incidents that rise to the level of a “notification incident” within 36 hours. The rule defines “computer security incident” as an “occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits.” These incidents aren’t limited to cyberattacks — they also can result from hardware or software failures, human error or other nonmalicious causes.

A computer security incident is deemed to be a notification incident if it’s reasonably likely to materially disrupt or degrade a bank’s 1) ability to carry out banking operations, activities or processes, or deliver products and services to customers, 2) business lines whose failure would result in a material loss of revenue, profit or franchise value, or 3) operations whose failure would pose a threat to U.S. financial stability. All banks should have procedures in place for identifying notification incidents and reporting them to their primary regulators on a timely basis.

© 2023

Categories
Financial Institutions and Banking

Strengthen Your Defenses: Preparing for ransomware attacks

In October 2021, a California community bank was victimized by a ransomware attack. The hackers obtained sensitive information from the bank’s systems, including loan application forms, tax returns, W-2 information, payroll records, names, addresses and Social Security numbers. They threatened to release this information if the bank failed to negotiate.

The bank incurred significant financial costs and reputational damage associated with the attack. It also offered free credit monitoring and identity theft protection services to affected customers. This is just one of many examples of community banks that have been targeted by ransomware attacks in recent years.

Double trouble

There was a time when smaller banks reasonably believed that cybercriminals would leave them alone, because larger institutions offered a bigger payoff. Recently, however, the trend has reversed. Cybercriminals are now targeting small banks, which they believe lack the wherewithal to protect against these attacks and have less robust internal controls than larger institutions.

A new ransomware scheme involves so-called “double extortion” attacks. In a traditional ransomware attack, the cybercriminal sends a phishing email to a bank employee or other user of the bank’s systems. If the recipient clicks on the link in the email, it introduces malware that infects the bank’s system, encrypting its data. The cybercriminal demands a ransom payment in exchange for the decryption key.

In some cases, however, victims were able to quickly restore their systems from unaffected backups and thus refused to pay the ransom. To avoid this result, a double extortion attack involves stealing sensitive data and threatening to release it if the ransom isn’t paid.

Protective measures

To minimize the risks associated with ransomware attacks, community banks should follow industry practices recommended by the Federal Financial Institutions Examination Council (FFIEC) and other federal banking agencies. These include:

  • Regularly assessing the bank’s exposure to ransomware risks and patching any vulnerabilities,
  • Educating employees about the risks of ransomware and training them on identifying and reporting potential attacks,
  • Inventorying hardware, software, connections and data, with programs in place that identify vulnerabilities,
  • Implementing backup systems designed to protect data from cybercriminals,
  • Segmenting networks to limit a cybercriminal’s access within the system if a breach occurs,
  • Managing third-party risks that expose the bank to ransomware attacks,
  • Implementing email filtering processes that identify malicious messages and prevent them from reaching end users, and
  • Restricting the use of employees’ personal devices on the bank’s network.

Be aware that payment of ransomware may result in sanctions if the cybercriminal is listed by the Office of Foreign Assets Control (OFAC) as a known or suspected terrorist or terrorist organization. Reporting ransomware demands promptly to the federal authorities can help mitigate these sanctions. Banks also may need to file Suspicious Activity Reports (SARs) in connection with ransomware payments.

Another critical tool for defending your bank against cyberattacks is a program of regular system vulnerability assessments and penetration tests. Vulnerability assessments involve scanning all internal and external networks to identify security flaws or weaknesses. Penetration testing — a form of “ethical hacking” — involves the intentional launching of simulated cyberattacks to identify any vulnerabilities that can be exploited to compromise the bank’s systems or data. It can also be used to test the bank’s security policies, employees’ security awareness, and the bank’s ability to flag and respond to security issues as they happen.

Typically, vulnerability assessments should be conducted twice a year and penetration testing should be done annually. But the appropriate frequency of testing depends on your bank’s circumstances and resources.

Have a plan

As cyber risks continue to mount, your bank needs a comprehensive cybersecurity plan that reduces risks and minimizes damages should they occur. It should include an incident response protocol for containing an incident, coordinating with law enforcement and third parties, restoring systems, preserving data and evidence, providing customer assistance, and reporting the incident to the relevant federal banking regulator within 36 hours.

© 2023

Categories
Financial Institutions and Banking

How To Assess and Deal With BSA/AML Risks

Over the past few years, many people have turned to electronic banking (e-banking), whether for individual or business purposes. While e-banking may be convenient, it also may increase the possibility of hidden criminal behavior. In addition, compliance with Bank Secrecy Act/Anti-Money Laundering (BSA/AML) laws and regulations is increasingly scrutinized by banking regulators. This puts banks in the middle of a potentially difficult — even dangerous — situation, unless they develop strategies to both assess and handle any related risks.

Get with the program

To help combat money laundering and terrorist financing, banks must develop and implement comprehensive BSA/AML programs. These programs ensure banks know their customers, monitor transactions, identify suspicious activity, and share information with the government and other financial institutions.

Federal regulators emphasize a risk-based approach to BSA/AML compliance. In other words, a bank is expected to conduct a thorough risk assessment and develop policies, procedures and processes that are adequate for its size, location, customer base, products and services.

Determine the impact

E-banking — including online account opening, ATM transactions, Internet banking transactions, remote deposit capture (RDC), telephone banking and mobile banking apps — can increase a bank’s BSA/AML risks. The lack of face-to-face contact in e-banking transactions introduces a heightened level of risk to institutions by making them vulnerable to unauthorized users accessing customer accounts. As your bank introduces new e-banking products and services, it’s imperative to evaluate their impact on your BSA/AML program.

For example, online account opening without face-to-face contact may heighten your risk because:

  • Verifying the customer’s identity is more difficult,
  • The customer may be outside the bank’s targeted geographic area,
  • The customer may perceive these transactions as less transparent, and
  • A front company or unknown third party may use the account.

To mitigate these risks, banks should ensure that their BSA/AML monitoring, identification and reporting systems are properly equipped to flag unusual and suspicious activities conducted electronically. Useful tools include ATM activity reports, funds-transfer reports, new-account-activity reports and change-of-Internet-address reports. Reports that identify related or linked accounts are particularly effective in an e-banking context. These reports reveal accounts with common addresses, phone numbers, email addresses and taxpayer identification numbers.

Additional risk-mitigating controls may include imposing limits on 1) the types and sizes of transactions that can be conducted through e-banking platforms, 2) the volume and frequency of online-initiated transactions, if allowed, and 3) online accounts to ensure they’re offered only to established customers. Banks need to develop effective and reliable methods for authenticating customers’ identities when they open accounts online (such as “out of wallet” questions that only that person can answer).

Reduce RDC risks

While RDC provides obvious benefits to customers, it exposes banks to money laundering, fraud and information security risks. For example, fraudulent, sequentially numbered or physically altered checks may be harder to detect when they’re submitted via RDC. Plus, it’s difficult for banks to control or locate RDC equipment, particularly when foreign correspondents and foreign money service businesses increasingly rely on RDC.

Inadequate controls can result in altered deposit data, duplicate deposits and other problems. Also, customers or service providers typically retain original checks or other deposit items, which may create recordkeeping, data safety and integrity issues.

Potential risk mitigation steps include:

  • Performing a comprehensive RDC risk assessment before implementation,
  • Conducting appropriate customer due diligence and enhanced due diligence,
  • Establishing risk-based parameters for RDC customer suitability, such as lists of acceptable industries and standardized underwriting criteria,
  • Comparing an RDC customer’s expected account activity to actual activity,
  • Establishing RDC transaction limits, and
  • Ensuring that RDC customers receive adequate training.

Contracts should clearly set out the relative roles, responsibilities and liabilities of the bank and its customers with respect to RDC transactions. This includes procedures for handling and disposing of original documents.

Being vigilant

Make sure your bank remains watchful for ongoing BSA/AML issues and other potential risks resulting from e-banking. There’s no going back — e-banking is here to stay. The best strategy is to ensure your bank remains fully compliant, with all appropriate processes and procedures in place.

© 2023

Categories
Financial Institutions and Banking

Should You Outsource The Internal Audit Function?

A solid internal audit program is one of the most effective tools a bank has to inspire confidence — among directors, investors, regulators, and other stakeholders — in its financial processes and reporting practices. Many banks outsource the internal audit function, in whole or in part, to take advantage of external auditors’ special skills and independence, address internal staffing shortages, and control costs. Here are some factors to consider when deciding whether to outsource this function.

Advantages of outsourcing

First and foremost, by outsourcing the internal audit, a community bank can tap a level of skill and expertise — critical in the highly regulated banking industry — that may be difficult to find or too expensive to maintain in-house. Access to this expertise is particularly beneficial for banks in smaller communities and those that want to expand their product or service offerings or enter new markets. External auditors may also have access to more sophisticated software or other audit tools that would otherwise be cost-prohibitive for a community bank.

Second, in the wake of the COVID-19 pandemic, many businesses, including banks, are facing severe labor shortages. Outsourcing the internal audit function allows them to focus on filling core positions.

Third, outsourcing can help a bank control costs. It allows the bank to set an internal audit budget that meets its needs and design a program that has more flexibility. The bank avoids the fixed labor and overhead costs associated with an internal audit staff, and it can adjust the use of outside consultants as its internal audit needs fluctuate or special projects arise.

Finally, outsourcing can help enhance auditor independence. In-house auditors who develop relationships with other bank staff may lose some objectivity — or at least the appearance of objectivity. Outsourcing also facilitates the rotation of internal auditors, something that’s difficult to do in-house.

Disadvantages of outsourcing

One potential downside is that outside consultants generally lack an insider’s in-depth knowledge about the bank’s operations, particularly when outsourced auditors are rotated frequently. The resulting learning curve may reduce the cost-effectiveness of an outsourced audit. To overcome this obstacle, some community banks outsource the internal audit function to their external auditors. Although doing so is permissible under specific circumstances, a bank should consider the potential impact on the external auditor’s independence before taking this approach.

Also, outsourcing arrangements require meticulous planning and monitoring, including a comprehensive engagement letter and regular communication. It’s critical to ensure that the parties are on the same page regarding the auditing firm’s activities, the scope of the audit and the advice provided by the auditor.

Outsourcing vs. co-sourcing

Co-sourcing can be an attractive alternative to fully outsourcing the internal audit function. As the name suggests, it involves splitting internal audit activities between internal and external auditors. This approach can take many forms, depending on the bank’s needs. A short-staffed bank might use outside auditors to supplement its staff and share various auditing tasks and responsibilities.

Co-sourcing also can be a good strategy if a bank’s internal audit staff lacks certain specialized skills. For example, if in-house staff isn’t equipped to perform specialized audits — such as information technology or Bank Secrecy Act/Anti-Money Laundering (BSA/AML) audits — the bank might engage an outside auditor to conduct those audits while its internal staff focuses on areas within its skill set.

A powerful tool

A well-designed internal audit program can be a powerful tool for evaluating a bank’s internal controls, processes, and procedures. Internal auditors also can recommend improvements and share their findings with the bank’s board of directors and other stakeholders. Whether conducted in-house, outsourced or co-sourced, an internal audit provides an opportunity for a fresh look at a bank’s operations by auditors who are independent from management.

Sidebar: Managing third-party risk

For banks that outsource or co-source the internal audit function, it’s important to recognize that doing so doesn’t absolve the bank’s board or management from responsibility for the internal audit. This function also doesn’t relieve the bank from liability for compliance or consumer protection issues associated with outsourced activities.

Before you enter an outsourcing relationship, review the federal banking regulators’ guidance on managing third-party risk, including the Office of the Comptroller of the Currency’s “Interagency Policy Statement on the Internal Audit Function and its Outsourcing.” Failure to properly manage this risk can result in financial loss and regulatory action. It can also jeopardize your bank’s reputation.

Among other things, a bank should:

  • Conduct a risk assessment to weigh the benefits and risks, including service provider risk, of outsourcing the internal audit.
  • Exercise due diligence in vetting the provider — including an examination of its background, reputation, financial condition, internal controls, disaster recovery plans, and business continuity plans.
  • Be sure that the contract or engagement letter clearly spells out each party’s rights and responsibilities. (For example, it should provide details on performance benchmarks, information sharing, audit rights, compliance, confidentiality, and indemnification.)
  • Monitor the provider’s performance and compliance with contract terms throughout the life of the arrangement.
  • Have a contingency plan in place in the event there are any disruptions in service.

© 2023

Categories
Financial Institutions and Banking

Bank Wire

FDIC offers guidance on multiple NSF fees

Recently, the FDIC issued guidance to address consumer compliance risks associated with assessing multiple nonsufficient funds (NSF) fees arising from re-presentment of the same unpaid transaction. This issue often comes up when transactions are presented for payment that can’t be covered by a customer’s balance, the bank charges NSF fees and the merchant subsequently resubmits the transaction for payment.

According to the FDIC, if the bank charges additional NSF fees for the same transaction, there’s “an elevated risk of violations of law and harm to consumers.” This risk may arise, for example, because disclosures didn’t fully or clearly describe the bank’s re-presentment policy by explaining that the same unpaid transaction might result in multiple NSF fees. As a result, there may be a heightened risk of violating the Federal Trade Commission Act’s unfair or deceptive acts or practices (UDAP) provisions.

The guidance encourages banks to review their practices and disclosures regarding NSF fees for re-presented transactions and to adjust them if necessary. If violations are noted, the FDIC expects banks to make restitution.

Complying with the updated FTC Safeguards Rule

In December 2021, the Federal Trade Commission (FTC) updated its Standards for Safeguarding Customer Information (Safeguards Rule). It’s generally applicable as of January 10, 2022, with some requirements taking effect December 9, 2022. According to the FTC, the amended rule preserves the flexibility of the original while providing more concrete guidance. “It reflects core data security principles that all covered companies need to implement,” the FTC explains. Some institutions are exempt, including those that maintain customer information concerning fewer than 5,000 consumers.

Financial institutions — including mortgage lenders, collection agencies, tax preparation firms, and non-federally insured credit unions — should review their information security programs to ensure that they comply with the latest standards. A good place to start is the FTC’s publication, “FTC Safeguards Rule: What Your Business Needs to Know,” which you can find at https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know.

Failure to safeguard data may violate consumer protection laws

In a recent circular, the Consumer Financial Protection Bureau (CFPB) confirmed that banks and other financial companies that fail to safeguard consumer data may violate federal consumer financial protection laws. The circular warns companies they risk violating the Consumer Financial Protection Act if they fail to have adequate measures to protect against data security incidents. It also provides examples of data security measures that, if not implemented, may trigger liability. These include multifactor authentication, adequate password management, and timely software updates.

© 2022

Categories
Financial Institutions and Banking

Should Community Banks Think About ESG Initiatives?

An increasing number of organizations — including many banks — are embracing environmental, social, and governance (ESG) initiatives. Although being a good corporate citizen may be its own reward, there’s evidence that responsible ESG practices may produce ample financial benefits.

What is ESG?

ESG generally refers to:

  • Environmental practices, including your bank’s use of energy, production of waste, and consumption of resources,
  • Social practices, including fair labor practices, worker health and safety, diversity and inclusivity, and other aspects of your bank’s relationships with people, institutions, and the community, and
  • Governance practices, including business ethics, integrity, openness, transparency, legal compliance, executive compensation, data protection, and product quality and safety.

Simply put, ESG means recognizing your bank’s impact on the environment and the people and institutions it interacts with.

Why should you care?

In recent years, pressure has been increasing on all businesses, including banks, to adopt responsible ESG practices. This pressure has been coming from a variety of stakeholders. For example, customers are increasingly considering ESG issues — such as product safety, environmental impact, and fair labor practices — when deciding which organizations to do business with. And many investors are making ESG a priority when deciding where to invest their capital.

Consider this: The U.S. Forum for Sustainable and Responsible Investment reported that from 2018 to 2020, the value of U.S. assets managed according to ESG principles increased from $12 trillion to $17 trillion. This represents one-third of all assets under management.

Another reason to adopt ESG practices is its potential impact on financial performance. A number of studies have shown that embracing ESG can lead to higher sales, reduced costs (including energy and compliance costs), and increased access to capital. Consulting firm McKinsey reviewed more than 2,000 academic studies of ESG and found around 70% report a positive relationship between ESG scores and financial returns, whether measured by returns on equity, profitability, or valuation multiples.

ESG also may improve a bank’s ability to attract and motivate talented employees — a significant benefit given the ongoing shortage of qualified workers. According to McKinsey, “A strong ESG proposition can help companies attract and retain quality employees, enhance employee motivation by instilling a sense of purpose, and increase productivity overall.”

Will ESG initiatives be mandated?

To date, ESG initiatives have been voluntary, but that could change as federal financial regulators are starting to pay more attention to ESG issues. For example, the FDIC and Office of the Comptroller of the Currency (OCC) have issued draft principles for managing exposures to climate-related financial risks. Although the proposals target larger banks, regulators have indicated that they expect community and midsize banks to develop climate-related financial risk management practices. The Securities and Exchange Commission has also proposed ESG disclosure requirements for companies it regulates. And the Federal Housing Finance Agency (FHFA) has added “resiliency to climate risk” to its list of institution assessment criteria.

Finally, although not yet required, an increasing number of companies are incorporating ESG information into their financial reports, combining nonfinancial and financial information into an integrated report. Many experts believe that these reports provide a more accurate picture of a company’s long-term value-creation potential. Banks should consider whether they should prepare this type of report or ask their customers to do so.

Can ESG initiatives benefit your bank?

Adopting ESG initiatives is viewed by many as a best practice, but it may very well be required — or at least strongly encouraged — by regulators in the future. Banks might benefit from evaluating the ESG impact of their activities and considering ways to incorporate ESG practices and initiatives into their operations.

© 2022

Categories
Financial Institutions and Banking

True or False? Assess Borrowers’ Financial Restatements

Businesses need to assess their financial status periodically in light of changing economic or industry conditions. This includes examining their financial statements to ensure the statements continue to be adequate, accurate and complete. Occasionally, business owners or financial officers may determine that the financial statements need to be revised or corrected. When your borrowers provide you with corrected or restated financial statements, be vigilant and double-check the numbers. It may be that the restatements simply correct an honest mistake. Alternatively, there may be fraud involved.

When a mistake becomes intentional

When Tom took over his aunt’s marketing company, the lender quickly discovered that Tom’s accounting skills hadn’t kept pace with his marketing abilities. The company engaged in various types of related-party transactions, including seller financing and a leasing arrangement with the previous owner. Tom also seemed unsure when to capitalize or expense supplies and equipment.

After two years of sloppy, delayed financial reporting, Tom’s lender recommended hiring an accountant for financial reporting and tax expertise. Shortly thereafter, the lender received an unwelcome surprise: The company needed to reissue its financial statements for the past three years.

Ultimately, the restatements revealed that Tom had overstated profits by more than $3 million over the last three years. When confronted with the news, he confessed that he’d been intentionally padding profits, because he didn’t want to disappoint his aunt.

The lender called the company’s $4 million line of credit. Tom was forced to confess his mismanagement to his aunt, who eventually left retirement to turn around the business.

When complex rules invite misinterpretation

Not all restatements result from misleading or unethical management. Often owners and managers just aren’t on top of today’s increasingly complex accounting rules — and honest mistakes or misinterpretations cause a restatement.

Restatements typically occur when the company’s financial statements are subjected to a higher level of scrutiny. For example, restatements may happen when a borrower converts from compiled financial statements to audited financial statements or decides to file for an initial public offering. They also may be needed when the borrower brings in additional internal (or external) accounting expertise, such as a new controller or audit firm.

The restatement process can be time-consuming and costly. Regular communication with interested parties — including lenders and shareholders — can help overcome the negative stigma associated with restatements. Management also needs to reassure employees, customers and suppliers that the company is in sound financial shape to ensure their continued support.

When errors become significant

Errors are a common cause of financial restatements. For example, borrowers sometimes make mistakes when accounting for leases or reporting compensation expense from backdated stock options.

Income statement and balance sheet misclassifications also cause a large number of restatements. For instance, a borrower may need to shift cash flows among investing, financing and operating on the statement of cash flows. Other leading causes of restatements are equity transaction errors, such as improper accounting for business combinations and convertible securities, and valuation errors related to common stock issuances. Preferred stock errors and the complex rules related to acquisitions, investments, revenue recognition and tax accounting also can cause restatements.

You can minimize your dependence on bad numbers by requiring independent audits for private borrowers. You also may request cost-effective internal control testing procedures for prospective and high-risk borrowers, such as those that engage in hedge accounting, issue stock options, use special purpose or variable interest entities, or consolidate financial statements with related parties.

Mistakes happen

Even the most well-managed business may slip up and make financial statement mistakes that need to be corrected. But some restatements are a warning flag — not just of potential fraud but of mismanagement or carelessness. When a borrower presents you with financial restatements, investigate the underlying cause to stay ahead of any potential problems.

© 2022

Categories
Financial Institutions and Banking

Monitoring and Managing Interest Rate Risk

For community banks, interest rate risk is a part of doing business, so it’s critical for banks to monitor that risk and take steps to control it. The “right” level of risk depends on several factors, including the size and complexity of a bank’s operations, as well as the sufficiency of its capital and liquidity to withstand the potential adverse impact of interest rate fluctuations.

Managing interest rate risk is particularly important in light of recent rate increases. The Office of the Comptroller of the Currency (OCC), in its Fiscal Year 2023 Bank Supervision Operating Plan, instructed examiners to determine whether banks appropriately manage interest rate risk through “effective asset and liability risk management practices,” noting that “rising rates may negatively affect asset values, deposit stability, liquidity, and earnings.”

Types of interest rate risk

In simple terms, interest rate risk means risk to a bank’s financial condition or resilience (that is, its ability to withstand periods of stress) caused by movements in interest rates. There are several types of interest rate risk, including:

Repricing risk. Banks experience this risk when their assets and liabilities reprice or mature at different times. Suppose, for example, that a bank makes a five-year, fixed-rate loan at 7% that’s funded by a six-month certificate of deposit (CD) at 3%. Every six months, when the CD renews, the bank is exposed to repricing risk. If the CD rate increases to 4% after six months, then the bank’s net interest income drops from 4% to 3%. Conversely, if the CD rate declines, the bank’s net interest income increases.

To gauge repricing risk, banks can compare their volume of assets and liabilities that mature or reprice over a given time period. The potential impact of fluctuating interest rates will depend in part on whether a bank is asset- or liability-sensitive. If it’s asset-sensitive — meaning assets reprice more quickly than liabilities — then its earnings generally increase when interest rates rise and decrease when they fall. If it’s liability-sensitive — meaning liabilities reprice more quickly than assets — then its earnings generally increase when interest rates fall and decrease when they rise. Some banks are neutral — that is, their assets and liabilities reprice at the same time.

Basis risk. This risk arises when there’s a shift in the relationship between rates in different markets or on different financial instruments. Suppose, for example, that an asset and a related liability are tied to the prime rate and the one-year U.S. Treasury rate, respectively. If the spread between those two rates widens or narrows, it will affect the bank’s net interest margins.

Yield curve risk. This risk arises from changes in the relationships among yields from similar instruments with different maturities. Suppose, for example, that a bank funds long-term loans with short-term deposits. A typical yield curve reflects rates that rise as maturities increase. However, if market conditions cause the yield curve to flatten or even slope downward, the bank’s net interest margins can shrink or even turn negative.

Options risk. Bank assets and liabilities often contain embedded options, such as the right to pay off a loan or withdraw deposits early with little or no penalty. The bank is compensated for offering customers this flexibility (typically in the form of higher interest rates on loans or lower interest rates on deposits). But granting these options creates interest rate risk. For example, if interest rates go up, deposit holders will have an incentive to move their funds into investments that enjoy higher returns. If rates go down, many borrowers will pay off their loans so they can refinance at a lower rate.

Another risk associated with rising interest rates is an increased risk of default by borrowers with variable rate loans.

Managing the risk

Banks can apply financial modeling techniques to measure and monitor their interest rate risk. If your interest rate risk is unacceptably high, consider strategies for mitigating it, such as:

  • Adjusting your bank’s mix of assets and liabilities to reduce interest rate risk,
  • Increasing capital to help the bank absorb the impact of fluctuating interest rates,
  • Reducing options risk by controlling the terms of loans and deposits, or
  • Using interest rate swaps or other techniques to hedge against interest rate risk.

Keep in mind that a key component of interest rate risk management is stress testing. (See “Stressing out about interest rate risk” below.)

Look at the big picture

This article focuses on interest rate risk, but it’s important to keep in mind that many of the risks banks face are interrelated. Thus, management of interest rate risk should be incorporated into a bank-wide risk management system.

Sidebar: Stressing out about interest rate risk

The Office of the Comptroller of the Currency (OCC) provides guidance on managing interest rate risk. The guidance urges banks to conduct periodic stress tests that include both scenario analysis and sensitivity analysis. Stress testing can help a bank manage risk by evaluating the possible impact of various adverse external events on a bank’s earnings, capital adequacy, and other financial measures.

Scenario testing examines the potential impact of various hypothetical or historical scenarios — such as rising or falling interest rates — on the bank’s financial performance. Sensitivity analysis estimates the impact of changes in certain assumptions or inputs into a financial model. It helps the bank determine which assumptions have the greatest influence on outcomes and fine-tune its assumptions accordingly.

© 2022