Risk-Focused Supervision Webinar Questions and Answers
On March 6, 2014, the Federal Reserve System conducted an Outlook Live webinar titled “Community Bank Risk-Focused Consumer Compliance Supervision Program.” Participants submitted a significant number of questions before and during the session. Because of time constraints, only a limited number of these questions were answered during the webcast. This article addresses some of the other questions we received.1
In the current climate, there are many demands on our staff’s time and it is a challenge to stay on top of regulatory issues. Can you cut to the bottom line and tell me how my examinations will change?
You will likely see a shift in examination time, with more time spent during the risk assessment and examination planning process before examiners enter your bank and less time spent on low-risk issues. This may result in shorter on-site examinations.
Specifically, examiners will develop an institution profile and a comprehensive risk assessment for the products, services, and activities that are material to the bank and evaluate the controls in place to manage those risks before an on-site examination is conducted. The enhanced risk assessment will permit examiners to more precisely scope and plan the on-site portion of the examination and customize examination work to the residual risk of the bank’s products or services. This means that examiners will focus on areas where residual risk is elevated and not on areas where inherent risk is well controlled and residual risk is limited or low.
Examiners will also contact you between examinations. The program includes ongoing supervision, which will typically be a touch point at the midpoint of the examination cycle. Ongoing supervision will help examiners understand changes in the types and complexity of product offerings and the consumer compliance management program. It also ensures that our supervisory information is up to date. Ongoing supervision allows for more engagement in the supervisory process and timely communication from both the institution and the examiners.
What products will examiners consider to be high risk?
Product risk is evaluated based on the inherent risk factors identified in the risk-focused supervision (RFS) program and the extent to which the associated risk controls effectively mitigate that risk. The scope and examination work plan are driven by residual risk, not inherent risk alone. Therefore, even if a product is subject to more complex regulations and is considered higher risk, the bank’s control of that risk will be considered. Of course, there could be some products — especially new ones — with high inherent risk where it may be appropriate for the examiners to test the efficacy of the controls before concluding that the inherent risk is effectively mitigated.
Because of the new risk-based examination approach, is it possible that transaction testing will not be performed for every regulation?
Yes, that is correct. Under the new program, examiners are not expected to transaction test every regulation. One of the core principles of the RFS program is that examination resources should be allocated based on risk. If, after balancing the level of inherent risk and the effectiveness of risk controls, the residual risk is limited or low, no transaction testing will likely be required. Even when residual risk may be higher for a particular product, it may be the case that risks are associated with only certain aspects of the product. In such cases, examiners may test compliance with regulations related to those higher residual risk elements, while they may choose not to test rules related to other aspects of the product where evidence indicates compliance risk is adequately controlled. For example, examiners may choose to test compliance with advertising rules but not other disclosure rules if the examiners’ concerns are solely related to advertising.
How is materiality defined or measured?
Examiners will evaluate product materiality as part of the risk assessment process. Materiality considers the relative importance of a product within the context of the bank’s business model and strategic plan. It is determined primarily by volume, as measured in numbers, dollars, or both. A product with greater volume compared to other products will be considered more material than a product with less volume. For example, examiners may determine that a product is not material because it has a very low level of activity. On the other hand, examiners may determine that a product with significant volume is material, even if the product has lower volume than other products. Furthermore, examiners will take into account potential growth in a product. Accordingly, a new product with only nominal activity at the time of the examination may be considered material due to anticipated product growth, particularly if the product is closely aligned with the bank’s business model and/or strategic plan.
We note that materiality does not only consider originations. For some bank activities, such as loan servicing, the appropriate gauge for materiality would be the number of loans serviced and/or the dollar size of the serviced portfolio. Regardless of a product’s materiality, the bank is expected to comply with all applicable consumer protection laws and regulations. Evaluating management’s willingness and capacity to comply will be part of the assessment of the effectiveness of the consumer compliance management program.
I’ve seen assessments of a bank’s inherent/residual risk where risk ratings are assigned to each regulation rather than to specific products. Is this method outdated?
The RFS program evaluates the overall risks of products, not regulations. Nonetheless, the laws and regulations that apply to a product — and the associated complexity of those regulations — remain an important factor when establishing the inherent risk of a product. Legal and regulatory risks, however, are not the only factors considered. Bank decisions concerning the features of a product and how the product is delivered are also important indicators of an institution’s risk appetite. A product that has many types of fees imposed under different conditions may have more risk than a similar product with a much less complex fee structure, even though both are subject to the same regulations. And a product delivered only through a bank’s branch locations will likely involve less risk than the same product delivered by third parties or via the Internet.
How will the institution’s overall control of compliance risk (oversight, policies and procedures, etc.) impact the rating of residual risk associated with a specific product risk?
An institution’s consumer compliance management program will have an important impact on the examiner’s assessment of residual risk. The residual risk of a product is determined by balancing the inherent risk of an activity with the overall strength of the risk controls for that activity. Accordingly, an institution with strong controls, policies, and procedures will likely have a more favorable residual risk rating than an institution that offers the identical product without adequate compliance management.
Will an examiner’s risk assessment be shared with the financial institution?
While the risk assessment document is considered part of the examination work product and is not shared, examination staff will convey to bank management the products and services that the examiner considers to have higher residual risk and the basis for these conclusions. Additionally, the work program’s scope will reflect the products and services that examiners consider to contain higher risk; the associated examination activities will be consistent with a product’s elevated residual risk. Finally, the report of examination will include an evaluation of the consumer compliance management program. Thus, the bank should have a full understanding of the examiner’s view of the risks associated with the bank’s products or services.
My business model and strategy are plain vanilla and stable. I already spend a lot of time on consumer compliance and keeping up with all the regulatory changes. Will this program increase my regulatory burden?
We expect that examiners will spend less time on low-risk compliance issues at community banks, increasing the efficiency of our supervision and reducing regulatory burden on many community banks. Our consumer compliance examiners now will base examination intensity more explicitly on the individual community bank’s risk profile, weighed against the effectiveness of the bank’s compliance controls. Examiners will perform more comprehensive risk assessments before they are on site at the bank. Thus, if a bank maintains a strong consumer compliance management program that effectively identifies and manages the consumer compliance risks of its products, services, and activities, on-site examinations will likely be shorter.
Specific issues and questions should be raised with your local Federal Reserve Bank.
- 1 The webinar has been archived and is available on our website.