Office of the Comptroller of the Currency Releases Report on Key Risks for Banks

On June 14, 2023, the Office of the Comptroller of the Currency (“OCC”) issued its semiannual report on the key issues facing the federal banking system (the “Report”), focusing on those that threaten the safety and soundness of banks, their ability to provide fair access and fair treatment to customers, and their compliance with applicable laws and regulations.¹ The report generally reflects data as of December 31, 2022, but also includes economic data and liquidity issues arising in the first few months of 2023.

Consistent with press reports, the Report indicates that the OCC closely monitored the condition of the institutions it supervises during the bank failures earlier this year and engaged directly with its banks to ensure they were appropriately managing their risks.² The Report urges OCC-regulated banks to remain diligent and maintain effective risk management practices over critical functions to continue to withstand current and future economic and financial challenges.

The Report also highlights key liquidity, operational, credit, and compliance risk themes. These include:

• The OCC’s belief that banks have strengthened their liquidity levels in response to the recent bank failures and more general declines in investment portfolios. However, banks should remain focused on stabilizing liquidity and maintaining public confidence in the banking system.
• Credit risk remains moderate in aggregate, but signs of stress are increasing, for instance in certain segments of commercial real estate. Further, persistent drag from high inflation and rising interest rates is causing credit conditions to deteriorate.
• As it has been for many years, operational risk remains elevated and an area of focus for the agency, accounting for 45% of outstanding Matters Requiring Attention at OCC-regulated banks. Cybersecurity threats persist, and the digitalization of banking products and services is expanding, especially as banks increase use of third parties to provide critical services. This expansion presents both opportunities (e.g., greater efficiencies) and risks for banks.
• Compliance risk also remains elevated. Banks continue to operate in a dynamic environment in which compliance management systems are challenged to keep pace with changing products, services, and delivery channel offerings developed in response to customer needs and preferences.

The Report highlights the OCC’s initiative on managing climate-related financial risks to the federal banking system. While this may not currently be a material risk for many banks, it clearly is an area of focus for the agency and something we expect to see in future releases. Supervisory efforts in this area are generally focused on institutions with total assets in excess of $100 billion.

The Report also highlights the risks related to banks continuing to use aging and obsolete technology. While it encourages banks to maintain their technology infrastructure and avoid accumulating a tech debt, it offers little in the way of practical steps for regional and community banks. These banks in particular continue to confront the problem of being burdened with increasing supervisory expectations and remaining too small to effectively compete against G-SIBs and less-regulated fintechs.

Conclusion

The Report walks a fine line between identifying risks that should be prudently managed and falling prey to the “Chicken Little” syndrome of identifying every known risk as key or critical. As we know from the COVID-19 pandemic, the most significant risks facing the banking system may come from areas that were not even on the industry’s radar, let alone identified by regulators. Therefore, banks should consider the key risks identified in the Report while remaining focused on executing their enterprise-wide risk management practices.

Additionally, the Report offers much in the way of data and risk information but little in the way of practical advice on how to manage the risks. Much of its advice is targeted at G-SIBs and larger banks with total assets in excess of $100 billion, most of whom already have sophisticated risk management frameworks. Smaller regional and community banks might be better served with more targeted guidance on how to manage these specific risks with the resources they possess.

¹ OCC, NR 2023-60 (June 14, 2023), https://www.occ.gov/news-issuances/news-releases/2023/nr-occ-2023-60.html.

² For more information on the recent bank failures, please see our portal: https://www.mayerbrown.com/en/capabilities/key-issues/distressed-banks-and-emerging-legal-issues?tab=overview.