On March 25, 2023, the Office of the Comptroller of the Currency (“OCC”) issued a revised approach to enforcement actions and related matters at the larger banks that it regulates (the “Revised Approach”).1 The Revised Approach describes when and how the OCC will take additional action against a larger bank that exhibits “persistent weaknesses.”
While framed as an enforcement policy, the Revised Approach is likely to have a meaningful impact on the operations and supervision of larger banks. This is because the time limits set forth in the Revised Approach are likely to act as a countdown clock—implicitly prodding larger banks rapidly to remediate issues to avoid being tagged as exhibiting persistent weaknesses.
The Revised Approach is effective immediately. In this Legal Update, we provide background on the supervision of larger banks and discuss the Revised Approach.
Background
In response to the 2008 financial crisis, the OCC established heightened expectations for the governance and oversight of the larger banks that it regulates.2 In 2014, it adopted those expectations as a specialized standard for safety and soundness at larger banks (“Heightened Standards”) and defined larger banks as those (i) with average total consolidated assets equal to or greater than $50 billion or (ii) that the OCC determines are highly complex or otherwise present a heightened risk.3
The core of the Heightened Standards are requirements that (i) a larger bank design and implement a risk governance framework and (ii) the institution’s board of directors oversee that framework.4 The required framework must cover the eight risk stripes defined by the OCC and must be composed of several highly detailed parts. Other mandatory parts of the Heightened Standards include the development of a written strategic plan with at least a three-year horizon, implementation of risk limits, risk data aggregation and reporting, and establishment of talent management processes and compensation and performance management programs. The Heightened Standards also requires a larger bank to manage concentrations of risk, including through limits (i.e., caps on aggregate exposure).
Revised Approach
The Revised Approach is targeted at larger banks that exhibit persistent weaknesses. For this purpose, the definition of larger bank is notably broader than that of the Heightened Standards because it includes banks that are highly complex or otherwise present a heightened risk, even if the OCC has not issued a formal determination under the Heightened Standards that they are larger banks.
Further, for banks with less than $50 billion in total assets, the Revised Approach indicates that the OCC also will consider (i) the structure of a bank’s holding company and whether affiliates engage in nonbank activities and (ii) the extent of the bank’s reliance on third-party service providers. This could subject much smaller banks to the rapid escalation framework based solely on external factors (e.g., unrelated weakness at a bank partner).
The Revised Approach states that persistent weaknesses may include:
- Composite or management component ratings that are 3 or worse, or three or more weak or insufficient quality of risk management assessments, for more than three years;
- Failure by the bank to adopt, implement, and adhere to all the corrective actions required by a formal enforcement action in a timely manner; or
- Multiple enforcement actions against the bank executed or outstanding during a three-year period.
The OCC will be disposed to take additional and increasingly severe action when a bank has continuing, recurring, or increasing deficiencies for a prolonged period, particularly when the bank has not made sufficient progress toward correcting deficiencies. If a bank exhibits persistent weaknesses, the OCC will consider additional actions, such as assessing civil monetary penalties or issuing other enforcement actions against the bank or institution-affiliated parties. Other enforcement actions may include restrictions on the bank’s growth (overall or in discrete areas), business activities, or payment of dividends.
Should a bank fail to correct its persistent weaknesses in response to prior enforcement actions or other measures, the OCC will consider further action to require the bank to remediate the weaknesses. This action could require the bank to simplify or reduce its operations, which could include reducing its asset size, divesting subsidiaries or business lines, or exiting from one or more markets of operation.
The Revised Approach appears to implement the framework set out in a speech from Acting Comptroller Michael Hsu earlier this year.5 In that speech, he indicated that the OCC would use a four-step escalation framework to address supervisor concerns at larger banks. The steps he described were the issuance of (i) a non-public matter requiring attention, (ii) a public enforcement action, (iii) one or more growth restrictions, and (iv) simplification via divestiture. These steps map directly to progression set forth in the Revised Approach.
Conclusion
The Revised Approach operationalizes the four-step escalation framework discussed in Acting Comptroller Hsu’s speech from earlier this year and establishes explicit thresholds for how long a larger bank will have to remediate compliance and risk management issues. These thresholds are likely to drive banks’ conduct to focus on rapid remediation because the alternative will be escalating supervisory and enforcement action. However, as was evident in the reviews of the recent failures of large regional banks, sometimes the oldest issues identified by examiners are neither the most material nor the most pressing concern for a bank. For example, under the Revised Approach, a larger bank would exhibit a material weakness by virtue of having multiple enforcement actions over a three-year period. But some enforcement actions may have little to do with the heightened risk presented by larger banks. By treating all weaknesses in the same manner (or, at least, not distinguishing among underlying causes), the OCC may be inadvertently doubling down on the same supervisory approach that contributed to the recent bank failures.
Finally, the Revised Approach emphasizes the potential imposition of growth restrictions and divestiture orders on larger banks. This recent theme is consistent with commentary from the debate around bank mergers and resolution-related obligations.6 Its inclusion in the Revised Approach, however, indicates that the OCC plans to use these draconian tools on a broader set of banks than just the largest regional banks and in situations other than those that might pose a risk to financial stability. Banks that may have thought they were too small to warrant enhanced prudential regulation might reconsider if the OCC has targeted them for enhanced supervision.
1 OCC, Bull. 2023-16 (May 25, 2023), https://occ.gov/news-issuances/bulletins/2023/bulletin-2023-16.html. The OCC regulates national banks, federal savings associations and federally licensed branches of non-US banks. For ease of reading, this Legal Update refers to all OCC-regulated entities as “banks.”
2 See Remarks by Thomas Curry, Comptroller of the Currency (Dec. 7, 2012).
3 79 Fed. Reg. 54,517 (Sept. 11, 2014).
5 Michael Hsu, Detecting, Preventing, and Addressing Too Big to Manage (Jan. 17, 2023), https://occ.gov/news-issuances/speeches/2023/pub-speech-2023-7.pdf.
6 See our earlier Legal Updates on these debates: https://www.mayerbrown.com/en/perspectives-events/publications/2022/04/us-fdic-requests-comment-on-bank-merger-oversight-framework; https://www.mayerbrown.com/en/perspectives-events/publications/2022/10/us-banking-regulators-solicit-comment-on-resolutionrelated-obligations-for-larger-regional-banks.
