Hello! Kiah here. Welcome to Fintech Takes Banking, my weekly newsletter where I highlight things I think are interesting or important for bankers and the surrounding environs.

Today’s newsletter discusses regulatory, supervisory and legal topics, which can often have very precise meanings. I am not an attorney! I've tried to be precise and specific where most important, but sometimes the legal precision gets in the way of writing sentences that aren’t painful to read.

Also if you're reading this as a respite from Money 20/20: Hi! I hope we cross paths while we're here. 👋🏻

Was this email forwarded to you?

Subscribe Here

At Your Own Risk

Regulators are redefining foundational concepts in bank supervision in an effort to refocus examiners and executives on the greatest risks facing institutions. The question is whether the definitions and standards outlined in the new final rule make things clearer, or more ambiguous and nuanced.

The rule, issued by the Federal Deposit Insurance Corp. and the Office of the Comptroller of the Currency, directs examiners to “prioritize material financial risks over concerns related to policies, process, documentation, and other nonfinancial risks.” The rule defines “unsafe or unsound practice” in banking and revises the supervisory framework for issuing matters requiring attention, or an MRA, and other feedback. It signals a shift in supervisory criticism to focus on underlying risks, rather than the process banks use to manage risk. Alongside the final rule, the FDIC revisited its outstanding supervisory criticisms for institutions and elected to close “a large majority” of them, stating that they don't meet the new standard. Others will be converted to MRAs.

Examiner communication to bank boards and management teams should now center on practices that are “likely to materially harm the financial condition of an institution,” so boards can address them. In simplifying what bank management teams should pay attention to, the rule could narrow and focus the scope of supervisory feedback that gets shared with the bank.

Categorization, prioritization and communication are at the heart of the rule. Today’s newsletter is about semantics. We’ll explore three important phrases in the new rule to better understand the direction of supervision at the FDIC and OCC.

“Unsafe or Unsound”

“Safe and sound” — and the inverted “unsafe or unsound” — have to be two of the most common phrases in banking, certainly in the supervision and examination space. The standard has historic roots dating as far back as the “free banking era” in the 1830s and 1840s, according to a January article from the Bank Policy Institute. Unsafe or unsound practices were codified by Congress in 1966 and have been the standard for bank regulation since then. However, it was never defined by statute.

The final rule addresses that. The agencies defined “unsafe or unsound” practices as “contrary to generally accepted standards of prudent operation” that, if continued, are “likely to” materially harm the institution’s financial condition or “present a material risk of loss to the Deposit Insurance Fund,” or have already “materially harmed the financial condition of the institution.” It specifies that examiners don’t need to wait for harm to manifest to identify issues, but that they should do so when the probability of material harm is “more than speculative or merely possible.”

The agencies’ definition of “unsafe or unsound” has some differences with how courts have conceptualized these risks, which is as a threat to an institution’s financial stability or integrity.

“Material Harm”

The definition of “unsafe or unsound” includes two more terms of art that will be crucial in the application of the new rule. The first is “material,” including its use in the phrases “material risk” or “material harm.”

The rule defines harm to financial condition as “financial losses or other negative impacts to an institution's capital, asset quality, earnings, liquidity, or sensitivity to market risk.” The harm must clear a “materiality” threshold.

What's that? Well it's not a number or amount. The banking agencies opted not to include a quantitative, or numerical, component to this standard. Instead, materiality to a bank’s financial condition will use examiner judgment, based on objective facts and sound reasoning, and should be tailored to a bank’s risk based on its capital structure, complexity, activities, asset size and other financial risk-related facators, wrote Davis Polk in a client brief.

Nonfinancial issues will be evaluated for their ability to threaten material harm to a bank’s financial condition. This could include critical infrastructure, information technology or cybersecurity deficiencies “so severe as to reasonably be expected to cause material financial harm,” according to Davis Polk’s client brief.

“Neither actual but non-material financial losses to the bank nor risks of minor harm to a bank’s financial condition, even if imminent, are sufficient to create an unsafe or unsound practice,” agencies wrote in the final rule.

Importantly, materiality in financial regulation is not the same concept as materiality in securities law and accounting definitions, which is the standard and threshold by which a company has to disclose information. This arena of materiality includes items like “material omissions,” “material nonpublic information,” “material events” and “material misstatements.”

"Generally Accepted Standards of Prudent Operation"

A practice, act or failure to act can be considered “unsafe or unsound” if it diverges from “generally accepted standards of prudent operation.” What does that mean?

This definition also depends on who's asking. The regulators decided not to codify practices or standards or establish a safe harbor or rebuttable presumption for when bank executives’ actions would be presumed to be generally prudent.

According to the agencies, this concept is a matter of examiner judgment but is based on objective facts and sound reasoning, and will be tailored based on the risks associated with an institution’s “capital structure, complexity, activities, asset size, and other financial risk-related factors.”

The standards also have some limits. A bank is not required to adopt what the agencies consider to be best practices and the agencies said they don’t intend to take enforcement actions for prudent operations “merely because they result in risk-taking.”

Your Attention, Please

One area of significant calibration in these announcements is what qualifies for the issuance of MRAs. In the supervisory escalation ladder, MRAs are above supervisory observations but below enforcement actions; they are nonpublic, but still pretty formal feedback. MRAs can be issued for practices that could materially harm a bank’s financial condition if they continued. They can also be issued for violations of law, which the agencies said they intend to limit to substantive violations, such as:

• Violations that show a pattern or are systemic.

• Violations that have, or could be reasonably expected to have, a more than minimal adverse impact on a bank’s financial condition, the accuracy of the bank’s books and records or its customers.

• Violations that require, or could be reasonably expected to require, more than minimal restitution to make the recipients whole.

• Violations that involve insider misconduct or self-dealing.

Under a separate proposal, the OCC would only issue an MRA in response to a “substantive violation” of a banking or banking-related law or regulation. A violation would be substantive if its “nature, duration, frequency or severity” could meaningfully impact the bank or its customers. The OCC stated it would not issue MRAs for “technical” violations, according to Davis Polk.

The agencies also attempted to better separate MRAs from supervisory observations, which are informal observations that identify weaknesses and that could enhance a bank’s policies, procedures or operations without requiring corrective action. That feedback now carries less weight: it doesn’t need to go to the board, and the bank doesn’t have to act on it.

The Eye of the Beholder

The new rule could change how examiners and bankers communicate with each other, by allowing room for their judgment and optionality in acting on some feedback.

On the examiner side, it may alter the reflexive caution and conservatism that examiners sometimes have when it comes to risk-taking at banks. Some parts of this rule retain agency flexibility by carving out room for examiner judgment based on “objective facts and sound reasoning” — another term of art whose meaning seems mostly inferred rather than defined. At the same time, it wants to encourage examiners to use a set of facts or a causation chain, rather than “speculative concerns,” to identify and communicate risks. It’s not just that the bank could lose some money — it’s that a bank could lose money and that could create a material financial risk for the bank or a material risk of loss to the Deposit Insurance Fund.

On the other side of that conversation, the final rule may give bankers more flexibility, and the benefit of the doubt, when they take risks that are based on their judgment and experience. Bank boards and management teams may receive fewer formal findings that examiners track and follow up on in later exams. This may better focus their attention so they can make more progress where it counts.

It remains to be seen whether the new rule could create an information gap that allows issues to fester over time. A former regulator told me that examination staff notice everything in a bank, including little problems that could grow into big problems in the future.

The new rule wants to move away from policy and process adherence, but sometimes the first sign a bank is taking risk is through a policy violation. Maybe that’s a violation in underwriting, or collateral, or borrower concentration or an economic value of equity or interest rate risk violation. Is an examiner who identifies a bank breaking its own policy box-checking, or flagging a material risk? How many policies must a bank violate before it becomes material?

Throughout banking history, risk tends to be taken in good economic times, and realized in bad ones. Think about where weakness or crisis has emerged in banking of late. The bonds that aren’t hedged, that are socked away in held-to-maturity, when rates are low and liquidity is plentiful — is that a material risk and when? Your deposits are sticky but are above the insurance limit and aren't in reciprocals — are you good at gathering deposits or taking unacceptable risk? What about a fintech partnership that increases customers and revenue, but the ledger is a little out of reconciliation — when does that cause harm, and to whom? Or commercial real estate lending that seems safe as long as interest rates don’t change rapidly and everyone always works in an office?

This subjectivity — and the eternal need to calibrate and refine — speaks to the reality that banks are still mostly run, and supervised, by humans. Bankers and examiners may look at the same activity and interpret the risks differently, based on their risk tolerances, past experiences and concerns.

In the past, it may have been more straightforward for examiners to point to process issue deficiencies at banks as a proxy for compliance and risk-taking. Refining and updating this approach the way the OCC and FDIC have, with these three definitions, could introduce elements of nuance and ambiguity where they seek to bring clarity and certainty.

Bank supervision isn’t easy, and this rule makes it harder in some ways. But easy or hard isn’t the measure here — it’s good and effective. The real question now is whether these updates move examination and supervision closer to those objectives.

FROM THE VAULT

What’s on my mind and filling my time:

🐕 They’re all good dogs: A new study found that dogs and infants both listen for consonants to figure out when one word ends and another begins to pick out distinct words in human speech. WHAT.

🍷 My cup runneth over: A wine glut means deep discount for private label wines and potentially “insane” deals, according to this article in Bloomberg News. Cheers to that!

🎙️ On Bank Nerd Corner: Alex joins me for October update to discuss the OCC trust bank lawsuit, agentic bank runs (ahem — drains) and we both share rants.

🛫 Catch me at: AFC Policy Summit on Nov. 17 in Washington. Piper Sandler’s Balance Sheet Strategy Seminar on Dec. 7 in New York.

🎤 Bonus Podcast Rec: Who owns what when it comes to agentic AI tech in banks? That's a question my Agent of Record cohost, Alex McLeod, has been thinking a lot recently. In episode 7 of Agent of Record, with Parlay Finance and me, Alex discusses her proposed shared responsibility model for AI use at banks. Check out the episode* to learn more about what shared responsibility for AI could look like between foundational models, harness providers and financial institutions.

*This rec is brought to you by one of our fantastic brand partners.

Thanks for reading! Also I managed to snag tickets to see "You Can See Everything" on Friday, and the hype is merited. Would love to hear your thoughts! This week is Wicker. 😏 - Kiah