What are the top risk areas for national banks and federal savings associations? According to the Office of the Comptroller of the Currency’s (OCC) Semiannual Risk Perspective for Spring 2017, there are four: strategic, credit, operational and compliance.
What happened
Drawing on bank financial data as of Dec. 31, 2016, the OCC’s Semiannual Risk Perspective notes improvement for the federal banking system over the prior 12-month period, with a 3.6 percent increase in total revenue and a 3.9 percent jump in net income. While loan growth slowed in the second half of 2016, banks of all sizes have experienced consistent loan growth for the past three years, particularly in the areas of residential and commercial real estate. The number of enforcement actions decreased and the number of banks at risk of failure continued to decline.
With this background, the agency discussed the key risks facing the federal banking system, which have remained “relatively unchanged” from its previous semiannual report. Strategic, credit, operational and compliance risk remain top concerns, with compliance bumped up to a key risk issue and auto lending recharacterized from a key risk issue to an issue warranting continued monitoring.
The OCC described strategic risk as “elevated” (particularly for midsize and community banks) given business model changes, the consideration of mergers and acquisitions, and the potential need to adapt in an uncertain regulatory climate. “Management teams are searching for sustainable ways to generate target rates of return in a persistent low interest rate environment despite recent and anticipated interest rate increases,” according to the report.
In addition, banks face competition from nonfinancial firms―including fintech companies entering the traditional banking industry―triggering changes in the way customers and financial institutions approach banking.
Turning to credit risk, the OCC found that competitive pressure and strong credit risk appetites have driven easing in underwriting standards and increased credit risk for some loan portfolios. Banks are continuing to incrementally ease their underwriting practices across a variety of commercial and retail credit products, the report said, and supervisory reviews are identifying concerns about the quality of CRE loans, amplified by growth in CRE portfolios over the past two years.
As to operational risks, the regulator emphasized the increasing dangers of cyber threats, which are increasing in both speed and sophistication. “Timely and thorough software patch and update management, strong risk-based authentication, sound controls, and effective user awareness campaigns and training can help banks avoid phishing, ransomware attacks, and viruses and mitigate other risks,” the OCC observed. The growing number, nature and complexity of third-party relationships also create operational risks, especially as consolidation among service providers has caused increased concentration risk.
Rounding out the four top areas of risk, compliance risk “remains high” as banks try to manage money laundering risks in an increasingly complex risk environment, the semiannual report found, with banks continuing to struggle with Bank Secrecy Act and anti-money laundering requirements.
Multiple changes in consumer protection law―such as the integrated mortgage disclosures under the Truth in Lending Act and the Real Estate Settlement Procedures Act, the updated regulation implementing the Military Lending Act, and pending changes to the data collection and processing rules for the Home Mortgage Disclosure Act―have outpaced compliance risk management at some banks, the OCC said.
Other compliance concerns include bank decisions to terminate entire categories of customer accounts without considering the risk presented by individual customers and the outsourcing of some or all of the loan application or underwriting processes, which can open banks up to greater exposure for fair lending issues and monitoring.
Banks should be aware of other risks as well, the OCC added, from heavy reliance on third-party service providers for critical activities to interest rate risk due to changes in interest rates and the yield curve to credit risk in banks with high concentrations in agricultural lending.
To read the Semiannual Risk Perspective, click here.
Why it matters
“While these are risks that the system faces as a whole, we note that the risks differ from bank to bank based on size, region, and business model,” Acting OCC Comptroller Keith Noreika said in a statement. “Compliance, governance, and operational risk issues remain leading risk issues for large banks while strategic, credit, and compliance risks remain the leading issues for midsize and community banks.”