+ All Categories
Home > Documents > What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber...

What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber...

Date post: 15-Oct-2020
Category:
Upload: others
View: 0 times
Download: 0 times
Share this document with a friend
25
Presented by NJ Bankers Association 2016 Compliance University June 22, 2016 What’s New in Regulatory Examinations and Enforcement Travis P. Nelson (212) 549-0236 New York, NY (609) 524-2038 Princeton, NJ [email protected]
Transcript
Page 1: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Pre se n te d by

NJ Bankers Associat ion2016 Compliance University

June 22, 2016

What ’s New in Regulatory Examinat ions and Enforcement

Travis P. Nelson(212) 549-0236 New York, NY

(609) 524-2038 Princeton, NJ

[email protected]

Page 2: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Tra vis P. NelsonMember of the Financial Services Regulatory Group

Former Enforcement Counsel with the Office of the Comptroller of the Currency, U.S. Treasury Department , Washington, D.C.

Focuses his pract ice on financial services regulat ion, enforcement defense, internal invest igat ions, and lit igat ion mat ters

Represents clients before federal law enforcement and regulatory agencies, including the OCC, FRB, FDIC, CFPB, and HUD, as well as var ious state author it ies across the count ry

Co-Chair of the Firm ’s Ant i-Money Launder ing & Trade Sanct ions Group

Adjunct faculty teaching Regulat ion of Financial Inst itut ions at Villanova University School of Law

Editor-in-Chief of the ABA’s Banking Law Commit tee Journal

Vice-Chair , Banking Law Sect ion, NJ State Bar Associat ion

Editor of the Reed Smith Financial Services blog –www.financialregulatoryreport .com

2

Counsel

Princeton, NJ+1 609 524 2038New York, NY+1 212 549 [email protected]

Page 3: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Overview• Int roduct ion to examinat ions.

• Who are the regulators?

• Examinat ion author ity.

• By the numbers.

• Key supervisory pr ior it ies for 2016.

• Changes to the Civil Money Penalty Mat r ix (“CMP Mat r ix”).

• Stages of a supervisory act ion.

• What to do and not do when the regulators come calling.

3

Page 4: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Introduction to Examinations• How to su pe rvisory/exa m in a t ion p rob le m s a r ise ???

• In te ra ge n cy re fe rra ls .

• At torn ey ge n e ra l re fe rra ls .

• Con su m e r com pla in t s .

• Exa m in e r review.

• Polit ica l p re ssu re …– https://www.youtube.com/watch?v=tM3OKJUjRkk

4

Page 5: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Who are the regulators?• Fe de ra l Re se rve Boa rd of Gove rn ors (FRB; th e Boa rd ; Fe de ra l

Re se rve ; th e Fe d ).

• Office of th e Com pt ro lle r o f th e Cu rre n cy (“OCC”; th e Com pt ro lle r).

• Fe de ra l De posit In su ra n ce Corpora t ion (“FDIC”).

• Con su m e r Fin a n cia l Pro te ct ion Bu re a u (“CFPB”).

• Sta te Ba n k Re gu la tors .

• Sta te At torn eys Ge n e ra l.

• Con su m e r p ro te ct ion ve rsu s p ru de n t ia l re gu la t ion .

• Som e re gu la tors ove rla p ba se d on m ission or o th e r fa ctors .

5

Page 6: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Examination Authority

6

St at eMem ber Bank

St at e Non-Mem ber Bank

Federally Char t ered Bank

BHC/FHC/S&LHC

FRB X XOCC XFDIC XCFPB Over $10 Billion in AssetsState Bank Regulators

X X

StateAttorneys General

X X X(limited)

X

Page 7: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

By the Numbers: By Regulator (as of June 16, 2016)• Office of th e Com pt rolle r of th e Cu rre n cy.

– US: 1366– NJ: 21

• Federal Deposit Insurance Corporat ion.– US: 3894– NJ: 65

• Federal Reserve Board.– US: 831– NJ: 3

• New Jersey Dept . of Banking and Insurance: 68

• New York Dept . of Financial Services: 93

• Pennsylvania Dept . of Banking & Securit ies: 135

• Delaware Commissioner of Banks: 13

• California Dept . of Business Oversight : 143

7

Page 8: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

By the Numbers: Enforcement Actions• OCC e n force m e n t a ct ion s, Ju n e 2015-Ju n e 2016.

– Formal agreements: 37.– Removal and prohibitions: 23.– Personal civil money penalties (“CMPs”): 23.

• Total amount: $549,000 (ranging from $2,500-$100,000)– Section 1829 actions: 55.– Cease and desist/restitution actions: 80.– Bank CMPs: 22.

• Total amount: $179,283,250 – Personal cease and desist orders: 10.

8

Page 9: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

By the Numbers: Enforcement Actions• FDIC e n force m e n t a ct ion s, Ju n e 2015-Ju n e 2016.

– Prompt Corrective Action Orders: 4– Civil Money Penalties: 51

• Aggregate amount: $158,398,735.00– Consent Orders: 31– Removal and Prohibition: 90– Section 1829 actions: 58– Terminations of Deposit Insurance: 11

9

Page 10: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

By the Numbers: Enforcement Actions• New Jersey Dept . of Banking and Insurance – 2015.

– Consent order (March 20, 2015): Safety and soundness issues related to Board Participation, Management, Classified Assets Reduction, Loss Charge-Off, Allowance for Loan and Lease Losses, Concentrations of Credit, Loan Review Program, Loan Policy, Capital, Profit and Budget Plan, Strategic Plan, and Correction of Violations.

– Consent order (February 25, 2015): Safety and soundness issues related to Board Supervision, Management, Bank Secrecy Act Compliance, and Correction of Violations.

• New York Dept . of Financial Services – June 2015 June 2016.– Banking generally: 9 actions.– Mortgage banking: Consent orders (1); Settlement agreements (9).

10

Page 11: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

By the Numbers: FinCEN

11

Page 12: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Key Supervisory Priorities for 2016• Inadequate underwrit ing.

– Examiner focus: Retail and commercial credit underwriting weaknesses.• “Examination procedures will focus on underwriting, credit

administration, portfolio management, and monitoring practices.”

• St ra te gic r isk.– Exam iner focus: FinTech; m ergers and acquisitions.

• Corpora te gove rn a n ce a n d ove rsigh t .– Exam iner focus: Is the institu tion m anaging risk we ll? Exam iners will be

assessing the feasib ility and risk posed by business m ode ls and stra tegic changes.

12

Page 13: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Key Supervisory Priorities for 2016• Risk management .

– Examiner focus: Is the institution fostering a culture of compliance? What does this mean?

• Con su m e r com plia n ce .– Exam iner focus: TRID, SCRA, Flood Disaste r Protection Act, and risks

posed by new product offe rings.

13

Page 14: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Key Supervisory Priorities for 2016• Cybe rse cu rity.

– Examiner focus: Examiners will be using Cybersecurity Assessment Tool to determine an institution’s ability to detect, prevent, and respond to emerging cyber readiness reviews.

– Notable developments…• NYDFS – Report on Cyber Security in the Banking Sector (May 2014).• NYDFS – Report on Cyber Security in the Insurance Sector (Feb. 2015).

– Notes focus on cyber security protocols at third-party vendors.• OCC Cybersecurity Guidance, Bulletin 2015-31 (June 30, 2015).• FDIC Cybersecurity Awareness Resources, FIL-55-2015 (Nov. 2015).• OCC Records Retention Guidance, Bulletin 2016-13 (April 27, 2016).• OCC FinTech White Paper (March 31, 2016).• In 2016 – FDIC adds 30 “specialized IT Examination Analysts” to focus

on cybersecurity.14

Page 15: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Key Supervisory Priorities for 2016• Third party relat ionships.

– Examiner focus: • Use of third party relationships in developing, marketing, and

managing credit products “can increase the risk of unfair or deceptive practices.”

• Banks focus on “vendors,” and not the broader “third-parties” under OCC guidance.

• Failure to involve all internal stakeholders in policy drafting.

15

Page 16: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Key Supervisory Priorities for 2016• Bank Secrecy Act /Ant i-Money Laundering.

– Examiner focus:• “Some banks have failed to develop or incorporate appropriate

controls as products and services have evolved.” – Comptroller Curry.• “Some banks failed to devote sufficient resources and expertise to

BSA/AML.” – Comptroller Curry• “An institution’s interest in revenue should not compromise efforts to

effectively manage and mitigate BSA/AML deficiencies and risks, including submission of appropriate and accurate reports to FinCEN.” –FinCEN.

• Examiners will be assessing effectiveness of BSA/AML programs and controls.

16

Page 17: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Key Supervisory Priorities for 2016• Fair access.

– Examiner focus: Examiners will be assessing the ability/efforts of banks to meet the needs of creditworthy borrowers and monitoring for CRA compliance.

• Failure to address MRAs or enforcement act ion requirements.– Examiner focus: Examiners will be assessing and validating whether the

requirements for MRAs/enforcement actions are met and closed.

17

Page 18: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Changes to CMP Matrix• Ba ckgrou n d on deve lopm e n t a n d u se of th e CMP Ma t r ix.

• In st itu t ion a l CMP m a t r ix:

• In cre a se d we igh t on som e a ggra va t in g fa ctors: – Intent.– Continuation of conduct after notification.– Concealment.– Existence of a prior citation from examiners as to the same problem.– History of violations.– Duration and frequency of the violations before being notified by the

OCC.

• Decreased weight on some mit igat ing factors:– Good faith before notification.– Efforts at restitution.

18

Page 19: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Changes to CMP Matrix• In st itu t ion a l CMP m a t r ix.

• Addit ion of a n ew fa ctor: “Effe ct ive n e ss of in te rn a l con t ro ls a n d com plia n ce p rogra m .”

– “Strong internal controls and compliance program” = 0 points.– “Internal controls and compliance program are substantially lacking”

= 4 points.

• Individual (“IAP”) CMP mat r ix:

• Increased weight on some aggravat ing factors: – Intent.– Continuation after notification.– Financial gain or other benefit to the IAP as result of the violation.– Loss or risk of loss to the bank.– History of violations and tendency to engage in violations.

19

Page 20: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Changes to CMP Matrix• In d ividu a l CMP m a t r ix.

• De cre a se d we igh t on on e m it iga t in g fa ctor:– Good faith before notification.

• Addit ion of new factors:– “Number of instances of misconduct at issue.”

• “None”: 0 points.• “More than 10 instances”: 4 points.

– “IAP responsibility for internal controls environment and its effectiveness.”

• “IAP has no responsibility, and/or adequate programs/policies exist in area where violation occurred”: 0 points.

• “IAP has responsibility for inadequate programs/policies and has not been responsive to supervisory recommendations”: 4 points.

20

Page 21: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Stages of a Supervisory Action: Preparing for the Examination• What type of examination is the agency conducting?

• Full-scope examination.

• Targeted examination.• Is there a particular issue that has sparked the agency’s interest?

• Specialty consideration examination.– BSA/AML examination.– Consumer compliance examination (fair lending).

• Review policies and procedures regarding the relevant area of the examination.

– Compare policies and procedures to examiner handbooks and examination checklists.

– Self-identify problems before the agency finds them.

21

Page 22: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Stages of a Supervisory Action: Preparing for the Examination

22

• Designat e a cent ral point of cont act t o coordinat e exam inat ion m at t ers and deliver request ed inform at ion – t he “Exam inat ion Manager .”

• Manage the message.

• Avoid obstruction of examination.

• Exam inat ion Manager is t he chief l iaison w it h agency exam iners.

• Designat e a m anagem ent of f icial who can provide an overview of t he inst it ut ion’s operat ions and can direct operat ional unit s under exam review.

• Should include someone from the IT function, as needed.

• Make sure t hat t he exam iners’ request s are prom pt ly and proper ly m et .

• Is the deliverable in the proper format?

• Does it convey your message – the right message?

• Defending your position vs. educating the examiners – What’s the difference?

• What about privileged material? Drafts?

• Have a plan for responding t o request s for pr ivi leged m at er ial.

• Consult outside regulatory counsel.

• Clear ly docum ent m inut es of m eet ings and forward t o regulat ory counsel.

Page 23: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Stages of a Supervisory Action: Conducting an Internal Review• If wa rra n te d , con du ct a n in te rn a l review du rin g th e

exa m in a t ion , o r be twe e n th e exa m in a t ion exit m e e t in g a n d issu a n ce of th e su pe rvisory le t t e r .

• Fa ct fin d in g – d id a vio la t ion a ctu a lly occu r?

• Le ga l a n a lysis – d id th e exa m in e r or a ge n cy a t to rn ey p rope rly a pp ly th e la w?

• De te rm in e th e exte n t o f like ly re st itu t ion .

• Pre pa re re spon se to su pe rvisory le t t e r .

23

Page 24: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Quick Reference: What to do and not do when the OCC comes calling!

24

• Know t he rules: Must be familiar with the examination policies and informal guidelines of the regulators.

• Involve counsel im m ediat ely: Comments in meetings or supervisory correspondence. Protection of privilege and document control.

• Review com parable enforcem ent act ions: What remedies have the regulators sought in the past? Consider comparable corrective action.

• Do not over react : Sometimes more regulators/enforcement counsel are brought than are necessary – Shock and Awe!

• Know t he players: Learn the relative authority and roles of the supervisory staff.

• The exam iners do not just “go away.”

Page 25: What’s New in Regulatory Examinations and Enforcement University/2016...–Notes focus on cyber security protocols at third -party vendors. • OCC Cybersecurity Guidance, Bulletin

Reed Smith LLP

Closing and Questions

25


Recommended