Enhanced Prudential Regulations for Foreign Banks (Regulation YY)

25 Frequently Asked QuestionsApril 2014

1Enhanced Prudential Regulations for Foreign Banks (Regulation YY) FAQs Protiviti

IntroductionIn December 2012, a year after it proposed enhanced prudential standards for domestic financial institu-tions, the Federal Reserve Board (FRB) published a proposed rule under the Dodd-Frank Act (DFA), specifically aimed at addressing enhanced prudential standards for foreign banking organizations (FBOs) with U.S. operations. Following a protracted rule-making process during which formal and informal comments were offered by, among others, the foreign banking community and foreign supervisors, the FRB published a final enhanced prudential supervision rule Regulation YY on February 18, 2014. The final rule incorporates requirements for both domestic financial institutions and FBOs. While the final rule does include some changes to the proposed rule that are beneficial to the foreign banking community, the end result nonetheless may reshape foreign banks activities in the United States.

The following questions are intended as a primer to help head office and U.S. management of foreign banking organizations understand Regulation YY. The complete text of Regulation YY can be found at www.gpo.gov/fdsys/pkg/FR-2014-03-27/pdf/2014-05699.pdf.

Frequently Asked Questions

1. Why did the DFA require the FRB to implement enhanced prudential regulations?One of the main goals of DFA is to reduce risk in the financial system by prohibiting certain risky activities (the Volcker Rules ban on proprietary trading is an example) and taking steps to ensure that financial insti-tutions, particularly those that are considered systemically important, are better positioned to withstand the next financial crisis. Enhanced prudential standards are intended to make systemically important financial institutions more resilient.

2. It makes sense that the U.S. regulators would implement enhanced prudential regulations for domestic banks, but why impose them on FBOs?

As noted in a recent speech by Federal Reserve Governor Tarullo (March 27, 2014, at the Harvard Law School Symposium on Building the Financial System of the Twenty-First Century: An Agenda for Europe and the United States), while the percentage of U.S. banking assets held by FBOs has remained constant at approximately 20 percent since the 1990s, the concentration of those assets has shifted. Today, there are as many FBOs with $50B in U.S. assets as there are domestic banks. In addition, the financial crisis raised a host of questions about cross-border resolution schemes and the extent to which an FBO would support, or would be allowed to support by its home country laws, a failing U.S. operation. The enhanced prudential standards for FBOs are designed to protect against these concerns by shoring up the U.S. operations of FBOs.

3. When is the final rule effective?The final rule extended the initial compliance date for covered FBOs from July 1, 2015, to July 1, 2016, although implementation plans for intermediate holding companies (IHCs) will need to be submitted by January 1, 2015. (Refer to Questions 610 for more information on IHCs.) Compliance with stress testing requirements of IHCs will become effective October 1, 2017.

2Enhanced Prudential Regulations for Foreign Banks (Regulation YY) FAQs Protiviti

4. Which foreign banking organizations (FBOs) are affected by the FRBs regulation?The regulation applies to all covered FBOs, which are defined as FBOs with more than $50B in consolidated worldwide assets and, in limited circumstances, to FBOs with consolidated worldwide assets between $10B and $50B. Application of the requirements is based on the size and footprint of an FBOs U.S. presence. Refer to Appendix B for more details.

5. What are the key areas addressed in the regulation?The regulation focuses on the following key areas:

Intermediate holding companies

Capital

Risk management

Liquidity

Stress testing

Debt-to-equity limit

The FRB deferred action on three topics in its final rule single party credit limits, early remediation requirements, and prudential requirements for non-bank systemically important financial institutions. These topics will be addressed in future rule-makings.

6. Which FBOs are required to establish intermediate holding companies (IHCs)?A covered FBO with more than $50B in non-branch/agency U.S. assets, as determined based on the four prior quarters Form FR Y7-Q financial data, must consolidate those assets under an IHC. This require-ment applies even if the FBO does not own a bank or thrift in the United States. The proposed rule would have required FBOs with $10B in non-branch/agency U.S. assets to form IHCs, so the final rule does represent an improvement for the foreign banking community.

7. Nothing in DFA requires that FBOs establish IHCs. What authority does the FRB have to impose this requirement and why did they opt to require IHCs?

The FRB has broad authority under DFA to establish any additional prudential standard for systemically important financial institutions that it deems appropriate. The FRBs view is that IHCs not only improve the resiliency of large FBOs, but also serve as a focal point for risk management activities and for resolu-tion of a large FBO, if necessary.

8. What FBO entities must be held under the IHC?All U.S. banking and nonbanking operations must be held under the IHC, except:

U.S. branches and agencies of the FBO

BHCA section 2(h)(2) companies (i.e., the U.S. subsidiaries of commercial or industrial companies) owned by the FBO

Debt Previously Contracted (DPC) branch subsidiaries

3Enhanced Prudential Regulations for Foreign Banks (Regulation YY) FAQs Protiviti

In addition, controlled merchant banking portfolio companies and/or insurance companies must be held under the IHC even if not integral to U.S. operations, where the definition of control would be subject to a rebuttable presumption consistent with FRB standards.

9. What if an FBOs home country regulation does not allow for combining certain activities under the same company?

The FRB may grant an exception where home country law prohibits the combining of certain activities (e.g., banking and securities) in the same company; however, the exception could come with some restrictions.

10. Are IHCs expected to be functioning, operational companies?Yes, IHCs must have fully functioning boards of directors or managers. IHCs are subject to capital require-ments and certain risk management requirements, as discussed in the questions and answers below.

11. How do capital requirements apply to FBOs?Beginning July 1, 2016:

A covered FBO must certify and demonstrate compliance with capital adequacy standards at the consolidated level consistent with the Basel Committee capital framework; as a practical matter, this is not likely to pose a challenge to a large FBO because the requirement will be consistent with its home country requirement.

An IHC must meet U.S. risk-based capital and leverage requirements to the same extent as a U.S. bank holding company (BHC), even if it is not a BHC.

12. What if a covered FBO fails to meet the capital requirements?The failure of an FBO to meet capital adequacy standards may result in the FRB imposing restrictions on U.S. activities or business operations of the FBO.

13. Which FBOs are required to have risk committees under these new rules?The following FBOs must have risk committees:

1. Publicly traded FBOs with $10B or more in worldwide assets

2. Covered FBOs with less than $50B of combined U.S. assets

3. Covered FBOs with more than $50B of combined U.S. assets

FBOs in the first two categories must have risk committees that oversee the risk management policies of their combined U.S. operations, with at least one member with risk management experience. An FBO in the third category must have a risk committee with at least one member with risk management experi-ence and at least one independent member. These risk committees must include oversight of liquidity risk in their charters.

Risk committees must have formal, written charters approved by the institutions board of directors, must meet at least quarterly, and must document and maintain records of their proceedings.

4Enhanced Prudential Regulations for Foreign Banks (Regulation YY) FAQs Protiviti

14. Does a covered FBO have any options about where its risk committee resides?For FBOs in categories 1 and 2, as described above, the risk committee may be a U.S.-based committee or a committee of the FBOs global board of directors or supervisory board. An FBO in category 3 that operates through U.S. branches/agencies also has the option to have a U.S.-based committee or it can leverage a committee of the FBOs global board of directors or supervisory board. However, an FBO in category 3 that operates in the U.S. solely through an IHC must place its U.S. risk committee at the IHC.

15. Are there pros and cons with placing the risk committee at the level of the FBOs global board of directors or supervisory board?

There would likely be cost and efficiency benefits to placing a risk committee at the level of the FBOs global board of directors or supervisory board, e.g., no need to form an additional committee, the global board likely already considers U.S. risk issues, etc. One downside, however, may be that using a global approach could potentially result in sharing information with the FRB that extends beyond just delibera-tions of U.S. risk matters.

16. Are FBOs required to have a U.S. chief risk officer (CRO)?FBOs with more than $50B in combined U.S. assets, either directly or through an IHC, are required to appoint a U.S. CRO. This individual must have risk management experience, be compensated indepen-dently of the business, be employed and located in the U.S. (in a U.S. branch/agency, IHC or U.S. subsidiary), and report directly and regularly to the U.S. risk committee and the FBOs global risk officer.

17. Does the regulation impose specific requirements/mandates for the U.S. CROs?The U.S. CRO must be responsible for liquidity risk management (see Question 18 below) and must oversee the measurement, aggregation, and monitoring of U.S. combined operations; the implementa-tion of and compliance with policies and procedures for reporting risks and risk management deficiencies; and the management, monitoring and testing of risk controls.

18. What if a covered FBO fails to comply with the risk management requirements?The failure of a covered FBO to comply with the risk management requirements may result in FRB-imposed limits on U.S. activities or operations.

19. What liquidity requirements apply to covered FBOs?FBO liquidity requirements are tiered as follows:

FBOs with combined U.S. assets of less than $50B must perform and report to the FRB the results of annual Basel Committee-consistent internal liquidity stress tests.

FBOs with combined U.S. assets of more than $50B must conduct at least monthly (more frequently if required by the FRB) liquidity stress tests and report the results to the FRB.

IHCs must maintain in the U.S. a liquidity buffer of highly liquid assets sufficient to meet external and internal net stressed cash flow needs over a 30-day period.

An FBOs U.S. branch/agency network must maintain a liquidity buffer to cover needs for 14 days.

5Enhanced Prudential Regulations for Foreign Banks (Regulation YY) FAQs Protiviti

The FBO parent of an IHC is required to make available to the FRB in a timely manner the results of home country liquidity stress testing and the establishment of liquidity buffers.

In addition, for FBOs with combined U.S. assets of more than $50B:

FBOs must establish appropriate liquidity risk management policies, procedures and risk limits, including a contingency funding plan.

The U.S. risk committee must approve liquidity risk tolerances for the combined U.S. operation at least annually; must review information provided by senior management to determine compli-ance with the approved liquidity risk tolerance at least semi-annually; must approve the contingency funding plan for the combined U.S. operations at least annually or whenever it is revised; and must conduct a liquidity risk review of significant business lines and products of the combined U.S. opera-tions at least annually.

The U.S. CRO must also review the liquidity risk management strategy, policies and procedures of the combined U.S. operation; review adherence to the liquidity risk tolerance limit; report to the U.S. and enterprise risk committee on the liquidity profile of the U.S. operations on at least a semi-annual basis; and approve new products and services based on consideration of liquidity risk. The U.S. CRO must also, on at least a quarterly basis, review cash flow projections for the combined U.S. operations; establish and determine compliance with liquidity risk limits; approve liquidity stress testing practices, methodologies and assumptions; review liquidity stress testing results; and approve the liquidity buffer.

An independent liquidity risk management review function must review, no less than annually, the adequacy and effectiveness of liquidity risk management processes of the combined U.S. operations and report liquidity risk management issues to the U.S. and enterprise risk committees.

20. What if a covered FBO fails to meet the liquidity requirements?For FBOs with less than $50B in combined U.S. assets, a failure to comply with Basel Committee-consis-tent liquidity requirements would result in obliging the covered FBO to limit the net aggregate amount owed by the head office and all non-U.S. affiliates to the combined U.S. operation, i.e., the net due from, to 25 percent or less of the combined U.S. operations third-party liabilities on a daily basis. For larger FBOs, the liquidity buffer ensures continued compliance; however, the FRB may take additional action in grave threat circumstances, as discussed in Question 23 below.

21. What stress testing requirements apply to covered FBOs?FBO stress testing requirements are tiered as follows:

FBOs with $10B or more in worldwide assets and FBOs with less than $50B in combined U.S. assets must conduct and pass home country stress tests.

FBOs with more than $50B in combined U.S. assets must be subject to and pass a home country stress testing requirement that includes either an annual supervisory stress test or a supervisor-reviewed annual test.

IHCs are subject to the same stress testing requirements as similarly based U.S. BHCs, effective October 1, 2017. Until that time, each FBO bank subsidiary and insured depository institution remains subject to existing stress test requirements.

6Enhanced Prudential Regulations for Foreign Banks (Regulation YY) FAQs Protiviti

22. What are the consequences to a covered FBO for failure to comply with stress testing requirements?

An FBO with $10B or more in worldwide assets or an FBOs with less than $50B in combined U.S. assets that fails to comply with stress test requirements would be subjected to a 105 percent asset maintenance requirement for its branch/agency network and would be subject to an annual stress test requirement of its U.S. subsidiaries.

An FBO with more than $50B in combined U.S. assets that fails to comply with stress test require-ments would be subject to a 108 percent asset maintenance requirement for its branch/agency network, an annual stress test requirement for its U.S. subsidiaries (to the extent the FBO has not established an IHC), and may be subject to additional liquidity buffer and/or intragroup funding restrictions.

23. When would a debt-to-equity limit be imposed on an FBO?A conditional debt-to-equity limit of 15:1 could be imposed on an FBO if the Financial Stability Oversight Council (FSOC) determines that the FBO poses a grave threat to the U.S. financial system. The limits would apply to any IHC and any U.S. subsidiary that is not under an IHC except for a DPC company or the U.S. subsidiary of a commercial or industrial company. In addition to the debt-to-equity limit, the branch/agency network of the FBO would be subject to a 108 percent asset maintenance requirement. The determination that an institution poses a grave threat would be based on a qualitative assessment by FSOC; to date, no quantitative standards have been established.

24. Does the FRB regulation impose any additional disclosure or reporting requirements on covered FBOs?

Regulation YY reporting and recordkeeping requirements include the following:

An FBO must provide notice to the FRB within 30 days of establishing or designating an IHC.

An FBO must provide reports relating to its compliance with the Basel capital adequacy standards in a yet-to-be-proposed amendment to the FR Y-7Q.

An FBO must certify at least annually to the FRB, concurrently with the filing of its Y-7, that it has a risk committee.

The FBO parent of an IHC must make available to the FRB on a timely basis its stress testing results.

FBOs with more than $50B in combined U.S. assets must report summary information about stress testing activities by January 5 of each year.

25. How will the FRB regulation likely affect the U.S. operations of covered FBOs?Regulation YY has wide-reaching consequences for FBOs that could result in some FBOs reconsidering the extent and structure of their U.S. operations. Increased compliance costs associated with Regulation YY will impact the profitability of U.S. operations. Both head office and U.S. management will need to coordinate closely to ensure compliance deadlines are met and compliance is sustained on an ongoing basis.

The above analysis is not intended to provide legal analysis or advice, nor does it purport to address all of the details and complexities of Regulation YY. FBOs should seek the advice of legal counsel or other appropriate advisers on specific questions as they relate to their unique circumstances.

7Enhanced Prudential Regulations for Foreign Banks (Regulation YY) FAQs Protiviti

Appendix A Selected Definitions and Acronyms

Term DefinitionAcronym, if Applicable

Bank Holding Company

Same meaning as defined in Section 2(a) of the Bank Holding Company Act (12 U.S.C. 1841(a)) and Section 225.2(c) of the Boards Regulation Y (12 CFR 225.2(c)).

BHC

Combined U.S. operations of an FBO

(1) The FBOs U.S. branches and agencies, if any; and(2)(i) If the foreign banking organization has established a U.S. intermediate

holding company, the U.S. intermediate holding company and the subsidiaries of such U.S. intermediate holding company; or

(ii) If the foreign banking organization has not established a U.S. intermediate holding company, the U.S. subsidiaries of the foreign banking organization (excluding any Section 2(h)(2) company, if applicable), and subsidiaries of such U.S. subsidiaries.

Control Same meaning as defined in Section 2(a) of the Bank Holding Company Act (12 U.S.C. 1841(a)). The terms controlled and controlling shall be construed consistently with the term control.

Covered FBOs FBOs with more than $50B of consolidated worldwide assets and, in limited circumstances, FBOs with consolidated worldwide assets between $10B and $50B.

Debt Previously Contracted Subsidiaries

Any subsidiary of a U.S. branch or a U.S. agency acquired, or formed to hold assets acquired, in the ordinary course of business and for the sole purpose of securing or collecting debt previously contracted in good faith by that branch or agency.

DPC branch subsidiary

Foreign Banking Organization

Same meaning as defined in Section 211.21(o) of the Boards Regulation K (12 CFR 211.21(o)), provided that if the top-tier foreign banking organization is incorporated in or organized under the laws of any state, the foreign banking organization shall not be treated as a foreign banking organization for purposes of this part.

FBO

Intermediate Holding Company

The top-tier U.S. company that is required to be established pursuant to 252.153 of Regulation YY.

IHC

8Enhanced Prudential Regulations for Foreign Banks (Regulation YY) FAQs Protiviti

Appendix B Quick Guide to Regulation YY Compliance Requirements for FBOs

Size Applicable Requirements

$10B FBOs Company-runstresstests

$10B FBOs that are publicly traded Riskcommittee

Covered FBO with less than $50B of combined U.S. assets

Risk-basedandleveragecapital Riskcommittee Liquidity Capitalstresstesting Debt-to-equitylimits(upongravethreatdetermination)

Covered FBO with more than $50B of combined U.S. assets

Risk-basedandleveragecapital Riskmanagementframework RiskcommitteeandU.S.chiefriskofficer Liquidityriskmanagement,stresstestingandbuffers Capitalstresstesting U.S.IHCrequirement(ifU.S.non-branchassetsofmorethan$50B) Debt-to-equitylimits(upongravethreatdetermination)

9Enhanced Prudential Regulations for Foreign Banks (Regulation YY) FAQs Protiviti

About ProtivitiProtiviti (www.protiviti.com) is a global consulting firm that helps companies solve problems in finance, technology, operations, governance, risk and internal audit, and has served more than 35 percent of FORTUNE 1000 and FORTUNE Global 500 companies. Protiviti and its independently owned Member Firms serve clients through a network of more than 70 locations in over 20 countries. The firm also works with smaller, growing companies, including those looking to go public, as well as with government agencies.

Protiviti is a wholly owned subsidiary of Robert Half (NYSE: RHI). Founded in 1948, Robert Half is a member of the S&P 500 index.

About Our Financial Services Industry Team

We assist financial services companies with identifying, measuring and managing the myriad risks they face. With our commitment to service, people, resources and values, we are the service provider of choice for financial institutions of all types and sizes.

Our consultants are experienced professionals. Many have decades of experience working in the financial services industry. Located in offices across the globe, they include former industry executives, former regulators and a broad range of subject-matter experts who have firsthand knowledge of the issues on which they provide advice. Our internal commitment to training ensures that our consultants remain current on important industry issues. Armed with tested tools and methodologies, our consul-tants provide pragmatic, cost-effective and value-added solutions to your company.

At Protiviti, we understand the challenges faced by financial services companies. Our solutions are designed to help your company turn these challenges into competitive advantages.

Contacts

Carol Beaumier Managing Director +1.212.603.8337 carol.beaumier@protiviti.com

John Atkinson Director +1.404.926.4347 john.atkinson@protiviti.com

ASIA-PACIFIC

AUSTRALIA

BrisbaneCanberraMelbournePerthSydney

CHINA

BeijingHong KongShanghaiShenzhen

INDIA

BangaloreMumbaiNew Delhi

INDONESIA**

Jakarta

JAPAN

Osaka Tokyo

SINGAPORE

Singapore

SOUTH KOREA

Seoul

* Protiviti Member Firm ** Protiviti Alliance Member

THE AMERICAS

UNITED STATES

AlexandriaAtlantaBaltimoreBostonCharlotteChicagoCincinnatiClevelandDallasDenverFort LauderdaleHouston

Kansas City Los Angeles Milwaukee Minneapolis New York Orlando Philadelphia Phoenix Pittsburgh Portland Richmond Sacramento

Salt Lake City San Francisco San Jose Seattle Stamford St. Louis Tampa Washington, D.C. WinchesterWoodbridge

ARGENTINA*

Buenos Aires

BRAZIL*

Rio de Janeiro So Paulo

CANADA

Kitchener-WaterlooToronto

CHILE*

Santiago

MEXICO*

Mexico City Monterrey

PERU*

Lima

VENEZUELA*

Caracas

2014 Protiviti Inc. An Equal Opportunity Employer M/F/D/V. PRO-0414-101062Protiviti is not licensed or registered as a public accounting firm and does not issue opinions on financial statements or offer attestation services.

SOUTH AFRICA*

Johannesburg

EUROPE/MIDDLE EAST/AFRICA

FRANCE

Paris

GERMANY

Frankfurt Munich

ITALY

Milan Rome Turin

THENETHERLANDS

Amsterdam

UNITED KINGDOM

London

BAHRAIN*

Manama

KUWAIT*

Kuwait City

OMAN*

Muscat

QATAR*

Doha

UNITED ARAB EMIRATES*

Abu Dhabi Dubai