supervisory insights: vol. 3, issue 1 - summer 2006 · accounting for employee stock options 30 on...

Inside

Operational Risk

Banks and Hurricanes

Enforcement ActionsAgainst Individuals

Impact of HMDAReporting Requirements

Accounting for EmployeeStock Options

Supervisory InsightsSupervisory InsightsDevoted to Advancing the Practice of Bank Supervision

Vol. 3, Issue 1 Summer 2006

Supervisory Insights

Supervisory Insights is published by theDivision of Supervision and ConsumerProtection of the Federal DepositInsurance Corporation to promotesound principles and best practicesfor bank supervision.

Martin J. GruenbergActing Chairman

Sandra L. ThompsonActing Director, Division of Supervisionand Consumer Protection

George FrenchExecutive Editor

Journal Executive Board

John M. Lane, Deputy DirectorRobert W. Mooney, Acting Deputy

DirectorWilliam A. Stark, Deputy DirectorJohn F. Carter, Regional DirectorStan R. Ivie, Regional DirectorJames D. LaPierre, Regional DirectorSylvia H. Plunkett, Regional DirectorMark S. Schmidt, Regional DirectorChristopher J. Spoth, Regional Director

Journal Staff

Bobbie Jean NorrisManaging EditorChristy C. JacobsFinancial WriterEloy A. VillafrancaFinancial Writer

Supervisory Insights is available onlineby visiting the FDIC’s website atwww.fdic.gov. To provide commentsor suggestions for future articles,to request permission to reprintindividual articles, or to requestprint copies, send an e-mail [email protected].

The views expressed in Supervisory Insights arethose of the authors and do not necessarily reflectofficial positions of the Federal Deposit InsuranceCorporation. In particular, articles should not beconstrued as definitive regulatory or supervisoryguidance. Some of the information used in thepreparation of this publication was obtained frompublicly available sources that are consideredreliable. However, the use of this information doesnot constitute an endorsement of its accuracy bythe Federal Deposit Insurance Corporation.

Letter from the Director......................................................... 2

Issue at a Glance

Vol. 3, Issue 1 Summer 2006

Regular Features

From the Examiner’s Desk . . . Two Years After: Assessing the Impact of the New HMDA ReportingRequirements 24The Federal Reserve Board’s latestrevisions to data collection and report-ing requirements for Regulation C, theimplementing regulation for the HomeMortgage Disclosure Act (HMDA),allow examiners to conduct moreprecise analyses than in the past. Thisarticle focuses on how the changes toRegulation C have affected fair lendingexaminations and the HMDA examina-tion process. It also explores the mostcommon HMDA violations cited sincethe changes were implemented.

Accounting News: Accounting for Employee Stock Options 30On January 1, 2006, the accountingrules for employee stock optionschanged. On that date, Statement ofFinancial Accounting Standards No. 123(Revised), Share-Based Payment, tookeffect for entities with a calendar yearfiscal year and eliminated an entity’schoice between two significantlydifferent methods of accounting foremployee stock options. This articlediscusses the key provisions of thisnew accounting standard and its effecton banks’ reported earnings and capitallevels.

Regulatory and Supervisory Roundup 46This feature provides an overview ofrecently released regulations andsupervisory guidance.

Articles

Operational Risk Management: An Evolving Discipline 4Growing complexity in the banking industry, several large andwidely publicized operational losses in recent years, and achanging regulatory capital regime have prompted both banksand banking supervisors to view operational risk management(ORM) increasingly as a distinct discipline, just like manage-ment of credit risk and market risk. This article provides anintroduction to operational risk, outlines the current state ofORM, and describes different quantification approaches in thisemerging field.

Banks and Hurricanes: A Look Back at the Storms of 2004–2005 12As the hurricane season of 2006 approaches, we look back atsome of the challenges bankers faced during the storms ofthe 2004–2005 seasons, which may provide context forbankers when they review plans for maintaining operations inthe event of a disaster. This article is an informal compilationof experiences and thoughts about the challenges and plan-ning options illustrated by those experiences.

Enforcement Actions Against Individuals: 2005 — A Year in Review 18Third in a series about the enforcement action process as itapplies to individuals, this article summarizes enforcementactions brought against individuals during 2005, with a partic-ular focus on losses to banks resulting from insider miscon-duct or fraud. The article highlights the importance of strongoversight of operating management and reemphasizes theneed for strong internal control and audit programs.

1Supervisory Insights Summer 2006

2

Letter from the Director

Supervisory Insights Summer 2006

Supervisory Insights has nowentered its third year of publica-tion. As indicated in our first issue

in June 2004, our goal is to provide adiscussion forum on how regulatorypolicy is put into practice in the field, toshare best practices, and to communi-cate information about emerging issuesbank supervisors are facing. While weare witnessing the longest period in FDIChistory without a bank failure, wecontinue to face new challenges. In thisissue of Supervisory Insights, weaddress a number of those challenges.

Increasing risks in institutions’ opera-tional environments have contributed toan evolution in operational risk manage-ment practices. While traditional internalprocesses, audit programs, and insur-ance protection to address operationalrisk remain of paramount importance,recent operational risk managementpractices have included a significanttrend toward more quantitative measure-ment. “Operational Risk Management —An Evolving Discipline” explores the vari-ous views on operational risk manage-ment, as well as the inclusion of a chargefor operational risk management as partof the risk-weighted assets calculationunder the Basel II framework.

The ability to respond to, and recoverfrom, business disruptions is critical tothe survival of institutions and to thecustomers and communities they serve.The past two hurricane seasons testedGulf Coast institutions’ business continu-ity plans. In 2005, 280 financial institu-tions, with approximately $270 billion intotal assets, were operating in the areasaffected by Hurricanes Katrina and Rita.The vast majority of these institutionswere well run, had strong managementteams, implemented sound backupcontingency plans, and were well capital-ized. Even so, six months after thestorms, 214 institutions were still report-ing some lingering effects, includingclosed branches and the need for tempo-

rary locations. “Banks and Hurricanes: A Look Back” discusses some of thechallenges faced by institutions along theGulf Coast, how they met those chal-lenges, and the prominent role of theirbusiness continuity plans. We hope thatthis article will provide some context asbanks prepare for the 2006 hurricaneseason.

This issue of Supervisory Insights alsocontains the third and final article in aseries on fraud, the resultant losses toinstitutions, and the enforcementactions taken by the FDIC. The firstarticle focused on a review of theenforcement action process and theincrease in enforcement action activitysince 2002. The second articlediscussed two cases of insider miscon-duct and highlighted internal controlweaknesses that facilitated the miscon-duct. This final article, “EnforcementActions Against Individuals: 2005 — AYear in Review,” presents informationon a year’s worth of enforcementactions, including information on theextent to which these enforcementactions addressed fraud committed bysenior bank management. While therewere no bank failures in 2005, fraud,specifically fraud perpetrated by insid-ers, has been a contributing factor inmany bank failures. We hope this seriesof articles will be of interest to banks’boards of directors and the executiveofficers responsible for implementingthe boards’ policies, as they review theirsystems of internal controls and report-ing to ensure that they are adequate toidentify and deter wrongdoing.

This issue’s “From the Examiner’sDesk” discusses how the new pricinginformation reported by mortgagelenders with the Home Mortgage Disclo-sure Act data has changed the fair lend-ing supervisory and examinationprocesses. The “Accounting News”feature highlights the key provisions ofStatement of Financial Accounting Stan-

dards No. 123 (Revised) (FAS 123(R))and its effect on banks’ reported earn-ings and capital levels. The article alsoprovides examples illustrating the basicsof accounting for employee stock optionsawarded after FAS 123(R)’s effectivedate.

We encourage our readers to continueto provide comments on articles, to askfollow-up questions, and to suggest topicsfor future issues. All comments, ques-tions, and suggestions should be sent [email protected].

Sandra L. ThompsonActing DirectorDivision of Supervision andConsumer Protection


Operational Risk Management:An Evolving Discipline


Operational risk is not a new concept inthe banking industry. Risks associatedwith operational failures stemming fromevents such as processing errors, internaland external fraud, legal claims, andbusiness disruptions have existed atfinancial institutions since the inceptionof banking. As this article will discuss,one of the great challenges in systemati-cally managing these types of risks isthat operational losses can be quitediverse in their nature and highly unpre-dictable in their overall financial impact.

Banks have traditionally relied onappropriate internal processes, auditprograms, insurance protection, andother risk management tools to counter-act various aspects of operational risk.These tools remain of paramount impor-tance; however, growing complexity inthe banking industry, several large andwidely publicized operational losses inrecent years, and a changing regulatorycapital regime have prompted bothbanks and banking supervisors toincreasingly view operational riskmanagement (ORM) as an evolving disci-pline. Of particular note is the applica-tion of quantitative concepts, similar tothose used to measure credit and marketrisks, to the measurement of operationalrisk.

This article provides an introduction tooperational risk, outlines the currentstate of ORM, and describes differentquantification approaches in this evolv-ing field.

Operational Risk Defined

The definition of operational riskcontinues to evolve, in part owing to its

scope. Before attempting to define theterm, it is essential to understand thatoperational risk is present in all activitiesof an organization. As a result, some ofthe earliest practitioners defined opera-tional risk as every risk source that liesoutside the areas covered by market riskand credit risk. But this definition ofoperational risk includes several otherrisks (such as interest rate, liquidity, andstrategic risk) that banks manage anddoes not lend itself to the managementof operational risk per se. As part of therevised Basel framework,1 the BaselCommittee on Banking Supervision setforth the following definition:

Operational risk is defined as therisk of loss resulting from inadequateor failed internal processes, people,and systems or from external events.This definition includes legal risk, butexcludes strategic and reputationalrisk.

While the Basel Committee’s definitionincludes what the Committee considersto be crucial elements, each bank’s defi-nition for internal management purposesshould recognize its unique risk charac-teristics, including its size and sophistica-tion, as well as the nature andcomplexity of its products and activities.In cooperation with industry partici-pants, the Basel Committee has identi-fied the seven operational risk eventtypes, shown in Table 1.2

An Evolving BankingLandscape

The operational environment for manybanks has evolved dramatically in recentyears. Deregulation and globalization of

1 Basel Committee on Banking Supervision (Basel Committee), International Convergence of Capital Measure-ment and Capital Standards (the revised Basel II framework), November 2005, Paragraph 644. Available atwww.bis.org/publ/bcbs118.htm.2 The event types and abbreviated examples presented in the table appear in the Basel Committee’s Sound Practicesfor the Management and Supervision of Operational Risk, Paragraph 5. Available at www.bis.org/publ/bcbs86.pdf.

financial services, the proliferation of newand highly complex products, large-scaleacquisitions and mergers, and greater useof outsourcing arrangements have led toincreased operational risk profiles formany institutions. Technologicaladvances, including growth in e-bankingtransactions, automation, and otherrelated business applications also presentnew and potentially heightened expo-sures from an operational risk standpoint.

Available data support the idea thatbanks’ operational environments aregetting riskier. Chart 1 depicts datagleaned from the 2004 Loss Data Collec-tion Exercise (LDCE)3 conducted inpreparation for the U.S. implementationof the Basel II capital framework. Despitecertain inherent limitations in the data,such as differences in data availabilityamong the reporting banks and improve-

ments in data capture methods over thecollection period, it appears that in aggre-gate loss amounts have increased sincecollection efforts began. For example, 20participating banks reported operationallosses of $15 billion in 2004, surpassingthe previous high of $5 billion in lossesreported by 17 institutions in 2002.

Losses associated with operational riskevents can be large. Some well-knownexamples are the collapse of BaringsBank due to fraudulent trading and thesubstantial legal settlements entered intoby Citigroup and JPMorgan Chase withregard to the Enron and WorldCommatters. The business disruptions andfinancial impacts resulting from Hurri-cane Katrina and the September 11terrorist attacks also exemplify howmajor, unforeseen events can materiallyaffect a bank’s operations.


Table 1

Event Type Examples

Loss Event Types and Examples

External fraud Robbery, forgery, and check kiting

Employment practicesand workplace safety

Workers’ compensation and discrimination claims, violation ofemployee health and safety rules, and general liability

Clients, products, andbusiness practices

Fiduciary breaches, misuse of confidential customer information,money laundering, and sale of unauthorized products

Damage to physicalassets

Terrorism, vandalism, earthquakes, fires, and floods

Business disruptionand system failures

Hardware and software failures, telecommunication problems, and utility outages

Execution, delivery, andprocess management

Data entry errors, collateral management failures, incomplete legaldocumentation, and vendor disputes

Internal fraud Employee theft, intentional misreporting of positions, and insider trading on an employee’s own account

3 The 2004 LDCE was a voluntary survey that asked respondents to provide data on individual operational lossesthrough June or September 2004 to enable the banking agencies to assess the potential impact of Basel II on capitalfor U.S. banking organizations. The results of the survey can be found at www.bos.frb.org/bankinfo/qau/pd051205.pdfand www.bos.frb.org/bankinfo/conevent/oprisk2005/defontnouvelle.pdf. Additional information regarding the LDCEis at www.ffiec.gov/ldce.

6

Controlling Operational Risk

Traditional ORM practices, which mostbanks employ today, rely on internalprocesses, audit programs, and insur-ance protection to counterbalance opera-tional risk. They are based largely on theassumption that intelligent, educatedpeople can, through their intuition, iden-tify their organization’s significant risks,corresponding controls, and associatedmetrics.4 In such environments, businesslines manage their operational risks asthey see fit (using a “silo approach”)with little or no formality or processtransparency.

Some larger banks have gone beyondthe silo approach by establishing central-ized departments or groups responsiblefor focusing on particular segments ofoperational risk, such as operatingprocesses, compliance, fraud, businesscontinuity, or vendor management/outsourcing. While this evolution hasimproved overall risk awareness, it tends

to promote a natural segmentation ofrisk awareness, because risks are catego-rized along functional lines. Thisapproach can create significant opera-tional risks if management fails toconsider end-to-end processes.5

More recent ORM practices arefounded on the view that intuition aloneis not sufficient to drive the ORMprocess. In this view, ORM practicesmust extend to quantitative measure-ment, including historical loss data,formal risk assessments, statistical analy-sis, and independent evaluation.6

A common framework at the largestU.S. banks combines the traditional siloapproach with an enterprise-wide over-sight function. The enterprise-wide (orcorporate) function designs and imple-ments the bank’s ORM framework,which serves as the structure to identify,measure, monitor, and control or miti-gate operational risk. The framework isdefined by the risk tolerance determinedby the board of directors, as well as the

Operational Riskcontinued from pg. 5


Available Data Suggest Riskier Operational Environment [Operational Losses — Frequency and Severity]

0

5,000

10,000

15,000

20,000

Pre-1999 1999 2000 2001 2002 2003 20040

6

12

18

24

Total # of Losses (Left hand scale)

Total Loss Amount ($M, left hand scale)

# of Firms Reporting (Right hand scale)

Source: 2004 Loss Data Collection Exercise3

Chart 1

4 Ali Samad-Khan, “Fundamental Issues in OpRisk Management,” OpRisk & Compliance, February 2006. 5 Eric Holmquist, “Scaling Op Risk Management for SMIs: How to Avoid Boundary Disputes,” OpRisk & Compliance, January 2006.6 Ali Samad-Khan, “Fundamental Issues in OpRisk Management.”

7

formal operational risk policies outliningroles and responsibilities, data standards,risk assessment processes, reportingstandards, and a quantification method-ology.7 Business line managers continueto “own the risk,” but risks are identifiedthrough formal self-assessments. The riskassessments are designed to capture end-to-end processes as well as generate anunderstanding of the risks in individualprocesses and products. Table 2compares the two approaches to ORM.

The primary value of such ORM tech-niques, as demonstrated by a growingnumber of institutions using them, istheir application to decision making andrisk management. Specifically, the use ofa well-integrated ORM framework can dothe following:

• Increase risk awareness and mitiga-tion opportunities, which may mini-mize potential exposure

• Assist in evaluating the adequacy ofcapital in relation to the bank’s overallrisk profile

• Enhance risk management efforts byproviding a common framework formanaging the risk

Quantifying Operational Risk:Roots in Economic Capital

As ORM continues to evolve into adistinct discipline, efforts to quantifyoperational risk have gained momentum.A number of large financial institutionshave been working to quantify opera-tional risk for several years as part oftheir economic capital frameworks. Theyhave developed and implementedeconomic capital models to allocate capi-tal to different business segments basedon a variety of risk factors (e.g., credit,market, interest rate, operational).However, within these internal capitalmeasurement and management


Table 2

Traditional Practice Emerging Practice

Comparison of Traditional and Modern Operational Risk Management8

“Silo-ed” business unit Integrated corporate risk management (CRM)risk management

Business line managers CRM supplements and reinforces business line risk ownership“own the risk”

Ad-hoc or no risk Uniform risk assessments across business units facilitated by CRMself-assessment

Voluminous performance Core set of key risk and performance metrics/escalation triggersindicators

Too much or too little Concise, uniform reporting to senior management and the board of information; inconsistent directorsbusiness unit reporting

Reliance on qualitative Use of quantitative information (potential operational risk processes to improve exposure) and risk assessments to improve risk managementrisk management

7 The Basel Committee, International Convergence of Capital Measurement and Capital Standards, Paragraph663(b).8 Table adapted from Operational Risk: Regulation, Analysis, and Management by Carol Alexander (2003), p. 15.Financial Times Prentice Hall. London.

8

processes, there is great variation inmethods used and levels of sophistica-tion, ranging from largely qualitative orjudgmental approaches to complex statis-tical modeling. With respect to opera-tional risk, in particular, many of themeasurement techniques have tradition-ally focused on proxies such as grossincome to estimate capital allocations.

While few institutions have incorpo-rated operational risk quantificationsystems into their economic capitalmodels, ongoing work in this area isbecoming increasingly important giventhe anticipated implementation of a newregulatory capital framework known asBasel II. This new framework, which hasbeen under development since the late1990s and is approaching internationaladoption, is intended to align capitallevels more closely with underlying risks.This general intention is consistent withthe broad goal of most economic capitalframeworks.

Operational Risk BecomesPart of Regulatory Capital

Under the Basel II framework, institu-tions (both mandatory and opt-in)9 willbe required to determine an appropriateoperational risk charge, along with creditand market risk charges, as part of theirrisk-weighted assets (RWA) calculation.Each institution’s estimate of its opera-

tional risk exposure will, subject tosupervisory approval, directly affect itsrisk-based capital (RBC) ratio.

Under the existing regulatory capitalregime (Basel I), which was adopted in1988, there is no explicit charge for oper-ational risk. In determining RBC ratios,financial institutions calculate RWA onthe basis of prescribed percentage alloca-tions for on- and off-balance sheet creditexposures and for certain market risks. Itcould be argued that operational risk andother risks were implicitly accounted forin the calibration of the minimum ratiothresholds for the various PromptCorrection Action categories10 (e.g., 4percent Tier 1 capital to average adjustedbalance sheet assets for the “AdequatelyCapitalized” designation), but they arenot considered in determining a bank’scapital ratios.

Quantifying Operational Risk

The Basel II framework outlines threequantitative approaches (shown in Table 3)for determining an operational risk capi-tal charge: the basic indicator approach,the standardized approach, and theadvanced measurement approach.

The first two approaches are simple andgenerate results on the basis of predeter-mined multipliers (percentages of grossincome11 for an entire entity or for indi-vidual business lines). The advanced



9 As noted in the August 2003 Advanced Notice of Proposed Rulemaking (ANPR), the Basel II framework in theUnited States applies to large, internationally active banking organizations. Mandatory banks are defined asthose with total assets of $250 billion or more or total on-balance-sheet foreign exposure of $10 billion or more.Such banks must apply advanced credit risk and operational risk approaches. Banks not subject to advancedapproaches on a mandatory basis (“opt-in” banks) may voluntarily apply those approaches. The ANPR is avail-able at www.fdic.gov/regulations/laws/publiccomments/basel/index.html. 10 The ratio thresholds for the Prompt Corrective Action categories are included in Subpart B of Part 325 of theFederal Deposit Insurance Corporation (FDIC) Rules and Regulations. Subpart B, issued by the FDIC pursuant tosection 38 of the Federal Deposit Insurance Act, establishes a framework of supervisory actions for insureddepository institutions that are not adequately capitalized. This subpart is available atwww.fdic.gov/regulations/laws/rules/2000-4500.html#2000part325.101. 11 Gross income is defined in Paragraph 650 of the revised Basel framework as net income plus net noninterestincome. This measure should be gross of any provisions (e.g., for unpaid interest); be gross of operatingexpenses, including fees paid to outsourcing service providers; exclude realized gains and losses from the saleof securities; and exclude extraordinary or irregular items, as well as income derived from insurance. The calcu-lations for the basic indicator and standardized approaches are based on average gross income figures over athree-year period, excluding periods in which gross income is negative or zero.

9

measurement approach (AMA) differsfrom the other two approaches in that itexplicitly attempts to estimate a bank’soperational risk exposure (aggregateoperational losses faced over a one-yearperiod) at a soundness level consistentwith a 99.9 percent confidence level.12

That is, in theory there should be only a1-in-1,000 probability that a bank’s oper-ational losses during a year will exceedthe AMA-estimated amount. Despite thestatistical challenges, banks typicallyselect a confidence level between 99.96percent and 99.98 percent for economiccapital modeling, which is generallyequivalent to the expected insolvencyrate for “AA” rated credit.

Banks adopting an AMA will effectivelycalculate operational risk capital using avalue at risk (VaR) approach common inboth market risk and credit risk manage-ment. The U.S. banking agencies havenot mandated the use of any particularquantitative methodology; however, each

institution employing an AMA must usethe following four elements in arriving atits operational risk capital estimate:internal data, external data, scenarioanalysis, and business environment andinternal control factors.

Conceptually, the operational risk capi-tal estimate can be expressed as protec-tion against expected and unexpectedfuture losses at a selected confidencelevel, with some provisions for offsettingportions of this exposure throughreserves or other permitted mitigationtechniques (namely insurance). Thisrelationship is reflected graphically inChart 2 using the loss distributionapproach (LDA), a common quantifica-tion method.

Expected losses (EL) are reflected onthe chart as the portion to the left of thedotted line marking the mean of thedistribution. The dotted line representsthe mean or expected value of the aggre-gate distribution of potential losses. Loss


Table 3

Basel II Approaches to Calculating Operational Risk Capital

Basic IndicatorApproach Standardized Approach

Advanced MeasurementApproach (AMA)

Supervisor-specificparameters

Bank-wide measure

Exposure indicator basedon gross income (15percent multiplier)

Supervisor-specificparameters

Business line measure

Exposure indicator basedon gross income (multipli-ers vary by business lineand range from 12 percentto 18 percent)

Bank-defined parameters

Supervisor establishes quanti-tative and qualitative standards

Significant flexibility

Examples:• Loss distribution approach• Scenario based• Extreme value theory

Ease of Use Potential Risk Sensitivity

12 As noted in the August 2003 ANPR, the AMA will be the only permitted quantification approach for U.S.-super-vised institutions (neither the basic indicator nor standardized approaches will be allowed).

10

levels falling in the EL category are typi-cally highly predictable and stable, andgenerally arise under normal operatingcircumstances. Banks may potentiallyuse capital-like substitutes (such as eligi-ble reserves per Generally AcceptedAccounting Principles) or other concep-tually sound methods to offset someportion of EL.

Unexpected losses (UL) on the chartare the area to the right of the dottedline. Migrating to the far right of the ULcategory (or the tail of the distribution)provides an increasingly high level ofconfidence that the estimate capturesthe appropriate degree of severity.

The Loss Distribution Approach

The LDA, or a hybrid thereof, hasemerged as the most common statisticalmethod to estimate a bank’s operationalrisk exposure. Through the LDA, bankscombine the four AMA elements withappropriate qualitative and quantitativeadjustments to derive their operationalrisk exposure estimates.

Example: A global institution has fivemajor business lines, one of which isthe consumer banking group (CBG).For simplicity we will consider onlyone business line, which is equal tothe bank’s unit of measure.13 CBGhas collected 25,000 loss events overthe past five years, with the majoritydefined as high-frequency, low-severityevents. To understand its full exposureover the next year, the CBG willconsider risks (both internal andexternal) that may not be representedin the internal data. For example, overthe last year, several banks in thesame business line have been sued forbreaches of customer information andhave settled for sums in excess of$1 billion. Additionally, the CBG hasdeveloped new product offerings andacquired several banks during theyear. The business line shouldconsider this information either byusing external loss data directly or byusing the information to developscenarios. The data from thesesources are combined using statisticalmethods to estimate operational riskexposure. The CBG should also incor-



13 A unit of measure represents the level at which a bank’s operational risk quantification system generates aseparate distribution of potential operational losses. For example, a unit of measure could be represented by abusiness line, loss event types, or a combination of both.

Loss Distribution Approach (LDA)

Prob

abili

ty

Aggregate Losses

EL UL

MeanRisk Mitigation— EL Offsets, Insurance

Tail Events

99.9%

Operational Risk Capital

Chart 2

11

porate changes into its residual risk(inherent risk less controls), as well asany risk mitigation offsets.

Quantification Challenges

Ongoing supervisory reviews and otherrecent industry studies indicate thatprogress has been made in quantifyingoperational risk. However, major chal-lenges remain, particularly with respectto addressing problems resulting prima-rily from data paucity. The primary quan-tification issues are as follows:

• Properly identifying units of measure

• Collecting adequate data (regardingfrequency and severity) for each unitof measure

• Calculating statistically significantparameters for each loss distribution

• Describing dependencies across unitsof measure if there is to be any diver-sification effect

• Determining how to incorporate andweigh each of the four required AMAelements within the modeling frame-work

ORM — Unique to Each Bank

Operational risk has emerged as adistinct discipline in response to Basel II,the increasing number of large opera-tional losses, and the growing size,sophistication, and complexity of thebanking industry. Regulators expectbanks that adopt Basel II to develop andimplement comprehensive ORM, data

and assessment, and quantificationprocesses that are appropriate to thenature of their activities, business envi-ronment, and internal controls.

The proposed operational risk capitalrules and supporting guidance14 establishbroad regulatory expectations whileenabling each bank to tailor its frame-work to its unique organizational struc-ture and culture. The embeddedflexibility will require regulators to exer-cise considerable judgment as theyconsider the appropriateness of thechosen ORM framework.

The vast majority of banks will continueto calculate regulatory capital underBasel I or Basel I-A (proposed)15 guide-lines, neither of which has an explicitoperational risk capital component.Nevertheless, many of the risk manage-ment principles being employed by thelargest U.S. banks can be used to somedegree by any institution regardless ofsize. The fundamental goal is the same:increasing operational risk awarenessand determining the means to minimizethe institution’s potential exposure.16

Alfred Seivold Senior Examination Specialist,San Francisco

Scott LeiferExamination Specialist, Boston

Scott UlmanSenior Quantitative RiskAnalyst, Washington, D.C.


14 The proposed operational risk capital rules are contained in the August 2003 ANPR. In conjunction with the ANPR’sissuance, the U.S banking agencies released proposed supervisory guidance to provide additional detail regardingsupervisory standards for operational risk management programs that will satisfy the qualification requirementsoutlined in the ANPR. The proposed supervisory guidance is available at www.fdic.gov/news/news/financial/2003/fil0362.html. 15 In October 2005, the U.S. banking agencies issued an ANPR to solicit comments regarding a new capital frame-work for banks that do not adopt the Basel II accord. This proposed framework, sometimes referred to as BaselI-A, is designed to modernize the risk-based capital rules and minimize potentially material differences in capitalrequirements between banks that adopt Basel II and banks that remain under existing rules. The ANPR is avail-able at www.fdic.gov/news/news/press/2005/pr10105a.html.16 Eric Holmquist, “The Fundamentals of Operational Risk Assessments,” OpRisk & Compliance, December 2005.

Banks and Hurricanes: A Look Back at the Storms of 2004–2005

As the 2006 hurricane seasonapproaches, bankers are reviewingplans for maintaining operations

in the event of a severe storm. A lookback at some bankers’ experiencesduring the storms of the 2004–2005seasons may provide context for thisplanning process. While the 2005 hurri-cane season was exceptionally severe, itillustrated the challenges banks may facein doing business in the aftermath of ahurricane or, potentially, other disasters.

This article is not a regulatory guide tobusiness continuity planning. Rather, itis an informal compilation of experi-ences, and thoughts about the challengesand planning options illustrated by thoseexperiences. Looking at how some insti-tutions met the challenges arising fromthe 2004 and 2005 storms may be ofinterest to other bankers as they preparefor the future.

Storms Challenge BusinessContinuity Plans

Preparing for a hurricane is challengingenough, but to remain fully prepared,storm after storm, for the resulting flood-ing and associated tornadoes takes agreat deal of effort and determination.Many communities had not yet fullyrecovered from the destruction of the2004 season’s hurricanes1 when 2005brought Dennis in July, Katrina inAugust, and Rita in September. Theresulting devastation left large portionsof five states without power, communica-tions, supplies, or reliable transportationsystems. The compounding effects oflosing both critical infrastructure andsupporting industry segments resulted ina prolonged recovery period — muchlonger than many business continuityplans (BCPs) addressed.

The scale of the devastation, unex-pected complications, and prolongedrecovery periods from these storms have caused many banks to reconsidercritical recovery priorities. Some of themost significant problems banks encoun-tered were unavailable personnel, inade-quate cash supplies, and loss ofcommunications, power, and multiplebanking facilities.

Personnel

One of the first things many banks real-ized is that even with a comprehensiveBCP, a working back-up facility, andcurrent copies of data files, people wereneeded for effective recovery operations.As the hurricanes approached, manybank employees evacuated. Manage-ment’s first task following the hurricaneswas to ascertain the safety and where-abouts of their employees.

After Hurricane Charley, bank officersat one large Florida community bankingorganization acted as a clearinghouse,taking inventory and coordinating theavailability of lodging and suppliesamong the staff. Management estab-lished a program to locate everyemployee, ascertain their immediateneeds, and make provisions to meetthose needs. They matched employeeswithout housing to those whose resi-dences were still habitable. The bankobtained necessary items and set up astorehouse where employees could havewhatever goods they needed. Manage-ment coordinated a daily potluck foodprogram and even arranged for childcare. Thanks to these efforts, bankemployees could focus on the recovery ofbank operations instead of personalneeds. The bank’s main office openedwithin days, damaged but functional, andpowered by a generator.


1 Hurricane Charley made landfall on August 13, 2004, as a category 4 storm; Frances on September 5 as a cate-gory 2; Ivan on September 15 as a category 3; and Jeanne on September 26 as a category 3.


For larger operations, such as serviceproviders with multiple locations, employ-ees from areas affected by the hurricaneswere shifted to corporate sites outside thedisaster area. Whenever possible, workwas shifted with employees. In oneinstance, the data center president,besides providing work space to the bank,took in the bank president’s family untilother arrangements could be made.

Staffing shortages also affected support-ing services such as transportation,communication, and security. Infrastruc-ture support staffs were especiallystretched to their limits by the storms of2005. Police and security firms weredealing with life-threatening emergen-cies. Securing damaged facilities immedi-ately after the disaster became thebanks’ responsibility. In severalinstances, bank officers stayed near or inbank buildings until more permanentarrangements to secure the buildingscould be made.

Meeting the challenge. The experiencesof 2004 and 2005 emphasize the impor-tance of appropriate methods to identifyand meet the needs of employees andtheir families so employees can focus onrecovery operations. Without the avail-ability of key recovery and operationspersonnel, timely recovery of criticaloperations will not be possible. Craig DeYoung, president of Charlotte StateBank, Port Charlotte, Florida, believes,“The initial primary focus must be onthe health and safety of your staff toensure they are all accounted for andhave a roof over their head as well asaccess to food and water. Once youhave their personal needs addressed,the likelihood of having a workforce tooperate your institution vastlyimproves.”

The 2005 experience especially illus-trates the desirability of having backup(redundant) personnel for key opera-tional positions and responsibilities and

having plans to use personnel from unaf-fected areas, if possible. Mr. De Youngoffers this advice: “…detailed maps arein all employee files so employees canbe located after a disaster. Those mapsshould not solely rely on names forroads (since signs are rarely remaining)but instead the number of roads orblocks from major intersections orlandmarks so locations can be found inextreme conditions.” The importance ofbeing prepared to work with regulatoryand emergency management personnelto locate missing employees and getrecovery personnel into affected areascannot be overemphasized.

Cash

Power and communications failuresprevented electronic forms of payment,such as debit and credit card use. With-out electronic access to funds, creditcards, debit cards, and even checksbecame useless. Cash quickly becamethe only viable means of payment, butcash was often in short supply. Gettingadditional supplies of cash into storm-damaged areas where transportation waslimited and security services stretchedthin posed difficulties. Consumers andemployees remaining in affected areasdesperately needed additional cash tomake critical purchases.

Meeting the challenge. The stormsreveal the importance of proper planningfor customer and employee cash needs,as well as consideration of distributionmethods, storage locations, and securityof the cash. Banks with comprehensivecustomer awareness programs to helpprepare their customers for a disasterhad a smoother transition to the recov-ery phase of their BCPs. Providing infor-mation on regulatory and othergovernment resources and Web sites alsohelped customers identify other avenuesfor critical services.

14

Communications

Voice communications. During andafter many of the storms, traditionalvoice phone circuits were down. In addi-tion, state and federal emergencyresponse authorities commandeered cellphone circuits to manage relief efforts.The Government Emergency Telecom-munications Service (GETS) CardProgram2 provided some limited voicecommunications for institutions that hadmade arrangements in advance. Whiletext messaging via the cell phonenetworks was still possible, the only reli-able means of voice communication formany people working on recoveringoperations was two-way radio or satellitephone.

Calling trees proved useless as theimpact of the hurricanes spread employ-ees far and wide. Some banks postedemergency Web sites to disseminateinformation to employees, as well as toinform customers of temporary loca-tions and service plans. Other banksused pre-established toll-free phonenumbers for employees to report in andobtain information.

Data processing. The widespreadcommunications outages resulting fromthe storms imposed considerable chal-lenges, especially for banks that relied onreal-time communications with dataprocessing service providers. For thosebanks and branch offices, connectivitywith the data processing facility was criti-cal to conduct routine banking business.Institutions without manual backupsystems or external electronic systemslocated out of the area were unable toconduct business.

One data processing service provider inFlorida experienced widespread loss ofcommunication to a significant numberof its client banks during HurricaneCharley. The service provider switched

the banks’ network connections to alter-nate communication paths using Perma-nent Virtual Circuit (PVC) technology,which rerouted the circuits. As a result,the affected banks were reconnected tothe data center by the following businessday.

After the 2005 hurricanes, many banksand their backup facilities were soseverely damaged that business opera-tions had to be moved to facilities outsidethe affected area. Establishing networkcommunications with these facilitiesposed new challenges that the use ofPVCs could not address. Eventually, thebanks working with the service providerestablished a secure virtual privatenetwork, allowing communications usinga standard Internet connection.

Transaction items and managementreports. In both 2004 and 2005, elec-tronic transmission of batch items andreport distribution were impossible for anumber of banks for an extended period.During localized disasters, the physicalmovement of these items is inconvenientbut possible. With the impact of thestorms resulting in traffic jams, gas short-ages, and security issues, delays of a dayor more were not unusual. Getting trans-action items to processing sites andproviding reports to managementbecame problematic. Institutions thathad planned for remote image capturewere better able to keep informationflowing.

Meeting the challenge. Effective BCPsconsider that normal land lines andcellular networks may be down forextended periods. The 2004–2005 hurri-cane seasons demonstrated the impor-tance of being prepared with alternativecommunication methods. Two-wayradios, satellite phones, wireless personaldigital assistants (PDAs), text messaging,and the GETS Card Program were allused to varying degrees.


Banks and Hurricanescontinued from pg. 13

2 FDIC FIL-84-2002, Financial and Banking Information Infrastructure Committee’s Interim Policy on the Sponsor-ship of Private Sector Financial Institutions in the GETS Card Program, issued August 6, 2002.

15

Emergency Web pages, which had beendeveloped in advance and stored off-site,also proved successful and could beeasily updated and posted on the bank’sWeb site. Darby Byrd, president ofOrange Savings Bank, Orange, Texas,noted, “We posted our emergencycontact phone numbers on our on-linebanking site as a communication tool.Almost immediately phone callsstarted pouring in.”

Incorporating communications ofgovernment agencies also served asuseful supplements to many banks’BCPs. Federal and state regulatorybodies are often highly visible, and cancommunicate information over majormedia outlets, including television andradio. Regulators can use those outlets toinform the public of information avail-able through their Web sites and emer-gency call centers.3

Keeping data and transactions movingand management reporting flowing afterthe storms proved critical to banks’recovery. Banks with BCPs that includedarrangements for alternative communi-cation paths were better able to keepbackroom operations going and to givemanagement the information necessaryfor recovery. Banks that had capabilityfor remote image capture also had moreinformation available during recovery.

Power

Availability of power was one of theareas of emphasis during business conti-nuity planning for Y2K. Many institutionsincluded in their BCPs arrangements foralternative power sources (multiplevendors), acquired generators, and madeplans for fuel deliveries. However, few, ifany, plans anticipated the widespreadfailure of a power grid, such as occurredin 2005. With portions of the power grid

inoperable, down-line power plants,transmission lines, and power distribu-tion centers were all affected.

Even banks with generators had prob-lems with flooding and fuel shortages.Many generators and switching stationswere in basements, which were subjectto flooding. Banks with working genera-tors soon found their fuel reservesrunning low. For many, deliveries of fuelbecame an ordeal, with delays measuredin hours or even days. In some cases,deliveries of fuel and other essential serv-ices were diverted for humanitarian andemergency efforts.

Meeting the challenge. While the 2004experience led many banks to invest inalternative power sources, such as gener-ators, 2005 highlighted the importanceof the location and fueling of such powersources, including alternative fuels (e.g.,propane and natural gas) for generators.Limited power and uncertainty aboutfuel deliveries were paramount in deci-sions about which equipment and facili-ties were powered following the storms,and even whether, and to what extent,operations needed to be scaled backduring the recovery period.

Facilities

The breadth of the devastation affectedevery aspect of business operations,including rendering many brick-and-mortar facilities unusable, at leasttemporarily. Some institutions came upwith unique solutions. For example, afterHurricane Katrina destroyed their facili-ties, several institutions in Baton Rougeand Kenner, Louisiana, cooperated toopen a shared facility so they could servetheir customers and instill confidencethat they were coming back. InLafayette, Louisiana, one institutionallowed a competitor to use a teller


3 After Hurricane Katrina, the FDIC established a 24-hour emergency consumer call center to answer questions.The emergency call center operated from September 8 until November 30, 2005. Calls after that time were routedthrough the normal “Ask FDIC” call center.

16

station at its branch office to conductbusiness. One Florida-based serviceprovider allowed a client bank and acompeting service provider to set uptemporary operations at its data centerfacilities after Hurricane Charley.

Immediately after Hurricanes Katrinaand Rita, federal and state banking regu-lators worked with the Department ofHomeland Security and law enforcementto arrange for bank officers to get intorestricted areas so recovery plans couldbe refined and temporary facilitiesopened. In some rural areas, state offi-cials helped bankers to enter the areasand assess their damage. Additionally,unprecedented cooperation betweenstate and local agencies helped to expe-dite building permits and inspections fortemporary facilities.

The existence, location, and capacity ofan adequate disaster recovery facility arecritical to any BCP. Fortunately for mostof the affected banks, capacity limita-tions at the recovery facility neverbecame a serious problem, as coopera-tion allowed for the movement of work tolocations that had adequate staff andequipment. However, the locations ofthese facilities were important. Somebanks’ recovery facilities were too nearbyand were destroyed by the same storm.Others were too far away, whichhindered recovery because of delays inrecovery staffs’ transportation to thefacilities.

Meeting the challenge. The broadgeographic areas affected by the stormsdemonstrate the importance of the loca-tion of banks’ recovery sites. Banks thatrecovered operations quickest had recov-ery sites outside the expected disasterarea and had planned that recovery teammembers would be sent to the site beforethe storms. “Buddy bank” arrangementsalso proved successful. In these arrange-ments, partnering banks are far enough

away from each other that a single disas-ter is unlikely to affect both, but not sofar that such an arrangement is useless.Each bank benefits from having aprearranged facility to serve customersand establish basic operations during therecovery process.

Effective BCPs Are Formal,Flexible, and Open-Ended

The 2004–2005 hurricane seasonshighlight the importance of enterprise-wide, comprehensive BCPs to thesurvival of an institutions and its abilityto serve customer needs. Most banks inthe Gulf Coast region had reasonableBCPs. Still, better testing of the continu-ity plans and recovery procedures couldhave identified problems ahead of time.The Business Continuity Planning ITExamination Handbook4 issued by theFederal Financial Institutions Examina-tion Council (FFIEC) on May 22, 2003,contains extensive guidance on businesscontinuity planning for banks. The FDICmaintains hurricane-specific guidance onits Web site.5

The FFIEC guidance stresses that thedevelopment of a successful BCPrequires a commitment of sufficientresources and delegation of authority bysenior management and the board. Theguidance states that a plan should bethoroughly and rigorously tested underrealistic disaster scenarios, include suffi-cient employee training measures, andbe updated on an ongoing basis toensure that it remains relevant. SteveFeller, vice president and head of Enter-prise Services Center Disaster RecoveryOperations at Harland Financial Solu-tions, provides this advice: “It is impor-tant that a bank and its serviceprovider work together throughout thelife cycle of business continuity plan-ning. Every step of the planning


4 See http://www.ffiec.gov/ffiecinfobase/html_pages/it_01.html.5 See http://www.fdic.gov/hurricane/index.html.

Banks and Hurricanescontinued from pg. 15

17

process is an opportunity for both tolearn together. That is why testing is soimportant — it creates opportunities tofind out what doesn’t work. When Ihave a test that doesn’t work asplanned, I tell my team that is asuccessful test, meaning that I want tofind that out now rather than during areal event. I stress learning how torespond quicker and recover fasterfrom every opportunity.”

No one plan is perfect for all situations.Effective BCPs are flexible and allow formodifications during execution. Themore information they include, thebetter prepared management will be toaddress the unexpected.


Personnel

• Coordinating activities to locate employeesand provide for their personal needs

• Cross-training employees to increaseoptions

Cash

• Prearranging for employee and customerdemand

• Planning to secure, store, and distributecash with limited power, staff, and security

• Communicating the availability and locationof cash to customers and regulators

Communications

• Addressing alternatives: text messaging,satellite phones, and two-way radios

• Participating in the GETS Program (FIL-84-2002)

• Using emergency Web pages to keepemployees and customers informed

Power

• Carefully considering location of generators• Planning for limited access to fuel for

extended periods• Using alternative fuels (propane, natural

gas)

Facilities

• Considering “buddy bank” arrangements• Ensuring that the backup site is far enough

away, but not too far• Coordinating with regulators to expedite the

establishment of temporary facilities

General

• Working together (bankers, regulators, andstate agencies) to accomplish more

• Anticipating the unexpected

Storm-Related Challenges and Options

James O. Brignac, CISAInformation Technology Examination Specialist, Dallas

Kevin J. Lenzmeier, CISANSCPInformation Technology Examiner, Tampa

The authors acknowledge the assistanceprovided by the following individuals inthe preparation of this article:

Mark A. ElliottFinancial Analyst, Dallas

Peter A. MartinoSupervisory Examiner, Tampa

Deona L. PayneField Supervisor, Tampa

Enforcement ActionsAgainst Individuals 2005: A Year in Review


This is the third and final article in aseries addressing insider fraud andenforcement actions. The first arti-

cle1 presented an overview of theenforcement action process; the second2

presented two enforcement action casestudies. This article will present detailson a calendar year of enforcementactions against individuals, focusing onthe losses to institutions and the impor-tance of oversight at all levels of a finan-cial institution as a deterrence to insiderfraud. Some representative fraud casesare included to illustrate how fraudulentactivities have been carried out for anumber of reasons, including personalgain, to conceal the deteriorating condi-tion of a bank customer, or to protect anindividual’s position in the financial insti-tution. Fraud has been a contributingfactor in many bank failures, as financialinstitutions are not always able to recoverfrom fraudulent activities.3 This articlewill look at the importance of board over-sight of senior bank management,4 whowere responsible for 80 percent of thefraud losses5 identified in these enforce-ment actions in 2005.

Overview of EnforcementActions Issued in 2005

In 2005, the Federal Deposit InsuranceCorporation (FDIC) issued 84 enforce-ment actions against individuals. Theenforcement actions included Orders ofRemoval/Prohibition, Orders to Pay Civil

Money Penalty, and Orders to Pay Resti-tution. Some respondents were issued anOrder of Removal/Prohibition with ajoint Order to Pay Civil Money Penalty orOrder to Pay Restitution. Of the enforce-ment actions issued in 2005, 63 percentwere stand-alone Orders of Removal/Prohibition and 5 percent were stand-alone Orders to Pay Civil Money Penalty.A total of 32 percent of the Removal/Prohibition cases involved either a jointOrder to Pay Civil Money Penalty or ajoint Order to Pay Restitution.

The individuals against whom the FDICissued enforcement actions in 2005caused 68 financial institutions to incura combined total loss of $67 million.6

The following comments present theFDIC’s 2005 removal/prohibition actioncases with a focus on loss to financialinstitutions. The cases are divided intothree categories to show the loss impactof fraudulent activities perpetrated byindividuals subject to the enforcementactions.

2005 Removal/ProhibitionOrders Classified by Loss

The enforcement actions issued in2005 (with the exception of the stand-alone Orders to Pay Civil Money Penalty)are grouped into categories on the basisof the gross amount of loss to the finan-cial institution:

1 Enforcement Actions Against Individuals in Fraud-Related Cases: An Overview, Supervisory Insights 2, Issue 1,Summer 2005. Available at www.fdic.gov/regulations/examinations/supervisory/insights/sisum05/article02_enforcement_action.html.2 Enforcement Actions Against Individuals: Case Studies, Supervisory Insights 2, Issue 2, Winter 2005. Availableat www.fdic.gov/regulations/examinations/supervisory/insights/siwin05/article03_enforcement.html.3 There were no bank failures in 2005.4 For this article, senior bank management includes the following positions of director, chairman of the board,president, chief executive officer, and chief financial officer.5 For this article, loss is the gross loss to the bank from fraud and/or misapplication of funds, before any reim-bursement such as restitution or a blanket bond payment. 6 The loss amounts discussed in this article represent only losses related to enforcement actions the FDIC issuedin the 2005 calendar year, not industry-wide fraud-related losses to financial institutions.


insider and for which the FDIC issuedOrders of Removal/Prohibition againsteach respondent. Some fraudulent activi-ties involved both the chairman of theboard and the president. The most signif-icant loss in this category was approxi-mately $34 million, which led to thebank’s insolvency and eventual mergerinto another financial institution. Exclud-ing this case, the total loss for Category1 is approximately $20 million, and theaverage loss adjusts to $2.3 million.While the Category 1 median miscon-duct period is 5.3 years, two cases at theupper limit are a misconduct period of14 years with a bank loss of $1.5 million,and a misconduct period of 20 yearswith a bank loss of $1.6 million. Thereare also cases in this category thatoccurred within a one-year period andstill resulted in significant loss to thefinancial institution. The median age forCategory 1 respondents was 56; norespondent in this category was less than40 years of age. Approximately half thetotal losses in Category 1 were used byrespondents for their personal benefit.The remaining losses were primarily loanlosses suffered by the institutions as aresult of the fraudulent insider activity.

• Category 1: losses totaling $1 millionor more

• Category 2: losses totaling $250,000to $999,999

• Category 3: losses totaling $249,999or less. This category also includescases with no loss to the bank, but inwhich the institution’s depositors wereor could have been prejudiced7 or therespondent received financial gain orother benefit.

The categories also contrast the variousfactors related to the enforcement actioncases and highlight the impact of fraudperpetrated by senior bank management.Table 1 provides a breakdown of thecategories and the resulting losses.

Category 1

With total losses of approximately$54.5 million, the enforcement actioncases in Category 1 represented thegreatest loss to financial institutions. It isnotable that most cases in Category 1were perpetrated by senior bank manage-ment, including board chairmen, presi-dents, and internal directors. Thiscategory includes fraud schemes thatwere carried out by more than one

Table 1

Removal/Prohibition Orders Classified by Loss — 2005

Number of Personal Gain MedianPeriod of Recovery of LossTotal Number Institutions Average Loss (Percent of Misconduct (Percent ofLoss of Cases with Losses per Institution Total Loss)a Before Discoveryb Total Loss)c

Category 1 $54,500,000 12 10 $5,450,000 51 percent 5.3 years 3 percent

Category 2 $8,600,000 20 19 $453,000 48 percent 3.6 years 18 percent

Category 3 $4,100,000 48 39 $105,000 93 percent 2.6 years 31 percenta Personal gain refers to the total loss amount of each category that was used for the personal benefit of the respondents.b Discovery refers to the date the misconduct was discovered. Fraudulent activities have been discovered by bank personnel, auditors, andFDIC examiners. c Recovery of loss refers to recovery from restitution or bond claim payment as of the date the enforcement action was issued.

7 Defined by Section 8(e) Removal and Prohibition Authority of the Federal Deposit Insurance Act.


Category 2

Category 2 involves 20 cases and atotal loss of approximately $8.6 million.While only two cases in this categoryinvolved senior bank management, theremaining cases included various otherlevels of bank management, includingassistant vice presidents, vice presidents,assistant cashiers, branch managers,senior loan officers, and loan officers. Aswith Category 1, the fraudulent activitiesof individuals in management positionscaused the greatest financial loss. Theyoungest respondent in this category was30 years of age; the median age of therespondents was 47. The highest loss ofthe category, $800,000, occurred over aten-year period, and the insider responsi-ble for the loss was the bank’s president.As with Category 1, funds used byrespondents for their personal benefitrepresented approximately half of thetotal losses in Category 2.

Category 3

This category includes 39 cases with atotal loss of approximately $4.1 million.Category 3 also includes nine enforce-ment action cases in which there was nomonetary loss to the financial institution.However, the no-loss cases resulted inpersonal gain or benefit to the respon-dents, and the institutions’ depositorswere or could have been prejudiced.Most of the no-loss cases involved seniorbank management. The respondents inCategory 3 ranged from a chairman ofthe board to a teller/proof operator. Theyoungest respondent was 23; the medianage was 43.

Senior Bank Management —The Primary Cause of Fraud-Related Losses

The total loss to financial institutionsresulting from the conduct of individualsagainst whom the FDIC issued enforce-ment actions in 2005 was approximately$67 million. Senior bank management

was responsible for 80 percent of thoselosses. Clearly, the significance of thoselosses emphasizes the need for strongboard oversight of senior bank manage-ment, including fellow directors. Insidersin senior management positions haveperpetrated fraudulent schemes forpersonal gain, to conceal the deteriorat-ing financial condition of loan customers,and to protect their positions. The follow-ing examples illustrate some of the fraud-ulent activities conducted by senior bankmanagement.

• A former director, president, and chiefexecutive officer (respondent)presented a $500,000 constructionloan to the board, and the loan wasapproved. The respondent divertedmore than $200,000 of the line ofcredit to himself (personal gain) andto friends for speculative businesstransactions. The respondent alsoreleased the guarantor of the loan.When the respondent presented theloan to the board for renewal, the loanwas unsecured; however, the respon-dent did not disclose the unsecurednature of the loan to the board. Therespondent repaid the diverted funds;therefore, the bank did not suffer aloss on the credit. However, therespondent received economic benefitfrom the balance of the divertedfunds. The respondent was able tocommit the fraud primarily because ofthe lack of appropriate disclosure tothe board of directors and the lack ofverification requirements for loandisbursements.

• A former director (respondent) usedbusiness checking accounts that hecontrolled at the bank and at a secondfinancial institution to carry out acheck kiting scheme between the twoinstitutions. The respondent’s transac-tions were included in the bank’s kitesuspect report; however, due to poorinternal controls, the situation wasnever reported to the board. The twobanks suffered a combined loss of$1 million on the overdrawn balances

Enforcement Actionscontinued from pg. 19

21

(respondent’s personal gain). Therespondent eventually made full resti-tution for the loss.

• A former director, president, chiefexecutive officer, and chairman of thebank’s loan committee (respondent)extended loans totaling more than$5 million to one borrower in violationof the bank’s internal lending limit.The respondent exceeded the lendinglimit by dividing the loans among vari-ous relatives of the borrower; however,proceeds of the multiple loans werefunneled to one deposit account. Therespondent did not disclose to theboard that the loans were for the bene-fit of a single borrower or that thesource of repayment for all loans wasthe same. The respondent substitutedloan customer names on bank recordsso that it appeared the bank wascomplying with its lending limit. Therespondent also falsified loan docu-ments and failed to inform the boardof the true purpose of the credits. As aresult of poor internal controls, therespondent was able to fund loans inexcess of his authorized lendingauthority without prior board approval.The bank suffered a loss of$1.4 million on the loans; the respon-dent had no personal gain.

• A former director and executive vicepresident (respondent) embezzledfunds by issuing cashier’s checks andmaking offsetting entries to a generalledger receivables account. Therespondent then deposited thecashier’s checks into his personalaccounts at another financial institu-tion. This process was repeatednumerous times. The respondentconcealed the growing receivablesaccount by manipulating bank recordsbefore the end of a calendar quarter,at month-end, and before a regulatoryexamination. During these periods,the respondent would clear out thereceivables account with offsettingfalse entries to both legitimate and

fictitious loan accounts. The respon-dent was able to conceal the fraudactivity due to the bank’s internalcontrol deficiencies and his manage-ment position. The bank suffered aloss of $1.6 million and personal gainto the respondent was the same.

• A former chairman of the board and aformer president (respondents)engaged in hazardous lending prac-tices in the bank’s automobile financ-ing portfolio. Due to weak internalcontrols, the respondents circum-vented the bank’s normal loan proce-dures and the bank’s loan policy. Therespondents acted outside of thebank’s loan policy, as they were theonly approving officials on the subjectloans. The respondents funded theloans without the appropriate docu-mentation to support a funding deci-sion, and funding was providedwithout confirming a borrower’s abil-ity to pay. The bank suffered a loss of$1.3 million. One respondent, whohad a financial interest in the businessthat benefited from the loans,obtained personal gain.

• A former chairman of the board/majority shareholder and a formerpresident/chief executive officer(respondents) engaged in a nomineeloan scheme that exposed the bank tolosses of more than $30 million. Theformer president/chief executive offi-cer originated the nominee loansknowing their true purpose, and therespondents presented the loans tothe board of directors without disclos-ing their true nature. The proceeds ofthe nominee loans were used to makea fraudulent capital injection into thebank and to refinance nonperformingloans. Even though limited financialinformation was presented for theseloans, the board approved many ofthem on the basis of the respondents’recommendations. The respondentswere able to conceal the true purposeof the loans because the former chair-


22

man of the board dominated theaffairs of the bank. Loans referred tothe bank by the respondents werealmost always approved regardless oftheir lack of documentation, financialanalysis, or appropriate underwriting.The more than $30 million in nomi-nee loan losses caused the bank’sinsolvency.

Oversight — The Deterrenceto Insider Fraud

Ultimate responsibility for preventingfraud rests with the board of directors,which must create, implement, andmonitor a system of internal controlsand reporting. The board also appointsexecutive officers, who share the respon-sibility for the financial institution’s well-being. As demonstrated above, the mostsignificant losses have been perpetratedby senior bank management; therefore,the board must ensure that appropriatecontrols are in place throughout theinstitution and must actively review theactivities of senior management. Most ofthe cases described above reflect thelack of appropriate board disclosure,poor internal controls, or dominance ofthe board by a single individual. Asstated in the first two articles of thisseries, bank employees in positions oftrust can exploit internal control weak-nesses to conduct improper activities.Strong management oversight and thor-ough audit and loan review programs are

essential to identifying and deterringwrongdoing.

Although not all fraud can beprevented, procedures should be estab-lished whereby suspicious activity of anyinsider is reported to senior bankmanagement and the board. Refer to thetext box for key directorate responsibili-ties. In addition, the board shoulddevelop operational policies and requiremanagement to adhere to the policies.For example, deviations from the board’sapproved loan policy, which generallyprovides guidelines regarding officerlending authority and loan documenta-tion requirements, should be approvedby the board, or an individual or commit-tee designated by the board. Most impor-tant, the board should question andinvestigate the actions of insiders that donot conform to the board’s policies, orthat are of a suspicious nature.

A board of directors’ primary responsi-bilities are formulating sound policiesand objectives for the bank and effec-tively supervising the bank’s affairs andwelfare. The circumstances surroundingeach of the 2005 enforcement actionsissued by the FDIC indicate that an esti-mated $67 million in losses might havebeen avoided or reduced by sound boardoversight and supervision and strongaudit programs.

Teresa RodriguezReview Examiner Washington, D.C.


Enforcement Actionscontinued from pg. 21


8 Enforcement Actions Against Individuals: Case Studies.9 www.fdic.gov/regulations/resources/directorscorner/index.html.10 FIL-80-2005, Fraud Hotline: Guidance on Implementing a Fraud Hotline. Available atwww.fdic.gov/news/news/financial/2005/fil8005.html.11 www.fdic.gov/regulations/resources/directorscorner/index.html.

Key Director Responsibilities in Deterring Fraud■ Internal Controls and Audit Program. Establish a strong audit program. Sound inter-

nal controls and audit functions are essential to inform the board of the adequacyand effectiveness of accounting, operating, and administrative controls of ongoingoperations. The Winter 2005 issue of Supervisory Insights8 discusses the compo-nents of a strong internal audit program. In addition, the FDIC’s Director’s CornerWeb site provides access to various guidance and resources on auditing and inter-nal controls.9

■ Director Supervision. Establish procedures that require operational information tobe reported to the board in a consistent format and at regular intervals. Board-requested information should include, but is not limited to, reports of internal andexternal audit, general portfolio composition, capital growth, loan limits, loan lossesand recoveries, and policy exceptions. In addition, the board should establishcommittees such as a loan or audit committee to supervise key operations moreclosely and report to the board.

■ Institution Culture. Establish a culture of open communication between the board,management, and bank employees. In such a culture, a bank employee may inquireabout a suspicious activity of senior management and have an avenue to report thesituation to the board, whether directly or through a fraud hotline.10

■ Suspicious Activity Reports. Report to the board any Suspicious Activity Reports(SARs) filed and record the SAR filing in the board minutes. SARs play a crucial partin the removal/prohibition of insiders who have committed frauds against financialinstitutions. Part 353 of the FDIC’s Rules and Regulations requires banks to file aSAR with the Financial Crimes Enforcement Network (FinCEN) when insider abuseis suspected, regardless of the amount involved. The SAR must be filed no laterthan 30 calendar days from the date the suspicious activity was detected.

■ Director Training/Education. Directors should participate in appropriate training toexpand their knowledge of the various banking areas and stay current with changesin banking laws and regulations. Directors are encouraged to participate in theFDIC’s Director’s College Program, which provides training in director responsibili-ties. The Director’s College Program is held several times a year, at various locationsnationwide. The FDIC Director’s Corner Web site provides information on the Direc-tor’s College Program and other resources for bank directors.11

This regular feature focuses on devel-opments that affect the bank examina-tion function. We welcome ideas forfuture columns. Readers are encour-aged to e-mail suggestions to [email protected].

Two years have passed since theFederal Reserve Board’s (FRB)latest revisions to Regulation C,1

the implementing regulation for theHome Mortgage Disclosure Act(HMDA),2 became effective. Among thechanges made by the FRB, the mostnotable required reporting on loan pric-ing data. This article discusses theimpact of the latest changes to Regula-tion C on fair lending examinations andon the HMDA examination process. Thearticle also provides information onsome of the most common HMDA viola-tions identified since the implementationof the new requirements.

With the advent of these changes, theFDIC now has additional information toconsider in the scoping and focusing offair lending examinations. According to aSeptember 13, 2005, Federal FinancialInstitutions Examination Council(FFIEC) press release, 8,853 institutionsreported HMDA data for 2004. Deposi-tory and for-profit nondepository institu-tions must report HMDA data dependingon their asset size, extent of business ina metropolitan statistical area, andwhether or not they offer residential

mortgage lending. For 2004, the assetthreshold3 for depository institutions was$33 million. The FDIC oversees approxi-mately 2,800 HMDA reporters, or nearly32 percent of all HMDA reporters.

HMDA was enacted in 1975 to providethe public with loan data that would assistin determining whether institutions wereserving the housing needs of theircommunities. It also provided anenhanced tool for examiners and othersto use in identifying discriminatory lend-ing practices, and assisted public officialsin distributing public-sector investments.4

Even with the new data, however, it isimportant to note that analysis of thedata alone cannot identify discriminatorylending practices. The HMDA data, whileproviding some good red flag indicators,does not include information on the cred-itworthiness of borrowers or other crite-ria (such as loan-to-value ratios or creditscores) that a bank may use in pricingloans. The new collection and reportingrequirements, however, do provide animproved starting point for identifyingpotential discriminatory practices.

Fair Lending and the NewData

The new requirements garnering themost attention and having the most effecton the fair lending examination processare the reporting of the following:

1 On January 23, 2002, the Federal Reserve Board (Board) adopted a final rule amending Regulation C, effectiveJanuary 1, 2003. See 67 FR 7222, February 15, 2002. The Board subsequently delayed the effective date of theamendments until January 1, 2004. See 67 FR 30771, May 8, 2002. 2 12 U.S.C. §2801, et seq.3 Section 203.2 (e)(1)(i) of Regulation C provides that the Federal Reserve Board will adjust the exemption thresh-old for depository institutions annually based on the year-to-year change in the average of the Consumer PriceIndex for Urban Wage Earners and Clerical Workers (CPIW), not seasonally adjusted, for each 12-month periodending in November, rounded to the nearest million. 4 12 C.F.R. §203.1(b).


From the Examiner’s Desk . . .Two Years After: Assessing the Impact of the NewHMDA Reporting Requirements


• Rate spreads

• Home Ownership and Equity Protec-tion Act (HOEPA)5 applicability

• Modified racial/ethnic categories

Rate spreads have been added to thereporting requirements to help identifyloan pricing practices that may warrantfurther investigation. Rate spreads arereported if the spread between the loan’sannual percentage rate and the Treasuryyield equals or exceeds 3 percentagepoints for first-lien loans or 5 percentagepoints for subordinate-lien loans.6 Thedata are reported for all originations ofhome purchase, dwelling-secured homeimprovement, and refinance loans.

HMDA reporters must also report theHOEPA status of loans. HOEPA loanshave unusually high interest rates or fees.Identifying these loans helps examinersdetect abusive practices that have accom-panied some of these loans in the past.

The racial/ethnic categories have beenrevised to reflect recent changes to theOffice of Management and Budget(OMB) racial and ethnic standards forfederal statistics and administrativereporting, and to conform to CensusBureau definitions. Instead of five mutu-ally exclusive categories that combinerace and ethnicity, applicants now desig-nate their ethnicity (“Hispanic” or “Notof Hispanic Origin”) separately fromrace. Applicants may also indicate morethan one racial category. Additionally,

lenders must now ask applicants theirethnicity, race, and sex in applicationsreceived by telephone, mail, or over theInternet.7 These changes allow examin-ers to identify and compare applicantson the basis of race and ethnicity moreaccurately.

Table 1 provides summary informationon changes to HMDA data collection andreporting requirements.

Examination Impact

Fair Lending ExaminationProcedures

Examiners consider pricing systemsand discretionary pricing practices inconjunction with the new pricing data asa part of the scoping process wheneverthey examine any HMDA reporter. Whensignificant disparities8 are found in asystem that permits pricing discretion, acomparative loan file analysis isconducted to determine the reason forthe pricing differences.

FDIC’s headquarters staff 9 reviews thedata annually for all HMDA reportinginstitutions to identify institutions thatappear to have particularly strong indica-tors of possible discrimination in thepricing of one or more loan products.These institutions undergo increasedscrutiny and may receive an acceleratedfair lending examination, including acomparative file analysis.

5 HOEPA, contained in the Riegle Community Development and Regulatory Improvement Act of 1994, Pub. L. 103-325, was enacted in response to anecdotal evidence of abusive lending practices in the home-equity lendingmarket. HOEPA imposes certain disclosure requirements, as well as some substantive limitations, on certainhome-equity loans with rates and fees above a certain percentage or amount. HOEPA is implemented throughthe Federal Reserve Boards’ Regulation Z, including 12 C.F.R. §226.31, §226.32, and §226.34.6 12 C.F.R §203.4(a)(12).7 Lenders were required to ask applicants their race, national origin, and sex in applications taken entirely bytelephone effective January 1, 2003. The revised ethnicity and race categories did not take effect until January 1,2004. See 67 FR 43217 and 67 FR 43218.8 A determination of significant disparities typically involves a statistical analysis conducted by Regional andheadquarters fair lending specialists and statisticians. 9 The FDIC’s Division of Supervision and Consumer Protection works closely with statisticians and economists inthe Division of Insurance and Research to develop screening techniques to identify institutions that exhibit anunusually high risk of pricing discrimination against one or more racial/ethnic minority groups or women.

Data Element Description of Change

Property type Requires lenders to identify applications and loans that involve manufactured housing. It is antici-pated that reporting these loans separately will help explain differences in denial rates and pricing.

Loan purpose Redefined the definitions of refinancing and home improvement loans to provide more consistencyand reliability of data.

Preapproval requests (Preapprovals The revisions require lenders to report information on requests for preapprovals of home purchase should be distinguished from prequali- loans. Data on denied preapprovals will provide more complete information on the availability of home fications, which are not reported for financing.HMDA purposes)

Lien status Lenders now must report the lien status of applications and originated loans. These data will be used to help interpret rate spread data and to differentiate between secured and unsecured home improvement loans.

Type of purchaser For loans originated or purchased and then sold within the same year, the type of entity that purchased the loan must be reported. The types of purchasers have been expanded to increase theusability of the data and provide information about the secondary market.

Coverage rule Nondepository lenders must report if they originated home purchase loans, including refinances, (Nondepository lenders) equaling at least $25 million in the preceding calendar year.

Application information New ethnicity categories, “Hispanic” and “Not of Hispanic Origin,” were created, and the race categories were revised to reflect changes to OMB standards. Lenders also must now ask for ethnicity, race, and sex in applications taken by telephone, mail, or Internet.

Additional data items For loan originations, lenders must now report the rate spread between the annual percentage rate and the yield on comparable Treasury securities, if the spread exceeds or equals 3 percentage points for first-lien loans or 5 percentage points for subordinate-lien loans. Lenders must also report whethera loan is subject to the Home Ownership and Equity Protection Act.

HMDA sampling and New HMDA fields to the list of key fields include the following:resubmission • Property typeprocedures • Request for preapproval

• Ethnicity, race, and sex of the applicant and co-applicant• Type of purchaser• Rate spread• HOEPA status• Lien status

These fields are considered critical to the integrity of analyses of the overall HMDA data.


In conducting a comparative file analy-sis, examiners consider both race andethnicity. Selecting a target group (thegroup suspected of receiving less favor-able treatment) that will be the focalpoint of a fair lending review requiresexaminer discretion. Selection of both atarget group and an appropriate controlgroup (the group suspected to be receiv-ing more favorable treatment) may incor-porate both race and ethnicity. For

example, a common control group wouldbe non-Hispanic (ethnicity) whites(race). The addition of ethnicity informa-tion and the ability of applicants to selectmore than one race allow a moreprecisely targeted analysis.

The addition of rate spread and HOEPAinformation to the HMDA data providesexaminers additional tools to scope andfocus fair lending examinations. Examin-ers use the data to compare different

From the Examiner’s Desk . . .continued from pg. 25

Table 1

HMDA Data Changes, Effective 1/1/2004


lenders in the market and to more read-ily identify secondary market loans (seepurchaser type code changes in Table 1).

In all comparisons, examiners look fordifferences in how certain target groupsare treated compared to an appropriatecontrol group. Appropriate racial/ethnic/sex comparisons are made withineach combination of loan type, propertytype, loan purpose, and lien type. Forexample, the percentage of loans to non-Hispanic whites for which rate spreadsare reported are compared to thepercentage of loans to Hispanics forwhich rate spreads are reported. Theaverage spread for target and controlgroup loans is also analyzed.

Examiners also use the race/ethnicityor sex HMDA data elements in conjunc-tion with the pricing information to deter-mine the need for a steering analysis. A steering analysis determines whetherlending personnel guide, or “steer,” appli-cants from a market-rate product forwhich the applicants may qualify to a lessfavorable alternative (e.g., a more expen-sive subprime mortgage product). Whileguiding an applicant to a loan productthat meets that applicant’s individualqualifications is not illegal, it can result infair lending violations when the reasonfor the referral is not related to the appli-cant’s creditworthiness, but rather to oneof the prohibited bases.

For example, a bank may originateloans subject to HMDA reporting throughboth a mortgage division and aconsumer loan division. Loans originatedthrough a bank’s internal consumer loandivision are typically priced higher, ineither rates or fees, than loans sold onthe secondary market through its mort-gage division. In such situations, examin-ers consider whether target groupapplicants are discriminatorily steered to

the consumer loan division. In most insti-tutions, part of the loan number on theHMDA-Loan Application Register(HMDA-LAR) will indicate which divisionoriginated the loan. The HMDA data field“Type of Purchaser” can also help distin-guish between in-house loans, which areoften originated out of a consumer loandivision, and secondary market loans,which are sold to investors. In addition tothe data analysis, customer interviewsmay be required to substantiate whethersteering is occurring. A decision onwhether to conduct customer interviewsis made only after consultation withsenior headquarters staff.

Throughout the fair lending examina-tion process, examiners consult withRegional fair lending examinationspecialists and, in many cases, headquar-ters fair lending staff, to ensure thatfinancial institutions receive consistenttreatment on both a Regional and anational basis. If a pattern or practice ofdiscrimination is identified, the violationis referred to the Department of Justice(DOJ). The referral provisions of theEqual Credit Opportunity Act (ECOA)10

require that the federal financial institu-tion regulatory agencies make a referralto the DOJ “whenever the agency hasreason to believe that one or more credi-tors has engaged in a pattern or practiceof discouraging or denying applicationsfor credit” in violation of ECOA’s generalrule prohibiting discrimination. At theFDIC, referral to DOJ is initiated throughformal consultations with the Regionaloffice and headquarters in Washington.

HMDA Examination Procedures

Interagency Examination Procedures11

were revised to address the new HMDAdata requirements. Under the new proce-dures, and consistent with the FDIC’s

10 ECOA, 15 U.S.C. §1691e(g).11 Revised Interagency Examination Procedures for the Home Mortgage Disclosure Act,www.fdic.gov/new/news/financial/2004/fil7104b.pdf.


compliance examination focus,12 examin-ers now concentrate their review of HMDAcompliance on determining the effective-ness of an institution’s compliance man-agement system with regard to HMDAdata collection and reporting require-ments. The data are tested as necessaryto determine whether the compliancemanagement system is adequate.

Accurate HMDA reporting is critical.HMDA data are made available to thepublic to help determine whether institu-tions are serving the housing needs oftheir communities and to identify poten-tial discriminatory lending patterns. Thenew HMDA pricing information has beenof significant interest to many public andprivate groups, including consumergroups, community groups, federal regu-lators, and congressional committees. Inaddition, the financial institution regula-tory agencies use the data in conjunctionwith Community Reinvestment Actperformance evaluations, as well as fairlending examinations. Inaccurate collec-tion and reporting of HMDA data result-

ing in significant violations could subjectan institution to civil money penalties.The FFIEC interagency examinationguidance states that every bank, regard-less of asset size, should have compre-hensive audit and review procedures toverify the accuracy of its HMDA data.

Through management interviews andreviews of a bank’s written policies, inter-nal controls, and HMDA-LAR, examinersdetermine whether the bank has adoptedand implemented comprehensive proce-dures to ensure adequate compilation ofhome mortgage disclosure information inaccordance with Section 203.4(a-e).Examiners also interview the bank’s front-line HMDA personnel and review trainingrecords to determine the effectiveness ofa bank’s policies and training program.

Examiners determine whether the bankhas a system for tracking rate lock datesand rate spreads.13 Examiners alsoreview for written procedures relating tothe collection of ethnicity, race, and sexdata for all applications received by tele-phone, mail, or Internet.

12 See “Compliance Examinations: A Change in Focus,” Supervisory Insights Vol.1, Issue 1, Summer 2004,www.fdic.gov/regulations/examinations/supervisory/insights/sisum04/compliance.html.13 The FFIEC’s rate spread calculator page provides a good model for a tracking form. www.ffiec.gov/ratespread/default/aspx/.

From the Examiner’s Desk . . .continued from pg. 27

Common HMDA ViolationsIn a December 5, 2005, memorandum, the FFIEC reported that the common reporting errors in the

2004 data pertained to HOEPA status, rate spread, and preapproval codes. (Seewww.ffiec.gov/hmda/pdf/FFIECguidance2005.pdf.)

A limited review of HMDA examinations since the reporting of the new data revealed that errorsin collecting and reporting data elements often resulted in violations of law. Deficiencies notedwere similar to those addressed in the December 2005 FFIEC memorandum, with the mostfrequently cited violations pertaining to the HOEPA status and the rate spread information. Forexample, some banks incorrectly reported rate spread information for loans that were not subjectto Regulation Z. Others inaccurately reported loans as being subject to HOEPA, had erroneousinformation pertaining to preapproval requests, or failed to collect the ethnicity of applicants.

While violations may reflect errors rather than willful violation of requirements, repeat violationsof the same or similar nature in subsequent examinations can result in the assessment of civilmoney penalties. Further review indicated that the HMDA violations often stemmed from weak-nesses in the banks’ compliance management systems, including inadequate training, insufficientmonitoring, and lack of appropriate audit procedures. Addressing these weaknesses can minimizethe potential for future violations.

29

Conclusion

The latest changes to the HMDA datacollection and reporting requirementsprovide examiners more readily availabledata for initial analysis, which shouldimprove the efficiency and quality of thefair lending scoping process. Examiners’ability to identify loan pricing concernsthat warrant further investigation shouldbe substantially enhanced. Preliminaryquestions that examiners pose mostoften include the following:

• To what extent are there disparaterates of higher-priced loans in minor-ity communities, and why?

• What pricing disparities exist amongborrowers of different races, ethnici-ties, or genders, and why?

• Do the disparities reflect importantnew homeownership opportunities forsome borrowers that would not other-wise exist — or unfair treatment?

• To what extent do disparities existamong insured financial institutions,affiliated mortgage companies, orindependent mortgage companiesthat focus on the subprime market?

Information on current HMDA viola-tions indicates the continuing need forbank management to provide appropri-ate oversight of their banks’ HMDAreporting systems to ensure accuratereporting. Institutions that have beensuccessful with their HMDA programsprovide effective training, a strong inter-nal monitoring system, and audit proce-dures that identify and address theunderlying causes of violations.

Julie V. BanfieldField Supervisor, Nashville, TN

Sandra JesbergerField Review Examiner, New York, NY

Elizabeth C. BorioCompliance Examiner,Philadelphia, PA

Christine StammenField Review Examiner,Nashville, TN


For banking organizations that issuestock options to their employees,January 1, 2006, marked a water-

shed event. On that date, Statement ofFinancial Accounting Standards No. 123(Revised), Share-Based Payment (FAS123(R)), took effect for entities with acalendar year fiscal year and eliminatedthe choice between two significantlydifferent methods of accounting foremployee stock options. Under FAS123(R), an entity that awards stockoptions to its employees must recognizethe cost of employee services received inexchange for the award, generally basedon the fair value of the options. Underprevious accounting standards, an entitycould choose to adopt the fair-value-basedmethod for measuring the cost ofemployee stock options or a method thatgenerally resulted in the recognition of nocompensation cost. Although an increas-ing number of banking organizations andother companies had adopted the fair-value-based method in recent years, mostentities had continued to apply the lattermethod, known as the intrinsic valuemethod, for financial reporting purposes.Because of the significance of thechanges brought about by FAS 123(R),this article discusses its key provisionsand its effect on banks’ reported earningsand capital levels.

Key Elements of FAS 123(R)

The Financial Accounting StandardsBoard (FASB) adopted FAS 123(R) inDecember 2004 to replace FASB State-ment No. 123, Accounting for Stock-Based Compensation (FAS 123), whichwas issued in 1995, and to supersedeAccounting Principles Board OpinionNo. 25, Accounting for Stock Issued to

Employees (APB 25), which dates backto 1972. The FASB summarized theprovisions of these earlier standards inFAS 123(R) as follows:

Statement 123 established the fair-value-based method of accounting aspreferable for share-based compensa-tion awarded to employees andencouraged, but did not require, enti-ties to adopt it. . . . Statement 123allowed entities to continue account-ing for share-based compensationarrangements with employees accord-ing to the intrinsic value method inAPB Opinion No. 25, Accounting forStock Issued to Employees, underwhich no compensation cost wasrecognized for employee share optionsthat met specified criteria. Public enti-ties that continued to use the intrinsicvalue method were required todisclose pro forma measures of netincome and earnings per share as ifthey had used the fair-value-basedmethod [to recognize the cost ofemployee share options in theirincome statements]. Nonpublic enti-ties that continued to use the intrinsicvalue method were required to makepro forma disclosures as if they hadused the minimum value method orthe fair-value-based method for recog-nition [in their income statements].

FAS 123(R) applies broadly to all share-based payment transactions in which abanking organization or other entityacquires goods or services from anemployee or a supplier or other nonem-ployee by issuing, or offering to issue,shares of its equity, stock options, orother equity instruments.1,2 In general, italso addresses transactions in which anentity incurs liabilities to an employee or

Accounting News: Accountingfor Employee Stock Options

1 For such share-based payment transactions with nonemployees, an entity must also follow the guidance inEmerging Issues Task Force Issue No. 96-18, “Accounting for Equity Instruments That Are Issued to Other ThanEmployees for Acquiring, or in Conjunction with Selling, Goods or Services.”2 However, FAS 123(R) does not apply to equity instruments held by an employee stock ownership plan (ESOP),the accounting for which is governed by American Institute of Certified Public Accountants’ Statement of Posi-tion 93-6, Employers’ Accounting for Employee Stock Ownership Plans.


nonemployee in amounts at least partiallybased on the price of the entity’s equityinstruments or that are or may bepayable by issuing equity instruments. Inaddition to employee stock options with awide variety of characteristics, share-based payment arrangements withemployees to which FAS 123(R) appliesinclude stock appreciation rights,restricted stock awards, restricted stockunits, performance share plans, perfor-mance unit plans, and employee stockpurchase plans.

In FAS 123(R), the FASB establishedtwo overarching principles that apply toall share-based payment transactions: arecognition principle and a measurementprinciple. As applied to employee stockoptions, the first principle provides thatan entity must recognize in its financialstatements the employee servicesreceived as they are received in exchangefor the issuance of the options. The entityalso recognizes a corresponding increasein equity capital (or, in some cases, liabil-ities). As these services are consumed,the entity recognizes the related cost inits income statement as expensesincurred for employee services.3 Thesecond principle states that the stockoptions must be measured based on theirfair value (or, in some cases, a calculatedvalue). FAS 123(R) also provides guid-ance on the accounting for modificationsof awards and the tax effects of share-based compensation arrangements, and itestablishes disclosure requirements forthese arrangements. The standard’s tran-sition rules explain how entities shouldaccount for stock options awarded inperiods before the effective date of FAS123(R).

Description of Employee StockOptions

FAS 123(R) defines a “share option”generically as a “contract that gives theholder the right, but not the obligation,either to purchase (to call) or to sell (toput) a certain number of shares at apredetermined price for a specifiedperiod of time,” and adds that most shareoptions granted to employees are calloptions. Identifying the terms of stockoptions awarded to employees is essentialto properly account for the options. Asthe definition indicates, two of the termsare the exercise price of the options (andwhether and how it may subsequently beadjusted) and the options’ contractualterm. The exercise price of most stockoptions equals the market value of ashare of the employer’s stock on the datethe option is granted. Nevertheless,options can be granted with an exerciseprice that is greater than or less than themarket value of the employer’s stock onthe grant date. The exercise price alsocan be adjusted upward or downward inresponse to changes in an index.

The vesting provisions of an awardexplain when the employee has the rightto exercise the option. For a call option,the option becomes vested when theemployee’s right to receive shares byexercising the option “is no longercontingent on satisfaction of either aservice condition or a performancecondition.” The end of the stated vestingperiod for an option would normallyoccur at the same time the employee hasthe right to exercise the option, which istypically after a specified number of yearsof continuous service to the employer.However, besides a service condition, thevesting provisions of an option may also

31

3 In some cases, the cost of the option would be initially capitalized into the cost of another asset, which wouldbe recognized in earnings when that asset is later disposed of or consumed. In banks, if options are issued toemployees involved in originating loans, a portion of option costs would be included in loan origination costs thatare deferred under FASB Statement No. 91, Accounting for Nonrefundable Fees and Costs Associated with Origi-nating or Acquiring Loans and Initial Direct Costs of Leases.



Accounting Newscontinued from pg. 31

include one or more performance ormarket conditions that must be met inorder for an option to be exercisable. Aperformance condition is a conditiondetermined solely by reference to theemployer’s operations or activities, suchas attaining a specified increase in returnon assets or undergoing a change incontrol. In contrast, a market condition isone that relates, for example, to theachievement of a specified price or intrin-sic value for the employer’s stock.

For an option with a service condition,an employer can establish either “cliff” or“graded” vesting. Under cliff vesting,employees become fully vested at the endof a specified period, (e.g., after fouryears of service). Under graded vesting,employees vest at specified rates over aspecified period (e.g., 25 percent peryear over a four-year vesting period or 50percent in the first year and 25 percentin the second and third years of a three-year vesting period).

One other significant feature of stockoptions is their tax treatment for federalincome tax purposes. The InternalRevenue Code classifies employee stockoptions as either incentive stock options(ISOs) or nonqualified stock options(NSOs). To be an ISO, the option mustsatisfy several statutory requirements. Anoption that does not satisfy these require-ments is an NSO. The tax consequences,both to the employer and the employee,differ for ISOs and NSOs. The vast major-ity of employee stock options are NSOs.4

The Basics of Accounting forStock Options Under FAS123(R)

The general rule when accounting foremployee stock options under FAS123(R) is that an employer must measure

the cost of services received from employ-ees in exchange for the awarding of theoptions based on the grant date fair valueof the options if they are classified asequity or based on the fair value of theoptions at each balance sheet date if theyare classified as liabilities. Becauseemployee stock options usually are classi-fied as equity, the remainder of this articleaddresses such options. The employerrecognizes the compensation cost for anaward of employee stock options classifiedas equity over “the period during whichan employee is required to provide servicein exchange for an award,” which istermed “the requisite service period,”generally with a corresponding credit toadditional paid-in capital on the balancesheet.5,6 The estimation of grant date fairvalue will be discussed later in this article.

For an award of stock options, the grantdate is defined in FAS 123(R) as “[t]hedate at which an employer and anemployee reach a mutual understandingof the key terms and conditions” of theaward. Awards that are subject toapproval by the shareholders, the boardof directors, or management are notdeemed to be granted until the necessaryapprovals have been obtained. However, ifshareholder approval is required but is“essentially a formality (or perfunctory),”actual approval is not needed (assumingany other necessary approvals have takenplace). This situation occurs, for exam-ple, “if management and the members ofthe board of directors control enoughvotes to approve the arrangement.”

In addition, FASB Staff Position No.FAS 123(R)-2, issued in October 2005,makes a practical accommodation forthe determination of the grant date. Itprovides that, assuming all other grantdate criteria have been met, there is apresumption that “a mutual understand-

4 CCH Incorporated, Accounting for Compensation Arrangements, 2006 edition, Paragraph 11.8.5 In general, compensation cost is recorded as a current period expense, except as described in footnote 3.However, this article follows the convention used in FAS 123(R) of referring to compensation cost rather thancompensation expense because of the existence of this exception.6 On a bank’s balance sheet, additional paid-in capital is typically labeled “surplus.”


ing of the key terms and conditions ofan award to an individual employee”exists at the date “the award is approvedin accordance with the relevant corpo-rate governance requirements” if theemployee lacks “the ability to negotiatethe key terms and conditions of theaward with the employer.” It must alsobe expected that these terms and condi-tions will be communicated to eachindividual award recipient “within arelatively short time period from thedate of approval” in accordance withthe entity’s “customary human resourcepractices.”

The terms of the stock option awardmust be analyzed in order to estimatethe requisite service period. When anaward includes only a service condition,the requisite service period is presumedto be the vesting period absent evidenceto the contrary. However, when such anaward has a graded vesting schedule, theemployer must make a policy decisionabout whether to treat the award, insubstance, as multiple separate awards,each of which has its own requisite serv-ice period, or as one award with a requi-site service period that corresponds tothat of the last separately vesting portionof the award. Determining the requisiteservice period becomes more difficultwhen an award contains performance ormarket conditions or both because theprobability of satisfying these conditionsmust be assessed. The initial best esti-mate of the requisite service period mustbe adjusted over time as circumstancesand hence, these probabilities, change.The date at which the requisite serviceperiod begins is defined as the “serviceinception date.” Although this date isusually the same as the grant date, insome instances the service inceptiondate may precede or follow the grantdate.

Because FAS 123(R) addresses theaccounting for share-based paymenttransactions with both employees andnonemployees, but with certain differ-

ences between the two, an employermust determine whether the persons towhom it has awarded stock options areemployees for purposes of this account-ing standard. An employee is an individ-ual over whom the employer exercises orhas the right to exercise sufficientcontrol to establish an employer-employee relationship under applicablelaw, which for the United States encom-passes common law and federal incometax laws. In addition, nonemployee direc-tors who are granted stock options fortheir services as directors are deemed tobe employees for purposes of FAS123(R) if they are elected by theemployer’s shareholders or are“appointed to a board position that willbe filled by shareholder election whenthe existing term expires.” Optionsawarded to directors for other servicesare treated as awards to nonemployeesunder FAS 123(R).

The total compensation cost thatshould be recognized over the requisiteservice period should be only foremployee stock options that will actuallyvest. For example, some employees mayleave the employer before the vestingperiod is over, thereby forfeiting theiroptions. In addition, it may or may notbe probable that a performance condi-tion will be achieved. When stockoptions include only a performancecondition for which achievement is notprobable, then the options will be treatedas not vesting and no compensation costshould be recognized. Stock options thatinclude both service and performanceconditions add to the complexity of esti-mating the number of options that willactually vest. In contrast, FAS 123(R)states that “a market condition is notconsidered to be a vesting condition,”and therefore it does not enter into theestimation of the number of options thatwill vest. The standard provides insteadthat “[t]he effect of a market condition isreflected in the grant-date fair value ofan award.”



Although performance conditions arebecoming more prevalent, virtually allstock option awards include a servicecondition.7 When estimating at the grantdate the number of options that will beforfeited because the service conditionwill not be met, the employer “considershistorical employee turnover and expec-tations about the future.” Because theestimate of forfeitures over the requisiteservice period may change over time,including on the basis of actual experi-ence after the grant date, the estimatednumber of options that will vest must berevised if subsequent information indi-cates that this number is likely to differfrom the previous estimate.

Once the employer has determined thegrant date of the options, their fair valueon that date, the requisite service period,and the number of options that will vest,the total compensation cost of theoptions can be calculated. For optionswith cliff vesting, this cost is recognizedon a straight-line basis over the requisiteservice period. For options with gradedvesting (and a service condition only),the cost recognition pattern depends onwhether the employer’s policy choice isto treat the stock option award as oneaward, to which the straight-line methodis applied,8 or as multiple separateawards, to which an accelerated methodis in effect applied. Examples later in thisarticle will illustrate the differences incost recognition.

If fully vested employee stock optionslater expire unexercised, which would bethe case if the market price of the stockis less than the exercise price of theoption, the employer is not permitted toreverse the previously recognizedcompensation cost.

An entity that is a subsidiary of anothercompany (e.g., a bank that is asubsidiary of a holding company) may

award options on its parent company’sstock to one or more of its employees ascompensation for services provided tothe entity. FAS 123(R) observes that“[t]he substance of such a transaction is”that the parent company “makes a capi-tal contribution” to the subsidiary andthe subsidiary “makes a share-basedpayment to its employee in exchange forservices rendered.” Thus, the subsidiarywould account for these stock options byapplying FAS 123(R) in its own separatefinancial statements, including, for abank, in its regulatory reports.

Estimating the Grant DateFair Value of Stock Options

FAS 123(R) states that an entity shouldmeasure the fair value of a stock optionas of the grant date “based on theobservable market price of an optionwith the same or similar terms andconditions, if one is available,” but theFASB further notes that market pricesgenerally are not available. In theabsence of such prices, fair value mustbe “estimated using a valuation tech-nique such as an option-pricing model.”The standard identifies a “lattice model”(e.g., a binomial model) and a “closed-form model” (e.g., the Black-Scholes-Merton formula) as acceptable option-pricing models and a Monte Carlo simu-lation technique as another type ofacceptable valuation technique. Anentity must choose an appropriate valua-tion technique on the basis of thesubstantive characteristics of the optionsit is valuing. The Black-Scholes-Mertonmodel is considered easier to applybecause it is a defined equation andincorporates only one set of inputs. As aresult, it is the model most commonly inuse. The binomial model is morecomplex and therefore is used lessfrequently, although its supporters argue

7 CCH Incorporated, Accounting for Compensation Arrangements, 2006 edition, Paragraph 8.7.8 When the “one award” policy choice is made, the cumulative “amount of compensation cost recognized at anydate must at least equal” the number of options that have vested times their grant date fair value.


that it produces more accurate fair valueestimates for options because it can takeinto account more assumptions and canincorporate multiple inputs.9

Whatever model or valuation techniquean entity uses for valuing employee stockoptions, FAS 123(R) specifies six inputsand assumptions that, at a minimum,must be taken into account:

• the exercise price of the option;

• the current price of the underlyingstock;

• the expected term of the option; and

• over this term, - the expected volatility of the price

of the underlying stock;- the expected dividends on the

underlying stock; and- the risk-free interest rate or rates.

An entity must develop reasonable andsupportable estimates for the assump-tions it uses in the model. FAS 123(R)notes that historical experience shouldgenerally be the starting point in devel-oping these estimates, but expectationsbased on such experience should bemodified when “currently available infor-mation indicates that the future isreasonably expected to differ from thepast.” Furthermore, when estimating theexpected term of an option, an entitymust consider “both the contractualterm of the option and the effects ofemployees’ expected exercise and post-vesting employment terminationbehavior.”

Volatility is defined in FAS 123(R) as a“measure of the amount by which afinancial variable such as a share pricehas fluctuated (historical volatility) or isexpected to fluctuate (expected volatil-ity) during a period.” The standard alsocites a number of factors to be consid-ered in estimating the expected volatility

of the underlying stock’s price. The staffof the Securities and Exchange Commis-sion (SEC) has also issued guidance onvolatility in Staff Accounting Bulletin No.107, Share-Based Payment (SAB 107).10

The outcome of this estimation processis particularly important because thehigher the expected volatility, the greaterthe fair value of an option.11

In developing FAS 123(R), the FASBrecognized that it might not be practica-ble for a nonpublic company that awardsemployee stock options to estimate theexpected volatility of its share pricebecause of insufficient historical informa-tion about past volatility, for example. Inthis situation, the nonpublic companywill be unable to reasonably estimate thegrant date fair value of its stock options.To remedy this problem, FAS 123(R)directs nonpublic companies to accountfor their stock options based on a “calcu-lated value” rather than the grant datefair value. To determine the calculatedvalue, a nonpublic company substitutes“the historical volatility of an appropriateindustry sector index for the expectedvolatility” of the price of its underlyingstock in its chosen option-pricing model.If possible, the industry sector indexshould reflect the size of the nonpubliccompany. The use of a broad-basedmarket index is not permissible.

Accounting for the Tax Effectsof Stock Options

FASB Statement No. 109, Accountingfor Income Taxes (FAS 109), establishesthe standards for accounting for andreporting the effects of income taxes infinancial statements. Under FAS 109, ingeneral, deferred tax assets and liabilitiesare recognized when there are “tempo-rary differences” between the tax basesof assets and liabilities and their reportedamounts in the financial statements.

9 Tim V. Eaton and Brian R. Prucyk, “No Longer an ‘Option,’” Journal of Accountancy, April 2005, 66–67. 10 SAB 107, released in March 2005, can be accessed at http://www.sec.gov/interps/account/sab107.pdf.11 CCH Incorporated, Accounting for Compensation Arrangements, 2006 edition, Paragraph 7.27.



The tax treatment of employee stockoptions that are ISOs and those that areNSOs differs, resulting in a differentaccounting outcome under FAS 109. Foran NSO, the more prevalent form ofoption, the employee typically does notrecognize any income for federal incometax purposes until the option is exer-cised. Upon exercise, the amount bywhich the fair market value of the stockexceeds the exercise price of the optionis ordinary income to the employee, andthe employer is normally entitled to a taxdeduction for this amount. In contrast,when an ISO is exercised, the employeedoes not realize any taxable income andthe employer does not receive a taxdeduction. However, if the employeeenters into a “disqualifying disposition”by selling the shares before the end ofeither of two specified holding periods,the transaction will generate a certainamount of ordinary income for theemployee and an equivalent tax deduc-tion for the employer.

Thus, the tax treatment of employeestock options is noticeably different fromthe financial accounting treatment ofoptions under FAS 123(R). This standardviews these differing treatments of NSOsas a deductible temporary difference forpurposes of applying FAS 109, whichleads to the recognition of deferred taxassets until the option is exercised orexpires. However, ISOs do not generate adeductible temporary difference becausethey do not ordinarily result in taxdeductions for the employer. Only whena disqualifying disposition occurs will theemployer recognize the tax effects aris-ing from the disposition in its financialstatements.

For NSOs, the employer must recognizea deferred tax asset and a correspondingcredit to deferred income tax expenseeach year during the requisite serviceperiod. The amount of the deferred taxasset equals the compensation costrecognized during the year times the“applicable tax rate” (i.e., the tax rate

“expected to apply to taxable income” inthe future year or years when the stockoptions are expected to be exercised). Inaddition, FAS 109 requires the employerto determine whether it is more likelythan not that some or all of its deferredtax assets will not be realized and, if so,to establish an appropriate valuationallowance.

When the NSOs are exercised, theemployer’s tax deduction may be greaterthan or less than the cumulative amountthat has been recognized as the compen-sation cost for the options. In the formercase, the amount of any realized taxbenefit in excess of the previously recog-nized deferred tax asset is normally cred-ited to additional paid-in capital (APIC).However, if the tax benefit resulting fromthe tax deduction arising from the exer-cise of the options will not be realizedbecause the employer is in a tax losscarryforward position, recognition of this“excess tax benefit” will be delayed untilthe deduction actually reduces taxespayable.

The accounting can be more compli-cated when the tax deduction resultingfrom the exercise of NSOs is less thanthe cumulative compensation cost forthe options, thereby creating a “tax defi-ciency.” In this situation, the amount bywhich the deferred tax asset associatedwith the exercised options is greater thanthe tax benefit from the tax deductionmust be written off. To the extent thatthere is “any remaining additional paid-in capital from excess tax benefits fromprevious [share-based payment] awardsaccounted for in accordance with” FAS123(R) or FAS 123, the write-off is firstcharged against such remaining APIC. Ifthe remaining APIC is not sufficient toabsorb the entire write-off, the remain-der of the write-off is charged to incometax expense in the income statement.FAS 123(R) provides guidance on how todetermine the amount of the so-called“APIC pool” available to absorb write-offsof deferred tax assets related to tax defi-


ciencies, but the calculation process hasbeen criticized as overly complex.12

When NSOs expire unexercised, thedeferred tax asset associated with theseoptions must also be written off becauseno tax deduction is generated. The write-off is accounted for as described abovefor a tax deficiency.

Transitioning to FAS 123(R)

As a result of guidance issued by theSEC in April 2005,13 public companiesother than “small business issuers” wererequired to adopt FAS 123(R) as of thebeginning of their first fiscal year begin-ning after June 15, 2005, while smallbusiness issuers and all nonpubliccompanies must adopt this standard asof the beginning of their first fiscal yearbeginning after December 15, 2005. Asa result, FAS 123(R) took effect for allcalendar year companies on January1, 2006.

The standard applies to all new stockoptions and other share-based payments

awarded to employees after its requiredeffective date and to prior awards modi-fied after that date. For companies thathad awarded share-based payments toemployees prior to the effective date ofFAS 123(R), different transition methodsapply to these awards depending onwhether the company is public ornonpublic and on its previous method ofaccounting for the awards. These meth-ods are summarized in Table 1.

In general, under the modified prospec-tive method, an employer with employeestock options for which the requisiteservice period has not been completed(i.e., options that are not fully vested) asof the effective date of FAS 123(R) mustrecognize compensation cost over theportion of the service period remainingafter the effective date. The compensa-tion cost must be based on the grantdate fair value of those options as calcu-lated under FAS 123.

When the use of the modified retro-spective method is permitted, anemployer must adjust its prior period

12 CCH Incorporated, Accounting for Compensation Arrangements, 2006 edition, Paragraph 11.43. The SEC staffand the FASB have attempted to provide some relief from the difficulties in calculating APIC pools in SAB 107 andin FASB Staff Position No. FAS 123(R)-3, Transition Election Related to Accounting for the Tax Effects of Share-Based Payment Awards, respectively.13 See SEC Release 33-8568, Amendment to Rule 4-01(a) of Regulation S-X Regarding the Compliance Date forStatement of Financial Accounting Standards No. 123 (Revised 2004), “Share-Based Payment.”

Table 1

Treatment of Awards Granted Before the Effective Date of FAS 123(R)

Treatment of Awards Granted in Periods Prior to Effective Date of FAS 123(R)

Restatement of Financial Statements for Periods Prior to Effective Date of FAS 123(R)

All other nonpublic companies Continue to account for awards outstanding ateffective date using accounting principles originallyapplied to those awards, but apply FAS 123(R) tomodifications of those awards after the effective date

Restatement not permitted

Nonpublic companies that used the fair-value-based method for recognition ordisclosure purposes under FAS 123

Must use modified prospective application transitionmethod

May elect to restate using modifiedretrospective application transitionmethod

All public companies regardless ofaccounting method used previously

Must use modified prospective application transitionmethod

May elect to restate using modifiedretrospective application transitionmethod



financial statements “to give effect to thefair-value-based method of accounting”under FAS 123 such that the “compensa-tion cost [of share-based payments toemployees] and the related tax effectswill be recognized in those financialstatements as though they had beenaccounted for under Statement 123.”

Examples

The following examples illustrate thebasics of accounting for employee stockoptions awarded after the effective dateof FAS 123(R). The examples, which arefor stock options with a service conditiononly, contrast the accounting and result-

ing compensation cost for options withcliff vesting versus graded vesting. Thegrant date fair values of the stock optionsare estimated using an appropriateoption-pricing model such as the Black-Scholes-Merton formula. Table 2 pres-ents key information for stock optionsawarded by Bank A and Bank B wherethe only differences arise from differentvesting methods.

Example: Compensation Costwith Cliff Vesting

On the basis of the expected forfeiturerate during the vesting period, 34 ofBank A’s employees who have been

Table 2

Bank A (Cliff Vesting) Bank B (Graded Vesting)Grant date January 1, 2006 January 1, 2006Number of employees granted 40 40optionsStock options granted to each 300 300employeeTotal stock options granted 12,000 12,000Expected forfeitures per year 5 percent 5 percentShare price at grant date $50 $50Exercise price of option $50 $50Contractual term of options 10 years 10 yearsVesting 3-year cliff vesting 3-year graded vesting with one-third

of the options vesting each year (3 tranches)

Requisite service period (RSP) 3 years First tranche (1/3 of the options): 1-year RSPSecond tranche (1/3 of the options):2-year RSPThird tranche (1/3 of the options):3-year RSP

Grant date fair value of options $18.00 per option Tranche-by-tranche valuation:$16.00 per option with a 1-year RSP$17.00 per option with a 2-year RSP $18.00 per option with a 3-year RSP

Valuation of entire award using asingle weighted-average expectedlife: $17.00 per option

Applicable tax rate 40 percent 40 percent

Stock Option Information for Bank A and Bank B


granted options are expected to vest atthe end of this three-year period. Thisnumber is determined by multiplying the40 employees granted options by oneminus the expected forfeiture rate raisedto the third power (for the number ofyears in the requisite service period),i.e., (1 – 0.05)3 or 0.953.

The total grant date fair value of alloptions that Bank A expects will actuallyvest is $183,600, which is the number ofoptions expected to vest (300 options x34 employees = 10,200 options), multi-plied by the grant date fair value of $18per option. Thus, Bank A must recognizetotal compensation cost of $183,600over the requisite service period of threeyears, one-third of which ($61,200) willbe recognized in each of the three yearsprovided there are no changes in theexpected forfeitures during that period.Because Bank A expects to generatesufficient future taxable income to real-ize the deferred tax benefits of itsemployee stock options, it must recog-nize income tax benefits of $24,480each year, which equals its applicable taxrate multiplied by the annual compensa-tion cost ($61,200 x 40 percent). Thesebenefits would essentially be a credit to(a reduction of) deferred income taxexpense.

In 2006, Bank A’s journal entries torecord its compensation cost anddeferred taxes would be as follows:

Compensation cost $61,200Additional paid-in capital $61,200

To recognize compensation cost.

Deferred tax asset $24,480Deferred tax expense $24,480

To recognize the deferred tax asset forthe temporary difference related tocompensation cost.

Provided the estimated forfeitures donot change in 2007 and 2008, Bank Awould record the same journal entries ineach of those two years. At the end of2008, Bank A must review the actualnumber of forfeited options and adjustthe cumulative compensation cost tobring it into line with the number ofoptions that actually vested.

Example: Compensation Costwith Graded Vesting

Because Bank B’s options have gradedvesting, the bank must determine thenumber of employees granted optionswho are expected to vest in each of thethree years. On the basis of the expectedforfeiture rate each year, Bank B esti-mates the number of employees who willvest in 2006, 2007, and 2008 and thenumber of stock options expected to vesteach year as shown in Table 3.

When employee stock options withgraded vesting are subject only to serviceconditions, the employer may choosebetween two alternatives each for valuingthe entire stock option award and recog-nizing compensation cost for the options,which results in four possible outcomesfor each year’s cost during the overallvesting period. Under the first combina-tion of alternatives, Bank B estimates the

Table 3

Year Number of Employees Number of Vested Stock OptionsTotal at grant date = 40

2006 40 x (1 – 0.05) = 40 x 0.95 = 38 38 x (300 x 1/3) = 38 x 100 = 3,8002007 38 x (1 – 0.05) = 38 x 0.95 = 36 36 x (300 x 1/3) = 36 x 100 = 3,6002008 36 x (1 – 0.05) = 36 x 0.95 = 34 34 x (300 x 1/3) = 34 x 100 = 3,400

Total vested stock options = 10,800

Bank B’s Estimate of Vested Stock Options



fair value and recognizes the compensa-tion cost of the options by separating theentire award into its three tranchesaccording to the year in which eachtranche vests. This produces the resultsin Table 4.

By treating the entire award as if it weremultiple awards (three in this example)rather than a single award, Bank B recog-nizes the compensation cost “on astraight-line basis over the requisite serv-ice period for each separately vestingportion of the award.” This means, forexample, that Bank B will recognize the$61,200 compensation cost attributableto the 3,600 options that vest at year-end2007 proportionately over the two-yearrequisite service period that it takes forthese options to vest. The estimated$183,200 total compensation cost is allo-cated to 2006, 2007, and 2008 as shownin Table 5.

Using journal entries comparable tothose illustrated for Bank A, Bank Bwould record the amounts of compensa-tion cost allocated to 2006, 2007, and2008 along with the related deferredtaxes each year. For example, the entriesfor 2006 would be as follows:

Compensation cost $111,800Additional paid-in capital $111,800

To recognize compensation cost.

Deferred tax asset $44,720Deferred tax expense $44,720

To recognize the deferred tax asset forthe temporary difference related tocompensation cost.

The second combination of alternativesavailable to Bank B would be to take the$183,200 estimated total compensationcost calculated above, but to recognizethis total cost on a straight-line basis overthe three years of the graded vestingperiod. Bank B’s total compensation costwould be allocated equally to each of

Table 4

Year Options Number of Grant Date Compensation Fully Vest Vested Options Fair Value per Option Cost

2006 3,800 $16.00 $ 60,8002007 3,600 $17.00 $ 61,2002008 3,400 $18.00 $ 61,200Total 10,800 $183,200

Compensation Cost for Three Annual Tranches

Table 5

Compensation Cost to Be Recognized in

2006 2007 2008Stock options vesting in 2006 $ 60,800Stock options vesting in 2007 $ 30,600 $ 30,600Stock options vesting in 2008 $ 20,400 $ 20,400 $ 20,400Cost for the year $111,800 $ 51,000 $ 20,400

Cumulative cost $111,800 $162,800 $183,200

Allocation of Compensation Cost over Three Years with Tranche-by-Tranche Valuation


these three years by dividing the total bythree ($183,200 ÷ 3 = $61,067 peryear).14

For the third and fourth combinationsof alternatives, Bank B would treat thestock option award as one award and usea single weighted-average expected lifefor purposes of estimating the grant datefair value of the options, which the bankdetermines is $17 per option. Bank Bcould then recognize compensation coston either a graded or straight-line basisas under the first two alternatives.

As previously calculated, the totalnumber of stock options expected to vestis 10,800. With a value of $17 peroption, the total compensation cost ofthe award is $183,600 for both the thirdand fourth combinations of alternatives(10,800 options x $17 grant date fairvalue). If Bank B allocates this cost on agraded basis, one-third of the total cost,$61,200, is allocated to each of the threetranches of the award. This amount isspread over the requisite service periodfor each tranche as shown in Table 6.

In contrast, if Bank B allocates this$183,600 total compensation cost on astraight-line basis, the cost would be allo-cated equally to each of the three years

over which the options vest by dividingthe total by three ($183,600 ÷ 3 =$61,200 per year in 2006, 2007, and2008).15

Regardless of the alternatives Bank Bselects for estimating the value of theoptions and allocating the compensationcost, it must adjust the cost “for awardswith graded vesting to reflect differencesbetween estimated and actual forfei-tures” in each tranche, including whenthe final tranche has fully vested.

Example: Exercise of StockOptions

In the example involving Bank A above,the 10,200 stock options vested at theend of 2008 have an exercise price of$50. On December 31, 2010, when theprice of Bank A’s stock is $70 per share,half the stock options (5,100 options)are exercised. If the par value of BankA’s common stock is $10 per share,Bank A’s entry to record the exercise ofthese options would be as follows:

Cash (5,100 x $50) $255,000Common stock $51,000Additional paid-in capital $204,000

To recognize the issuance of commonstock upon exercise of stock options.

14 For options with graded vesting and only service conditions, FAS 123(R) “requires that compensation costrecognized at any date must be at least equal to the amount attributable to options that are vested at that date,”which is the case for this second combination of alternatives. However, if half the options awarded by Bank Bhad vested in 2006, half the total compensation cost would be recognized in 2006.15 The compensation cost recognition requirement described in footnote 14 would also apply to this alternative.

Table 6

Compensation Cost to Be Recognized in

2006 2007 2008Stock options vesting in 2006 $ 61,200Stock options vesting in 2007 $ 30,600 $ 30,600Stock options vesting in 2008 $ 20,400 $ 20,400 $ 20,400Cost for the year $112,200 $ 51,000 $ 20,400

Cumulative cost $112,200 $163,200 $183,600

Allocation of Compensation Cost over Three Years with Valuation Based on Weighted-Average Expected Life



In contrast, if Bank A has no-parcommon stock, it would credit commonstock for the sum of the cash proceedsreceived from the exercise of the optionsplus the $91,800 previously credited toadditional paid-in capital (5,100 optionsx $18 grant date fair value) during therequisite service period for the optionsthat have been exercised. In this case,Bank A’s entry would be as follows:

Cash (5,100 x $50) $255,000Additional paid-in capital $91,800

Common stock $346,800To recognize the issuance of commonstock upon exercise of stock options andto reclassify previously recorded addi-tional paid-in capital.

Bank A is entitled to take tax deduc-tions in 2010 for the difference betweenthe market price of its stock on the datethe stock options were exercised ($70per share) and the exercise price of theoptions ($50 per share). For the 5,100options exercised, which are NSOs, thedeductible amount is $102,000 [5,100options x ($70 - $50)]. Because Bank Ahas generated sufficient taxable incomein 2010 to fully use the tax deduction,the $40,800 realized tax benefit of thisdeduction ($102,000 tax deduction x 40percent applicable tax rate) will reducethe bank’s current income taxes payable.Bank A records the amount by which the$102,000 realized tax deduction exceedsthe $91,800 compensation cost previ-ously recognized for the options exer-cised (5,100 options x $18 grant date fairvalue) as a credit to additional paid-incapital. The exercise of the stock optionsalso signals the reversal of the deductibletemporary difference that originatedduring the three-year requisite serviceperiod when the compensation cost ofthe options was recognized in Bank A’sfinancial statements. As a consequence,Bank A must eliminate the previouslyrecognized $36,720 deferred tax assetassociated with the 5,100 options exer-cised ($91,800 compensation cost x 40percent applicable tax rate). Bank A

records the following journal entries forthese tax effects:

Deferred tax expense $36,720Deferred tax asset $36,720

To reverse the deferred tax asset for thetemporary difference associated withstock options that have been exercised.

Current taxes payable $40,800Current tax expense $36,720Additional paid-in capital $4,080

To adjust current taxes payable andcurrent tax expense for the tax benefitrealized from the exercise of stockoptions and the tax effects of the recog-nized compensation cost, and to creditthe resulting excess tax benefit to addi-tional paid-in capital.

On December 31, 2011, when theprice per share of Bank A’s stock hasfallen to $67, the remaining 5,100options are exercised. Bank A recordsjournal entries similar to the first twothat it recorded above for the stockoptions exercised one year earlier.However, Bank A’s tax deduction forthe options exercised in 2011 is$86,700 [5,100 options x ($67 –$50)], which is less than the $91,800compensation cost recognized for theoptions exercised (5,100 options x $18grant date fair value). Although Bank Ahas generated sufficient taxableincome in 2011 to fully use the taxdeduction and the resulting $34,680realized tax benefit ($86,700 taxdeduction x 40 percent applicable taxrate), Bank A has a tax deficiencybecause this realized tax benefit is lessthan the previously recognized$36,720 deferred tax asset associatedwith the 5,100 options exercised($91,800 compensation cost x 40percent applicable tax rate). Becausethe exercise of the stock options in2010 generated an excess tax benefitof $4,080 that was credited to addi-tional paid-in capital, Bank A has an“APIC pool” sufficient to absorb thetax deficiency without having to chargeany of the deficiency to current period


earnings. The bank would reflect thisoutcome in the following journal entry:

Current taxes payable $34,680Additional paid-in capital $2,040Current tax expense $36,720

To adjust current taxes payable andcurrent tax expense for the tax benefitrealized from the exercise of stockoptions and the tax effects of the recog-nized compensation cost, and to chargethe resulting tax deficiency against addi-tional paid-in capital.

In the compensation cost exampleinvolving Bank B, the stock options hadgraded vesting. Bank B’s accounting forthe exercise of stock options would, inconcept, be comparable to Bank A’saccounting. However, the graded vestingapproach adds a degree of complexity. Inthis regard, the FASB notes that unlessBank B

identifies and tracks the specifictranche from which share options areexercised, it would not know therecognized compensation cost thatcorresponds to exercised share optionsfor purposes of calculating the taxeffects resulting from that exercise. Ifan entity does not know the specifictranche from which share options areexercised, it should assume thatoptions are exercised on a first-vested,first-exercised basis (which works inthe same manner as the first-in, first-out basis for inventory costing).

Examination Considerations

All banks that award stock options toofficers or other employees as part oftheir compensation must adopt FAS123(R) for financial reporting purposes,including for their Reports of Conditionand Income (Call Reports), as of theeffective date of the standard (January 1,2006, for most banks). When examining

a bank that awards a significant numberof employee stock options, examinersshould gain an understanding of thebank’s methods of accounting for theoptions both before and after the effec-tive date of FAS 123(R), as well as thetransition method used for optionsawarded before the effective date. Thisunderstanding will assist the examiner inassessing how the compensation cost ofthese options affects the bank’s earningsand equity capital, particularly whenanalyzing the bank’s earnings trends.Examiners should also recognize that thestock option compensation cost reflectedin a bank’s income statement is anoncash expense.

Since most banks applied the intrinsicvalue method of accounting for employeestock options before the effective date ofFAS 123(R), these banks will not haveincluded any compensation cost in their“salaries and employee benefits” in 2005and earlier years.16 If such a bank is not apublic company or a subsidiary of apublic company, it will continue to applythe intrinsic value method to employeestock options awarded before 2006 thatcontinue to vest in 2006 and subsequentyears unless a previous award is modified.Therefore, a “nonpublic bank” will notbegin to reflect any compensation cost inits earnings until it grants a newemployee stock option award. In contrast,if the bank is a public company or asubsidiary of a public company and haspre-2006 employee stock options thatwere not fully vested at the end of 2005,this “public bank” must begin to includethe compensation cost of these options inits earnings in 2006 even though it previ-ously applied the intrinsic value methodto these options. Therefore, even if thebank does not grant any new employeestock options in 2006, stock optioncompensation cost will be reflected in itsincome statement in 2006 and subse-

16 For stock options awarded to directors for their services as directors, compensation cost for options would bereported with other forms of directors’ compensation in “other noninterest expense” rather than in “salaries andemployee benefits.”



quent years until its pre-2006 options arefully vested.

Under FAS 123(R), all public banks, aswell as nonpublic banks that used thefair-value-based method of accounting foremployee stock options for recognitionor disclosure purposes under FAS 123prior to 2006, are permitted to adjustprior years’ financial statements as if thismethod had been applied since FAS 123took effect (the modified retrospectiveapplication transition method). However,as noted in the Call Report instructions,“[b]ecause each Report of Incomecovers a single discrete period, retroac-tive restatement of prior years’ Reportsof Condition and Income is not permit-ted.”17 If a bank applies modified retro-spective application for other financialreporting purposes, it should adjust the2006 beginning balances of additionalpaid-in capital (surplus), deferred taxes,and retained earnings for Call Reportpurposes, and it should report the neteffect of these adjustments on totalequity capital at the beginning of 2006as a direct adjustment to capital in theCall Report schedule of changes inequity capital (Schedule RI-A).

For a bank that regularly grants stockoptions to employees, including in 2006,and previously used the intrinsic value

method of accounting for these options,an analysis of its earnings will show anincrease in “salaries and employee bene-fits” in 2006 compared to prior yearsthat is attributable to the newly requiredrecognition of compensation cost underFAS 123(R). Whether the 2006 earn-ings for such a bank include the compen-sation cost only for options granted in2006 or also include the cost for any not-yet-fully-vested pre-2006 options dependson whether the bank is public or nonpub-lic. Examiners should therefore considerthe impact of the change in accountingfor employee stock options when assess-ing the trend in overhead and overallearnings over periods that include thetransition year of 2006.

In addition, banks are encouraged toprepare a profit plan and budget thataddresses the current year and the nextoperating year. Because all banks thataward stock options in 2006 and beyondmust recognize compensation cost basedon the grant date fair value of the options(and certain banks must do so for pre-2006 awards that vest in 2006 andbeyond), examiners should ensure thatsuch banks have adjusted their budgetingprocess so that projections of “salariesand employee benefits” conform to therequirements of FAS 123(R).

17 See the Glossary entry for “Accounting Changes” on page A-1 of the Call Report instructions.

Table 7

Equity Capital Prior to Equity Capital After Recording Entries Related to Entries Related to Stock Recording Entries Related to

Stock Compensation Cost Option Compensation Cost Stock Compensation CostCommon stock (no par value) $10,000,000 $10,000,000Additional paid-in capital (surplus) $61,200 61,200Retained earnings 7,000,000 (61,200)a 6,963,280

24,480b

Accumulated other comprehensive income (1,000,000) (1,000,000)Total equity capital $16,000,000 $24,480 $16,024,480

a Compensation costb Deferred tax expense

Effect of Compensation Cost of NSOs on Regulatory Capital


Although the accounting for stockoptions under FAS 123(R) results in therecognition of compensation cost thatreduces earnings, there is generally acorresponding credit to equity capital(additional paid-in capital) on a bank’sbalance sheet. Furthermore, for NSOs,after recording the tax effects of thecompensation cost, the overall effect ofthese entries, in most cases, is anincrease in the bank’s Tier 1 capital.18

This favorable regulatory capitaloutcome for NSOs can be illustrated byshowing the effects of Bank A’s compen-sation cost and deferred tax journalentries for 2006 (from earlier in this arti-cle) on the equity capital section of BankA’s balance sheet (see Table 7).

Finally, when reviewing financial state-ments submitted by a bank’s borrowers,examiners should be aware that theseborrowers must also apply the fair-value-based accounting requirements of FAS123(R) to stock options and other share-based payment arrangements withemployees beginning, in general, in2006. As mentioned above, the compen-sation cost of these arrangements is anoncash expense and therefore has noeffect on the borrowers’ cash flow.

Robert StorchFDIC Chief Accountant, Washington, DC

18 Tier 1 capital would not increase if a valuation allowance had to be established for the entire deferred taxasset associated with the stock options under FAS 109 or if the incremental increase in the bank’s net deferredtax assets was disallowed under the banking agencies’ regulatory capital limit on deferred tax assets.


This section provides an overview of recently released regulations and supervisory guidance, arranged inreverse chronological order. Press Release (PR) or Financial Institution Letter (FIL) designations areincluded so the reader may obtain more information.

Overview of Selected Regulations and Supervisory Guidance

Revised Fair Credit Reporting ActExamination Procedures (FIL-18-2006,February 22, 2006)

The Federal Financial Institution Examinations Council (FFIEC) Task Force on ConsumerCompliance approved Fair Credit Reporting Act (FCRA) examination procedures for use inrisk-focused compliance examinations. The procedures, which became effective onFebruary 22, 2006, incorporate the new requirements created by the FACT Act.

SubjectAmended Regulations ReflectingMerger of the Bank Insurance Fundand Savings Association InsuranceFund (FIL-36-2006, April 27, 2006; andFederal Register, Vol. 71, No. 77,p. 20524, April 21, 2006)

SummaryThe Federal Deposit Insurance Corporation (FDIC) merged the Bank Insurance Fund (BIF)and the Savings Association Insurance Fund (SAIF) to form the Deposit Insurance Fund(DIF), effective March 31, 2006. This action was pursuant to the provisions in the FederalDeposit Insurance Reform Act of 2005. The FDIC has amended its regulations to reflect themerger.

Updated Compliance (FIL-34-2006,April 19, 2006) and Community Rein-vestment Act (FIL-33-2006, April 10,2006) Examination Procedures

The FDIC issued revised compliance examination procedures that incorporate banker feed-back and results of internal reviews. Additionally, the FDIC, the Board of Governors of theFederal Reserve System (Federal Reserve Board), and the Office of the Comptroller of theCurrency (OCC) issued new interagency Community Reinvestment Act (CRA) examinationprocedures for intermediate small banks and revised the existing CRA examination proce-dures for small institutions, large institutions, wholesale and limited purpose institutions,and institutions under a strategic plan. The CRA examination procedures reflect the signifi-cant changes to the CRA regulations that took effect on September 1, 2005.

Comments Requested on Ways toEnhance the Accuracy and Integrity ofInformation Furnished to ConsumerReporting Agencies (PR 32-2006,March 22, 2006; FIL-31-2006, April 7,2006; and Federal Register, Vol. 71, No.55, p. 14419, March 22, 2006)

Interagency Advisory on InfluenzaPandemic Preparedness (FIL-25-2006,March 15, 2006)

Final Rules on Changes in DepositInsurance Coverage (PR-29-2006,March 14, 2006; FIL-27-2006, March 28,2006; and Federal Register, Vol. 71, No.56, p. 14629, March 23, 2006)

Interagency Guidance on the Commu-nity Reinvestment Act (PR-23-2006,March 2, 2006; FIL-23-2006, March 10,2006; and Federal Register, Vol. 71, No.47, p. 12424, March 10, 2006)

The FDIC, the Federal Reserve Board, the OCC, and the OTS (collectively, the Federal bank-ing agencies) issued an advisory to financial institutions and their technology serviceproviders. The advisory is intended to raise awareness of the threat of a pandemic influenzaoutbreak and its potential impact on the delivery of critical financial services. It also advisesrecipients to consider this and similar threats in their event response and contingencystrategies.

The FDIC adopted interim final rules to implement provisions of the Federal Deposit Insur-ance Reform Act of 2005 pertaining to deposit insurance coverage. The rules raise thedeposit insurance coverage on certain retirement accounts to $250,000 from $100,000. Thebasic insurance coverage for other deposit accounts remains at $100,000. The rules tookeffect on April 1, 2006.

The FDIC, the Federal Reserve Board, and the OCC published informal staff guidance oncommunity reinvestment in the form of questions and answers. The agencies developedthese interagency questions and answers to address several significant revisions to theCRA regulations that took effect on September 1, 2005.

The FDIC, the Federal Reserve Board, the OCC, the Office of Thrift Supervision (OTS), theNational Credit Union Administration (NCUA) (collectively, the Federal financial institutionregulatory agencies), and the Federal Trade Commission jointly published an AdvanceNotice of Proposed Rulemaking (ANPR). The ANPR invites comment for the purpose ofdeveloping guidelines and rules to enhance the accuracy and integrity of informationfurnished to consumer reporting agencies, pursuant to Section 312 of the Fair and AccurateCredit Transactions (FACT) Act. Comments were due by May 22, 2006.


SubjectJoint Final Rule on Capital Standardsfor Securities Borrowing Transactions(FIL-17-2006, February 22, 2006; andFederal Register, Vol. 71, No. 35,p. 8932, February 22, 2006)

SummaryThe FDIC, the Federal Reserve Board, and the OCC issued a joint final rule clarifying thecapital treatment for securities borrowing transactions for banks and bank holding compa-nies that are subject to the Market Risk Capital, Rule 12, CFR Part 325, Appendix C. Thefinal rule took effect on February 22, 2006.

Guidance on Hurricane-Related Bene-fit Fraud (FIL-15-2006, February 14,2006)

The FDIC provided guidance issued by the Financial Crimes and Enforcement Network(FinCEN) regarding benefit fraud related to the recent hurricanes. The guidance includespossible signs of fraudulent activity to assist financial institutions in identifying hurricane-related benefit fraud. FinCEN also requested that specific words be used in the narrativeportion of all Suspicious Activity Reports (SARs) filed in connection with hurricane-relatedfraud.

Final Guidance Regarding Unsafe andUnsound Use of Limitation of LiabilityProvisions in External Audit Engage-ment Letters (PR-11-2006, February 3,2006; FIL-13-2006, February 9, 2006; andFederal Register, Vol. 71, No. 27,p. 6847, February 9, 2006)

Interagency Examination Guidance forInstitutions Affected by HurricaneKatrina (FIL-12-2006, February 3, 2006)

Guidance on Sharing SuspiciousActivity Reports with ControllingCompanies (FIL-5-2006, January 20,2006)

Comments Requested on ProposedGuidance on Commercial Real EstateLending (FIL-4-2006, January 13, 2006;Federal Register, Vol. 71, No. 9, p. 2302,January 13, 2006; and PR-27-2006,March 9, 2006)

The Federal financial institution regulatory agencies issued the final interagency advisoryon the unsafe and unsound use of limitation of liability provisions in external audit engage-ment letters. These provisions may weaken an external auditor’s objectivity, impartiality,and performance, and thus reduce the regulatory agencies’ ability to rely on the externalaudit. The final advisory applies to all audits of financial institutions, regardless of the sizeof the institution, whether the institution is public or not, and whether the audits arerequired or voluntary.

The Federal financial institution regulatory agencies and the state supervisory authoritiesin Alabama, Louisiana, and Mississippi jointly issued examiner guidance outlining thesupervisory practices to be followed in assessing the financial condition of institutionsaffected by Hurricane Katrina. The guidance notes that when considering any supervisoryresponse, examiners will give appropriate recognition to the extent to which weaknessesare caused by external problems related to the hurricane and its aftermath.

The FinCEN and the Federal financial institution regulatory agencies issued guidance tonotify institutions when a SAR can be shared with a holding company or other controllingcompany, or with the head office of a U.S. branch or agency of a foreign bank. Institutionsmay share a SAR to discharge their oversight responsibilities with respect to enterprise-wide risk management and compliance with applicable laws and regulations.

The Federal banking agencies sought comment on guidance relating to sound riskmanagement practices for concentrations in commercial real estate (CRE) lending. Theproposed guidance reinforces existing guidelines for real estate lending and providescriteria for identifying institutions with CRE loan concentrations that may warrant greatersupervisory scrutiny. The comment period was extended to April 13, 2006.

Comments Requested on ReducingRegulatory Burden in Rules on PromptCorrective Action and the Disclosureand Reporting of CRA-Related Agree-ments (FIL-3-2006, January 11, 2006;and Federal Register, Vol. 71, No. 2,p. 287, January 4, 2006)

The Federal banking agencies asked for recommendations on how to reduce regulatoryburden on insured institutions in rules relating to Prompt Corrective Action and the Disclo-sure and Reporting of Community Reinvestment Act-Related Agreements. This request ispart of the agencies’ effort to identify and eliminate regulatory requirements that areoutdated, unnecessary, or unduly burdensome pursuant to the Economic Growth and Regu-latory Paperwork Reduction Act of 1996. Comments were due by April 4, 2006.


Regulatory and Supervisory Roundupcontinued from pg. 47

Amendments to Annual IndependentAudits and Reporting Requirements(FIL-119-2005, November 28, 2005; andFederal Register, Vol. 70, No. 227,p. 71226, November 28, 2005)

The FDIC amended Part 363 of its regulations by raising the asset-size threshold from$500 million to $1 billion for internal control assessments by management and externalauditors. For institutions in this asset range, only a majority of the members of the auditcommittee (who must be outside directors) must be independent of management. The finalrule was effective December 28, 2005.

Revised Trust Examination ManualAvailable (FIL-118-2005, November 23,2005)

The FDIC made available its updated Trust Examination Manual at www.fdic.gov/regulations/examinations/trustmanual/index.html. The manual also may be purchased in a CD-ROMformat.

SubjectGuidance to Help Financial Institu-tions Affected by Wildfires (FIL-130-2005, December 30, 2005)

SummaryThe FDIC issued supervisory practices intended to facilitate the rebuilding process in areasin Oklahoma and Texas damaged by wildfires.

Comments Requested on InteragencyGuidance on Nontraditional MortgageProducts (PR-128-2005, December 20,2005; FIL-129-2005, December 29, 2005;and Federal Register, Vol. 70, No. 249,p. 77249, December 29, 2005)

Final Rules on Section 312 of the USAPatriot Act (FIL-128-2005, December28, 2005; and Federal Register, Vol. 71,No. 2, p. 496, January 4, 2006)

Guidance on Filing Notices ofProposed Class Action Settlements(FIL-126-2005, December 21, 2005)

Guide to Help Financial InstitutionsComply with Information SecurityGuidelines (PR-127-2005, December14, 2005)

Final Rule on Medical Information(PR-114-2005, November 17, 2005; FIL-121-2005, December 8, 2005; FederalRegister, Vol. 70, No. 224, p. 70663)

The FinCEN announced the final regulation implementing the due diligence requirements forthe international correspondent banking and the private banking provisions of Section 312 ofthe USA PATRIOT Act. For new accounts opened by U.S. financial institutions, the final ruleswere extended to July 5, 2006, and for existing accounts, the rules will be effective October2, 2006. (See FIL-35-2006, April 24, 2006.) Concurrently, FinCEN released a further notice ofproposed rulemaking regarding due diligence procedures for correspondent accounts main-tained for certain foreign banks.

The FDIC issued guidance on new requirements for filing notices of proposed class actionsettlements involving financial institutions for which the FDIC is the primary Federalregulator.

The Federal banking agencies issued a compliance guide to accompany the InteragencyGuidelines Establishing Information Security Standards (Security Guidelines). This guidesummarizes the obligations of financial institutions to protect customer information andshows how certain provisions of the Security Guidelines apply to specific situations.

The Federal financial institution regulatory agencies issued final rules relating to the FACTAct. Section 411 of the FACT Act prohibits creditors from obtaining and using medical infor-mation in determining credit eligibility, except as permitted by the financial institution regu-latory agencies. Through the final rules, the agencies developed exceptions that will allowcreditors to obtain and use medical information in appropriate circumstances. The rulestook effect on April 1, 2006.

The Federal financial institution regulatory agencies proposed guidance addressing thepotential for heightened risk levels associated with nontraditional mortgage lending and theimportance of carefully mitigating those risk exposures. The comment period was extendedto March 29, 2006.


SubjectFinal Rules on Post-EmploymentRestrictions for Senior Examiners (PR-115-2005; and Federal Register, Vol. 70,No. 221, p. 69633, November 17, 2005)

SummaryThe Federal banking agencies issued final rules to implement a special post-employmentrestriction on certain senior examiners. Under the final rules, if an examiner serves as thesenior examiner for a depository institution or depository institution holding company formore than 2 months during the last 12 months of employment with an agency or FederalReserve Bank, the examiner may not knowingly accept compensation as an employee,officer, director, or consultant from that institution. The restriction applies for one yearafter the examiner leaves the employment of the agency or Reserve Bank. The final ruleswere effective December 17, 2005.

Comments Requested on Proposal toModernize Large-Bank Deposit Insur-ance Determinations (PR-122-2005,December 6, 2005; FIL-2-2006, January10, 2006; and Federal Register, Vol. 70,No. 238, p. 73652, December 13, 2005)

The FDIC sought comment on whether the largest insured depository institutions shouldbe required to modify their deposit systems so that the FDIC may calculate deposit insur-ance coverage quickly in the event of a failure of one of these institutions. For purposes ofthe Advance Notice of Proposed Rulemaking, a large institution is one that holds morethan 250,000 deposit accounts and $2 billion in domestic deposits. Comments were due byMarch 13, 2006.

Comments Requested on ProposedRevisions to Statement of Policy onthe National Historic Preservation Actof 1966 (FIL-112-2005, November 15,2005; and Federal Register, Vol. 70, No.200, p. 60523, October 18, 2005)

The FDIC proposed to revise its Statement of Policy (SOP) on the National Historic Preser-vation Act of 1966 (NHPA) to reflect the FDIC’s experience and practices in applying thecurrent SOP and statutory changes to the NHPA and its implementing regulations. Theproposed SOP would continue to be relevant to applications for deposit insurance for denovo institutions, applications to establish domestic branches, and applications to relo-cate domestic branches or main offices. Comments were due by December 19, 2005.

Comments Requested on ProposedRulemaking on Interstate BankingFederal Interest Rate Authority (FIL-109-2005, November 11, 2005)

The FDIC published a proposed rulemaking to clarify which state laws apply to branchesof out-of-state state-chartered banks, and the interest rates state-chartered banks maycharge. Comments were due by December 13, 2005.

Subscription FormTo obtain a subscription to Supervisory Insights, please print or type the following information:

Institution Name __________________________________________________________________________________

Contact Person __________________________________________________________________________________

Telephone __________________________________________________________________________________

Street Address __________________________________________________________________________________

City, State, Zip Code __________________________________________________________________________________

Please fax or mail this order form to: FDIC Public Information Center3501 North Fairfax Drive, Room E-1002Arlington, VA 22226Fax Number (703) 562-2296

Subscription requests also may be placed by calling 1-877-ASK-FDIC or 1-877-275-3342.

Federal Deposit Insurance CorporationWashington, DC 20429-9990

OFFICIAL BUSINESSPENALTY FOR PRIVATE USE, $300

PRESORTEDSTANDARD

MAILPostage &Fees Paid

FDICPermit No. G-36

✁

supervisory insights: vol. 3, issue 1 - summer 2006 · accounting for employee stock options 30 on...

Documents