Earlier this month the Federal Reserve released its latest semiannual report on supervision and regulation.[1] It began by reassuring readers: “The banking system remains sound and resilient.” But it also reported that in the first half of 2024 two-thirds of large financial institutions (LFIs) were rated less than satisfactory by their examiners. Those LFIs hold 85 percent of assets held by banking organizations supervised by the Fed ($26 trillion of $30.5 trillion in total).[2] So how could the Fed possibly conclude that the banking system is sound and resilient overall?
This post sifts through the limited information provided in the report’s section on Supervisory Developments in search of an answer to this puzzle. The tentative conclusion is that many large banks have been downgraded because they have not addressed supervisory findings (so-called Matters Requiring Attention (MRAs) and Matters Requiring Immediate Attention (MRIAs)) to the satisfaction of their examiners, even though those findings were apparently largely confined to subjective assessments that governance and controls deficiencies would pose a threat to a bank’s safety and soundness at least in certain stress conditions. But the report does not provide enough information about the nature of supervisory findings to know for sure. The post concludes by making recommendations, some of which BPI has made previously, for the release of additional aggregated information about supervisory findings and ratings that would allow the public to better understand how supervisory findings and ratings relate to bank safety and soundness.
Why Are Two-Thirds of LFIs Rated Unsatisfactory? Does it Mean Banks are Unsafe and Unsound?
As the report explains, examiners summarize their assessments of LFIs using the LFI Rating System, which was finalized in 2018[3] and described in SR Letter 19-3, Large Financial Institution (LFI) Rating System.[4] It includes assessments of three components: (1) capital planning and positions; (2) liquidity risk management and positions; and (3) governance and controls. If any of the three components is rated unsatisfactory, the LFI is rated unsatisfactory. The report indicates that unsatisfactory ratings of LFIs were generally driven by supervisory findings of weaknesses in governance and controls, not capital or liquidity. Most LFIs met supervisory expectations for capital and liquidity, although supervisors identified continued weaknesses in risk-management practices for interest rate risk and liquidity risk, which were the weaknesses responsible for the failures of some large banks in early 2023. The weaknesses related to governance were in areas such as operational resiliency, cybersecurity, BSA and AML. Indeed, two-thirds of outstanding issues (unresolved supervisory findings) related to governance and controls, consistent with the last two semiannual reports.[5]
These findings are communicated to a banking organization’s management and board of directors in a written report. If a bank does not address these supervisory findings or if the findings are considered significant enough to pose a threat to a bank’s safety and soundness, supervisors may lower the bank’s supervisory rating or pursue an enforcement action against the bank.
Apparently, a bank may be rated unsatisfactory simply because it does not meet the demands of its examiners, even if examiners’ demands and expectations are based entirely on a subjective assessment of the impact of governance and controls deficiencies on the bank’s ability to remain safe and sound through a “range of conditions”(and, apparently, even if the more objective measures of financial condition—capital and liquidity—are not affected). While it is certainly the case that governance and controls failures of a profound nature could rise to the level of a real threat to the safety and soundness of an institution, it is equally certain that this cannot currently be the case for two-thirds of LFIs.
This also raises the related issue of loss of “well-managed” status based on a downgrade on only one of the three component ratings. Indeed, in a 2020 speech by then-Vice Chair for Supervision Quarles, he noted his concern with this aspect of the new rating system:
As we gain more experience with LFI, we will be paying close attention to how the new rating system is working and whether it is achieving its intended purpose. There are two features of the ratings system that I will be particularly interested to monitor, and which may well require adjustment. These are the embedding of qualitative “risk management” standards in the capital and liquidity components of the ratings (as opposed to standardized quantitative measures of capital and liquidity adequacy) and the ascetic principle by which a firm’s “well managed” status is determined by its lowest component rating, no matter how good the bank is at everything else.[6]
With two-thirds of LFIs rated unsatisfactory—and therefore not “well-managed”—apparently largely on the basis of governance and controls component downgrades, it is time to consider whether this result is consistent with the purpose of the rating system. If it is not, it is time for the Federal Reserve to consider appropriate adjustments. As noted below, these could include reconsidering the use of a composite rating determined using a simple average, or another process that does not presume that any governance and controls downgrade for an institution necessarily warrants an overall unsatisfactory rating for the institution.
Similar concerns persist with the management or “M” rating under the CAMELS framework for rating insured depository institutions (IDIs). Over the summer, press reports noted that the OCC found that half of the large banks it supervises “have ‘insufficient’ or ‘weak’ management of so-called operational risk,” which “contributed to about one-third of the banks rating three or worse on a five-point scale for their overall management.”[7] Downgrades based on subjective assessments of governance and controls are not confined to the Fed’s LFI rating system and, as we’ve noted previously, an overhaul of the CAMELS framework is long overdue.[8]
Is It Credible That Two-Thirds of LFIs Have Unsatisfactory Governance and Controls?
Without greater clarity regarding the standards by which examiners judge the quality of governance and controls at LFIs (or “management” at IDIs), it is hard to assess whether their judgments are reasonable. But it strains credulity to conclude that two-thirds of LFIs have unsatisfactory governance and controls, but only 5 percent or so of smaller banks (regional banks (RBOs) and community banks (CBOs)) do, even assuming smaller institutions are held to a lower standard for demonstrating operational resilience and managerial effectiveness. To be sure, size and geographical spread can pose challenges, and it may well be appropriate to hold larger institutions to higher standards, but the difference between the shares of large banks and small banks with unsatisfactory ratings is remarkably large especially considering the resources and controls LFIs dedicate to these efforts (including those intended to self-identify and remediate deficiencies).
Are the standards used in reaching judgments about governance and controls at LFIs reasonable? Perhaps more to the point, are examiners accurately assessing that governance and controls deficiencies “put the firm’s prospects for remaining safe and sound through a range of conditions at significant risk”—the standard for a rating of Deficient-1? How would large businesses in other industries fare if judged by the same standards? How would the federal government fare? For that matter, how does the Federal Reserve ensure there is clear alignment on how examiners characterize and prioritize supervisory findings and the true gravity of a problem from a safety and soundness perspective?
Recommendations for Additional Disclosures of Aggregated Information on Ratings, Supervisory Findings
The credibility of the Fed’s LFI rating system could be enhanced by expanding the aggregated information that has been provided to date in its semiannual reports. The report could be more precise about the percentages of LFIs that maintain satisfactory ratings for each of the three LFI components.[9] Credibility would also be enhanced by providing more information about outstanding supervisory findings by category.
Given that the report states that “firm remediation efforts on previous supervisory findings” is a supervisory priority, it should report for each category how many previous findings had been remediated during the prior six months.
More generally, the Federal Reserve should take a fresh look at the contents of the Supervisory Developments section of the report and identify opportunities to better inform the public regarding the activities, accomplishments and shortcomings of supervisory efforts. When the report was first issued in the fall of 2018, it was an important first step toward greater transparency. But the contents have changed little since then, and one gets the impression that, as often is the case with routine reports, its production is seen more as an exercise to comply with expectations created by past reports than an opportunity to make supervision more transparent and accountable.
Should the Process Tail Continue to Wag the Financial Condition Dog?
According to the Federal Reserve, “The LFI rating system represents a supervisory evaluation of whether a firm possesses sufficient financial and operational strength and resilience to maintain safe-and-sound operations and comply with laws and regulations, including those related to consumer protection, through a range of conditions”. That regulatory word salad has some language focused on financial condition – financial strength and resilience – but also focuses on “operational strength and resilience” which includes consumer protection. That dual mandate presumably is what caused the Federal Reserve to adopt a policy whereby the lowest of the three components – Capital, Liquidity and Governance and Controls – determines the composite rating and the Fed’s overall assessment of the bank.
The dominance of the Governance and Controls component now means that the LFI rating also is not any guide to the financial condition of banks. Ironically, because their financial condition is so strong, the ratings for Capital and Liquidity no longer matter in determining the composite rating – and thus the condition of the industry that the Federal Reserve describes to the public based on those ratings. The Governance and Controls rating now drives the assessment, and it can be based on failings on anything from consumer compliance to vendor management to AML screening – even if those deficiencies are in the process of being remediated or based on a range of unknown conditions or assumptions. So, to anyone looking to the Federal Reserve’s report to determine whether they should worry about a financial stability problem or a banking crisis, the message should be: look away.
The Federal Reserve should amend its policy to state that the composite rating is determined by the average of the components, not the lowest. Or better yet, it should have a Financial Condition Rating System that informs its assessment of bank resilience and a separate Compliance Rating System that evaluates how well examiners believe the bank is being operated.
[1] Federal Reserve Board, Supervision and Regulation (November 2024), available at https://www.federalreserve.gov/publications/files/202411-supervision-and-regulation-report.pdf.
[2] LFIs are defined in the report as both U.S. firms with total assets of $100 billion or more and Foreign Banking Organizations (FBOs) with combined U.S. assets of $100 billion or more.
[3] See 83 Fed. Reg. 58724 (November 21, 2018).
[4] Available at https://www.federalreserve.gov/supervisionreg/srletters/sr1903.htm.
[5] See reports from May 2024 (https://www.federalreserve.gov/publications/files/202405-supervision-and-regulation-report.pdf) and November 2023 (https://www.federalreserve.gov/publications/files/202311-supervision-and-regulation-report.pdf). The governance and controls component rating is intended to evaluate the effectiveness of a firm’s (i) board of directors, (ii) management of business lines and independent risk management and controls, and (iii) recovery planning (for domestic LISCC firms).
[6] Randal Quarles, “Spontaneity and Order: Transparency, Accountability, and Fairness in Bank Supervision,” Speech at the American Bar Association Banking Law Committee Meeting (January 17, 2020), available at https://www.federalreserve.gov/newsevents/speech/quarles20200117a.htm (emphasis added).
[7] “Secret Bank Ratings Show US Regulator’s Concern on Handling Risk,” Bloomberg (July 21, 2024), available at https://www.bloomberg.com/news/articles/2024-07-21/secret-bank-ratings-show-us-regulator-s-concern-on-handling-risk?.
[8] Greg Baer, The Bank Examination Problem, and How to Fix It (July 17, 2024), available at https://bpi.com/the-bank-examination-problem-and-how-to-fix-it/.
[9] While disaggregating the information to provide separate information for U.S. GSIBs, LBOs and FBOs would be useful for some information, in other cases (notably ratings) it might be inconsistent with the need to maintain confidentiality of supervisory findings for individual banks.
