BPI surveyed its members to learn about the overall burden for banks to comply with regulation and supervision. Twenty banks, approximately half of BPI’s membership, responded to the survey, including global systemically important banks, regional banks, and major foreign banks doing business in the United States.
The survey investigated changes in the compliance burden from 2016 to 2023. The year 2016 is a solid benchmark for a couple of reasons: 1. It is long after the Global Financial Crisis precipitated an increase in compliance staff, and 2. It is also the year preceding what some contend was the beginning of four years of “deregulation” of and eased supervisory expectations for the banking industry.[1]
As BPI has noted,[2] the contrary has occurred, and compliance burdens are more onerous and not less:
- The amount of employee time spent complying with financial regulations and responding to examiner mandates is growing, not shrinking. Between 2016 and 2023, the number of employee hours dedicated to complying with financial regulations and examiner mandates increased by 61%, even though aggregate employee hours increased only 20% in the same period.[3]
- Nearly half of management and board time is devoted to complying with regulation and supervision. Banks reported that 42% of C-Suite time and 43% of board time was devoted to regulatory or supervisory compliance, including examiner mandates and recommendations, instead of devoted to strategic planning or oversight of strategic planning, business planning, risk management, and other traditional management or board functions.[4] In 2016, C-Suite time devoted to compliance was 24% and board time was 27%, which means that in seven years the burden increased by 75% and 63%, respectively.
- The portion of bank IT budgets devoted to compliance grew by 40%. In 2016, banks spent 9.6% of their IT budget on compliance duties; in 2023, they spent 13.4%.[5]
[1] See, e.g., Vice Chair for Supervision Michael S. Barr, Review of the Federal Reserve’s Supervision and Regulation of Silicon Valley Bank, Board of Governors of the Federal Reserve System (April 28, 2023), p. iii, https://www.federalreserve.gov/publications/files/svb-review-20230428.pdf (alleging that, during several of the years covered in the period of BPI’s survey, “supervisory policy placed a greater emphasis on reducing burdens on firms”) (emphasis added); Road to Recovery: Protecting Main Street from President Trump’s Dangerous Deregulation of Wall Street, Better Markets(Sep. 15, 2020), p. 3 (arguing “the Trump Administration has launched an all-out assault on these important financial protection rules” and “needlessly increased the risk that a future shock to our banking or financial system more broadly might result in a crisis similar to that of 2008-2009… or worse” and that the agenda is “not […] based on evidence or data […] but vacuous words and phrases”); see also Michael Hiltzik, How Trump’s frenzy of deregulation killed Silicon Valley Bank, Los Angeles Times (March 30, 2023), https://www.latimes.com/business/story/2023-03-30/how-trumps-frenzy-of-deregulation-killed-silicon-valley-bank.
[2] See, e.g., Greg Baer, The Bank Examination Problem, and How to Fix It, Speech at the Constitutional Renewal Foundation,(July 17, 2024), available at https://bpi.com/the-bank-examination-problem-and-how-to-fix-it/; Greg Baer, Rethinking Bank Examination, Starling Insights Compendium (June 11, 2024), https://insights.starlingtrust.com/content/compendium/rethinking-bank-examination.
[3] The survey assessed a bank’s “full-time equivalents” (“FTEs”) in 2016 and 2023, and how much of total FTE time was devoted to compliance. FTEs was defined as “the number of full-time hours being worked by both full-time and part-time employees.” The survey included all FTEs in the United States, including the U.S. top-tier holding company and all U.S. bank and nonbank subsidiaries and affiliates. FTEs working for legal entities located outside the United States were excluded.
FTE time devoted to compliance included all employee time spent supporting the organization’s compliance with financial institution-specific law, regulation, guidance or other governmental mandate, including responding to mandates and recommendations from federal and state banking agencies, CFPB, SEC and other U.S. market and prudential regulatory agencies. It excluded employee time spent monitoring risk for financial purposes and time spent supporting compliance with laws and regulations applicable to an ordinary company (i.e., one without government-issued charters/licenses to conduct banking or other financial activities), like tax, general corporate, and labor laws, etc.”
[4] The survey defined “regulatory or supervisory compliance” as “compliance with law, regulation, guidance or other governmental mandate, including responding to mandates and recommendations from federal and state banking agencies, CFPB, SEC and other U.S. market and prudential regulatory agencies.”
By contrast, the survey defined “risk management” as “risk management in the ordinary course unrelated to prudential regulatory or supervisory requirements.” By example, the survey noted that “credit underwriting is an ordinary risk management practice for any business lending money, regardless of any prudential regulatory or supervisory requirements.”
[5] The survey queried the percentage of an organization’s IT budget “devoted to demonstrating compliance with law, regulation, guidance or other governmental mandate issued by federal and state banking agencies, the CFPB, SEC, and other U.S. market and prudential regulatory agencies, or responding to consent orders, MRAs or other examiner mandates or recommendations from those agencies.”
