Newly Adopted OCC Standards Raise Institutional ... - Dinsmore

Newly Adopted OCC StandardsRaise Institutional and PersonalExposure for Banks and Bankers

Recent regulatory action implementing a government-wide statutory mandate raising the dollar amounts of civil moneypenalties (CMPs) imposed on financial institutions, senior executive officers, board members, and other institution-affiliatedparties (IAPs) have heightened both the government's expectations with respect to an institution's control environment andthe risk of more severe sanctions for operational and compliance failures. Contemporaneously, the Office of the Comptroller

of the Currency has reconfigured its CMP assessment framework, adopting two matrices, one specifically designed forinstitutions and the other for IAPs. The new matrices set lower thresholds for triggering sanctions and provide for the

imposition of higher penalties, increasing both institutional and individual exposure. This article explores the nature andimpact of these actions and offers practical insights for managing the enforcement process.

FRANK A. MAYER, III, JOHN E. BOWMAN, RICHARD M. BERMAN, JONATHAN L. LEVIN, AND ADRIENNE C. BEATTY

Anyone monitoring recent trends in the super-visory climate affecting financial institutionsknows that risk management and compliance

are paramount. Regulatory and enforcement actionsundertaken by federal agencies over the past year haveraised the stakes for non-compliance for institutionslarge and small and have put their institution-affili-ated parties (IAPs) at greater personal risk. This ar-ticle examines the evolving framework for civil moneypenalties (CMPs) and related supervisory sanctions.

Frank A. Mayer, Ill is a partner and Chair of the Financial

Services Regulatory & Enforcement Group at Dinsmore& Shohl LLP. John E. Bowman is the co-chair of thefirm's Financial Services Group and a former director of

the Office of Thrift SuperVision. Richard M. Berman is a

Partner in the firm's Corporate Department and a member

of the Financial Services Regulatory and Enforcement

Group. Jonathan L. Levin is Of Counsel in Dinsmore's

Philadelphia office and a member of the Financial Services

Regulatory & Enforcement Group in the CorporateDepartment. Adrienne C. Beatty is a member of the firm'sCorporate Department, focusing her practice on financial

services, bank regulatory compliance, and public finance.

The authors may be contacted by email, respectively, at

[email protected], John.Bowman@dinsmore.

com, Richard.Berman @dinsmore.com, Jonathan.Levin @dinsmore.com, and [email protected].

THE OCC'S UPDATED POLICIES AND PROCEDURESMANUAL FOR CMPSThe seminal event altering the landscape for sanctionswas the publication by the Office of the Comptrol-ler of the Currency (OCC) of a revised Policies andProcedures Manual (PPM 5000-7) that reformulatesthe system for imposing CMPs on national banks, fed-eral savings associations, federal branches of foreignbanks, and other institutions and IAPs under its juris-diction. Issued on February 26, 2016, this PPM modi-fies, expands the bases, and lowers the bar for CMPassessment, superseding guidelines from earlier OCCand Office of Thrift Supervision (OTS) releases.'

With the OCC's new PPM come changes that carrywith them increased compliance burdens, obligatinginstitutions to recalibrate their governance structureand reevaluate their appetite for risk in connectionwith all activities and business lines. These challengestend to be more easily addressed by larger institutionsthan smaller ones, and the OCC appears to recognize

1 The new PPM (available at https://www.occ.gov/news-s s uance s/b ulletins/2016/b ulletin-2016-5 a .pdf ) revises PPM5000-7 (REV), dated June 16, 1993 (available at http://aabd.org/wp-content/uploads/2016/05/OCC-Matrices_1993.pdf), and super-sedes PPM 5000-27 (REV), "Civil Money Penalty Assessment forDelinquent or Inaccurate Call Reports," dated May 21, 1993, andOTS Regulatory Bulletin 18-3b, "Enforcement Policy Statementon Civil Money Penalties," dated Dec. 3, 2009.

Winter 2017 Vol 30 / No 2 NEWLY ADOPTED OCC STANDARDS RAISE INSTITUTIONAL AND PERSONAL EXPOSURE 5

this truth, acknowledging that "a bank's governancepractices should be commensurate with the bank's size,complexity, and risk profile."2 Moreover, the OCCemphasizes that examiners have wide discretion injudging the appropriateness of corporate and risk gov-ernance based on an institution's size, risk profile, andcomplexity, with larger institutions needing board andmanagement structures and practices that are more so-phisticated and formal. Nonetheless, the guidance andprocedures in the new PPM apply to OCC-supervisedinstitutions of all sizes, as well as their IAPs.

Aiming the PPM at promoting an appreciation ofpositive public policy, the OCC explains that a CMPmay serve as a deterrent to future violations of lawand breaches of fiduciary duty by both IAPs andinstitutions. At the same time, a range of possibleCMPs can encourage correction of violations andunsafe and unsound practices. While affirming itsdiscretionary authority to assess CMPs independentlyor in conjunction with a number of other availableenforcement actions, the OCC notes that nothing inthe PPM creates any substantive or procedural rightsfor IAPs or institutions.

Assessment of Penalties. Three statutory tiers ofCMPs are identified in the revised PPM:

• Tier 1: simple violations of law or official actions;• Tier 2: violations of law or supervisory actions or

reckless unsafe or unsound practices or breaches offiduciary duty that are part of a pattern of mis-conduct, cause more than minimal damage to theinstitution or bring the violator monetary gain; and

• Tier 3: knowing (i) violations of legal require-ments, (ii) unsafe or unsound practices, or(iii) breaches of fiduciary duty that knowingly orrecklessly cause substantial loss to the institutionor bring the violator substantial gain.

The higher the tier, the greater the monetary penalties.

Factors to Be Considered. In determining a CMP,the OCC is required to consider four statutorily man-dated factors:

1. Size of financial resources and good faith;2. Gravity of the violation;3. History of violations; and4. Other matters as justice may require.'

2 OCC, Comptroller's Handbook, Corporate and Risk Gov-ernance (July 2016), Introduction, p. 1, available at https://occ.gov/publications/publications-by-type/comptrollers-handbook/pub-ch-crg.pdf.

See 12 U.S.C. § 1818(i)(2)(G).

To this end, federal banking agencies adopted the1998 Federal Financial Institutions ExaminationCouncil (FFIEC) "Interagency Policy Regarding theAssessment of Civil Money Penalties by the FederalFinancial Institutions Regulatory Agencies,"4 whichidentifies 13 factors that agencies should considerin assessing CMPs consistent with the four statutoryfactors.To ensure that all relevant factors—the four statu-

tory factors and the 13 FFIEC factors—are consideredin all CMP decisions, and to promote consistencyamong those decisions, the OCC diverged from thepath taken by the other agencies, abandoning thesingle matrix used since 1993 in favor of two separateCMP matrices, one for IAPs and another for institu-tions. Described as tools to quantify the degree ofseverity of violations, unsafe and unsound practices,and breaches of fiduciary duty, the new matricesappended to the revised PPM provide guidance indetermining whether a CMP is warranted and, if so,the appropriate amount. The OCC has added twofactors to the 13 on the interagency list for institu-tions: (1) loss or harm caused to consumers or thepublic from consumer law or Bank Secrecy Act (BSA)violations and (2) the level of good faith displayedbefore notification to the institution of the violation.'Similarly, the OCC has added two factors to the13 on the interagency list for IAPs: (1) the numberof instances of misconduct at issue and (2) the levelof good faith displayed before notification to theIAP of the violation.

Reliance on broad discretion by examiners remainsa foundational principle of bank supervision, andthe OCC takes pains to emphasize that the matricesare intended neither to reduce the CMP process toa mathematical equation nor to be a substitute forsound supervisory judgment. The matrices apply tothe assessment of Tier 1 and Tier 2 CMPs. However,Tier 3 CMPs are assessed not by use of the matrix butexclusively on the basis of individualized supervisoryevaluation, which the OCC believes these most severecases deserve.

Assessment Procedures. The revised PPM sets forthspecific CMP assessment procedures. In the case of IAPs,these procedures outline the three supervisory responses

4 See https://www.gpo.gov/fdsys/pkg/FR-1998-06603/pdf/98-14611.pdf.

s Bank Secrecy Act (BSA) violations deserve special attention.Not only is a high weight assigned to these violaticfris, but a strongsignal of their importance was also sent when OCC Bulletin 2016-6,reiterating the CMP process for BSA noncompliance, was releasedonly three days after the revised PPM.

6 JOURNAL OF TAXATION AND REGULATION OF FINANCIAL INSTITUTIONS Winter 2017 Vol 30 / No 2

available to the OCC considering the appropriatenessof a CMP:

1. It can issue a nonpublic supervisory letter;2. It can 'deliver a nonpublic letter of reprimand; or3. It can assess a publicly disclosed CMP.

In dealing with an IAP, a supervisory letter is usedwhen a CMP or reprimand is unwarranted but thetransgression should not pass unnoticed. A letter of

reprimand is issued to an IAP when the CMP wouldbe small; the misconduct was technical in nature; therewas no history of misconduct or no intent; the repri-

mand will achieve the supervisory objectives; and theappropriate Supervision Review Committee (SRC) ap-

proves.6 A reprimand remains on record and leaves nodoubt that the IAP will face significant consequencesshould he or she commit any future violations.'

Supervisory letters are an integral part of the gen-eral supervisory process for institutions and, being aroutine form of communication between the regulator

and the institution, are not specifically spelled out inthe CMP assessment process. As such, they are notnormally used by the regulators as an alternative toCMPs with institutions. Letters of reprimand arenever issued to institutions.

The new assessment methodology is anchored bythe bifurcation of the original unified 1993 matrix

into the two new matrices. Presented in greater detail

than the 1993 original, the 2016 matrices providemore extensive descriptions of conduct together withtheir increasing levels of severity. These enhancementsappear to be aimed at achieving greater consistencyin determining the gradient of conduct.

Both 2016 matrices include revised "FactorWeights." By way of comparison, whereas the total

Factor Weight in 1993 was 43, the total Factor Weight

of the 2016 IAP Matrix has been increased to 45

and the total Factor Weight of the 2016 Institution

Matrix has been increased to 50. Consequently, using

the 0-to-4 scoring system that remains unchanged, in

1993 the maximum possible score was 172, while themaximum possible score in 2016 is 180 for IAPs and

200 for institutions.Some examples of factor weight changes tell a

story: The OCC now will attribute greater weight

6 Supervisory Review Committees are established at the OCC

District and Washington levels to ensure effective and consistent

enforcement policies.

While supervisory letters and letters of reprimand are not

publicly disclosable, an IAP could be obligated to disclose their

existence when being considered by another financial institution or

holding company to serve as an executive officer or board member.

to aggravating factors and less value to mitigatingfactors. For institutions, the weight for violations car-ried out with intent increased from 5 to 7, violationswhich continued after notification from 3 to 5, con-cealment from 5 to 6, instances of previous concernor administrative action for similar violations from3 to 5, history of violations and tendency to engagein violations from 2 to 3 and duration and frequencyof violations before notification from 2 to 3. A newfactor, effectiveness of internal controls and compli-ance program, has been assigned a factor of 4. ForIAPs, the weight of intent has increased from 5 to 6,financial gain from 4 to 6, continuation of conductafter notification from 3 to 4 and previous concern

•I— , _.,•----,-, ̀ _Y =cam

ht .

' a ..' '4 I

e ' }.04t.lii_ i .0 ,, II , ,nd) i ;,

ot,Ltaiss_„,:sito _. N-:s.boutil,e4_ ,.. -i.i ma_ . -Ii-,- 'N riiistit r11 pViiiiigil

917-9 i I .- c t .,

I 'S.

h

or administrative action for similar violation from2 to 3. A new factor, IAP responsibility for internalcontrols environment and its effectiveness, has beenassigned a factor weight of 4.The 1993 Matrix had a total Mitigating Factor

Weight of 7, which, when multiplied by the factor scoreof 0 to 4, resulted in a maximum possible mitigatingfactor score of 28. In contrast, the 2016 IAP Matrix hasa total Mitigating Factor Weight of 6, which, using the0-to-4 scoring system, results in a maximum possiblemitigating factor score of 24, while the 2016 Institu-tion Matrix with a total mitigating factor weight of 5results in a maximum possible mitigating factor scoreof 20. The principal cause of these reductions is, forinstitutions, the lowering of good faith and restitutionweights from 3 to 2 and 2 to 1, respectively, and forIAPs, the lowering of good faith weight from 3 to 2.Reconfiguration of factors relating to Bank SecrecyAct/Anti-Money-Laundering (BSA/AML) violations,harm to consumers and other deficiencies signals theadvent of increased scrutiny in these areas, as well asintensified focus on the effectiveness of compliance andcontrol functions for institutions and IAPs responsiblefor managing these functions.

Practical Effect of Changes. Consequently, institutionsshould rededicate themselves to improving theircompliance and controls to avoid prohibited conduct

r


and, should such conduct still occur, to enabling its quick

identification and cessation. With prohibited conduct

that continues post-notification being assigned increased

weight as a negative factor and good faith being assigned

decreased weight as a mitigating factor, the effectiveness

of compliance and controls becomes ever more critical.

As was the case with the 1993 matrix, each of the

2016 matrices is accompanied by a corresponding

Suggested Action Table, but, here again, the differ-

ences are considerable. The new Suggested Action

Tables make significant changes in the way viola-

tions, unsafe or unsound practices and breaches of

fiduciary duty are treated for.purposes of considering

potential penalties.

•

'17-7it1.1

71170...70re..ar..;

1 I

Notably, the total matrix score threshold for impo-

sition of CMPs for both institutions and IAPs under

the 2016 Suggested Action tables has been lowered

to 41 from the 51 threshold established in 1993.

Additionally, the 2016 Suggested Action Table for

institutions lists CMP amounts that are based on a

combination of the total matrix score and the total

asset size of the institution. Compounding the impact,

the 2016 CMP amounts have been raised well above

1993 levels, with penalties for institutions set higher

than those for similar violations by IAPs. In short,

weighting of negative factors has increased, weight-

ing of mitigating factors has decreased, thresholds for

supervisory letters, letters of reprimand and CMPs

have been lowered, and the amount of suggested

CMPs has increased.'

HOW IT WILL WORK "ON THEGROUND"-A HYPOTHETICALTo provide the reader with a more concrete under-

standing of how the new assessment methodology

compares with the old, we have conceived the fol-

lowing hypothetical, which, admittedly, is sparse in

its detail. Our purpose is riot to create a fully formed

The ability of both an institution and an IAP to pay the CMP

is to be considered after completion of the matrix and before a

recommendation to assess a CMP.

true-to-life situation, but rather to sketch a factualskeleton along with a Total Matrix Score that is in-structive in demonstrating how the same conductinvolving an institution and its IAP could yield asuggested outcome under the 2016 matrices that ismarkedly different from the outcome under the 1993matrix. Undeniably, every actual case will presentfacts and nuances that can significantly alter the cal-culation of the underlying scores.

A Hypothetical Scenario. A community bank withtotal assets of $500 million (Bank) received its firstnotification by way of a Matter Requiring Attention(MRA) in a Report of Examination that it hadpotentially committed violations resulting from theinadequacy of its BSA/AML monitoring system. Inthe interest of economics and because other revenue-generating IT projects were "ahead" in the queuefor implementation, the CEO delayed approval ofthe purchase and installation of upgraded software

that would better automate its monitoring system.

Bank has just received a 15-day letter from the OCC

asserting that the system should have been updated a

year ago and indicating that CMPs may be assessed.

To date there has been no confirmation of actual loss

to Bank.Tables 1, 2, and 3 show the respective treatment

of this scenario under the 1993 and 2016 matrices.

According to the Suggested Action Table under

the 1993 Matrix, the Total matrix score of 44 (for

simplicity of illustration scored the same for both the

Bank and the IAP) falls squarely within the second

lowest of eight ranges, spanning 31-50, where issu-

ance of a supervisory letter is suggested. For scores

in the lowest range (below 31), examiners were dis-

suaded from making a referral to their supervisory

office, and not until the score reached 51 did the

OCC consider sending a 15-day letter announcing its

intention to issue a reprimand (for an IAP) or to levy

a small CMP no greater than $5,000 (applicable to

an institution or an IAP).In stark contrast, according to the institution Sug-

gested Action Table under the 2016 Matrix, a Total

matrix score of 56 drops Bank into the middle of the

second of six ranges, spanning 41-70. As Bank is ail

institution with assets between $250 million and $1

billion, the table suggests levying a CMP in an amount

up to $100,000. At this same score, if Bank had assets

exceeding $100 billion, the suggested CM P would top

off at $15 million. Only institutions scoring 40 or less

avoid the suggested CMP assessment.Even more striking, the IAP Suggested Action

Table under the 2016 Matrix plants the Total matrix

score of 56 for the CEO in the third of seven ranges,

8 JOURNAL OF TAXATION AND REGULATION OF FINANCIAL INSTITUTIONSWinler 2017 Vol 30 /

No 2

Table 1: 1993 Matrix

Factors 0 1 2 3 4WeightFactor

FinalFigure

Intent Noi —

Should haveknown

Clear intent 5 10*

Pecuniary gain orother benefit to IAPor related interest

No

Indirect benefitto IAP or relatedinterest

Direct benefit toIAP or relatedinterest

4 0

Prev, admin. actionor criticism

NonePrev.criticism forsimilar violation

Violation orcriticism on pointcited in ROE

MOU, CommitmentLetter orSupervisory Letteron point

C&D, Agreement,Condition in Writ-ing, Reprimand, orprior CMP on point

3 6

History NoneUnrelated priorviolation

At least one similar violation

Several similarviolations

Frequent similarviolations

2 0

Loss or risk of lossto the bank

No loss and norisk of loss

No loss or minimalrisk

Minimal loss ormoderate risk

Substantial actualor potential loss

6 12

No. of violationsat issue

Numerousviolations

2 2

Duration ofviolation prior tonotification

Violationoutstanding forlong period

2 6

Continuation afternotification

Violation ceasedprior to notification

Violation ceasedimmediately uponnotification

Violationcontinued forperiod of time afternotification

Violation stillcontinuing

3 9

Concealment None

Purposelycomplicatedtransaction to makeit difficult touncover

Active concealment 5 0

Impact other thanloss

No impact onbank or bankingindustry

Substantialimpact on bank; noimpact on bankingindustry

Moderate impacton bankingindustry or onpublic perceptionof banking industry

Substantial impacton bankingindustry or onpublic perceptionof banking industry

6 6

Loss or harm toconsumers (con-sumer laws only)

No loss and noharm

No loss or minimalharm

Minimal loss ormoderate harm

Substantial loss orharm

5 0

Subtotal 151

Restitution No restitution Partial restitution

Complete restitutionunder compulsion(e.g., threat oflosing job)

Complete restitutionimmed. after loss orviolation brought toattention

Complete restitutionvoluntarily, beforebank or examineruncovered loss

2 0

Good faith (prior tonotification)

NoneUnintentionalviolation

3 3

Full cooperation(after notification)

NoneForthcoming ininterviews

2 4

Subtotal 27

Total (Subtract 2 from 1)44

"The Final Figure In each case is arrived at by multiplying the Severity Level by the Weight Factor. lu this example, the Severity Level of 2 may be determined by div

id-

ing the Final Figure of 10 by the Weight Factor of 5 (10 - 5 = 2).


Table 2: 2016 Matrix for Institutions

Factors 0 1 2 3 4Factorweight

Factorscore

Intent (1)a NoneShould haveknown

Disregarded redflags or otherwarnings

Clear intent orclearlydisregarded the lawor consequences tothe bank

7 14

Continuation afternotification (3)

Violation ceasedbefore notification


Bank took timelysteps to correctviolation, butviolation continuedafter notification

No timelycorrective action;violation continuedfor short period oftime afternotification

Violation stillcontinuing orcontinued for longperiod of time afternotification

5 15

Concealment (5)None, orself-disclosure ofviolation

Disclosure ofrelevant facts uponrequest

Incompletedisclosure ofrelevant facts ormaterials

Purposelycomplicated trans -action to make itdifficult to uncover

Actively tooksteps to concealmisconduct orrelevant facts

6

_

0

Financial gain orother benefit as aresult of violation(7)

NoneMinimal indirectgain to bank orrelated interest

Indirect gain orbenefit to bank orrelated interest

Direct gain orbenefit to bank orrelated interest

Substantial directbenefit to bank orrelated interest

4 0

Loss or risk of lossto the bank (6)

No loss and norisk of loss

Minimal actualloss or minimalrisk of loss

Moderate risk ofloss

Moderate actualloss or substantialrisk of loss

Substantial actualloss

4 8

Impact or harmother than financialloss to the bank(6)

No impact or harmto bank

Minimal impactor minimal harmto bank

Some impact orsome harm to bank

Moderate impactor moderate harmto bank

Substantial impactor substantialharm to bank

4 4

Loss or harmto consumersor the public(consumer law orBank Secrecy Actviolations)

No loss and noharm

Minimal loss orminimal harm

Moderate loss orharm to moderatenumber of con-sumers or portionof the public

Moderate loss orharm to substantialnumber of con-sumers or portionof the public

Substantial loss orharm to substantialnumber of con-sumers or portionof the public

5 0

Previous concernor administrativeaction for similarviolation (10) (13)

None

Concern in anymatters requiringattention (MRA) forrelated deficiencyor violation

Repeat or pastdue concern in anMRA for relateddeficiency orviolation

Concern inan informalenforcement actionintended to preventthe violation

Concern in a for-mal enforcementaction intendedto prevent theviolation

5 5

History of viola-tions and tendencyto engage inviolations (9) (12)

No prior similarviolations orminimal history ofunrelated violations

Prior unrelatedviolations

At least one priorsimilar violation

Prior unrelatedrepeat or recurringviolations

Prior similar repeator recurringviolations

3 0

Duration andfrequency ofviolations beforenotification (2)

Isolated violationViolation contin-ued for up to6 months

Several viola-dons, or violationcontinued for up to1 year

Frequentviolations, orviolation continuedfor 1-2 years

Pattern or practice,or violationoutstanding formore than 2 years

3 6

Effectiveness of in-ternal controls (IC)and complianceprogram (CP) (11)

Strong ICs and CP

Generally effectiveICs and CP withrelevantweaknesses

ICs and CP havemoderateweaknesses

Minimal, ineffec-five ICs and CP

ICs and CP aresubstantiallylacking

4 12

Subtotal 1 64(Continued

10 JOURNAL OF TAXATION AND REGULATION OF FINANCIAL INSTITUTIONSWinter 2017 Vol 30 /

No 2

Factors 0 1T

2 3 4Factorweight

Factorscore

Good faith beforenotification

Complete lack ofgood faith

Some evidence ofgood faith

Good faith shownthroughout

2

-

4

Full cooperationafter notification(4)

NoneLimited disclosureand cooperationafter notification

Full disclosure andcooperation afternotification

2 4

Restitution, ifapplicable (8)

No restitution Partial restitutionCompleterestitution undercompulsion

Complete restitu-tion timely afternotification

Complete restitu-tion voluntarilybefore notification

1 0

Subtotal 2 8

Total matrix score (subtract subtotal 2 from subtotal 1) 56

'Parenthetical numbers refer to the numbered interagency factors listed in the FFIEC's "Interagency Policy Regarding the Assessment of Civil Money

Penalties by the Federal Financial Institutions Regulatory Agencies," 63 Fed. Reg. 30227 (June 3, 1998), available at https://www.occ.gov/news-issu

ances/federal-register/OCC1998-20a.pdf.

Table 3: 2016 Matrix for Institution-Affiliated Parties

Factors 0 1 2 3 4Factorweight

Factorscore

Intent (1)a NoneShould haveknown

Disregarded redflags or otherwarnings

Clear intent orclearly disre-garded the law orconsequences tothe bank

6 12

Continuation afternotification (3)

Violation ceasedbefore notification


IAP took timelysteps to correctviolation, but viola-tion continued afternotification

IAP did not timelycorrect violation,and violation con-tinued for short timeafter notification

Violation stillcontinuing orcontinued for longperiod of time afternotification

4 12

Concealment (5)None, or self-disclosure ofviolation

Disclosure ofrelevant facts uponrequest

Incomplete orinvoluntary disclo-sure, or failure toescalate to appro-priate authority

Purposely compli-cated transaction tomake it difficult touncover

Actively tooksteps to concealmisconduct orrelevant facts

5 0

Financial gain orother benefit as aresult of violation

(7)

NoneMinimal indirectgain to IAP orrelated interest

Indirect gain orbenefit to IAP orrelated interest

Direct gain orbenefit to IAP orrelated interest

Substantial directbenefit to IAP orrelated interest

6 0

Loss or risk of lossto the bank (6)

No loss and no riskof loss

Minimal actualloss or minimalrisk of loss

Moderate risk ofloss

Moderate actual Substantialloss or substantialrisk of loss

actualloss

5 10

Impact or harmother than financialloss to the bank,including harm toconsumers or thepublic (6)

No harm to thebank, consumers,or the public

Minimal impact orminimal harm tobank; no harm toconsumers or thepublic

Some harm to bankor minimal harm toconsumers or thepublic

Moderate harm tobank, consumers,or the public

Substantial harm tobank, consumers,or the public

5 5

Previous concernor administrativeaction for similarviolation (10) (13)

None

Concern in anymatters requiringattention (MRA) forrelated deficiencyor violation

Repeat or past dueconcern in an MRAfor related defi-ciency or violation

Concern in an in-formal enforcementaction intendedto prevent theviolation

Concern in aformal enforcementaction intendedto prevent theviolation

3 3

(Continued


Table 3: 2016

Factors

Matrix for Institution-Affiliated

10

Parties (Continued)

2 3 4Factorweight

Factorscore

History of viola-tions and tendencyto engage in viola-tions (9) (12)

No prior similarviolations orminimal history ofunrelatedviolations

Prior unrelatedviolations

At least one priorsimilar violation

Prior unrelatedrepeat or recurringviolations

Prior similar repeator recurringviolations

3 0

Duration ofviolation beforenotification (2)

Violation continuedless than 1 month

Violation continuedfor up to 6 months

Violation continuedfor up to 1 year

Violation continuedfor 1-2 years

Violationoutstanding formore than 2 years

2 4

Number ofinstances ofmisconduct at issue

None 1-3 instances 4-6 instances 7-10 instancesMore than 10instances

2 2

IAP responsibilityfor internalcontrolsenvironment andits effectiveness(11)

IAP has noresponsibility,and/or adequateprograms/ policiesexist in area whereviolation occurred

IAP hasresponsibility forinadequatemonitoring andreporting ofexceptions

IAP has responsi-bility for inadequateprograms/ policiesbut has cooperatedin bank's responseto requiredcorrective action

IAP has responsi-bility for absenceof any programs/policies in areawhere violationoccurred

IAP has respon-sibility for inad-equate programs/policies and hasnot been respon-sive to requiredcorrective action

4 16

Subtotal 1 64

Good faith beforenotification

Complete lack ofgood faith

Some evidence ofgood faith

Good faith shownthroughout

2 4

Full cooperationafter notification (4)

NoneLimited disclosureand cooperationafter notification

Full disclosure andcooperation afternotification

2 4

Restitution, ifapplicable (8)

No restitution Partial restitutionCompleterestitution undercompulsion

Complete restitu-tion timely afternotification

Completerestitution beforenotification

2 0

Subtotal 2 8

Total matrix score (subtract subtotal 2 from subtotal 1) 56

'Parenthetical numbers refer to the numbered interagency factors listed in the FFIEC's "Interagency Policy Regarding the Assessment of Civil Money

Penalties by the Federal Financial Institutions Regulatory Agencies," 63 Fed. Reg. 30227 (June 3,1998), available at https://www.occ.gov/news-issu

ancesltederal-reg ister/OCC 1998-20a.pdf.

spanning 51-60. At this level a CMP is virtually un-

avoidable, with the suggested amount pegged between

$5,000 and $15,000. A supervisory letter is suggested

only for a score up to 40, while a score between 41

and 50 would land the CEO either a reprimand or a

CMP up to $5,000.

CATCH-UP AND ANNUAL CMP INCREASES

As if the how of assessments taking root at the

OCC was not change enough, the impact of the new

methodology was suddenly compounded by a genera-

tional shift in the how much, reaching well beyond

OCC-supervised institutions. In coordination, though

not jointly, the Consumer Financial Protection Bureau

(CFPB), the Financial Crimes Enforcement Network

(FinCEN), the OCC, the Federal Reserve Board and

the Federal Deposit Insurance Corporation (FDIC)9

adopted regulationsl° that implement the directive

under the Federal Civil Penalties Inflation Adjust-

ment Act Improvements Act of 201511(the 2015 Act).

9 The Justice Department, the Commodity Futures Trading

Commission (CFTC), and the Securities and Exchange Commission

(SEC) also have taken similar actions.

10 Each regulation was issued as an interim final rule, having

the full effect of a final rule while inviting public comment by

Aug. 30, 2016.

11 P.L. 114-74, § 701, 129 Stat. 584, 599.

12 JOURNAL OF TAXATION AND REGULATION OF FINANCIAL INSTITUTIONSWinler 2017 Vol 30 / No 2

Where previous 1aw12 required agencies to make in-flation-based adjustments every four years, the newdirective calls for annual adjustment of the maximumamount or the minimum-maximum range for eachCMP authorized by the laws an agency administers.Thus, beginning in 2017, the agencies must establish

and publish adjustments to the CMP ranges to ac-count for inflation, based on the percentage increasein the consumer-price index (CPI-U), no later than

January 15th of each year.

Catch-Up Adjusment. In their initial phase, these

regulations, implementing a mandate in the 2015 Act,

engineer a "catch-up" adjustment meant to bring all

CMPs into line with long-term inflation. Although

the catch-up is capped at 150 percent of each CMP

charged as of November 2015, the adjustment often

yields snaximuna CMP amounts that, when compared

to the inaximum originally prescribed in authorizing

law, rise to nearly double, or even more. To give a

clearer sense of dimension, a large number of the

earliest CMP statutes that carry three-tiered penalties

geared to levels of severity and intent will have risen

from their original maximums three decades ago of

$5,000, $25,000, and $1 million to $9,468, $47,340,

and $1,893,610, respectively.As also published by its sister banking agencies, the

OCC presents the new CMP maximums, which took

effect August 1, 2016, in a chart listing all applicable

laws. Where a law covers more than one agency, the

OCC calculations and those of the other agencies

are identical. Adjustments apply only to penalties

stated as a dollar amount. The increases do not ap-

ply to penalties that are functions of violations. For

example, a penalty described as "twice the value of

the transaction or $250,000" would show that only

the dollar figure is subject to adjustment.

Augmented List of Violations. This action carries

greater significance than might initially seem apparent.

Not only is the magnitude of the inflation-based

adjustments considerable, but the list of violations

also has been augmented. Together with the FDIC,

the OCC has expanded its existing chart to include

a new law (originating from the Dodd-Frank Act)

that authorizes CMPs when creditors making home

mortgage loans violate agency regulations covering

12 Specifically, the Debt Collection Improvement Act of 1996,

P.L. 104-134, § 31001(s), 110 Stat. 1321-373 (Apr. 26, 1996), codi-

fied at 28 U.S.C. § 2461 note, amended the Federal Civil Penalties

Inflation Adjustment Act of 1990, P.L. 101-410, 104 Stat. 890

(Oct. 5, 1990), codified at 28 U.S.C. § 2461 note, to require that,

at least once every four years, federal agencies issue regulations

adjusting CMPs to account for inflation.

appraiser independence requirements." Beyond

that addition, and also with the FDIC, the OCC

has included existing but previously unlisted CMPs

for refusal by any affiliate to permit an examiner to

make an examination of such affiliate or to provide

any information required in the course of such

an examination. The OCC has also added three

previously unlisted federal savings association CMPs

that cover negotiable instrument withdrawal and

transfer restrictions, certain anti-tying restrictions,

and various securities law provisions.

fvt. ,--••:1,-,...1 •-.174‘,7 --7]-',1

.1. ,• I - 111. - . . ..4

II

•71, 40.C.tril• .. .'4.4-1- • 7- -'1;1'.7tC2.1: : 1 9-, r i 1...LFH4, j j..: ...si' Nipi*.4,ik Orri,:-.,...57,fc:10'..7.,--4—,-P•r-75:- )-1 , --. , . . . - , • . ,, ., . ,....

'11.. 1 .1j ..•ii 1 !.] 1 1 11.411,1i ill 1— i(41! •

P4.--• •,.•••.1--- • ...) I .1 •

. , ') , r.7-7. n 5! ,...i .:. j i7 . ! •I -- '.)

rf.7.71.;N. f 1 1412i '' .!771'..'3L'W' t'i.'. ...-_ --:.& I - . •.

A.

MT:7 i!..:111'-7'P=

Transition. Regarding the transition of assessments to

the increased levels, the Federal Register preamble to

this interim final rule indicates that the revised CMPs

apply only to penalties assessed on or after the effective

date of the interim final rule, i.e., August 1, 2016.14 A

close reading of the language in the 2015 Act reveals

a more definitive approach regarding the imposition

of increased penalties for violations occurring prior to

the effective date of the interim final rule. The 2015

Act provides in pertinent part that lalny increase

under this Act in a civil monetary penalty shall apply

only to civil monetary penalties, including those whose

associated violation predated such increase, which are

assessed after the date the increase takes effect."" As

the OCC and other federal banking agencies press

forward with implementation of the interim final

rule, the propriety of assessing increased penalties

for violations committed before August 1, 2016, may

become the subject of judicial review.

Goals Underlying the Changes. The OCC has heralded

the beneficial effects expected from these increases.

Regular adjustments for inflation are intended to

maintain the deterrent effect of CMPs, promote

compliance with the law, and improve federal

government collection of CMPs.

13 The CFPB chart also contains this law, but the agency had

not published any previous list that required expansion.

14 81 Fed. Reg. 43024 (July 1, 2016).

is P.L. 114-74, § 701(b)(3), 129 Stat. 600.


Another unmistakable signal of the intensifying re-solve on the part of federal regulators to impose disci-pline throughout the financial services industry is the0 CC's mid-summer 2016 release of a new Corporateand Risk Governance booklet." This publication—acomponent of The Comptroller's Handbook, whichnow uniformly covers national banks and federalthrifts—sounds the call for examiners to take a freshlook at institutional operations through the lens ofrisk management. Central to the change in approach isthe focus on identification, measurement, monitoring,and controlling of risks through policies, processes,personnel, and control systems that enable institutionsto meet their strategic objectives.

Alongside the issuance of the new booklet, theOCC published an updated version of The Director'sBook, its manual for board members of nationalbanks and federal savings associations. Although theOCC claims not to have altered the basic principlesgoverning the responsibilities of directors, the "pri-mary duty" of a bank director in the 2010 edition is"to protect the bank," while the "primary duty" inthe 2016 edition is "to ensure that the bank operatesin a safe and sound manner." Anyone tracing the arcof bank regulation understands that the referenceto "safety and soundness" implicates longstandingsupervisory standards that can readily provide thebasis for enforcement actions. The increased CMPs,coupled with the expanded matrices, suggest thatless complex institutions will increasingly be held tothe standards previously reserved for more complexinstitutions.

MANAGING THE ENFORCEMENT PROCESSAs referenced in the hypothetical presented above, theCMP process begins with the issuance by the OCC ofa 15-day letter, so called because the recipient ordi-narily is given 15 days to respond to the allegations.Grounded in a supervisory and legal determinationthat a basis exists for taking the recommended action,the 15-day letter is dispatched upon approval by theappropriate SRC.17

Even if the charges seem wholly unjustified, theresponse to the 15-day letter must be approached withthe greatest seriousness, as it is the sole opportunityfor the institution or IAP to present their account ofthe facts and possibly change the course of the actionas initially envisioned by the OCC. A well-handledresponse can persuade the supervisory office to revise

16 Supra note 2.

17 See supra note S.

its recommendation to the SRC, update the examiner-in-charge (EIC) recommendation, recalculate theCMP matrix, and possibly mitigate the nature andamount of potential penalties.

Development of the response must begin by takinga close look at all relevant facts and materials, such asinstitutional records, policies and procedures, exami-nation reports, and other supervisory communicationswith the OCC. It is critically important at this initialstage that the recipient of the 15-day letter, guided byexpert counsel, gauge the likelihood that a violationwould be found should the matter continue throughthe formal OCC appeals process, including the scopeof potential penalties. Penalties could range froman informal supervisory action to a public CMP, anindustry ban, or even a referral for criminal charges.This is the stage at which the institution or IAP canmeet with OCC officials to resolve or contain the mat-ter and, if necessary, manage any potential criminalreferrals that could arise from a finding of willfulness.At this time, IAPs may be asked to submit updatedpersonal financial statements.

While typically it is best for management and di-rectors to present a unified front, an institution mustbe mindful of the potential for conflicting interestsbetween management and directors, given the dif-ferent regulatory standards and penalties that applyto each. If there is a uniformity of interest betweenmanagement and directors, a joint defense can be un-dertaken. Most board protection plans will cover legalfees and costs associated with independent counsel.Institutions are prohibited from indemnifying direc-tors or IAPs who are assessed CMP.

Where the penalty cannot be reduced to a super-visory letter or avoided altogether, the issuance ofa reprimand, assessment of a CMP, or impositionof an industry suspension or ban, independently orin combination, will be made public. At this point,the sanctioned party may request a hearing before

an administrative law judge. After such hearing oc-

curs and submissions from counsel are reviewed, the

judge issues an opinion and a recommendation to the

Comptroller himself, who, after conducting a similar

adjudicatory process, renders a final agency action.

This final agency action then is appealable to a federal

appellate court.

FINAL THOUGHTS ON THE CHANGINGSUPERVISORY CLIMATEThe focus on risk management as a cornerstone of safe

and sound banking has been around for more than a

decade. The OCC views die failure to provide an effec-

tive risk management process as an unsafe and unsound

14 JOURNAL OF TAXATION AND REGULATION OF FINANCIAL INSTITUTIONSWinter 2017 Vol 30 /

No 2

banking practice.'" With the intensifying focus on risk,

especially in the compliance context, it should come as

no surprise that the OCC has taken a leading role in

exercising stricter supervisory scrutiny bolstered by dra-

matically increased CMP assessment levels and lower

"' Sue OCC. Bulletin 2.004-20, "Risk- Management of Nuw,

Expanded, or Modified Bank Products and Services" (May 10,

2004), a vuilable at 11rtps://occ.gov/itews-issuarieesibullerins/21304/

bulletin-2004-20.html.

trigger thresholds. These actions reveal the ()CC's

intention to leverage the punitive impact of letters of

reprimand and (Mrs to deter violations cif law and un-

safe and unsound banking practices at institutions of

all sizes. The increased readiness to use these powerful

enforcement tools should give all financial institutions

and their IAPs renewed motivation to be ever more vigi-

lant in conducting their business and, when called to

account by examiners, ever more conversant with the

nuances and pitfalls cif the supervisory process.


Newly Adopted OCC Standards Raise Institutional ... - Dinsmore

Documents