FINANCIAL SERVICES FLASH REPORT

Agencies Issue Final Stress Test Guidance for Medium-Sized Firms as Called for Under Dodd-Frank

March 21, 2014

On Wednesday, March 5, the Board of Governors of the Federal Reserve System (Board or Federal Reserve), Federal Deposit Insurance Corporation (FDIC) and Office of the Comptroller of the Currency (OCC) issued their final guidance detailing supervisory expectations for stress tests applicable to all bank and savings and loan holding companies, national banks, state member banks, state nonmember banks, federal savings associations, and state-chartered savings associations with total consolidated assets between $10 billion and $50 billion.

As detailed in the agencies’ updated guidance, these institutions are required to conduct annual, company-run stress tests under rules issued by the agencies in October 2012 to implement a provision contained in the Dodd-Frank Wall Street Reform and Consumer Protection Act (DFA).1

This updated guidance is effective April 1, 2014, for institutions regulated by the Federal Reserve, and March 31, 2014, for those institutions regulated by the FDIC and OCC. The agencies' stress test rules are flexible to accommodate different risk profiles, sizes, business mixes, market footprints and organizational complexities. Consistent with this flexibility, the final guidance describes general supervisory expectations for these companies' DFA stress tests. It also provides examples of practices that would be consistent with those expectations.

The final guidance from the Board, FDIC and OCC is similar to earlier guidance issued by the agencies in 2012 and 2013. However, in this final guidance, the agencies have clarified previous guidance, in much more detail, in response to feedback provided by the banking community. The subject matter that most banks with $10 billion to $50 billion in assets should particularly review includes data, modeling and model risk, the use of vendors, and the flexibility banks have to use outside variables and data if it is pertinent to the bank’s risk profile and contributes to a more meaningful stress testing process.

1 “Agencies Issue Final Dodd-Frank Act Stress Test Guidance for Medium-Sized Firms,” March 5, 2014, www.federalreserve.gov/newsevents/press/bcreg/20140305a.htm. The content herein represents a summary of the regulatory release and our perspectives. This Flash Report does not include mention or summary of the industry comments disclosed by the regulators. Industry comments represented 23 of the 68 pages in the release.

Protiviti | 2

Overview of the Final Guidance This new release builds upon the existing May 2012 guidance and provides banks with clarifications and expectations as they pertain to seven distinct aspects of DFA stress testing. The guidance is structured as follows:

• DFA Stress Test Timelines

• Scenarios

• Methodologies and Practices

• Estimating the Potential Impact on Capital

• Controls, Oversight and Documentation

• Regulatory Reporting

• Publicly Disclosing Results

DFA Stress Test Timelines Banks will continue to generate stress test results over a nine-quarter time horizon with the financial as of date for actuals (the starting point to base forecasts on) being as of September 30. Specifically with respect to the allowance for loan and lease losses (ALLL) portion of stress testing, in order to generate a meaningful estimate of the ALLL, banks would have to forecast four quarters beyond the nine-quarter cycle. From our experience, this was not always the practice at many medium-sized banks, but the regulators are now making clear that banks are expected to forecast beyond the DFA-defined period.

Scenarios The regulators are providing additional guidance on the use of macroeconomic variables:

• Banks do not need to utilize all the variables provided by the regulators.

• Banks can use variables outside of those provided if they are more meaningful to them, provided that the use of the variables is well supported and documented. Additionally, the stress displayed by these outside variables should be consistent with the economic or market stress described in the regulatory narrative. It is common for the larger money-center banks to develop their own custom variables. For perspective, this process is very involved – it can take many weeks to generate the variables, review their consistency with the scenarios, and vet the forecasted paths. While this does enhance accuracy, it can materially add to the complexity of a bank’s DFA stress testing process.

• Banks can engage with third-party vendors to assist in the development of these variables provided that the banks understand the analysis used to create the variables, understand any limitations with the analysis or the variables, and are able to challenge the key assumptions used in generating those variables.

• Banks can forecast beyond the nine quarters if it is necessary for their stress testing processes.

Protiviti | 3

Methodologies and Practices The guidance outlines regulator expectations with respect to forecasting pre-provision net revenue (PPNR), provision expense (losses), and net income toward meaningful capital management and decision-making via quality information. Embedded within a bank’s stress testing processes should be an open environment that facilitates the ability for management and analysts alike to challenge data, assumptions, models and results.

• Management information systems (MIS) should be adequate. To the extent data is lacking, alternative data sources are acceptable as long as the data is representative of other banks with similar risk profiles and complexity. Also, if a bank must use industry or vendor data, it should also develop strategies to accumulate the necessary data to improve its forecasting capabilities over time. This particular guidance is critical for banks in the $10 billion to $50 billion asset range. Typically, existing bank information systems have been structured around generally simpler credit data to support periodic reporting, loan review, and the allowance process. However, it is common for banks of this size to be in active growth cycles either through organic growth or asset/bank acquisition. MIS and historical data can often be a patchwork of systems that might not be optimal for use in the more complex data requirements for stress testing.

• Data segmentation should be at a sufficient level to capture the risks inherent in the bank’s balance sheet. Enhanced views would best facilitate management analysis and discussion. These views could include elements such as product, market segment, vintage, industry, geographic unit, etc. At a minimum, the segmentation should align with the structure in the DFA stress testing forms banks must complete. This is also key guidance for this population of banks. Due to the aforementioned balance sheet growth rates observed for banks in this category, the lack of “through-the-cycle” internal credit and loss data is a common challenge, and one that generally drives banks to use vendor solutions as a result.

• Effective model risk management practices are a must. Models used in DFA stress testing cycles should be validated. If the models cannot be validated before they are used to generate results submitted to the regulators, a) management must have controls in place so that the output from these models is not treated the same as fully compliant models, b) management must have documented instances when results are derived from non-validated models, and c) management must understand that the use of non-validated models is temporary.

• Vendor models are acceptable. However, management must demonstrate adequate familiarity of those models’ limitations, assumptions and functionality.

• Qualitative adjustments to results are acceptable; however, those adjustments must be grounded in a thoughtful process that includes well-supported rationale/analysis, challenges and documentation, and they should be applied consistently.

• Banks should have credible loss estimation practices. Regulators acknowledge there is no one-size-fits-all and may consider a single loss methodology applied to the entire loan portfolio as insufficient. Loss forecasting should be aligned with the bank’s size and complexity, and include adequate data and forecasting segmentation. The key is for banks to utilize a process that yields reasonable results. Management has the leeway to select differing forecasting approaches by portfolio or by scenario as long as they are sufficiently calibrated to the severity of each scenario.

• The PPNR should be forecasted at least at the level reported in the DFA stress testing form. Additional granularity is suggested as firms increase in size or become

Protiviti | 4

more complex. Differing approaches can be utilized to forecast, based on internal data, industry data or relationships to macroeconomic variables. Regardless of the approach, management should ensure it is incorporating data that looks “through-the-cycle” in order to capture reasonable sensitivities to economic or market shocks.

• Many firms in the $10-50 billion asset size spectrum have experienced either material organic growth or growth through acquisition in recent history. Consequently, internal historical data may not be of adequate quality for PPNR or loss forecasting. Additionally, for banks within this range, the approach can be commensurate with the size and complexity of the organization. This may allow for less sophisticated approaches in areas with less materiality. In such cases, management should generally make conservative assumptions and adjustments to its forecast processes.

• Impacts to the forecasted balance sheet need to be linked with impacts to PPNR and losses. The balance sheet is a primary driver of financial results. Forecasts should not be developed in isolation and management needs to maintain linkages between all aspects of a bank’s financial condition that are observed in the baseline forecast.

• The materiality of an exposure should drive the rigor employed in forecasting that item. Regardless of the precise approach, proper documentation should exist.

• Due to their unique risks and capital treatment, taxes and deferred tax assets should be forecasted with the level of rigor commensurate with their materiality and utilize the same assumptions used in the PPNR and the balance sheet forecast. This will likely continue to be an area of higher scrutiny for the regulators.

Estimating the Potential Impact on Capital This section includes guidance on the capital actions banks and holding companies are required to consider within their stress test results. Essentially, dividends and their impact to capital ratios need to be considered while capital issuances (common or preferred) should not be part of the stress testing submission. Essentially, the regulators are trying to reinforce a scenario in which the tools institutions would have available to boost capital would be limited. Moreover, any cash dividend payments need to be consistent with the bank’s internal policies and risk appetite. Additionally, any capital actions or significant merger and acquisition activity needs to be well documented and included in the firm’s results submission narrative. This underscores the need for adequate documentation that is honed to the particular risks and practices for your bank.

Controls, Oversight and Documentation The regulators continue to request documentation around not just stress test results but also the process that supports and facilitates stress testing. This section reiterates much of what was provided as guidance from May 2012 but attempts to better clarify the differences in engagement of the board versus senior management related to review and oversight of stress testing practices. The guidance continues to address the need of formal policies and procedures, which are to be reviewed with the board (or committee thereof) at least annually. This guidance notes the need to ensure stress test requirements are also incorporated into other company policies and procedures as applicable (e.g., model risk policy). Senior management owns the responsibility for establishing and validating consistent and repeatable practices that demonstrate control, governance and transparency into their stress testing activities. There should be clear assignment of roles and responsibilities, and proof of compliance with policies and procedures, which underscores the need for the proper level of

Protiviti | 5

engagement from audit and compliance partners. As senior management takes an implementation and execution role, the board provides a broader oversight function to confirm requirements are being met as expected. At a minimum, documentation should include methodologies used in stress tests, data types, key assumptions, stress test results, DFA stress test risks and exposures covered, and model documentation. It should be noted that the level and detail of documentation should not be underestimated.

Regulatory Reporting The guidance provides additional clarification around the quantitative and qualitative information that is to be submitted to supervisors by March 31 based on the format prescribed. This includes:

• Quantitative: properties of losses, PPNR, balance sheet, risk-weighted assets, ALLL, and capital on a quarterly basis.

• Qualitative: description of types of risks in stress tests, description of methodology used, and explanation of most significant causes for changes in capital ratios.

The section also reminds banks to refer to agency instructions that are published with reporting templates.

Publicly Disclosing Results This section includes guidance on the timing and procedure for publishing public disclosures. Information must be disclosed between June 15 and June 30, 2015, using data as of September 30, 2014. This requirement extends to any subsidiary subject to DFA testing and can be satisfied by including a summary of results within the parent company’s public disclosure and that is reasonably accessible to the public (e.g., company website).

Public disclosures will be for the Supervisory Severely Adverse scenario only and must cover the following topic areas:

• Description of types of risks in stress test

• Summary of methodology used

• Estimates of: aggregate losses, PPNR, PLLL, net income, pro-forma capital ratios and any other capital ratio specified by Federal regulators

• Explanation of the most significant changes in capital ratios

The guidance does clarify the differences in the public disclosure requirements between bank holding companies and savings and loan holding companies vs. banks and thrifts:

• Bank holding companies and savings and loan holding companies: include information on stress tests conducted by subsidiaries subject to DFA stress tests.

• Banks and thrifts: must disclose when parent company disclosure includes the required information on the bank or thrift’s stress test results, unless the company’s primary regulator determines the disclosure at the holding company level does not adequately capture potential impact of the scenarios on the capital of the company.

Finally, the guidance also notes that the agencies will make a greater effort in communicating to the public the hypothetical nature of the stress test scenarios.

Protiviti | 6

Important Takeaways Many elements of the new guidance are similar or the same to what Comprehensive Capital Analysis and Review institutions have already been doing for several years. This further illustrates that the bar has been raised, and will continue to be raised for institutions with $10 billion to $50 billion in assets.

Credit risk is generally going to be the primary loss driver in a stress scenario for banks in this asset size range. The guidance is peppered with references to the need for a bank’s loss forecasting capabilities and allowance forecasting processes to be adequate to capture the risk in that firm. As noted earlier, many firms in this population struggle with proper data segmentation and loss identification at a transactional level sufficient for scenario forecasting. Given the new guidance, regulators could start taking a closer look at the adequacy of a firm’s allowance methodology for both baseline and stress scenarios.

Clarification on the use of vendors for data, modeling and variables is helpful. The use of vendors is particularly unique to banks in the $10 billion to $50 billion asset size range, which struggle with having sufficient internal resources to develop a compliant stress testing process versus utilizing vendor resources.

Conclusion Stress testing is just one component of “strong” risk management. Investments to-date in resources, time, and money will continue to be needed as regulators expect banks to evolve their stress testing frameworks. The push will be there for greater accuracy, greater flexibility, enhanced reporting, and adequate documentation. Banks are encouraged by the regulators to ensure that all material risks and vulnerabilities, such as liquidity risk, operational risk, market risk, etc., are adequately measured and monitored. To be meaningful, stress testing results need to be actionable and integrated into the bank’s overall risk appetite framework and measured/monitored using strong management information systems. This sort of integrated process is the end game and should help bankers make better, more informed decisions in an efficient matter to keep up with the speed at which markets, economics and politics change the risk dynamics for a bank.

© 2014 Protiviti Inc. An Equal Opportunity Employer M/F/D/V. Protiviti is not licensed or registered as a public accounting firm and does not issue opinions on financial statements or offer attestation services.

About Protiviti Protiviti (www.protiviti.com) is a global consulting firm that helps companies solve problems in finance, technology, operations, governance, risk and internal audit, and has served more than 35 percent of FORTUNE 1000® and FORTUNE Global 500® companies. Protiviti and its independently owned Member Firms serve clients through a network of more than 70 locations in over 20 countries. The firm also works with smaller, growing companies, including those looking to go public, as well as with government agencies.

Protiviti is a wholly owned subsidiary of Robert Half (NYSE: RHI). Founded in 1948, Robert Half is a member of the S&P 500 index.

Contacts Carol Beaumier Executive Vice President – Global Industry Programs Global Leader – Financial Services Practice +1.212.603.8337 carol.beaumier@protiviti.com Cory Gunderson Managing Director – U.S. Financial Services Industry Practice Leader Global Leader – Risk & Compliance Solutions +1.212.708.6313 cory.gunderson@protiviti.com Shaheen Dil, Ph.D. Managing Director and Practice Leader – Model Risk and Capital Management +1.212.603.8378 shaheen.dil@protiviti.com Charlie Anderson Managing Director +1.312.364.4922 charlie.anderson@protiviti.com