On October 31, 2017, the Office of the Comptroller of the Currency (OCC) updated its Policies and Procedures Manual (PPM) regarding enforcement actions against banks, federal savings associations, federal branches, and agencies (collectively referred to as "banks"), rescinding and replacing a previous version of the PPM that was issued in 2011. The updated PPM provides internal OCC guidance on selecting the appropriate enforcement action to resolve a bank's deficiencies and promote consistency, while also preserving flexibility for individual circumstances.
The updates to the PPM were in part prompted by certain recommendations made pursuant to an International Peer Review of the OCC's Supervision of Large and Midsize Institutions ("the Review"), which was conducted by senior regulators from countries with well-respected supervisory regimes. The Review was initiated by the OCC in response to criticism that it contributed to the financial crisis by allowing large banks under its supervision to engage in unduly risky practices, with the goal of helping to identify and address supervisory weaknesses of the federal prudential regulators. Recommendations included clarifying organizational mandates to emphasize that the OCC's primary objective is to promote the safety and soundness of banks and the banking system and making improvements to risk identification and reporting by developing controls to better manage the process for handling matters requiring attention (MRAs) or documented supervisory "concerns." The OCC subsequently determined that it could benefit from making similar improvements to its processes regarding enforcement actions.
Consistent with the recommendations made by the Review, the PPM was updated to reflect the following principles, which the OCC deems important in implementing its mission of ensuring safe and sound bank operations:
- Ensure agency-wide consistency of the enforcement action process.
- Reinforce the importance of timely and thorough follow-up and tracking of bank management's corrective actions and milestones to those actions.
- Communicate a bank's compliance or noncompliance with an enforcement action in a consistent format using consistent terminology.
- Convey the relationship between violations, concerns documented in matters requiring attention, and enforcement actions.
- Emphasize the need for examiners to communicate effectively and in a timely manner with the bank's board of directors, the bank's management team, and OCC supervisors.
To achieve the goals and principles set forth, the OCC made several key revisions to the PPM:
MRAs and Enforcement Actions
- The 2011 PPM did not discuss the role of MRAs as a means of requiring a bank's board of directors and management to take timely actions to correct deficient practices or violations (collectively, deficiencies); the revised PPM articulates the relationship between MRAs and enforcement actions.
- The revised PPM notes, for example, that the OCC typically first cites a violation or documents a concern in an MRA through a formal written communication addressing a bank's deficiencies, rather than instituting an enforcement action.
Framework for Imposing Informal and Formal Enforcement Actions
- The 2011 PPM generally described the types of enforcement actions and the differences between informal and formal enforcement actions. For purposes of determining whether an informal or formal enforcement is warranted, the 2011 PPM provided guidance based on the bank's composite CAMELS rating. Conversely, the revised PPM urges examiners to consider certain factors regardless of the composite CAMELS rating, including the bank's risk profile and trends, as well as the nature, extent, and severity of the bank's deficiencies, and the extent of any unsafe or unsound practices.
- The revised PPM also provides stricter guidelines for the minimum enforcement response based on the bank's composite CAMELS rating, in certain instances. For example, the revised PPM states that there always is a presumption for use of a formal enforcement action for a 3-rated bank, and certain factors make such a presumption particularly strong. The revised PPM also clearly states that a bank with a composite CAMELS rating of 1 or 2 may warrant an enforcement action where deficiencies are particularly severe, where previously identified deficiencies were not corrected, or if the OCC is not confident that a bank's board or management is willing or able to correct deficiencies.
Decision Authority
- The 2011 PPM stated that the examiner-in-charge (EIC) was responsible for initially recommending the use of an enforcement action to address problems and concerns identified, and that the assistant deputy comptroller (ADC) could approve the use of certain informal enforcement actions on 1- and 2-rated banks. The 2011 PPM also stated that deputy comptrollers were responsible for deciding most enforcement action recommendations against banks under their supervision, and that those decisions were informed by various supervision review committees (SRCs).
- The revised PPM highlights the role of SRCs in deciding the use of the OCC's enforcement authority, noting that the "supervisory office," which refers to the EIC, ADC, director, associate deputy comptroller (AsDC), or deputy comptroller, together with assigned legal staff, typically is responsible for presenting recommendations regarding enforcement actions to the appropriate committee. In addition, the revised PPM includes a discussion of the Major Matters Supervision Review Committee (MMSRC), which makes enforcement decisions in cases that are of heightened importance because of their visibility, policy sensitivity, involvement of multiple agencies, nature of the issues, or potential systemic impact.
Timeliness of Enforcement Actions
- The 2011 PPM stated the OCC took enforcement actions as soon as practical once the need for such action has been identified, including during an examination when circumstances warranted, and the appropriate decision makers recommended initiating an enforcement action, or modifying an existing enforcement action, or within 15 calendar days following a final Report of Examination that identified deficiencies subject to an enforcement action.
- The revised PPM states that a proposed enforcement action should be presented to the bank within 180 days of the start of a supervisory activity resulting in a formal written communication that (i) states that the bank is experiencing one or more of the significant deficiencies listed in the revised PPM; (ii) assigns a composite CAMELS rating of 3, 4, or 5; (iii) states that the bank is undercapitalized, significantly undercapitalized, or critically undercapitalized; (iv) states that an undercapitalized bank has failed to submit an acceptable capital restoration plan or has failed in some material respect to implement it; or (v) states that the bank is in noncompliance with the safety and soundness guidelines. The revised PPM also requires enforcement action recommendations to be presented to the appropriate SRC within 90 days of the completion of the investigative work.
- Appendix C to the revised PPM provides a more specific outline of the general process and timelines by type of enforcement action.
Follow-up Activities
- The 2011 PPM required the EIC and ADC to perform an on-site assessment of the bank's compliance with the enforcement action within 60 days of the latest due date in the action, and noted that articles requiring cessation of specific activities usually necessitated immediate action by the bank and monitoring by the OCC. The revised PPM layers additional steps, including that the EIC and ADC must assess the bank's compliance with the enforcement action and present the findings and any recommendation to take further action to the appropriate SRC at least every six months while the enforcement action remains outstanding.
- The revised PPM requires examiners to perform the first assessment of a bank's compliance with an enforcement action within 180 days of the date the enforcement action was executed, and at least once within the bank's supervisory cycle while the enforcement action remains outstanding. The revised PPM also introduces the concepts of verification and validation as the central components of the OCC's enforcement action follow-up activity. Verification is the process by which examiners review the bank's documentation and confirm that the board and management completed the required corrective actions. Validation is the process by which examiners confirm the effectiveness and sustainability of corrective actions.
Communicating Enforcement Action Compliance
- The revised PPM introduces a new provision requiring examiners to provide written communication to the bank after completing verification or validation activities, or in response to a bank's submission or request concerning compliance with an enforcement action. The written communications must include a "Compliance with Enforcement Actions" section, a template for and sample of which are provided in appendices to the revised PPM. The section is required to include a write-up for each actionable article that includes a summary of the article's requirements, status of the actions required, additional actions required, if applicable, and commitment, if applicable.
- This provision of the revised PPM also states that examiners must review and respond to submissions by the bank required by the enforcement action within 30 days of receipt or inform the bank in writing of the date that examiners will review the submission. Guidelines for reviewing and responding to requests by the bank for an extension of a time frame or waiver or suspension of provision(s) in the enforcement action are also included. Requests must be submitted in writing with facts to support the request. Extensions must be requested in advance of the corrective action due date.
Terminating an Enforcement Action
- The revised PPM clarifies the limited instances in which an enforcement action may be terminated, and includes a section on escalation, i.e., the process of terminating an existing enforcement action and replacing it with a more comprehensive or severe action. The revised PPM also provides considerations for determining whether to escalate an enforcement action, including (i) the bank's level of compliance with an existing action; (ii) overall condition of the bank; (iii) direction of risk profile; (iv) board and management's ability and willingness to correct deficiencies within an appropriate time frame; (v) extent and severity of the deficiencies; (vi) nature, extent, and severity of new deficiencies identified after issuing the existing action; and (vii) impact or potential impact to bank customers, the Deposit Insurance Fund, or the public.
Documentation in OCC's Supervisory Information System
- The revised PPM requires the supervisory office, which is responsible for maintaining accurate information regarding each enforcement action, to document the enforcement action and all relevant tracking dates in the OCC's supervisory information systems in accordance with established procedures for entering enforcement actions and documenting supervisory activities related to enforcement actions. The revised PPM states that the OCC's supervisory records must accurately reflect the efforts of the board and management to resolve deficiencies and the OCC's supervisory activities or actions to ensure resolution.
- The enforcement action section of the OCC's supervisory information systems must include, among other items, (i) the decision to initiate and terminate the enforcement action, including an SRC memo, when applicable; (ii) the nature and extent of corrective actions, including who completed them and when they were completed; (iii) a conclusion about the effectiveness of the board and management's corrective actions; and (iv) a description of the actions examiners have taken to follow up on management's or the board's corrective actions.