TSL: It seemed like small business loan data collection (Sec. 1071) and concerns over banks’ ability to comply were top concerns.
(Editor's Note: Please see SFNet's January 24 announcement: SFNet Learns the Final Regulations Pertaining to CFPB Section 1071 of Dodd-Frank, Could Prove to be Unduly Burdensome)
Burniston: This is new ground for many institutions and the proposal issued by the CFPB suggested to the industry that this will present not only an implementation challenge, but an analytical challenge.
There are a lot of unknowns here – reporting threshold levels, the data elements that need to be reported, the implementation time period – some of which will be answered when the final rule is issued.
Having those answers will help, but the challenge of implementation is still high. The analytical work needed to understand the data is new ground as well, and the analytical models aren’t in place. Operationalizing these rules in whatever time period the CFPB gives the industry will be challenging.
TSL: What would you say are the key takeaways from this risk Indicator survey?
Burniston: Tracking and keeping current with regulatory change came up as a major theme, as well as proving compliance to regulators and being able to show regulators you have appropriate systems, procedures, and policies in place to stay on top of risk and compliance issues. Actual compliance with regulatory requirements is another area of considerable concern, along with different issues with compliance management and managing compliance through a bank’s or a financial institution’s programs.
As mentioned earlier, the number of new regulations to absorb, implement and manage on an ongoing basis was another area of concern. We also saw respondents were giving considerable attention to interest rate increases, inflation, the possibility of recession, ransomware, tax and their enterprise business risk planning.
TSL: Are there any results that surprised you this year?
Burniston: I'll start with what I didn't see that surprised me. I had expected to see more of our respondents say that they were experiencing more regulatory scrutiny on fair lending examinations, and we didn't see that. We did have 16 percent of respondents indicate more scrutiny, and that was higher than 2021’s number. I expected to see more because the regulatory focus on fair lending is high. We'll have to keep watching that one for 2023.
I expected to see more concern about risk management. We had a total of 50 percent of respondents raising some level of concern about it. That number will probably go up.
Another surprise was the score increase for managing risks across business lines. That was our highest number, 59 percent, in the last four years. To put that into perspective, when we began the survey in 2012, that number was close to 70 percent and had come down and now it popped back up again.
One of the other areas where we saw a big change was in third-party risk management going from 15 percent in 2021 to 26 percent in 2022. These results reflect the growth of partnerships and regulatory attention to the management of third-party relationships.
All the numbers for everything we asked about in terms of increases in compliance management system investments were up from 2021 numbers. Those included investments in strengthening risk management, updating policies and procedures, and managing regulatory content.
The business environmental factors, such as interest rate increases, inflation, and a possible recession, are all weighing heavily on the respondents right now. Lastly, we saw 73 percent of our respondents indicate that they thought a reduction in overall regulatory burden was either somewhat or very unlikely over the next two years.
TSL: Did many of 2021’s noteworthy banking regulation and compliance trends continue into 2022? One area you mentioned in last year’s interview was you expected climate risk management concerns to increase into 2022 but it looked like that came out lower, compared to interest rates, recession and ransomware. Did this surprise you?
Burniston: It did surprise me. I had expected that number would be a little higher in 2022. At the end of 2021 there was a lot of regulatory activity and announcements about regulators looking at this issue. Once there's more clarity from them on the topic, we may see the level of concern rise for next year.
One thing to think about is there's still 50 percent of our respondents indicating that they were giving it at least some or a significant level of attention in their planning efforts. When you look at the distribution of the survey responses, there’s a lot of smaller institutions, and the fact that it is 50 percent is kind of remarkable. But we are seeing that regulators are looking more closely at the issues and working on setting clear expectations for managing climate-related financial risk.
TSL: How can asset-based lenders and factors not only secure their own systems and networks, but ensure that their clients are doing the same? What would you say that they need to be aware of now in 2023?
Burniston: Cybersecurity has been at the top of the list of concerns raised by the survey respondents. A recent FinCEN report that covered 2021 showed that there was roughly $1.2 billion in ransomware payments that year, which was triple the amount from the previous year. I can offer some perspectives from the standpoint of what the regulators are looking for: risk and vulnerability assessments across the enterprise, reporting systems and investments in talent. I’d also reinforce the importance of establishing clear accountability and responsibilities between an IT function, a chief information officer function, and the chief risk officer function so that everybody understands their role. Finally, review, update, and test incident response and business continuity plans.
The Federal Financial Institutions Examination Council (FFIEC) issued an update to the FFIEC Cybersecurity Resource Guide for Financial Institutions in Fall 2022. The 2022 guide lists voluntary programs and actionable initiatives that are designed for or are available to help financial institutions meet their security control objectives and prepare to respond to cyber incidents.
TSL: Most survey respondents reported change management as their organization’s most pressing regulatory compliance challenge over the next 12 months. Can you share more on this trend?
Burniston: It tells us that the ability to absorb the breadth and volume of regulatory change is overwhelming and a formidable challenge no matter what kinds of resources you have available in an institution. The lesson to take away from that is regulatory change doesn't discriminate.
It does raise the question, though, about whether something like differential regulation, where you have different kinds of requirements in place for different types and sizes of institutions, makes sense. But in a lot of cases, these requirements involve consumer protection matters and rights, where consumers should be equally protected whether they're working with a smaller organization or a larger one. So, it shouldn't matter who you're doing business with.
A complicating factor is that part of the implementation process that involves operationalizing regulatory changes. A further complication is that we're in a challenging economic environment.
The other thing that I took away from it is an observation suggesting that institutions are feeling pressure from regulators to ensure that their change management programs are really solid and fully functional.
But I believe you also must consider the several significant regulatory initiatives that are underway right now. One is CRA regulatory modernization, where we're expecting a final rule from the bank regulators as early as the first quarter of 2023. Another is the small business lending data collection requirements that the CFPB will be issuing as a final rule between now and the end of this March. We saw that the respondents are anticipating a lot of challenges arising from implementing this type of regulatory change across the enterprise.
The CRA rule changes and the small business lending data collection regulations could hit at roughly the same time and have an implementation path that's in tandem. Both are very complicated. They are going to require a consolidated effort across an institution to implement.
These have been on the horizon for several years, but they're getting close now to being finalized for banks. The CRA changes are going to affect all of them in some way, whether that is a new evaluations methodology, new things to learn, new data to collect, new exam processes to adjust to and new approaches for working with consumers or communities and partners. The small business lending data collection rules have to sync with the CRA rules so that you don't end up with dual reporting and complications.
With small business lending data collection there is also concern with the implementation of getting systems ready to collect that information and report it, and once you have this information, how to analyze it. I think that's what may be driving much of the concern about regulatory change.
