By Daniel Meade

Partner | Financial Regulation

Last week, just after we went to press, the Office of the Comptroller of the Currency (“OCC”) released its Bank Supervision Operating Plan for Fiscal Year 2023. 

The Operating Plan sets out the OCC’s supervision priorities and objectives for the fiscal year, which began on October 1. Those priorities and objectives are: 

• Strategic and operational planning. The Operating Plan sums up this item as safety and soundness and fairness, noting that “examiners should focus on strategic and operational planning to assess whether banks maintain stable financial positions, especially regarding capital, allowance for credit losses, management of net interest margins, liquidity, and earnings.”
• Operational resiliency and cybersecurity. The Operating Plan stated: “[O]perational resilience examinations should consider incident response and business resumption practices, with explicit evaluation of data backup and recovery capabilities. Information and cybersecurity examinations should focus on fundamental controls to identify, detect, and prevent threats and vulnerabilities; such controls include authentication, access controls segmentation, patch management, and end-of-life programs.”
• Third parties and related concentrations. The Operating Plan notes that examiners should monitor banks’ risk-management governance of their third-party relationships, and highlighted fintech relationships. 
• Credit risk management. The OCC noted that credit losses have been at historical lows but that banks need to be prepared for a changing credit risk environment. The Operating Plan went on to state that “[r]isk-based examination work should focus on new products, areas of highest growth, or portfolios that represent concentrations.”    
• Allowances for credit losses. The Operating Plan noted: “[As] banks finalize adoption of the current expected credit losses accounting standard according to promulgated schedules, examiners should assess the effectiveness of the implementation and ACL methodology at estimating lifetime expected losses.”
• Interest rate risk. The Operating Plan noted a focus on effective asset and liability risk management practices. 
• Liquidity risk management. “[B]anking system liquidity remains strong,” according to the Operating Plan, “but sharp rate increases could adversely affect banks’ deposit volume or mix and reduce liquidity from investment portfolio pledging or sales because of unrealized losses.”
• Consumer compliance. The Operating Plan notes that examiners should focus on compliance management systems, in addition to statutory-required assessment.    
• Bank Secrecy Act. In addition to OFAC compliance review, the Operating Plan encourages examiners to “continue to assess bank change management plans for implementing changes to existing BSA/AML compliance programs that will be necessary to implement the requirements of the Anti-Money Laundering Act of 2020.” 
• Fair lending. The Operating Plan stated: “[F]air lending supervision activities should consider the full life cycle of credit products, such as mortgages, and the potential for mortgage lending discrimination resulting from appraisal bias or discriminatory property evaluations.”
• Community Reinvestment Act. The Operating Plan reminded examiners of the 2020 rescission of the previous CRA rule released by the OCC so that the OCC rule is in line with the 1995 Interagency rule. Examiners are also reminded that a final CRA rule could be released by the OCC, Federal Reserve and FDIC in FY 2023.  
• New products and services. The Operating Plan notes that examiners should review bank management’s processes for the review of new product opportunities, and especially noted payments products and fintech and digital assets.
• Climate-related financial risks. The Operating Plan stated that “[d]uring FY 2023, the agency will continue information gathering efforts and plan on conducting additional industry outreach. At the largest banks, examiners will monitor the development of climate-related financial risk frameworks and will engage with bank management to understand the challenges that banks face in this effort, such as data and metrics, governance and oversight, policies, procedures, and limits, strategic planning, scenario analysis capabilities and techniques, and incorporation of the frameworks into current bank risk management processes.”

The Operating Plan offers some insights into what OCC examiners will be focusing on, but nothing in the plan should come as a surprise for anyone following Acting Comptroller Hsu’s recent speeches.