Earlier this week, the Federal Reserve issued a Supervision and Regulation Letter regarding the “Creation of Novel Activities Supervision Program” (SR 23-7). The letter informs all banking organizations subject to supervision by the Fed, including those with assets of $10B or less, that it has established an enhanced program to “monitor and examine novel activities conducted by supervised banking organizations” that will “work within existing supervisory portfolios and alongside existing supervisory teams.”
Novel activities specifically mentioned by the Fed include hot-button issues such as “crypto-asset related activities” and the provision of banking services to fintechs, but also include “projects that use distributed ledger technology with the potential for significant impact on the financial system” as well as complex partnerships with non-banks that involve “technologies like application programming interfaces (“APIs”) that provide automated access to the bank’s infrastructure.” However, the scope of novel activities now subject to enhanced supervision is not limited to these specific areas, but rather extends generally to “financial innovation supported by new technologies” that can “lead to rapid change in individual banks in the financial system and generate novel manifestations of risks that can materially impact the safety and soundness of banking organizations.” Banking organizations whose novel activities will be subject to examination will be notified in writing.
Practically speaking, this announcement by the Fed puts all supervised banks on notice that they can and should expect to be questioned regarding activities that are considered novel. In particular, banking organizations that provide banking support to cryptocurrency companies of all kinds or that have significant involvement with innovative fintech products and services should expect imminent inquiries from the Fed, in addition to whatever inquiries may have been posed already by other prudential regulators. Even the biggest banks should take notice because while most have limited their involvement in crypto-asset related activities, many have more broadly engaged with fintechs and incorporated API-based third-party services into their everyday retail and commercial offerings. The best strategy to ensure an optimal outcome in these kinds of supervisory exams is to take all of the following steps: 1) identify all products, services and relationships that could be deemed to include “novel activities”; 2) review, update and correct all related risk assessments such that perceived risks are either validated or debunked through experience with the novel activity and appropriate controls have been clearly documented to address validated risks; 3) examine consumer complaints related to all novel activities, even if such consumer complaints are received by the fintech or cryptocurrency company and not the bank; and 4) create, review or update the banking organization’s strategy and perspective regarding engagement in novel activities so that it can be presented cohesively to the Fed.