“Complacency” on OCC’s watch list

With the industry apparently continuing to ride the relatively benign economic conditions of the last seven years, one of the chief credit worries of the Comptroller’s Office is that both bankers and examiners will get too used to this environment.

In the agency’s latest Semiannual Risk Perspective Report, the word “complacency” appears several times, and OCC staff taking part in a press meeting about the report with Comptroller Joseph Otting continued the usage.

“Complacency is clearly at the top of our minds,” a senior staff member said at the Jan. 18 meeting. “A former Comptroller used to say that ‘the worst loans are made in the best of times,’ and we’ve been going through some pretty good times.” (Policy at these briefings is that only the Comptroller is to be identified by name in subsequent articles, though several top officials speak and take questions.)

This was a key takeaway from a press session that looked to credit and operational risks, including citation of a rising level of cyberrisk and Otting’s initial reaction to a critical letter from a group of Senate Banking Committee Democrats.

Reviewing lending risk factors

The agency had no blinking red lights to show—maybe a yellow or two—which is very much the point. As the report states, there’s no tinge of crimson, only the risk of it:

“Asset quality remains strong, and overall underwriting is acceptable. Nonetheless, the credit environment continues to be influenced by strong competition, tighter spreads, and slowing loan growth. These factors are driving incremental easing in underwriting practices and increasing concentrations in select loan portfolios—leading to heightened risk if the economy weakness or markets tighten quickly.”

“Vigilance”—OCC’s term—will be necessary to make sure bankers don’t allow good conditions to dull their radar. A close watch must be kept on underwriting, an official said during the briefing. This includes knowing about exceptions to loan policy, understanding those exceptions, and knowing how the banks’ portfolio would perform if conditions deteriorate.

“We look at the underwriting during almost every exam we go into,” the official said.

Where there has been easing, OCC believes it has chiefly been to meet competition and to accommodate customers. Banks, especially mid-sized and community banks, face increased pressure on margins and thus are more willing to soften terms.

“The vast majority of banks continue to maintain satisfactory underwriting policies and practices, and operate within bank-approved tolerances,” the report stated. The report also indicated that OCC examiners find that most banks continue to lend within their established credit risk appetites.

Eye out for weak spots

An official said one of OCC’s tasks is keeping an eye on potential imbalances in the banking system. These can evolve into risks that unfold in unexpected ways, he added.

Increasing weakness is developing in certain lending areas. A notable one is agricultural credit, where farmers have gone into greater debt in recent years, reflecting poor results, and the need to cover expenses.

Debt levels have begun to approach those seen in the 1980s. However, the report noted that prevailing interest rates are much lower on the debt than during the 1980s ag lending crisis. In addition, the report points out that a much greater portion of ag debt is secured by land than during the bust.

More broadly, in urging bankers to avoid complacency in lending, the report noted that banks face strong competition for both commercial and retail lending products from both banks and nonbanks.

Compounding the risks of easing, collateral values are something OCC is monitoring.

“Valuations for many asset classes are at or near historical highs,” the report said. “There is growing concern by some market participants that valuations for some asset classes are growing faster than can be supported by underlying fundamental drivers.”

What impact from fintech lending?

While the pressures of competition were dwelled on in the report and the press conference, an interesting wrinkle came in answer to a question regarding what pressures fintech lenders to both small business and personal borrowers were placing on banks.

An OCC official downplayed the competitive impact of fintech lenders.

“Overall, competition on the business side is fairly limited,” he said. “There is some competition on the consumer side. But the overall volume of bank lending far exceeds the fintechs.”

The official added that for some small banks fintech players are partners. The fintechs give them a source of additional loan volume. Comptroller Otting pointed out that such partnerships can help banks build up loans in communities where they don’t have a channel.

Another credit area being monitored is commercial real estate lending, which OCC said remains a key growth factor in small banks. OCC is monitoring CRE growth in both these banks and mid-size institutions.

Cyberrisks seen increasing

Otting has made it clear in this and another press meeting that cybersecurity issues are high on his list of concerns.

“Cyberrisk is the one that keeps executives and regulators up at night,” he said. He characterized the exposure as an “80/20” challenge.

By that he meant that 80% of exposure can be handled by strict attention to hardware vulnerabilities and software patch policies and similar preventative measures.

“Those are things we can go in and analyze” in exams, he explained.

However, the other 20%, he said, represents “the unknown”—the source of cyberrisk that isn’t foretold. There, he said, “we assess their ability to respond” to the unexpected.

While officials could not provide specific numbers, OCC said that cyberrisks are rising.

“We have more bad actors with more technology willing to do more bad things,” one official said.

Asked about the motivations of those making cyber attacks on the industry, the official commented that, “each of the attackers has their own reason for attacking. But for most it’s about money. They want to monetize whatever they get.” This could be customer data or otherwise that can be turned into a criminal tool or sold.

“There are more sophisticated actors out there,” added the official, “but they have a different objective altogether.” He said they couldn’t be grouped into neat categories.

Commons causes referred to in the report: Banks can face exposures due to employee errors, such as being “phished,” or through “watering holes,”—infections to corporate systems made as a result of visiting tainted websites that targeted employees frequent.

Another source of risk to be aware of are third parties that provide tech services at some level to the bank. These could serve as a unknowing conduit for an attack. The report also discussed the risks posed overall by third-party relationships.

Additional risks cited

OCC’s report covers many types of risks. Two more worth citing:

• Compliance management. “Bank internal quality assurance and risk assessment processes for supporting compliance management systems and the ability to maintain sufficient compliance expertise to manage the additional risks and complexities remain a concern,” the report stated. “… In some banks these systems have not kept pace with the increasing complexity of the regulatory and risk environments in which they operate.”

• Sales practices. The report cited as an area being monitored “weaknesses in the governance of product sales, delivery, and service results [that] result in elevated levels of operational risk for some banks.”

The issue’s status reflected a downgrade in perceived risk, which was questioned during the meeting.

“We’ve gotten comfortable with the level of risk,” said Otting, “but we continue to work through the industry to understand that. It’s become a focus area in our examinations.”

One reporter cited a Jan. 17 letter to Otting from six Senate Banking Committee Democrats alleging that the agency has not followed up on the recommendations made in an internal review concerning the time taken to detect sales practice issues at Wells Fargo.

Otting said that he had been “disturbed” by the letter. He called the published letter “reckless” in its portraying things as it had “without the information to make an informed statement.”

Otting said OCC was preparing a response which would be released soon.

“I would hope that the future dialog would be fact-based,” said Otting. The Comptroller declined to be more specific at the time of the press meeting.

Download OCC's Semiannual Risk Perspective report