CONFIDENTIAL Restricted FR 2009 New York Operations Review Internal Team Scope Memorandum - Do not share outside the team FINAL Ver 11.16.09 District Overview The Second District's supervisory portfolio is comprised of twenty-four 5MBs, 133 top-tier bank holding companies, and ninety-three foreign banking organizations (FBOs). 1 In terms of assets supervised, the Second District ranks first in the Federal Reserve System with respect to BHCs (47.5 percent of System BHC assets), first with respect to FBOs (60 percent of System FBO assets), and second with respect to 5MBs (25.8 percent of System 5MB assets). • As of June 30, 2009, five (20.8 percent) of the District's 5MBs were rated less-thansatisfactory (four institutions are 3-rated and the fifth is 4-rated), with an additional five banks identified for possible downgrade by SR-SABR, bringing the total number of 5MBs on the Watch List to ten, equivalent to 41.6 percent of all District 5MBs. This is twice the proportion compared to a year ago however; the District still ranks lowest in the System by this statistic. • Also as of June 30, 2009, twenty-five of the District's top-tier BHCs were rated less-thansatisfactory, equivalent to 19.1 percent of all District BHCs. In contrast to the Watch List statistic cited above, this statistic ranks the District third-highest in the System (after San Francisco at 35.3 percent and Atlanta at 19.8 percent). With respect to the level of problem and watch-listed supervised institutions, the Second District is dealing with a relatively small number of troubled institutions compared to other Districts, but one of these, Citigroup, poses dramatic systemic risk and holds the vast majority of assets of the twenty-five Second District holding companies that are rated less-than-satisfactory ($l.85 trillion in Citigroup, of $l.93 trillion total). Bank Supervision Group Senior Management Team William Rutledge is Executive Vice President in charge of the Bank Supervision Group. His direct reports and their sections are listed below: • Brian Peters, SVP of Risk Management; • Art Angulo, SVP of Relationship Management; • Zahra El-Mekkawy, SVP of Resource and Logistics Management; • Marc Saidenberg, SVP of Financial Sector Policy and Analysis; and • Michael Alix, SVP and Senior Advisor. These numbers represent increases in supervisory responsibility compared to just a year ago, with two additional S1.1Bs, five additional BRCs, and three additional FBOs. 1 The formal count of ninety-three FBO institutions is based on a definition of FBO that considers which Reserve Bank has the lead supervisory responsibility within the Federal Reserve System. Due however to the presence within the Second District of many FBO-related entities for which supervisory responsibility is shared with other Districts, the Reserve Bank's supervision department performs supervisory activities for a larger nurn ber of FBO entities in the form of foreign branches, foreign agencies, Edge and agreement corporations, and representative offices. FCIC-090804 CONFIDENTIAL Restricted FR Staffing In September 2009, the Bank Supervision Group released a revised organizational chart; SVP Sarah Dahlgren and her supervisory team for AIG Relationship Monitoring were transferred from Supervision to Credit, Investment, and Payment Risk, as were staff associated with the Citi Asset Guarantee Program. The District's staffing budget has expanded significantly for the years 2009-2010, with almost all new staff being hired in 2009. The budget impact in 2010 is limited to the full-year effect of the 2009 hires. Overall staffing within the Bank Supervision Group is increasing by 96.5 ANP, equivalent to an 18.2% increase; the new staff are concentrated in Risk Management (55.9 ANP, an increase of 24.4%) and Relationship Management (44.3 ANP, an increase of26.9%). 2 Although the department has well-established programs to orient new staff, the current inflow is unprecedented and raises the level of operational risk significantly as management works to integrate the new hires effectively into the supervision program. Many of the new staff bring valuable industry experience, but it can take time to develop a supervisory perspective within such individuals. The problem is likely more acute in the case of the FRB New York because the Bank Supervision Group has a number of key officers and managers who do not have a supervisory background. Risk Assessment The supervision program level of risk is considered high and the trend is increasing; the trend is increasing for reputational, strategic, and operational risks, stable-to-increasing for portfolio risk, and stable for environmental risk. • • Reputation risk considers the effectiveness of the Reserve Bank's processes and systems to identify institutions or activities that posed reputational risk to the System and to the Reserve Bank. This risk category also considers the Reserve Bank's ability to identify emerging trends and to effect changes in supervisory processes necessary to effect change. o The New York Reserve Bank's reputation risk is high in view of the concentration of LFI banking companies for which the New York Reserve Bank has supervisory responsibility, and in recognition of its role to perform and support supervision of the largest and most complicated BHCs through the work of the LFI Committee. o Opportunities for improvement identified through the various "Lessons Learned" indicate that processes for mitigating reputational risk may have not been as robust as they should have been and therefore contribute to rating reputational risk as high. Strategic Risk considers the Reserve Bank's ability to plan for and adapt to change, the adequacy of succession planning, and the adequacy of business continuity planning. 2 In contrast staffing was slightly reduced or unchanged in secondary areas such as Financial Sector Policy and Analysis and Resource and Logistics Management. From outside the Bank Supervision Group, other areas that charge to Supervision also are increasing staffing, mostly Research and Statistics 2 FCIC-090805 CONFIDENTIAL Restricted FR o • • Strategic risk is high and increasing as Congress has placed the Federal Reserve under close scrutiny while it evaluates our supervisory role during negotiations on regulatory reform; how the FRB New York supervision function implements "lessons learned" and performs in the future will be critically important determinants of the Federal Reserve's success as a bank supervisor. The overall level of risk is somewhat mitigated by the strength of New York's business continuity planning as New York's efforts in this area are considered strong and staff are involved in crisis management efforts on a number of levels. Operational risk considers such factors as compliance with System guidance, policies, and procedures, the effectiveness of communication and coordination internally and with Board staff, and other regulatory bodies. Other considerations include, material changes in organization or operations of the supervision department or the Reserve Bank, the number of branches where supervision activities are dispersed across several offices, the quality of the information systems to support the supervision activities, the effectiveness of supervisory planning and allocation, the experience and depth of the management team, the sufficiency of staffing levels and expertise, and the ability to recruit and retain staff. Overall, operational risk as well as the other risks discussed can be mitigated by the adequacy and effectiveness of the quality management functions, particularly the quality assurance function. o Operational risk is considered high but stable for several reasons. Management and staff have been at the center of the banking and financial industry crisis for two years now and have had to react repeatedly to unprecedented demands on the supervision function. o One important aspect of operational risk is how to balance resource demands between bank supervision and financial stability oversight, two related but distinct activities; more specifically, the risk is whether, over time, neglecting core bank examination and supervision activities would actually raise the degree of risk to financial stability. In 2008 Board staff were concerned that management of the Bank Supervision Group was directing more resources toward financial stability oversight and less resources toward core supervision, with the result that the Group's execution of the delegated bank supervision function did not meet the System's documented procedures and requirements. Operational risk is also high and rising due to strains placed on supervisory resources given deterioration in the portfolio. o New York's quality assurance efforts are considered satisfactory, although the effectiveness of the function has not been reviewed since the last operations review. This review will assess the work of the quality assurance through the review of the core supervisory processes. Portfolio risk considers the financial condition of the District's institutional portfolio, the trends in problem institutions and the institutions under enforcement actions, the size, complexity, and systemic importance of the institutions supervised. This risk category also considers portfolio concentrations, growth trends in institutions supervised and the number of de novo institution. o Portfolio risk for the New York is high primarily because the New York portfolio includes the largest number of systemically important banking organization is the System. In addition, New York has responsibility for four of the new BHCs, including Goldman Sacs, Morgan Stanley, ICE US Trust LLC, and American Express Co. However, as discussed 3 FCIC-090806 CONFIDENTIAL Restricted FR above the level of problem institutions in the District is lower than that seen in other Districts. There also seems to be some signs of stabilizing insofar as the financial and liquidity crises that effectively shut down capital and credit markets during 2008 and part of 2009 have eased, and aggregate BHC liquidity ratios have improved in the last twelve 3 months. • Environmental risk considers the risk posed to the Reserve Bank's portfolio by the regional economic conditions and the market competition mitigated by the Reserve Bank's effective use of surveillance systems and market feedback in the identification of emerging market trends and Issues. o The District's Environmental risk is high given issues related to the recent economic crisis as identified in the various "Lessons Learned." However, based on Second District economic indicators from the Beige Book environment risk posed by the economic conditions may be stabilizing. Overall, we view the risk of the New York supervisory function to be high and stable to increasing, depending the particular risk category. The operations review team will assist in validating the assessment of Supervision Program risk, mitigating factors, and the direction of trends. The table below summarizes the overall risk of the Reserve Bank supervision department for risk discussed above. Risk Assessment Summary Type of Risk Reputational Strategic Operational Portfolio Environmental Composite Low Level of Risk Medium Hi~h X X X X X X Trend Increasing Increasing Stable StablelIncreasing Stable Increasing Scope of Review The scope of this review will focus on core supervision activities tailored to the risks identified for this Reserve Bank. Key areas offocus include: • • • 3 Enterprise risk management - Is the Reserve Bank critically assessing and holding institutions to a high standard based on their risk profile, escalating concerns as appropriate, and actively monitoring and following up? Also, is the Reserve Bank affecting improvements/change in regards to the critical thought process and overall systems for enterprise risk management?; Implementation of "lessons learned" from both internal and external studies performed during the past two years; How is the supervision program addressing ongoing weaknesses in condition and performance for the financial institutions within the Second District's portfolio? Source: Board Surveillance, Quarterly Report of Top Tier BRCs (Y9C and SP filers table, pAl. 4 FCIC-090807 CONFIDENTIAL Restricted FR • • • • • Particularly for the largest institutions, what progress has the Reserve Bank made to implement the supervisory plans for 2009 and how are the staff positioned to execute the supervisory plans for 2010? New supervisory responsibilities associated with new entities specifically Goldman Sachs and Morgan Stanley; Resolution of recommendations from the prior operations review; Communication of examinationlinspections findings; and On-boarding of the large number of newly hired staff into its supervision program The effectiveness of supervisory processes should be assessed for each area reviewed using established operations review procedures. The team should evaluate: • • • • • • • • • Institutional risk assessments; Implementation of continuous monitoring in large and regional financial institutions; Examination scoping and planning; Documentation of review and examination findings in support of supervisory decisions; Vetting processes; Communication of supervisory issues to the banking organization; Follow-up activities; Implementation of System Guidance, specifically: o SR 08-091CA 08-12 Consolidated Supervision ofBank Holding Companies and the Combined u.s. Operations ofForeign Banking Organizations and SR 08-8/CA 08-ll Compliance Risk Management Programs and Oversight at Large Banking Organizations with Complex Compliance Profiles; o AD 09-4 Implementation of the Federal Reserve Safety-and-Soundness Supervision Priorities Framework (please review the recent NY QA review); o SR 08-1 Communication ofExam inationlInspection Findings (please review the recent NY QA review); and o SR 05-27 Responsible Reserve Bank and Inter-District Coordination for the FBO program. Quality control and assurance work products in conjunction with specifics above. Discussion of Areas of Specific Focus Implementation of Supervisory Plans in 2009 and 2010 The Board's 2008 performance review of the New York supervision department noted that during 2009 it will be critical that the CPC teams develop comprehensive risk assessments and supervisory plans, and that these plans are implemented. During your review of the files, please evaluate the effectiveness of the Reserve Bank staff's development and implementation of the 2009 risk assessments and supervisory plans. In addition, please evaluate the development and plans for implementation for the 2010 supervisory plans. Clear and timely communication of supervisory concerns, and timely, effective follow-up In past Reserve Bank, annual evaluations Board staff have periodically cited concerns about the clarity and timeliness with which supervisory issues are communicated, and the timeliness of effective follow5 FCIC-090808 CONFIDENTIAL Restricted FR up. The team should determine whether supervision staff appropriately identify and communicate supervisory issues in accordance with System guidance. Please also assess whether follow-up on indentified supervisory issues is timely and effective so as to ensure that bank management takes appropriate action to address the identified issues. In addition, the team should assess whether the follow-up is based on validation and testing or the acceptance of bank management assertions about the actions to be taken to address the supervisory issues. Specifically, the team should assess whether there are instances where credit is given to bank management for promised actions, prior to the actual implementation and validation of those activities. Adequacy of examination review and testing activities The team should also assess whether or not supervision staff performs sufficiently detailed examination work (review and testing activities) necessary to support a strong supervision program. Specifically the team should assess the following: • Are the communications of supervisory findings to financial institutions and the conclusion memoranda adequately supported by workpapers, such that examination findings are clearly documented in the workpapers and carried forward to the communications to the financial institution and conclusion memoranda? Where the supervisory findings are not carried forward to the final documents, is there clear documentation of the reasons for the changes, and is there appropriate review and signoff of these changes? • Are examination scope memos appropriately risk-focused and detailed so the examination work is appropriately directed to the level of work needed to validate managements statements, to provide an adequate level of testing of internal controls, and to explore and understand the knowledge gaps identified through continuous monitoring activities? • Are the risk assessments and supervisory plans updated on an ongoing basis as the result of changes in the institution's risk profile, supervisory activities including continuous monitoring, and examination work? • Are the key supervisory products (institutional overview, risk assessment, supervisory plan, scope memos, product memos, and examination reports), appropriately linked, to support the supervisory process for each institution? Effectiveness of collaboration between Relationship Management and Risk Management The Bank Supervision Group organizational model relies heavily on collaboration and synergies between the epe dedicated teams in Relationship Management and the Risk Management subject matter experts. The team should assess whether the dedicated teams effectively leverage the knowledge and expertise of the Risk Management specialists to assist and support the appropriate identification of risk management issues. Resource allocation Has the Bank Supervision Group allocated appropriate staff to business lines according to the risk and activities of that business line? Has management developed and documented criteria for allocating staff, including appropriate numbers and skill sets, and are those criteria consistently applied? 6 FCIC-090809 CONFIDENTIAL Restricted FR Management oversight and gUidance As the teams review the files and business lines they should consider and assess whether the level of management oversight and guidance is appropriate and evident given the size and complexity of the particular business line. Consideration should be given to the following: • • • Defining and implementing expectations; Supporting staff at all levels with appropriate guidance, coaching, and feedback; and Holding management and staff accountable for results. Implementation of "lessons learned" The supervision department has performed several "Lessons Learned" studies in the aftermath of the financial crisis. The team should assess whether and to what extent these "Lessons Learned" have been applied to the supervision program? Specifically: • What specific actions has management taken to enhance forward-looking risk identification processes for developing a more comprehensive understanding of supervised firms' emerging business activities and associated risks? • What specific actions has management taken to more explicitly incorporating analysis of economic and market developments into supervision planning strategies? • What specific actions has management taken to focus greater attention on assessing risk exposures and associated risk management practices across an entire organization to understand better the potential impact of correlated risk exposures that may reside in distinct business lines as well as different legal entities? • What specific actions has management taken to place more emphasis on understanding both firmspecific and broader financial sector consequences of particularly adverse events, including the rapid and severe deterioration of financial market and macro-economic conditions? • Is it clear that staff are testing and assessing fundamental risk management processes, and requiring firms to take prompt action when weaknesses are identified? • Is there evidence that staff are effectively challenging management at supervised firms on specific business activities and risk management practices before weaknesses turn into serious problems? • Are the staff adjusting ratings of supervised firms on a more timely basis and incorporating all available information into ratings, including market-based signals? 7 FCIC-090810 CONFIDENTIAL Restricted FR • What actions has management taken to ensure that communication with banking organizations is clear and forceful communications and supported by more active and consistent use of formal and informal enforcement actions? Implementation of Consolidated Supervision (CS) and Compliance RiskManagement (CRM) • Assess the supervisory teams' reliance on information provided by the prudential and functional regulators in assessing the overall consolidated organization. • Determine incorporation of CS and CRM guidance into examination/inspection and nonexamination/non-inspection activities such as continuous monitoring activities, discovery reviews, and testing and to validate the Reserve Bank's response to the self-assessment. • Determine if the supervision function processes support the respective business lines' effective implementation ofCS and CRM. • To accomplish our objective, we will review the supervision products for the institutions selected as the operations review sample for each the LBO, RBO, and FBO portfolio. A standard work program will be used to facilitate the review process and provide consistency to our approach. System supervisory gUidance for new BHCs Outside of determining the effectiveness of the Reserve Bank's supervision portfolio, the operations review management team is interested in understanding whether or not the existing System guidance, policies, and procedures are appropriate and effective in supporting the supervision of the new BHCs, particularly those with non-traditional activities such as investment banks. Please gather this information as you review the supervisory program and through conversations with Reserve Bank staff. Appli cati ons • The applications team will focus on applications processed by the Reserve Bank under delegated authority. The sample will focus on two categories: proposals to expand powers and applications for state membership. The team should assess the quality of analytical work supporting the approval, including whether deteriorating safety and soundness trends were identified and appropriately analyzed. Other Areas • Quality Assurance (QA) - To the extent possible, the teams should leverage the local QA work where appropriate and sufficiently detailed for this operations review. While the QA function will not be directly evaluated, the team should assess the contribution and value of the QA work to improving the individual supervision areas under review. 8 FCIC-090811 CONFIDENTIAL Restricted FR Summary of Findings from 2005 New York Operations Review and Status of Actions Taken to Address Findings The review resulted in twelve recommendations related to safety and soundness supervision programs, including timeliness of issuing formal communication of examination activities, meeting statutory mandates, adequacy of staffing in support of continuous supervision activities, and the use of management information systems to support information access and sharing among the Risk and Relationship teams. The Reserve Bank has taken action to address the majority of the findings; however, feedback from Board staff through the Annual Evaluation process, and the findings from the preliminary operations review work conducted in 2008, both indicate that additional action may be needed to address fully the findings of the 2005 operations review. Timeliness of supervisory work and written products The review team found that the Reserve Bank did not complete supervisory work or issue supervisory products in a timely manner. This is a long-standing criticism of the Reserve Bank supervision department and has been cited repeatedly by Board staff in past operations reviews and annual evaluations. • In Large Complex Banking Organization (LCBO) supervision, the System standards for timeliness and content were not being met. Specifically, the supervisory plans, risk assessments, and risk matrices were not completed in a timely manner; in several cases risk assessments and risk matrices had not been updated in over twelve months. In addition, the documentation related to ongoing supervision was not updated to link changes in institutional risk profiles to supervisory strategies for those institutions. Lack of timeliness in supervisory products could result in delayed delivery of formal communications of supervisory findings to financial institutions. In addition, the lack of timeliness lessens the validity of supervisory information used for comparison purposes in horizontal reviews. • In Foreign Banking Organization (FBO) supervision, ten statutory examination mandates were missed; thirty-three examination reports were mailed after the System guideline of sixty-days; and eighteen assessments of FBO combined U. S. operations were not completed within the required timeframe. • o To address these findings, the supervision department enhanced existing management information systems and related processes designed to support staff in tracking and meeting deadlines for supervisory events and products. o The supervision department's Quality Assurance Unit (QA) reviewed the newly implemented processes in May 2009, and noted improvement. However, additional time will be needed to verify the effectiveness of the new management information systems and processes in improving timeliness of supervisory work and products. Since the 2005 operations review, timeliness, and quality of content issues were subsequently cited in Annual Evaluation Talking Points for the years 2005, 2006, 2007 and 2008. 9 FCIC-090812 CONFIDENTIAL Restricted FR Continuous supervision The 2005 review found that thin staffing and limited tenure on the LCBO dedicated teams detracts from the teams' ability to conduct continuous supervision activities and may result in delayed recognition of and reaction to emerging issues in supervised institutions that face frequent changes in their risk profile. The staffing issue was particularly severe for the Citigroup team, but also existed to a lesser extent at others. • Although the supervision department increased staffing for the dedicated teams in subsequent years, the 2006 and 2007 Annual Evaluation Talking Points noted continued concern that the resources remain inadequate. Effective use of information-sharing technology The review concluded that a seamless and consistent platform to house information and manage data would improve information access and sharing and so that supervisory information can better be shared among the Risk and Relationship teams. • The supervision department addressed this criticism by developing "leamrooms" for the large financial institutions that serve as secure databases to post institution-provided risk management materials, supervisory products, and internal memoranda, and thereby facilitate information sharing. • While these changes have put adequate information-sharing platforms in place, initial findings from the preliminary 2008 review indicate that the information is not yet consistently organized to achieve the full benefits intended by the operations review recommendation. Complying with System gUidance in Community Bank Supervision In Community Bank Supervision, staff were not consistently complying with System guidance related to statistical sampling in loan reviews, criticized loan write-ups, and implementation of the riskfocused framework for community bank supervision. In addition, the quality of examination workpapers was inconsistent and did not always adequately support the supervisory findings documented in the examination reports. For example, workpaper documentation for examiner assessments of management, capital, and earnings did not support the examination findings. • The supervision department reported that a new protocol would be implemented to document the workpapers and support the examination findings. • Senior management also adopted the use of electronic workpapers, and designed training for all examiners and managers to standardize practices for how to prepare and review workpapers, and how to reference their findings in higher-level supervisory products. • The supervision department's QA staff reviewed the electronic workpapers system and practices in February 2008 and noted significant improvement in the quality of the electronic workpapers. However, the review did note that additional improvement is needed to ensure 10 FCIC-090813 CONFIDENTIAL Restricted FR that issues and conclusions in the supervisory products are appropriately supported in the workpapers. • The 2008 review team confinned that all workpapers were electronic but was not able to assess how consistently the workpapers were prepared or reviewed, or how effectively they support higher-level supervisory products. Audit Review No internal audit was conducted in 2008 or 2009. The last internal audit was conducted in February 2007. That review resulted in no Severity Levell or Severity Level 2 findings, but there were two Severity Level 3 findings concerned infonnation security and laptop inventories. 4 The next internal audit is scheduled for 2010. Risks Identified by the Reserve Bank 5 Critical skill gaps In January 2009, management identified skill gaps as the chief risk faced by the Bank Supervision Group and began an aggressive hiring program to find staff skilled in advanced credit, market, funding and liquidity and financial infrastructure risks. To the extent possible, the team should evaluate how successfully management has filled and is effectively deploying new staff to meet specific skill gaps in these targeted areas: traded products and counterparty credit, retail Basel II, credit cards, mortgage and non-mortgage lending, wholesale credit risk management, risk modeling, equity underwriting and derivatives, municipal bonds, securitization and treasury. Missed mandates We are strategizing how to get infonnation on missed mandates for FBOs and BHCs using System data resources rather than ask the Reserve Bank to prepare such a report prior to the Annual 6 Questionnaire. Specifically, the two findings related to the retention of documentation evidencing the Evolve security access reviews and the performance of a periodic inventory of laptops kept at EROC for contingency purposes. 4 5 2008 Arumal Questionnaire response. As background, for the year 2008 management identified 40 examinations or inspections not conducted as required. Five were branches ofFBOs where the exam was postponed between two weeks and three months. Nine were lower-risk FBO representative offices where the exam was rescheduled or reprioritized. Only one S1.1B exam was delayed, by two weeks. Thirteen of these were BSA reviews rescheduled due to staffing constraints; Board BSA staff report NY staff keep them well informed of decisions to postpone or reschedule. 6 11 FCIC-090814 CONFIDENTIAL Restricted FR Work Products Close-out reports Each Area Leader will prepare a "close-out" report using a standard fonnat that will be provided by the operations review management team. This report should identify any recommendations or suggestions and provide detailed comments to support the findings and conclusions. Electronic workpapers Each community bank team member will complete a workpaper template for each organization reviewed. Large and regional bank team members will complete the consolidated supervision template and also provide specific details on each target/exam reviewed. Examples will be provided while onsite. Interviews and pre-close-out meeting discussions It is critical that interviews, and to the extent necessary follow-up discussions, are conducted with both management and staff of all business lines reviewed. Interviews are a vital part of the operations review process because they both pennit the Reserve Bank staff to "be heard" and they give the operations review team valuable insights into how the department works, what processes work well, and what could be improved. If the team notes areas of concern, these should be vetted with the Area Leader of each team and the Operations Review Coordination Team. Following the vetting, the concerns should then be discussed in pre-close-out meetings with the officer(s) and manager(s) of the business line. Attached Appendices: Appendix Appendix Appendix Appendix Appendix Appendix 1 2 3 4 5 6 Operations Review Team by Area of Responsibility Sample and Staffing by Business Line Scope Details for the FBO Program Review Scope Details for the M&LR Program Review Governor Duke Briefing for FRB NY 3.3.09 2005 FRB New York Operations Review Report 12 FCIC-090815