Prognoses from VBC for the Regulatory Road Ahead

Posted in ERM, Insights, MRM

As 2023 draws to a close, the risk specialists at VBC would like to share our prognoses and predictions for the regulatory road ahead.  Our views reflect what we have seen from our clients following the high-profile failures of Silicon Valley, Signature, and First Republic, as well as our careful read of regulatory pronouncements and activities in the aftermath of these bank failures.

Stated simply: the regulators are and will continue to demand of their client institutions heightened expectations with respect to risk management and governance, especially with respect to enterprise risk management (ERM) and model risk management (MRM), with a particular emphasis on the effective measurement, management and mitigation of interest rate, liquidity, and capital risk.  Irrespective of asset size and complexity, financial institutions will need to demonstrate resiliency and maintain higher standards with respect to safety and soundness, risk management, internal controls, and governance.  Specifically, institutions will need to demonstrate evidence of independent, effective challenge and proactive risk management across the firm, from the Board of Directors to rank and file personnel.  Regulators will expect expanded documentation with respect to the explicit mapping of responsibility levels and robust testing of controls.  Institutions viewed by regulators as demonstrating “persistent” or “recurring” weaknesses in risk management and governance are particularly exposed.

Looking out to 2024, regulatory intensity and interventions with respect to risk management and governance will continue in the form of targeted reviews and examinations, escalating enforcement activities, and the like.  We strongly recommend the following with respect to effective response anticipation and delivery:

• Institutions should prepare current and target state assessments, budget for enhanced or expanded resource commitments, formulate next stage program reinforcement and implementation, and demonstrate a proactive willingness to address existing or potential weaknesses across all three lines of defense (business lines, risk, and internal audit).
• Institutions should demonstrate and document governance and controls effectiveness via first line ownership of process controls and performance testing.
• Second line independent review and effective challenge should also be effectively reinforced.
• Institutions should also ensure end-to-end process evaluations from the third line, with particular focus on issue identification, management, and remediation.

Overall, firms should seek to reinforce internal risk cultures, commit to independent and effective challenge, and ensure demonstrable and integrated ownership of risk across all three lines of defense.

As noted, heightened risk standards for both ERM and MRM will be in play for 2024.  With respect to ERM, institutions should plan to implement wholistic risk management or the identification, management, and mitigation of firm-wide risk.  This will include reinforcing the internal culture of risk (“tone from the top”), continued risk quantification and cross line integration, and effective risk monitoring and reporting.  For MRM, the establishment and maintenance of a robust governance framework will be essential to countering or preparing for heightened regulatory scrutiny.  Specific areas of MRM practice include ongoing model performance monitoring, demonstrated effective challenge with respect to independent review and validation of model development and implementation, model inventory and change controls, and timely issue remediation.

From a first line (model owner) perspective, enhanced capital and liquidity management will be expected by regulators.  Given the events of 2023, there is no question that regulators have demonstrated renewed focus on the liquidity risk management posture and practices of their client banks regardless of asset size or complexity.  This includes core liquidity risk management (LRM) components such as stress testing, contingency funding plans, intraday liquidity risk, retail deposit funding, and high-quality liquid asset buffers.  We have encountered increased scrutiny with respect to LRM models, modeling assumptions, and stress testing practices.  Of particular interest are modeling assumptions with respect to uninsured deposits, price risk associated with held-to-maturity (HTM) securities, stress testing and sensitivity analysis, and LRM reporting.  Additionally, the integration of asset liability management (ALM) and LRM with respect to stress testing and capital forecasting and planning are considered supremely important areas of risk management practice for client institutions. Prescriptions for enhancing capital and liquidity risk management include:

• Strengthen supporting risk management and governance frameworks and infrastructures implicating all three lines of defense.
• Review and optimization of both liquidity and capital requirements, particularly where such requirements are shown to intersect based on company run stress testing results.
• Tighter integration between capital planning/forecasting, balance sheet forecasting, credit risk, and liquidity management frameworks and activities.

In short, during 2024 we fully expect regulatory intensity and interventions to continue. This will result in targeted reviews and examinations focused on the management of liquidity, capital, and interest rate risk for banks regardless of size and complexity.  To meet this moment, banks will need to ensure that the risk management, governance, and compliance frameworks supporting these critical first line functions are sufficiently robust, well-articulated, appropriately staffed, and effectively implemented.

James L. Glueck, CAMS, CFA, FRM, SCR, Managing Director, VBC Advisors

Brian A. Velligan, Managing Partner & Co-founder, VBC