With regard to managing risk across business lines, we learned that 74 percent of our respondents rated this as a high or moderate risk, compared to 59 percent last year. That was also a big jump. And, finally, one surprise that we also saw was a decline in cybersecurity as a concern, at least in the survey results.  In 2019, for example, 78 percent noted this matter was receiving escalated priority in their business planning; in the 2023 survey, that percentage declined to 58 percent.   

I doubt the industry is less concerned about cybersecurity in 2023 than it was in 2019.  I believe the industry is likely just as anxious about it, but it is doing a better job of managing it and that progress is reflected in the survey responses. The regulators have certainly not de-emphasized cybersecurity risk.  Their concern is clear from their presentations and in their advisories to the industry.  We see news reports of breaches and other concerns across all different lines of business. So I don’t think overall concern about cybersecurity is going down as much as the percentage might suggest, and I am also confident that financial institutions are devoting a significant amount of time and attention to it.

The overall Main Indicator Score rose back to a score similar to 2021’s of 128. Some of the reasoning cited behind this included a three-fold increase in the dollar amount of regulatory fines imposed over the past 12 months, from $1.3 billion for the 2022 survey period to $3.9 billion in 2023.  Can you explain more about this? Were there any specific regulatory fines that added to this large increase?

Some of this relates to the timing of the survey and the unpredictability of when enforcement actions are completed and made public. In looking behind the numbers, we are seeing through our other work with the industry that regulators are taking aggressive action to address non-compliance and safety and soundness issues. One area, for example, is in fair lending, particularly with regard to redlining, where the Department of Justice has reached several settlements in the past year with lenders and has upwards of 20 more cases that they’re reviewing now.  So, that’s one example that supports the notion that regulators are taking more aggressive action.

There was one enforcement action that caused the 2023 dollar amount number to bump up considerably.  If we were to remove that one very large enforcement action, the numbers would be more closely aligned with last year’s results. 

Given the challenges to the CFPB’s Sec.1071 final rule (such as Judge Crane of the Southern District Court in Texas broadening the injunction to include all covered financial institutions), do you think these rules will ever be implemented?

When the CFPB issued its final rule at the end of March 2023, it included a tiered or phased implementation schedule based on volume. Those in the Tier One category, comprised of the largest lenders, were to begin collection in October 2024, with other tiers to follow in 2025 and beyond. 

The institutions that have October 2024 on their radar screen have all been working very steadily towards that date, with the understanding that the date will be extended by the injunction.  The injunction calls for an extension of the implementation period for as long as it stays in place.  The implementation dates will be recalibrated once the U.S. Supreme Court issues its opinion, sometime between now and June, in a different case involving a different rule and a different issue.  That case involves the CFPB’s payday lending rule and a challenge to the constitutionality of the CFPB’s statutory funding mechanism.

The industry has been looking at the extension of the October 2024 date as a gift of additional preparation time, not as an excuse to stop work.  Most are optimizing and taking advantage of the additional time, which could be several more months.  I do think that the rules will ultimately be implemented. 

With 74% respondents expressing their concern as high for small business lending rules, do you think this will drop as time goes on, as compliance teams undergo more training and become more familiar with rules?

The overall level of concern will diminish over time, but concerns about certain aspects of the implementation process are going to grow before that happens, namely with the ability to accurately capture data and data analysis.  The survey asks questions about different steps in the implementation process, and as the implementation process proceeds, we expect to see certain things take on more importance, then trail off, and then return later.  That’s what we saw with the implementation of the revamped Home Mortgage Disclosure Act regulations several years ago, which bear many similarities in concept to the small business lending regulations. 

 Right now, we are seeing the industry ramping up to train their team members to get them more familiar with the rules, as well as preparing for collecting the necessary data and getting systems ready.  

With the implementation starting in October 2024 for larger lenders, and 74% of Indicator respondents ranking the small business lending rules among their concerns, including accurately capturing new data fields, system upgrades, and staff training for compliance, what steps can be done to prepare?

Given that it has been close to a year since the final rule was issued, I would hope that people have taken the time to read it and have also looked at the materials issued by the CFPB designed to facilitate compliance.  That is the critical first step.  Second, I hope institutions are taking full advantage of the entire implementation period and have mapped out a plan and strategy for being ready when the compliance dates arrive.  Third, it is critical to look at the small business lending rules as more than an exercise in collecting data.  It is much more than that.  You have to understand why it is that the CFPB is collecting this information.  This is a fair lending regulation.  And that information is going to be used for fair lending purposes to look at small business lending, and credit access and availability, much in the same way HMDA is used for mortgage lending access and treatment issues.

Fourth, given the breadth and importance of the regulation and how the data will be used, fully and effectively operationalizing it requires an enterprise-wide regulatory change management program.  That means an institution needs to have all the right people assembled across the organization, with compliance, legal, IT, credit, and financial reporting groups working together with clarity of purpose and responsibilities. 

There are many operational challenges that must be addressed in just capturing the data. There are also complications with the collection of race and gender data of a small business. Much of this involves new information that institutions have never collected before, and the rule requires institutions to have reasonably designed procedures for the small business application process which many probably have not had before.  Those procedures will help ensure consistency in the collection and reporting of the data as well as in facilitating staff training and setting up controls and monitoring.  All of this ultimately ties back to the fundamental imperative to having a comprehensive compliance management system in place that’s guiding the implementation process.   

Did many of 2022’s noteworthy banking regulations and compliance trends continue in 2023?

A few of them did.  Keeping current with changing regulations is one of those common themes that we see from year to year, and that showed up again this past year. The small business lending regulations also carried through from 2022.  Other things that carried through included the most significant obstacles to managing a compliance program – too much reliance on manual processes, too many competing business priorities, and staffing. 

Finally, interest rate increases and concerns about ransomware carried through to 2023. Everyone is watching for what the Federal Reserve does in 2024 and beyond with interest rates.  There have been certain signals that the country is turning a corner, and we will see some welcome interest rate decreases in 2024.

What can banks do to overcome the top obstacles reported in the Indicator?

The results show that enforcement actions are costly. So, the question becomes what can we learn from the experience of others?  Reverse engineering each one of those actions to determine whether a similar issue exists in your institution is one way.  What are the risks that you see that resulted in enforcement actions and what are you doing to manage those same risks? 

Another step is enhancing the compliance program management of the institution.  A place to start is with a comprehensive risk assessment that is kept current. Technology can be very helpful in monitoring—and tailoring that monitoring activity to the areas of highest risk identified in the risk assessment. 

I would also say manage regulatory change wisely, and that means making full use of implementation time periods.  There is often a tendency to sit on a new regulation for a few months and not want to open the book just yet.  My advice is to open the book and find out what’s in there. 

Looking at data governance as a regulatory and business imperative goes to the issue of accurately capturing and using information.  Regulators have been spending a lot more time on making sure the information that they’re using for examination and supervisory purposes is accurate and can be relied upon.  I think that institutions owe it to themselves to take a look at that and make sure that they can use that data and they’re making decisions based on good information.

 Third-party risk management is an area that everyone needs to be looking at.  The uptick in the fair lending program or fair lending scrutiny in examinations has got me thinking about the need to look closely at your fair lending program, especially in connection with the management of third-party relationships.

And, lastly, on the compliance management side, look at staffing models and talent management, particularly in tough times where resource management becomes most challenging.