Bank Lawyer's Blog

Immoral Hazards

While guys like John Dugan get their knickers in a twist about the "moral hazard" of granting limited accounting forbearance to community banks who want to amortize commercial real estate losses, the Main Stream Media wrings its hands about big bad mortgage lenders who expect a borrower to pay back money he or she borrowed and, when the borrower doesn't pay it back, not only foreclose on the home but sue some of the borrowers for the deficiency. When will the madness stop!

First out of the moral outrage starting gate was The Washington Post, which a couple of weeks ago ran a story entitled (with just a hint of incredulity) "Lenders go after money lost in foreclosures."

Over the past year, lenders have become much more aggressive in trying to recoup money lost in foreclosures and other distressed sales, creating more grief for people who thought their real estate headaches were far behind.

In many localities -- including Virginia, Maryland and the District -- lenders have the right to pursue borrowers whose homes have sold at a loss to collect the difference between what the property sold for and what the borrower owed on it, also called a deficiency.

Before the housing bust, when the volume of foreclosures was relatively low, lenders seldom bothered to chase after deficiencies because borrowers had few remaining assets to claim and doing so involved hassles and costs. But with foreclosures soaring, lenders are more determined to get their money back, especially if they suspect borrowers are skipping out on loan they could afford, an increasingly common practice in areas where home values have tanked.

The story relates the sad fact that many of these borrowers are forced to file bankruptcy.

"I am definitely seeing more people come through my door who walked away from houses a year or two ago and thought they were as free as the dead," [bankruptcy attorney Nancy] Ryan said. "They're stunned when they realize they're not."

That about says it all for a segment of the population that considers a legal obligation a mere inconvenience and is "stunned" when the counterparty actually enforces its rights.

The article does correctly observe that most lenders don't pursue deficiencies where they expect the borrower has few valuable non-exempt assets other than the home. It also notes that since second lenders are most often left out in the cold in a foreclosure these days, they are more likely to sue than are first lien lenders.

The story also features a couple who did a short sale with the express understanding that the home equity lender reserved the right to come after them for the unpaid balance of its debt. Nevertheless, the borrowers reacted bitterly when the second lender actually called to collect six months later. They stated that they should have trashed the home and let the lender foreclose. Apparently, they failed to appreciate the fact that by taking care of the home and doing a short sale, they very likely lowered the ultimate amount of the deficiency liability that they owe by a substantial amount, especially if the alternative was wrecking the interior of the house and then letting the lender eventually foreclose. That course of conduct made good business sense.

The attitude displayed in these cases appears to be that since times are tough, lenders need to let borrowers off the hook and absorb the losses themselves because, I assume, the borrowers are "entitled to it," even if they can afford to repay all or a hefty portion of the deficiency. A bank's management that enacted and followed a policy of doing that would be in breach of its fiduciary duties to its shareholders and, when viewed by a regulator other than Sheila Bair, would have engaged in an unsafe and unsound banking practice. The lender would also very likely be insolvent itself in short order.

Obviously, each case needs to be analyzed on its merits, and in many cases, the borrowers lack of financial resources will justify the bank not pursuing the deficiency. However, the bank's management has an obligation to act in the bank's best financial interests, not in the borrowers' best financial interests. If the two interests coincide, great. If not, and the borrower has assets to go after and no apparent legal defense to enforcement of the bank's right to be paid, the bank has a duty to enforce that right.

I realize that a distraught borrower, especially one raised in the land where every mother's child has a right to a flood of unending self-esteem and a guarantee (enforceable by the government) that nothing bad will happen to him or her until he or she eventually tragically dies for no good reason at all other than that life is ultimately meaningless, might have difficulty grasping the harsh dose of reality that legal contracts are enforceable. However, aren't these some basic concepts that we expect major market media outlets to fathom and to put into perspective for the reading public? Is that asking too much?

***************************************************************************************************************************

I'm off until next week. Y'all have a most excellent Independence Day.

Cantankerous Contrarian

ContraBanker's cranky, and his ire is directed at both sides of the management-regulatory divide.

I live in western Colorado. At certain times of the year migrating deer and elk can make our highways look like lunch time on Times Square. If you could put a suit and tie on the animals, that startled, stunned look in the headlights would be a perfect approximation of bankers and regulators alike right now.

He segregates the community banking universe into three categories: good banker, bad banker, and "the regulator," a label that doesn't need an adjective designating moral quality, because everyone knows that "a regulator" is the moral equivalent of Charles Manson on a bad acid trip.

When a rookie becomes a bank regulator there are two standard issues of equipment: a laptop and a prayer wheel. The latter is spun constantly for the next umpteen years and each revolutions says "I gotta keep my job". These are perilous times for regulators, witness the criticism in the wake of Countrywide, Indymac Bank and WAMU. The profession has learned from these debacles:

• No Regulator ever got fired for being too tough.
• If I don't make a decision, I can't be faulted for making a bad decision.
• We let too many people in banking. If, now, we don't let any people in the club, we won't have bad people.

There's a ton of private capital out there that could, and would, relieve a lot of pressure on the hapless taxpayer, but the FDIC has made it too difficult for private money to help. What the heck: do nothing, and nothing will happen, and that prayer wheel can go on spinning.

Now, that's some mighty fine snark he just laid down, ladies and gentlemen. Savor it for a moment as you sip your morning cup of Joe, inhale that last quarter-inch of your roach clip, and get ready to jump back into bed, pull the covers over your head, and "go all Rumpelstilskin on us" for the next 20 years or so until this banking mess blows on by.

Lest you think Pat is being "unfair and unbalanced," however, he's equally disgusted with bankers of all stripes. These are unprecedented times (at least unprecedented in the lifetimes of the post-WW II generations), and no one group seems to be able to rise above their inherent limitations and save us all from ourselves. Unlike bank lawyers, of course, who bestride the moral universe as a colossus. Yes I know, that's as a colossus of venality, bile, and "bad bidness," so let's not go there.

Hey, Pat, no one ever said working as or for bankers was a great big barrel of laughs, did they? Cheer up: we've got 2315 pages of the new banking reform legislation to digest, and after we cram that down our gullets, we'll wake up and realize that we've all been "saved."

Either that, or we'll be reaching for the Tums. Or the roach clip.

False Forbearance Allegations

A recent article in the American Banker (paid subscription required) discussed briefly some of the arguments that federal banking regulators have been making to members of Congress in opposition to the loss-amortization provisions of the small business financing bill that made it through the House. The bill faces stiff opposition from Republicans in the Senate, due to the fact that they're cynically attempting to exploit the anti-bailout sentiment among many voters by labeling the small business lending program "just another Tarp." As I've urged community bankers recently, come November, remember who your true friends are but, more importantly, remember who your true enemies are. Republicans who will throw you under the bus in order to exploit base emotions and misperceptions among voters for victory in November are as much your enemy as is a so-called "populist" like Sheila Bair. You can't vote Bair out of office (she failed in her one and only attempt to run for public office when her "mentor" Bob Dole supported her opponent, and she's wisely chosen a "non-elected" line of work since then), but you can vote against any purported champion of small businesses in Congress who voted against the bill that contains CRE loss amortization. That would include all but three House Republicans, by the way.

The regulators are apparently pushing three basic themes in their attempt to influence legislators. According to the American Banker article, the regulators are arguing that amortization of CRE loan losses over a period of up to 10 years is bad because (1) it undermines confidence in banks, (2) it hides "true" losses, and (3) it creates a "moral hazard" because banks that receive it are likely to take big risks going forward in an attempt to recover before the amortization period runs out. I don't think the regulators who are making these arguments actually believe them to be true, although I can't insert myself into their minds to accurately discern their intent (any more than I could--or would desire--to enter the mind of a Mafia don). Instead, I assume that for these Pontius Pilates, "truth" is a relative term. It's not what an objective observer would conclude after attempting to be fair and reasonable. Instead, it's all about spinning the story so that it achieves the objective of preserving the power of the regulators to act without any interference with their ability to pick winners and losers among the too-small-to-save community banking business. If you think that sounds cynical, you're dead on.

The "undermining confidence" and "hiding true losses" arguments both are related to the alleged "fact" that by allowing banks to amortize losses on CRE, the "true" financial condition of the banks is "masked."  Inasmuch as the recently passed legislation requires banks to report regulatory capital calculations with and without the loss amortization, those arguments are bogus. Full disclosure will be made. Private equity investor representatives I have spoken to (and the "forbearance" would not apply to publicly-traded banks) state that this is a non-issue for them. As to the regulators, are they saying that they can't figure out the actual financial condition of a bank that is amortizing losses for regulatory capital purposes? If not. Who, then, can't see through the so-called "mask"? Depositors? Congress just voted to protect all of them up to $250,000, so who, exactly, is so unsophisticated that they might be unwittingly deceived and harmed by the fact that there are side-by-side regulatory capital calculations being reported, one with and one without amortization of CRE losses?

As for the "moral hazard" argument, that, too, is patently false. The loans that the amortization would apply to must have been "originated" prior to January 1, 2008, so it won't apply to new loans. Moreover, the bank's federal regulator(s) must approve the bank for eligibility, which means that if the regulator believes that the bank's current management is the type to take unjustifiable risks going forward, the bank won't be participating. The regulators must also create underwriting guidelines for banks participating in CRE loss amortization, so that should provide yet one more safeguard to bar future excessive risk taking. Finally, since banks file quarterly CALL reports (and since many are under enforcement actions that require more frequent reporting and restrictions on the bank's activities), the regulators are going to be able to know quickly if unreasonable growth is taking place, and where that growth is coming from.

Based upon discussions with the loss amortization provisions' supporters, it also appears that the regulators are trying to conflate CRE loss-amortization with the types of forbearances that were used by the late, not-lamented Federal Savings and Loan Insurance Corporation in the 1980s in order to prop up failing savings and loan associations throughout the country. It seems that the regulators are citing studies by various academics and government agencies that purport to "prove" that the S&L forbearances were an "Epic Fail" and were also largely responsible for making the eventual thrift failures much more costly, and then alleging that the CRE loss amortization is the same type of forbearance.

These arguments are misleading at best, intellectually dishonest at worst. The CRE loss amortization provisions are not akin to the across-the-industry forbearances that were issued by the FSLIC, but are substantially similar to the very narrow loss amortization provisions of the Competitive Equality Banking Act of 1987 that applied to agricultural banks. A study apparently not cited in any of the voluminous footnotes in letters that regulators have sent to Congress is a 1998 review by the FDIC of the banking crises of the 1980s and early 1990s. That study reveals that "class-of-bank" forbearance programs are clearly distinguishable from the widespread forbearance programs like that employed by the FSLIC, and, moreover, are much more successful in both rescuing banks that would otherwise have failed and in lowering losses of those banks that eventually fail despite the forbearance. Of 33 banks in the 1987 program, 27 survived as independent, 2 were merged without FDIC assistance, and only 4 failed. Moreover, as to all "class-of-bank" forbearance programs implemented in the 1980s, the banks in the programs that did fail had lower, not higher, losses than those that did not participate in the programs. While condemning the FSLIC-type widespread forbearance programs as "disasters," the report has this to say about more narrowly-focused temporary forbearance programs:

The more favorable results of bank forbearance programs as compared with the FSLIC strategy reflect the smaller number of banks involved, the closer monitoring of banks, the fact that problems addressed by bank forbearance programs were temporary and cyclical in nature, and (most important) the fact that bank regulators sought to control risk taking by participating institutions rather than encourage it.

All of the above factors should apply to the proposed CRE loss amortization program. Arguments that this is another FSLIC-type forbearance program are disingenuous. This is a targeted, temporary, narrowly focused forbearance program,designed to address problems that are temporary and cyclical in nature. The federal bank regulators will have plenty of power to determine who participates and who does not, and, as to those who participate, that no excessive risk taking will be permitted.

Private Equity And Failed Banks: The Stiff Arming Continues

The American Banker chose to post an article online outside it's subscription-based firewall, which means that readers who don't subscribe to that publication get a chance to read the article and see what they're missing on a daily basis. I don 't get paid to plug that trade publication (not even a discount on my annual subscription price), but I often quote from its articles because it's one of the best sources for news on banking. This one, authored by Paul Davis, addresses a subject that I follow with particular interest: the problems that private equity investors are having participating in the resolution of failed bank transactions handled by the FDIC.

Though executives at many private-equity firms continue to raise capital and scout opportunities, few have emerged victorious in the bidding for failed institutions in recent months.

Davis discusses a number of reasons for the failures cited by private equity firms, including the slower-than-expected pace of bank failures (which is not considered slow enough for many small bankers who've watched their banks crumble). For unassisted deals that some investors are now considering, the amount of due diligence required to make sure you're not buying a pig in a poke is daunting and time consuming. Davis also lists a factor that's been apparent for some time: the aversion of federal banking regulators (especially, in my opinion, the FDIC and the Federal Reserve Board) to deal at all with "private equity" (a term they refuse to define with specificity but, like pornography, claim to recognize when they see it). I guess singing "getting to know you, getting to know all about you" repeatedly to the FDIC for the last year hasn't done private equity players a lick of good. When the FDIC thinks of "private equity," the only image that pops into its mind is a three dimensional holograph of the DNA structure of the Ebola virus.

Of course, major private equity investors aren't going to be brutally candid about their feelings in a public manner, because they're not all ready to abandon ship when there's still a chance that they can ride the failed bank wagon train to the land of milk and honey. According to investors Davis spoke with, they're taking a clam and sanguine approach. They assume that as banks continue to fail, existing bank acquirers become more scarce (because they've either eaten their fill or they, too, have problems to deal with), and the economic recovery continues to remain fixed firmly on the distant horizon, the FDIC's sense of antipathy will weaken and, eventually, private equity will worm its way into the FDIC's cold, cold heart.

Davis also discusses a trend that we've seen manifest itself, and about which we've blogged recently: private equity saying "to heck" with failed bank deals and turning to still-solvent deals where a more sympathetic federal regulator may be involved and/or where the competitors aren't other existing institutions who can offer a better price for "strategic" reasons. The downside risk to playing that game is well articulated by investor Wilbur Ross.

But Wilbur L. Ross Jr. said many firms are engaging in a "dangerous exercise." His W.L. Ross & Co. was among eight investment firms that successfully bid on BankUnited of Coral Gables, Fla., earlier this year.

"If you are going to do a nonassisted transaction, you have to be a lot more certain that your numbers are right" given the lack of loss-sharing agreements, Ross said. "You have to be sure that the troubles aren't so severe that the equity you invest will be wiped only a few months later."

For that reason, Ross said his firm is not dedicated solely to pouring capital into banks.

"We are not pigeonholed," he said. "That's what makes us different. We like banks now and see them as a decent opportunity. When that is no longer the case we will go on to something else."

That's my personal opinion, as well, and I don't think Mr. Ross is so very different from many other private equity investors. If the opportunity is no longer "decent," the investors will look elsewhere. I sense that a number of private equity investors who've been unsuccessfully pursuing failed bank transactions are reaching that point, or will be reaching that point by the end of this year.

Diana Taylor Says, "Yes. No. Maybe."

As long-time readers understand, the principal author of this blog has had an unhealthy obsession with a passing interest in Diana Taylor, former New York Banking Superintendent and current paramour of New York City Mayor Michael Bloomberg. It's been over a year since we last basked in the glow of the light she was trying to keep under a bushel basket so as not to steal the glory from her wanna-be fashion plate boyfriend. After being gunned down by the NRA (over Bloomberg's anti-handgun positions) for the Chairmanship of the FDIC (which then went to second-choice anti-banker, Sheila Bair) and later leaving the New York Superintendent's job after Eliot Mess was elected governor of The Empire State, we thought she might just have permanently retired from public service. Much to our delight, we were wrong.

According to The New York Times, she seriously considered running this year for Senator from New York, before deciding the time is not quite right. However, according to informed sources, the time will be right at some point.

Her actions suggest that as Mr. Bloomberg enters the twilight of his mayoralty, the heir to his political legacy may be the woman he has dated for a decade. “If she wants it, she has a political future,” said John J. Faso, the Republican candidate for governor in 2006.

"Dated." I just love that euphemism, don't you?

Republican lawmakers, consultants and operatives continue to describe Ms. Taylor — a former investment banker and state banking regulator — as a “perfect candidate,” a “grand-slam home run” and a “shoo-in” for offices ranging from governor to mayor of New York.

Their enthusiasm, as overheated as it may seem, can be traced to her eclectic résumé and a personal warmth that seems to stand out all the more against Mr. Bloomberg’s sometimes chilly demeanor.

Well, there's nothing like a billion dollars or so to warm you up to the chilliest demeanor, eh?

The Times' article is quite favorable, which might be considered unusual if you thought Ms. Taylor was a Republican in the mold of Mitch McConnell, which she definitely is not. She'd probably be accused by die-hard conservatives as being much more a RINO than a "traditional" Republican.

A registered Republican, Ms. Taylor embraces a philosophy that closely mirrors that of the mayor. She is socially progressive and fiscally conservative. She is fond of invoking Abraham Lincoln on the role of government (which she has paraphrased as “to do for those who cannot do so well for themselves”), and she is infuriated by those who complain about Washington but do not have the stomach to become involved in public life.

Bloomberg has vowed to retire in three years. If he sticks to that timetable, in the near future we may see someone in the Senate who actually understands banking and doesn't hate banks. Wouldn't that be refreshing?

CRE Loss Amortization: Less Than A Home Run

Although the commercial real estate loan loss amortization amendment sponsored by Colorado Representative Ed Perlmutter that we discussed last week made it into HR 5297, which was passed late last week by the House of Representatives, the final version of that amendment (see Section 113 of HR 5207) is subject to so may "ifs, ands, and buts," that, contrary to my view of last week, I doubt it will be of use to many community banks that could benefit from extended loss amortization.

Only banks "eligible" for a Tarp-like capital investment under the act (although supporters will slice and dice you if you dare to call this investment a "Tarp" investment) will be able to take advantage of the loss amortization. "Eligible institutions" do not include banks on the FDIC's troubled bank list, and the way I read the statute, the bank's primary federal regulator will have a de facto veto power over who gets to be classified as "eligible."

The amortization period is determined in accordance with Section 113(c), which refers to "the initial 2-year period referred to in section 4(d)(4)." That section discusses the 2-year period that runs from the date of Treasury's capital investment in institution, so it appears to me that only "eligible institutions" that have actually received a capital investment under this act will be able to take advantage of extended loss amortization. Furthermore, the amortization period depends on increased small business lending during that 2-year period, so it's not clear to me what amortization period the bank begins with and how and when adjustments to that amortization period are made. By the time all this is clarified, maybe another two or three hundred too-small-to-save community banks will have failed.

To prevent wild and crazy risk taking (I presume), the loss amortization only applies to "loan origination that occurred on or after January 1, 2003, and before January 1, 2008." There's also a requirement that the appropriate federal bank regulatory agency for an eligible bank that chooses to amortize loan and REO losses has to adopt regulations within 60 days of enactment of the legislation "defining minimum underwriting standards that must be made for loans made by the eligible institution."  That ought to present another opportunity for federal regulators, who don't like this amortization provision to begin with, to tighten the screws on the ability to benefit from it.

It's better than absolutely nothing, I suppose, but even if this provision makes it through the Senate, at first blush it's a far cry from what was originally intended by the community banks who proposed this legislation. We'll see how this plays out, and whether this legislation is adopted by the Senate, where Republicans have been making noises about blocking it as another "Tarp-like bank bailout."

While we're on the subject of Republicans as enemies of community banks, we note with amusement the statement put out by Colorado Republican Representative Mike Coffman, who publicly supported Perlmutter's amendment and voted for it, and who then almost immediately voted against the bill that contained the amendment. He put out a John Kerryesque statement about how he feels strongly both ways.

In November, let's remember to throw all the bums out, regardless of party affiliation.

A Little Kryptonite Thrown At The FDIC

It's not often that the so-called "Superpowers" of the FDIC as receiver of a failed bank are curbed. However, Kevin LaCroix discussed a recent decision of the federal Second Circuit Court of Appeals that clipped the FDIC's wings in his The D&O Diary blog.

The suit arose out of a claim by the FDIC against a failed bank's fidelity bond, based on a fraudulent loan scheme allegedly concocted by officers of Connecticut Commerce Bank (CBC), which failed in 2002. The issuer of the bond denied coverage on the basis that CBC had made false statements and omissions on its application for the bond. The FDIC sued the issuer, alleging that such defenses are barred by the dreaded provisions of 12 USC 1823(e), which provides:

No agreement which tends to diminish or defeat the interest of the Corporation in any asset acquired by it under this section or section 11, either as security for a loan or by purchase or as receiver of any insured depository institution, shall be valid against the Corporation unless such agreement--

(A)  is in writing,

(B)  was executed by the depository institution and any person claiming an adverse interest thereunder, including the obligor, contemporaneously with the acquisition of the asset by the depository institution,

(C)  was approved by the board of directors of the depository institution or its loan committee, which approval shall be reflected in the minutes of said board or committee, and

(D)  has been, continuously, from the time of its execution, an official record of the depository institution.

The section lists some exceptions to this general rule, none of which were applicable to this case.

The district court granted summary judgment in favor of the bond issuer and the Second Circuit upheld the district court's decision. While holding (contrary to an earlier Sixth Circuit opinion) that the fidelity bond is an "asset" of the failed bank, the court ruled that 1823(e) bars "secret defenses," but not bar defenses raised by the bond itself.

The Second Circuit found that "as the grounds for rescission were plainly stated on the face of the bond, there is nothing secret about [the fidelity bond insurer’s] misrepresentation defense." To recognize the FDIC’s position, the Second Circuit said, would be to "strike the rescission clause from the bond."

Kevin asserts that the decision has a couple of implications. First, it affirms that notwithstanding the "Superpowers" of the FDIC and the FDIC's willingness to push the envelope on the limits of those "Superpowers," "the FDIC’s ability to enforce the failed bank’s insurance coverage is subject to the defenses the insurer may have that appear in the relevant policies." Second, "the opinion starkly demonstrates the critical importance of the policy application process and the extent of the insurer’s rights, under certain circumstances, to seek rescission."

The Second Circuit’s view of the applicant’s obligation to provide responsive information is broad and encompassing...The breadth of the ruling rescission ruling could well prove helpful to insurers in other rescission cases, even those lacking the distinctive characteristics of this case."

The nature and extent of the FDIC-receiver's powers under 12 USC 1823(e) were critically important during the last bank crisis of the late 1980s and early 1990s. With the failure of nearly 250 banks in the last year and one-half, and with many more failures coming before the current crisis has run its course, banks and those who have relationships with them (including their borrowers, correspondent banks, loan participants, landlords, and service providers) are rediscovering, often to their extreme dismay, the extent and breadth of these "Superpowers."

Those interested in learning more might consider listening to Tuesday's webinar, "Revisiting the FDIC's "Super Powers": Contract Repudiation and D'Oench Duhme," given by Haynes and Boone lawyers John Podvin and Erin Burrows.

CRE Loss Amortization Makes It Into HR 5297

I was informed today that US Representatives Mike Coffman and Ed Perlmutter of Colorado succeeded today in securing an amendment to HR 5297 (The Small Business Lending Fund Act), which is expected to be voted on by the House tomorrow. The amendment permits amortization of commercial real estate loan losses by banks, a legislative proposal we previously discussed here, and discussed most recently with respect to the efforts of Coffman and Perlmutter here. I haven't seen the text of the amendment, so I can't relate its specific terms. However, based upon the remarks today of Perlmutter and Coffman in support of the amendment (see videos embedded below), and what we know about early drafts of proposed legislation on the topic, I assume the amortization period is up to 10 years.

Whatever community banks can achieve in this regard will be useful in preserving capital. I've been told by some supporters of the bill that the Obama Administration and the federal banking regulators (whether all of them or only some of them was not made clear to me) have come out against this amendment. Therefore, if any community bankers or small businessmen out there want to push this forward in the face of such opposition, they ought to contact their representatives immediately and make their views known, even if it is the eleventh hour and fifty-ninth minute. This is the best chance banks will have to get something like this done.

If not, go back to "America's Got Talent" and your Bud Light.

Here are Perlmutter's remarks today:

Here are Coffman's remarks:

Don't Look Now, But There's A Man In Your Browser

Consultant Jasbir Anand wrote a nice "Viewpoint" piece in  a recent issue of the American Banker (paid subscription required) about "man-in-the-browser" attacks on bank accounts. While banks have invested in multifactor authentication over the past few years (which is a requirement of regulatory guidelines), Anand points out that multifactor authentication alone is no longer sufficient to beat the sophisticated cyber criminals of today (the type we recently discussed).

In the past, banks invested in multifactor authentication to try to ensure that only legitimate users accessed online banking systems; they also invested in systems that provide IP address intelligence for online banking transactions. However, although IP address intelligence detects account takeover where fraudsters have used phishing techniques and malware to obtain login credentials of legitimate users, it falls short at detecting man-in-the-browser attacks — which take place without affecting the legitimate device and IP address data sent with the transaction.

So what can banks do to protect themselves from man-in-the-browser attacks? Customer authentication measures aren't sufficient, so instead banks can mitigate their risk by gaining a better understanding of the activity within an online banking session to determine if it fits the established profile of the genuine customer.

Anand recommends a "layered approach" to monitoring transaction activity as well as the banking account itself. 

For example, all customer interactions can be categorized into event classes that incorporate monetary and nonmonetary actions such as: payment events — financial transactions such as funds transfers and bill payments; login events — IP address and session ID profiling; password events — changes in logon passwords; profile events — changes to customer demographic information; and navigation events — changes to how a customer navigates an online portal. A break in pattern of one of these may not indicate fraudulent activity. However when monitored together, the identification of small anomalies becomes a strong predictor of criminal intent.

Anand also recommends that banks monitor across multiple transaction channels, because fraudsters are gaining access through one channel, then maneuvering across many "silos" within the bank where banks are not connecting the dots. 

Banks and financial institutions need to explore enterprise fraud management systems that take a full view of an institution's relationship with a customer. An enterprisewide approach protects institutions at multiple levels, from identity theft to deposit fraud. This expanded view allows institutions to better detect and prevent fraud by monitoring transactions and events across the range of customer activity.

Yes, this takes effort and expense, and experts who know what they're doing. Unfortunately, "experts who know what they're doing" are exactly what bank security systems are trying to fight. There's no lack of brainpower among criminals, notwithstanding the lack of moral scruples. Banks can't afford to be behind the curve.

As I said a couple of days ago, it's certainly understandable why smaller banks spend a lot of time gnawing their fingernails to the quick about these types of threats and the expertise and expense required to combat them. On the other hand, you can't be in the banking game today unless you offer online banking to consumers and businesses, and you can't offer online banking unless you are prepared to provide sufficient security to meet your regulatory and legal obligations. Well, you can, actually, but you won't be doing it for long. Either the criminals, your regulator, or the outward stampede of customers will fairly quickly put you out of business.

You can find out more about these type of threats to online banking (and others), and how to deal with them, in tomorrow's webinar from Bank Law Stuff, "Online Banking Security: Corporate Account Takeovers, Electronic Money Mules and How to Protect Your Customers."

As the former CEO of a community bank told me over lunch not long ago after we discussed a case of cybercrime that cost a certain community bank a tarnished reputation, "Am I glad I retired when I did. Banking is getting to be such a pain in the a** that I just wouldn't want to be starting all over again today."

I could have told him that the same could be said about bank lawyering, but since most bankers (like most other citizens of this country) don't consider lawyers to be actual "human beings" worthy of sympathy, I kept my mouth shut and just nodded my head sympathetically.

Bashing the FDIC: It's Not a Pastime, It's a Way of Life

Ever since one of New Mexico's largest home grown community-focused banks, Charter Bank, was seized by the FDIC last year, the New Mexico Business Weekly has been all over the FDIC. Not in the way Monica Lewinski was all over Bill Clinton while they inhabited the White House, but more like the way B-29s were all over Tokyo in the spring and summer of 1945. Last Friday's target was one that has enraged the easily enrageable for some time now: FDIC loss-sharing agreements with the acquirers of failed banks. Once again, Charter Bank's situation was used as the focal point of some negative commentary about the arrangements, and the acquirer of Charter Bank's assets and deposit liabilities (and owner of the "new, improved" Charter Bank), Texas-based Beal Financial Corp., was also in the cross hairs.

“We are probably the best capitalized bank in the state,” Charter Bank of Albuquerque President and CEO Robert Bonnet said recently.

The reason for Charter’s strong standing, though, is in part due to the financial assistance it received and continues to have access to from the Federal Deposit Insurance Corp., in the form of guarantee on loan losses it might incur.

[...]

The FDIC has agreed to reimburse the new Charter up to 80 percent of its losses on $805 million in loans it acquired from the old bank. If Charter loses more than $274 million on those loans, the FDIC will absorb 95 percent of those additional losses, said Charter CFO Bruno Ienni. Three days after it assumed the assets and liabilities of the original Charter, the new entity was sent $89.1 million by the FDIC in a wire transfer, Ienni said. That $89 million represents differences between the liabilities (deposits) and assets (loans) purchased by the new Charter. The bank’s parent company, Beal Financial Corp. of Plano, Texas, put $97 million in fresh capital into the new bank. The FDIC calls that $89 million “cash amount due to acquirer.” “When an open financial institution acquires or assumes the liability for a failing institution’s deposits, the FDIC as insurer reimburses it for the amount of insured deposits,” says the federal agency’s handbook on bank closures. In the first quarter, Charter claimed just under $1 million in loss share money, Ienni added.

Yes, that's the way these deals work. The FDIC first has to "fill the hole" between the amount of liabilities assumed and assets taken, then has to provide some loss protection on the riskier assets taken. Otherwise the acquirer would never take the insured deposits, which the FDIC doesn't want to have to pay off, and the FDIC would have to liquidate the assets itself. It's required by law to enter into a loss sharing arrangement like this one only if it determines that it's less than the cost of liquidation. The basic templates for these transactions haven't really changed substantially for decades, although they are tweaked as circumstances change. None of this seems unusual or unexpected to anyone who's been in the banking business for more than ten minutes.

Nevertheless, many members of the public are "outraged" at the very thought these acquirers are receiving a "windfall" of "big money" from the public coffers. For bankers, however, whose assessments fund the FDIC, if these deal structures lower ultimate losses to the FDIC from failed banks, they're all for them. That's especially true for "strategic bidders" that are existing well-capitalized financial institutions that use these deals to enter new markets or enhance existing market share more cheaply than they otherwise could. If, as some of the more extreme anti-FDIC pundits have been warning, the FDIC eventually needs a taxpayer bailout, using loss-sharing to lessen FDIC losses will also be good for the taxpayers.

That said, the newspaper picks up on an angle that steams many bankers who are trying to work through troubled times and save their franchises. That's the fact that "open bank assistance" is not on the FDIC's current menu.

It is financial assistance the FDIC won’t and can’t legally give to troubled banks, except if the bank is deemed too big to fail.

[...]

It’s those loss sharing agreements the FDIC can offer to buyers of closed banks, but not to shareholders of troubled banks, that have riled some banking experts.

New Mexico bank consultant Joe Badal says the loss share agreements basically mean that no, or very few investors, will put money into a bank that is under a federal regulatory order. That’s because any investor who did pour capital into a troubled bank would be in line to lose it to loans gone bad, writedowns and federal regulators who, any day, could close a bank and “sell” it to another entity.

Investors simply cannot obtain the guarantee on losses that someone who acquires a bank from the FDIC has.

“Why would anybody buy a bank on the open market when you could get one, assuming you could work a deal with the FDIC?” Badal said. “I’ve talked to some investors in town, and they say there is no way they would buy a bank on the open market when they could wait and get an 80/20 split with the FDIC.

“It’s flabbergasting, it’s unbelievable and it’s an absolute boondoggle,” Badal added.

As I've explained above, I don't think it's flabbergasting at all. Nevertheless, I feel Joe's pain. So does the director of the New Mexico Financial Institutions Division, Bill Verant, a regulator who agrees with Badal that investors won't invest in a troubled bank when they can wait until it fails and get loss-sharing from the FDIC. He also yearns for open bank assistance.

What bothers Verant, a 45-year veteran of the banking business who went through the savings & loan crisis of the late 1980s and early 1990s, is that the FDIC and other federal regulators aren’t doing what was once called ‘open bank assistance.’ It offered financial aid to troubled banks, instead of closing and selling them.

“Back in the olden times, when they set up the Resolution Trust Corporation during the S&L crisis, they did entertain open bank assistance. They could allow a new controlling interest or partnership to come in and buy a controlling interest and not close the bank and leave the the shareholders in place,” Verant said.

“I thought that was going to be part of what would be going on in the current situation, and I thought that, with the Troubled Asset Relief Program [TARP], they would take troubled assets out of banks and put them in ‘warehouses’ and use TARP funds to buy troubled assets, but they used TARP money to buy General Motors.”

That last zinger doesn't hit the FDIC, but it does hit the White House squarely on the chin. I've never met Mr. Verant, but I think I'd like him.

The article accurately points out that Congress changed the law in the 1990s to prevent the FDIC from granting open bank assistance if the existing shareholders would benefit. In almost every case where they aren't completely wiped out by the transaction, that will be difficult to achieve, and if they are wiped out, why would they approve the deal? There are some exceptions to this requirement, but none likely to occur for "too-small-to-save" community banks, or, for that matter, for even a large regional player like the late Guaranty Bank of Dallas, which went down in flames and was sold to BBVA Compass, notwithstanding the fact that investors like Gerald Ford and Carl Icahn were willing to recapitalize the bank if the FDIC would have agreed to render open bank assistance.

As a matter of pure bureaucratic backside protecting, what's the upside to the FDIC in letting the bank remain open, giving it assistance, and then still have it fail at a later date?

<sound of crickets chirping>

I doubt that the FDIC will ever again determine that an open bank assistance deal is the least costly alternative. Neither does Verant, although he appears somewhat rueful about that fact.

Verant said there were scores of now-closed banks on the FDIC’s troubled bank list that could have benefited from open bank assistance “instead of having to have gone through the funeral.

“But the FDIC does not have the time to sort them out,” Verant added, “It decided to close them all and let God sort them out.”

Folks, that's likely one of the few times, and perhaps the only time, you'll see "FDIC" and "God" mentioned in the same sentence on this blog without the deity's name being taken in vain.