Bank Lawyer's Blog

Activist Investors Betting On Bank Mergers

2016-02-07T22:01:00-06:00

It appears that "activist" investors are turning to banks because they, like many of the rest of us close to the banking sector, think that there will be continued consolidation of the banking industry in the U.S., and what better way to make yourself some hard-earned profits than buying shares in a business and then pushing its board to sell the family farm so you can cash out. Some of you may remember that this model business plan was why the FDIC apparently soured on relying on "private equity" investors to help it clean up the mess after the last banking meltdown.

According to reporters in the St. Louis Post-Dispatch, "[a]ctivist investors are putting the U.S. banking sector in their crosshairs, betting that headwinds whipping through the industry will accelerate consolidation among lenders." The authors cite the rapid uptick in such "activist campaigns" in the financial sector last year, and observe that the "activists" are turning their attention from insurance companies and other non-bank financial businesses to commercial banks.

Hedge funds such as Ancora Advisors, Clover Partners and Seidman & Associates are buying up stakes in lenders across the U.S., from community banks to large regional lenders.

Driving these investments is the view that ultra-low interest rates, lagging returns on equity and tough regulations will push more banks to merge, with buyers willing to pay a hefty multiple to a bank’s tangible book value. Activist investors interviewed by Reuters say another factor is exposure to energy-related loans, which is driving down the valuations of certain banks and making them all the more vulnerable to a takeover.

“Bigger banks are back in the market doing deals,” said Ralph MacDonald, a partner at law firm Jones Day, who specializes in mergers and acquisitions.

U.S. bank mergers and acquisitions volume rose 58 percent last year to $34.5 billion, according to Thomson Reuters data.

The authors think that Zions and Comerica are likely targets. Both "Systemically Important Financial Institutions" had under performing returns on equity last year. That alone makes them prime targets for "activists."

The firm believes that any bank earning a 12 percent or less return on tangible common equity needs to consider whether it can prosper as an independent institution, PL Capital co-founder Richard Lashley said in an interview.

A bank’s exposure to falling energy prices makes it even more vulnerable, he noted. But another key factor is a bank’s ability to maneuver through a climate where low rates are compressing net interest margins, and stricter regulations are increasing costs.

“Management teams and boards are just exhausted,” said Lashley, who is based in New Jersey. “It’s not fun to run a bank anymore.”

However, the article also contains a quote from a community bank chief that indicates that the trend to consolidate is not just for SIFIs.

“My phones are ringing off the hook with calls coming in from banks wanting to sell,” said Pat Hickman, the CEO of Happy State Bank, a lender in the Texas panhandle. “And one of the primary reasons is regulation.”

Yes, it's not fun to run ANY bank anymore, not just the large ones. Whether your a big bank or a small one, publicly traded or privately held, pressured by "activist" investors or simply by the facts of life: as we said a few weeks ago, 2016 will very likely be the year of the bank merger.

The Underbelly Of The Mt. Holly Settlement

2015-05-28T22:04:00-05:00

The settlement of the Mt. Holly disparate impact case before it could be decided by the US Supreme Court were suspicious. At the time, it was thought by many that the US Justice Department had helped to engineer that settlement so that its (and HUD's and the CFPB's) use of that questionable doctrine in fair lending claims could continue for a while longer. The last thing the Feds wanted was for the SCOTUS to decide the matter, because they were worried (correctly) that it would strike down its use. At the same time, the banking industry wanted the SCOTUS to render a decision, because it thought that the court was more likely than not to strike down the doctrine's use in the fair lending context. The last thing that banks wanted was for the parties to the case to settle before the SCOTUS could render its decision (which is exactly what happened).

Recently, a rock has been overturned that has exposed a bunch of creepy-crawlers that work not for the federal government, but for the big banks that wanted the SCOTUS to rule in the Mt. Holly case. According to a former senior executive of Chase, that bank tried to get him to use his board position with a non-profit housing organization to "scuttle" the funding of the settlement. Moreover, the former executive, Wayne Trotman, at the time the mid-Atlantic market president of Chase, alleges that when he refused to breach his fiduciary duty as a member of the board of directors, the bank retaliated by firing him.

The fact that Mr. Trotman is an African-American adds not only to the radioactivity of the alleged wrongful conduct, but also substantial irony to those actions, if Mr. Trotman's allegations are true. While Chase counters that Trotman's claims are "baseless," Trotman's lawyers claim that they have "substantial evidence" to support them.

Obviously, the first thing that Trotman has to prove is that Chase pressured him to use his board position to scuttle the settlement. According to the linked article, which cites Trotman's Complaint, he claims that he was instructed to do so by Chase's Associate General Counsel, via email, even after he refused on the grounds that it would breach his fiduciary duty. The Complaint later states that another Chase attorney told him that he should not honor the request (which was also the position of his supervisor). Apparently, the ball started rolling in Jamie Dimon's office after he (and the heads of other large banks) received an email from Tim Pawlenty of the Financial Services Roundtable uirging the bankers to find ways to derail the settlement long enough for the SCOTUS to render a decision. There does not appear from the kinked article to be any order from Dimon that Trotman do anything, but, then, that's what subordinates are for: read the CEO's mind and "get 'er done" while retaining deniability for those residing at the top of Mt. Olympus.

The harder nut to crack for Mr. Trotman may likely be proving the causal connection between his decision to be an honorable man and not to breach his fiduciary duties, and his subsequent termination by Chase. It's impossible to determine that connection solely from the linked article, although I assume that the "substantial evidence" referenced by Trotman's lawyers indicates that they think that they can carry the water on that claim. The man worked for Chase for 19 years, received a "meets expectations" review shortly after the incident (although Chase substantially cut his bonus from the previous year, in which he received the same rating), then six months later received a mid-year performance rating of "poor" and was fired 14 days later without being provided an opportunity to improve. On its face, it looks like there might be fire with this smoke.

On the other hand, we haven't seen Chase's formal responsive pleading. In one press report, a Chase spokesperson told a reporter that Trotman 's position was eliminated in a "reorganization of markets." That spokesperson also claimed that Chase would "fight this in court." I guess that beats fighting it in the streets.

Obviously, it's too early to tell what the outcome of this lawsuit might be. The smart money in these situations is on a cash settlement with nondisparagement and confidentiality provisions in the settlement agreement, so that the "reputational risk" is mitigated and the whole sordid affair is swept under a rug.

Still. When it comes to picking a champion inducer of the gag reflex, it's often tough to choose between Big Banking and Big Government.

Poison "IvI"

2014-11-02T21:54:00-06:00

*Kevin LaCroix discussed a recent federal district court decision that adds to the number of court rulings that the "Insured versus Insured" (IvI) exclusion in banks' D&O insurance policies does not preclude officers and directors of a failed bank from making a claim for coverage under the policy based upon claims of the FDIC as receiver against them for their alleged acts and omissions as officers and directors of the bank. This issue has come to the forefront again as a result of the waive of (mostly community) bank failures following the economic collapse of 2008. As was the case in the previous wave of savings and loan and bank failures in the late 1980s and early 1990s, insurance companies have attempted to invoke the exclusion in order to deny liability, arguing that the FDIC as receiver "steps into the shoes of the failed bank."

(As a side note, my Contracts professor in law school asserted that insurance companies have a very simple business model: Collect Premiums. Deny Liability.)

Kevin explains the exclusion in the specific policy.

The IvI Exclusion provided in pertinent part that the policy does not provide coverage for any claim against an Insured “brought by or on behalf of any Insured or Company [including the Bank] in any capacity.” The exclusion had a carve-back that preserved coverage for “a Claim that is a derivative action brought or maintained on behalf of the Company by one or more persons who are not Directors or Officers and who bring and maintain such Claim without the solicitation, assistance or active participation of any Director or Officer.”

The insurance company in the case discussed by Kevin asserted that the IvI barred coverage for claims asserted by the FDIC since the FDIC was itself the "Insured." The judge denied the motion for summary judgment filed by the insurance company and granted the FDIC and defendants' motion of summary judgment on the basis that the exclusion was "ambiguous" and could not, therefore, be used as a basis to deny coverage.

Judge Guilford went on to note that “the insurance company has the ability, as a repeat party to these contracts, to ensure that ambiguities are eliminated over time.” The insurer “had the opportunity to make clear in the Policy that the IvI Exclusion applied to the FDIC-R, and it could have done so with a simple statement.” Judge Guilford noted that, in fact, the carrier “provides an optional regulatory exclusion – not included on the policy here – that explicitly names the FDIC.”

Without thrashing through the weeds in a manner that would interest lawyers rather than bankers (and the lawyers can read the opinion via the link provided by Kevin), the takeaways for officers and directors are as follows:

Read your policy and obtain professional, independent help to ensure that you understand it and that you get the best possible protection. As the court points out, the "regulatory exclusion" could have left the defendants high and dry if the insurance company had inserted it in the policy, Understand what could bite you in the nether regions and shop around if you have to.
Get the protection you need before you need it. Your best opportunity to obtain the most favorable policy will be when things are going swimmingly, not when you're taking on water faster than you can bail out the dinghy.
While the trend of court decisions appears to be in favor of the insureds and against the insurer on the issue of IvI in the context of FDIC receivership claims against former officers and directors, the issue is far from settled. Kevin points out that contrary rulings do exist (one in the Northern District of Georgia, one of the less favorable regions to be from if you plan to run a bank into a ditch) and that there appears to be questionable reasoning in some of the favorable rulings. Therefore, expect insurers to continue to litigate the issue until doing so will open the door to a can of whoop-ass sanctions and a complete failure to pass the lying-with-a-straight-face test.

*Photo's Source: Barrett Insurance Agency

Undue Process

2014-10-12T21:42:00-05:00

For Patrick Adams, justice has been both delayed and, now, denied.

Regular readers of this blog are familiar with Mr. Adams protracted fight with the OCC, and I won't regurgitate the history of the conflict. In my most recent post, I criticized the repeated failure of the Comptroller of the Currency to render a timely decision in the OCC's enforcement action against Mr. Adams as required by applicable law. An administrative law judge had determined that the OCC's enforcement action against Mr. Adams was not supportable on the basis of applicable law and the factual record, and the OCC had appealed the ALJ's decision to the Comptroller, who repeatedly extended the deadline for his rendering of a final decision, notwithstanding the fact that the applicable statute does not provide for such extensions.

On September 30th, the Comptroller rendered a decision in which he determined that the ALJ was completely wrong on the law and that even though the ALJ's finding of fact were "inadequate" for the Comptroller to be able to reach a "final findings of fact," they were sufficiently adequate for the Comptroller to allege (as he does on page 67) that a trier of fact could have determined that Mr. Adams should be sanctioned with civil money penalties. After spending 67 pages rejecting the exoneration of Mr. Adams by an independent trier of law and fact, the Comptroller then concludes that it is not going to send the matter back down to the ALJ in order to determine an "adequate basis" for a final finding of facts. Instead, the Comptroller dismissed the charges and sanctions against Mr. Adams in the exercise of his "plenary authority over remedies."

In other words, the ALJ was flat wrong and the defendant is guilty as initially charged, but what the heck: we made him spend hundreds of thousands of dollars to defend himself against charges that we weren't able to prove before an independent judge, he's been de facto ostracized from the banking business anyway, and we'd likely lose before an objective federal district court judge if we sanctioned him in final agency action, so why give him a reason to appeal?

Some former federal bank regulatory counsel have suggested to me that the OCC is twisting and spinning the official record in a CYA effort to impede a claim by Mr. Adams for his attorneys fees and costs as a "prevailing party" under the Equal Access to Justice Act. That may or may not be the case. What is clear is that there's an inherent flaw in a system that purports to afford due process to defendants but in which the prosecutor and judge are the same person. In such a system, the fairness of the outcome depends entirely on the personal and professional integrity of the ultimate decision-maker.

If this case proves anything, it proves that the system needs some serious legislative refinements.

More On A Higher Standard For Bank Directors

2014-09-01T21:59:00-05:00

Kevin LaCroix has some further thoughts on John Gorman's criticism of the proposal of FRB Governor Daniel Tarullo and certain academics that bank officers and directors should be held to a different (i.e., more stringent) fiduciary standard than officers and directors of other types of corporations. After discussing John Gorman's criticism of Tarullo's proposal (discussed here), LaCroix also discusses recent decisions by a federal district court judge in Georgia and the Georgia Supreme Court, the upshot of which is that while bank officers and directors (in Georgia, at least) are entitled to the protection of the business judgment rule, there may be some basis for holding them liable for ordinary negligence (as opposed to the higher "gross negligence" liability standard that is the "default" standard under FIRREA and the effective standard if the business judgment rule is applied). Kevin is concerned.

It should be emphasized that the academics’ proposal to hold bank directors to a higher standard was limited just to directors of systemically important financial institutions. I share the concerns John Gorman expressed in his American Banker article about this proposal. However, I have additional concerns, which is that there are already theories floating around that bank directors should be held to a different standard than directors of other companies, as shown by Judge Thrash’s remarks in the Buckhead Community Bank case. My concern is that if the idea were accepted that directors of systemically important banks should be held to have expanded fiduciary duties, the idea would quickly expand beyond just systemically important institutions and be applied to many , most, or even all bank directors, without regard to whether or not their institution is systemically important.

This was the same concern I expressed in my earlier post, and it's comforting to know that other observers share your concern about "trickle down" liability.

Kevin is particularly concerned about the spate of litigation directed against officers and directors of failed banks by the FDIC. The FDIC has been attempting to whittle away the business judgment rule wherever possible. The long-range implications are troubling.

There undoubtedly are meritorious lawsuits filed against bank directors, particularly where there is evidence of self-dealing or complete abdication of responsibility. Just the same, the overall level of litigation aimed at bank directors is both excessive and socially inefficient, particularly with respect to the litigation that so often follows after banks’ failures. So often the failed bank lawsuit allegations consist of little more than scapegoating and hindsight second-guessing. Creating a liability regime that would encourage further litigation and expand the potential liabilities of bank directors would accomplish little except enlarging the litigation burden that prospective directors would have to consider before accepting a seat on a bank board.

There is no question that prospective directors of financial institutions (especially community banks) have to think long and hard about the potential liability before agreeing to accept a board seat. For an increasing number of otherwise qualified candidates, the decision may be that if you don't have "a dog in the hunt" (a substantial financial investment in the bank), the benefits of being on the board do not outweigh the risks if (God forbid!) "something bad happens."

Tarullo Intrigued

2014-08-10T21:57:00-05:00

John Gorman wrote commentary in the American Banker last week that ought to add to community bank directors' already high level of angst. Gorman discussed a recent speech by Fed Governor Daniel Tarullo, in which Tarullo spoke favorably of a paper by two law school professors (the road to hell is paved with such papers) in which the good professors argue that directors of too big to fail banks should be held to a higher fiduciary duty than bank directors are held today. The focus of the professors was on the implied duty of "board oversight" of bank operations. The professors' paper "proposed board oversight responsibility for the level of risk-taking by an institution, and the application of a simple negligence standard to this board responsibility."

Shareholder loss and/or systemic harm in the traditional sense — decline in stock price or bankruptcy, for example — would not be required for a stockholder to sue the board. Rather, the triggering event would be a "significant loss" at the firm resulting from an alleged breach of a board's risk oversight responsibilities. (The example given is the $6 billion "London Whale" trading loss incurred by JPMorgan Chase.) Judges would determine if the board-approved risk management processes, including its assessment of the appropriate level of risk and potential risk outcomes, were reasonable. This broadened fiduciary duty would apply only to those firms "capable of imposing systemic loss."

As Gorman points out, the duty of "oversight" is an adjunct to the duty of loyalty rather than the duty of due care. The business judgment rule (discussed here) generally protects directors from judicial second-guessing as long as they aren't "grossly negligent." As it has been previously interpreted in most jurisdictions, the duty of oversight does not generally provide a sustainable basis for a claim of breach of fiduciary duty unless the directors of the bank , in effect, simply ignored red flags. The professors want to change all that for systemically important financial institutions.

Gorman notes the problem with this approach.

Broadening a board's fiduciary responsibilities with respect to risk oversight would expose a board to liability for good faith judgments as to risk management, and would require boards to function in a management capacity. This would be expensive and inefficient, and would undoubtedly discourage capable persons from serving on bank boards. It will also ultimately be ineffective — risk and adverse risk outcomes cannot be eliminated, just as the business cycle has not and cannot be eliminated. Altering the fiduciary duty of oversight to require board "ownership" of risk management, would merely provide a prima facie basis for the filing of a lawsuit against many boards. As we know from the current corporate litigation environment, shareholder lawsuits that are not dismissed are settled (the risk that a judge or jury will rule against them and impose personal liability, is one that a board absolutely will not assume), and the primary beneficiaries of legal settlements seem to be the attorneys.

Many community bank directors who read this might be tempted to shrug it off. After all, if the enhanced duty of oversight applies only to the systemically important, why should I worry? Because as experience informs us, these heightened duties inevitably trickle down to the rest of the banks, even the "too small to save." And it is a director of the too small to save that is most at risk of the FDIC pursuing litigation against him or her if the bank fails. The too big to fail don't fail. Their directors may face litigation from shareholders, but they've got the policy coverage and financial heft to protect the directors. Community bank directors don't have that near certainty. The only certainty they have is that if failure occurs, the FDIC will push every theory available to find a breach of fiduciary duty and a pot of gold at the end of the D&O policy rainbow.

It's nice that Mr. Tarullo is intrigued by this new theory. However, let's hope that his attention span is short and that his focus soon turns elsewhere. Like to regulatory relief, for example.

Shaming The Shameless

2014-07-27T21:52:00-05:00

While we're sure it's merely a coincidence, hot on the heels of the letter that Rep. Pete Sessions sent to the Treasury Department's Inspector General that complained about the repeated failure of the Comptroller of the Currency to issue a final decision in the case of Patrick Adams, the Comptroller raised his middle finger to the requirements of 12 USC 1818(h) issued yet another extension of the deadline to issue a final decision, this time extending the date of decision from August 13 to September 30. As one observer pointed out, at least this time the Comptroller gave himself a deadline to issue a final decision. Whether he "sticks to it" remains to be seen.

Mr. Adams' plight has generated some interesting email. Customarily, private practitioners are most harsh in their indictment of the sort of cavalier nose-thumbing at the requirements of federal law by those whose job it is to enforce it that we've seen demonstrated in this case. However, former enforcement attorneys, such former OCC attorney Robert Serino, whose concerns about Mr. Adams were highlighted in the post linked above, have also expressed their displeasure with the way the regulator has ignored the requirements of fundamental fairness (and, as noted above, the deadlines set by federal statute). One former regional counsel for a federal bank regulatory agency wrote to complain about the "shameless arrogance" displayed by the federal government in this case and to assert that in his decades both in government service and on the other side of the table from the government, he had "never seen any type of enforcement action instituted against an individual that remotely resembles the OCC action against Mr. Adams."

Frankly, neither has anyone else with whom I've spoken about Patrick Adams, including former OCC counsel. It's not only questionable conduct, it's almost inexplicable. I say "almost," because after decades of my own experiences with federal regulatory attorneys and enforcement personnel, and after some of the spittle spewed my way in the last few years in reaction to blog posts by a couple of Erik Dorfs currently at home in the bowels of the Mother Ship, nothing much really surprises me anymore.

Due Process: Delayed And Denied?

2014-06-29T21:52:00-05:00

In November of 2012, an administrative law judge recommended that all charges brought by the Comptroller of the Currency against Patrick Adams, the former CEO of Dallas-based T-Bank, be dismissed. As we noted at that time, the road to vindication for Mr. Adams was long, hard, and expensive. What's shocking to us is that the long road is still not finished for Mr. Adams, notwithstanding the fact that ALJ found against the OCC on every one of its allegations, and, more critically, that although 12 CFR 109.40 provides that the Comptroller "shall render a final decision within 90 days after notification of the parties that the case has been submitted for final decision" (final submission was in early April 2013), the Comptroller has failed to render such a decision. Instead, the Comptroller has extended the 90-day period four times, most recently in May of this year, despite, according to a former OCC Deputy General Counsel who helped draft the OCC's enforcement procedures, no apparent authority to do so.

The troublesome nature of this process was recently discussed by attorneys Jerry Buckley, Robert Serino and Ann Wiles in an article for Consumer Financial Services Law Report. As noted in the opening paragraph, "Mr. Serino was formerly deputy chief counsel of the Office of the Comptroller of the Currency and established that agency’s enforcement program." Thus, their comments are not merely the rantings of a man once described by a reporter for a trade press rag as "a Texas curmudgeon." They are expressions of concern by people with knowledge of the process, one of whom had a hand in crafting the process that's being abused.

While focusing on general concerns in addition to Mr. Adams' specific case, the authors spend time discussing Adams' situation because, as they put it, it highlights the need for "additional procedural protections" to protect an individual facing enforcement action by a federal banking agency. They do a good job of running through the sequence of events, and the various facts that concerned the ALJ prior to making his decision, so I won't reiterate all of them. You can (and I encourage you to) read them in the linked article. At this point, the most disconcerting injustice to me is the failure of the Comptroller to issue a final decision "despite a statutory requirement to do so within 90 days."

But others would argue that the case against Mr. Adams highlights a lack of procedural protections for individuals who may suffer significant reputational harm, damage to their careers, and significant expense in defending themselves, only for it to be ultimately found that an enforcement action was not warranted.

By "others," the authors can include me and other bank regulatory attorneys I've heard from on this matter, including other former federal bank regulatory agency attorneys who are now in private practice. They can also include Texas Representative Pete Sessions, Chairman of the US House of Representatives Rules Committee, who, on June 20, 2014, sent the Inspector General of the Treasury Department a letter that requests an investigation by the IG into the handling of Mr. Adams' case.

It's irrelevant what OCC supervisory and enforcement personnel think of Mr. Adams. What's critical to the functioning of a process that claims to be "due" and "fair" is that the rules be followed by the government. A regulatory body that seeks to enforce the law but fails to follow it lacks credibility. The members of that agency who fail to follow the law deserve an Inspector General's investigation and any consequences to them that result. If that view engenders more anonymous troll-like hate mail that threatens me with regulatory retaliation and violates federal law, as was the case the last time I criticized the OCC, then I'll risk it.

The ALJ determined that the charges should not have been brought. We all realize that the OCC likely doesn't agree with that determination, but the Comptroller could have issued a decision within 90 days that decided not to follow that ruling. Then, Mr. Adams could have appealed that decision and had a resolution. Instead, by failing to follow its own rules, the OCC keeps the man in limbo indefinitely. Under whose sense of fundamental fairness is this appropriate? Vladamir Putin's?

I'll close with the same paragraph I used in my November 2012 post on this subject, because I still wonder where the government's lawyers who are involved in this matter stand. Do they really think that this is the way to handle this? Do they really think that this is fair and reasonable?

As I've contended previously, with great power comes great responsibility. When you have the power to ruin an individual's life, you need to make damn sure that you're doing "the right thing" before you start down that road. I don't see any concern with that "aspirational goal" in this case.

On the other hand, I think it's always useful for both government attorneys and those who oppose them to keep in mind the following ethical consideration, which, though "aspirational" in nature and part of the since-replaced Model Code of Professional Responsibility, embodies what the legal profession has long held to be proper conduct by those lawyers who wield the power to wreak havoc on the lives of the regulated:
EC 7-14 A government lawyer who has discretionary power relative to litigation should refrain from instituting or continuing litigation that is obviously unfair. A government lawyer not having such discretionary power who believes there is lack of merit in a controversy submitted to him should so advise his superiors and recommend the avoidance of unfair litigation. A government lawyer in a civil action or administrative proceeding has the responsibility to seek justice and to develop a full and fair record, and he should not use his position or the economic power of the government to harass parties or to bring about unjust settlements or results.

Is Vendor Risk Scoring Mandatory?

2014-05-12T22:11:00-05:00

Notwithstanding the insistence of some inside and outside the federal regulatory agencies that regulatory "guidance" is not "mandatory," the cautious banker knows better. The headline in today's American Banker (paid subscription required) screamed, "Risk-Scoring Mandate Pushes Banks to Rethink Vendor Choices."

The word "mandate" may be thought a tad strong by some, and downright wrong by others. After all, the article referred primarily to OCC Bulletin 2013-29, which is officially merely guidance. However, as we've asserted repeatedly on this rag, a bank that doesn't treat guidance as mandatory is a bank with a strong streak of masochism.

The specific alleged "mandate" that reporter Penny Crossman is that banks "risk score" their vendors.

What regulators have been asking in their latest round of vendor management guidance is a far more detailed scrutiny of vendors: of their financial stability, debt, revenue, profitability, their cost structure, and product strategy, among other things.

In the past, a large, well-known vendor may have been a safe choice, but regulators are now saying it's no longer enough to choose a vendor because it's a market leader. They want to be presented with a scorecard that lets them review how banks evaluate their vendors in a consistent way.

"The regulators are forcing banks to sit down and say 'what if. if this vendor goes away, what are the risks to you?'" says Lawrence Kaplan, of counsel at the Washington, D.C., law firm Paul Hastings.

Along those lines, Bulletin 2013-29 also specifically provides that a long-standing relationship with a vendor does not negate the requirement that the bank do the "required" due diligence and evaluation on that vendor as it would on any comparable vendor, and make certain that it engages in ongoing monitoring of that vendor in an objective fashion. Familiarity shall not breed comfort, is apparently the regulators' motto.

As Crossman points out, there's no one-size-fits-all risk scoring model. I've seen several, any one of which appeared to do the trick. However, it appears that some sort of numerical risk-scoring is becoming the rule rather than the exception for banks.

The regulators haven't even explicitly said banks must assign each vendor a numerical score, though they have implied it.

"Unfortunately a score for each vendor is an unstated expectation," says Paul Reymann, a partner at McGovern Smith Advisors in Washington.

[...]

"Examiners want to know how you went through that methodology," Reymann says. "How you measure that could be with numbers, 0 to 100, or red, yellow and green indicators."

Among the factors that could be included in such a model, the article mentions financial viability, ownership, scalability (ability to grow with the bank), concentration risk (vendor failure affecting a large number of banks), and compliance risk (can you say "online tribal payday lending? I knew that you could!"). Those are only a few. Consultant Walter Taylor has come up with a list of 30 of them. Obviously, the risk assessment becomes more important as the vendor becomes more "critical" to the bank, but the basic risk scoring ought to be done on all vendors to justify to examiners how you rated the vendor and why you made the decision to retain them (if you did).

A couple of quotes struck home, because they mirror my own experiences.

It's not that you can't use a startup, but the management of the bank will have to justify it to the board, which will have to justify to the regulators why they're using Larry's ATM Machines rather than Diebold," Kaplan says. "What benefit do we get out of that and why are we better off, other than price? It's going to be a critical issue."

[...]

"If you've got three people in a garage doing some type of real-time processing for you with deposits or credit cards, that's crazy," Taylor says."

It's not pretty when the bank officer's buddies, who, literally, are three guys in a garage (with a heck of a neat software code they've developed), have their spare balance sheet and income statement reviewed by the green eye-shades on the vendor oversight committee, who respond with a variation of "You're kidding us, right?"

With all the other stuff banks have to worry about, vendor management may seem like it ought to be small potatoes. It's not. If you treat it that way, you'll dodge the bullet for awhile, right up until the instant it carves a canoe in your skull. Vendor management is serious business these days. Take it seriously.

When Curry Speaks, All Banks Should Listen

2014-04-17T21:45:00-05:00

The Comptroller of the Currency Thomas Curry gave a speech the other day (paid subscription required), and emphasized a couple of points that vendor management folks at financial institutions with various charters--state and federal, bank and credit union--and the lawyers who represent them, would be wise to heed.

Comptroller of the Currency Thomas Curry said his agency is increasingly concerned about the cybersecurity risks from banks relying too much on certain vendors and using service providers in foreign countries.

Banks can end up becoming dependent on certain vendors because of consolidation in the service provider industry, Curry said in his prepared remarks for the Consumer Electronics Show's Government Summit in Washington. They can also be exposed to risks when they assign critical functions to outside vendors, including those that use foreign-based subcontractors.

"Banks need to consider the legal and regulatory implications of where their data is stored or transmitted, and make a determination as to whether geographic limitations are needed in their contracts," Curry said. "Finally — and perhaps most importantly — we are concerned about the access third parties have to large amounts of sensitive bank or customer data."

Here are a few take-aways:

First, cybersecurity due diligence of your vendor assumes critical importance when that vendor has access to customer data and other sensitive information of the institution. Access to sensitive information ought to make that vendor a "critical" vendor regardless of the dollar "value" of the contract. The institution needs to be able to document that it examined the information security procedures and systems and found that they met industry standards.

Second, the provisions of the agreement between the institution and such vendors on confidentiality and information security need to be "robust." This is especially critical when one or a couple of vendors of the institution have access to a lion's share of sensitive data. Read OCC Bulletin 2013-29, FFIEC's handbooks on the outsourcing of technology services, and other regulatory guidance. Make sure you know what contractual assurances you need and then make sure they're in the agreement.

Third, the financial institution needs to monitor the compliance of these vendors with information security safeguards throughout the life of the relationship. If a critical vendor's not providing an annual SASE 16 audit report of an appropriate type (SOC 1 vs. SOC 2), and not addressing problems raised by such annual reviews, you've got a problem.

"We expect the board and management to ensure that appropriate risk management practices are in place, that clear accountability for day-to-day management of these relationships is established, and that independent reviews of these relationships will be conducted periodically," Curry said in his remarks Wednesday.

That's a red flag, no?

Fourth, you need to read between the lines of what Curry's saying about "certain vendors." Pay attention to what's happening in the marketplace. If an article appears in the press that notes problems with a critical vendor, investigate and assure your self that any problems are being addressed. Review the web sites of the regulators for enforcement actions, and pay attention to what you find if a vendor is the subject. Pay attention to your own due diligence. If you gather necessary information but don't act upon it appropriately, your regulator will not be pleased.

Fifth, foreign subcontractors have become a "hot button" concern. I would recommend that in your vendor agreements with critical vendors you have adequate restrictions on the use of subcontractors. Among those restrictions ought to be that the use of a non-US based subcontractor requires your prior written consent. I represent banks that would never consent, but that's a story for another day.

If the vendor pushes back, that vendor ought to be a cause for grave concern. They're not doing you a favor by selling you their technology, although a few of the larger ones act that way, especially if you're a smaller institution. These concerns are regulatory concerns, matters of safety and soundness. If the vendor is large and representing a number of financial institutions, none of these issues should come as surprise to them. If you have concerns about a vendor, give your federal regulator a call and tell him or her about those concerns. As Curry makes clear, your regulator will be interested. Very interested.