Institute of International Bankers Annual Seminar on Regulatory Examination, Risk Management and Compliance Issues: Examination Perspectives October 29-30, 2007 ADVISORY Discussion Notes: To be added Hugh C. Kelly Partner, National Lead Bank Regulatory Advisory KPMG LLP Washington, DC

Lesson from the sub-prime crisis – Don’t forget how quickly contagion can threaten enterprise solvency and increase systemic risk http://quote.bloomberg.com/apps/news?pid=10000006&sid=aO.Ek0E2iqpI&refer=home (Delphi) http://online.wsj.com/article/SB118407355028062073.html?mod=todays_us_money_and_investing

It is important to understand your exposure to regulatory risk… It is important to understand your exposure to regulatory risk….and proactively manage it Failure to understand impact of regulation and determine risk appetite Weak/inadequate risk management processes to manage regulatory risks and detect failures Continued weaknesses Loss of confidence from consumers/rating agencies/regulators Increased capital requirements imposed by regulators Warning from Home//Host regulators Regulatory fines/ consumer litigation Loss of license/Close down of business by parent

Evolution of U.S. Bank Examinations – Current themes Risk-Based Supervision More dynamic than ever before Supervisory strategy includes both on-site exams and off-site analysis Increased focus on the Bank’s formal Risk Assessment process, including: Safety & Soundness risks – Credit, Market, Liquidity, Operational Risks AML / BSA / OFAC compliance Other Compliance areas Examiners are benchmarking ERM, Operational Risk Management and Internal Audit processes Must assume your U.S. regulators have close communication and information-sharing arrangement with your Home Country regulators Watch Basel II’s Pillar 2 --- it will be challenging for both banks and banking supervisors …

Basel II: Pillar 2 Supervisory Review -- Role of The Supervisors Pillar 2 Main Goals Bridge gap between capital requirement and remaining risks Focus on adequacy of risk management and capital planning process Direct regulatory assessment of risk not discretely measured in Pillar 1: Interest Rate, Liquidity, Concentration, Reputation, Strategic Risks Consequence 1 Consequence 2 Consequence 3 Main Goals: Bridge gap between minimum capital requirement and remaining risks Enhancement of risk management methods for the supervision and control of banking risks Regulator assessment by, on the quality of banks’ risk estimation and capital planning Consequence 1 - Dialogue between banks and regulators. Consequence 2 - Banking supervision will have a quantitative as well as the existing qualitative orientation. Consequence 3- Structuring of the regulatory supervision into four main principles: Principle 1: Banks should have a process for assessing their overall capital adequacy in relation to their risk profile and a strategy for maintaining their capital levels. Principle 2: Supervisors should review and evaluate banks’ internal capital adequacy assessments and strategies, as well as their ability to monitor and ensure their compliance with regulatory capital ratios. Supervisors should take appropriate supervisory action if they are not satisfied with the result of this process. Principle 3: Supervisors should expect banks to operate above the minimum regulatory capital ratios and should have the ability to require banks to hold capital in excess of the minimum. Principle 4: Supervisors should seek to intervene at an early stage to prevent capital from falling below the minimum levels required to support the risk characteristics of a particular bank and should require rapid remedial action if capital is not maintained or restored. Strength of Pillar 2 in the US – historically, the US bank agencies have been a lot stronger in this area than other countries. Bank and regulator dialogue Quantitative, as well as existing qualitative assessment Regulatory discretion over capital level

Enterprise Risk Management, Monitoring & Control Evolution of U.S. bank examination expectations – Risk-Based Supervision, Basel II, ERM and Operational Risk Management Financial Reporting Operational Risk Credit Risk Compliance Liquidity Risk Market Risk Board Oversight Enterprise Risk Management, Monitoring & Control Transparency “Large banks assume varied and complex risks that warrant a risk-oriented supervisory approach. Under this approach, examiners do not attempt to restrict risk-taking but rather determine whether banks identify, understand, and control the risks they assume.” Large Bank Supervision, Comptroller’s Handbook

Execution, Monitoring, & Correction Other Examination Themes: The “three lines of defence" principle as a cornerstone of ERM 1st line 2nd line 3rd line Role: Daily Risk Management, Execution, Monitoring, & Correction Indpt Oversight, Analysis, Monitoring, & Reporting Testing, Validating & Line Management Risk Management & Compliance (Internal) Audit Audit Committee

Other Examination Themes: Operational Risk Management The Basel II regulatory definition of Operational Risk is: “The risk of loss resulting from inadequate or failed people, processes, systems or external events” Thus, Operational Risk implicitly includes the risk of loss associated with: Failures in compliance processes (the consumer, AML/BSA, PATRIOT Act, fiduciary, broker-dealer compliance overlap) Information security failures (the GLBA overlap) Financial reporting errors or failures (the SOX overlap) Lapses in overall internal control systems (the FDICIA overlap) Traditionally, banks have managed these operational and compliance risks in silos Today, spurred by Basel II, banks and their examiners are focusing on a more enterprise-wide approach to operational risk management leading to: More convergence of risk & control assessments, reviews and reporting processes Better identification of “horizontal risks” and “emerging risks” More holistic focus on new products, activities and business strategies Facilitate discussion around question. Click again to display bulleted list.

Other Examination Themes: Integrated Operational Risk Management People Processes Key Elements: Enterprise OpR vision and policy Executive champion Consistent methodology for risk identification, assessment, measurement & reporting Clarity of roles, responsibilities, key interfaces and reporting infrastructure for the “three lines of defense” Model Validation New Product assessment & approval Compliance AML** Business Continuity SOX Operational Risk Management Vendor Management Information Security Event/Issue Management Change Risk Management Systems External Events

U.S. Bank Examinations – How to be Proactive Identify a branch “point of contact” for all examination logistical issues and requests Have substantive and frequent communications with your examination team and their bosses Keep records of all contacts with the examiners Maintain an “Examination Issues Tracking” process Consistently adhere to a “no surprises” doctrine with respect to the regulators Emerging problems New products, activities and strategies Change in key staff or management Regularly introduce visiting Head Office managers to the regulators Keep up with changing U.S. regulatory developments and issues Industry meetings Fed / NY State / OCC works-shops 3rd party regulatory summaries (e.g., KPMG’s The Washington Report) Maintain current Policies and Procedures – “do not let them collect dust”

"All of life is the management of risk, Final Words…. "All of life is the management of risk, not its elimination." Walter Wriston * * Soon after assuming the presidency, Walter Wriston built Citibank into the U.S.’s second largest bank in terms of total assets. His willingness to pioneer by pursuing and investing in new technologies and going into areas where others wouldn't tread -- or had tread and faltered -- was how this man truly revolutionized American and global banking. It was under his watch that Citibank became an innovator in technology by introducing some of the first automatic teller machines in the nation. He also pursued the credit card business in a way that no other bank was doing at the time.

KPMG Knowledge Leadership and Contact Basel Briefing – Aimed at risk management professionals, this 11th edition of the Basel Briefing covers a range of topics relevant to Basel II preparations, from expected losses in operational risk to data reporting protocols for banks The Washington Report -- This weekly federal regulatory and legislative newsletter provides updates on current issues impacting the U.S. financial services industry Hugh Kelly, Partner National Lead for Bank Regulatory Advisory Services – Safety & Soundness KPMG LLP 202-533-5200 hckelly@kpmg.com