0. Institute of International Bankers
Annual Seminar on Regulatory Examination, Risk Management and Compliance Issues:
Examination Perspectives
October 29-30, 2007
ADVISORY
Discussion Notes:
To be added
Hugh C. Kelly
Partner, National Lead Bank Regulatory Advisory
KPMG LLP
Washington, DC

1. Lesson from the sub-prime crisis – Don’t forget how quickly contagion can threaten enterprise solvency and increase systemic risk
(Delphi)

2. It is important to understand your exposure to regulatory risk…
It is important to understand your exposure to regulatory risk….and proactively manage it
Failure to understand
impact of regulation and
determine risk appetite
Weak/inadequate risk management processes to manage regulatory risks and detect failures
Continued weaknesses
Loss of confidence from consumers/rating agencies/regulators
Increased capital requirements imposed by regulators
Warning from Home//Host
regulators
Regulatory fines/ consumer litigation
Loss of license/Close down of business by parent

3. Evolution of U.S. Bank Examinations – Current themes
Risk-Based Supervision
More dynamic than ever before
Supervisory strategy includes both on-site exams and off-site analysis
Increased focus on the Bank’s formal Risk Assessment process, including:
Safety & Soundness risks – Credit, Market, Liquidity, Operational Risks
AML / BSA / OFAC compliance
Other Compliance areas
Examiners are benchmarking ERM, Operational Risk Management and Internal Audit processes
Must assume your U.S. regulators have close communication and information-sharing arrangement with your Home Country regulators
Watch Basel II’s Pillar it will be challenging for both banks and banking supervisors …

4. Basel II: Pillar 2 Supervisory Review -- Role of The Supervisors
Pillar 2 Main Goals
Bridge gap between capital requirement and remaining risks
Focus on adequacy of risk management and capital planning process
Direct regulatory assessment of risk not discretely measured in Pillar 1: Interest Rate, Liquidity, Concentration, Reputation, Strategic Risks
Consequence 1
Consequence 2
Consequence 3
Main Goals:
Bridge gap between minimum capital requirement and remaining risks
Enhancement of risk management methods for the supervision and control of banking risks
Regulator assessment by, on the quality of banks’ risk estimation and capital planning
Consequence 1 - Dialogue between banks and regulators.
Consequence 2 - Banking supervision will have a quantitative as well as the existing qualitative orientation.
Consequence 3- Structuring of the regulatory supervision into four main principles:
Principle 1: Banks should have a process for assessing their overall capital adequacy
in relation to their risk profile and a strategy for maintaining their capital levels.
Principle 2: Supervisors should review and evaluate banks’ internal capital adequacy
assessments and strategies, as well as their ability to monitor and ensure their
compliance with regulatory capital ratios. Supervisors should take appropriate
supervisory action if they are not satisfied with the result of this process.
Principle 3: Supervisors should expect banks to operate above the minimum
regulatory capital ratios and should have the ability to require banks to hold capital in
excess of the minimum.
Principle 4: Supervisors should seek to intervene at an early stage to prevent capital
from falling below the minimum levels required to support the risk characteristics of a
particular bank and should require rapid remedial action if capital is not maintained or
restored.
Strength of Pillar 2 in the US – historically, the US bank agencies have been a lot stronger in this area than other countries.
Bank and regulator dialogue
Quantitative, as well as existing qualitative assessment
Regulatory discretion over capital level

5. Enterprise Risk Management, Monitoring & Control
Evolution of U.S. bank examination expectations – Risk-Based Supervision, Basel II, ERM and Operational Risk Management
Financial Reporting
Operational Risk
Credit Risk
Compliance
Liquidity Risk
Market Risk
Board Oversight
Enterprise Risk Management, Monitoring & Control
Transparency
“Large banks assume varied and complex risks that warrant a risk-oriented supervisory approach. Under this approach, examiners do not attempt to restrict risk-taking but rather determine whether banks identify, understand, and control the risks they assume.”
Large Bank Supervision, Comptroller’s Handbook

6. Execution, Monitoring, & Correction
Other Examination Themes: The “three lines of defence" principle as a cornerstone of ERM
1st line
2nd line
3rd line
Role:
Daily Risk Management,
Execution, Monitoring, & Correction
Indpt Oversight,
Analysis,
Monitoring, &
Reporting
Testing,
Validating &
Line Management
Risk Management &
Compliance
(Internal) Audit
Audit Committee

7. Other Examination Themes: Operational Risk Management
The Basel II regulatory definition of Operational Risk is: “The risk of loss resulting from inadequate or failed people, processes, systems or external events”
Thus, Operational Risk implicitly includes the risk of loss associated with:
Failures in compliance processes (the consumer, AML/BSA, PATRIOT Act, fiduciary, broker-dealer compliance overlap)
Information security failures (the GLBA overlap)
Financial reporting errors or failures (the SOX overlap)
Lapses in overall internal control systems (the FDICIA overlap)
Traditionally, banks have managed these operational and compliance risks in silos
Today, spurred by Basel II, banks and their examiners are focusing on a more enterprise-wide approach to operational risk management leading to:
More convergence of risk & control assessments, reviews and reporting processes
Better identification of “horizontal risks” and “emerging risks”
More holistic focus on new products, activities and business strategies
Facilitate discussion around question. Click again to display bulleted list.

8. Other Examination Themes: Integrated Operational Risk Management
People
Processes
Key Elements:
Enterprise OpR vision and policy
Executive champion
Consistent methodology for risk identification, assessment, measurement & reporting
Clarity of roles, responsibilities, key interfaces and reporting infrastructure for the “three lines of defense”
Model
Validation
New Product assessment & approval
Compliance
AML**
Business Continuity
SOX
Operational Risk Management
Vendor
Management
Information
Security
Event/Issue
Management
Change Risk
Management
Systems
External Events

9. U.S. Bank Examinations – How to be Proactive
Identify a branch “point of contact” for all examination logistical issues and requests
Have substantive and frequent communications with your examination team and their bosses
Keep records of all contacts with the examiners
Maintain an “Examination Issues Tracking” process
Consistently adhere to a “no surprises” doctrine with respect to the regulators
Emerging problems
New products, activities and strategies
Change in key staff or management
Regularly introduce visiting Head Office managers to the regulators
Keep up with changing U.S. regulatory developments and issues
Industry meetings
Fed / NY State / OCC works-shops
3rd party regulatory summaries (e.g., KPMG’s The Washington Report)
Maintain current Policies and Procedures – “do not let them collect dust”

10. "All of life is the management of risk,
Final Words….
"All of life is the management of risk,
not its elimination."
Walter Wriston *
* Soon after assuming the presidency, Walter Wriston built Citibank into the U.S.’s second largest bank in terms of total assets. His willingness to pioneer by pursuing and investing in new technologies and going into areas where others wouldn't tread -- or had tread and faltered -- was how this man truly revolutionized American and global banking. It was under his watch that Citibank became an innovator in technology by introducing some of the first automatic teller machines in the nation. He also pursued the credit card business in a way that no other bank was doing at the time.

11. KPMG Knowledge Leadership and Contact
Basel Briefing – Aimed at risk management professionals, this 11th edition of the Basel Briefing covers a range of topics relevant to Basel II preparations, from expected losses in operational risk to data reporting protocols for banks
The Washington Report -- This weekly federal regulatory and legislative newsletter provides updates on current issues impacting the U.S. financial services industry
Hugh Kelly, Partner
National Lead for Bank Regulatory Advisory Services – Safety & Soundness
KPMG LLP