Examiner Guidance: ASSESSING CAPITAL ADEQUACY Background These guidelines presume that the bank maintains adequate asset quality reserves, including the Allowance for Loan and Lease Losses, and that examiners consider the quality of credit risk management in assessing reserve adequacy. Evaluation of asset quality and transfer risk on cross border transactions, when appropriate, should be considered in assessing capital adequacy. Examiners should determine whether additional capital is needed to support interest rate, foreign exchange rate, fiduciary, and operational risks; as well as other risks identified as significant. In reaching those conclusions, examiners should assess the quality of risk management and the current level of risk for each risk area. Examiners should rate the quality of risk management as GOOD, IN NEED OF IMPROVEMENT, or INADEQUATE. In addition, the level of risk will be rated as LOW, MEDIUM, or HIGH. Examiners should also assess the effect of specific concentrations on capital levels. Other factors considered in evaluating capital adequacy include the overall quality of senior management and board supervision, the bank's strategic direction, and the level of compliance risk. I. QUALITY OF RISK MANAGEMENT The following ratings should be used to assess management quality. A. GOOD MANAGEMENT These banks have comprehensive risk management policies and systems. Management demonstrates both an understanding of the sources and levels of exposure and the ability to measure and control it. To determine if management is GOOD, consider if: * The bank has well defined written policies that address responsibility, authority, limits, compliance responsibilities, and contingency plans. The policies must be approved by the board of directors, which reviews and updates them regularly. * The bank complies with its policies, unless a properly documented and approved exception is granted in accordance with policy. * Procedures for policy implementation are stated clearly and are followed. * The level of acceptable risk exposure is defined. Limits have been adopted and are reviewed periodically by the board. * The identification of and measurements of risk are clear and appropriate for the bank's risk characteristics. All major sources of exposure are captured, including those arising from materially significant subsidiaries and operating units. * Risk measurements express exposures in terms compatible with the risk limits. * Management Information Systems (MIS) data are accessible, timely, and accurate; internal controls, internal and external audit coverage, and contingency plans are in place and are effective. * The bank has established a process to address new products and services. * Senior management is well informed and has access to the information necessary to make sound decisions. * Senior management has assigned adequate resources to the measurement and management of relevant risk. * Risk managers understand the nature of the risk area, maintain up-to-date knowledge of external factors affecting it, and can effectively manage the level of risk. * Those responsible for identifying and controlling risks and implementing decisions are properly trained. * Management acts decisively to control or mitigate a situation when excessive risk or adverse trends are identified. * Management implements appropriate corrective action when deficiencies are identified. B. MANAGEMENT IN NEED OF IMPROVEMENT These banks possess the basic elements of good risk management, but must devote additional resources or efforts to improve their risk management practices. Management has the ability, and has demonstrated the willingness, to make the necessary corrections. To determine if management is IN NEED OF IMPROVEMENT, consider if: * Policies exist, but are unwritten, incomplete, out dated, or have not received board approval or periodic review. * Policies are neither followed consistently, nor are exceptions properly documented or approved. * Procedures for policy implementation are not stated clearly, are not comprehensive, or are not followed consistently. * The level of acceptable risk exposure has not been established clearly, nor has clearly defined limits. * Risk measures do not capture all major sources of exposure. * Risk measurements do not express exposures in terms compatible with the risk limits. * The MIS produces only limited data where accessibility, accuracy, and timeliness need improvement. * Internal controls, internal and external audit coverage, or contingency plans need enhancement. * The risk assessment process to address new products and services is deficient or is not followed. * Senior management is neither well informed nor has access to the information necessary to make sound decisions. * Additional resources and effort must be devoted to the measurement and management of the relevant risk area. * Risk managers do not understand completely the nature of the risks, are limited in their ability to manage the risks effectively, and do not routinely maintain current knowledge of external factors affecting the risk area. * Training is sometimes deficient for those responsible for identifying and controlling risks and implementing decisions. * Management does not always act decisively when excessive risk is identified. * Management does not routinely correct identified deficiencies. C. INADEQUATE MANAGEMENT These banks have serious deficiencies that management may be unable to correct. Risks may not be understood, recognized, managed, or controlled. To determine if management is INADEQUATE, consider if: * Formal policies do not exist, are incomplete, or are out dated. Existing policies are not followed. * Implementation procedures are missing, incomplete, or are not followed. * Management has not established the level of acceptable risk exposure nor has it established risk limits. If limits exist, they are not followed. * The bank does not measure risk, significant exposures are omitted, or measurement methods are undefined. * Data produced by MIS are not accessible, timely, or accurate. * Serious weaknesses exist in internal controls, internal and external audit coverage, or contingency plans. * The risk assessment process to address new products and services is nonexistent or needs clarification. * Senior management is neither properly informed nor has the information necessary to make sound decisions. * Resources devoted to measuring and managing relevant risk are deficient, and management has not demonstrated a commitment to make the corrections required to improve risk management. * Risk managers do not understand the nature of the risk, cannot manage it, or do not know the external factors affecting the risk area. * Those responsible for identifying and controlling risks and implementing decisions are not adequately trained. * Management is unable or unwilling to mitigate or control risks. * Management is uncooperative or unwilling to correct deficiencies. II. LEVEL OF RISK Interest Rate Risk Interest rate risk is a complex risk. There is no standard approach to define, measure, or control it. Appropriate risk management systems will vary among banks. The use of sophisticated computer models will not necessarily imply good risk management, nor will their absence indicate that management is inadequate. To be rated as GOOD, management should measure and limit risk in terms of: (1) the exposure to capital from the institution's longer term positions, and (2) earnings at risk from historic cost accounts (net interest income) and, when engaged in trading activities, investment risk from accounts carried on a market value basis. Foreign Exchange Rate Risk Assessment of management should include a review of the risk measurement systems. It should determine that systems quantify risk in terms of the earnings at risk and the effect of risk on the bank's economic value. Fiduciary Risk Fiduciary activities should be managed by a capable, well trained staff versed in trust and securities law and in trust investments, and supported by adequate resources. Their performance should comply with written policies and procedures and their planning should accompany innovations in fiduciary services. Operational Risk Key to the assessment of operational risk is the planning and implementation process for ongoing, new, or the expanding products and services. Written policies, procedures, contingency plans, and backup systems must be reviewed. A. INTEREST RATE RISK ASSESSMENT All banks assume interest rate risk in their normal banking operations. Often they undertake interest rate risk to enhance profitability. Interest rate risk, however, can introduce volatility to the bank's economic value and its earnings. Exposure to interest rate risk may be viewed from two different, but related, perspectives: The "economic perspective" focuses on the sensitivity to the economic value (market value of portfolio equity) of the institution. The values of most financial instruments change with interest rates. These changes in value can be particularly large for long-term fixed rate instruments. The "earnings perspective" views interest rate risk as the exposure to reported earnings. This includes: (1) the exposure to net interest income arising from repricing imbalances among historic cost accounts, and (2) the exposure to changes in market values of instruments carried on a market valuation basis. For additional information on these two topics, see the OCC staff paper entitled, An Overview of Interest Rate Risk dated December 1989. Risk Levels In assessing the level of interest rate risk for capital adequacy, examiners should focus on exposures that can seriously impair capital value. Often they arise from longer term positions that may not pose a risk in the near term. The "economic perspective" best identifies and evaluates this type of exposure. Examiners and bank management should not, however, ignore the "earnings perspective." Earnings exposure should be considered by examiners when assessing the stability of future earnings that contribute to capital. Such an assessment is relevant to determining whether the bank can maintain capital at adequate levels in the future. Measurement of the market value exposure of portfolio equity can be complex. However, management is expected to assess any significant exposures arising from long-term fixed rate positions and to understand the risks inherent in the bank's product mix. The bank's interest rate risk is not merely the risk inherent in individual products. An evaluation of bank activities is required. Various levels of interest rate risk may occur as follows. To determine if the level of interest rate risk is LOW, consider if: * The bank has limited exposure to interest rate changes. * The bank's business mix generates few repricing imbalances. * Long-term fixed rate assets comprise a small portion of the balance sheet and are funded with liabilities that have similar repricing characteristics. * Existing interest rate exposure is hedged prudently. * Trading activity in longer term instruments is limited or nonexistent. * The bank holds neither large pools of derivative mortgage products or mortgage-backed securities, nor long-term off-balance sheet interest rate contracts. * The volume of off-balance sheet commitments is moderate, and they do not amplify repricing imbalances. * The bank's off-balance sheet commitments are hedged prudently. To determine if the level of interest rate risk is MEDIUM, consider if: * The bank has a moderate exposure to interest rate changes. * Some small longer term repricing imbalances exist. * Fixed rate loans, mortgages, derivative mortgage products, mortgage-backed securities, and long-term securities do not represent a significant portion of the balance sheet (or if they do, they are hedged effectively or matched-funded). * The bank's portfolio does not contain any high risk mortgage backed securities as defined in BC 228. * Trading in longer term instruments is not substantial. * Options and long-term swaps are limited and used only as hedging vehicles. * The volume of off balance sheet commitments is low, but they amplify repricing imbalances. * The bank has a high volume of off-balance sheet commitments, which are only partially hedged. To determine if the level of interest rate risk is HIGH, consider if: * The bank exhibits significant exposure to rate changes. * The bank's business mix generates significant longer term repricing imbalances. * Fixed rate assets significantly exceed fixed rate funding sources. * The investment portfolio is sizeable and funded primarily with short-term borrowings or deposits. This portfolio contains concentrations in longer maturities (beyond five years), mortgage-backed securities or derivative mortgage products that are not effectively managed, hedged. * The bank's portfolio contains high risk mortgage-backed securities as defined in BC 228. * The bank has large, unmatched options, or long-term swap positions. * The bank has either large trading positions in long-term instruments or allows individuals to create large positions that speculate on future interest rate movements. * Short-term positions are vulnerable to rate swings, and the bank lacks flexibility to compensate for adverse rate movements. * The volume of off-balance sheet commitments is moderate, and they amplify repricing imbalances. * The bank has a high volume of off-balance sheet commitments, which are not hedged. Management of banks whose focus is limited to near term earnings exposure may fall into the INADEQUATE category. These banks generally must broaden the scope of their measurement and limit systems to include exposures from longer term positions that could potentially threaten the market value of portfolio equity. Bank management may be rated as IN NEED OF IMPROVEMENT when their risk measurement and data systems have lagged behind their growth or increasing complexity. External or internal models may contain deficiencies that significantly impair their effectiveness. B. FOREIGN EXCHANGE RATE RISK (Applicable only to banks with foreign exchange positions) Foreign exchange rate risk is the risk incurred by a bank that has on- and off-balance sheet positions denominated in foreign currencies. These positions are exposed to movements in foreign exchange rates. Movements may result from customer dealing activities, market making activities, strategic positioning, or structural exposures (investments, capital). Banks with substantial open foreign exchange positions should hold additional capital to support these risk exposures. Risk Levels To determine if the level of foreign exchange rate risk is LOW, consider if: * The bank's foreign exchange activity is limited to handling requests from corporate customers or covering foreign currency positions arising from other bank business (e.g., foreign currency denominated loans, deposits, and investments). * Active trading for the bank's own account is limited. * Intra-day and overnight positions are small and limited to major, liquid currencies. * The bank does not engage in forward market activity, except to cover forward foreign currency exposure. * Currency options are used only for hedging. To determine if the level of foreign exchange rate risk is MEDIUM, consider if: * The bank engages in some foreign exchange trading activities, but the potential earnings effect of its open risk positions (both intra-day and overnight) is minimal. * The bank takes small positions in the spot market in major currencies. * Activity in the forward market, currency options, and cross-currency interest rate swaps is limited. To determine if the level of foreign exchange rate risk is HIGH, consider if: * The bank runs large open risk positions (both intra-day and overnight) that have a potentially major effect on earnings. * Trading activities historically have affected overall bank earnings significantly. * The bank is an active market maker in numerous currencies, including less liquid currencies, in the spot market; the long-dated forward market; the written currency options market; or the cross-currency interest rate swap market. C. FIDUCIARY RISK Fiduciary risk may result from: * Processing services -- fiduciary accounting and recordkeeping; asset custody and control; fiduciary tax preparation; participant recordkeeping; asset custody; securities trade processing system reconcilement and control; securities lending processing; mutual fund processing; global custody processing; and transfer agent functions. * Investment Management -- individual accounts; collective investment funds (particularly GIC funds, real estate and other illiquid asset funds); securities trading and lending; closely held business management; and mutual fund advisor. * Fiduciary Administration -- estate settlement; living and testamentary trusts; employee benefit trusts (including ESOP's and master trusts); trustee for LBO's/securitized assets; and bond indenture trustee. Processing services support investment management and fiduciary administration. Thus, processing problems may result in both operational and fiduciary risks. Processing system weaknesses can affect: the timeliness of investment decisions; reliability of customer information; safety and control of fiduciary assets; and the ability to incorporate new products and services, as well as future growth. Fiduciary service wholesalers offer advanced processing and investment management services to other financial institutions. The complexity of those services and the number of institutions employing them increases risks to the wholesalers and their users. Risk Levels To determine if the level of fiduciary risk is LOW, consider if: * The bank offers only basic personal trusts and estate services. * The bank does not ordinarily engage in more complex products, such as employee benefit and bond trusteeships. * The bank has a stable or low fiduciary growth pattern. * Traditional investment strategies are used primarily with low risk assets (U.S. Governments, insured deposits, blue chip stocks). * The bank generally employs a nationally recognized vendor to provide operational support. * Wholesalers of complex fiduciary services are not often used. To determine if the level of fiduciary risk is MEDIUM, consider if: * Greater emphasis is placed on developing new fee-based products and services. * The bank expands fiduciary activity beyond traditional personal trusts and estates. * The bank competes in markets that require specialized knowledge, such as employee benefit and bond trusteeships. * Products offered include private label mutual funds, specialized collective funds, or sophisticated processing services, and other institutions act as fiduciary service wholesalers for these products. To determine if the level of fiduciary risk is HIGH, consider if: * The bank has experienced rapid fiduciary growth or has made radical changes in fiduciary management. * Fiduciary activities are consolidated into a larger, more complex operation or are disbursed throughout the organization. Either makes oversight more critical and difficult. * Consolidation of fiduciary functions, or imprudent cost cutting to reduce overhead, has resulted in insufficient operational or administrative capabilities. * The bank offers more complex products and services, such as private label mutual funds, securities lending, or asset securitization involving the fiduciary department. * The bank is a fiduciary product wholesaler, offering asset management, processing or other services to other institutions. * Processing services include global custody or mutual fund accounting. * Nonbank affiliates provide support services, such as investment management and discount brokerage. Affiliate officers or employees may be unfamiliar with fiduciary laws and principles and take excessive risks to enhance investment performance. * Investment strategies tend to involve more complex techniques that emphasize nontraditional, higher risk vehicles. * The bank is involved in fiduciary litigation exposing it to significant risk of loss. D. OPERATIONAL RISK Operational risk is the risk of bank loss because of its failure to process a transaction properly. The failure may be caused by inadequate controls, employee error or malfeasance, a breakdown in the bank's computer system, or a natural catastrophe. Operational risk is inherent in every bank service, whether accepting a deposit, paying a check, disbursing a credit, processing a loan payment, operating an automated teller machine, or providing wire transfer services. Banks that provide specialized and more complex services, and high volume transaction processing, incur greater operational risks and normally should maintain higher capital. Risk Levels Operational risk rises with an increase in the number and complexity of transactions processed, including those completed for outsiders, the size of those transactions, and insurance coverage deductibles. It falls when processing services are contracted and limits of insurance coverage are maximized. To determine if the level of operational risk is LOW, consider if: * The bank processes limited basic banking services, such as routine deposit, lending, and collection services. It offers only minimal custodial and wholesale or correspondent services. * The growth of new accounts is modest and conforms to plan. * The bank is a net user of transactions processing by outside institutions. * Insurance coverage is adequate, with low deductibles and high limits. To determine if the level of operational risk is MEDIUM, consider if: * The bank processes varied banking products and moderately complex services, and participates in an automated clearing house system. * Account activity, transaction processing requirements, and the aggregate volume of transactions are higher than average for a bank of its size. * The growth of new services and new accounts is moderate. * The bank provides processing for other institutions. * Insurance coverage is adequate, with low deductibles and high limits. To determine if the level of operational risk is HIGH, consider if: * The bank processes broad specialized and complex activities, including highly sophisticated products and services with complex and high volume transaction processing requirements. Examples are mortgage or student loan servicing operations; agent services for large loan and bond syndications; and significant wire transfer activities. * The bank provides complex financial or extensive processing services to other institutions, such as the operation of a credit card sales-draft processing center. * The growth of new services and new accounts is rapid. * Insurance coverage is not sufficient to cover higher risk operations. E. CONCENTRATION RISK The size and type of concentrations in a bank may affect its condition significantly. When assessing capital adequacy, the extent and nature of concentrations must be determined. Concentrations depend upon a unique characteristic and, when weaknesses develop in that characteristic, each loan in the concentration may be adversely affected. Most banks exhibit concentrations that require additional capital. Geographic Concentrations exist when the bank derives a significant portion of its business from a specific market. The bank is exposed to a market's economic fluctuations, even if it diversifies its sources of revenue, lending, and investment throughout that market. A bank that operates in a smaller geographic market may find it harder to diversify against significant exposures and serve its community. Therefore, those banks probably should hold more capital. Industry Concentrations involve one borrower, an affiliated group of borrowers, or borrowers engaged in or dependent upon one industry. A concentration may result from the acquisition of a volume of loans from a single source, despite the diversity of the individual borrowers. Loans concentrated in one source are centered mainly in and predicated on, the financial capability and character of the individual or entity. Loans centered in an affiliated group are susceptible to a domino effect if one or a few group members experience financial problems. Dominant Industry Concentrations also occur in banks located in towns economically dominated by one or several businesses. Those banks typically grant a substantial percentage of their loans to those businesses and their employees. Heavy unemployment could result from the curtailment of operations, if other job opportunities are nonexistent, and pose a serious threat to the economy of the entire town. The bank should be aware of the loans of businesses, such as local merchants, that rely heavily on those dominant companies. Foreign Concentrations involve extensions of credit to a foreign government, its agencies, and majority-owned or controlled entities. Credit to specific private enterprises may be included in such concentrations if an interrelationship exists in the form of guarantees, moral commitments, significant subsidies, or other factors that suggest dependence on the public sector. F. OTHER CONSIDERATIONS An assessment of capital adequacy should not be limited only to the specific risks listed in this paper. Examiners may determine that other factors are relevant. Such factors will vary from bank to bank and circumstances within each. Among the most common are examiners' assessments of the quality of senior management and board supervision, the possible consequences of strategic planning, transfer risk, and compliance risk. Overall Management and Board Supervision Quality The quality of senior management and board supervision is essential to an assessment of capital adequacy. When serious deficiencies exist in senior management or board supervision, examiners may determine that the bank should hold capital above the level suggested in their assessments of the specific risks. Conversely, examiners may determine that a lower level of capital is adequate when senior management and board supervision is strong. Strategic Direction A bank's strategic direction can indicate potential for significant changes in its risk profile. Capital must be sufficient to support the level of risk likely to result from implementation of the bank's strategic plan. Often the bank's strategic direction will suggest that no more capital is needed than is determined appropriate to support the bank's inherent risks. In such banks strategies for expansion in diverse activities may reflect their strengths and weaknesses. They may also have sound plans to ensure capital adequacy. Banks that pursue an expansive strategy may need additional capital: * To support the effect of new activities and acquisitions. * When expansion is rapid or occurs in activities where high earnings volatility can be expected. * When a bank attempts to compete in businesses or markets where it lacks strong management skills and experience or does not have an inherent competitive advantage. Compliance Risk Compliance risk and its management must be considered when assessing capital adequacy. This assessment should be sensitive to the risk of capital dissipation because of reimbursements, restitutions, fines, asset forfeitures, and civil or criminal liabilities. Bank earning power can also be eroded by potential adverse publicity. FOR ADDITIONAL GUIDANCE Questions about assessing capital adequacy should be directed to the Chief National Bank Examiner's Office at 202-874-5170.