CCAR and DFAST - Looking Ahead for 2018
Summary of Results
The 2017 Comprehensive Capital Analysis and Review (“CCAR”) results released this June by the Federal Reserve (“Fed”) marked several new milestones. For the first time in CCAR’s seven year history, all 34 bank holding companies (“BHC’s”) with more than $50 billion in assets passed and exceeded the Fed’s quantitative requirements. Only one firm, Capital One, was required to resubmit its capital plan to address weaknesses in their capital planning process. In 2017, Fed results revealed on the aggregate, a 1.7% increase on common equity tier 1 (“CET1”) capital over the previous year. Most firms fared well exceeding post stress minimums and being better capitalized. Thirty firms exceeded traditional capital measures by greater than 1.0 percent with 11 out of 15 firms exceeding the new supplementary leverage ratio by 1.0 percent or more.
The Fed moved to a new direction this year, exempting 21 less complex institutions covered under SR 15-19 from public qualitative review. A more private review and feedback process has been planned. In another first, all 13 complex institutions covered by SR 15-18 passed CCAR’s qualitative requirement, with Capital One receiving a conditional non-objection and resubmission. (Note: The word “passed” is the verb in the sentence)
A summary of 2017 Dodd Frank Act Stress Test (“DFAST”) results details significant strides in pre- provision net revenue (“PPNR”) and global market shock and counterparty losses. Aggregate DFAST PPNR under stress rose by $34 billion contributing to overall improved results from 2016. At the same time, losses from global market shock and counterparty positions fell by 24% or $34 billion resulting from more aggressive scenario assumptions relative to the previous year. Mixed results were evident in the banks’ performance on loan loss rates, with about 25% experiencing higher overall losses in 2017 versus 2016.
Shortfalls - The Good, the Bad, and the Ugly
By all measures, CCAR and DFAST have achieved remarkable strides
in strengthening the largest banking institutions capitalization post-2008 crisis. But based on the Fed’s extensive feedback for the 2017 stress testing cycle, the work is far from complete. Large and complex firms were cited to have fallen short of supervisory expectations in four key areas: risk identification, model risk management, data quality, and internal audit.
The Fed had cited in its June 2017 CCAR review that several firms have not adequately identified risks particularly emerging from new products or changes in underwriting standards. Risk identification has evolved into being viewed by regulators as more than a once-a-year stress testing requirement into an integral part of banks’ comprehensive enterprise risk management process. Risk identification is seen in broader terms, as foundational to the effective operations of banking institutions. Going forward, best practices will require institutions to develop a risk inventory that categorizes risk events in more specific versus generic terms. A case in point is the area of cybersecurity risk, which takes on many sub-types, each necessitating different responses. A comprehensive risk inventory allows for more robust scenario forecasting, critical to the capital planning process.
MODEL RISK MANAGEMENT ("MRM")
The Fed’s horizontal examinations, assessments on common areas of practice (i.e. internal audit) across multiple firms, revealed shortfalls around MRM controls by SR 15-18 firms. The scope of MRM standards is expected to expand to non-stress testing models. Institutions would be wise to enhance and strengthen independent model validation processes, together with implementing strong model governance, policies, and oversight. Best in class institutions will be those that achieve a well-integrated model development, validation planning, and execution framework. Rising regulatory expectation calls for moving the focus away from compliance on process requirements and towards more collaborative dialogue between modelers and business groups.
Despite improvements on data quality and integrity since CCAR’s inception, several participants still struggle with manually intensive processes for data gathering. The availability and reliability of key data are often inconsistent. Formatting of data to align with Fed formats compels banks to deploy hundreds of staff to meet CCAR deadlines and requirements. Clearly, banks have no other choice but to make the necessary investments to automate and harmonize data to meet regulatory requirements. Not only will investments in automation help in streamlining the stress testing process but benefits can be realized with the integration of overall bank operations. Efficiencies can translate to cost reductions and profit generation.
The most recent hype on data automation has centered on the use of robotic algorithms and machine learning analytics. Machine learning has been heralded for data cleansing and model validation. Other notable tools are in natural language processing (“NLP”) for less costly and more efficient data capture of physical loan documents and robotic processing automation (“RPA”) for data reconciliations. However, the challenge of integrating these new tools onto legacy systems will be a constant issue.
The Fed has continued to maintain high expectations for institutions and cited weaknesses in internal audit programs in its 2017 CCAR review feedback. Internal audit groups are expected to perform a critical oversight role in the capital planning process and to sustain a robust internal controls framework. With increased pressure from both bank boards and regulators, internal audit continues to face challenges on many fronts. Juggling auditing in real time while executing CCAR submissions with tight deadlines provide for a difficult environment. Building teams with stature and expertise across a wide range of complex products combined with a strong audit background, can be daunting. One particular area cited by the Fed points to the need for internal audit to “up their game” in the area of MRM. The historical focus relied heavily on compliance instead of model validation policies and policies. What the Fed has made clear is the need for enhanced governance, requiring not only performing an independent model testing review but likewise, providing a more vigilant role in challenging and escalating issues.
What’s in Store for 2018
The Trump Administration appears hell-bent in keeping its campaign promise of deregulation. The Fed's appointment of Randall Quarles and the recent Senate confirmation of Jerome Powell as Chairman of the Federal Reserve, are largely considered an affirmation of expected regulatory easing. Pundits view both as pro-business given their stints as former partners at private equity firm, The Carlyle Group.
Stress testing in the near term has been predicted to become more transparent and possibly less complex given recent legislation in Congress to dismantle Dodd-Frank reform. But predicting the direction and extent of changes of regulatory requirements remain valid concerns.
The most immediate threat to stress testing is the recent Congressional approval of The Financial Choice Act (“FCA”) of 2017. The bill managed to pass last June 2017 across party lines but with uncertain prospects to pass Senate approval. The FCA contains provisions that would allow banks to do capital distributions, stock repurchases, and buy-backs if they meet the 10% leverage ratio threshold based on stress test results. Currently, regulators can veto capital distributions if the banks don’t meet minimum capital requirements. Another significant item widely lobbied by the banks, is the provision on public disclosure of underlying stress test scenarios. As former Fed Governor Daniel Tarullo pointed out in his April 2017 farewell address at Princeton University, public disclosure may encourage increased correlations in asset classes among larger banks, leading to industry-wide systemic risks during severe market downturn. Disclosure can lead to banks having the ability to “game” the process by shifting to assets with lower loss function around the stress testing period to optimize their balance sheet.
There has been no indication in the easing of standards from the Fed based on the 2017 CCAR review. On the contrary, regulators are publicly calling for more rigor in sustaining robust internal controls and embedding the stress testing process as a foundational framework for doing business.