On January 21, the Federal Financial Institutions Examination Council (FFIEC) issued a statement announcing best practices for financial regulatory oversight agencies whenever requesting examination information from supervised entities.
Five Key Principles Were Identified
- Information requests should be risk-focused and relevant to the examination.
- Supervised institutions should be given sufficient time to produce new or additional requested information.
- Examiners should coordinate information requests among the examination team to avoid duplicative and/or redundant requests.
- Information requests should be made through the supervised institution’s designated regulatory examination point-of-contact, if applicable, to avoid placing the burden on other institution staff.
- Information requests and supplemental information requests should be clearly articulated in writing.
The statement of principles released by the FFIEC represents the completion of the final phase of the Examination Modernization Project, initiated in response to a review of regulations under the Economic Growth and Regulatory Paperwork Reduction Act. The FFIEC released two previous updates on the Examination Modernization Project on March 22, 2018, and November 27, 2018.
Designated Regulatory Examination Point of Contact
Possibly the core principle of examination management begins with a designated point-of-contact. This is likely true from both the supervision perspective and the regulated entities perspective. Clear communications and the tracking of requests and request submissions between the two designated point-of-contacts is only possible if requests are primarily managed at the top level. A supervised financial institution should clearly relay to the supervising regulatory entity the designated point-of-contact. In certain circumstances, such as areas with specific technical expertise, sub-teams within the financial institution may be the more appropriate point of direct contact. But such exceptions should be strategically rare, as there are long-proven benefits for designating a single and accountable gatekeeper overseeing the in-flow and out-flow of requests and submission of requests at the examination level.
Examination Team Coordination
The regulatory examination process can be burdensome for a financial institution. The FFIEC points out that examination efficiency can be achieved with coordination among examination team members and information requests. This coordination on the part of the examination team is designed to eliminate or minimize possible duplication of requests. A strong centralized request process on the financial institutions’ part can play a part in the process of eliminating duplicative requests. By tracking requests at the point-of-contact, the examination team can be notified when a duplicate request has been submitted, referencing for the examination team the previously submitted request, and hence appropriately allocating examination resources.
Requests in Writing
Verbal requests for information, whether over the phone or as a result of a meeting, have the possibility of a misunderstanding between the ask and the result. Are you asking for the requests in writing? For example, I have worked with one particularly seasoned individual who often serves as the designated point-of-contact on examinations. The point-of-contact places an “in-box” and an “out-box” on their desk. The examiners are instructed to drop requests off in writing in the in-box and return periodically to determine whether the request has been fulfilled by checking the out-box. All requests must be submitted in writing in this process and little verbal communication, if any, regarding the request takes place. And as a consequence, with this known protocol in place, fewer mistakes are made and misunderstandings are greatly minimized.
It is key for financial institution personnel who are responsible for managing the regulatory examination process to diligently track requests and the submission of requests. This process requires a centralized system with the supervised institution’s point-of-contact closely coordinating with the regulatory examination’s team point of contact these same requests.