Our Take: financial services regulatory update - March 17, 2023
Change remains a constant in financial services regulation. Read "our take" on the latest developments and what they mean.
Current topics - March 17, 2023
- 1. Bank stress and responses continue
- 2. SEC issues cybersecurity proposals
- 3. On our radar
1. Bank stress and responses continue
Following the failures of Silicon Valley Bank, Signature Bank and Silvergate Bank and the subsequent actions by the banking regulators to instill confidence in the US banking system (see Our Take: Special Edition), the market and policymakers have continued to react. Notable actions this week include:
- Support for stressed banks:
- The Treasury Department, Fed, FDIC and OCC released a joint statement announcing that 11 banks have deposited $30 billion into First Republic Bank.
- Credit Suisse announced that it received a loan of approximately $54 billion from the Swiss National Bank, Switzerland’s central bank.
- The Fed’s most recent balance sheet release showed an additional $297 billion largely stemming from short-term loans. Banks took loans of approximately $12 billion from the Fed’s new Bank Term Funding Program and $152 billion from the discount window, while the bridge banks established by the FDIC earlier this week took $142 billion.
- Banks requested almost $90 billion from the Federal Home Loan Bank (FHLB) system on March 13th, a one-day record, culminating in nearly $250 billion in new FHLB borrowings by March 16th.
- Policy makers setting expectations and providing guidance:
- President Biden released a statement calling upon Congress to (1) expand the FDIC’s authority to claw back executive compensation to a wider range of banks than only the largest institutions; (2) strengthen the FDIC’s ability to bar executives from holding jobs in the banking industry; and (3) expand the FDIC’s authority to bring fines against executives.
- Treasury Secretary Janet Yellen testified before the Senate Finance Committee. In her prepared remarks, she stated that the US banking system is sound and bank customers can “....feel confident that their deposits will be there when they need them.” During questioning, she noted that uninsured deposits will not be protected absent a systemic risk determination, leading Sen. James Lankford (R-OK) to question whether community bank depositors in his state would be protected.
- Senate Banking Committee Chair Sherrod Brown (D-OH) released a statement urging banking regulators to (1) identify and close regulatory gaps, including those related to capital, liquidity, stress testing, concentration risk, and risk management; (2) hold those responsible for the failures accountable by clawing back bonuses and compensation; and (3) strengthen the guardrails for banks in order to prevent failures.
- The Financial Industry Regulatory Authority (FINRA) issued guidance to its member firms clarifying that deposits held at Silicon Valley Bank and Signature Bank may continue to be treated as allowable assets for net capital purposes. They also specified that funds held in Customer and PAB Reserve Bank Accounts at both banks may continue to be treated as qualified reserve bank account deposits.
Our Take
The actions this week from the government and the eleven banks are a show of force designed to instill market confidence and preserve stability in the US financial system. As the industry rallies and cooperates with the government to prevent a broader crisis, the policymakers are already turning to the diagnosis and treatment of what they determine to be the root causes of the crisis.
President Biden’s call to empower the FDIC appears to have support from Senator Brown, but it will take much broader agreement and significant deliberation to pass these policies through a divided Congress, particularly given the looming election cycle. In the short term, legislators are more likely to hold the regulators accountable for responsive changes to supervision. Senator Brown’s statement has kicked this off with a call to action for the regulators to exercise their existing authority to verify that all banks are operating in a safe and sound manner, including by adequately identifying, managing and controlling risks. Most immediately, we expect intensity and invasiveness of supervision – through the examiners in the field – to increase. Areas of focus will likely involve more frequent and detailed liquidity reporting, enhanced assessments of risk management practices, internal audit coverage as well as senior management and board oversight.
In parallel, we expect the regulators to revisit the previous Administration’s regulatory tailoring that had reduced the frequency and magnitude of requirements including those around capital adequacy (e.g., leverage ratios), total loss absorbing capacity and resolution planning. The regulators had already been indicating that they would raise expectations for large regional banks that had grown in recent years but the concentration of the recent stress will likely prompt a reevaluation of the regulatory scrutiny applied to banks with less than $250 billion in assets. In addition, given the potential origins of the recent bank failures, the regulators’ assessment will likely include liquidity ratios, risk management and reporting; the impact of accounting for unrealized gains or losses in securities portfolios; and requirements for interest rate risk management.
In terms of bank reactions, the high volume of Fed and Federal Home Loan Bank borrowing that has taken place over this week indicates that banks are not hesitating to take necessary action to shore up liquidity, but could be reflective of depositors continuing to change their bank relationships. Despite Secretary Yellen’s assurance of the safety of bank deposits, her clarification on uninsured balances could drive customers to find alternative safe havens for deposits in excess of the insurance limit during this time of uncertainty. Given the high degree of political risk and moral hazard, policymakers are presumably treading lightly to reassure the public while avoiding signaling that all uninsured deposits will be protected by the government.
2. SEC issues cybersecurity proposals
On March 15th, the SEC issued three proposals concerning customer data protection, cybersecurity risk management for broker-dealers, and amendments to Regulation Systems Compliance and Integrity (Reg SCI). It also reopened the comment period on a previous cybersecurity risk management proposal for investment advisers and funds.
- Customer data protection. The first proposal comprises amendments to rules under Regulation S-P, which requires registrants to protect and properly dispose of customer data. The amendments would require broker-dealers, investment companies and advisers to have policies and procedures around incident response programs to address unauthorized access to customer information. These institutions would also generally be required to notify customers whose sensitive information “was or is reasonably likely to have been accessed or used without authorization” no later than 30 days after becoming aware of the incident.
- Cybersecurity risk management for broker-dealers. The second proposal would apply new cybersecurity risk management requirements to broker-dealers, clearing agencies, major security-based swap (SBS) participants, the Municipal Securities Rulemaking Board, national securities associations, national securities exchanges, SBS data repositories, SBS dealers, and transfer agents (collectively, Market Entities). Under the proposal, Market Entities would be required to implement – and review at least annually – policies and procedures “reasonably designed to address their cybersecurity risks” and prevent unauthorized access to information systems. Market Entities would also need to send the SEC “immediate written electronic notice of a significant cybersecurity incident” and publicly disclose information on such incidents would also need to be publicly disclosed on proposed Form SCIR.
- Amendments to Reg SCI. The third proposal on the agenda concerns amendments to Reg SCI that would expand the scope of entities subject to the regime and update certain provisions. The proposed amendments would expand the scope of Reg SCI1 to cover registered security-based swap data repositories, clearing agencies that are exempt from registration, and certain large broker-dealers. The amendments would also add new requirements for all covered entities to maintain a written system inventory and program for life cycle management, preventing unauthorized access to critical systems, and managing certain third-parties, including cloud service providers. In addition, the proposal would expand the types of events that would trigger immediate SEC notification.
- Cybersecurity risk management for advisers and funds. The cybersecurity risk management standards for registered investment advisers and funds, which were previously proposed in February 2022, would require them to adopt and implement policies and procedures designed to address cybersecurity risks that could harm advisory clients and fund investors. The proposal states that “reasonably designed” policies and procedures should contain elements including implementation responsibility, risk assessments, user security and access, information protection, threat and vulnerability management, incident response and recovery. The proposal also introduces a new confidential form, Form ADV-C, that advisers would be required to file with the SEC within 48 hours of significant cybersecurity incidents affecting the adviser, its fund or private fund clients.
Comments on all four proposals will be accepted for 60 days following publication in the Federal Register.
Our Take
With these proposals, Chair Gary Gensler has checked off nearly every target in his January 2022 speech outlining plans to shore up information security-related defenses across the capital markets. As he foreshadowed, these proposals would ensure that all major categories of financial institutions overseen by the SEC have comprehensive cybersecurity policies and procedures. Most firms already have cybersecurity policies and procedures at various stages of maturity, but even those with advanced programs will need to closely compare their capabilities with the elements described in these proposals and make plans to close any gaps. Notably, all four proposals include a provision around notifying either the SEC, customers, or both, of cybersecurity or data breach incidents, meaning that affected firms will need to develop or enhance reaction plans to develop, validate and issue the necessary communications. All of the proposals also echo Treasury’s recent cloud report in recognizing the prevalence of migrating data to cloud service providers and the resulting importance of effective third party risk management and oversight. As such, firms impacted by these proposals will need to develop a better understanding of where sensitive data is located, how access is restricted and authenticated, and what mechanisms are in place to detect and react to breaches - including through their third party service providers. As they are affected by all three of the new proposals, large broker-dealers will have the most work ahead and should begin to develop strategies and consider resource needs for potentially overlapping implementation schedules.
1 Reg SCI was adopted in 2014 to require certain market participants that are key to the functioning of the US securities market – including securities exchanges, registered clearing agencies and alternative trading systems – to have comprehensive policies and procedures for establishing, operating, maintaining, and securing critical technology systems.
3. On our radar
These notable developments hit our radar this week:
- Fed announces July FedNow launch. On March 16th, the Fed announced that its FedNow service, which will provide 24x7x365 real-time gross settlement with integrated clearing functionality, will launch in July. The announcement notes that the Fed will begin certifying early adopters in April.
- SEC set to adopt Form PF amendments. On March 22nd, the SEC will meet to finalize amendments to Form PF, a confidential reporting form instituted following the financial crisis to require advisers to certain private equity and hedge funds to report financial, ownership, performance and exposure details to the government on a quarterly and annual basis. The amendments were proposed in January 2022 would require advisers to PE funds and large hedge funds to file reports within one day of certain events, lower the current threshold for filing by large PE advisers, and require them to report more granular information including details on their strategies, use of leverage and portfolio company financings, and portfolio company restructurings or recapitalizations.
Follow us
