Our Take: financial services regulatory update – July 28, 2023

Change remains a constant in financial services regulation. Read "our take" on the latest developments and what they mean.

Current topics – July 28, 2023

1. The Basel III Endgame is on

On July 27th, the Fed, FDIC, and the OCC released their long-awaited proposal to implement the final components of the Basel III agreement, also known as the Basel III endgame. Separately, the Fed also proposed adjustments to the calculation of the capital surcharge for global systemically important banks (G-SIBs). The agencies estimate varied impact across the categories of the Fed’s tailoring framework, with an aggregate increase in RWA by 24% for Category I and II banks and 9% for Category III and IV banks. The proposals include adjustments to the following areas:

  • Expanded scope and new requirements.
    • Scope. The proposal confirms that it would apply to banks with over $100 billion in assets.
    • Changes in capital numerator. The proposal would remove the accumulated other comprehensive income (AOCI) opt-out for Category III and IV banks, requiring them to recognize unrealized gains or losses in calculating their regulatory capital. These banks would also be subject to deductions currently only applicable to larger banks (e.g., mortgage servicing assets, deferred tax assets (DTAs), significant investments in the capital of unconsolidated financial institutions) and rules for minority interest.
    • New capital requirements. Banks between $100 and $700 billion would be subject to total loss absorbing capacity (TLAC) requirements, the supplementary leverage ratio (SLR), and the countercyclical capital buffer (CCyB), if activated. Currently these requirements only apply to G-SIBs and/or Category II banks.
  • Banks need to calculate RWA under two approaches, subject to an output floor.
    • Dual approach calculation. Banks would be required to calculate RWA amounts under the standardized approach and the “expanded risk-based approach” (the regulators’ term for the proposed Basel III endgame requirements), with the higher of the two being used to set their minimum capital requirements (see Figure 1). Importantly, even in the standardized stack, the new market risk RWA will be applied, thereby increasing capital requirements for the standardized stack at firms with trading exposures.
    • Output floor. The proposal also maintains an output floor that would serve as a lower bound under the expanded risk-based approach for banks that adopt the internal model approach of market risk. If the risk-weighted assets under the expanded risk-based approach were less than the output floor, the output floor would have to be used as the risk-weighted asset amount under the expanded risk based approach.
  • Large increase in capital requirements across risk stripes.
    • Market risk changes would drive increased capital requirements for banks with large trading books.
      • New standardized approach applied by default. A new standardized approach must be used by all Category I-IV institutions, and across all asset classes. This is expected to result in a higher market risk capital requirement compared to the existing approaches. 
      • Internal models remain but on a more granular and limited basis. Expected shortfall models would replace value at risk (VaR) models, with heightened requirements for obtaining regulatory approval prior to use. Banks will have to determine the benefit and cost of developing models for the most liquid products (although prohibited for securitization or correlation trading instruments) on a desk-by-desk basis.
      • New banking book and trading book boundary. The proposal provides revised definitions of covered market risk positions with explicit inclusion (e.g., publicly traded equity positions) and exclusion (e.g., debt securities for which the fair value option was elected) of certain product types. This could expand the scope of positions requiring market risk RWA calculations and require banks to develop procedures to accurately identify such positions.
      • Revised market risk scope. All banks with over $100 billion in assets are now required to calculate market risk capital requirements regardless of the size of their trading assets and liabilities. Additionally, other firms (not otherwise in scope) with “significant trading activity” (i.e. with trading assets and liabilities of $5 billion or more or that exceed 10% of total assets) will also be subject to the requirements. The $5 billion threshold is an increase from the previous $1 billion.
    • Credit valuation adjustment (CVA) applies a standardized approach, with no internal models option.
      • Alignment to simulation-based accounting CVA approaches. The proposal would replace the current approaches for measuring capital requirements for changes in the valuation of over-the-counter (OTC) derivative contracts with a standardized approach largely intended to align to common market simulation based approaches to determine accounting CVA. However, firms will need to ensure specific aspects of existing models are aligned to regulatory requirements.
    • Operational risk would be another primary driver of increasing capital requirements for all banks.
      • Shift to standardized approach. The internal models based approach (i.e. the advanced measurement approach) has been removed and replaced with a standardized approach that accounts for a bank’s business volume, activities, and historical operational risk losses.
      • Internal loss multiplier (ILM). The ILM is a component of the standardized operational risk RWA calculation process that adjusts RWA based on a 10 years of operational loss history. Despite the ILM being set at one (eliminating its impact) in the EU and UK, the US proposal would allow the ILM to scale operational risk RWA up if firms have substantial operational loss events in the look back period.
    • The changes to credit risk in the US may not be as beneficial as expected.
      • Gold plating on lending. The proposal would increase risk weights beyond Basel levels (known as gold plating) for a number of material portfolios. For example, the residential mortgage framework now includes loan-to-value (LTV) bands, but the risk weights would be increased by 20 percentage points relative to the Basel framework. Similarly, for retail exposures, risk weights have been increased by 10 percentage points. For corporate exposures, the proposal requires them to be listed on a recognized exchange to be classified as investment grade, which aligns with the Basel framework but deviates from the EU/UK implementation where the listing requirement was excluded.
      • Haircut floors for securities financing transactions (SFTs). For repo-style transactions and eligible margin loans, the proposal includes haircut floors that generally align with the Basel framework but excludes certain transactions where a bank borrows securities for the purposes of meeting a current or anticipated demand, providing some capital relief.
      • No simple transparent and comparable (STC) securitization. The proposal does not include the STC criteria for securitization exposures as included in the Basel framework and also proposed in the EU with some modifications. The Basel STC criteria permitted eligible securitization exposures to receive preferential risk weight treatment and applied more punitive risk weights to non-STC exposures. The proposal would subject all securitization exposures to the more punitive capital treatment.
      • All large banks would use the standardized approach for counterparty credit risk (SA-CCR). All large banks would need to use SA-CCR to calculate exposures for derivatives. Category I and II banks currently use SA-CCR, but today other large banks have the option to use the current exposure method approach for such exposures.
      • Cross-default added to definition of defaulted exposures. The proposal’s classification of defaulted exposures (excluding to a sovereign entity, real estate exposure, a retail exposure, or a policy loan) would look to the performance of the borrower with respect to credit obligations to “any” creditor, whereas the Basel framework does not explicitly call out defaults to “any” exposure. Such exposures will be risk weighted at 150%.
  • Stress testing will need to consider both the standardized and the expanded approaches. 
    • Binding constraint approach for stress testing. Banks in Categories I - III of the Fed’s framework would be required to use the capital and RWA approach that is the binding constraint at the start of the projection horizon for capital stress testing. For many banks, the binding constraint is likely to be the expanded risk-based approach. Category IV banks would need to make baseline projections using their binding constraint approach.
  • G-SIB surcharge  to use more daily and monthly average data.
    • Daily average input data and cliff effects. The G-SIB surcharge proposal would report and measure certain systemic indicators as an average of daily values over the quarter or average of month-end values rather than only year-end. It would also measure the GSIB surcharge in increments of 10 basis points rather than 50.
    • Adjustments to the interconnectedness component. The proposal would also expand the definition of “financial institution” to include savings and loan holding companies, private equity funds, asset management companies, and exchange-traded funds. This will increase the interconnectedness component of the surcharge.

Comments on both proposals are due by November 30, 2023. As proposed, implementation of Basel III endgame would take effect July 1, 2025 with a three year phase in until June 30, 2028.

Our Take

The proposal would raise capital requirements beyond what was anticipated and implemented globally.

  • Most significant increase in capital for the largest banks. G-SIBs would be the most adversely impacted under the proposed expanded risk-based approach, particularly those with large sales and trading businesses.
  • Retention of internal models for market risk presents both challenges and opportunities. To meet the proposed standards, banks would need to develop entirely new market risk models with much more granular calculations and will need to obtain regulatory approval before using them. While waiting for this approval, banks would have to utilize the more punitive standardized market risk approach. However, for certain firms the ultimate market risk capital benefit from utilizing internal models may be significant as the output floor constraint is assessed against total expanded risk based capital (with standardized measure for market risk).
  • New operational risk impact. With the expanded risk-based approach likely to result in the binding capital ratios for most banks, the new standardized operational risk approach would materially increase capital requirements. Given that the ILM component was set to one in the UK and EU, a similar adjustment to improve competitiveness for US banks would likely be considered as part of the comment process.
  • Gold plating will fuel arguments around pushing financing out of the banking sector. There are several provisions that “gold plate” or go beyond the standards implemented in other jurisdictions (e.g., risk weights on residential mortgage, definition of default). These higher capital requirements could push even more activity into the less stringently regulated non-bank finance sector. Some Fed governors have expressed concern about the implications of this shift on financial stability.

The proposal significantly reduces variance between categories in the regulatory tailoring framework.

  • Biggest change in requirements for banks with between $100 and $250 billion. These banks were the greatest beneficiaries of the Fed’s 2019 tailoring framework as they were placed in Category IV, which had the most relief from post-crisis requirements. However, the newly proposed changes will essentially collapse the categories with little differentiation in capital requirements between Categories II and IV. While Category III and IV banks have lower increases in RWA through the expanded risk-based approach, the changes to the definition of capital (e.g., removal of AOCI opt out, limits on deferred tax assets, and limits on minority interest) will have a significant impact. Banks will need to analyze their temporary difference DTAs to determine if they will need to haircut the DTAs that are included in CET1.
  • New considerations at $100 billion threshold. These changes would also result in a new incentive structure for banks close to $100 billion to either diligently remain below the threshold or to grow substantially enough, including through mergers, to benefit from economies of scale given the increased regulatory cost.

Compliance will be more complicated than just meeting new regulatory capital minimums.

  • Each change would need operational adjustments. The proposal introduces a significant number of modifications and refinements that will require banks to adapt their data, calculations, processes, controls, and documentation, putting pressure on all three lines of defense. Category III and IV banks will particularly need to make significant investments to comply with the proposed enhanced risk-based requirements as well as SLR, SA-CCR, and TLAC requirements which currently only apply to the largest banks.
  • Models and processes would need to be ready on July 1, 2025. Despite the three year phase-in period to meet capital requirements, banks will need to have their updated models and calculations ready from the effective date and to conduct calculations under both new and old approaches throughout the phase-in period.
  • Banks likely to update capital allocation strategies. While banks with shortfalls could raise the necessary capital through earnings and reduced distributions to shareholders, most will seek to optimize their capital allocation strategies for the new approaches. Banks have long been arguing that these efforts will result in reduced lending and trading activity that may not deliver adequate economic returns relative to its capital impact. They are likely to continue to press this point and to push the regulators for evidence-based rationale for higher capital requirements.

What happens now?

  • 120 days to digest and comment. While the 120-day comment period is longer than usual, it will still be a tight timeframe for banks to digest the proposal, determine how it affects them, and to organize their advocacy to focus on the areas where they can make the strongest case for relief in the final rule. The lack of initial concessions and multiple dissents by Fed and FDIC board members indicates that there are components of the rule that may well be adjusted before the rule is finalized.

Figure 1: Risk based capital stacks

Source: PwC Analysis

*  Existing standardized approach except derivatives that must use SA-CCR

** SCB will be same across both the stacks and will based off of the constraining approach as of the jump off point for stress testing

*** Expanded Risk Based RWA (stack 2) would be floored at 72.5% of RWA calculated across risk stripes using the same expanded risk based approach but using only standardized measures of the proposed market risk framework

**** For simplicity “adjusted allowance for credit losses not included in tier 2 capital” and “allocated transfer risk reserves” are not included

2. SEC finalizes cybersecurity disclosure rules

On Wednesday, the Securities and Exchange Commission adopted final rules and amendments requiring public company registrants to disclose material cybersecurity incidents and to make certain disclosures regarding their cybersecurity risk management, strategy and governance on an annual basis. Specifically, the final rule requires:

  • Registrants to describe:
    • The nature, scope, timing, and impact of any material cybersecurity incident on Form 8-K
    • Their processes for assessing, identifying and managing material cybersecurity risks as well as any material impact from previous incidents on Form S-K
    • The board of directors’ oversight of cybersecurity risks and management’s role and expertise in assessing and managing material risks on Form S-K
  • Foreign private issuers to furnish information on material cybersecurity incidents that they make or are required to make public or disclose in a foreign jurisdiction on Form 6-K

There were a number of key changes from the March 2022 proposed amendments including:

  • The SEC clarified that there is no deadline for determining the materiality of a cyber incident, as long as it is not an unreasonable delay following discovery. However, once such a determination of materiality is made, the incident must be reported in Form 8-K within four business days.
  • Disclosure of material cyber incidents may be delayed if the US Attorney General determines and notifies the SEC that immediate disclosure would pose a substantial risk to national security or public safety (in the proposed amendments there were no exceptions from the four-day filing requirement).
  • The proposed rule required disclosure when a series of previously undisclosed individually immaterial cybersecurity incidents become material in the aggregate. Instead, the final rule clarifies the definition of cyber incident as including a series of related occurrences. If a company determines that it is materially affected by a series of related occurrences — such as incidents related to the same threat actor or multiple actors exploiting the same vulnerability— the 8-K incident reporting would be required, even if each individual occurrence is immaterial.
  • Removal of the proposed requirement to disclose the names of any board member with cyber expertise.

The material incident disclosure requirements would be effective on or after December 18, 2023 (smaller reporting companies have a 180-day deferral). Disclosures for risk management, strategy and governance would be effective for all registrants for fiscal years ending on or after December 15, 2023.

Our Take

This rule will pose numerous challenges for publicly traded US companies, which must soon make new disclosures pertaining to material incidents, cyber risk management, strategy and governance. Most large financial institutions are already facing growing cybersecurity risk management expectations from regulators, including the Fed and OCC, but having to publicly describe their programs in greater detail may spur them to further shore up their defenses. This new disclosure regime will expose companies’ cybersecurity programs to comparison with their peers and scrutiny from investors. Accordingly, financial institutions will need to not only consider standards from their primary regulators, but where their policies, procedures, risk assessments, and controls stand against industry leading practices. They will also need to develop or update policies and procedures for determining materiality of cybersecurity incidents and the details they should disclose with coordination across security, finance, risk and legal teams as well as, when needed, key business leaders. In particular, they will need to be prepared to make timely determinations of whether certain disclosures could exacerbate security risks or publicize vulnerabilities.

In addition, as they prepare to describe their oversight role in annual disclosures, financial institution boards should take note that regulators and investors expect them to take an increasingly active oversight role when it comes to cybersecurity matters. Although they will no longer be required to disclose specific names, firms should still consider either having a board member with cybersecurity expertise or having consistent access to independent subject matter experts for educational sessions or consultations. They should also make sure they are kept abreast of the information to be disclosed, assess the content and frequency of information they receive on cybersecurity risks, and make sure members are able to effectively challenge management’s identification and management of such risks.

For more information on preparing, see our analysis of the SEC’s new cyber disclosure rule.

3. SEC proposes predictive data analytics requirements

Also on July 26th, the SEC proposed new requirements for broker-dealers and investment advisers (collectively referred to as firms) to address conflicts of interest associated with predictive data analytics. Chair Gary Gensler has previously spoken on the proliferation of predictive data analytics and expressed concerns that such technologies to recommend investments can result in conflicts of interest, bias, and breaches of investment adviser requirements like fiduciary duty, best execution, and best interest.

The proposal would require firms to evaluate their use of covered technologies, defined as “analytical, technological, or computational functions, algorithms, models, correlation matrices, or similar methods or processes that optimize for, predict, guide, forecast, or direct investment-related behaviors or outcomes of an investor.” They would need to determine whether there are any conflicts of interest placing the firm’s interests ahead of those of investors and if any exist, to eliminate or neutralize them. They would also be required to have written policies and procedures and keep books and records related to these requirements.

Separately, the SEC proposed updates to its rule requiring investment advisers that provide advisory services through the internet to register with the SEC to remove the de minimis exception allowing investment advisers to have a limited number of non-internet clients. Internet advisers would need to provide services to all clients exclusively through an operational interactive website.

Both proposals will be open for comment for 60 days after they are published in the Federal Register. 

Our Take

While Chair Gensler has had predictive data analytics in his sights for much of his tenure as SEC Chair, this proposal also reflects growing concerns across regulators and lawmakers around potential harm resulting from the use of automated technologies, including artificial intelligence (AI). All SEC-supervised firms will need to understand whether their investment platforms use any tools that fall under the broad definition of “covered technologies” and demonstrate thorough analysis of potential conflicts of interest. To do so, they should closely review the output of those technologies for determinations that benefit the firms’ interests or have disparities across investor demographics and classes. Boards and senior managers should seek detailed explanations of the data and logic underlying such systems and scrutinize controls in place to prevent conflicts of interest. Even if a firm’s assessment of its data analytics technologies finds that there are no potential conflicts of interest or that they are effectively managed, SEC examiners will expect to see detailed documentation of how the firm came to that determination.

4. ISDA publishes trading book climate scenario analysis framework

On July 12, the International Swaps and Derivatives Association (ISDA) published a new Conceptual Framework for climate scenario analysis in the trading book based upon commissioned research with more than 30 ISDA member banks. ISDA notes that climate scenario efforts so far have primarily focused on long-term impacts on the banking book and that different considerations are needed to assess shorter-term effects of climate risk on the trading book. ISDA plans to pilot this conceptual framework during the second half of 2023 to test its usefulness as well as to generate some estimates of potential climate risk impacts on a set of hypothetical portfolios.

The framework focuses primarily on scenario design and implementation while breaking it down into five key stages:

  1. Objective: Define the use case for the analysis across regulatory stress testing, internal risk management, disclosures and reporting, and strategy and pricing while taking into consideration applications and balance sheet assumptions.
  2. Scenario development: Develop a plausible and coherent climate scenario that translates climate shocks into macro-financial variables in the short-term horizon that is consistent with longer term climate-risk scenarios.
  3. Data: Identify and segment portfolio exposures, data requirements, and review data quality and granularity of GHG emissions, transition scores, historical data, and operating asset data.
  4. Shock generation: Expand scenario variables, including transmission channels, liquidity horizon, calibration, and modeling capabilities to derive market risk factors
  5. Impact analysis: Generate results across asset classes, regions, sectors and counterparties, validate outputs and conduct sensitivity analysis.

Our Take

This ISDA framework demonstrates growing attention on shorter-term effects of climate risk on the trading book, where many banks have less mature capabilities after having been focused mainly on their banking books. In order to expand their climate scenario analysis to the trading book, banks will need to conduct new assessments of scenarios impacting all asset classes (i.e., equities, fixed income, derivatives), identify internal and external available data sources, analyze existing stress testing methodologies to be augmented and align on newly defined metrics. With derivative instruments, there could be challenges discerning probable climate drivers or pathways, as well as mapping or selecting parameters, that lead to measurable economic impacts given the current development stage of climate scenario analysis. Although institutions may be comfortable with their existing risk framework and climate considerations (e.g., carbon or commodity pricing), additional impacts and pathways should account for a broader spectrum of risks, particularly physical climate risks (e.g., event severity, frequency, duration) and their application to FX or rates strategies. Given the nuances involved, it is paramount that first and second lines of defense (e.g., climate officers, risk, trading desks) share their expertise to address product impacts, data requirements, and overall approach to close gaps and address potential challenges that could arise within the layers of their current framework. The key difference in governance and accountability between the banking book and trading book is with the frequent coordination that must occur across the business (i.e., trading desks), financial risk, model risk management, and data and technology.

While much work is still to be done, the latest framework is a step forward in understanding and managing the impact of climate-related events on traded assets. Although expectations for US banks are not yet as rigorous for climate-related financial risk, the continued release of additional reviews and guidance are signaling that more regulatory scrutiny is likely on the horizon.

5. On our radar

These notable developments hit our radar this week:

  • Agencies update guidance on liquidity risks and contingency planning. On July 28th, the Fed, FDIC, OCC, and NCUA updated their existing guidance on liquidity risks and contingency planning. The guidance reaffirms the need for depository institutions to regularly evaluate and update their contingency funding plans and maintain access to adequate, reliable funding sources that can be used during times of stress. The guidance also gives explicit attention to use of the Fed’s discount window and the Federal Home Loan Bank system
  • FSOC meets on non-bank mortgage servicers, climate risk and a closer look at trading books. On July 28th, the Financial Stability Oversight Council (FSOC) met and discussed efforts to address financial stability risks related to nonbank mortgage servicers, climate-related financial risks as well as a recap on the current conditions in the banking sector including the 2023 bank stress test results. Staff from the Fed discussed conducting an exploratory market shock on the trading books of the largest banks in order to further understand the risks with their trading activities and to ensure banks are resilient to a range of different risks.
  • FINRA Proposed Amendments to Rule 4210 have been adopted. After almost a decade, on July 27th, the Financial Industry Regulatory Authority (FINRA)’s proposed amendments to Rule 4210 which require broker-dealers to collect margin on the majority of To-Be-Announced (TBA) transactions have been adopted and an effective date is anticipated to be released shortly.
  • CFTC approves final rule and three proposals. On July 26th, the CFTC approved the following:
    • A final rule amending certain reporting and information regulations applicable to derivatives clearing organizations (DCOs). These amendments update information requirements associated with commingling customer funds and positions in futures and swaps in the same account, revise certain daily and event-specific reporting requirements and codify the fields that a DCO is required to provide on a daily basis.
    • The Swap Confirmation proposed rule amends its swap execution facility (SEF) regulations related to uncleared swap confirmations, as well as associated conforming and technical changes.
    • The Part 40 proposed rule governs how registered entities submit self-certifications, and requests for approval, of their rules, rule amendments, and new products for trading and clearing, as well as the Commission’s review and processing of such submissions.
    • The Margin Requirement proposed rule looks to amend the margin requirements for uncleared swaps applicable to swap dealers (SDs) and major swap participants (MSPs) for which there is no prudential regulator.

All proposed rules have a 60-day comment period after publication in the Federal Register.

  • CFPB Exams Find Unfair, Deceptive, and Abusive Practices. On July 26th, the CFPB released a new Supervisory Highlights report covering recent findings related to auto lending, unlawful debt collection on medical debt and illegal payday lender collection practices. This edition includes updates from the new CFPB supervision information technology program, including several violations caused in whole or in part by insufficient information technology controls.
  • FedNow goes live. On July 20th, the Fed launched a pilot of FedNow, its new system for instant payments, with 35 early-adopting banks and credit unions.
  • DOJ and FTC request comment on draft merger guidelines: On July 19th, the DOJ and FTC released draft merger guidelines which describe how the agencies’ review mergers and acquisitions to determine compliance with federal antitrust laws. The goal of this update is to better reflect how the agencies determine a merger’s effect on competition in the modern economy and evaluate proposed mergers under the law. The draft guidelines are open for comment until September 18, 2023.  
Follow us