Guidelines establishing standards for recovery planning by certain large insured national banks, federal savings associations, and federal branches are to be revised by the Office of the Comptroller of the Currency (OCC).

The final guidelines are effective on January 1, 2025, with staggered compliance dates based on size (total consolidated assets), with an additional six months to comply with the new testing provision.

The guidelines only apply to OCC-supervised institutions with more than $100 billion in average total consolidated assets and can be found at 12 CFR 30, appendix E.

The guidelines in general

The final guidelines do the following:

• Expand the recovery planning guidelines to apply to insured national banks, insured federal savings associations, and insured federal branches with at least $100 billion in average total consolidated assets.
• Incorporate a testing standard for recovery plans.
• Clarify the role of nonfinancial risk (including operational and strategic risk) in recovery planning.
• Provide covered banks with timeframes in which to comply with the final guidelines, including development of a testing framework and conducting testing.

The OCC explained in its final rule that, during the 2008 crisis, it observed that many financial institutions were not prepared to respond effectively to the financial effects of severe stress. The lack of or inadequate planning threatened the viability of some financial institutions, and many were forced to take significant actions without the benefit of a well-developed plan for recovery.

The OCC said it believes annual testing is appropriate and concluded that a covered bank should also test its recovery plan following any significant changes to the recovery plan made in response to a material event.

The OCC said this experience highlighted the importance of large, complex banks having strong risk governance frameworks, including plans for how to respond quickly and effectively to, and recover from, the financial effects of severe stress.

The agency said it “recognized that this type of advance planning would reduce a bank’s risk of failure and increase the likelihood that it would return to a position of financial strength and viability following severe stress.”

Testing specifically

The OCC is expecting covered banks to test their recovery plans following any significant changes to the recovery plan made in response to a material event. “This frequency will ensure that management and the board can consider the results of testing during their recovery plan reviews,” the OCC notes.

Within this framework, the final guidelines provide each bank with flexibility regarding when to test its plan, including whether to align this testing with other types of testing or to engage in continuous or regular testing throughout the testing cycle, provided that the bank meets the testing standard in the guidelines.

The OCC also says it does not expect a covered bank to consider every component of each element during each testing cycle (for example, considering the trigger element during a cycle does not necessarily mean considering every trigger during that cycle). Instead, testing should be risk-based, the agency said.

The OCC said it believes that covered banks should take a risk-based approach to updating their recovery plans following testing. For example, if testing reveals a critical deficiency in the plan, the covered bank should update it as soon as feasible. However, for less significant deficiencies, it may be appropriate to delay updates until the next annual review cycle.

The OCC said it believes annual testing is appropriate and concluded that a covered bank should also test its recovery plan following any significant changes to the recovery plan made in response to a material event.

Non-financial risk

The OCC said it has observed that covered banks have been less consistent in considering or addressing nonfinancial risk, such as operational and strategic risks. “By focusing a recovery plan exclusively on financial risks while neglecting non-financial risks, the covered bank may overlook the very real threats that non-financial risks can pose” the agency said.

The OCC agreed with those who commented on the proposed rule that financial risk and non-financial risk differ, but it reiterated that both are important aspects of recovery planning, and the guidelines provide covered banks with sufficient flexibility to account for these differences.

The guidelines state that each covered bank’s recovery plan can and should address financial risk and nonfinancial risk in a manner appropriate for that bank, including by ensuring that its recovery plan reflects their differences.

Moreover, while the breach of any trigger (whether financial or nonfinancial) should always be escalated for purposes of initiating a response, a covered bank should not view a specific trigger as necessitating the execution of a particular option, the guidelines point out. “Rather, a covered bank should use its judgment to determine what options, if any, to undertake during a period of severe stress.”