This is a transcript of the podcast Maria Vullo on regional banks, risk, and accountability between GRIP US Content Manager Julie DiMauro and Maria Vullo, former superintendent of the New York Department of Financial Services and now CEO at Vullo Advisory Services.
[INTRO]
Julie DiMauro: I’m Julie DiMauro, and welcome everyone to GRIP’s podcast at Global Relay. We are GRIP, Global Relay Intelligence Practice, and you can find our editorial content and our podcasts and our coverage of regulatory developments at GRIP.GlobalRelay.com. Today we are so excited to talk to Maria Vullo and she’s going to tell us a little bit about herself and how to reach her.
Maria Vullo: Great. So, hi, Julie. It’s great to be here with you today and to talk with you. So most relevant for today, I served as superintendent of financial services for the state of New York for three years. I also was a partner in a major law firm. Currently I teach banking and insurance regulation at Fordham Law School, and I have my own advisory practice at www.vulloadvisory.com.
Julie DiMauro: Okay. Thanks so much, Maria. Wonderful. Okay. Just diving right in here, we’re going to talk about Silicon Valley Bank and its collapse. So risk management. If risk management problems were a major factor in SVB’s collapse, as they seem to have been, one has to wonder how that came to be. For starters, how does a bank grow to be overly concentrated in one business sector? And didn’t they learn their lessons from WaMu back in the day?
Maria Vullo: So interesting comparison, because obviously WaMu was concentrated in mortgage and as a bank, a very large one that failed. But here, you know, what’s interesting is that you had both a bank whose business strategy from the start was concentrated and it grew exponentially in, you know, a few years period, but its risk management did not grow alongside it. And while concentration risk that people think about, you know, say, oh, only mortgage lending or oh, only a certain type of lending, here the concentration risk was the nature of the customers that the bank had, which were technology and startup companies and the venture capital world.
And that was concentration risk for sure. Why? Because those were companies in a certain sector that that sector either grew or didn’t grow together and obviously experienced softness, you know, coming out of the pandemic, say, in 2021, 2022. And the bank’s concentration in this sector also was a function of their lending and their cash management business. In other words, at least how the reporting has been is that the bank would loan money to these businesses at apparently, you know, pretty good rates and also require them to put their deposits on account at the bank. So their customer base in both lending and in the deposit customers were a very large overlap, which is another type of concentration risk. There’s no diversification there. And for a bank, the problem with that is that, you know, your deposit customers, you know, should be separated to some extent and you need diversification in your business. So another example, you know, WaMu was a good example is if you were a bank and you concentrated in the restaurant industry and in COVID, you know, what would have happened? That bank would have failed. So and here the technology startups. There was a lot of, you know, great, you know, there was a lot of growth in that and the bank grew its risk management didn’t grow alongside of it. And then when it softens, what happens with the bank is the cash management and the withdrawals are happening because of the nature of the business and for banks, which engage in fractional reserve banking, they don’t have the cash, you know, to deal with, you know, loans or their regular business operations. And this was just a highly, highly risky business strategy from the start. Although that’s not the only reason that it failed. There are other risk management problems that this bank had for sure. And it had many regulatory violations. So there are lots of issues here, but that’s a big one.
Julie DiMauro: Absolutely. Thank you. And I want to jump to actually risk management. So they had a chief risk, a lack of a chief risk officer. That was an open role for a while, but they still had a risk department and they had a board with oversight into the company’s overall risk profile. How should we read into the lack of a CRO? Can’t we hold the board accountable here, especially since there seems to have been a skill set issue, at least from my reading with regard to the board and its oversight and its composition?
Maria Vullo: So I think all of the above what you’ve just said. So starting with the chief risk officer, that’s a huge red flag, meaning they lacked a chief risk officer for some eight or some months. And I listened to the CEO’s testimony trying to say, “Oh, but we had this risk department.”
It comes from the top. You need a strong chief risk officer. It certainly appears that the person that they had was not strong enough. Perhaps the regulators had concerns, but this goes back to the bank grew exponentially and its risk management did not grow along with it. So perhaps their chief risk officer didn’t have all of the tools that someone should have in a $200 billion bank of this size, but they didn’t replace the person quickly enough. And of course the CEO says, “Well, it takes a while to replace the person.” But you have to plan for these things and the bank didn’t plan. And yes, the board of directors is responsible. Chief risk officers usually and should report directly to the board. And what’s interesting here is the CEO testified that the risk management committee, which is a board committee, met 18 times in the year 2022. That is a lot of times. That’s like every three weeks for a risk management committee to meet. So clearly there were issues, but they didn’t fix them and the board was involved and the board is responsible. So that lack of a chief risk officer, I don’t think you could say, “Oh, there was a department or something.” And even if there was, they still didn’t address their issues. They didn’t have liquidity, what’s called liquidity fund planning. So when there were withdrawals, they had access to other funds. So what did they do here is they sold their US treasury bonds at a loss. Another red flag.
Julie DiMauro: Exactly. I want to ask you about large bets on treasury bonds. They had made the bet when the interest rates were low, how did that factor into the risk management failure?
Maria Vullo: Well certainly, let’s be clear here. Banks investing in treasury bonds is a good thing. It’s not a bad thing.
In other words, you don’t want them investing in private equity and in fact, they’re not allowed to. So because then you can’t sell it in the case of it. But here, the banks risk management and overall management failures, and again, the board’s responsible too, is that they had all these long treasuries. Now if those treasuries were held to their maturity, the bank would have made money off of it, but they didn’t have them hedged. Interest rate risk, if a banker doesn’t know about interest rate risk, then you can’t be a banker. It’s all about interest rates banking. You give interest to your depositors, you get interest from your loans, and then you put money in, you know, you invest in treasuries. If you don’t understand interest rate risk, you can’t be in the banking business. So this idea of, oh, you know, the Federal Reserve did all this to us. Well, the Federal Reserve told you that they were going to do it. They didn’t hedge the treasuries. They didn’t have the opposite side interest rate, except that they had hedges, but they sold those hedges like a year or so before.
And my guess is they sold those hedges because they were in need of some cash hedging, you know, it was expensive for the fees and they wanted that cash and to make that money off of it because you could make money off of the other side of the hedge once the Fed was increasing interest rates. So they sold them and they left this huge portfolio, like $20 billion in treasuries, unhedged. And then when they sold them, they took about a $2 billion loss on that, which they wouldn’t have had if they would have held them. And that loss became public, which triggered people saying, uh oh, what’s wrong with this bank? Why are they selling their treasuries? Right? That’s a red flag that precipitated in part the bank run.
Julie DiMauro: Absolutely. Maria, you and I, before we pressed record today, we were talking a little bit about the role that social media played. You know, it is like you were telling me, like, played a role, but stop blaming it as like, you know, one of the first, one of the biggest reasons why SVB failed. Can you tell us about how it played a role, though, even if it wasn’t the biggest factor?
Maria Vullo: I mean, sure. The role of social media here was that, you know, once people started to withdraw funds, there was, you know, instantaneous conversation on social media about what was happening at the bank. Right? And so the ability of people to communicate more quickly precipitated a greater bank run. But you can’t blame social media for the bank’s failure. The bank’s failure was caused by mismanagement of the bank, the poor business structure. And you know, getting back to those depositors, those were business depositors in a concentrated industry that then was softening. 94% of those deposits were uninsured, meaning above the $250,000, you know, FDIC insurance fund limit, which is the case with most, you know, commercial deposits, but they had 94%, the highest percentage of any bank. That is so risky. It’s mind boggling. This was not a retail bank, right? They didn’t have individual people, but you can’t have that large amount of uninsured deposits and then say, oh, but our customers, you know, knew us so well, you know, and they were going to stay. It’s like, no, customers, when they see you sold your treasuries at a $2 billion loss, why would you take a $2 billion loss? Something must be wrong. So those customers, you could say, acted rationally, you know, by pulling their money. And why did they act rationally? Because Silicon Valley Bank, while not small, was a $200 billion bank. It was not a quote, too big to fail bank that had been rescued, you know, like the banks that were rescued in the financial crisis in 2007, 2008. So the fear was the government’s not going to bail out, you know, this bank. And so we’re going to lose our money because we have millions of dollars, not just $250,000. So that’s why, you know, the withdrawals were so precipitous, but it was bank mismanagement. Social media allowed for a quicker bank run.
But, you know, the banks mismanagement caused this failure. And it’s really unfortunate because there was a contagion effect of it. And you know, and to me, part of this is the failure in 2007, 2008, to hold individuals responsible for risk management failures.
Julie DiMauro: If you don’t mind, I would love to delve into that. So if we had held some big bankers, some CEOs responsible during the financial crisis, you think that would have sent a clearer message, a strong message to the banking industry?
Maria Vullo: Well, I think, look, I think you have to think about every issue. People are talking now about, well, what do we do here? Because we have the midsize banks now that are at risk and people are taking their money from midsize banks and putting them all into the larger banks, the too big to fail banks, which is creating greater risk in our financial system by having such larger banks getting even bigger, right? So what happens here is, you know, banks are not people, right? Banks are just legal entities.
You know, it’s the people that are managing them that need to, you know, not take excessive risk. And so from 2007, 2008, while there were large fines and everything else, you know, the banks paid those fines, which you could say the shareholders of the banks paid those fines, right? But there weren’t individuals held accountable. So fast forward, you have banks that are taking risks, concentrated business models, 94% uninsured. Oh, you know, I have 30 plus regulatory violations. I’m going to take my time in responding to the regulators. I’m going to take my time in dealing with the chief risk officer. I’m going to sell off the hedges because I want more profit. I’m going to sell my stock, you know, because I have inside information. I’m going to just worry about the profit. And so people take greater risk with other people’s money, here, customers’ money. And then what happens is you have the bank run. The government has to come in. It’s not the same type of bailout because the insurance fund is taking the hit here to the tune of $16 billion, which is the current estimate. And so other banks now have to pay those fees. But how are they going to make up for the profit? You know, ultimately customers are going to pay for that. So it’s not the taxpayer directly. But that’s not good. And so what’s to prevent another bank along the way of their management of engaging in risk taking, you know, closing out the hedges, not hiring, you know, the right people, not having what I like to talk about a good compliance bank culture that responds to regulators and doesn’t have business models where you say, oh, venture capital, lots of money. I’m going to get all these startup companies. And I’m not going to worry about when the market softens and the bank’s going to go down. That’s, you know, we need to be more serious about the issue of accountability of people.
Julie DiMauro: Yeah, that’s very interesting. I want to touch on that a little bit because I want to talk about the existence and the future existence of regional banks, community banks. And a lot of people are worried about their, you know, their existence and their wherewithal because there’s a lot of consolidation happening right now. If we look at SVB First Republic and Signature Bank, right, they had larger banks take over their operations. Thinking about people like Senator Elizabeth Warren that had just the other day signaled her distaste for comments made by Janet Yellen at Treasury, the acting director of the OCC, Michael Hsu. Is that how you say his name?
Maria Vullo: Yes.
Julie DiMauro: Yes. And they had signaled some, you know, openness to bank mergers. And she’s worried that we’re going to have these bank monopolies. We’re just going to have banks of the size, about the size of JP Morgan and, you know, and Citibank and that they’re all going to be very large firms and we’re going to just see these community regional banks disappear. And then that doesn’t go along with, you know, President Biden’s efforts to, you know, foster competition in a number of different industries, including the financial services sector. And that it undermines consumer protection. Can you touch on those points and let us know what your thoughts are?
Maria Vullo: Sure. So first of all, you know, First Republic Bank, I’m glad you mentioned it, because First Republic Bank appears to be really a victim of contagion here. According to the CEO’s testimony, you know, before Congress, First Republic didn’t have regulatory violations, you know, you know, from all accounts, you know, it was a victim of this contagion effect, meaning after SVB failed, signature failed, and Republic was similar in the sense that the size was around that same kind of $200 billion mark, which is like a midsize. Sounds like a lot of money, but it’s like a midsize bank, still large, the midsize. And you know, so customers were withdrawing after they saw what happened with the other banks and putting their money in larger banks. Also First Republic had, you know, more uninsured deposits because these were business customers. So it’s still back to that too big to fail. But then what happened was First Republic, there were like 11 banks, large banks that JP Morgan Chase, Jamie Dimon organized to give $30 billion to, to help stave it off. And there was all this about Janet Yellen worked with them to do that.
Unfortunately, it didn’t stave it off. It didn’t prevent First Republic from failing because I think still, you know, some customers were concerned about the banks, you know, not being able to survive. And so were pulling their money out. And then what happened was JPM, along with some other banks bid during the FDIC receivership and acquired the bank, and now got larger and just announced the other day that it’s closing 25% of the branches. Right. So that’s consolidation.
And while the FDIC is restricted by statute that it’s supposed to take the largest bidder, because it has to reduce the insurance fund and protect the insurance fund, you know, the OCC, so acting controller, Hsu, has a broader mandate and could have rejected this merger, if you will, this acquisition of assets by JPM, which is just making it bigger. So I think Senator Warren, you know, like many things in the area of banking is, is right on target. You know, I think she knows what she’s talking about. And I think this is a real concern and the concern of the midsize banks, because they do provide competition, which is a good thing. And they provide, you know, they have some, you know, experience and at least reputation of having good customer service, you know, that some people don’t think. And I’m not, you know, every, every bank is different. Every branch is different, but they do have that. And some people just want that. Smaller businesses want a smaller bank.
You know, some do, but the fear here is, you know, the big banks that are going to be protected by our government, they’re preferred. And again, I do believe it gets back to the 2007, 2008 financial crisis where the big banks were all bailed out and just a, you know, a reality that we can’t allow our financial system to collapse. And that’s a truth. It is a truth. And people, you know, really do, you know, act based on that truth. But I think that the way we need to address it in part is to make sure that bank managers and boards of directors act responsibly, have good cultures. And one way to do it is to hold them accountable. We can’t just have fines that the institution pays, which means the shareholders pay and the customers pay. At some point we have to hold people responsible personally for their role in inadequate risk management and risk taking, such as what we’re seeing here. Not with First Republic, from what I can tell, but certainly from Silicon Valley Bank and perhaps Signature Bank as well, because they had regulatory violations.
Julie DiMauro: Absolutely. What about, we’re talking about holding top executives responsible for some of the mismanagement at their institutions. And I’m wondering about the threat of withdrawing a license to operate within a state like the New York Department of Financial Services that you used to help. Is that a viable threat?
Maria Vullo: I mean, it is, but, you know, withdrawing a bank’s license is killing the institution, its employees, its customers, and everyone else. And if you pull the license, what do you do with all of that? You’re effectively putting it in receivership, right? So you know, and when you have a savings bank or a depository bank, FDIC insured, it’s very difficult to do. You can do it, and I did it, you know, when you have like, you know, anti-money laundering violations that are just, you know, over the top. But when you have, you know, customers that are of the size of this and you really, and you have that many employees, not that you couldn’t do it if it got so bad, but it’s effectively putting it in receivership. And then what do you do? And also you have all the loans and what happens to the loan. Loans are assets because they’re paying. So all of those factors really have to be considered and the larger the size, the more difficult. Now, I suppose you could start thinking about, you know, splitting them up, you know, to reduce the size because then it reduced the risk.
You know, so again, I’m just thinking about, you know, banks are entities, legal entities, but legal entities can’t function without people making decisions. And it’s important to focus sometimes on the people while obviously wanting people to be encouraged to enter the banking industry because it’s a good industry. So you have to pay them, you know, reasonably. But some of these executives are paid so much money and they get profits even when, you know, the banks are doing poorly or they’re pulling out their stock or, you know, we have to start aligning some of those incentives with compliance culture, risk management culture. And also if people behave, again, I’m talking about civil responsibility. I’m talking about, you know, if you’re behaving in a risky manner that’s causing this, you know, as a CEO and only focusing on the shareholders and not the culture and regulatory issues, then perhaps you shouldn’t have kept those bonuses and everything else. And perhaps there should be a financial consequence and regulators do have some powers, but perhaps we need to consider broader powers, you know, against civil responsibility. What I’m talking about.
Julie DiMauro: On compensation maybe.
Maria Vullo: Yeah, exactly. And that those types of things do have an impact on people to say, you know, well, then, you know, I shouldn’t engage in such risky activity, you know, in addition to people talking about maybe changing, you know, capital rules. The problem that I have with wholesale changes of capital rules is it doesn’t really take into account that there are some very, very good bank managers that don’t take these types of risks. And why should the entire bunch of them be held responsible, you know, and of course then the customers because the management and the board of Silicon Valley bank acted poorly. That’s what I think.
Julie DiMauro: Yeah. Right. Right. Maria, this has been a fantastic discussion. Thank you so much for your time. I really enjoyed our conversation today. Remind people how they can reach you.
Maria Vullo: So my website is www.vulloadvisory.com and my email is mvullo at vulloadvisory.com and the last name is spelled V as in Victor U L L O. Great to speak with you, Julie, as always.
Julie DiMauro: Thank you so much. And everybody again, this is Grip’s podcast. You can find us at grip.globalrelay.com. Thank you so much.
