oversight

Priority Open Recommendations: Board of Governors of the Federal Reserve System

Published by the Government Accountability Office on 2019-04-12.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

441 G St. N.W.                                                                        Comptroller General
Washington, DC 20548                                                                  of the United States


April 5, 2019


The Honorable Jerome H. Powell
Chairman
Board of Governors of the Federal Reserve System
20th St. & Constitution Ave., NW
Washington, DC 20551

Priority Open Recommendations: Board of Governors of the Federal Reserve System

Dear Mr. Chairman:

The purpose of this letter is to provide an update on the overall status of the Board of Governors
of the Federal Reserve System’s (Federal Reserve) implementation of GAO’s recommendations
and to call your personal attention to areas where open recommendations should be given high
priority. In November 2018, we reported that on a government-wide basis, 77 percent of our
recommendations made 4 years ago were implemented. 1 The Federal Reserve’s
implementation rate for these recommendations was 100 percent. As of January 24, 2019, the
Federal Reserve had 34 open recommendations. Fully implementing these open
recommendations could significantly improve the Federal Reserve’s efforts to more effectively
oversee risks to consumers and the safety and soundness of the U.S. banking system.

We have identified 10 priority recommendations that fall into the following three areas (see the
enclosure for the list of these recommendations):

Consumer Protection for Financial Data Aggregation Services. One recommendation
relates to consumer protection for users of financial data aggregation services. Consumers are
using financial technology—or “fintech”—firms to aggregate information from their various
financial accounts, including their assets in bank accounts and brokerage accounts, as a way to
better manage their finances. While financial institutions typically reimburse losses in credit card
or bank accounts arising from unauthorized activity, in March 2018 we found that market
participants disagreed over whether consumers using these financial account aggregators
would be reimbursed if they experience such losses.

Industry efforts to address these issues are underway, and bank and credit union regulators and
the Consumer Financial Protection Bureau have been holding collaborative discussions on the
issues surrounding financial account aggregation. However, these collaborations have yet to
result in any coordinated public outcomes. We recommended that the Federal Reserve engage
in collaborative discussions with other relevant financial regulators and stakeholders to address
these issues. We urge the Federal Reserve to continue to actively participate in ongoing efforts
to help ensure that these efforts result in tangible outcomes that balance both financial
institution and consumer interests.

1
GAO, Performance and Accountability Report: Fiscal Year 2018, GAO-19-1SP (Washington, D.C.: Nov. 15, 2018).




Page 1      GAO-19-355SP Board of Governors of the Federal Reserve System Recommendations
Derisking. One recommendation relates to derisking—the practice of banks limiting services or
ending relationships with customers to, among other things, avoid perceived regulatory
concerns about facilitating money laundering. In our February 2018 report, we determined that
Bank Secrecy Act/anti-money laundering (BSA/AML) regulatory concerns have played a role in
banks’ decisions to terminate and limit customer accounts and close bank branches. However,
the actions taken to address derisking by the federal banking regulators and the Financial
Crimes Enforcement Network (FinCEN) and the retrospective reviews conducted on BSA/AML
regulations have not fully considered or addressed these effects.

We recommended that the Federal Reserve jointly conduct a retrospective review of BSA/AML
regulations and their implementation for banks with the Federal Deposit Insurance Corporation
(FDIC), Office of the Comptroller of the Currency (OCC), and FinCEN and revise regulations or
their implementation, as appropriate. This review should focus on how banks’ regulatory
concerns may be influencing their willingness to provide services. In January 2019, Federal
Reserve staff noted that the Federal Reserve convened a working group in 2018 with FDIC,
OCC, FinCEN, the National Credit Union Administration, and the Office of Terrorism and
Financial Intelligence to identify ways to improve the efficiency and effectiveness of BSA/AML
regulations, supervision, and examinations. While the establishment of the working group has
produced outcomes consistent with encouraging greater efficiency and effectiveness of banks’
BSA/AML compliance programs and reducing burden, we have not yet seen outcomes that
address the full range of factors that may be influencing banks to derisk or close bank branches.

Stress Testing of Banking Institutions. Eight recommendations relate to the stress testing of
banking institutions to assess how they might perform in adverse scenarios. Broadly, the
Federal Reserve’s stress testing programs are intended to evaluate if banking institutions have
sufficient capital and capital planning processes to remain solvent under stressful economic
conditions. In November 2016, we found some limitations in the areas of scenario design and
model risk management, including the following examples:
    • The Federal Reserve’s approach to designing stress test scenarios has not included
        analysis of whether the current approach, which uses one severe economic scenario
        rather than several, is sufficient to assess the resilience of the banking system, or
        proactively considered levels of severity outside of U.S. postwar historical experience.
        Such analysis could help the Federal Reserve to ensure that it is not missing risks to the
        banking system and to guard against those risks.
    • The Federal Reserve’s risk management of its stress test models also has not included
        a focus on the risks associated with the system of models that produce the stress test
        results, in which the results of component models are combined with assumed or
        planned capital actions.
    • Further, the Federal Reserve has not conducted sensitivity and uncertainty analyses of
        how its modeling decisions affect overall results, or developed a process for
        communicating information about uncertainty to the Board or a process for the Board
        and senior staff to articulate tolerance levels for key risks.

We recommended that the Federal Reserve take steps to address the limitations in scenario
design and model risk management. As of January 2019, the Federal Reserve had taken
actions to address some of our recommendations. For example, in some cases the Federal
Reserve has indicated that projects are underway which—upon completion—may result in
implementation of processes that are responsive to our recommendations. However, for other
recommendations, the Federal Reserve has not yet taken actions that fully implement the
recommendation, such as establishing a process to facilitate proactive consideration of scenario



Page 2     GAO-19-355SP Board of Governors of the Federal Reserve System Recommendations
severity that may fall outside U.S. postwar historical experience. For one recommendation, the
Federal Reserve’s responsive actions are part of a proposed rulemaking that has yet to be
finalized. Completing the implementation of our recommendations can help the Federal Reserve
identify and manage the risks introduced into its models and account appropriately for
uncertainty and sensitivity of model results.

                                                      - - - - -

In addition, on March 6, 2019, we issued our biennial update to our high-risk program, which
identifies government operations with greater vulnerabilities to fraud, waste, abuse, and
mismanagement or the need for transformation to address economy, efficiency, or effectiveness
challenges. 2 Our high-risk program has served to identify and help resolve serious weaknesses
in areas that involve substantial resources and provide critical service to the public.

Several government-wide high-risk areas, including (1) ensuring the cybersecurity of the nation,
(2) improving management of information technology acquisitions and operations, (3) strategic
human capital management, (4) managing federal real property, and (5) the government-wide
security clearance process, have implications for the Federal Reserve and its operations. We
urge your attention to these government-wide high-risk issues as they relate to the Federal
Reserve. Progress on high-risk issues has been possible through the concerted actions and
efforts of Congress, the Office of Management and Budget, and the leadership and staff in
agencies, including the Federal Reserve. Another of our high-risk areas is modernizing the U.S.
financial regulatory system, including encouraging regulators to strengthen systemic risk
oversight and monitor progress on reforms.

Copies of this report are being sent to the Director of the Office of Management and
Budget and appropriate congressional committees, including the Committees on Appropriations,
Budget, and Homeland Security and Governmental Affairs, United States Senate; and the
Committees on Appropriations, Budget, and Oversight and Reform, House of Representatives.
In addition, the report will be available at no charge on the GAO website at https://www.gao.gov.

I appreciate the Federal Reserve’s commitment to these important issues. If you have any
questions or would like to discuss any of the issues outlined in this letter, please do not hesitate
to contact me or Lawrance Evans, Managing Director, Financial Markets and Community
Investment at evansl@gao.gov or 202-512-8678. Contact points for our Offices of




2
 GAO, High-Risk Series: Substantial Efforts Needed to Achieve Greater Progress on High-Risk Areas, GAO-19-
157SP (Washington, D.C.: Mar. 6, 2019).


Page 3       GAO-19-355SP Board of Governors of the Federal Reserve System Recommendations
Congressional Relations and Public Affairs may be found on the last page of this report. Our
teams will continue to coordinate with your staff on all of the 34 open recommendations. Thank
you for your attention to these matters.

Sincerely yours,




Gene L. Dodaro
Comptroller General
of the United States



Enclosure

cc: The Honorable Mick Mulvaney, Director, Office of Management and Budget




Page 4      GAO-19-355SP Board of Governors of the Federal Reserve System Recommendations
Enclosure

   Priority Open Recommendations to the Board of Governors of the Federal Reserve
                            System (Federal Reserve)


Consumer Protection for Financial Data Aggregation Services

Financial Technology: Additional Steps by Regulators Could Better Protect Consumers and Aid
Regulatory Oversight. GAO-18-254. Washington, D.C.: March 22, 2018.

Recommendation: The Chair of the Board of Governors of the Federal Reserve System should
engage in collaborative discussions with other relevant financial regulators in a group that
includes all relevant stakeholders and has defined agency roles and outcomes to address
issues related to consumers' use of account aggregation services.

Action Needed: The Federal Reserve agreed with the recommendation. The Federal Reserve
stated that it will continue to facilitate and engage in collaborative discussions with other
relevant financial regulators in these and other settings to help market participants address the
important issues surrounding reimbursement for consumers who use financial account
aggregators and experience unauthorized transactions. In November 2018, Federal Reserve
staff told us that they had met and discussed these issues at a June 2018 meeting, that they are
monitoring industry efforts to resolve the issues, and that additional discussions would be held
in the future. Aligning ongoing collaborative efforts with leading practices could help regulators
and market participants resolve disagreements over financial account aggregation and related
consumer compliance issues more quickly and in a manner that balances the competing
interests involved. Specifically, the collaborating agencies should define the short-term and
long-term outcomes that the collaboration is seeking to achieve and clarify the roles and
responsibilities of the participating agencies.

Managing Director: Lawrance Evans, Jr., Financial Markets and Community Investment
Contact Information: evansl@gao.gov or 202-512-8678


Derisking

Bank Secrecy Act: Derisking along the Southwest Border Highlights Need for Regulators to
Enhance Retrospective Reviews. GAO-18-263. Washington, D.C.: February 26, 2018.

Recommendation: The Chair of the Board of Governors of the Federal Reserve System should
jointly conduct a retrospective review of Bank Secrecy Act/anti-money laundering (BSA/AML)
regulations and their implementation for banks with the Federal Deposit Insurance Corporation
(FDIC), the Office of the Comptroller of the Currency (OCC), and the Financial Crimes
Enforcement Network (FinCEN). This review should focus on how banks’ regulatory concerns
may be influencing their willingness to provide services. In conducting the review, the Federal
Reserve, FDIC, OCC, and FinCEN should take steps, as appropriate, to revise the BSA
regulations or the way they are being implemented to help ensure that BSA/AML regulatory
objectives are being met in the most effective and least burdensome way.




Page 5      GAO-19-355SP Board of Governors of the Federal Reserve System Recommendations
Action Needed: In its agency comment letter dated February 2018, the Federal Reserve said it
would leverage ongoing initiatives to respond to our recommendation. In January 2019, Federal
Reserve staff said that the Federal Reserve convened a working group in 2018 with FDIC,
OCC, FinCEN, the National Credit Union Administration, and the Office of Terrorism and
Financial Intelligence to identify ways to improve the efficiency and effectiveness of BSA/AML
regulations, supervision, and examinations while continuing to meet the requirements of the
statute and regulations, supporting law enforcement, and reducing BSA/AML compliance
burden. Federal Reserve staff believe that the ongoing review conducted by this working group
addresses our recommendation and noted two recent interagency joint statements that resulted
from the activities of the working group as examples. The first, issued in October 2018, clarified
the permissibility of sharing BSA resources among institutions with lower risk profiles to
increase efficiency and reduce burden. The second, issued in December 2018, encouraged
innovative industry approaches by banks to enhance the efficiency and effectiveness of their
BSA/AML compliance programs. While the establishment of the working group has produced
outcomes consistent with encouraging greater efficiency and effectiveness of banks’ BSA/AML
compliance programs and reducing burden, we have not yet seen outcomes that address the
full range of factors that may be influencing banks to derisk or close bank branches. We will
continue to monitor the activities and related outcomes of the working group for actions that are
fully responsive to our recommendation.


Managing Director: Lawrance Evans, Jr., Financial Markets and Community Investment
Contact Information: evansl@gao.gov or 202-512-8678


Stress Testing of Banking Institutions

Federal Reserve: Additional Actions Could Help Ensure the Achievement of Stress Test Goals.
GAO-17-48. Washington, D.C.: November 15, 2016.

Recommendation: To strengthen the scenario design process, the Federal Reserve should
assess—and adjust as necessary—the overall level of severity of its severely adverse scenario
by establishing a process to facilitate proactive consideration of levels of severity that may fall
outside U.S. postwar historical experience.

Action Needed: In January 2019, Federal Reserve staff stated that, in accordance with its
Policy Statement on the Scenario Design Framework for Stress Testing, the Federal Reserve
generates and considers scenarios with severity levels that fall outside of postwar U.S. history.
While the framework may produce scenarios that in some ways exceed postwar severity levels,
it does not indicate that a process has been established to facilitate proactive consideration of
such severity levels. We will continue to monitor the Federal Reserve's implementation of its
scenario design framework for actions that may be responsive to our recommendation.

Recommendation: To strengthen the scenario design process, the Federal Reserve should
assess—and adjust as necessary—the overall level of severity of its severely adverse scenario
by expanding consideration of the trade-offs associated with different degrees of severity.

Action Needed: In January 2019, the Federal Reserve said it had initiated two projects that
would allow a more efficient evaluation of multiple scenarios, including assessing trade-offs
associated with different levels of scenario severity. We will continue to monitor the Federal



Page 6      GAO-19-355SP Board of Governors of the Federal Reserve System Recommendations
Reserve's completion and implementation of these projects and any additional actions it takes
that may be responsive to our recommendation.

Recommendation: To improve understanding of the range of potential crises against which the
banking system would be resilient and the outcomes that might result from different scenarios,
the Federal Reserve should assess whether a single severe supervisory scenario is sufficient to
inform Comprehensive Capital Analysis and Review (CCAR) decisions and promote the
resilience of the banking system. Such an assessment could include conducting sensitivity
analysis involving multiple severe supervisory scenarios—potentially using CCAR data for a
cycle that is already complete, to avoid concerns about tailoring the scenario to achieve a
particular outcome.

Action Needed: In January 2019, the Federal Reserve said it had initiated two projects that
would allow a more efficient evaluation of multiple scenarios. We will continue to monitor the
Federal Reserve's completion and implementation of these projects and any additional actions it
takes that may be responsive to our recommendation.

Recommendation: To improve the Federal Reserve's ability to manage model risk and ensure
that decisions based on supervisory stress test results are informed by an understanding of
model risk, the Federal Reserve should apply its model development principles to the combined
system of models used in the supervisory stress tests.

Action Needed: In 2017, the Federal Reserve took actions to address the incorporation of a
combined system of models into execution of its supervisory stress tests, including amending
guiding principles and policies governing supervisory stress test model development. In
January 2019, the Federal Reserve indicated that it was nearing completion of model-system
documentation and had initiated a longer-term project to test the system of models. Once we
receive documentation demonstrating the Federal Reserve’s application of model development
principles to the combined system of models—including the completion of these projects—we
will update the status of this recommendation.

Recommendation: To improve the Federal Reserve's ability to manage model risk and ensure
that decisions based on supervisory stress test results are informed by an understanding of
model risk, the Federal Reserve should create an appropriate set of system-level model
documentation, including an overview of how component models interact and key assumptions
are made in the design of model interactions.

Action Needed: In January 2019, the Federal Reserve indicated that it was nearing completion
of a project to develop system-level model documentation. Once we receive documentation, we
will update the status of this recommendation.

Recommendation: To improve the Federal Reserve's ability to manage model risk and ensure
that decisions based on supervisory stress test results are informed by an understanding of
model risk, the Federal Reserve should design and implement a process to test and document
the sensitivity and uncertainty of the model system's output—the post-stress capital ratios used
to make CCAR quantitative assessment determinations—including, at a minimum, the
cumulative uncertainty surrounding the capital ratios and their sensitivity to key model
parameters, specifications, and assumptions from across the system of models.

Action Needed: In January 2019, the Federal Reserve said that it had previously initiated
multiple projects to respond to our recommendation and that several of these were complete.


Page 7     GAO-19-355SP Board of Governors of the Federal Reserve System Recommendations
We will continue to monitor the Federal Reserve's completion and implementation of these
projects, and we will update the status of this recommendation once we receive documentation
demonstrating the completion of responsive actions.

Recommendation: To improve the Federal Reserve's ability to manage model risk and ensure
that decisions based on supervisory stress test results are informed by an understanding of
model risk, the Federal Reserve should design and implement a process to communicate
information about the range and sources of uncertainty surrounding the post-stress capital ratio
estimates to the Board during CCAR deliberations.

Action Needed: In January 2019, the Federal Reserve said it had previously initiated a project
to respond to our recommendation. We will continue to monitor the Federal Reserve’s
completion and implementation of this project, and we will update the status of this
recommendation once we receive documentation demonstrating the completion of responsive
actions.

Recommendation: To improve the Federal Reserve's ability to manage model risk and ensure
that decisions based on supervisory stress test results are informed by an understanding of
model risk, the Federal Reserve should design and implement a process for the Board and
senior staff to articulate tolerance levels for key risks identified through sensitivity testing and for
the degree of uncertainty in the projected capital ratios.

Action Needed: In January 2019, the Federal Reserve said that it had previously initiated a
project to respond to our recommendation. We will continue to monitor the Federal Reserve’s
completion and implementation of this project, and we will update the status of this
recommendation once we receive documentation demonstrating the completion of responsive
actions.

Managing Director: Lawrance Evans, Jr., Financial Markets and Community Investment
Contact Information: evansl@gao.gov or 202-512-8678




(103216)


Page 8      GAO-19-355SP Board of Governors of the Federal Reserve System Recommendations
This is a work of the U.S. government and is not subject to copyright protection in the United States.
The published product may be reproduced and distributed in its entirety without further permission
from GAO. However, because this work may contain copyrighted images or other material,
permission from the copyright holder may be necessary if you wish to reproduce this material
separately.
                         The Government Accountability Office, the audit, evaluation, and investigative
GAO’s Mission            arm of Congress, exists to support Congress in meeting its constitutional
                         responsibilities and to help improve the performance and accountability of the
                         federal government for the American people. GAO examines the use of public
                         funds; evaluates federal programs and policies; and provides analyses,
                         recommendations, and other assistance to help Congress make informed
                         oversight, policy, and funding decisions. GAO’s commitment to good government
                         is reflected in its core values of accountability, integrity, and reliability.

                         The fastest and easiest way to obtain copies of GAO documents at no cost is
Obtaining Copies of      through GAO’s website (https://www.gao.gov). Each weekday afternoon, GAO
GAO Reports and          posts on its website newly released reports, testimony, and correspondence. To
                         have GAO e-mail you a list of newly posted products, go to https://www.gao.gov
Testimony                and select “E-mail Updates.”

Order by Phone           The price of each GAO publication reflects GAO’s actual cost of production and
                         distribution and depends on the number of pages in the publication and whether
                         the publication is printed in color or black and white. Pricing and ordering
                         information is posted on GAO’s website, https://www.gao.gov/ordering.htm.
                         Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
                         TDD (202) 512-2537.
                         Orders may be paid for using American Express, Discover Card, MasterCard,
                         Visa, check, or money order. Call for additional information.

                         Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Connect with GAO         Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.
                         Visit GAO on the web at https://www.gao.gov.

                         Contact:
To Report Fraud,
                         Website: https://www.gao.gov/fraudnet/fraudnet.htm
Waste, and Abuse in
                         Automated answering system: (800) 424-5454 or (202) 512-7470
Federal Programs
                         Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400,
Congressional            U.S. Government Accountability Office, 441 G Street NW, Room 7125,
Relations                Washington, DC 20548

                         Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
Public Affairs           U.S. Government Accountability Office, 441 G Street NW, Room 7149
                         Washington, DC 20548

                         James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707
Strategic Planning and   U.S. Government Accountability Office, 441 G Street NW, Room 7814,
External Liaison         Washington, DC 20548




                            Please Print on Recycled Paper.