Latest regulations give bankers new concerns

Northwestern Financial Review, Dec 15-Dec 31, 2002 by Dullum, Justin

[interview: Neil Willardson]

Q: What's new on the regulatory front?

Well first, I'll briefly mention that the Fed recently came out with the final Regulation W. Regulation W is one of those documents that provides an interpretation of the regulations that relate to transactions between affiliates and banks. The value of this document isn't that there is a lot of new stuff there but that it takes all of these interpretations and puts them into a single form. It's something people in the banking industry have been waiting for-banks that have affiliates within their bank holding companies. Those companies have found some questions a little difficult to understand. The other issues are the U.S. Patriot Act and Sarbanes-Oxley, the later of which doesn't hold any specific changes for non-- public companies.

Do provisions of Sarbanes-Oxley have the potential to spill over into the private sector?

Federal regulators currently have guidance for all banks applicable to outsourcing functions including internal auditing. It's likely that these provisions will be revisited in light of the requirements of Sarbanes-Oxley. Sarbanes-- Oxley provides some important financial standards for best practices that small banks will find helpful, I think. It might raise the bar to some extent for small banks' corporate governance in general. The bill is really designed for publicly traded companies. And even some of the largest publicly traded banks may find themselves less affected than the non-financial companies because many of the bill's requirements have been in place for larger banks since the passage of the Federal Deposit Insurance Corporation Improvement Act of 1991. So for large and midsized institutions, there isn't much that is new there. For small banks it's a call for best practices. It comes down to maintaining a good reputation.

If I'm on the board of directors, what does Sarbanes-Oxley mean for me?

Banks should be prepared to prove their corporate governance process to regulators. Auditing companies are taking the general requirements of Sarbanes-Oxley pretty seriously. I think that's a good thing for the banking industry. We want involvement from the board of directors. The corporate governance processes within an organization are really only as good as the tone that is set by executive management at the top. They need to set a tone of transparency and clear strategy. They need to show that they execute plans according to approved policy and that they're taking prompt action if there are any discrepancies. When we talk with boards, we ask what kind of information the directors are receiving from executive management. What is the quality of the information you receive?

What do you say about the idea that new accounting and auditing provisions might turn accountants into quasi regulators of banks?

I don't agree with that. I will acknowledge that the rules are intended to preserve and enhance the independent nature of the relationship between banks and their accountants. The intent is for those accounting firms to give their best independent view. While they are certainly service providers to the organization, that independent role is critical to the safety and soundness of the banking system. I can see how that thought might occur, but I'm not sure I agree directly with it. People see the pendulum swinging and think that if it gets to a certain point, you would have a regulatory body, but that's not the intent of any of this and I don't see it going that far.

How is the U.S. Patriot Act going to affect banks?

The provisions that bankers are mostly interested in are those that have to do with customer identification procedures. Those initial regulations were issued in July. It has a number of requirements for financial institutions to implement a customer identification program. There are three main aspects of those requirements. One is to verify the identity of the person seeking to open an account. Second is to maintain records of the information used to verify identity. The third is to determine whether a person is on a list of known or suspected terrorists. Our most common question from bankers concerns the second aspect. What records do I need to maintain to verify that I have checked this person's identity? The final regulations on this have not been issued but I think we might see something shortly.