The May 25, 2018, compliance effective date of the EU’s General Data Protection Regulation (GDPR) is just weeks away, and many U.S.-based companies have at least by now taken stock of their EU customer base and operations, and developed a baseline set of compliance plans.  For many, that might only entail a data inventory and controls that would ensure that changes to the company’s business plan, advertising strategies, and physical footprint would be assessed for GDPR compliance in advance, just as with any other area of compliance.  However, for companies whose business relies upon the gathering and use of consumer data, the GDPR implementation process has been onerous.

In particular, as recent American Banker coverage has described, this compliance effort is hitting financial institutions of all sizes hard.  While the exact nature and magnitude of enforcement exposure is still unclear, U.S. banks should take a broad view of their overseas business – including where U.S. customers temporarily work or travel – in order to stay ahead of GDPR compliance issues.

For U.S.-based small businesses, including community banks, the conventional wisdom has focused on whether the institution solicits or services EU customers.  Unfortunately this approach may cause banks or other businesses to underestimate their potential exposure.

For purposes of the GDPR, compliance obligations for companies without a physical presence in the EU are generally only implicated if the company (1) offers goods and services in the EU or (2) monitors the behavior of EU customers (referred to affectionately as “data subjects” in the regulation).

Of particular concern for community banks is whether tourists, foreign work assignments, or overseas service members could cause the bank to become subject to GDPR obligations.

In this the new era of banking, our clients are continually looking for ways to enhance efficiency and effectiveness at all levels of their organizations. This line of thinking has led to the revolution of the bank branch and the adoption of many new technologies aimed at serving customers and automating or otherwise increasing process efficiency. Perhaps most importantly, however, banks have begun to focus on optimizing their governance structures and practices, particularly at the board level.

(A print version of this post if you’d like to print or share with others is available here.)

As we discuss this topic with our clients, the conversation quickly turns to the role and function of the bank’s director loan or credit committee, which we refer to herein as the “Loan Committee.” We continue to believe that Loan Committees should move away from the practice of making underwriting decisions on individual credits absent a specific legal requirement, and here we set forth the position that this change should be made in order to enhance Board effectiveness, not just to avoid potential liability.

Ensuring Board Effectiveness

Whenever we advise clients with regard to governance, our fundamental approach is to determine whether a given course of action helps or hinders the Board’s ability to carry out its core functions. Defining the core functions of a Board can be a difficult task. Fortunately, the staff of the Board of Governors of the Federal Reserve System recently outlined its view of the core functions of a bank Board. We agree with the Federal Reserve’s outline of these functions as set forth in its proposed guidance regarding Board Effectiveness applicable to large banks, which was based on a study of the practices of high-performing boards. Based on our experiences, many of the concepts expressed in that proposed guidance constitute board best practices for banks of any asset size. The proposed guidance indicates that a board should:

• set clear, aligned, and consistent direction;
• actively manage information flow and board discussions;
• hold senior management accountable;
• support the independence and stature of independent risk management and internal audit; and
• maintain a capable board composition and governance structure.

We believe that an evaluation of the board’s oversight role relative to the credit function is a necessary part of the proper, ongoing evaluation of a bank’s governance structure. As it conducts this self-analysis, a board should evaluate whether the practice of underwriting and making credit decisions on a credit-by-credit basis supports its pursuit of the first four functions. We believe that it likely does not.

Considering Individual Credit Decisions May Hinder the Committee’s Ability to Set Overall Direction for the Credit Function.

We have observed time and time again Loan Committee discussions diving “into the weeds” and, in our experience, once they are there they tend to stay there. In most Loan Committee meetings, the presenting officer directs the committee’s attention to an individual credit package and discusses the merits and challenges related to the proposal. Committee members then typically ask detailed questions about the particular financial metrics, borrower, or the intended project, assuming that any discussion occurs at all prior to taking a vote.

While it may sometimes be healthy to quiz officers on their understanding of a credit package, focusing on this level of detail may deprive the Loan Committee of the ability to focus on setting direction for the bank’s overall loan portfolio. In fact, in many of the discussions of individual credits, detailed questions about the individual loan package may in fact distract from the strategic and policy questions that really should be asked at the board level, such as “What is the market able to absorb with regard to projects of this type?” and “What is our overall exposure to this segment of our market?”

It can be a challenge, when economic times are relatively good, to take time away from thinking about new opportunities to discuss topics like D&O insurance.  Even though I am biased, I’ll admit that, in those times, discussing the risks of potential liability and how to insure those risks can feel both a pretty unpleasant and a pretty remote thing to be discussing.  However, like all risk-related issues, it is precisely in those times when business is going well that a little bit of counter-cyclical thinking and attention can do the most good over the long haul.

As you approach your next D&O policy renewal – and particularly in the 30-60 days prior to the expiration of your current policy, there are a few things that you may want to consider.

Multi-year endorsements – what’s the catch? 

In good times, many insurers will offer packages styled as multi-year policies, usually touted as an option that allows for some premium savings and perhaps a reduced administrative burden.  However, as with all things, these advantages may come with a catch.

Many multi-year endorsements will reserve to the insurer the discretion to assess additional premium on an annual basis within the multi-year period if the risk profile of the bank changes in a material way.  So premium savings may not ultimately be realized, depending on the facts.

Beyond this, some multi-year endorsements will actually impose additional requirements on the insured to provide notice of events that could trigger the carrier’s repricing rights or other conditions.  Those obligations may be triggered when those events occur on an intra-period basis, which can set up a potential foot-fault for an organization that does not keep those requirements front of mind (which can be a practical challenge, as if those events are happening, it is likely that there are a number of issues competing for management and the board’s attention).

Companies looking at multi-year endorsements should make sure they understand fully the terms on which the multi-year option is being provided and should have counsel or an independent broker review the specific language of the proposed multi-year endorsement itself on their behalf.  In addition, while it may be tempting to use a multi-year endorsement to try to extend the renewal horizon and to try to reduce the administrative burden that comes with the renewal process, doing so may also reduce your ability to negotiate appropriate enhancements to your policy terms over the multi-year period.

Multi-year policies may be the right fit for your institution, but they should not be viewed as a one size fits all solution.  Before heading down that road, ask yourself how much is being saved and how real those savings actually are and, perhaps just as importantly, whether avoiding a broader discussion of your coverage strategy on at least an annual basis is a good thing or not.

What about the bank has changed? 

Times of economic expansion often bring with them opportunities to explore new lines of business.  In addition, substantial recent technological innovations in the financial services industries and increasing consumer demands for technological solutions have meant that not only are new market opportunities being explored but that they are being explored in new ways.  And if that isn’t enough, there is always the ever-changing regulatory and compliance landscape to contend with.

All of these trends – as well as your decisions of where and how your institution will choose to participate (or not to participate) in them – bring with them new and different risks.  To the extent that your bank has expanded its offerings, changed its footprint or portfolio mix, or otherwise changed its policies or ways of doing business, you should think about how those changes may impact your insurance needs.  It can be easy, particularly when you have a long relationship with an incumbent carrier, for the renewal process to become somewhat rote.

In recent exam cycles, bankers have generally been no strangers to heightened scrutiny by FDIC examiners on a variety of topics.  In the past several months, the insurance policies carried by banks have been added to the list of potential hot-button items.

Specifically, FDIC examiners have begun to scrutinize bank insurance policies to determine whether the policies provide coverage for civil money penalties (“CMPs”) that may be assessed against bank officers or directors. If any bank insurance policies are found on examination to contain an endorsement extending coverage for CMPs to officers or directors, the FDIC is citing such policies as being in violation of Part 359 of the FDIC’s Rules and Regulations.

Part 359, among other things, prohibits banks and affiliated holding companies from making certain “prohibited indemnification payments.” These prohibited payments include any payment or agreement to pay or reimburse bank officers or directors for any CMP or judgment resulting from any administrative or civil action which results in a final order or settlement in which that officer or director is assessed a CMP, removed from office or ordered to cease and desist from certain activities. As a matter of public policy, this provision is designed to prevent banks from bearing the costs of penalties assessed against individuals for actions that could result in harm or potential harm to a bank or to the safety and soundness or integrity of the banking system more generally.

Part 359 explicitly permits reasonable payments by banks to purchase commercial insurance policies, provided that the policy not be used to pay or reimburse an officer or director the cost of any judgment or CMP assessed against him or her. However, Part 359 does permit the insurance paid for by the bank to cover (1) legal or professional expenses incurred in connection with such a proceeding and (2) the amount of any restitution to the bank, its holding company, or its receiver.

Read More

A representative of the Federal Reserve Bank of Atlanta has informed us that the Treasury does not intend to process any applications for private companies until all public company applications have been processed.  As a result, we expect (and the Federal Reserve did not deny) that a December 31 funding date is probably a realistic expectation only for public companies at this point.  We hope that Treasury will begin to realize some efficiencies in the processing of closing documents, but December 31 is approaching rapidly.

To the extent that any privately-held clients may be expecting a potential TARP infusion to keep them “well-capitalized” at December 31, 2008, they may need to also be working on Plan B.

We are beginning to receive some indication of how the Federal Reserve will be reviewing TARP Capital Applications for public member banks.  As institutions begin to file applications in greater numbers, we believe the review process is starting to gel from a methodological standpoint (although the regulators still say they receive new guidance daily).  We have not yet had any indication as to how consistent this review methodology may be between regulatory agencies.

We understand that the review will generally consist of a 3-part process:

• First, the regional director of applications risk will serve as an initial point-of-contact person who will review the application and any follow-up materials that may be requested.  The plan is for this initial review period to take approximately 3 days, although this time period could be extended, depending on the circumstances of a particular application and the volume of applications being processed.
• Second, the application will be passed along to a 5-member panel.  This panel will review the application and make the decision as to whether an “invest” recommendation should be made to Treasury.
• Finally, Treasury will make its ultimate investment decision, based in large part on the recommendation of the regulators.

The review process, from the filing of an application to an ultimate decision by Treasury to fund, may be completed in as little as 5-7 days, although this process could be drawn out considerably, based on the circumstances.