Some small banks and credit unions are still operating in the technological Dark Ages, unable to upload files during the pandemic to regulators, who were forced to scale back audits, the Government Accountability Office said.
The revelation that some small financial institutions are still relying heavily on paper files and couldn't send documents to their regulators' secure portals was revealed Thursday in a
Some small banks were unable to perform routine tasks such as sharing credit files or loan documents with examiners and couldn't provide access to internal systems so examiners could conduct loan reviews and testing, the GAO said.
The report, a post-mortem examining "lessons learned" from remote bank supervision, found that regulators faced many challenges conducting audits due to the technology gap between large and small financial institutions.
"In order to accommodate a fully off-site examination during the pandemic, smaller institutions needed on-site staff and technology resources to scan loan files or coordinate remote access to their internal systems," the GAO said. "Some institutions lacked staff resources or faced technological limitations."
The idea that some banks could not upload documents as part of routine exam work is puzzling given that most audit firms use secure portals and adjusted during the pandemic to sharing documents, even in Zoom meetings.
The GAO interviewed 110 examiners at five regulatory agencies and found that regulators temporarily delayed exams when banks could not provide loan files or other documentation for examiners to assign a rating. The government watchdog noted that regulators went into overdrive in March 2020 by deferring exams, expanding off-site monitoring, adjusting telework policies, and providing technology and guidance to examiners working remotely.
Still, the pandemic contributed to an overall decline in the number of bank exams conducted in 2020, though the drop differed dramatically by regulator.
Bank audits by regulators plummeted across the board in 2020, but most precipitously by the Federal Reserve, whose examinations fell 30% year-over-year. The National Credit Union Administration's examinations fell by 17%, while the Federal Deposit Insurance Corp. posted an 8% decline and the Office of the Comptroller of the Currency fell 3.5% in 2020.
The Consumer Financial Protection Bureau, which is not technically a "prudential" regulator, posted a 21% decline to 105 exams in 2020. But the CFPB also differed from other regulators by conducting "prioritized assessments," during the pandemic with a focus on entities in markets that it believed posed elevated risks of consumer harm. The CFPB conducted 312 prioritized assessments in 2020 and 150 in 2021.
The GAO also noted that bank exams have been on the decline for a decade due to bank consolidation. In addition, legislation raised the asset threshold of banks eligible for an 18-month examination cycle from $1 billion to $3 billion under the Economic Growth, Regulatory Relief, and Consumer Protection Act, passed by then-President Trump in 2018.
While regulators had little trouble conducting off-site remote supervision of large banks with the aid of videoconferencing and other technology tools, some small institutions seemingly could not accommodate their regulator.
"Examiners told us they had challenges carrying out some examination steps in institutions that had only physical (hard copy, non-imaged) credit files or that did not have technology capable of allowing examiners to gain access to bank internal systems remotely to carry out examination activities such as loan reviews or transaction testing," the GAO said.
The FDIC went so far as to provide scanners — or, in some cases, third-party contractors — to supervised banks that needed to scan loan files. The NCUA permitted some examiners to pick up documents in person from a bank. When banks had difficulty providing certain information digitally, the OCC modified the timing of exams and worked with institutions on technology or other solutions, the GAO said.
Before the pandemic, bank examiners and staff conducted key parts of their work on-site at supervised entities. But staffing challenges impacted remote exam work. On-the-job training and informal communications between banks and regulators came to a halt seemingly overnight.
Due to such challenges, the Fed shifted staff to examine banks deemed to be at higher risk and to support implementation of its emergency lending facilities. Because exams of small institutions took longer during the pandemic, the FDIC temporarily hired back retired employees to assist in carrying out exams and offered a 2020 leave buyback program to increase available work hours for existing staff.
While the GAO did not specifically say that the pandemic resulted in less rigorous exams, nevertheless, regulators were forced to scale back the depth of loan reviews, the size of samples requested for testing of transactions and the volume or type of documentation reviewed. At the Fed, examiners reduced the number of loans reviewed and relied more on bank self-reporting, the GAO said.
The GAO report said that learning lessons from a major crisis is "a principal component of an organizational culture committed to continuous improvement."
While three of the regulators completed or have begun to identify actions to better manage future disruptions to on-site exams, the OCC appeared to be the sole outlier in not reviewing potential lessons learned to prepare for future crisis events.
The GAO had two recommendations but only for the Fed and the OCC.
Though the concepts are abstract, the GAO suggested that the Fed assess risks to its supervisory work by focusing on an enterprise risk management framework. In response, the Fed's Chief Operating Officer Pat McClanahan responded by saying the Fed "continues to develop an enterprise risk management framework that will provide a strategic view for comprehensively managing all material risks faced by the Board, including pandemic-related risks."
The OCC had not conducted a review of "lessons learned" during the pandemic, the GAO said. Greg Coleman, the OCC's senior deputy controller for large- bank supervision, wrote in a letter to the GAO that the OCC plans to complete a lessons learned analysis by March 31, 2023.
