WASHINGTON There may as well be two different industries when it comes to risks threatening the banking sector, according to a report from the Office of the Comptroller of the Currency.
Compliance challenges and operational risk are clear warning signs for the big banks, the OCC said in its Semiannual Risk Perspective. But the report outlined an entirely different set of issues for midsize and community banks, which are instead threatened by slow growth and an uncertain interest rate environment.
"We are definitely seeing more operational risk issues, compliance-related issues at many of our larger banks" while community banks are dealing with risks arising from "looking for the profitability, looking for the yield, attempting to find the loan growth," Darrin Benhart, the OCC's deputy comptroller for supervision risk management, said on a conference call to discuss the report.
The report, which covers risk trends for the second half 2014, reiterated that cybersecurity is a principal concern for the industry. It also raised red flags about banks' exposure to the oil and natural gas industry, commercial real estate concerns, underwriting standards for indirect auto lending, leveraged loans and a looming end to the draw period for home equity lines of credit.
"Cybersecurity and cyber threats have obviously been at the top of the OCC priority risk for the last two years," Beth Dugan, deputy comptroller for operational risk at the OCC, said on the conference call.
The OCC listed "high strategic risk" associated with "intense competitive pressures" as the top concern facing community and midsize banks. That was followed by issues dealing with management succession and retaining key staff, as well as eroding credit underwriting.
Meanwhile, weakness in enterprise risk practices, high levels of operational risk and growing cyber-related vulnerabilities were the top three risks facing large banks.
Yet cybersecurity was noted as an area of concern for banks of all sizes, the OCC said.
Dugan said that as bigger banks fortify their cyberdefenses, cybercriminals appear to be moving down the food chain to find institutions with more vulnerable systems.
"Cyber threats are increasing just across the entire environment," Dugan said. She added that the threat is increasing for smaller banks as larger banks adopt mitigating controls. "The bad actors are just going down looking for the weakest link," Dugan said.
Benhart said falling oil prices have led to concerns not only about banks' direct exposure to the oil and natural gas industry, but also about indirect exposure to other correlated businesses such as the office and hospitality sectors that are starting to feel the effects of the falling prices.
"We are starting to see some credit issues that are related to the oil and gas industry," he said.
The report also noted that underwriting standards for commercial real estate, leveraged loans and indirect auto lending continue to be a risk.
Syndicated leveraged loan volume fell 17% in 2014, but it was still the second-highest level on record, the OCC said. The average debt-to-earnings "multiples" for leveraged loans before interest, depreciation and amortization rose to 4.9 times in 2014, higher than the 4.7 figure registered a year earlier and the highest level since 2007.
Benhart also pointed to a wave of home equity lines that will reach the end of the draw period over the next three years, increasing the potential for delinquencies.
"2015 is the start of a three-year period when roughly $131 billion, or almost half of outstanding HELOC balances, have scheduled transitions from draw period to repayment," Benhart said.
Bank Secrecy Act and anti-money laundering compliance was also a risk. Similar to cyber-related concerns, the OCC said high-risk customers are starting to turn up in smaller institutions as larger banks are either declining their accounts or implementing stronger defenses.
"Displacement of customers due to reevaluation strategies by larger institutions may result in the continued on-boarding of higher-risk customers by banks that potentially have less experience with associated BSA risks," the OCC said.