An Action Plan for the Bank Regulators

An economy that works for all Americans can only be built on a stable, fair, and inclusive banking system. When financial institutions collapse—as they did during the 2008 financial crisis—borrowers cannot obtain the loans they need to support their businesses, employers lay off workers, the economy falters, and society’s most vulnerable suffer. In addition to facilitating inclusive and sustainable economic growth, financial stability is essential for promoting other progressive values, such as tackling climate change, advancing labor rights, ensuring workplace equality, and safeguarding democratic governance.

Fortunately, the federal bank regulatory team is nearly complete. This week, the Senate Banking Committee advanced Michael Barr’s nomination to become the Federal Reserve Board’s top bank regulator. Once confirmed, Barr will join Democratic appointees already installed at the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corp. (FDIC). These three agencies are collectively responsible for ensuring the banking system is safe, fair, and accessible so as to facilitate the development of a broadly inclusive economy.

As the economy recovers from the pandemic and new financial risks continue to emerge, bank regulators have big tasks ahead of them. This report proposes a comprehensive bank regulatory agenda for the duration of President Joe Biden’s first term. Specifically, the banking agencies should undertake three sets of initiatives to improve the safety and accessibility of the financial system.

During the Trump administration, the banking agencies weakened numerous safeguards that had been enacted in response to the 2008 financial crisis. If left in place, this ill-advised deregulation could permit risks to proliferate through the financial system, leading to another collapse.

Below are three of the most concerning Trump-era rollbacks that the banking agencies should reverse.

Stress testing

In the wake of the 2008 financial crisis, stress testing emerged as the Federal Reserve’s primary tool for assessing the banking sector’s stability. Under annual tests mandated by the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), the Federal Reserve assessed whether the United States’ largest banks would maintain minimum capital levels in a hypothetical severely adverse economic scenario. A bank that failed the stress test could be restricted from paying dividends or buying back shares.

However, under the leadership of Trump-appointed Vice Chair for Supervision Randal Quarles, the Federal Reserve weakened the stress test by relaxing key assumptions and providing banks detailed information about the central bank’s models.¹ As a result, the stress test is now less stressful, and banks can more easily “game” the system through reverse engineering. The upshot is that the watered-down tests might allow the United States’ largest banks to reduce their capital levels by up to 10 percent.²

To address this, the Federal Reserve should undo the Trump-era reforms and further strengthen the stress test to ensure that big banks maintain sufficient capital cushions to withstand severe economic downturns without a taxpayer bailout.³

Tailoring

Before the 2008 financial crisis, U.S. policymakers generally held banks to similar regulatory standards, regardless of their size. Yet the collapse of Wachovia, Washington Mutual, Countrywide, and IndyMac in 2008 vividly demonstrated that large, interconnected depository institutions can pose unique risks to the global economy. Accordingly, the Dodd-Frank Act created a new system of tiered regulation that subjected banks to increasingly stringent rules as their asset size increased. Initially, the most significant rules—including leverage limits, liquidity requirements, and risk-management standards—applied to banks with more than $50 billion in assets, approximately 30 institutions in total.⁴

In 2018, the Republican-controlled Congress adopted the Economic Growth, Regulatory Relief, and Consumer Protection Act, which lifted the threshold for the most meaningful rules from $50 billion to $250 billion in assets.⁵ In implementing this law, however, the Federal Reserve did much more than Congress instructed: It also “tailored”—or weakened—regulatory requirements for large regional and foreign banks with between $250 billion and $700 billion in assets.⁶ For example, the Federal Reserve reduced liquidity standards for these banks by 15 percent and eliminated the requirement that such firms calculate their capital ratios using sophisticated financial models.

Going forward, regulators should undo the “tailoring” provisions that are not required by statute, in recognition of the risks that firms such as U.S. Bank, PNC, Truist, TD Bank, and Capital One could pose to the domestic economy. Regulators should also require large regional banks to maintain a special type of convertible debt that would help facilitate an orderly resolution if such a firm were to fail, as acting Comptroller of the Currency Michael Hsu recently proposed.⁷

The Volcker Rule

As one of the centerpieces of the Dodd-Frank Act, the Volcker Rule sought to prevent banks and their affiliates from taking speculative risks.⁸ Named after its strongest proponent, former Federal Reserve Chair Paul Volcker, the rule contained two prohibitions: 1) it barred banking entities from engaging in proprietary trading, and 2) it restricted banking entities from investing in hedge funds or private equity funds. Volcker, who passed away in 2019, famously warned that if policymakers did not curb speculative activity in the banking system, “I might not live long enough to see the crisis but my soul is going to come back and haunt you.”⁹

Under the Obama administration, five agencies collaborated on regulations to implement the Volcker Rule and limit banks’ exposure to speculative trading activity. Under the Trump administration, however, the same agencies significantly watered down the Volcker Rule’s restrictions, allowing speculative risks to reenter the banking system.¹⁰ Among other misguided reforms, the Trump-era reforms exempted approximately $600 billion of assets from the proprietary trading prohibition and reversed the ban on banking entities investing in credit funds and venture capital funds.¹¹

The financial regulators should restore the Volcker Rule to ensure that banking entities remain focused on providing critical financial services to households and businesses, not risky speculative activities.

In addition to reversing Trump-era actions, the banking agencies ought to complete several long-delayed regulatory initiatives. In some instances, the banking agencies have not updated essential regulations in several decades, while the financial industry has undergone radical transformations. In other cases, the banking agencies have never issued regulations at all, despite Congress telling them to do so.

Below are three long-overdue projects that the bank regulators should finally finish.

Incentive compensation reform and other unfinished Dodd-Frank rules

When Congress enacted the Dodd-Frank Act in 2010, the law required the banking agencies to adopt rules governing incentive-based compensation at large financial institutions.¹² These rules would prohibit banks with more than $1 billion in assets from compensating employees in a way that “encourages inappropriate risks” or “could lead to material financial loss” to the bank.¹³ Congress included these rules in the law due to the role compensation played in precipitating the 2008 financial crisis. The Financial Crisis Inquiry Commission noted that financial institutions “provid[ed] aggressive incentives, often tied to the price of their shares and often with accelerated payouts,” that encouraged immediate profits while risking significant future losses.¹⁴ Recognizing the importance of the incentive compensation rules, Congress required them to be enacted within nine months following the passage of the Dodd-Frank Act.

More than one decade later, however, those rules have yet to be finalized. The bank regulators should prioritize the completion of incentive compensation reform to ensure inappropriate pay arrangements do not continue to promote excessive risk-taking on Wall Street.

The executive compensation rules are not the only important Dodd-Frank Act regulations left unfinished. For example, Congress required the banking agencies to issue new rules explaining how bank holding companies must serve as a “source of strength” for depository institutions¹⁵ and authorized the Federal Reserve to enact regulations restricting transactions between depository institutions and their parents, affiliates, and insiders.¹⁶

The banking regulators must finalize these and other important reforms to ensure that the problems that led to the 2008 financial crisis cannot occur again.

Community Reinvestment Act modernization

Regulations implementing the Community Reinvestment Act (CRA)—a law enacted to combat redlining in low-income neighborhoods and communities of color by ensuring credit access—were last updated in 1995. Much has changed since then.¹⁷ The internet now allows banks to make loans nationwide regardless of their physical branch locations;¹⁸ banking deserts are more pronounced and predatory lenders increasingly harm communities of color; and the threats from climate change are more damaging to homes and businesses.¹⁹

Under the CRA, a bank is annually assessed on its “record of meeting the credit needs of its entire community, including low- and moderate-income neighborhoods.”²⁰ The regulators’ 1995 rules evaluate a bank on a number of factors, such as its “record of helping to meet the credit needs of its assessment area(s) through its lending activities”;²¹ its “qualified investments”;²² and “the availability and effectiveness of a bank’s systems for delivering retail banking services.”²³ Importantly, only loans affecting a bank’s assessment area(s) are counted; an assessment area “include[s] the geographies in which the bank has its main office, its branches, and its deposit-taking [ATMs]” and surrounding areas.²⁴ Yet because rural communities are particularly vulnerable to banking deserts and majority-Black communities have been more likely than others to lose bank branches, current CRA regulations have a lower impact on these communities.²⁵

Banking regulators should significantly amend their current CRA regulations to account for changes that have occurred over the past quarter-century. Among the potential actions, the regulators should expand the definition of assessment area to incentivize banks with a nationwide footprint to provide financial services and lending in banking deserts; strengthen CRA enforcement by implementing “stringent, quantitative benchmarks” and measuring socioeconomic outcomes;²⁶ support banks’ efforts to provide “flexible, innovative, small-dollar credit alternatives”;²⁷ and implement “a climate resilience and environmental justice finance mandate” that banks must meet to ensure that banks address the climate crisis.²⁸

The banking regulators recently proposed new CRA rules that would implement each of these changes; their finalized rules should be at least as strong as the proposal.

Bank mergers

More than 30,000 banks operated in the United States one century ago. In large part due to mergers and acquisitions, fewer than 5,000 remain today.²⁹ This dramatic consolidation of the banking sector has weakened competition, harmed consumers, and intensified risk to financial stability. After Congress first instructed the banking agencies and the U.S. Department of Justice (DOJ) to review bank merger proposals in the 1960s, the agencies regularly blocked deals they believed to be anti-competitive or otherwise not in the public interest. Today, however, the federal banking agencies have not denied a bank merger since 2003, and the DOJ has not challenged a bank merger since 1985.³⁰

In the meantime, big banks have continued gobbling up competitors. For example, BB&T and SunTrust merged in 2019, creating Truist, which at the time was the sixth-largest bank in the United States.³¹ PNC has since surpassed Truist with its acquisition of BBVA’s $100 billion of U.S. assets in 2021.³² Pending mergers by both U.S. Bank and TD Bank would further increase concentration among the largest regional banks.

The DOJ and the banking agencies have not updated their bank merger guidelines since 1995.³³ It is long past time for the agencies to revisit their framework for analyzing bank merger proposals.

President Biden issued an executive order on competition in July 2021, which, among other things, encouraged the DOJ and the banking agencies to “adopt a plan … for the revitalization of merger oversight.”³⁴ Both the DOJ and the FDIC have requested public comment on potential revisions to their bank merger guidelines.³⁵ The Federal Reserve and the OCC should follow suit, and the four agencies should collaborate on a joint framework to strengthen merger oversight and thereby better protect consumers and the broader financial system.

In addition to revisiting old rules, banking regulators must also look forward. Banks face new risks today, and the banking agencies must ensure banks are equipped to continue providing the vital financial services upon which their communities rely.

Below are three emerging risks that the banking agencies must address.

Climate change

Financial institutions face significant risks from climate change in the form of both physical and transition risks.³⁶ Physical risks include those stemming from acute and chronic physical damages that can result from extreme storms, flooding, or wildfires, as well as productivity losses that stem from extreme temperatures. Transition risks include those resulting from the ongoing transition away from high-carbon industries and associated legal and financial liabilities. The banking agencies are responsible for ensuring that banks do not operate in an “unsafe or unsound condition”³⁷ and for responding to “emerging threats to the stability of the United States financial system.”³⁸ Accordingly, they must prepare banks for these climate risks.

Importantly, climate risks manifest themselves in ways that are similar to those that banks routinely face, such as in the form of credit risk, market risk, and operational risk. Farmers may be unable to repay loans if their crops are destroyed; the fossil fuel infrastructure acting as collateral for oil and gas companies may become obsolete or lack demand; and banks cannot make new loans if their own offices or technology are inaccessible due to extreme weather events.

Likewise, the tools regulators have to ensure banks remain safe and sound in the face of climate risks are also similar to those they regularly use. The banking agencies should issue clear supervisory guidance explaining to banks the climate-related risks they face and expectations for how they can mitigate those risks; require banks to disclose to investors and depositors their exposures to climate-related risks; and research climate change’s effects on particular asset classes so as to implement appropriate capital risk weighting.³⁹

Cybersecurity, Big Tech, and crypto assets

Twenty-first-century banking requires institutions to use technology in ways previously unimaginable. Like other modern companies, banks maintain client records and balance sheet ledgers in electronic databases, and many use algorithms and artificial intelligence to make business decisions.⁴⁰ But unlike other companies, banks’ uses of technology are much more fraught: Customers’ financial information is among the most important data that a company can hold, and accordingly, it is of paramount importance that this information is protected and used appropriately.

The banking agencies must use their supervisory and regulatory authorities to require all banks to implement state-of-the-art cybersecurity protections that ensure that customer data are sufficiently secure from hacks. Furthermore, the banking agencies must ensure that banks have processes and procedures in place to thwart social engineering attacks such that hackers cannot manipulate bank employees to gain access to data systems. Additionally, many if not all banks rely on third parties to develop custom or off-the-shelf software to enable them to act with increased efficiency. Because third parties are prohibited from indemnifying banks for losses resulting from their mistakes, the banking agencies must ensure that banks conduct sufficient oversight of their service providers.⁴¹

Furthermore, the banking agencies must ensure that banks’ uses of big data adhere to fair lending requirements. Companies across many industries are using artificial intelligence to mine pools of data to evaluate products or to target potential customers, and banks have indicated a desire to use big data in the provision of financial services.⁴² However, the Equal Credit Opportunity Act and other federal laws prohibit financial services providers from discriminating on the basis of race, religion, sex, or other protected classes when extending credit, and the “black box” nature of many artificial intelligence systems means that banks may inadvertently discriminate when using big data to evaluate a prospective borrower’s credit-worthiness. The banking agencies must allow banks to use big data only when the factors algorithms consider are expressly disclosed.

Lastly, the banking agencies must address whether and how banks may engage in crypto-related activities. To date, the OCC has released several guidance documents indicating that national banks may provide cryptocurrency custody services, may hold dollar deposits backing stablecoins, and may facilitate stablecoin payments, among others.⁴³ The OCC and the FDIC have also both released guidance asking banks to consult with their primary regulator if they are considering engaging in these activities due to their potential to upset banks’ safety and soundness.⁴⁴

The banking agencies should do more to detail the risks that banks may face from various crypto activities, help banks mitigate the risks that come from providing crypto custody services, and determine whether or how bank-issued stablecoins may be afforded deposit insurance.⁴⁵

Nonbank chartering

Bank charters are valuable; only institutions with bank charters may accept deposits guaranteed by taxpayers, make loans with those deposits, and facilitate payments using the Federal Reserve’s real-time payment system.⁴⁶ The banking agencies must permanently address efforts by nonbanks to obtain charters that would give them unfair advantages over their rivals, harm borrowers, and potentially put the financial system at risk.

The first type of nonbank to address is the industrial loan company (ILC). ILCs are essentially state-chartered banks that are owned by commercial firms and violate the United States’ long history of ensuring that commercial entities cannot own and operate banks. This separation of banking and commerce exists for a number of reasons, including that commercial ownership of lenders can create “an uneven playing field among commercial firms,” inflict conflicts of interest in lending, and allow commercial entities undue influence over consumers.⁴⁷ For instance, a bank owned by a retailer could offer loans to its retail affiliate at overly favorable rates, could refuse to offer loans to its retail competitors, and could provide cheaper loans to its retailer’s customers than to other retailers’ customers. This is especially problematic when those loans are made with deposits explicitly backed by taxpayers. However, the Competitive Equality Banking Act of 1987 opened the door to providing deposit insurance to ILCs, breaking this separation.⁴⁸

The FDIC, which is in charge of reviewing ILC charter applications, recently finalized a rule that codified practices for supervising ILCs whose applications have been approved.⁴⁹ Yet the rule insufficiently limits the ability of commercial parents to control their ILCs and enables them to pressure their ILCs for disparate and beneficial treatment.⁵⁰ It also creates risk to the financial system: Whereas the parents of traditional banks are overseen by the Federal Reserve, the commercial parents of ILCs are subject to no consolidated supervision. The FDIC must rescind this rule.

The second type of nonbank to address are fintechs. These firms, which use technology to provide financial services, generally aim to make loans or facilitate payments without also taking federally insured deposits. Because of their nonbank status, they usually partner with banks for some services that only banks can provide. However, many fintechs have expressed interest in becoming banks—albeit without a desire to hold deposits—and have a variety of business models that can be made more efficient with a federal bank charter. Fintechs that issue cryptocurrencies could benefit from having access to the Federal Reserve’s payment system, for example, while fintechs that use investor capital to make consumer loans could benefit from a national bank charter that preempts state consumer protection laws.⁵¹ At the same time, these fintechs generally do not accept consumer deposits and would, accordingly, not face many of the same regulations faced by banks that do.

In 2018, the OCC announced that it would begin providing special-purpose national bank charters to fintechs, though no such charters have been granted.⁵² This policy not only is contrary to good public policy, but also may be against the law.⁵³ The OCC must rescind this policy and announce that that it will not grant charters to institutions that do not take deposits, make loans, and facilitate payments.

A safe and fair banking system is the cornerstone of a healthy and equitable economy. Without one, Americans are likely to face weaker economic growth, rising inequality, and more frequent financial crises.

The banking regulators have much work to do to support the economic recovery and prevent emerging risks from escalating into another financial crisis. Delivering on the agenda suggested in this report would be a great way to start.