Hearing of the Securities, Insurance and Investment Subcommittee of the Senate Banking Committee – Lessons Learned in Risk Management Oversight at Federal Financial Regulators

Hearing of the Securities, Insurance and Investment Subcommittee of the Senate Banking Committee - Lessons Learned in Risk Management Oversight at Federal Financial Regulators

CHAIRED BY: SENATOR JACK REED (D-RI)

WITNESSES: SCOTT POLAKOFF, ACTING DIRECTOR, OFFICE OF THRIFT SUPERVISION; ORICE WILLIAMS, DIRECTOR, FINANCIAL MARKETS AND COMMUNITY INVESTMENT, GOVERNMENT ACCOUNTABILITY OFFICE; ROGER COLE, DIRECTOR, DIVISION OF BANKING SUPERVISION AND REGULATION, FEDERAL RESERVE BOARD; TIMOTHY LONG, SENIOR DEPUTY COMPTROLLER, BANK SUPERVISION POLICY AND CHIEF NATIONAL BANK EXAMINER, OFFICE OF THE COMPTROLLER OF THE CURRENCY; ERIK SIRRI, DIRECTOR, DIVISION OF TRADING AND MARKETS, SECURITIES AND EXCHANGE COMMISSION

Copyright ©2009 by Federal News Service, Inc., Ste. 500, 1000 Vermont Ave, Washington, DC 20005 USA. Federal News Service is a private firm not affiliated with the federal government. No portion of this transcript may be copied, sold or retransmitted without the written authority of Federal News Service, Inc. Copyright is not claimed as to any part of the original work prepared by a United States government officer or employee as a part of that person's official duties. For information on subscribing to the FNS Internet Service at www.fednews.com, please email Carina Nyberg at cnyberg@fednews.com or call 1-202-216-2706.

SEN. REED: Can we call the hearing to order and first, apologize for the extra delay. We were engaged in voting and these things take longer than we usually expect. But thank you very much.

I want to thank you all for joining us here today. This financial crisis has demonstrated that contrary to the presumption of many, financial institutions were unprepared and in many cases incapable of adequately assessing the risks that they were bearing on their books.

The governance structures, the firm managers and sophisticated models all failed to capture the magnitude of the risks that were building. Now the mistakes and poor risk management by these financial institutions and their regulators have become the taxpayers' problems with the effects spiraling through the broader global economy. The trillions of dollars in losses stand as witness to the many failures in risk management at these firms. Blame must primarily be placed at the feet of these financial institutions which gambled and then cashed in on exorbitant transaction fees for creating exotic financial products.

The guiding presumption of many, including former Federal Reserve Chairman Alan Greenspan, was that self-interest would keep these firms from engaging in overly risky behavior, and if that was insufficient, then surely market discipline would rein in excess.

But in reality both proved inadequate to constrain excessive risk taking. The drive for short-term profits led to irrational behavior that affected many, not just a few firms. When self-interest and market discipline break down, we hope that the safety net, the regulators, will guide us out of the storm. However, if the people engaging in these complex transactions did not understand risk, the regulators, it appears, based upon the report we've been given today might have known even less.

The capacity to conduct oversight of the risk management function at these firms was in many cases lacking. During the good times, when all the excesses were building up, the regulators did not press hard enough. Yet, it is during these times that it's most important as excesses encourage a sense of fearlessness about risk taking that the regulators act promptly to constrain the exuberance.

Perhaps more fundamentally, the regulators should be asking hard questions. When new financial products are drawn in -- growing in unprecedented profits, they should be asking pointed questions about the cash flows and how the products work, including how they perform in good times and bad. Reverse engineering these products is critical if regulators are to understand how they operate and know their embedded risks.

Regulators also need a firm wide view on risk. As we heard in testimony last week concerning AIG, the firm stopped offering credit default swaps on CDOs and mortgage-backed securities in one area of the firm at the same time it started risky securities lending in another area of the firm. Another bank claimed it was never involved in subprime lending yet it was buying mortgage lenders engaged in the practice and securitizing such products.

Last June, I called a similar hearing to discuss risk management and its implications for systemic risk. Unfortunately, further variances in risk management have taken place since that time. The purpose of this hearing is to bring to light the specific problems and to find a positive way forward. This hearing is particularly important, given the need for swift and yet deliberate regulatory reform. GAO, at my request after last June's risk management hearing, undertook a study of the risk management function of those regulators responsible for large financial institutions.

GAO reviewed a sample of large complex financial institutions to determine what the regulators knew, when they knew it, and what changes were requested as a result of the regulatory examinations and inquiries. While GAO will be sharing this in testimony, I wanted to highlight a few findings that I found particularly troubling.

Regulators found problems as early as 2005, four years ago, with the risk management systems at large complex financial institutions, but often were not aggressive in insisting on changes at firms until market events made the problems self-evident.

A Federal Reserve review conducted in 2006 concluded that no large complex financial institutions they reviewed had sufficient enterprise wide stress tests to determine what economic or other scenarios might render the entire company insolvent. Moreover, many large complex financial institutions could not sufficiently measure or manage all of their risks at a consolidated level. Rather, they focused on risks within various subsidiaries without looking at the health of the entire holding company.

Even knowing this, regulators did not significantly change their ratings of such firms until the crisis emerged. Because of the sensitive nature of the information, I would ask that my colleagues avoid asking about any currently ongoing financial institution by name. Instead, I think the focus here is on the performance of the regulators and also in general the performance of these -- of these regulated entities.

The GAO's review comes at an important time in our history. It is the kind of deep analysis that should guide us forward as we take up questions on regulatory reform that will serve as the foundation for financial oversight as we go forward. In short, major regulatory reform is coming. I hope that we can learn from what has transpired, move forward with a stronger safety net, and build a stronger financial system.

And at this time, I'd like to recognize Ranking Member Senator Bunning.

SEN. JIM BUNNING (R-KY): Thank you, Chairman Reed. This is my first hearing working with you on this subcommittee. I'm glad to be here and I look forward to working with you for years to come.

I think what we are going to hear today from our witnesses is that failures in risk management that contributed to our current economic crisis were not just the result of problems with our laws or poor decisions by firms. No, there was also a failure by regulators to recognize the dangers, and even worse, a lack of will to do something about the problems that they did find.

Mr. Chairman, I find that deeply troubling. I also find the example of the 2006 Federal Reserve study mentioned in the report to be extremely troubling. The Fed found that that none of the institutions it looked at had stress tests that covered the entire company, and none of the tests to see what would make them insolvent. That is bad and shows the irresponsibility of the firms. But as far as I can tell, the Fed also did little or nothing about it. That is worse and should throw cold water on the idea of some that the Fed should be the new risk regulator.

I find the admission by some regulators to GAO that they did not understand the real risk or the importance of contributing factors to be refreshing but still very troubling. Those admissions should raise questions about whether we can ever create a risk regulator that will understand and act to stop system wide risk and a system of too big to fail. When market discipline has been removed by bailouts, we have to rely on regulators to make sure firms don't get into trouble. But if our regulators are unable to find problems and unwilling to do something about them, we are in real trouble and maybe we need to reconsider the whole concept of relying on regulators to be the last line of defense against all problems.

Why should we think a few changes in the law will magically make them more effective the next time around? We can try to fix problems with our current system but we cannot legislate will or competency. Instead, we need to build a system where everyone is accountable and has incentives to perform due diligence, a sort of check and balance, so if any one party does not do so it will not lead to an overall failure.

The system also needs to be robust enough to handle the failure of individual firms and we should assume that firms will fail because they do. To handle that, we need to approve the authority of regulators to take control of and shut down failing firms through some -- some type of orderly bankruptcy. We also need to hold directors and executives accountable. If everyone knows they will face the consequences of their actions, they will be more careful in the future. I think that will go a long way in the future to creating a stable financial system than rearranging the furniture downtown at various regulators. Again, thank you, Mr. Chairman. I'm looking forward to hearing from the witnesses.

SEN. REED: Thank you, Senator Bunning. I too look forward not only to hearing from the witnesses but working with you on the subcommittee. Thank you very much.

Let me introduce our panel. Ms. Orice Williams is the director of the Financial Markets of the Community Investment group at the Government Accountability Office; Mr. Roger Cole is the director of the Division of Banking, Supervision and Regulation, Federal Reserve Board; Mr. Timothy Long is the senior deputy comptroller, Bank Supervision Policy and Chief National Bank examiner for the Office of the Comptroller of the Currency; Mr. Scott Polakoff is the acting director of the Office of Thrift Supervision; and Dr. Erik Sirri is the director of Division of Trading and Markets, U.S. Securities and Exchange Commission.

All of your testimony will be made part of the record. You may summarize if you wish. In fact, it is encouraged. And I understand both Ms. Williams and Mr. Polakoff have had a long day of testimony, so thank you particularly for waiting and -- and being with us today. Ms. Williams, would you please begin.

MS. WILLIAMS: Mr. Chairman and Ranking Member Bunning, I am pleased to be here today to discuss lessons learned from risk management oversight at large complex institutions.

At your request, we initiated work in December to review the risk management oversight of large institutions by the banking and securities regulators, namely, the Federal Reserve, the Office of the Comptroller of the Currency, the Office of Thrift Supervision, the Securities and Exchange Commission, et cetera.

Our objectives were to, one, identify how regulators oversee risk management at large institutions; two, identify the extent to which regulators identified shortcomings in risk management at selected institutions prior to financial crisis; and, three, how some aspect of the regulator system may have contributed to or hindered their oversight. However, I need to note that Section 714 of the Federal Banking Agency Audit Act generally prohibits GAO from disclosing non- public information about an open bank. Therefore, I will not disclose the banking institutions included in our sample or provide detailed information obtained from the examinations or interviews with examination staff.

First, we found the regulators generally maintained continuous contact with large, complex institutions using a risk-based examination approach that aims to identify areas of risk and assess these institutions' risk management systems. But the approaches of the banking and securities regulators vary somewhat. Likewise, the regulators generally use a combination of rules and activities to assess the quality of risk management. For example, bank examiners review the activities, products and services that an institution engages in to identify risk, and then, through continuous monitoring and targeted examinations assesses how the institution manages those risks.

When regulators identify weaknesses in risk management at an institution, they have a number of formal and/or informal supervisory tools they can use for enforcement and to effect change. For the examinations we reviewed, we found that regulators had identified numerous weaknesses in institutions' risk management systems prior to the beginning of the financial crisis. However, regulators did not effectively address the weaknesses, or in some cases truly understand their magnitude until the institutions were stressed. In hindsight, the regulators told us that they had not fully appreciated the risk to the institution or the implications of the identified weaknesses or the stability of the overall financial system.

We also found that some aspects of the regulatory system may have hindered regulators' oversight of risk management. For example, no regulator systematically and effectively looks across all large, complex institutions to identify factors that could have a destabilizing effect on the overall financial system.

In closing, I will share a few observations.

First, while an institution's risk management directors and auditors all have key roles to play in effective corporate governance, regulators, as outside assessors of overall adequacy of the system of risk management, also have an important role in assessing risk management, yet the current financial crisis has revealed that many institutions have not adequately identified, measured and managed all core components of sound risk management. They also found that for the limited number of large, complex institutions we reviewed, the regulators failed to identify the magnitude of these weaknesses, and that when weaknesses were identified, they generally did not take forceful action to prompt these institutions to address them.

Second, while our recent work is based on a limited number of institutions, these examples highlight the significant challenges regulators face in assessing risk management systems at large, complex institutions.

While the painful lessons learned during the current crisis bolster market discipline and regulatory authority in the short term, assessment regulation requires that regulation requires that regulators critically assess their regulatory approaches, especially during good times, to ensure that they are aware of potential regulatory blind spots. This means constantly reevaluating regulatory and supervisory approaches and understanding inherent biases and regulatory assumptions. While we commend recent supervisory efforts to respond to the current crisis, the new guidance we have seen tends to focus on issues specific to this crisis rather than on broader lessons learned about the need for more forward-looking assessments, and on the reasons that regulation failed.

Finally, the current institution-centric approach has resulted in regulators all too often focusing on the risks of individual institutions and regulators looking at how institutions are managing individual risk while missing the implications of the collective strategy, which is premised on the institution having little liquidity risks and adequate capital. Whether the failures of some institutions ultimately come about because of a failure to manage a particular risk, such as liquidity or credit risk, these institutions often lack some of the basic components of good risk management, for example, having boards of directors and senior management set the tone for proper risk management across the enterprise.

Mr. Chairman, Ranking Member, this concludes my oral statement and I would be happy to answer any questions at the appropriate time.

SEN. REED: Thank you, Ms. Williams. Mr. Cole, please.

MR. COLE: Chairman Reed, Ranking Member Bunning, it is my pleasure to be here today to -- (off mike).

SEN. REED: Is your microphone on, Mr. Cole? Could you put your mike up --

(Cross talk.)

MR. COLE: It is my pleasure today to discuss the state of risk management and the banking industry and the steps taken by supervisors to address risk management shortcomings. The Federal Reserve continues to take vigorous and concerted steps to correct the risk management weaknesses at banking organizations revealed by the current financial crisis. In addition, we are taking actions internally to improve supervisory practices, address the issues identified by our own internal review.

The U.S. financial system is experiencing unprecedented disruptions that have emerged with unusual speed. Financial institutions have been adversely affected by financial crisis itself as well as by the ensuing economic downturn. In the period leading up to the crisis, the Federal Reserve and other U.S. banking supervisors took several important steps to improve the safety and soundness of banking organizations and the resilience of the financial system such as improving banks' business continuity plans and the compliance with the Bank Secrecy Act and Anti-Money Laundering requirements after the September 11th terrorist attacks.

In addition, the Federal Reserve, working with the other U.S. banking agencies, issued several pieces of supervisory guidance before the onset of the crisis, such as for non-traditional mortgages, commercial real estate and subprime lending. This is to highlight the emerging risks and point bankers to the prudential risk management practices they should follow. We are continuing and expanding the supervisory actions mentioned by Vice Chairman Kohn last June before this subcommittee to improve risk management at banking organizations. While additional work is necessary, supervisory institutions are making progress.

Where we do not see sufficient progress, we demand corrective action from senior management and boards of directors. Bankers are being required to look not just at risks from the past but also to have a good understanding of their risks going forward. For instance, we are monitoring the major firms' liquidity positions on a daily basis, discussing key market developments with senior management, and requiring strong contingency funding plans.

We are conducting similar activities for capital planning and capital adequacy, requiring banking organizations to maintain strong capital buffers over regulatory minimums. Supervised institutions are being required to improve their risk identification practices. Counterparty credit risk is also receiving considerable focus. In all of our areas of -- (inaudible) -- we are requiring banks to consider the impact of prolonged stressful environments.

The Federal Reserve continues to play a leading role in the work of the Senior Supervisors Group, whose report on risk management practices at major U.S. and international firms has provided a tool for benchmarking current progress. Importantly, our evaluation of banks' progress in this regard is being incorporated into a supervisory exam process going forward to make sure that they are complying and making the improvements we're expecting.

In addition to the steps taken to improve banks' practices, we are taking concrete steps to enhance our own supervisory practices. The current crisis has helped us recognize areas in which we can improve. Vice Chairman Kohn is leading a systematic internal process to identify lessons learned and develop recommendations. As you know, we are also meeting with members of Congress and other government bodies, including the Government Accountability Office, to consult on lessons learned and to hear additional suggestions for improving supervisory practices.

We have already augmented our internal process to disseminate information to examination staff about emerging risks within the industry. Additionally, with the recent Federal Reserve issuance of supervisory guidance on consolidated supervision, we are not only enhancing the examination of large, complex firms with multiple legal entities but also improving our understanding of markets and counterparties contributing to our broader financial stability efforts.

Looking forward, we see opportunity to improve our communication of supervisory expectations to firms who regulate to ensure those expectations are understood and heeded. We realize now more than ever that when times are good and when bankers are particularly confident, we must have even firmer resolve to hold firms accountable for prudent risk management practices.

Finally, despite our good relationship with fellow U.S. regulators, there are gaps and operational challenges in the regulation supervision of our overall U.S. financial system that should be addressed in an effective manner.

I would like to thank you and the subcommittee for holding this second hearing on risk management, a crucially important issue in understanding the failures that have contributed to the current crisis. Our actions, with the support of Congress, will help strengthen institutions' risk management practices and the supervisory and regulatory process itself, which should in turn greatly strengthen the banking system and the broader economy as we recover from the current difficulties. I look forward to answering your questions.

SEN. REED: Mr. Long?

MR. LONG: Chairman Reed, Ranking Member Bunning, my name is Tim Long. I'm a senior deputy comptroller for Bank Supervision Policy at the OCC. I appreciate this opportunity to discuss the OCC's views on risk management and the role it plays in banks we supervise.

The weaknesses and gaps that we've identified in risk management practices and the steps we're taking to address those issues and how we supervise risk management at the largest national banks. Recent events have revealed a number of weaknesses in banks' risk management processes that we in the industry must address and we're taking steps to ensure this happens. More importantly, these events have reinforced that even the best policy manuals and risk models are not a substitute for strong corporate governance and risk management culture, a total approach to business that must be set at the top of the organization and instilled throughout the company.

While risk management practices are legitimately the focus of much current attention, risk management is hardest when times are good and problems are scarce. It is in those times when bank management and supervisors have the difficult job of determining when accumulating risks are getting too high and that the foot needs to come off the accelerator. These are never popular calls to make, but in retrospect we and bankers erred in not being more aggressive in addressing our concerns.

However, we must also now lose sight that banks are in the business of managing financial risks. Banks must be allowed to compete and innovate, and this may at times result in a bank incurring losses. The job of risk management is not to eliminate risk but to ensure that those risks are identified and understood so the bank management can make informed choices. Among the lessons we're learned are underwriting standards matter, regardless of whether the loans were held or sold; risk concentrations can excessively accumulate across product and business lines; asset-based liquidity is critical; backroom operations and strong infrastructure matters; and robust capital and capital planning are essential.

As described in my written testimony, we are taking steps to address all of these issues. Because the current problems are global in nature, we are working closely with my colleagues here and internationally. Critical areas of focus are in improved liquidity risk management, stronger enterprise-wide risk management including regular stress testing, and further strengthening the Basel II capital framework.

Risk management is a key focus of our large bank supervision program. Our program was organized with a national perspective. It is centralized and headquartered in Washington and structured to promote consistent and uniform supervision across the banking organizations. We establish core strategic objectives annually, based on emerging risks. These objectives are incorporated into the supervisory strategies for each bank and carried out by our resident on-site staff with assistance from specialists in our Policy and Economics Unit. Examination activities within a bank are often supplemented with horizontal reviews across a set of banks. This allows us to look at trends not only within but across the industry.

Through our resident staff we maintain an ongoing program of risk assessment and communication with bank management and the board of directors. Where we find weaknesses we direct management to take corrective action. For example, we have directed banks to make changes in personnel and organizational structures to ensure that risk managers have sufficient stature and ability to constrain business activities when warranted. Through our examinations and reviews we've directed banks to be more realistic about recognizing credit risks, to improve our evaluation techniques for certain complex transactions, to aggressively build loan-loss reserves, to correct various risk management weaknesses, and to raise capital as market opportunities permit.

Finally, the subcommittee requested the OCC's views on the findings that Ms. Williams from the GAO will be discussing with you today. Because we only recently received the GAO's summary statement of findings, we have not had an opportunity to review and assess the full report. We take the findings from GAO very seriously and we'll be happy to provide the subcommittee with a written response to this report once we receive it.

My preliminary assessment, based on the summary we were provided, is that the GAO raised a number of legitimate issues, some of which I believe we are already addressing, and others, as they pertain to the OCC, may require further action on our part.

Thank you and I will be happy to answer questions you may have.

SEN. REED: Thank you, Mr. Cole (sic). Mr. Polakoff, please.

MR. POLAKOFF: Good afternoon, Chairman Reed, Ranking Member Bunning. Thank you for inviting me to testify on behalf of OTS on the lessons the current economic crisis has taught us about risk management. The topic is timely and important because, as you know, the heart of bank supervision is in monitoring for risks to help prevent them from endangering the health of regulated financial institutions.

Some of the risks I will discuss today not only endangered institutions during this crisis, but played major roles in some failures. The financial crisis has had serious consequences for our economy and for public confidence in the safety of their bank accounts and investments. This confidence and the trust it engenders are necessary for both the smooth operation of our financial system and the larger economy. Restoring confidence is essential to achieving full economic recovery.

In my comments today I will focus on three risks that I think are most significant: concentration risk, liquidity risk, and the risk to the financial system from unevenly regulated companies, individuals and products. Shortcomings in responding to each of these risks had significant consequences.

So let me start with concentration risk, which is basically the risk of a financial institution having too many of its eggs in one basket. If something bad happens to that basket, the institution is in trouble. Although concentration risk is one of the main risks that our examiners traditionally watch closely, the current crisis exposed a new twist to concentration risk and the OTS has acted to address that risk.

The new twist was the risk of a business model heavily reliant on originating mortgage loans for sale into the private label secondary market. The freeze-up in this market for private label mortgage- backed securities in the fall of 2007 exposed this risk for institutions with an originate-to-sell business model. Their warehouse and pipeline loans could no longer be sold and had to be kept on their books, causing severe strain. To prevent this problem in the future, the OTS reviewed all of its institutions for exposure to this risk, updated its examination handbook in September 2008, and distributed a letter to the chief executive officers of OTS-regulated thrifts on best practices for monitoring and managing this type of risk.

The financial crisis also taught us lessons about liquidity risk when some of our institutions experienced old-fashioned runs on the bank by panicked customers. In some cases, the size and speed of the deposit withdrawals were staggering. The events showed that the prompt corrective action tool created to prevent a gradual erosion of capital during the financial crisis of the late '80s and early '90s is inadequate to address a rapidly accelerating liquidity crisis. Rather than seeking a new type of prompt corrective action for liquidity, federal banking regulators plan to issue guidance to examiners and financial institutions to incorporate lessons learned on managing liquidity risk.

Finally, I would like to discuss the risk to the financial system and the larger economy by companies, individuals and products that are not regulated at the federal level, or in some cases at any level. These gaps in regulation are, in my mind, the root cause of the crisis. If you could distill the cause to a single sentence, I think it would be this. Too much money was loaned to too many people who could not afford to pay it back.

The simple lesson is that all financial products and services should be regulated in the same manner, whether they are offered by a mortgage broker, a state licensed mortgage company of a federally regulated depository institution.

To protect American consumers and safeguard our economy, consistent regulation across the financial services landscape is essential.

Thank you again, Mr. Chairman, for having us here today. I look forward to answering your questions.

SEN. REED: Thank you, Mr. Polakoff.

Dr. Sirri.

MR. SIRRI: Chairman Reed, ranking member Bunning, and members of the subcommittee, I'm pleased to have the opportunity today to testify concerning insights gained from the SEC's administration that consolidated supervised entities, or CSE program, as well as the SEC's long history of regulating the financial operation of broker dealers and protecting customer funds and securities.

The turmoil in the global financial system is unprecedented and has tested the resiliency of financial institutions and the assumptions underpinning many financial regulatory programs.

I believe that hearings such as this, where supervisors will reflect on and share their experiences from this past year, will enhance our collective efforts to improve risk management of complex financial institutions.

A registered broker dealer entity within the CSE group was supervised by an extensive staff of folks at the SEC and at FINRA, the broker SRO. All U.S. broker dealers are subject to the SEC's rigorous financial responsibility rules, including the net capital rules, the customer protection rules, and other rules designed to ensure that firms operate in a manner that permit them to meet all obligations to customers, counterparties, and market participants.

The CSE program was designed to be broadly consistent with the Federal Reserve oversight of bank holding companies. Broker dealers had to maintain a minimum of five billion dollars of tentative net capital to qualify for the program and no firm fell below this requirement.

The CSE regime was also tailored to reflect two fundamental differences between investment bank and commercial bank holding companies.

First, the CSE regime reflected the resilience of securities firms on -- the reliance of securities firms on market to market accounting as a critical risk and governance control.

Second, the CSE firms were required to engage in liquidity stress testing and hold substantial liquidity pools at the holding company.

We also required firm-wide stress testing as a prerequisite to being allowed to enter the program, a requirement that was put in place well before the crisis started.

For most firms the stress testing comprised a series of historical or hypothetical scenarios that were applied across all positions, not just across one product or business line.

While the set of scenarios did not cover every plausible scenario, they included major financial shocks or stresses to the market such as the fall 1988 failure of long term capital and the Russian default, as well as the 1987 stock market crash.

The CSE firms later expanded these scenarios or created others to stress their hedge fund counterparty credit risk exposures.

I too appreciate the work that GAO did to review the supervision of financial institutions risk management programs across the various regulators and find their observations on these programs very helpful. We are reviewing their recommendations and findings and we look forward to working with GAO as we fully consider their report.

The SEC supervision in investment banks has always recognized that capital is not synonymous with liquidity. And the ability of a securities firm to withstand stress events depends on having sufficient liquid assets, cash in high quality instruments such as U.S. treasuries that can be used as collateral to meet their financial obligations as they arise.

For this reason, the CSE program required stress testing of liquidity and substantial liquidity pools at the holding company to allow firms to continue to operate normally in stress market environments.

But what the CSE regulatory approach did not anticipate was the possibility that secured funding, even that funding backed by high quality collateral such as U.S. Treasury and agency securities would become unavailable.

Thus, one lesson of the SEC's oversight over CSE's, Bear Sterns in particular, is that no parent company liquidity pool can withstand a run on the bank. Such a liquidity pool would not suffice in an extended financial crisis of the magnitude we are now experiencing.

In addition, these liquidity constraints are exacerbated when clearing agencies sizable amounts of collateral were clearing deposits to protect themselves against intraday exposures to the firm.

Another lesson relates to the need for supervisory focus on the concentration of illiquid assets held by financial firms, particularly in entities other that the U.S. registered broker dealer. Such monitoring is relatively straight forward with larger U.S. broker dealers, which must disclose illiquid assets on a monthly basis in reports -- financial reports that are filed with their regulators.

For the consolidated entities, supervisors must be well acquainted with the quality of assets on a group wide basis and monitor the amount of illiquid assets and drill down on their relative quality.

Leverage tests are not accurate measures of financial strength for investment banks. In particular, due to their sizable match book or derivatives business. Leverage tests do not account for the quality or liquidity of assets, rather they rely on overly simplistic measures of risk such as leverage ratios.

Regulators of financial firms have gone to a great deal of effort to develop and should continue to refine capital rules that are risk sensitive and act as limiters on the amount of risk that can be taken by a firm.

Finally, any regulator must have the ability to get information about the holding company and other affiliates, particularly about issues and transactions that impact capital and liquidity.

As we have witnessed with Lehman Brothers, the bankruptcy filing of a material affiliate had a cascading effect that can bring down the other entities in the group.

For these reasons and to protect the broker and its customer assets, the SEC would want, not only to be consulted before any such liquidity drain occurs at the parent, but to have a say, likely in coordination with other interested regulators, in the risk capital and liquidity standards of the holding company must maintain.

Our experience last year with the failure of Lehman's U.K. broker and the fact that the U.S. registered broker dealers were well capitalized and liquid throughout the turmoil has redoubled our belief that we must rely on and protect going forward the soundness and the regulatory regime of the principle subsidiaries.

Thank you for this opportunity to discuss these important issue and I'm happy to take your questions.

SEN. REED: Thank you very much.

Senator Bunning had to step out. He will rejoin us for his questioning.

But let me begin. I want to address a question to all the regulators. First, let me say that I thought the GAO did a very responsible and thorough examination. Thank you and you colleagues Ms. Williams.

But the basic questions are -- and I'll begin with Mr. Cole just because you happen to be sitting next to Ms. Williams. But when did you first institutionally become aware of the significance of the risk difficulties in your supervised entities? And how did you communicate the -- (inaudible) -- concerns both to your supervisors, to your fellow regulators, and to a broader audience and when did that, you know, that communication become public? So, Mr. Cole.

MR. COLE: I need to go back somewhat in time in answering that. In '95 we issued a supervisory letter to our examiners directing them in terms of taking a systematic approach to assessing the risk management, including the major risk categories of credit risk, market risk, operational risk, liquidity, reputational and legal risks.

And then that became part of the formal exam process and rating process.

Kind of fast forwarding to the 9/11 type situation, as I mentioned in my testimony, we focused on some significant risk issues there that we thought needed to be addressed. Some of them tended to focus on, say, operational risks such as payments and settlements, others on contingency planning, locating backup facilities at different distances, and then, very importantly, on BSAAML, Bank Secrecy Anti Money Laundering.

In that regard, with regard to one of the institutions in question we took very strong action to require a significant change in their business risk management and that was accomplished at the -- with a very forceful hand in terms of requiring them to make those changes.

So, I think that is a good example of where, you know, when we see a significant problem we do act.

SEN. REED: Let me be more specific. The issue, I think, that the GAO has revealed is a lack of the capacity of large, complex financial institutions -- which all of you regulate, to assess adequately all the risks they face. It's not so much a particular risk, but the fact that they did not have systems in place to adequately assess the risk, which I think is a fair conclusion of the report of the GAO.

At what point did this fact, or this observation, become resonant with the Fed; and how was it communicated to the banking community, to the regulated community, and on to the broader audience -- the Congress, for one?

MR. COLE: We have been engaged, you know, consistently, I think, since -- just going back, say, to the '95 letter, in terms of working with institutions to enhance the risk management process.

Now, in terms of moving right to the current situation, the stress testing example is a good example, because we believed, going into that stress test, that there was a significant opportunity to put pressure on those -- on the big firms to improve their ability to pull positions together, on a firm-wide basis, and develop a really robust stress test.

The horizontal review that we did provided very significant information for us, on a peer basis, that they were not able to do that, that they -- The stress that they typically came up with was one quarter's worth of earnings. And that was based on a fairly flawed system of not being able to comprehensively pull the positions together on an integrated firm-wide basis.

SEN. REED: And that was --

MR. COLE: We used -- we used that as a major tool, in terms of pushing on those firms. It was feedback from that exercise, and saying, look, you need to do more here. And that's one of the main tools that we have, is that type of horizontal review. So, that occurred, say, in June, 2007 -- that kind of feedback with the firms on the findings from that stress testing.

And, you know, I would move just a little bit further --

SEN. REED: Can I just clarify, is it June, 2007 or 2006?

MR. COLE: The actual exercise was in 2006. We did the report in 2007, and then the feedback to the firms, I think, was in June of 2007.

SEN. REED: Well, it raises an issue, which is that, in 2006 you had at least had serious concerns that -- because of the stress testing, that these firms could not handle, or had systems in place to deal with the risk. And the whole point, I think, of the report of the GAO is that, having that knowledge or those suspicions, it didn't seem to produce timely -- a timely, rapid response.

MR. COLE: Well, Senator, I think that at the same time that we were doing the stress testing we were also reviewing and having very significant interactions with these firms, in terms of various aspects of their risk process.

SEN. REED: Let me just ask, did you communicate in 2006 with the other supervisors -- the OTS comptroller, SEC, your concerns that some of the institutions that you were the overall supervisor (of) had these deficiencies in risk assessment?

MR. COLE: Well, we have very frequent conversations with --

SEN. REED: Would you say, fairly, that you communicated these concerns to the other regulators, or you heard similar concerns from them?

MR. COLE: I would say fairly that, as we are working on, for example, infrastructure requirements for the use of models, and so on, we have had consistent communications with the other regulators that there are significant deficiencies in risk management.

SEN. REED: And let me just ask a final question, because I do want your colleagues to respond too, is that, what broader audience did you communicate these concerns about the lack of adequate systems in place?

MR. COLE: We have, throughout the development, for example, of qualifying criteria for the use of Basel II, and the so-called Pillar II criteria, indicated the need for improvement to the firms we've been working with.

SEN. REED: Mr. Long, the same -- similar questions: When did you -- not personally, but the organization become aware, if you did, of failings in the management of risk by entities you supervised? Did you communicate them to your fellow supervisors? Did they communicate with you? And then what broader audience?

MR. LONG: To follow up on backing, yes, I do think we began to communicate pretty well in the 2006 (rein ?), as my colleague says. But, let me -- let me back up to answer -- I want to make sure I answer your question.

As is stated in my written testimony, you know, there is -- it's difficult at times to strike that balance of letting a bank meet competition and innovate, and at the same time figure out -- and order a bank to constrain a certain business activity because we believe they're taking on too much risk. It's always a delicate balance and it's something we work hard to do.

But, I think we did -- going back to 2004, I know at the OCC and amongst other regulators we did begin to see this build-up of risk and this build-up of excess of aggregation of risk. We issued guidance, going back to 2004. We had the Interagency Credit Card guidance. We issued guidance on home equity lending, on non-traditional mortgage products, on commercial real estate lending, and then the most recently some interagency on complex structured products.

And as we issued these guidance to the industry, our examiners were in the banks and they were examining for this. We frequently cited matters requiring attention, and began taking actions -- various types of actions surrounding these guidance.

So, from 2004, up to 2007, I think we all saw the accumulation of risk. I think we looked at the OCC, we looking vertically, very well, into those companies. If there were lessons learned by us it was probably in two things: Number one, we underestimated the magnitude of the effects of the global shutdown beginning in August of 2007; and we did not rein in the excesses driven by the market.

So, a real lesson learned. And I think you've heard it some of the statements and in the GAO report, the ability to look vertically into these companies is good. The ability to look across the companies, in terms of the firms we supervise, we need to get better at that. And, looking vertically across the system -- or, horizontally across the system is something I think we all need to do.

A good example of that is, in the firms that we supervise we underestimated the amount of subprime exposure they had. We basically kicked the subprime lenders out of the national banking system. Our banks were underwriting very little of the subprime loans. What we didn't realize is that affiliates and subsidiaries of the banks that we supervise were turning around, buying those loans, structuring them, and putting that, you know, bringing that risk back in in another division in the bank.

And that's a good example of, you know, being able to look horizontally across a company and see that coming.

SEN. REED: But, what inhibited you from looking across these other subsidiaries?

MR. LONG: Senator, there's two things -- you know, internally, from the OCC's standpoint, we need to get better at horizontal -- at doing more horizontal work. And I think we have. I think we started doing that probably a year and a half ago, where we have networking groups; we do more horizontal-type exams to where REICs can share information amongst themselves.

Where we're continuing to work with our other colleagues, with the other agencies, is making sure that we try to gather the risk in the entire system. But, obviously, all of us are constrained somewhat by GLBA.

SEN. REED: Let me -- Mr. Polakoff and -- can I finish this line of questioning, and then I'll recognize you, Jim, to --

SEN. BUNNING: I'll stay as long as -- (inaudible) --

SEN. REED: Thank you.

Yes, sir.

MR. POLAKOFF: Senator, thank you. I don't want to embellish on what my colleagues have said. It's a consistent message. I would say a trip-wire date for us was June of 2007. When the liquidity market shut down, what it proved to us, and probably all of us at this table, is we did not stress test models sufficiently for that kind of catastrophic event.

So, you know, risk management turned upside down at that period of time. When any of these models predicted a stress scenario, and even a more stressed scenario, none of us -- none of the entities still predicted, or had a model that stressed the scenario for what ultimately we saw starting in June of 2007 forward.

It's a critical lesson learned for all of us.

SEN. REED: Dr. Sirri?

MR. SIRRI: The one thing I would point out, that's slightly different with the SEC, is that we entered this business in a different manner. The firms that we regulated under the CSC (sp) program came to us because of the European Union Financial Conglomerates Directive. For that purpose they needed a consolidated holding company supervisor and they didn't have one for that purpose.

So we came at this from rule not by statute. We crafted a regime where in exchange for certain capital treatment we would be given a limited amount of access to the holding company.

What we focused on and what that access related to were financial and operational risk controls. And in that sense I think that was very helpful in forming the broker-dealer oversight issues as well as certain issue of the holding company. But, for example, as my colleagues have pointed out, Graham Leach Bliley limits the way we touch upon other regulated entities and we would defer to the functional regulator in that sense and so our knowledge there was more limited.

What you're really asking is a point that was made in the GAO report, which says if an enterprise of a modern firm manages risk at an enterprise level, how can you as a regulator, that is in many ways functionally-based, replicate that in your own regulatory program? And I acknowledge that's a challenge.

SEN. REED: Let me follow up with a very quick question because I want to recognize Senator Bunning, is that given the fact that you had to rely upon other regulatory agencies, what was the level of communication if, in fact, by 2004 or 2005 the OCC was aware of buildup of risk that 2006 the Federal Reserve was aware of risk? I would presume that in that same era -- so did anyone in a systematic way say you should be aware that we're concerned about risk assessment, about the ability to manage these enterprise risks -- did that ever become part of the discussion?

MR. SIRRI: I think we -- I won't speak for others -- I think we understood and my impression was all of these regulators understood that we were limited in part. We had dialogue amongst ourselves -- staff on the ground talked to staff from other regulators. In addition, the firm -- it's not like the firms drew up walls and said we won't give you information in that bank or we won't give you information on that thrift; they would provide such information. But in the sense of integrated enterprise risk management, I think it was not what it could be.

SEN. REED: Senator Bunning and take as much time as you want.

SEN. BUNNING: Thank you Mr. chairman. Welcome back from your vacations that you've been on for the last five years -- and I say that not kiddingly; I say that as meaningful as I can because if we would have had good regulators we wouldn't be in the crisis we're in right now.

Ms. Williams, at the bottom of page 24 you said the Fed did not identify many of the issues that led to the failure of some large institutions. Can you tell us what some of these issues that they are -- what they missed?

MS. WILLIAMS: Absolutely. If I could direct your attention to a couple of pages later on page 26. We note that the Fed began to issue risk committee reports and in April 2007 they issued prospectives on risk. And we list a number of issues that we pulled from that report. For example, it includes that there -- the report stated that there were no substantial issues of supervisory concern for large financial institutions; that asset quality across the systemically important institutions remains strong. In spite of predictions of a market crash, the housing market correction has been relatively mild and while price appreciation in home sales have slowed, inventories remain high and most analysts suspect the housing boom to bottom out in mid- 2007.

Overall, the impact on a national level will likely be moderate; however in certain areas housing prices have dropped significantly. They also noted that the volume of mortgages being held by institutions or warehouse pipelines had grown rapidly to support collateralized mortgage-backed securities and CDOs and noted that the surging investor demand for high yield bonds and leveraged loans, largely through structured products such as CDOs, was providing a continuing strong liquidity that resulted in continued access to funding for lower rated firms at relatively modest borrowing cost.

So those are some of the --

SEN. BUNNING: Would you like to comment on counterparty exposures -- particularly to hedge funds?

MS. WILLIAMS: This is an area -- and we do note that this is kind of a hindsight look back -- but that was another area. Counterparty exposures, particularly to hedge funds --

SEN. BUNNING: Mr. Cole, would you like to respond?

MR. COLE: Thank you for the opportunity, senator. First of all, I would say that my understanding is that the report that the GAO has done is really based on review of one institution.

SEN. BUNNING: That's not correct, but that's fine. Think of that any time you want.

MR. COLE: Okay and that we received this report with reference to the prospectus on risk just in the last couple of days. So we would like an opportunity to go over these findings with the GAO as we typically do and GAO reviews. We did not have that opportunity. But I will say this that I think that what Ms. Williams quoted from is in the report but unfortunately there are other parts that were not quoted -- and one in particular is: "the effects of a long period of easy liquidity and benign credit conditions have continued to weaken underwriting standards across all major credit portfolios. Finally we note that investor demands appear to be encouraging large financial institutions to originate more assets and even greater volumes of low quality assets and in order to distribute them through the capital markets.

In response to that, we took very firm actions and that included—

SEN. BUNNING: When? When did you take firm action?

MR. COLE: Let's see, the prospectus of risk report was issued in February 2007 and we initiated major analysis of sub-prime mortgage markets in March and published an interim report in June of that year.

SEN. BUNNING: In 2007.

MR. COLE: That's correct.

SEN. BUNNING: Okay, that's about five years after the -- that's about five years after the sub-prime and the mortgage mess hit the fan -- 2002, 2003 is when it hit.

MR. COLE: Yes but could I also --?

SEN. BUNNING: No, you can't.

MR. COLE: Okay.

SEN. BUNNING: What did the Fed do about the 2006 review that showed institutions did not have overall stress testing for their own enterprise? Did you require your regulated firms to fix those problems?

MR. COLE: Yes, I actually touched upon that in a prior response that we did follow up with the institutions.

A very critical part of this type of horizontal peer review is going back to the institutions, which we did in June of 2007. The report was actually issued in February of 2007 and had had communications with those firms indicating that there was a significant need for improvement.

We also, I'm told, communicated to the primary -

SEN. BUNNING: You were told or you know?

MR. COLE: I know. I was informed in the interim of my last question that the primary regulators of these institutions were informed of the deficiencies we observed, as well as the President's Working Group. So it was -

SEN. BUNNING: Well, that's well and good if you followed up and made sure that they weren't going to repeat the same mistakes in the immediate future and subject the country to the recession that we are now in. But if you sat on your hands, which the Fed did in overseeing mortgages and mortgage lenders and banks that were under your jurisdiction, then I think that the Fed is a failure in doing what they're supposed to do.

For anyone, did the board of directors understand the risk their firms were taking?

MR. COLE: Senator, I would say they understood the risk for the period of time that they were operating in, but failed to -

SEN. BUNNING: In other words, what I'm trying to get at, there's a reasonable rate of return on equity that everybody expected at a given point in time. Somehow, that got out of kilter and instead of being happy with the seven or eight percent return on equity, people were leveraging and I don't blame anybody, but regulators ought to be looking at the rate of return on equity and not giving permission for these firms to get into mischief and that's what happened, that's why we are here today asking you these questions.

The regulators should have stopped the risk takers taking undo risk with taxpayers' money or with equity that has been invested. Now, the taxpayers are paying the price.

So, go ahead. Finish your answer.

MR. COLE: I agree with what you said, Senator.

SEN. BUNNING: And how do we improve senior management and boards understanding of an accountability for risk? How do we get that regulated?

MR. POLAKOFF: Well, across the spectrum, all of the boards I believe are held accountable for the risk -

SEN. BUNNING: Is that right? Is that why we're paying bonuses to each and every one at AIG? They were the board. They were the people that were supposed to regulate AIG. So we're paying them bonuses for taking $160 billion in taxpayers' money. Are you kidding me?

Explain that to the American people.

MR. POLAKOFF: AIG right now is not a regulated company.

SEN. BUNNING: It is, it's owned by the federal government, so the federal government is the regulator. It's owned by the federal government. The contracts that have been paid out were okayed by the federal government. So it is regulated.

MR. POLAKOFF: Yes, sir, I was speaking only from an OTS perspective.

SEN. BUNNING: Okay, it's not yours, it's ours. How did you miss the risk and possibility of liquidity drying up? How did you miss it?

MR. SIRRI: I can speak for the firms that we regulate, for a trading firm, for a securities firm, they don't take deposits as a commercial bank or a thrift does. Their primary means of funding is through the capital markets, especially through a market known as the re-purchase market. What a firm does is it takes the security it has, it gives it -

SEN. BUNNING: I'm familiar.

MR. SIRRI: It comes back. Because that's a secured lending market, the lenders were thought to be not sensitive to the health of the firm, but sensitive to the quality of the collateral they got. So our thought was always that if you as a firm gave someone a Treasury bill or gave them an agency security, they would take that and fund you even if you were as a firm were in trouble. That was an assumption we made and that's, I think, an assumption many in the financial community made and we were wrong.

When firms got in trouble, other funding counter parties, money market funds, people with cash to lend, wouldn't take Treasuries to fund and that was something we had never seen before.

SEN. BUNNING: Mr. Long, what changes in the law, what changes in law do you suggest to protect against future failures like we're in right now?

MR. LONG: Senator, I don't know if I can think of a change in law that we need, I mean, we need to continue to have, you know, rigorous supervision around these companies. We need to make as I said in my written statement, you need a strong corporate culture and it needs to start at the top of the organization and it needs to be led by the chairman and put down into the company.

SEN. BUNNING: That, unfortunately, is not an answer. Ms. Williams, do you have any changes in law that we can get a hold of as we are looking for as members of Congress to prevent any more of this debacle that is going on right now?

MS. WILLIAMS: I would just touch on a couple of issues. In January, GAO issued a framework for reforming the current financial regulatory system and we point out a couple of issues, one would be clearly articulated goals, that is Congress needs to be very clear about the goals that they expect regulators to achieve. There also needs to be a system-wide focus in the structure and -

SEN. BUNNING: In other words, A watching B and B watching C?

MS. WILLIAMS: Not necessarily, but system-wide from the perspective of not focusing on particular institutions and getting caught up in the institution or the type of product, but anything that poses a risk to the overall system, being able to have a regulator that can focus attention -

SEN. BUNNING: Then we need one for about 25 major money market banks in New York City, one regulator each for each one because those are the ones that are too big to fail. That's what we've been told by our chairman of the Fed in fact. And we also have been told that by the secretary of the Treasury. So if that's the case, we need an awful lot of regulators.

Scott, do you have some suggestions?

MR. POLAKOFF: Senator, I would offer that we need to ensure that there's a level playing field. We've had some products. Eighty percent of subprime loans were underwritten by mortgage brokers. There's no federal oversight for that.

SEN. BUNNING: Well, I'm sorry, but the Federal Reserve got that job in 1994. That was their job. I mean, we wrote a law that gave them that job. Whether they did it or not is another question, but we handed that over to the Fed.

SEC?

MR. SIRRI: Our charge is the broker dealer, primarily. And so I'm going to translate your question as, what do you need to make sure that we keep safe the customer's --

SEN. BUNNING: What would give the SEC the ability to discover this situation that we're in now before or as it's happening and do something about it?

MR. SIRRI: Drexel, Lehman Brothers taught us the same lesson. The lesson is that the health of a broker deal can be affected by entities outside the broker dealer -- commercial banks, thrifts, unregulated affiliates that deal in derivatives. We need to touch on those entities, we need to have a say so on risk.

SEN. BUNNING: In other words, we should take all manners of dealing with the broker dealer, whether it be securities, whether it be bonds, you mentioned some other things that they're dealing with now, that we should have someone watching the store for all entities.

MR. SIRRI: Again, I was focusing on the broker dealer, but I know that our charge is affected by risks that are taken outside the broker dealer. You don't hold derivatives in a broker dealer because we haircut you, we charge you capital. So firms respond by moving the risk outside the broker dealer by moving illiquid instruments outside the broker dealer. That still imperils the broker dealer. We need to touch on those. We need --

SEN. BUNNING: Well, then, you need regulations over those people that are dealing in those entities.

MR. SIRRI: For preserving the broker dealer, that would be very helpful.

SEN. BUNNING: Thank you very much, Mr. Chairman.

SEN. REED: Thank you, Senator Bunning.

Let me raise a few questions. You mentioned, Dr. Sirri, that really what happened, in your view, was a run on the bank. And I think it begs the question, what caused the run on the bank? There are some people that suggest the huge amount of leverage which the market became aware of just undercut any sort of willingness to accept even Treasury securities. And that leverage ratio was something that was approved by the SEC, at least not effectively disapproved, and I think you had the authority to do that. Can you comment on that?

MR. SIRRI: Sure. The question of a run on the bank, which is the term I used, is always a difficult one because it implicitly depends on confidence in the institution. Of course, we didn't have a bank, and the run was different. It wasn't deposits. But nonetheless, it was funding with certain kinds of securities through the repo market. You know, it's hard to know why something like that starts. The instruments became the instruments in these firms. In some of the firms that are no longer with us, Lehman Brothers, for instance, suffered a lot of uncertainty about valuation.

So you have a financial firm, they're typically opaque, you don't know exactly what's going on, and that's the nature of a financial firm. Valuations become questionable because you're holding, for example, commercial whole loans, in the case of Lehman, where people doubted valuations. In a situation like that, people will be wary about funding. Because even if you can potentially get your money back, you're not in the business of getting tied up in an uncertainty, and that causes a situation that can cause a run.

SEN. REED: Thank you very much. Let me ask a general question which -- (inaudible) -- the answer unless -- my assumption is that the umbrella regulator in each one of these large institutions had an umbrella regulator, had the responsibility for the risk assessment throughout the organization, that there was not a case where the overall enterprise risk assessment or enterprise activities were not at all under the authority of a regulator. Is that your understanding, Dr. Sirri, in terms of the law?

MR. SIRRI: Well, I think the authority stems from different places. Again, we had no statutory authority. We crafted rules, I think, in other places. It's statutory. And again, our question of where we would look was governed by a certain set of preset risks. Our concern was always the broker dealer. Risks that pertained to things other than the broker deal that might imperil other entities were not our charge, and our program was not crafted to cover those.

SEN. REED: Mr. Polakoff, your responsibility derived from statute. Did you feel at OTS that those entities that you (were supervising ?) that you had responsibility for enterprise risk (Alice's ?) assessment -- (inaudible) -- enterprise?

MR. POLAKOFF: Yes, sir. The only thing I would offer is per Gramm-Leach-Bliley, we did rely to a great extent on functional regulators within the system. But as the holding company regulator for our institutions, absolutely, we had the overall umbrella responsibility.

SEN. REED: Mr. Long, is that your understanding? I know OTC is -- do you have an umbrella responsibility? Let me ask the basic question.

MR. LONG: We're the primary regulator for the bank, absolutely. Our authority and how we conduct our risk assessments, I think, works very well, and we feel like we have the proper authority.

SEN. REED: So you understand that you have to collaborate with others but that ultimately there is one federal regulator under the statute, Mr. Sirri has an exception, that had responsibility to look across the organization for risk assessment, risk evaluation and risk compliance?

MR. LONG: Well, I'm sorry, maybe I didn't understand your question. The way it works now is it's dependent on how well we communicate with each other. And if that's what you're asking, Senator, I want to make sure I answer your question right. Is there a systemic umbrella regulator right now that --

SEN. REED: I'm not talking systemic. I'm talking about you have a large, integrated financial organization that is regulated under statute. There is one regulator who is responsible for the overall operation. And let me ask the question, is there one regulator responsible for the overall operation of the entire enterprise?

MR. LONG: The OCC is responsible for the bank, and the Fed is responsible for the holding company.

SEN. REED: Mr. Cole, as the umbrella regulator for several large financial institutions, do you feel that you're responsible, the Federal Reserve is responsible for the overall capacity of that institution as the enterprise to evaluate risk?

MR. COLE: Yes, sir, we do. And we've gone, I think, an extra to make sure that that's very clear with the firms and our examiners by rolling out a consolidated supervision program in October of last year and communicating that very clearly with the other agencies.

SEN. REED: Let me go back to the point that was raised between Ms. Williams and Senator Bunning about the large financial institution's perspective on risk, the '05 reports, '06, '07 reports. These are internal documents, Ms. Williams, of the Fed? These were not released to the public?

MS. WILLIAMS: Yes, these are internal.

SEN. REED: And then there was an interruption in the report. But then in April of 2007, there was a report perspective of risk. Was that an internal document, too?

MS. WILLIAMS: Yes, all of them were internal.

SEN. REED: And it raises that question with respect to the Federal Reserve that if these documents are solely within the purview of the Federal Reserve, how is the broader financial community, the broader community and how is Congress to inform itself of critical issues that you feel could have profound consequences which have profound consequences?

MR. : One issue is just getting our own shop in order in terms of pulling all the information that is available to gather and creating a perspective on risk from a financial stability point of view, and that there is that process, we do have that process. We have a formal umbrella group that is in charge of making periodic reports to the board on information that's drawn from research and from our shop and other payment series and so on. So we are very, very focused in terms of creating a holistic picture of what's happening in the financial system now. That's very important.

Now, you know, the question in terms of, how do we go kind of the step of somehow making that public? It would obviously be worthwhile in some form to be public. I cannot answer that at this point.

SEN. REED: Well, you know, I would, I guess, one presumption would be to have this information. And I understand there is proprietary information that you have. And also, there's a concern about causing market movements based not upon financial information but other information. But I think if such information was in the public domain in some capacity in 2005, 2006 and 2007, was available to Congress and there was a number of opportunities for testimony to communicate that, that there might have been earlier, prompter and more effective action to deal with some of these issues which are bedeviling us at the moment. In that regard, too, I know, because we've had the chance to meet, that the Federal Reserve and all these agencies are taking a serious look backwards. You know, you've described some of your conclusions.

Ms. Williams has and her colleagues have provided some perspective. But these reports -- I'll use the term I used as a youth -- these after-action reports have to become public, particularly in the context of organizing a systemic regulator. Because if we are unaware, if you remain, you know, opaque, it's hard for us, I think, to make a reasoned judgment about who should have responsibilities, what could be the lines of communication. So I know Governor Cohen and his colleagues are working on this report. I would hope it would be public.

Let me ask another question, and it comes from the GAO report, which is the comment and conclusion that, in many respects, you are captives of the information of the organization you're regulating, that you have to rely, to a certain degree, on their models, their information and, in some cases, I think, talking with respect to counterparty risk, their intuitions about the credit worthiness of counterparties. Is that a fair summary of your conclusions, Ms. Williams?

Let me begin with Dr. Sirri and work the other way. Which is, you know, being a captive to information, to systems and to models sometimes doesn't give you the leverage you need to take action. Is that, one, accurate? And two, how do you change that?

MR. SIRRI: I think there's an element of accuracy to that. But I think there are tools available to us as regulators. Let me give you a specific instance. You're right. A particular complex financial firm will develop a model for risk, but they'll have a process around that model for risk. And we care about the processes and the robustness of the processes and controls. So for example, the model for risk is developed. Who validates it? Who verifies it? Who runs that model? If they report to the trading desk whose assets they're pricing, that's not helpful, and that's problematic. If they report to an independent third party that perhaps reports directly to the CFO or a risk officer, much stronger structure, gives you some comfort.

Again, let me take a second one -- a price-verification group. You may have a firm that trades assets, but they have problems valuing the assets, as you do when liquidity dries up. When valuations are struck, how are those valuations struck? There may be a model. Who validates the model? And how do you resolve disputes? If the trader says it's worth more than the risk person says it's worth, how do you resolve that? Is there a process where it could go up to the audit committee? And if it goes to the audit committee, does the after- action report, the phrase you used, for that instance, does that go to the board of directors?

Such processes, if they're in place, tell you that that firm is taking their job seriously.

SEN. REED: I would presume, and correct me, that those appropriate procedures you described were not being deployed very successfully at various times at Lehman Brothers. And were you aware of kind of those deficiencies contemporaneously with their --

MR. SIRRI: I don't want to comment on any one firm, but what I will say is there was considerable variation across the firms, especially with -- let's take that same point, pricing. And one thing we saw, and issues like this are dealt with in the senior supervisors report that the New York Fed led, the stronger your governance, the stronger your controls, it turns out the better you probably weathered the storm. The best-run firms had good processes. And some of the firms that got into the most trouble had distinct weaknesses. It varied from firm to firm.

SEN. REED: Just to follow up. The firms that you saw and which have failed, did you note those weaknesses? Did you communicate those weaknesses to the board? It goes to the essence of many of the questions we've raised. You know, making the diagnosis that you're ill and then not treating the patient is, you know, malpractice. What do you think?

MR. SIRRI: We had escalation procedures, and we used them. I don't want to come here and tell you that every time we did it perfectly, but I have personally met with audit committee members when I felt that there was an issue that wasn't being resolved properly. But I don't want to overstate and say in each way we escalated as far as we should have, looking back. We probably should have done more at times.

SEN. REED: Mr. Polakoff, the same general line of questions about the reliance upon internal models, the data of the company, sort of captive of what they're doing versus having the resources to leverage appropriately behavior.

MR. POLAKOFF: Senator, I'd say there's an element of truth to that statement in the report, but it probably doesn't capture the entire universe. What we do and we do very well is put boots on the ground. We have examiners to go on site from one large institution to another large institution. And while there may be a stable and there is a stable examiner in charge, we send specialists from institution to institution, which allows a horizontal review, which allows an assessment of best practices. So whether it's modeling, whether it's pricing, whether it's risk factors, we don't silo the examination approach. And that's very helpful in addressing these kind of issues. So that's number one.

Number two, we look to the outside parties, so whether it's the external auditors, whether it is the external accountants, we work with them on models because they also bring a similar expertise of looking horizontally across a number of institutions for best practices in a number of areas.

And then number three, like Eric said, we look at the corporate governance of the institution itself. How is it structured? How robust is the risk management committee? How robust is the audit committee as part of the board? How are the reporting lines handled?

Each of those three areas, I think, allows us to very independently assess and judge whether it's the risk models or other factors.

SEN. REED: And listening to that, it's very, I think, insightful. And it seems to be a great approach, it just doesn't seem to have worked in the case of some of the institutions that you regulated. And that wasn't the approach that was being used in 2004 or 2005, 2006? Or it was an approach but something else undermined it?

MR. POLAKOFF: It was the approach. Senator, the one common theme that all of us see is an economic cycle that was unprecedented in its duration. All of our institutions, all of our risk management practices, all of our examination approaches work well, but it's difficult to look at all the risk models and stress them to unprecedented degrees and then require institutions to operate within those stress models.

You know, hindsight, we should have predicted a little better in 2004 and 2005 what the economy was going to look like now. But the economy we're operating in now has an absolute direct affect on performance.

SEN. REED: Well, let me raise a -- because this has been publicly discussed, I think we actually discussed it last week. In 2005, the Financial Products Division of AIG concludes that mortgage- backed securities are too risky a bet. At the same time, the securities lending operation decides that they want to take their cash that they're getting and invest it decisively in these types of securities. You know, where was the risk assessment of the enterprise, as you described it? And where was the OTS to say, wait a second, you can't have two contradictory approaches based upon, one, this is the best investment and, two, this is the worst investment?

MR. POLAKOFF: So Senator, you're right, and you identified what's either a hole or an overlap, depending on one's view. Those activities, as you remember, were regulated by the state insurance commissioners. So under Gramm-Leach-Bliley, the umbrella regulator typically will defer to the functional regulator to assess the risks and then report up to the umbrella regulator.

SEN. REED: But you know, it goes back to the question I raised before and which I think you had firmly responded, that in terms of overall risk mechanisms, risk compliance, that it was clear that the umbrella regulator had that responsibility. And here, if you had communicated with the supervisor and they had indicated that this was the investment patent of the regulated insurance part, it would have seemed to have raised a huge red flag. They both can't be right.

MR. POLAKOFF: Senator, I can assure you that there was ample communication between OTS and its umbrella responsibility and the functional regulators. But you're identifying an absolute inconsistency which is, why did we stop one function from performing that kind of activity, and why did another functional regulator allow its entities to move forward with it? I mean, there has to be a postmortem on what broke down in that process.

SEN. REED: Yes.

Mr. Long, same set of issues about reliance upon information and being a captive of the regulated entity.

MR. LONG: Well, I agree with what Scott said. I'm not going to repeat it. I think we have ample authority to take whatever action we need. And you know, look, I think it's an oversimplification to say that this was a modeling problem. If you go back to the last time we went through this and you talk to the CEOs that went through this back in the late '80s and early '90s, they're going to tell you there were two things that got them. One was the concentrations, and number two were mitigating the policy overrides on the underwriting.

Quite frankly, I think that is really the center of this thing. This wasn't that we missed a bunch of models. Clearly, the banks weren't modeling in their tail risk that there would be a complete shutdown of liquidity across the system. And that was a problem with their models. But this goes to basic underwriting, and it goes to basic concentration risk. They had too much of a bad deal, and that has compounding affects on liquidity, on capital. And when the global liquidity market shut down, they had a real problem.

So you know, yeah, we look at all of it. We look at corporate governance. We look at underwriting. We look at all of the risk areas. And clearly, we look at modeling, too. We have a rigorous, you know, check and stress testing around those models. And quite frankly, a lot of people missed the part of, you know, they'd stress tail risk in the company, they didn't stress tail risk across the world.

SEN. REED: Mr. Cole, briefly, if you could, please.

MR. COLE: Indeed, Senator. We clearly, as umbrella oversight supervisors, rely significantly on the functional regulators. I will say, though, that in terms of really doing our job, if we sense that there are deficiencies and need to do more than the functional regulator is doing, we do reserve the ability, I think, under Gramm- Leach-Bliley in fact by authority to go in and do more.

SEN. REED: Ms. Williams, I mean, you talked about and we've had a discussion about communicating concern, looking at regulatory structures, looking at the governance, et cetera. But there's another way sort of to get the message across to the marketplace. That's enforcement action. That's public enforcement action that is clear to everyone that there is not only a particular situation but a category of situations that regulators are concerned about. Did you touch upon that in your report or your review about any follow-up enforcement, official enforcement actions rather than informal discussions?

MS. WILLIAMS: I think we did touch on the process and the range of options in the fact that with the banking regulators, in particular, there was a tendency not to pursue formal public enforcement actions. And that has to do with the fact that it does become public, and that can have an adverse impact on an open bank.

SEN. REED: Can you cite a situation, Dr. Sirri, where the SEC took a formal enforcement action with respect to the risk practices of any of the regulator entities?

MR. SIRRI: I'm not sure I can cite a public action, something that has happened and been closed. I will cite something that is public. I don't know the current list, but a number of months ago we stated how many cases we had in progress on matters related to subprime mortgages. Now, subprime mortgages run the gamut, the cases from issues about origination through issues related to other things within large firms. It wouldn't surprise me, and it may be possible, I honestly don't know, that there might be something related in there. But I truly do not know. And even if I did, I shouldn't comment.

SEN. REED: Mr. Polakoff.

MR. POLAKOFF: Absolutely, Senator. We took public and formal enforcement action against AIG regarding some of its inappropriate lending.

SEN. REED: No, I'm talking about the issue of risk assessment, risk management, the issues that have been the subject of this GAO report.

MR. POLAKOFF: I'm not sure about all the specifics on the GAO report, but I think Ms. Williams said that for some of the larger institutions the regulators were shy in pursuing formal enforcement action because it was public. And I'd like to suggest that that would not be an accurate statement, at least from an OTS perspective.

SEN. REED: And what actions did you take with respect to AIG?

MR. POLAKOFF: It was a cease and desist order. We took a cease and desist order against a large institution on the West Coast for BSA-related problems. And these are all formal and public. And I don't think any of the banking regulators would shy away from taking formal enforcement action because it's public. We don't shy away because it's public. We don't shy away even when an institution's trying to raise capital. We have to do the right thing from an enforcement action perspective.

SEN. REED: Mr. Long, your view?

MR. LONG: Congressman, we've taken both formal and informal, and we use them regularly. But let me clarify something because I think it's important for this point. Congress specifically gave the banking regulators specific authority here to either do, you know, a series of informal actions and a series of formal actions. And you know, in some cases, you know, we choose to go informal and we go nonpublic. I want to assure you that that is no less rigorous than formal action. I mean, I've been in the board room for the signings of many informal documents throughout my career and recently, and I can assure you that the environment in that room in the signing of the information documents can be a career-altering experience for the management of that firm. The fact that it's informal does not mean that it's not serious and not taken seriously.

SEN. REED: I'm not suggesting that these aren't serious actions and you're not serious about your actions. It's just that many times an action which is publicized gets the attention of a lot more people than just the people in the board room. And behaviors change not just within that board room of that organization but throughout the system.

MR. LONG: Senator, that's a good point. And we look at every action that we take, and we weigh the pros and cons. But you know, we feel like we use both effectively. But we do utilize both, and we do it regularly.

SEN. REED: Mr. Cole.

MR. COLE: Yes. With regard to the BSA situation, I mentioned earlier that was a formal public action. I would tend to agree very much with Mr. Long in terms of figuring out what the most effective approach is given the management situation. And if we can effect change by going directly to the management and accomplishing that, that's what we would tend to do rather than taking the next step and going to a formal action.

SEN. REED: Well, I don't think there is -- this is so specific in the situation that you have to have some deference to regulators. But going to the core issue we've had of just the perception, I think, that was growing throughout the community of regulators that risk systems, risk compliance, attention to risk was not being emphasized enough. And then try to deal with it on a case by case and, you know, quietly didn't seem to work. And I think that might be one of the conclusions we draw, not to say you didn't have the authority to do it or your judgment was -- but it just didn't seem to work.

I want to thank you. I want to thank, again, Ms. Williams and her colleagues for, I think, a very good report. I want to thank you for your comments and questions. And we'll continue to probe all these issues as we go forward. Thank you very much. The hearing is adjourned.

END.

Source