RATING SYSTEMS—Financial Institutions

The Uniform Financial Institutions Rating System (UFIRS) was adopted by the Federal Financial Institutions Examination Council (FFIEC) on November 13, 1979. Over the years, the UFIRS has proven to be an effective internal supervisory tool for evaluating the soundness of financial institutions¹ on a uniform basis and for identifying those institutions requiring special attention or concern. A number of changes, however, have occurred in the banking industry and in the federal supervisory agencies’ policies and procedures which have prompted a review and revision of the 1979 rating system. The revisions to UFIRS include the addition of a sixth component addressing sensitivity to market risks, the explicit reference to the quality of risk-management processes in the management component, and the identification of risk elements within the composite- and component-rating descriptions.

The revisions to UFIRS are not intended to add to the regulatory burden of institutions or require additional policies or processes. The revisions are intended to promote and complement efficient examination processes. The revisions have been made to update the rating system, while retaining the basic framework of the original rating system.

The UFIRS takes into consideration certain financial, managerial, and compliance factors that are common to all institutions. Under this system, the supervisory agencies endeavor to ensure that all financial institutions are evaluated in a comprehensive and uniform manner, and that supervisory attention is appropriately focused on the financial institutions exhibiting financial and operational weaknesses or adverse trends.

The UFIRS also serves as a useful vehicle for identifying problem or deteriorating financial institutions, as well as for categorizing institutions with deficiencies in particular component areas. Further, the rating system assists Congress in following safety-and-soundness trends and in assessing the aggregate strength and soundness of the financial industry. As such, the UFIRS assists the agencies in fulfilling their collective mission of maintaining stability and public confidence in the nation’s financial system.

Under the UFIRS, each financial institution is assigned a composite rating based on an evaluation and rating of six essential components of an institution’s financial condition and operations. These component factors address the adequacy of capital, the quality of assets, the capability of management, the quality and level of earnings, the adequacy of liquidity, and the sensitivity to market risk. Evaluations of the components take into consideration the institution’s size and sophistication, the nature and complexity of its activities, and its risk profile.

Composite and component ratings are assigned based on a 1 to 5 numerical scale. A 1 indicates the highest rating, strongest performance and risk-management practices, and least degree of supervisory concern, while a 5 indicates the lowest rating, weakest performance, inadequate risk-management practices and, therefore, the highest degree of supervisory concern.

The composite rating generally bears a close relationship to the component ratings assigned. However, the composite rating is not derived by computing an arithmetic average of the component ratings. Each component rating is based on a qualitative analysis of the factors comprising that component and its interrelationship with the other components. When assigning a composite rating, some components may be given more weight than others, depending on the situation at the institution. In general, assignment of a composite rating may incorporate any factor that bears significantly on the overall condition and soundness of the financial institution. Assigned composite and component ratings are disclosed to the institution’s board of directors and senior management.

The ability of management to respond to changing circumstances and to address the risks that may arise from changing business conditions, or the initiation of new activities or products, is an important factor in evaluating a financial institution’s overall risk profile and the level of supervisory attention warranted. For this reason, the management component is given special consideration when assigning a composite rating.

The ability of management to identify, measure, monitor, and control the risks of its operations is also taken into account when assigning each component rating. It is recognized, however, that appropriate management practices vary considerably among financial institutions, depending on their size, complexity, and risk profile. For less complex institutions engaged solely in traditional banking activities and whose directors and senior managers, in their respective roles, are actively involved in the oversight and management of day-to-day operations, relatively basic management systems and controls may be adequate. At more complex institutions, on the other hand, detailed and formal management systems and controls are needed to address their broader range of financial activities and to provide senior managers and directors, in their respective roles, with the information they need to monitor and direct day-to-day activities. All institutions are expected to properly manage their risks. For less-complex institutions engaging in less-sophisticated risk-taking activities, detailed or highly formalized management systems and controls are not required to receive strong or satisfactory component or composite ratings.

Foreign-branch and specialty examination findings and the ratings assigned to those areas are taken into consideration, as appropriate, when assigning component and composite ratings under UFIRS. The specialty examination areas include compliance, community reinvestment, government security dealers, information systems, municipal security dealers, transfer agent, and trust.

The following two sections contain the composite-rating definitions and the descriptions and definitions for the six component ratings.

Composite ratings are based on a careful evaluation of an institution’s managerial, operational, financial, and compliance performance. The six key components used to assess an institution’s financial condition and operations are capital adequacy, asset quality, management capability, earnings quantity and quality, the adequacy of liquidity, and sensitivity to market risk. The rating scale ranges from 1 to 5, with a rating of 1 indicating the strongest performance and risk-management practices relative to the institution’s size, complexity, and risk profile, and the level of least supervisory concern. A 5 rating indicates the most critically deficient level of performance; inadequate risk-management practices relative to the institution’s size, complexity, and risk profile; and the greatest supervisory concern. The composite ratings are defined as follows.

Financial institutions in this group are sound in every respect and generally have components rated 1 or 2. Any weaknesses are minor and can be handled in a routine manner by the board of directors and management. These financial institutions are the most capable of withstanding the vagaries of business conditions and are resistant to outside influences such as economic instability in their trade area. These financial institutions are in substantial compliance with laws and regulations. As a result, these financial institutions exhibit the strongest performance and risk-management practices relative to the institution’s size, complexity, and risk profile and give no cause for supervisory concern.

Financial institutions in this group are fundamentally sound. For a financial institution to receive this rating, generally no component rating should be more severe than 3. Only moderate weaknesses are present and are well within the board of directors’ and management’s capabilities and willingness to correct. These financial institutions are stable and are capable of withstanding business fluctuations. These financial institutions are in substantial compliance with laws and regulations. Overall risk-management practices are satisfactory relative to the institution’s size, complexity, and risk profile. There are no material supervisory concerns and, as a result, the supervisory response is informal and limited.

Financial institutions in this group exhibit some degree of supervisory concern in one or more of the component areas. These financial institutions exhibit a combination of weaknesses that may range from moderate to severe; however, the magnitude of the deficiencies generally will not cause a component to be rated more severely than 4. Management may lack the ability or willingness to effectively address weaknesses within appropriate time frames. Financial institutions in this group generally are less capable of withstanding business fluctuations and are more vulnerable to outside influences than those institutions rated a composite 1 or 2. Additionally, these financial institutions may be in significant noncompliance with laws and regulations. Risk-management practices may be less than satisfactory relative to the institution’s size, complexity, and risk profile. These financial institutions require more-than-normal supervision, which may include formal or informal enforcement actions. Failure appears unlikely, however, given the overall strength and financial capacity of these institutions.

Financial institutions in this group generally exhibit unsafe and unsound practices or conditions. There are serious financial or managerial deficiencies that result in unsatisfactory performance. The problems range from severe to critically deficient. The weaknesses and problems are not being satisfactorily addressed or resolved by the board of directors and management. Financial institutions in this group generally are not capable of withstanding business fluctuations. There may be significant noncompliance with laws and regulations. Risk-management practices are generally unacceptable relative to the institution’s size, complexity, and risk profile. Close supervisory attention is required, which means, in most cases, formal enforcement action is necessary to address the problems. Institutions in this group pose a risk to the deposit insurance fund. Failure is a distinct possibility if the problems and weaknesses are not satisfactorily addressed and resolved.

Financial institutions in this group exhibit extremely unsafe and unsound practices or conditions; exhibit a critically deficient performance; often contain inadequate risk-management practices relative to the institution’s size, complexity, and risk profile; and are of the greatest supervisory concern. The volume and severity of problems are beyond management’s ability or willingness to control or correct. Immediate outside financial or other assistance is needed in order for the financial institution to be viable. Ongoing supervisory attention is necessary. Institutions in this group pose a significant risk to the deposit insurance fund and failure is highly probable.

Each of the component-rating descriptions is divided into three sections: an introductory paragraph, a list of the principal evaluation factors that relate to that component, and a brief description of each numerical rating for that component. Some of the evaluation factors are reiterated under one or more of the other components to reinforce the interrelationship between components. The listing of evaluation factors for each component rating is in no particular order of importance.

A financial institution is expected to maintain capital commensurate with the nature and extent of risks to the institution and the ability of management to identify, measure, monitor, and control these risks. The effect of credit, market, and other risks on the institution’s financial condition should be considered when evaluating the adequacy of capital. The types and quantity of risk inherent in an institution’s activities will determine the extent to which it may be necessary to maintain capital at levels above required regulatory minimums to properly reflect the potentially adverse consequences that these risks may have on the institution’s capital.

The capital adequacy of an institution is rated based upon, but not limited to, an assessment of the following evaluation factors:

Ratings.

The asset-quality rating reflects the quantity of existing and potential credit risk associated with the loan and investment portfolios, other real estate owned, and other assets, as well as off-balance-sheet transactions. The ability of management to identify, measure, monitor, and control credit risk is also reflected here. The evaluation of asset quality should consider the adequacy of the allowance for loan and lease losses and weigh the exposure to counterparty, issuer, or borrower default under actual or implied contractual agreements. All other risks that may affect the value or marketability of an institution’s assets, including, but not limited to, operating, market, reputation, strategic, or compliance risks should also be considered.

The asset quality of a financial institution is rated based upon, but not limited to, an assessment of the following evaluation factors:

Ratings.

The capability of the board of directors and management, in their respective roles, to identify, measure, monitor, and control the risks of an institution’s activities and to ensure a financial institution’s safe, sound, and efficient operation in compliance with applicable laws and regulations is reflected in this rating. Generally, directors need not be actively involved in day-to-day operations; however, they must provide clear guidance regarding acceptable risk-exposure levels and ensure that appropriate policies, procedures, and practices have been established. Senior management is responsible for developing and implementing policies, procedures, and practices that translate the board’s goals, objectives, and risk limits into prudent operating standards.

Depending on the nature and scope of an institution’s activities, management practices may need to address some or all of the following risks: credit, market, operating or transaction, reputation, strategic, compliance, legal, liquidity, and other risks. Sound management practices are demonstrated by active oversight by the board of directors and management; competent personnel; adequate policies, processes, and controls taking into consideration the size and sophistication of the institution; maintenance of an appropriate audit program and internal-control environment; and effective risk-monitoring and management information systems. This rating should reflect the board’s and management’s ability as it applies to all aspects of banking operations as well as other financial service activities in which the institution is involved.

The capability and performance of management and the board of directors is rated based upon, but not limited to, an assessment of the following evaluation factors:

Ratings.

This rating reflects not only the quantity and trend of earnings but also factors that may affect the sustainability or quality of earnings. The quantity as well as the quality of earnings can be affected by excessive or inadequately managed credit risk that may result in loan losses and require additions to the allowance for loan and lease losses, or by high levels of market risk that may unduly expose an institution’s earnings to volatility in interest rates. The quality of earnings may also be diminished by undue reliance on extraordinary gains, nonrecurring events, or favorable tax effects. Future earnings may be adversely affected by an inability to forecast or control funding and operating expenses, improperly executed or ill-advised business strategies, or poorly managed or uncontrolled exposure to other risks.

The rating of an institution’s earnings is based upon, but not limited to, an assessment of the following evaluation factors:

Ratings.

In evaluating the adequacy of a financial institution’s liquidity position, consideration should be given to the current level and prospective sources of liquidity compared to funding needs, as well as to the adequacy of funds-management practices relative to the institution’s size, complexity, and risk profile. In general, funds-management practices should ensure that an institution is able to maintain a level of liquidity sufficient to meet its financial obligations in a timely manner and to fulfill the legitimate banking needs of its community. Practices should reflect the ability of the institution to manage unplanned changes in funding sources, as well as react to changes in market conditions that affect the ability to quickly liquidate assets with minimal loss. In addition, funds-management practices should ensure that liquidity is not maintained at a high cost, or through undue reliance on funding sources that may not be available in times of financial stress or adverse changes in market conditions.

Liquidity is rated based upon, but not limited to, an assessment of the following evaluation factors:

Ratings.

The sensitivity-to-market-risk component reflects the degree to which changes in interest rates, foreign-exchange rates, commodity prices, or equity prices can adversely affect a financial institution’s earnings or economic capital. When evaluating this component, consideration should be given to management’s ability to identify, measure, monitor, and control market risk; the institution’s size; the nature and complexity of its activities; and the adequacy of its capital and earnings in relation to its level of market-risk exposure.

For many institutions, the primary source of market risk arises from nontrading positions and their sensitivity to changes in interest rates. In some larger institutions, foreign operations can be a significant source of market risk. For some institutions, trading activities are a major source of market risk.

Market risk is rated based upon, but not limited to, an assessment of the following evaluation factors:

Ratings.