SECURITIES—Due Diligence Requirements for Investing; Supervisory Policy Statement

The Office of the Comptroller of the Currency (OCC) has issued final rules to revise the definition of “investment grade,” as that term is used in 12 CFR parts 1 and 160 in order to comply with section 939A of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act). Institutions have until January 1, 2013, to ensure that existing investments comply with the revised “investment grade” standard, as applicable based on investment type, and safety and soundness practices described in 12 CFR 1.5 and this guidance. This implementation period also will provide management with time to evaluate and amend existing policies and practices to ensure new purchases comply with the final rules and guidance. National banks and federal savings associations that have established due diligence review processes as described in previous guidance, and that have not relied exclusively on external credit ratings, should not have difficulty establishing compliance with the new standard.

The OCC is issuing this guidance to clarify steps national banks ordinarily are expected to take to demonstrate they have properly verified their investments meet the newly established credit quality standards under 12 CFR part 1 and steps national banks and federal savings associations are expected to take to demonstrate they are in compliance with due diligence requirements when purchasing investment securities and conducting ongoing reviews of their investment portfolios. Federal savings associations will need to follow Federal Deposit Insurance Corporation (FDIC) requirements when that agency promulgates credit quality standards under 12 U.S.C. 1831e. The standards below describe how national banks may purchase, sell, deal in, underwrite, and hold securities consistent with the authority contained in 12 U.S.C. 24 (Seventh), and how federal saving associations may invest in, sell, or otherwise deal in securities consistent with the authority contained in 12 U.S.C. 1464(c). The activities of national banks and federal savings associations also must be consistent with safe and sound banking practices, and this guidance reminds national banks and federal savings associations of the supervisory risk-management expectations associated with permissible investment portfolio holdings under part 1 and part 160.

Parts 1 and 160 provide standards for determining whether securities have appropriate credit quality and marketability characteristics to be purchased and held by national banks or federal savings associations. These requirements also establish limits on the amount of investment securities an institution may hold for its own account. As defined in 12 CFR part 1, an “investment security” must be “investment grade.” For the purpose of part 1, “investment grade” securities are those where the issuer has an adequate capacity to meet the financial commitments under the security for the projected life of the investment. An issuer has an adequate capacity to meet financial commitments if the risk of default by the obligor is low and the full and timely repayment of principal and interest is expected. Generally, securities with good to very strong credit quality will meet this standard. In the case of a structured security (that is, a security that relies primarily on the cash flows and performance of underlying collateral for repayment, rather than the credit of the entity that is the issuer), the determination that full and timely repayment of principal and interest is expected may be influenced more by the quality of the underlying collateral, the cash flow rules, and the structure of the security itself than by the condition of the issuer.

National banks and federal savings associations must be able to demonstrate that their investment securities meet applicable credit quality standards. This guidance provides criteria that national banks can use in meeting part 1 credit quality standards and that national banks and federal savings associations can use in meeting due diligence requirements.

The OCC’s elimination of references to credit ratings in its regulations, in accordance with the Dodd-Frank Act, does not substantively change the standards institutions should use when deciding whether securities are eligible for purchase under part 1. The OCC’s investment securities regulations generally require a national bank or federal savings association to determine whether or not a security is “investment grade” in order to determine whether purchasing the security is permissible. Investments are considered “investment grade” if they meet the regulatory standard for credit quality. To meet this standard, a national bank must be able to determine that the security has (1) low risk of default by the obligor, and (2) the full and timely repayment of principal and interest is expected over the expected life of the investment.¹ A federal savings association must meet the same standard when purchasing certain municipal revenue bonds pursuant to 12 CFR 160.24 and must meet the standards in 12 U.S.C. 1831e when purchasing corporate debt securities.

For national banks, type I securities, as defined in part 1, generally are government obligations and are not subject to investment grade criteria for determining eligibility to purchase. Typical type I obligations include U.S. Treasuries, agencies, municipal government general obligations, and for well-capitalized institutions, municipal revenue bonds. While type I obligations do not have to meet the investment grade criteria to be eligible for purchase, all investment activities should comply with safe and sound banking practices as stated in 12 CFR 1.5 and in previous regulatory guidance. Under OCC rules, Treasury and agency obligations do not require individual credit analysis, but bank management should consider how those securities fit into the overall purpose, plans, and risk and concentration limitations of the investment policies established by the board of directors. Municipal bonds should be subject to an initial credit assessment and then ongoing review consistent with the risk characteristics of the bonds and the overall risk of the portfolio.

Financial institutions should be well acquainted with fundamental credit analysis as this is central to a well-managed loan portfolio. The foundation of a fundamental credit analysis—character, capacity, collateral, and covenants—applies to investment securities just as it does to the loan portfolio. Accordingly, the OCC expects national banks and federal savings associations to conduct an appropriate level of due diligence to understand the inherent risks and determine that a security is a permissible investment. The extent of the due diligence should be sufficient to support the institution’s conclusion that a security meets the investment grade standards. This may include consideration of internal analyses, third-party research and analytics including external credit ratings, internal risk ratings, default statistics, and other sources of information as appropriate for the particular security. Some institutions may have the resources to do most or all of the analytical work internally. Some, however, may choose to rely on third parties for much of the analytical work. While analytical support may be delegated to third parties, management may not delegate its responsibility for decisionmaking and should ensure that prospective third parties are independent, reliable, and qualified. The board of directors should oversee management to assure that an appropriate decisionmaking process is in place.

The depth of the due diligence should be a function of the security’s credit quality, the complexity of the structure, and the size of the investment. The more complex a security’s structure, the more credit-related due diligence an institution should perform, even when the credit quality is perceived to be very high. Management should ensure it understands the security’s structure and how the security may perform in different default environments, and should be particularly diligent when purchasing structured securities.² The OCC expects national banks and federal savings associations to consider a variety of factors relevant to the particular security when determining whether a security is a permissible and sound investment. The range and type of specific factors an institution should consider will vary depending on the particular type and nature of the securities. As a general matter, a national bank or federal savings association will have a greater burden to support its determination if one factor is contradicted by a finding under another factor.

The following matrix provides examples of factors for national banks and federal savings associations to consider as part of a robust credit risk assessment framework for designated types of instruments. The types of securities included in the matrix require a credit-focused pre-purchase analysis to meet the investment grade standard or safety and soundness standards. Again, the matrix is provided as a guide to better inform the credit risk assessment process. Individual purchases may require more or less analysis dependent on the security’s risk characteristics, as previously described.

The creditworthiness assessment for an investment security that relies on the cash flows and collateral of the underlying assets for repayment (i.e., a structured security) is inherently different from a security that relies on the financial capacity of the issuer for repayment. Therefore, a financial institution should demonstrate an understanding of the features of a structured security that would materially affect its performance and that its risk of loss is low even under adverse economic conditions. Management’s assessment of key factors, such as those provided in this guidance, will be considered a critical component of any structured security evaluation. Existing OCC guidance, including OCC Bulletin 2002-19, “Supplemental Guidance, Unsafe and Unsound Investment Portfolio Practices,” states that it is unsafe and unsound to purchase a complex high-yield security without an understanding of the security’s structure and performing a scenario analysis that evaluates how the security will perform in different default environments. Policies that specifically permit this type of investment should establish appropriate limits, and pre-purchase due diligence processes should consider the impact of such purchases on capital and earnings under a variety of possible scenarios. The OCC expects institutions to understand the effect economic stresses may have on an investment’s cash flows. Various factors can be used to define the stress scenarios. For example, an institution could evaluate the potential impact of changes in economic growth, stock market movements, unemployment, and home values on default and recovery rates. Some institutions have the resources to perform this type of analytical work internally. Generally, analyses of the application of various stress scenarios to a structured security’s cash flow are widely available from third parties. Many of these analyses evaluate the performance of the security in a base case and a moderate and severe stress case environment. Even under severe stress conditions, the stress scenario analysis should determine that the risk of loss is low and full and timely repayment of principal and interest is expected.

The OCC has had a long-standing expectation that national banks implement a risk-management process to ensure credit risk, including credit risk in the investment portfolio, is effectively identified, measured, monitored, and controlled. The 1998 Interagency Supervisory Policy Statement on Investment Securities and End-User Derivatives Activities contains risk-management standards for the investment activities of banks and savings associations (see 3-1562).³ The policy statement emphasizes the importance of establishing and maintaining risk processes to manage the market, credit, liquidity, legal, operational, and other risks of investment securities. Other previously issued guidance that supplements OCC investment standards are OCC 2009-15, “Risk Management and Lessons Learned” (which highlights lessons learned during the market disruption and re-emphasizes the key principles discussed in previously issued OCC guidance on portfolio risk management); OCC 2004-25, “Uniform Agreement on the Classification of Securities” (which describes the importance of management’s credit risk analysis and its use in examiner decisions concerning investment security risk ratings and classifications); and OCC 2002-19, “Supplemental Guidance, Unsafe and Unsound Investment Portfolio Practices” (which alerts banks to the potential risk to future earnings and capital from poor investment decisions made during periods of low levels of interest rates and emphasizes the importance of maintaining prudent credit, interest rate, and liquidity risk-management practices to control risk in the investment portfolio).⁴

National banks and federal savings associations must have in place an appropriate risk-management framework for the level of risk in their investment portfolios. Failure to maintain an adequate investment portfolio risk-management process, which includes understanding key portfolio risks, is considered an unsafe and unsound practice.

Having a strong and robust risk-management framework appropriate for the level of risk in an institution’s investment portfolio is particularly critical for managing portfolio credit risk. A key role for management in the oversight process is to translate the board of directors’ tolerance for risk into a set of internal operating policies and procedures that govern the institution’s investment activities. Policies should be consistent with the organization’s broader business strategies, capital adequacy, technical expertise, and risk tolerance. Institutions should ensure that they identify and measure the risks associated with individual transactions prior to acquisition and periodically after purchase. This can be done at the institutional, portfolio, or individual instrument level. Investment policies also should provide credit risk concentration limits. Such limits may apply to concentrations relating to a single or related issuer, a geographical area, and obligations with similar characteristics. Safety and soundness principles warrant effective concentration risk-management programs to ensure that credit exposures do not reach an excessive level.

The aforementioned risk-management policies, principles, and due diligence processes should be commensurate with the complexity of the investment portfolio and the materiality of the portfolio to the financial performance and capital position of the institution. Investment review processes, following the pre-purchase analysis, may vary from institution to institution based on the individual characteristics of the portfolio, the nature and level of risk involved, and how that risk fits into the overall risk profile and operation of the institution. Investment portfolio reviews may be risk-based and focus on material positions or specific groups of investments or stratifications to enable analysis and review of similar risk positions.

As with pre-purchase analytics, some institutions may have the resources necessary to do most or all of their portfolio reviews internally. However, some may choose to rely on third parties for much of the analytical work. Third-party vendors offer risk analysis and data benchmarks that could be periodically reviewed against existing portfolio holdings to assess credit quality changes over time. Holdings where current financial information or other key analytical data is unavailable should warrant more frequent analysis. High quality investments generally will not require the same level of review as investments further down the credit quality spectrum. However, any material positions or concentrations should be identified and assessed in more depth and more frequently, and any system should ensure an accurate and timely risk assessment and reporting process that informs the board of material changes to the risk profile and prompts action when needed. National banks and federal savings associations should have investment portfolio review processes that effectively assess and manage the risks in the portfolio and ensure compliance with policies and risk limits. Institutions should reference existing regulatory guidance for additional supervisory expectations for investment portfolio risk-management practices.