SAFETY AND SOUNDNESS—Interagency Guidance on Asset-Securitization Activities

Recent examinations have disclosed significant weaknesses in the asset-securitization practices of some insured depository institutions. These weaknesses raise concerns about the general level of understanding and controls among institutions that engage in such activities. The most frequently encountered problems stem from (1) the failure to recognize and hold sufficient capital against explicit and implicit recourse obligations that frequently accompany securitizations, (2) the excessive or inadequately supported valuation of “retained interests,”¹ (3) the liquidity risk associated with over reliance on asset securitization as a funding source, and (4) the absence of adequate independent risk-management and audit functions.

The Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System, and the Office of Thrift Supervision, hereafter referred to as “the agencies,” are jointly issuing this statement to remind financial-institution managers and examiners of the importance of fundamental risk-management practices governing asset-securitization activities. This guidance supplements existing policy statements and examination procedures issued by the agencies and emphasizes the specific expectation that any securitization-related retained interest claimed by a financial institution will be supported by documentation of the interest’s fair value, utilizing reasonable, conservative valuation assumptions that can be objectively verified. Retained interests that lack such objectively verifiable support or that fail to meet the supervisory standards set forth in this document will be classified as loss and disallowed as assets of the institution for regulatory capital purposes.

The agencies are reviewing institutions’ valuation of retained interests and the concentration of these assets relative to capital. Consistent with existing supervisory authority, the agencies may, on a case-by-case basis, require institutions that have high concentrations of these assets relative to their capital, or are otherwise at risk from impairment of these assets, to hold additional capital commensurate with their risk exposures. Furthermore, given the risks presented by these activities, the agencies are actively considering the establishment of regulatory restrictions that would limit or eliminate the amount of certain retained interests that may be recognized in determining the adequacy of regulatory capital. An excessive dependence on securitizations for day-to-day core funding can also present significant liquidity problems—either during times of market turbulence or if there are difficulties specific to the institution itself. As applicable, the agencies will provide further guidance on the liquidity risk associated with over reliance on asset securitizations as a funding source and on implicit recourse obligations.

Asset securitization typically involves the transfer of on-balance-sheet assets to a third party or trust. In turn the third party or trust issues certificates or notes to investors. The cash flow from the transferred assets supports repayment of the certificates or notes. For several years, large financial institutions, and a growing number of regional and community institutions, have been using asset securitization to access alternative funding sources, manage concentrations, improve financial-performance ratios, and more efficiently meet customer needs. In many cases, the discipline imposed by investors who buy assets at their fair value has sharpened selling institutions’ credit-risk selection, underwriting, and pricing practices. Assets typically securitized by institutions include credit card receivables, automobile receivable paper, commercial and residential first mortgages, commercial loans, home-equity loans, and student loans.

While the agencies continue to view the use of securitization as an efficient means of financial intermediation, we are concerned about events and trends uncovered at recent examinations. Of particular concern are institutions that are relatively new users of securitization techniques and institutions whose senior management and directors do not have the requisite knowledge of the effect of securitization on the risk profile of the institution or are not fully aware of the accounting, legal and risk-based capital nuances of this activity. Similarly, the agencies are concerned that some institutions have not fully and accurately distinguished and measured the risks that have been transferred versus those retained, and accordingly are not adequately managing the retained portion. It is essential that institutions engaging in securitization activities have appropriate front- and back-office staffing, internal and external accounting and legal support, audit or independent review coverage, information systems capacity, and oversight mechanisms to execute, record, and administer these transactions correctly.

Additionally, we are concerned about the use of inappropriate valuation and modeling methodologies to determine the initial and ongoing value of retained interests. Accounting rules provide a method to recognize an immediate gain (or loss) on the sale through booking a “retained interest;” however, the carrying value of that interest must be fully documented, based on reasonable assumptions, and regularly analyzed for any subsequent value impairment. The best evidence of fair value is a quoted market price in an active market. In circumstances where quoted market prices are not available, accounting rules allow fair value to be estimated. This estimate must be based on the “best information available in the circumstances.”² An estimate of fair value must be supported by reasonable and current assumptions. If a best estimate of fair value is not practicable, the asset is to be recorded at zero in financial and regulatory reports.

History shows that unforeseen market events that affect the discount rate or performance of receivables supporting a retained interest can swiftly and dramatically alter its value. Without appropriate internal controls and independent oversight, an institution that securitizes assets may inappropriately generate “paper profits” or mask actual losses through flawed loss assumptions, inaccurate prepayment rates, and inappropriate discount rates. Liberal and unsubstantiated assumptions can result in material inaccuracies in financial statements, substantial write-downs of retained interests, and, if interests represent an excessive concentration of the institution’s capital, the demise of the sponsoring institution.

Recent examinations point to the need for institution managers and directors to ensure that—

The following sections provide additional guidance relating to these and other critical areas of concern. Institutions that lack effective risk-management programs or that maintain exposures in retained interests that warrant supervisory concern may be subject to more frequent supervisory review, more stringent capital requirements, or other supervisory action.

Institutions engaged in securitizations should have an independent risk-management function commensurate with the complexity and volume of their securitizations and their overall risk exposures. The risk-management function should ensure that securitization policies and operating procedures, including clearly articulated risk limits, are in place and appropriate for the institution’s circumstances. A sound asset-securitization policy should include or address, at a minimum—

It is essential that the risk-management function monitor origination, collection, and default-management practices. This includes regular evaluations of the quality of underwriting, soundness of the appraisal process, effectiveness of collections activities, ability of the default-management staff to resolve severely delinquent loans in a timely and efficient manner, and the appropriateness of loss-recognition practices. Because the securitization of assets can result in the current recognition of anticipated income, the risk-management function should pay particular attention to the types, volumes, and risks of assets being originated, transferred, and serviced. Both senior management and the risk-management staff must be alert to any pressures on line managers to originate abnormally large volumes or higher-risk assets in order to sustain ongoing income needs. Such pressures can lead to a compromise of credit-underwriting standards. This may accelerate credit losses in future periods, impair the value of retained interests, and potentially lead to funding problems.

The risk-management function should also ensure that appropriate management information systems (MIS) exist to monitor securitization activities. Reporting and documentation methods must support the initial valuation of retained interests and ongoing impairment analyses of these assets. Pool-performance information has helped well-managed institutions to ensure, on a qualitative basis, that a sufficient amount of economic capital is being held to cover the various risks inherent in securitization transactions. The absence of quality MIS hinders management’s ability to monitor specific pool performance and securitization activities more broadly. At a minimum, MIS reports should address the following.

The summary should include relevant transaction terms such as collateral type, facility amount, maturity, credit-enhancement and subordination features, financial covenants (termination events and spread-account capture “triggers”), right of repurchase, and counterparty exposures. Management should ensure that the summaries are distributed to all personnel associated with securitization activities.

Performance factors include gross portfolio yield, default rates and loss severity, delinquencies, prepayments or payments, and excess spread amounts. The reports should reflect performance of assets, both on an individual-pool basis and total managed assets. These reports should segregate specific products and different marketing campaigns.

Vintage analysis helps management understand historical performance trends and their implications for future default rates, prepayments, and delinquencies, and therefore retained interest values. Management can use these reports to compare historical performance trends to underwriting standards, including the use of a validated credit-scoring model, to ensure loan pricing is consistent with risk levels. Vintage analysis also helps in the comparison of deal performance at periodic intervals and validates retained-interest valuation assumptions.

This analysis entails reviewing monthly cash receipts relative to the principal balance of the pool to determine the cash yield on the portfolio, comparing the cash yield to the accrual yield, and tracking monthly changes. Management should compare the timing and amount of cash flows received from the trust with those projected as part of the FAS 125 retained-interest valuation analysis on a monthly basis. Some master-trust structures allow excess cash flow to be shared between series or pools. For revolving-asset trusts with this master-trust structure, management should perform a cash-collection analysis for each master-trust structure. These analyses are essential in assessing the actual performance of the portfolio in terms of default and prepayment rates. If cash receipts are less than those assumed in the original valuation of the retained interest, this analysis will provide management and the board with an early warning of possible problems with collections or extension practices and impairment of the retained interest.

Measuring the effect of changes in default rates, prepayment or payment rates, and discount rates will assist management in establishing and validating the carrying value of the retained interest. Stress tests should be performed at least quarterly. Analyses should consider potential adverse trends and determine “best,” “probable,” and “worst case” scenarios for each event. Other factors to consider are the impact of increased defaults on collections staffing, the timing of cash flows, “spread account” capture triggers, overcollateralization triggers, and early-amortization triggers. An increase in defaults can result in higher than expected costs and a delay in cash flows, decreasing the value of the retained interests. Management should periodically quantify and document the potential impact to both earnings and capital and report the results to the board of directors. Management should incorporate this analysis into their overall interest-rate risk measurement system.³ Examiners will review the analysis conducted by the institution and the volatility associated with retained interests when assessing the Sensitivity to Market Risk component rating.

Ongoing compliance with deal-performance triggers as defined by the pooling and servicing agreements should be affirmed at least monthly. Performance triggers include early amortization, spread capture, changes to overcollateralization requirements, and events that would result in servicer removal.

The method and key assumptions used to value the retained interests and servicing assets or liabilities must be reasonable and fully documented. The key assumptions in all valuation analyses include prepayment or payment rates, default rates, loss-severity factors, and discount rates. The agencies expect institutions to take a logical and conservative approach when developing securitization assumptions and capitalizing future income flows. It is important that management quantifies the assumptions on a pool-by-pool basis and maintains supporting documentation for all changes to the assumptions as part of the valuation process, which should be done no less than quarterly. Policies should define the acceptable reasons for changing assumptions and require appropriate management approval.

An exception to this pool-by-pool valuation analysis may be applied to revolving-asset trusts if the master-trust structure allows excess cash flows to be shared between series. In a master trust, each certificate of each series represents an undivided interest in all of the receivables in the trust. Therefore, valuations are appropriate at the master-trust level.

In order to determine the value of the retained interest at inception, and make appropriate adjustments going forward, the institution must implement a reasonable modeling process to comply with FAS 125. The agencies expect management to employ reasonable and conservative valuation assumptions and projections and to maintain verifiable objective documentation of the fair value of the retained interest. Senior management is responsible for ensuring the valuation model accurately reflects the cash flows according to the terms of the securitization’s structure. For example, the model should account for any cash collateral or overcollateralization triggers, trust fees, and insurance payments if appropriate. The board and management are accountable for the model builders’ possessing the necessary expertise and technical proficiency to perform the modeling process. Senior management should ensure that internal controls are in place to provide for the ongoing integrity of MIS associated with securitization activities.

As part of the modeling process, the risk-management function should ensure that periodic validations are performed in order to reduce vulnerability to model risk. Validation of the model includes testing the internal logic, ensuring empirical support for the model assumptions, and back-testing the models with actual cash flows on a pool-by-pool basis. The validation process should be documented to support conclusions. Senior management should ensure the validation process is independent from line management as well as the modeling process. The audit scope should include procedures to ensure that the modeling process and validation mechanisms are both appropriate for the institution’s circumstances and executed consistent with the institution’s asset-securitization policy.

Third parties are often engaged to provide professional guidance and support regarding an institution’s securitization activities, transactions, and valuing of retained interests. The use of outside resources does not relieve directors of their oversight responsibility, or senior management of its responsibilities to provide supervision, monitoring, and oversight of securitization activities, and the management of the risks associated with retained interests in particular. Management is expected to have the experience, knowledge, and abilities to discharge its duties and understand the nature and extent of the risks presented by retained interests and the policies and procedures necessary to implement an effective risk-management system to control such risks. Management must have a full understanding of the valuation techniques employed, including the basis and reasonableness of underlying assumptions and projections.

Effective internal controls are essential to an institution’s management of the risks associated with securitization. When properly designed and consistently enforced, a sound system of internal controls will help management safeguard the institution’s resources, ensure that financial information and reports are reliable, and comply with contractual obligations, including securitization covenants. It will also reduce the possibility of significant errors and irregularities, as well as assist in their timely detection when they do occur. Internal controls typically (1) limit authorities, (2) safeguard access to and use of records, (3) separate and rotate duties, and (4) ensure both regular and unscheduled reviews, including testing.

The agencies have established operational and managerial standards for internal control and information systems.⁴ An institution should maintain a system of internal controls appropriate to its size and the nature, scope, and risk of its activities. Institutions that are subject to the requirements of FDIC regulation 12 CFR 363 should include an assessment of the effectiveness of internal controls over their asset-securitization activities as part of management’s report on the overall effectiveness of the system of internal controls over financial reporting. This assessment implicitly includes the internal controls over financial information that is included in regulatory reports.

It is the responsibility of an institution’s board of directors to ensure that its audit staff or independent-review function is competent regarding securitization activities. The audit function should perform periodic reviews of securitization activities, including transaction testing and verification, and report all findings to the board or appropriate board committee. The audit function also may be useful to senior management in identifying and measuring risk related to securitization activities. Principal audit targets should include compliance with securitization policies, operating and accounting procedures (FAS 125), and deal covenants, and accuracy of MIS and regulatory reports. The audit function should also confirm that the institution’s regulatory-reporting process is designed and managed in such a way to facilitate timely and accurate report filing. Furthermore, when a third party services loans, the auditors should perform an independent verification of the existence of the loans to ensure balances reconcile to internal records.

The securitization and subsequent removal of assets from an institution’s balance sheet requires additional reporting as part of the regulatory reporting process. Common regulatory reporting errors stemming from securitization activities include—

An institution’s directors and senior management are responsible for the accuracy of its regulatory reports. Because of the complexities associated with securitization accounting and risk-based capital treatment, attention should be directed to ensuring that personnel who prepare these reports maintain current knowledge of reporting rules and associated interpretations. This often will require ongoing support by qualified accounting and legal personnel.

Institutions that file the Report of Condition and Income (call report) should pay particular attention to the following schedules on the call report when institutions are involved in securitization activities: Schedule RC-F, Other Assets; Schedule RC-L, Off Balance Sheet Items; and Schedule RC-R, Regulatory Capital. Institutions that file the Thrift Financial Report (TFR) should pay particular attention to the following TFR schedules: Schedule CC, Consolidated Commitments and Contingencies; Schedule CCR, Consolidated Capital Requirement; and Schedule CMR, Consolidated Maturity and Rate.

Under current regulatory-report instructions, when an institution’s supervisory agency’s interpretation of how generally accepted accounting principles (GAAP) should be applied to a specified event or transaction differs from the institution’s interpretation, the supervisory agency may require the institution to reflect the event or transaction in its regulatory reports in accordance with the agency’s interpretation and amend previously submitted reports.

Transparency through public disclosure is crucial to effective market discipline and can reinforce supervisory efforts to promote high standards in risk management. Timely and adequate information on the institution’s asset-securitization activities should be disclosed. The information contained in the disclosures should be comprehensive; however, the amount of disclosure that is appropriate will depend on the volume of securitizations and complexity of the institution. Well-informed investors, depositors, creditors, and other bank counterparties can provide a bank with strong incentives to maintain sound risk-management systems and internal controls. Adequate disclosure allows market participants to better understand the financial condition of the institution and apply market discipline, creating incentives to reduce inappropriate risk taking or inadequate risk-management practices. Examples of sound disclosures include—

For regulatory purposes, recourse is generally defined as an arrangement in which an institution retains the risk of credit loss in connection with an asset transfer, if the risk of credit loss exceeds a pro rata share of the institution’s claim on the assets.⁵ In addition to broad contractual language that may require the selling institution to support a securitization, recourse can also arise from retained interests, retained subordinated security interests, the funding of cash-collateral accounts, or other forms of credit enhancements that place an institution’s earnings and capital at risk. These enhancements should generally be aggregated to determine the extent of an institution’s support of securitized assets. Although an asset securitization qualifies for sales treatment under GAAP, the underlying assets may still be subject to regulatory risk-based capital requirements. Assets sold with recourse should generally be risk-weighted as if they had not been sold.

Securitization transactions involving recourse may be eligible for “low-level-recourse” treatment.⁶ The agencies’ risk-based capital standards provide that the dollar amount of risk-based capital required for assets transferred with recourse should not exceed the maximum dollar amount for which an institution is contractually liable. The low-level-recourse treatment applies to transactions accounted for as sales under GAAP in which an institution contractually limits its recourse exposure to less than the full risk-based capital requirements for the assets transferred. Under the low-level-recourse principle, the institution holds capital on approximately a dollar-for-dollar basis up to the amount of the aggregate credit enhancements.

Low-level-recourse transactions should be reported in Schedule RC-R of the call report or Schedule CCR of the TFR using either the “direct-reduction method” or the “gross-up method” in accordance with the regulatory-report instructions.

If an institution does not contractually limit the maximum amount of its recourse obligation, or if the amount of credit enhancement is greater than the risk-based capital requirement that would exist if the assets were not sold, the low-level-recourse treatment does not apply. Instead, the institution must hold risk-based capital against the securitized assets as if those assets had not been sold.

Finally, as noted earlier, retained interests that lack objectively verifiable support or that fail to meet the supervisory standards set for in this document will be classified as loss and disallowed as assets of the institution for regulatory capital purposes.

The creation of a retained interest (the debit) typically also results in an offsetting “gain on sale” (the credit) and thus generation of an asset. Institutions that securitize high-yielding assets with long durations may create a retained-interest asset value that exceeds the risk-based capital charge that would be in place if the institution had not sold the assets (under the existing risk-based capital guidelines, capital is not required for the amount over 8 percent of the securitized assets). Serious problems can arise for institutions that distribute contrived earnings only later to be faced with a downward valuation and charge-off of part or all of the retained interests.

As a basic example, an institution could sell $100 in subprime home-equity loans and book a retained interest of $20 using liberal “gain on sale” assumptions. Under the current capital rules, the institution is required to hold approximately $8 in capital. This $8 is the current capital requirement if the loans were never removed from the balance sheet (8 percent of $100 = $8). However, the institution is still exposed to substantially all of the credit risk, plus the additional risk to earnings and capital from the volatility of the retained interest. If the value of the retained interest decreases to $10 due to inaccurate assumptions or changes in market conditions, the $8 in capital is insufficient to cover the entire loss.

Normally, the sponsoring institution will eventually receive any excess cash flow remaining from securitizations after investor interests have been met. However, recent experience has shown that retained interests are vulnerable to sudden and sizeable write-downs that can hinder an institution’s access to the capital markets, damage its reputation in the market place, and in some cases threaten its solvency. Accordingly, the agencies expect an institution’s board of directors and management to develop and implement policies that limit the amount of retained interests that may be carried as a percentage of total equity capital, based on the results of their valuation and modeling processes. Well-constructed internal limits also serve to lessen the incentive of institution personnel to engage in activities designed to generate near-term “paper profits” that may be at the expense of the institution’s long-term financial position and reputation.

Asset securitization has proven to be an effective means for institutions to access new and diverse funding sources, manage concentrations, improve financial performance ratios, and effectively serve borrowing customers. However, securitization activities also present unique and sometimes complex risks that require board and senior management attention. Specifically, the initial and ongoing valuation of retained interests associated with securitization, and the limitation of exposure to the volatility represented by these assets, warrant immediate attention by management.

Moreover, as mentioned earlier in this statement, the agencies are studying various issues relating to securitization practices, including whether restrictions should be imposed that would limit or eliminate the amount of retained interests that qualify as regulatory capital. In the interim, the agencies will review affected institutions on a case-by-case basis and may require, in appropriate circumstances, that institutions hold additional capital commensurate with their risk exposure. In addition, the agencies will study, and issue further guidance on, institutions’ exposure to implicit-recourse obligations and the liquidity risk associated with over reliance on asset securitization as a funding source.