Annual Report of the Council of Inspectors General on Financial Oversight - July 2019

We have maintained the structural and data integrity of the original printed product

in this text file to the extent possible. Accessibility features, such as descriptions

of tables, footnotes, and the text of the Corporation’s comments, are provided but may

not exactly duplicate the presentation or format of the printed version.

The portable document format (PDF) file also posted on our Web site is an exact

electronic replica of the printed version.

[Cover page]

Council of Inspectors General on Financial Oversight

Annual Report of the Council of Inspectors General on Financial Oversight - July 2019

(CIGFO member agency seals)

[End of Cover page]

Message from the Chair

In keeping with its mission, the Council of Inspectors General on Financial Oversight

(CIGFO), which is authorized to oversee the Financial Stability Oversight Council

(FSOC) operations, continued its  work in 2018 and 2019. In its oversight role, it has,

since 2011, established working groups that are comprised of staff from the CIGFO member

Inspector General offices to conduct reviews of FSOC operations—CIGFO relies on these

working groups to fulfill its mission. CIGFO issued an audit report by a Working Group

convened in December 2017 that assessed FSOC’s monitoring of international financial

regulatory proposals and developments. CIGFO also convened the following Working Groups:

• June 2018 – initiated a project to report on management and performance challenges

identified in 2017 across CIGFO agencies. That report, Top Management and Performance

Challenges Facing Financial Regulatory Organizations, was issued in September 2018.

• December 2018 – initiated a project to survey FSOC Federal members’ efforts to support

implementation of the Cybersecurity Information Sharing Act. This project is expected to

be completed in 2019.

• March 2019 – initiated a project to report on management and performance challenges

identified in 2018 across CIGFO agencies. This project is expected to be completed in

2019.

In addition to CIGFO’s oversight activities, it has performed monitoring activities that

included sharing financial regulatory information which enhanced the Inspectors General

knowledge and insight about specific issues related to members’ current and future work.

For example, during its quarterly meetings, CIGFO members discussed efforts to increase

cybersecurity and the resiliency of the financial sector; swaps regulations, including

related reforms under the Dodd-Frank Wall Street Reform and Consumer Protection Act; and

other legislative activities that could impact the financial regulatory system.

In the coming year, CIGFO members will continue, through their individual and joint work,

to help strengthen the financial system by oversight of FSOC and its Federal member

agencies.

/s /

Rich Delmar

Acting Chair, Council of Inspectors General on Financial Oversight

Acting Inspector General, Department of the Treasury

[End of Message from the Chair]

Table of Contents

The Council of Inspectors General on Financial Oversight

Council of Inspectors General on Financial Oversight Reports

Office of Inspector General Board of Governors of the Federal Reserve

System and Bureau of Consumer Financial Protection

Office of Inspector General Commodity Futures Trading Commission

Office of Inspector General Federal Deposit Insurance Corporation

Office of Inspector General Federal Housing Finance Agency

Office of Inspector General U.S. Department of Housing and Urban

Development

Office of Inspector General National Credit Union Administration

Office of Inspector General U. S. Securities and Exchange Commission

Special Inspector General for the Troubled Asset Relief Program

Office of Inspector General Department of the Treasury

Appendix A: Top Management and Performance Challenges Facing Financial

Regulatory  Organizations

Appendix B: CIGFO Audit of the Financial Stability Oversight Council’s

Monitoring of International Financial Regulatory Proposals and

Developments

[End of Table of Contents]

[Seal Board of Governors of the Federal Reserve System, Consumer Financial Protection

Bureau]

Office of Inspector General

Board of Governors of Federal Reserve System and Bureau of Consumer Financial

Protection

The Office of Inspector General (OIG) provides independent oversight by conducting

audits, inspections, evaluations, investigations, and other reviews of the programs

and operations of the Board of Governors of the Federal Reserve System (Board) and the

Bureau of Consumer Financial Protection Bureau (Bureau) and demonstrates leadership by

making recommendations to improve economy, efficiency, and effectiveness, and by

preventing and detecting fraud, waste, and abuse.

Background

Congress established the OIG as an independent oversight authority for the Board, the

government agency component of the broader Federal Reserve System, and the Bureau.

Under the authority of the Inspector General Act of 1978, as amended (IG Act), the OIG

conducts independent and objective audits, inspections, evaluations, investigations,

and other reviews related to the programs and operations of the Board and the Bureau.

• We make recommendations to improve economy, efficiency, and effectiveness, and we

prevent and detect fraud, waste, and abuse.

• We share our findings and make corrective action recommendations to the Board and

the Bureau, but we do not have the authority to manage agency programs or implement

changes.

• We keep the Board’s Chair, the Bureau’s Director, and Congress fully informed of

our findings and corrective action recommendations, as well as the agencies’ progress

in implementing corrective action.

In addition to the duties set forth in the IG Act, Congress has mandated additional

responsibilities for the OIG. Section 38(k) of the Federal Deposit Insurance Act (FDI

Act) requires that the OIG review failed financial institutions supervised by the Board

that result in a material loss to the Deposit Insurance Fund (DIF) and produce a report

within 6 months. The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-

Frank Act) amended section 38(k) of the FDI Act by raising the materiality threshold

and requiring the OIG to report on the results of any nonmaterial losses to the DIF

that exhibit unusual circumstances warranting an in-depth review.

Section 211(f ) of the Dodd-Frank Act also requires the OIG to review the Board’s

supervision of any covered financial company that is placed into receivership under

title II of the act and produce a report that evaluates the effectiveness of the

Board’s supervision, identifies any acts or omissions by the Board that contributed

to or could have prevented the company’s receivership status, and recommends

appropriate

administrative or legislative action.

The Federal Information Security Modernization Act of 2014 (FISMA) established a

legislative mandate for ensuring the effectiveness of information security controls

over resources that support federal operations and assets. In a manner consistent

with FISMA requirements, we perform annual independent reviews of the Board’s and

the Bureau’s information security programs and practices, including the effectiveness

of security controls and techniques for selected information systems.

OIG Reports and Other Products Related to the Broader Financial Sector

In accordance with section 989E(a)(2)(B) of the Dodd-Frank Act, the following

highlights the completed and ongoing work of our office, with a focus on issues

that may apply to the broader financial sector.

Completed Work

Major Management Challenges for the Board and the Bureau

Although not required by statute, we annually report on the major management

challenges facing the Board and the Bureau. These challenges identify the areas that,

if not addressed, are most likely to hamper the Board’s and the Bureau’s accomplishment

of their strategic objectives. Among other items, we identified five major management

challenges for the Board that apply to the financial sector in 2018:

• Enhancing Organizational Governance

• Enhancing Oversight of Cybersecurity at Supervised Financial Institutions

• Ensuring an Effective Information Security Program

• Advancing Efforts to Improve Human Capital Management

• Remaining Adaptable to Internal and External Developments While Refining the

Regulatory and Supervisory Framework

Among other items, we identified three major management challenges for the Bureau that

apply to the financial sector in 2018:

• Ensuring That an Effective Information Security Program Is in Place

• Managing the Human Capital Program

• Strengthening Controls and Managing Risks

In Accordance With Applicable Guidance, Reserve Banks Rely on the Primary Federal

Regulator of the Insured Depository Institution in the Consolidated Supervision of

Regional Banking Organizations, but Document Sharing Can Be Improved, OIG Report

2018-SR-B-010, June 20, 2018

The Board is the consolidated supervisor of bank holding companies (BHCs)—entities

that own or control one or more banks. The Board delegates authority to each Reserve

Bank to supervise the BHCs in the Reserve Bank’s District. By law, the Reserve Banks

must rely to the fullest extent possible on the work of the PFR of the BHCs’

subsidiary depository institutions. We conducted this evaluation to assess the

effectiveness of the consolidated supervision of RBOs. We reviewed how Reserve Banks

rely on other federal regulators to conduct consolidated supervision of RBOs—each

with $10–$50 billion in assets.

In accordance with applicable guidance related to consolidated supervision, the

Reserve Banks relied on the respective PFR of RBOs’ insured depository institutions

to supervise the RBOs we sampled. We also noted that the Reserve Banks appear to have

increased their reliance on the PFRs.

We identified an opportunity for the Board to establish general guidelines for reliance

on PFR documents and to ensure that all examiners have access to those documents. In

addition, we found that the Board and the Reserve Banks could improve document-sharing

processes. Finally, several RBO executives noted the potentially avoidable regulatory

burden created because RBO employees sometimes upload the same documentation to multiple

systems in response to Reserve Bank and PFR documentation requests.

Our report contains recommendations designed to improve document sharing among the Board,

the Reserve Banks, and the PFRs. The Board concurred with our recommendations.

The Board’s Currency Shipment Process Is Generally Effective but Can Be Enhanced to Gain

Efficiencies and to Improve Contract Administration, OIG Report 2018-FMIC-B-021,

December 3, 2018

The Board’s Banknote Issuance and Cash Operations section is responsible for the currency

shipment process. This process includes monitoring and forecasting the demand for

currency and planning and executing the issuance of currency to Reserve Bank cash offices.

We assessed the efficiency and effectiveness of the Board’s management of the currency

shipment process and the effectiveness of related contracting activities.

The Board’s currency shipment process is generally effective; however, the process can be

enhanced to gain time and cost efficiencies. Streamlining the currency forecasting process

could save time and minimize the potential for human error. Selecting different

transportation modes for certain currency shipment routes and evaluating alternatives to

transporting shipping equipment could yield transportation cost savings.

Additionally, the Board can improve the administration of its armored carrier contracts

to help ensure that the Board is adequately protected against loss or damage during

shipments, that armored carriers are adequately protecting Board data, and that the

Board is receiving the expected level of service.

Our report contains recommendations designed to help the Board seek additional

efficiencies in the currency shipment process and to improve the administration of

armored carrier contracts. The Board concurred with our recommendations.

Knowledge Management for the Board’s Comprehensive Liquidity Analysis and Review Is

Generally Effective and Can Be Further Enhanced, OIG Report 2018-SR-B-013,

September 5, 2018

Through the CLAR program, the Federal Reserve System conducts a horizontal

supervisory assessment of liquidity risk and risk management practices across Large

Institution Supervision Coordinating Committee (LISCC) firms—the largest, most complex

financial firms under Board supervision. We assessed the System’s knowledge management

processes, practices, and systems in support of the CLAR program.

The CLAR program’s knowledge management practices generally align with many of the

leading practices described in the academic studies and Harvard Business Review articles

we reviewed related to preserving and transferring institutional knowledge. For example,

CLAR leadership has fostered a culture that prioritizes knowledge management; CLAR teams

practice regular, team-based collaboration; and the CLAR program uses an information-

sharing application to capture, store, and share institutional knowledge. As a result,

the CLAR program appears to preserve and maintain institutional knowledge related to

supervisory findings and fosters effective collaboration.

Although the CLAR program has generally effective knowledge management practices, the

practices can be further strengthened by (1) increasing CLAR program employees’ awareness

of management’s office hours, during which they can discuss the rationale for decisions

made during the CLAR letter-writing process; (2) formalizing employee onboarding

procedures; and (3) standardizing the CLAR Steering Committee’s approach to meeting

minutes.

Our report contains recommendations designed to further enhance the CLAR program’s

knowledge management

practices. The Board concurred with our recommendations.

Review of the Failure of Fayette County Bank, OIG Report 2018-SR-B-016,

September 26, 2018

In accordance with the requirements of section 38(k) of the Federal Deposit Insurance

Act, as amended by the Dodd-Frank Act, we conducted an in-depth review of the failure

of Fayette County Bank (FCB) because the failure presented unusual circumstances that

warranted an in-depth review.

FCB failed primarily because of an aggressive growth strategy coupled with ineffective

oversight by its board of directors, leading to declining asset quality and rapid

capital depletion. In addition, the bank’s board of directors was unable to hire and

retain effective management following a long-tenured Chief Executive Officer’s

retirement in December 2012.

The Federal Reserve Bank of St. Louis generally took decisive supervisory action to

address FCB’s weaknesses and deficiencies during the time frame we reviewed, 2011

through 2017, by appropriately downgrading the bank’s CAMELS composite rating

consistent with its risk profile and promptly issuing an emergency supervisory

directive. The Federal Reserve Bank of St. Louis’s supervisory activity included

formal enforcement actions and a recommendation to implement an enforcement

action against an FCB bank official.

Our review resulted in a finding related to enhanced communication between the

Board’s Legal Division and the Federal Reserve Bank of St. Louis. Because our

office has recently issued a recommendation to address that communication issue,

our report contains no new recommendations.

The Bureau Can Improve Its Follow-Up Process for Matters Requiring Attention at

Supervised Institutions, OIG Report 2019-SR-C-001, January 28, 2019

During the examination process, Division of Supervision, Enforcement and Fair

Lending (SEFL) employees may identify corrective actions that a supervised

institution needs to implement to address certain violations, deficiencies, or

weaknesses. These corrective actions include MRAs. We assessed SEFL’s

effectiveness in monitoring MRAs and ensuring that supervised institutions address

them in a timely manner.

SEFL can improve its follow-up process for MRAs. For example, we found that the

Bureau’s approach for measuring how timely it resolves MRAs is prone to

misinterpretation and therefore appeared to overstate the agency’s progress toward

closing these actions. We also determined that some of the underlying data used to

calculate the measurement were not reliable. Additionally, we observed inconsistent

MRA follow-up documentation and workpaper retention practices in certain areas.

Our report contains recommendations designed to further enhance the MRA follow-up

process. The Bureau concurred with our recommendations.

Security Control Review of the Bureau’s Mosaic System, OIG Report 2018-IT-C-012R,

June 27, 2018

Mosaic, a public-facing web application running on a cloud-based platform-as-

a-service, is used by the Bureau to manage consumer complaints related to financial

products and services. It also provides the Bureau with enhanced services and tools

related to workforce and resource management; entity boarding; and the creation and

management of investigative records, company ratings, and surveys. In accordance

with FISMA requirements, we evaluated the effectiveness of specific (1) security

controls for the Mosaic system and (2) components of the planning, development, and

delivery processes used for the system as they relate to the Bureau’s risk

management program.

Overall, we found that the security controls we tested for the Mosaic system were

operating effectively. Further, specific components of the planning, development,

and delivery processes used for the system, as they relate to the Bureau’s risk

management program, were performed effectively. For instance, we found that controls

related to continuous monitoring, vulnerability scanning and remediation, and system

and information integrity were operating effectively. Further, the Bureau developed

a business case, which included an analysis of the benefits and risks, prior to

implementing Mosaic. However, we found that the Bureau can strengthen controls in

the area of identity and access management to ensure that the security control

environment for Mosaic remains effective.

We made a recommendation in the area of identity and access management controls

for Mosaic. The Bureau concurred with our recommendation. In addition, our report

includes matters for management’s consideration in the areas of audit and

accountability, contingency planning, and configuration management.

The Bureau Can Improve Its Risk Assessment Framework for Prioritizing and

Scheduling Examination Activities, OIG Report 2019-SR-C-005, March 25, 2019

The scope of the Bureau’s financial institution oversight authorities covers

depository institutions with more than $10 billion in total assets and thousands

of nondepository institutions. The Bureau seeks to prioritize its examination

activities based on an annual assessment of the risks that the products offered by

these financial institutions present to consumers. We assessed the effectiveness

of SEFL’s risk assessment framework, including the identification, analysis,

and prioritization of specific institution product lines for examination, and we

reviewed each region’s implementation of the results of the prioritization process

through examination scheduling.

We identified opportunities for the Bureau to improve its risk assessment framework

for prioritizing and scheduling examinations. Specifically, SEFL’s approach for

assigning a key risk score to individual institution product lines is not transparent

for some Bureau employees involved in the scoring process; these employees would

benefit from additional training and guidance on that process. We also found that

SEFL can improve its preliminary research on supervised institutions. Finally, we

found that SEFL can improve the internal reporting of changes to the examination

schedule.

Our report contains recommendations designed to improve the Bureau’s risk assessment

framework for prioritizing and scheduling examination activities. The Bureau concurred

with our recommendations.

Ongoing Work

Evaluation of the Effectiveness of the Board’s Cybersecurity Supervision (Phase 2)

We identified cybersecurity oversight at supervised financial institutions as a major

management challenge for the Board on an annual basis from 2015 to 2018. In 2017, we

issued a report focused on cybersecurity supervision of multiregional data processing

servicers and financial market utilities, among other topics. We have initiated the

second phase of our cybersecurity oversight activities focused on assessing the Board’s

cybersecurity supervision of the nation’s largest and most systemically important

financial institutions—those institutions in the Board’s Large Institution Supervision

Coordinating Committee portfolio.

Audit of the Federal Reserve System’s Supervision and Oversight of Designated Financial

Market Utilities

Title VIII of the Dodd-Frank Act grants the Board the authority to supervise certain

financial market utilities designated as systemically important by the Financial

Stability Oversight Council. Title VIII also grants the Board the authority to consult

with federal agencies that supervise other designated financial market utilities. This

project will assess the Federal Reserve System’s (1) process for supervising and

overseeing designated financial market utilities and (2) processes for reviewing

notices of material change from these institutions. We also plan to review the System’s

collaboration with other federal agencies in these areas.

Evaluation of the Efficiency and Effectiveness of the Board’s and the Reserve Banks’

Enforcement Action Issuance and Termination Processes

The Board may take formal enforcement actions against supervised financial institutions

for violations of laws, rules, or regulations; unsafe or unsound practices; breaches of

fiduciary duty; and violations of final orders. The Board also may use a variety of

informal enforcement tools to address deficiencies that are relatively small in number,

are not material to the safety and soundness of the institution, and can be corrected

by the institution’s current management. We are assessing the efficiency and effectiveness

of the Board’s and the Federal Reserve Banks’ processes and practices for issuing and

terminating enforcement actions.

Evaluation of the Board’s and the Reserve Banks’ Enforcement Action Monitoring Practices

An enforcement action generally requires a supervised financial institution to develop

and implement acceptable plans, policies, and programs to remedy the deficiencies that

resulted in the action. Under delegated authority from the Board, the Federal Reserve Banks

conduct supervision activities, including monitoring institutions’ efforts to

address the terms of enforcement actions. We are assessing the effectiveness of the Board’s

and the Reserve Banks’ practices for monitoring open enforcement actions against supervised

financial institutions.

Evaluation of Postemployment Restrictions for Senior Examiners

The Intelligence Reform and Terrorism Prevention Act of 2004 prohibits specific employees

who meet the definition of a senior examiner from knowingly accepting compensation as an

employee, officer, director, or consultant from a depository institution, a depository

institution holding company, or certain related entities that the employee may have

supervised as a Reserve Bank employee. In November 2016, the Board issued new guidance on

these postemployment restrictions that expanded the definition of a senior examiner. We

are assessing the implementation of these updates across the Federal Reserve System and

the effectiveness of controls that seek to ensure compliance with postemployment

restrictions.

Evaluation of the Bureau’s Periodic Monitoring of Supervised Institutions

The Bureau has the authority to supervise depository institutions with more than $10 billion

in total assets and nondepository institutions in certain markets, including credit

reporting agencies. To supplement its onsite examinations of those institutions, the Bureau

conducts periodic offsite monitoring of all the depository institutions within its

supervisory jurisdiction and certain nondepository institutions, including credit reporting

agencies. We plan to evaluate the Division of Supervision, Enforcement and Fair Lending’s

policies and procedures for conducting periodic monitoring. This evaluation will assess the

implementation of these practices across the Bureau’s regional offices and benchmark the

Bureau’s approach to offsite monitoring activities against the monitoring activities of other

financial regulators.

Evaluation of the Bureau’s Processes for Leveraging the Federal Risk and Authorization

Management Program

The Federal Information Security Modernization Act of 2014 requires that we test the

effectiveness of the Bureau’s policies, procedures, and practices for select information

systems. In support of these requirements, we are conducting an evaluation of the Bureau’s

risk management activities with respect to its various cloud computing platforms and

providers, including the agency’s reliance on the Federal Risk and Authorization Management

Program.

Our evaluation objective is to determine whether the Bureau has implemented an effective

life cycle process for deploying and managing its cloud-based systems, including ensuring

that effective security controls are implemented.

Evaluation of the Office of Consumer Response’s Efforts to Share Complaint Data Within the

Bureau

The Office of Consumer Response (Consumer Response) is responsible for sharing

consumer complaint information with internal stakeholders in order to help the Bureau

supervise companies, enforce federal consumer financial laws, and write rules and

regulations. The effective sharing of consumer complaint information can help the Bureau

understand the problems consumers are experiencing in the financial marketplace and

identify and prevent unfair practices from occurring before they become major issues.

This evaluation is assessing the effectiveness of Consumer Response’s complaint-sharing

efforts. Specifically, this project is examining (1) the extent to which Consumer

Response’s consumer complaint-sharing efforts help to inform the work of internal

stakeholders and (2) Consumer Response’s controls over internal access of shared

complaint data, which can contain sensitive consumer information.

Evaluation of the Bureau’s Final Order Follow-Up Activities

This evaluation is assessing the Division of Supervision, Enforcement and Fair

Lending’s final order follow-up processes. The Bureau generally has enforcement

authority over any person or entity that violates federal consumer financial protection

law. In executing that authority, the Bureau can file a civil suit in federal district

court that may result in a federal court order. Alternatively, through the

administrative adjudication process, the Bureau and the relevant entity may agree to a

consent order that includes a series of required corrective actions by that entity. Our

objective is to review the Bureau’s processes for monitoring and conducting follow-up

activities related to final orders.

[Seal - Commodity Futures Trading Commission]

Office of Inspector General

Commodity Futures Trading Commission

The CFTC OIG acts as an independent Office within the CFTC that conducts audits,

investigations, reviews, inspections, and other activities designed to identify fraud,

waste and abuse in connection with CFTC programs and operations, and makes

recommendations and referrals as appropriate.

Background

The CFTC OIG was created in 1989 in accordance with the 1988 amendments to the Inspector

General Act of 1978 (P.L. 95-452). OIG was established as an independent unit to:

• Promote economy, efficiency and effectiveness in the administration of CFTC programs

and operations and detect and prevent fraud, waste and abuse in such programs and

operations;

• Conduct and supervise audits and, where necessary, investigations relating to the

administration of CFTC programs and operations;

• Review existing and proposed legislation, regulations and exchange rules and make

recommendations concerning their impact on the economy and efficiency of CFTC programs

and operations or the prevention and detection of fraud and abuse;

• Recommend policies for, and conduct, supervise, or coordinate other activities carried

out or financed by such establishment for the purpose of promoting economy and efficiency

in the administration of, or preventing and detecting fraud and abuse in, its programs and

operations; and

• Keep the Commission and Congress fully informed about any problems or deficiencies in

the administration of CFTC programs and operations and provide recommendations for

correction of these problems or deficiencies.

CFTC OIG operates independently of the Agency and has not experienced any interference

from the CFTC Chairman in connection with the conduct of any investigation, inspection,

evaluation, review, or audit, and our investigations have been pursued regardless of the

rank or party affiliation of the target.1 The CFTC OIG consists of the Inspector General,

the Deputy Inspector General/Chief Counsel, the Assistant Inspector General for Auditing,

the Assistant Inspector General for Investigations, one Attorney-Advisor, two Auditors,

one Senior Program Analyst, and one parttime consultant. The CFTC OIG obtains additional

audit, investigative, and administrative assistance through contracts and agreements.

Footnote: 1 The Inspector General Act of 1978, as amended, states: “Neither the head of

the establishment nor the officer next in rank below such head shall prevent or prohibit

the Inspector General from initiating, carrying out, or completing any audit or

investigation….” 5 U.S.C. App. 3 sec. 3(a).[End of Footnote]

Role in Financial Oversight

The CFTC OIG has no direct statutory duties related to oversight of the futures, swaps

and derivatives markets; rather, the CFTC OIG acts as an independent Office within the

CFTC that conducts audits, investigations, reviews, inspections, and other activities

designed to identify fraud, waste, and abuse in connection with CFTC programs and operations,

and makes recommendations and referrals as appropriate. The CFTC’s yearly financial statement

and Customer Protection Fund audits are conducted by an independent public accounting firm,

with OIG oversight.

Recent, Current or Ongoing Work in Financial Oversight

In addition to our work on CIGFO projects described elsewhere in this report, CFTC OIG

completed the following projects during the past year:

Inspection & Evaluation: CFTC Stress-Testing Development Efforts (July 2018)

OIG’s Office of Legal and Economic Review completed and published a report titled Inspection

& Evaluation: CFTC Stress-Testing Development Efforts. This inspection was motivated by

allegations of mismanagement in the Risk Surveillance Branch (RSB) of the CFTC Division of

Clearing and Risk (DCR), which was conveyed to us by multiple CFTC whistleblowers. We first

brought the allegations to the attention of the Chairman’s Chief of Staff in July 2017. The

Chairman appointed a new Director of DCR in September 2017, and OIG communicated frequently

with the new DCR Director beginning in October 2017. We circulated a summary memo to the

Chairman in October 2017, followed by a substantially complete version of the report in

December 2017. In January 2018, we met with the Chairman, his staff, and the Director of DCR;

they stated they had no major disagreements with the report. We finalized a discussion draft

in February 2018 and circulated it to the Commission. We accommodated the Chairman’s request

for an extended time to respond to the February 2018 discussion draft. We received no formal

written response or any stated disagreements, and circulated the report as final on July

30, 2018.

We found that leadership in the Division of Clearing and Risk (DCR)’s Risk Surveillance

Branch (RSB) retarded the development of CFTC stress-testing capabilities, undermined efforts

to improve the usability of uncleared swaps data, denied various employees access to certain

information technology resources, and overstated publicly the independence and coverage of its

November 2016 Supervisory Stress Test of Clearing Houses report (November 2016 report). To

complete our inspection and evaluation, we contracted with National Economic Research

Associates, Inc. (NERA). NERA assisted our technical evaluation of two CFTC stress-test

methodologies. NERA issued detailed analysis, including substantive criticism of the

methodology CFTC employed in the November 2016 report. No recommendations were issued by

NERA or OIG.

In our cover memo, we disclosed that, in lieu of a written response, the new DCR Director

verbally informed us that a new Deputy Director of the Risk Surveillance Branch (RSB) would

be named shortly, and this has occurred. In addition, we were told there will be a

reorganization of RSB, including greater integration of the related endeavors of margin model

review and stress-testing; that there will be greater emphasis on technical acumen,

technological development, and automation; and that there will be greater quantitative

analytical support of other business divisions within the CFTC. We understand these

processes are ongoing, and we intend to monitor the issues identified in our report and in

NERA’s report.

Customer Protection Outreach Whitepaper (September 2018)

This whitepaper examined possible locations for targeted CFTC education initiatives based

on the locations of highvolumes of complaints and enforcement filings (“hotspots”), coupled

with the locations of airport hubs and relevant state regulators.

We compared identified hotspots with recent outreach efforts by CFTC’s Office of Customer

Education and Outreach (OCEO), and concluded that OCEO’s educational outreach activities

could better align with existing hotspots, specifically in the Southern and Western United

States, where large hotspots exist that have not been visited by OCEO (or have not been

visited frequently). We noted that CFTC does not have a permanent physical presence in these

regions; CFTC’s furthermost western (and southern) presence is in Kansas City, Missouri. We

believe OCEO should target its efforts where customer education and outreach appears most

needed.

In addition, we addressed factors impacting the feasibility of increased outreach efforts

by OCEO, including: 1) Consumer Protection Funds (CPF) availability and the adequacy of

CFTC’s financial system to track and monitor expenditures; 2) CFTC’s authority to spend

CPF funds on education initiatives; and 3) CFTC’s ability to detail appropriate CFTC staff

to strengthen OCEO on a reimbursable basis. We concluded that CFTC has the current ability

to track and monitor expenditures, and agreed with the Office of General Counsel that CFTC

has the authority to spend CPF funds on education initiatives. Furthermore, we concluded

that CFTC has current funds available to further support education activities, and we

forecast -- based on our analysis of CFTC collections activity -- that funds

availability should continue.

We asked the Commission to consider –

• Establishing OCEO personnel in the CFTC Kansas City regional office;

• Opening additional CFTC field offices or establishing permanent remote OCEO employees

in the hotspots;

• Detailing personnel from other Divisions to OCEO (on a reimbursable basis from the CPF);

and

• Engaging appropriate Federal, State, and local government entities and other relevant

entities located in hotspots to facilitate customer education initiatives.

Management expressed their appreciation for our report and provided detailed comments.

Management’s comments, and our responses, are published with the whitepaper.

Inspection and Evaluation of the February 2018 CFTC-SEC Harmonization Briefing

(October 2018)

Under the Dodd-Frank Act, the CFTC and the Securities and Exchange Commission have

certain joint responsibilities.2 Our report titled Inspection and Evaluation of the

February 2018 CFTC-SEC Harmonization Briefing responded to two outside complaints that

the SEC-CFTC harmonization briefing held on February 27, 2018, might have violated the

Government in the Sunshine Act.3 Lacking a specific allegation of misconduct by any

individual, we determined to conduct an inspection and evaluation of the meeting. After

interviewing all CFTC attendees, as well as reviewing all matters voted on by the

Commission from the date of the meeting until the appointment of a full Commission, we

concluded that CFTC complied with the Government in the Sunshine Act in the conduct of

the meeting.

Footnote: 2 See, e.g., Memorandum of Understanding Between the U.S. Securities and

Exchange Commission and the U.S. Commodity Futures Trading Commission Regarding

Coordination in Areas of Common Regulatory Interest and Information Sharing, July 11,

2018. [End of footnote]

Footnote: 3 The Government in the Sunshine Act, 5 U.S.C. § 552b (1976), requires that

meetings of multi-member federal agencies shall be open to the public, with the exception

of discussions in ten narrowly defined areas. The Sunshine Act defines “meeting” as “the

deliberations of at least the number of individual agency members required to take action

on behalf of the agency where such deliberations determine or result in the joint conduct

or disposition of official agency business” [with exceptions]. Id. [End of footnote]

[Logo - Office of Inspector General, Federal Deposit Insurance Corporation]

Office of Inspector General

Federal Deposit Insurance Corporation

The FDIC OIG mission is to prevent, deter, and detect fraud, waste, abuse, and misconduct

in FDIC programs and operations; and to promote economy, efficiency, and effectiveness at

the agency.

Background

The Federal Deposit Insurance Corporation (FDIC) was created by the Congress in 1933 as

an independent agency to maintain stability in the nation’s banking system by insuring

deposits and independently regulating state-chartered, non-member banks. The FDIC insures

more than $7.5 trillion in deposits at more than 5,400 banks and savings associations, and

promotes the safety and soundness of these institutions by identifying, monitoring, and

addressing risks to which they are exposed. The FDIC is the primary federal regulator for

approximately 3,500 of the insured institutions. An equally important role for the FDIC is

as Receiver for failed institutions; the FDIC is responsible for resolving the institution

and managing and disposing of its remaining assets.

The FDIC Office of Inspector General (OIG) is an independent and objective oversight unit

established under the Inspector General (IG) Act of 1978, as amended. The FDIC OIG mission

is to prevent, deter, and detect fraud, waste, abuse, and misconduct in FDIC programs and

operations; and to promote economy, efficiency, and effectiveness at the agency.

Importantly, also in connection with matters affecting the financial sector, in February

2019, our Office published its assessment of the Top Management and Performance Challenges

Facing the FDIC. This assessment was based on our extensive oversight work and research

relating to reports by other oversight bodies, review of academic and other relevant

literature, perspectives from Government agencies and officials, and information from

private sector entities.

In addition, we conducted significant investigations into criminal and administrative

matters involving complex multi-million-dollar schemes of bank fraud, embezzlement, money

laundering, and other crimes committed by corporate executives and bank insiders. Our cases

reflect the cooperative efforts of other OIGs, U.S. Attorneys’ Offices, FDIC Divisions and

Offices, and others in the law enforcement community throughout the country. These working

partnerships contribute to ensuring the continued safety and soundness of the nation’s

banks and help ensure integrity in the FDIC’s programs and activities.

Finally, over the past year, we continued to coordinate with our financial IG counterparts

on issues of mutual interest. As a member of CIGFO, the FDIC OIG is also participating in

the joint project related to the Financial Stability Oversight Council members’ efforts to

support implementation of the Cybersecurity Information Sharing Act.

Top Management and Performance Challenges Facing the FDIC

The OIG identified the Top Management and Performance Challenges facing the FDIC and

provides its assessment to the Corporation for inclusion in the FDIC’s annual performance

and accountability report. This year, we identified nine areas representing the most

significant challenges for the FDIC, a number of which have implications to the financial

sector, and ways to improve financial oversight. The identification of these challenges

helps the FDIC and other policymakers to identify the primary risks at the agency, and

provides guidance for our Office to focus its attention and work efforts, as shown in the

following summaries of each of these challenges.

Enhancing Oversight of Banks’ Cybersecurity Risk

Cybersecurity continues to be a critical risk facing the financial sector. Cyber risks can

affect the safety and soundness of institutions and lead to the failure of banks, thus

causing losses to the FDIC’s Deposit Insurance Fund. For example, a cybersecurity incident

could disrupt services at a bank, resulting in the exploitation of personal information

in fraudulent or other illicit schemes, and an incident could start a contagion that spreads

through established interconnected banking relationships. Despite increased spending on

cybersecurity, banks are encountering difficulties in getting ahead of the increased

frequency and sophistication of cyberattacks. The FDIC’s IT examinations should ensure

strong management practices within financial institutions and at their service providers.

Adapting to Financial Technology Innovation

FDIC policy-makers and examiners must keep pace with the adoption of new financial

technology to assess safety and soundness of institutions and its impact on the stability

of the banking system. The pace of change and breadth of innovation requires that the

FDIC create agile and nimble regulatory processes, so that it can respond to and adjust

policies, examination processes, supervisory strategies, preparedness and readiness,

and resolution approaches as needed.

Strengthening FDIC Information Security Management

The FDIC maintains thousands of terabytes of sensitive data within its IT systems and has

more than 180 IT systems that collect, store, or process the PII of FDIC employees; bank

officials at FDIC-supervised institutions; and bank customers, depositors, and bank

officials associated with failed banks. FDIC systems also hold sensitive supervisory

data about the financial health of banks, bank resolution strategies, and resolution

activities. The FDIC must continue to strengthen its implementation of governance and

security controls around its IT systems to ensure that information is safeguarded

properly.

Preparing for Crises

Central to the FDIC’s mission is readiness to address crises in the banking system.

The FDIC must be prepared for a broad range of crises that could impact the banking

sector. These readiness activities should help to ensure the safety and soundness of

institutions, as well as the stability and integrity of our nation’s banking system.

Maturing Enterprise Risk Management

Enterprise Risk Management (ERM) is a critical part of an agency’s governance, as it

can inform prudent decisionmaking at an agency, including strategic planning, budget

formulation, and capital investment. ERM program requirements include identifying

risks that could affect the organization (Risk Profile and Inventory), establishing the

amount of risk an organization is willing to accept (Risk Appetite), prioritizing

strategies to address risks in the proper sequence, and responding to and mitigating

the risks. The FDIC established an ERM program office in 2011, but has neither developed

the underlying ERM program requirements nor realized the benefits of a mature ERM program.

Sharing Threat Information with Banks and Examiners

Federal Government agencies and private-sector entities share information about threats

to U.S. critical infrastructure sectors, including the financial sector. Sharing

actionable and relevant threat information among Federal and privatesector participants

protects the financial system by building threat awareness and allowing for informed

decision-making.The FDIC must ensure that relevant threat information is shared with its

supervised institutions and FDIC examiners as needed, in a timely manner, so that actions

can be taken to address the threats. Threat information also provides FDIC examiners with

context to evaluate banks’ processes for risk identification and mitigation strategies.

Managing Human Capital

The FDIC relies on skilled personnel to fulfill its mission, and 68 percent of the FDIC’s

operating budget for 2019 ($1.8 billion) was for salaries and associated benefits for

employees. Forty-two percent of FDIC employees are eligible to retire within 5 years, which

may lead to knowledge and leadership gaps. To ensure mission readiness, the FDIC should

find ways to manage this impending shortfall. In addition, the FDIC should seek to hire

individuals with the advanced technical skills needed for IT examinations and supervision

of large and complex banks.

Administering the Acquisitions Process

The FDIC relies heavily on contractors for support of its mission, especially for IT and

administrative support services. The average annual expenditure by the FDIC for contractor

services over the past 5 years has been approximately $587 million. The FDIC should maintain

effective controls to ensure proper oversight and management of such contracts and should

conduct regular reviews of contractors. In addition, the FDIC should also perform due

diligence to mitigate security risks associated with supply chains for goods and services.

Improving Measurement of Regulatory Costs and Benefits

Before issuing a rule, the FDIC should ensure that the benefits accrued from a regulation

justify the costs imposed. The FDIC should establish a sound mechanism to measure both costs

and benefits at the time of promulgation, and it should continue to evaluate the costs and

benefits of a regulation on a regular basis, even after it has been issued. Additional

information on these Challenges can be found in the full Top Management and Performance

Challenges report, available on our Website, www.fdicoig.gov. These Challenges align with

those facing the financial regulatory community as a whole, as discussed in the CIGFO report

entitled Top Management and Performance Challenges Facing Financial Regulators.

FDIC OIG Audits and Evaluations Made Significant Recommendations for

Improvements to the FDIC

During the 12-month period ending March 31, 2019, the FDIC OIG issued 14 audit, evaluation,

and other reports and made 53 recommendations to strengthen controls in FDIC programs and

operations. Our work covered diverse topics such as information security, processing of

consumer complaints, and the FDIC’s Forward-Looking Supervision program, among others.

The FDIC’s Forward-Looking Supervision Program

The goals of the FDIC’s Forward-Looking Supervision initiative are to identify and assess

risk before it impacts a financial institution’s financial condition and to ensure early

risk mitigation. Prior to the financial crisis of 2008-2011, examiners often identified weak

risk management practices at financial institutions, but they delayed taking supervisory

action until the institution’s financial performance declined. Forward-Looking Supervision

seeks to avoid this result.

Our evaluation objective was to determine whether the Forward- Looking Supervision

approach achieved its outcomes—the Division of Risk Management Supervision pursued

supervisory action upon identifying risks and the financial institutions implemented

corrective measures. Our review showed that examiners substantially achieved the

intended outcomes of the Forward-Looking Supervision approach for our sampled

institutions. Examiners applied Forward-Looking Supervision concepts during their

financial institution examinations, rated institutions based on risk,

and recommended corrective actions based on their risk assessments. Also, the

financial institutions committed to implement the corrective actions.

We found that:

• The FDIC did not have a comprehensive policy guidance document on Forward-Looking

Supervision and should clarify guidance associated with its purpose, goals, roles,

and responsibilities;

• Examiners typically documented their overall conclusions regarding the financial

institutions’ concentration risk management practices; however, they did not always

document certain Forward-Looking Supervision concepts in pre-examination planning

documents and when reporting examination results;

• Examiners typically reported or elevated identified overall concentration risk

management conclusions and concerns; however, a greater number of these concerns

should have appeared in the report section that includes issues requiring the

attention of the institution’s board; and

• Examiners generally identified concentration risk management concerns on a timely

basis; however, in certain instances, they identified concentration risk management

concerns that had not been identified during the prior examination cycle.

We made four recommendations to the FDIC to: (1) issue a comprehensive policy

guidance document defining Forward-Looking Supervision; (2) issue guidance to

reinforce how and where examiners should be documenting concentrations and an

institution’s concentration risk management practices in the Report of Examination;

(3) provide additional case studies on Forward-Looking Supervision to strengthen

training for examiners; and (4) conduct recurring retrospective reviews to ensure

examiners are documenting the concentration risk management analysis.

The full report is available on our Website, www.fdicoig.gov.

Federal Information Security Modernization Act (FISMA) Audit – 2018

We evaluated the effectiveness of the FDIC’s information security program and

practices. A strong information security program is needed for the protection of

sensitive information the FDIC collects in conducting is work, including sensitive

bank data and personal information of borrowers. The IG FISMA Reporting Metrics

require IGs to assess the effectiveness of their agencies’ information security

programs and practices on a maturity model spectrum. We found that the FDIC’s

overall information security program was operating at a Maturity Level 3

(Consistently Implemented) on a scale of 1 to 5, which is an improvement from

2017 but not considered effective under the metrics.

We found that the FDIC established a number of information security program

controls and practices that complied or were consistent with standards and

guidelines, and took steps to strengthen controls following the 2017 FISMA

report. However, ongoing security control weaknesses limited the effectiveness

of the FDIC’s information security program and practices and placed the

confidentiality, integrity, and availability of the FDIC’s information systems

and data at risk. In many cases, these security control weaknesses were

identified by other OIG audits or through security control assessments completed

by the FDIC. Although the FDIC was working to address these previously identified

control weaknesses, the FDIC had not yet completed corrective actions at the time

of the audit. Accordingly, the security control weaknesses continued to pose risk

to the FDIC. The highest risk weaknesses included:

• Information Security Risk Management. The FDIC had not fully defined or

implemented an enterprise-wide and integrated approach to identifying, assessing,

and addressing the full spectrum of internal and external risks, including those

related to cybersecurity and the operation of information systems. This limits

the ability of FDIC Divisions and Offices to make effective risk management

decisions, and prevents the FDIC from ensuring it is effectively prioritizing

resources toward addressing risks with the most significant potential impact on

achieving strategic objectives.

• Enterprise Security Architecture. Our 2017 FISMA audit noted that the FDIC had

not established an enterprise security architecture, which is considered a

fundamental component of an effective information security program and describes

the structure and behavior of an organization’s security processes, systems,

personnel, and subunits and shows their alignment with the organization’s mission

and strategic plans. In July 2018, the FDIC provided the OIG with documentation

describing its enterprise security architecture. The OIG is reviewing this

documentation, along with other information related to the enterprise security

architecture provided by the FDIC, to determine whether it is responsive to the

recommendation in our FISMA audit report issued in 2017. The lack of effective

enterprise security architecture increased the risk that the FDIC’s information

systems would be developed with inconsistent security controls that are costly to

maintain.

• Security Control Assessments. In separate OIG audit work, we identified instances

in which contractorperformed security control assessments did not include testing

of security control implementation, when warranted. Instead, assessors relied on

narrative descriptions of the controls in FDIC policies, procedures, and system

security plans and/or interviews of FDIC or contractor personnel. Without testing,

assessors did not have a basis for concluding on the effectiveness of security

controls. Inadequate FDIC oversight of security control assessments contributed to

this weakness. Because the FDIC relies on the results of the assessments

to support a number of important risk management activities, the FDIC must ensure

that personnel perform security control assessments at an appropriate level of

depth and coverage.

• Patch Management. The FDIC’s patch management processes were not always

effective in ensuring that the FDIC implemented patches within FDIC-defined

timeframes. Unpatched systems increase the risk of exposing the FDIC’s network

to a security incident.

• Backup and Recovery. Our 2017 FISMA report noted that the FDIC’s IT restoration

capabilities were limited and that the FDIC had not taken timely action to address

known limitations with respect to its ability to maintain or restore critical IT

systems and applications during a disaster. In December 2017, the FDIC’s Board of

Directors authorized a multi-year Backup Data Center Migration Project to ensure

that designated IT systems and applications supporting mission-essential functions

can be recovered within targeted timeframes. While the FDIC established governance

over this project, assurance that the FDIC can maintain and restore mission-

essential functions during an emergency within applicable timeframes will be

limited until the scheduled completion of the project in 2019.

We made four recommendations to improve the effectiveness of the FDIC’s information

security program controls and practices.

The publicly-releasable Executive Summary of this report is available on our Website,

www.fdicoig.gov.

Our ongoing audit and evaluation reviews are addressing the FDIC’s:

• Enterprise Risk Management Program;

• Cost-Benefit Analysis Process for Rulemaking;

• Anti-Sexual Harassment Program;

• Readiness for Crises;

• Contract Oversight Management Program; and

• Privacy Program.

These ongoing reviews are also listed on our Website, www.fdicoig.gov, and, when

completed, their results will be posted there.

FDIC OIG Special Inquiry Report Made Significant Recommendations Regarding Breach

Response, Reporting, and Interactions with Congress

In addition to the audit and evaluation reports listed above, the OIG issued a multi-

disciplinary Special Inquiry report in April 2018.

During late 2015 and early 2016, the FDIC experienced eight information security

incidents as departing employees improperly took sensitive information shortly before

leaving the FDIC. Seven of the eight incidents involved Personally Identifiable

Information (PII), including Social Security Numbers, and thus constituted breaches.

In the eighth incident, the departing employee took highly sensitive components of

resolution plans submitted by certain large systemically important financial

institutions without authorization.

In April and May 2016, the Committee on Science, Space, and Technology of the House

of Representatives (SST Committee) examined the FDIC’s handling of these incidents,

its data security policies, and reporting of the “major incidents.” As part of its

investigation, the SST Committee requested pertinent documents from the FDIC about the

incidents. The SST Committee held two hearings in May and July 2016 about the incidents

at the FDIC and issued an interim report on the matter. During the hearings and in its

interim report, as well in correspondence with the FDIC, the SST Committee expressed

concerns about the FDIC’s information security program, the accuracy of certain FDIC

statements, and the completeness of the FDIC’s document productions.

On June 28, 2016, the then-Chairman of the Senate Committee on Banking, Housing, and

Urban Affairs requested that our Office examine issues at the FDIC related to data

security, incident reporting, and policies, as well as the representations made by

FDIC officials.

The FDIC OIG conducted a Special Inquiry in response to that request. We examined the

circumstances surrounding the eight information security incidents. The FDIC initially

estimated that the incidents involved sensitive information that included the PII of

approximately 200,000 individual bank customers related to approximately 380 financial

institutions, as well as the proprietary and sensitive data of financial institutions.

Based on additional analysis, the FDIC later revised the number of affected individuals

to 121,633.

Our work revealed certain systemic weaknesses that hindered the FDIC’s ability to

handle multiple information security incidents and breaches efficiently and effectively;

contributed to untimely, inaccurate, and imprecise reporting of information to the

Congress; and led to document productions that did not fully comply with Congressional

document requests. We also identified shortcomings in the performance of certain

individuals in key leadership positions as they handled the incidents and related

activities.

Importantly, in its handling of the information security incidents, the FDIC did not

fully consider the range of impacts on bank customers whose information had been

compromised or consider customer notification as a separate decision from whether it

would provide credit monitoring services. As a result, the FDIC delayed notifying

consumers and thus precluded them from taking proactive steps to protect themselves.

Also of note, when reporting incidents to the Congress, the FDIC used broad

characterizations and referenced mitigating factors that were sometimes inaccurate and

imprecise, and tended to diminish the potential risks. Despite several opportunities

to clarify or correct the record regarding the nature of the incidents, the FDIC did

not provide the Congress with accurate and complete information about the incidents.

Finally, with regard to document production, the SST Committee had requested that the

FDIC produce relevant documents and information. The FDIC did not initially respond to

these requests in a complete manner and should have been clear in its communications

with the Committee as to its approach and progress in complying with the document

production requests. Later, the FDIC took steps to better identify and provide

responsive records.

Throughout and subsequent to our Special Inquiry, the FDIC took steps to address prior

recommendations pertaining to incident and breach response. In addition, we made 13

recommendations in this Special Inquiry report to address the systemic issues

associated with the FDIC’s incident response and reporting and interactions with the

Congress.

FDIC OIG Investigations Seek to Ensure Integrity in the Banking Sector

OIG investigations over the past months continued to complement our audit and

evaluation work. Our investigative results over the 12 months ending March 31, 2019,

included the following: 64 indictments; 35 arrests; 43 convictions; and potential

monetary recoveries (fines, restitution, and asset forfeitures) of over $354 million.

Our current cases involve fraud and other misconduct on the part of senior bank

officials, and include money laundering, embezzlement, bank fraud, and other

financial crimes. The perpetrators of such crimes can be those very individuals

entrusted with governance responsibilities at the institutions—directors and bank

officers. In other cases, parties providing professional services to the banks and

customers, others working inside the bank, and customers themselves are principals

in fraudulent schemes. The FDIC OIG also investigates significant matters of

wrongdoing and misconduct relating to FDIC employees and contractors.

Our Office is committed to partnerships with other OIGs, the Department of Justice

(DOJ), and other state and local law enforcement agencies in pursuing criminal acts

in open and closed banks and helping to deter fraud, waste, and abuse. The OIG also

actively participates in many financial fraud working groups nation-wide to keep

current with new threats and fraudulent schemes that can undermine the integrity of

the FDIC’s operations and the financial services industry as a whole.

The FDIC OIG’s Office of Investigations also continues to identify emerging financial

fraud schemes that affect FDICsupervised and insured institutions. Our relationships

with DOJ’s Money Laundering and Asset Recovery Section, and DOJ’s Fraud Section and

Anti-Trust Division, have allowed us to play a lead role in money laundering and

foreign currency exchange rate manipulation investigations. We also work with other

agencies, including the Small Business Administration, to identify fraud in the

guaranteed loan portfolios of FDIC-supervised institutions. These investigations

are important, as large-scale fraud schemes can significantly affect the financial

industry and the financial condition of FDIC-insured institutions.

Former Senior Employee at FDIC Convicted of Stealing Confidential Documents

On December 11, 2018, a former senior employee in the FDIC’s Office of Complex

Financial Institutions (OCFI) was convicted of two thefts of government property in

the possession of the FDIC. OCFI was created after passage of the Dodd-Frank Wall

Street Reform and Consumer Protection Act to oversee and conduct, if necessary, an

orderly bankruptcy of the world’s largest banks and financial institutions. Each of

these banks and financial institutions is required to file resolution plans, referred

to as “living wills,” with the FDIC. The plans contain confidential information

about the bank, including its assets, business operations, data center locations,

critical vendors, agreements with other banks, and potential weaknesses or other

deficiencies that pose risk during a time of financial crisis.

In August 2015, the then-FDIC employee used her office computer to review listings for

and apply for jobs with financial institutions that filed living wills with the FDIC.

On August 27, 2015, one day after being contacted about a possible position at one of

the banks, she logged on to a secure FDIC database and printed living will information

for that bank. On September 16, 2015, she resigned her position at the FDIC. A review

of FDIC Data Loss Prevention software revealed that on her last day of work, the then-

FDIC employee copied numerous electronic files from the FDIC network to external USB

drives, including living wills for U.S. banks where she had been seeking employment.

Former Bank President Sentenced to Prison and Ordered to Pay $137 Million

On December 14, 2018, the former president and CEO of The Bank of Union in El Reno,

Oklahoma, was sentenced to 4 years in federal prison followed by 2 years of supervised

release for making a false statement to the FDIC. He had previously pled guilty to this

charge in 2017. The sentence requires the former president to pay over $137 million in

restitution, over $97 million of which is owed to the FDIC.

State banking regulators closed The Bank of Union in 2014 because of the bank’s loan

losses, and the FDIC was appointed as receiver. According to a 2016 indictment, the

former president defrauded the bank in several ways: (1) by issuing loans with

insufficient collateral and falsifying financial statements for several high-dollar bank

borrowers; (2) by originating nominee loans to circumvent the bank’s legal lending limit;

(3) by concealing the bank’s true financial condition from the Board of Directors; (4)

by soliciting a fraudulent investment; and (5) by falsely representing the bank’s true

status to the FDIC.

Over a 4-year period, the former president conspired with borrowers by issuing them

millions of dollars in loans secured by collateral they did not have and issuing them new

loans to keep them off of overdraft reports. The former president misled the Board of

Directors by falsely stating the borrowers were paying down their loans. The former

president also defrauded a partial owner and investor in the bank by convincing him to

wire nearly $40 million. The former president falsely represented to the investor that

the bank was growing rapidly and performing well and that his investment would not be at

risk, despite knowing that the bank was on the brink of failure and needed an immediate

capital infusion.

Finally, the former president was charged with falsely representing the bank’s loan

status to the FDIC. Between September 2012 and September 2013, he continued to renew

certain unpaid loans by capitalizing unpaid interest. Pursuant to a 2013 FDIC examination,

he allegedly falsely represented that he had not renewed or extended any loans without

full collection of the interest due during that time period. He also falsely represented

in writing that the bank had total equity capital of more than $36 million in July 2013,

when he knew the bank’s equity capital was significantly less.

The partial owner who wired money for the bank’s benefit is due $40 million of the

restitution amount, and the remaining $97 million is due to the FDIC, which lost money

when it assumed the bank’s liabilities as receiver in January 2014.

South Florida Resident Convicted of $100 Million International Fraud Scheme that Led

to Collapse of One of Puerto Rico’s Largest Banks

On February 4, 2019, the former chairman and CEO of a pharmaceutical company was

convicted of eight counts of wire fraud affecting a financial institution after a three-

week trial in the Southern District of Florida. The former CEO’s scheme triggered a series

of events leading to the insolvency and collapse of Westernbank of Puerto Rico.

According to evidence presented at trial, from 2005 to 2007, the individual served as

chairman and CEO of Inyx, Inc., a publicly-traded multinational pharmaceutical

manufacturing company. Beginning in early 2005, the then-CEO caused Westernbank to enter

into a series of loan agreements in exchange for a security interest in Inyx’s assets.

Under the loan agreements, Westernbank agreed to advance money based on Inyx’s customer

invoices from “actual and bona fide” sales.

However, the then-CEO orchestrated a scheme to defraud Westernbank by causing numerous

Inyx employees to make tens of millions of dollars’ worth of fake customer invoices

purportedly payable by customers in the United Kingdom, Sweden, and elsewhere. The then-

CEO caused these invoices to be presented to Westernbank as valid invoices and made false

representations to Westernbank about purported repayments from lenders in order to lull

Westernbank into continuing to lend money to Inyx. He also fraudulently represented to

Westernbank executives that he had additional collateral, including purported mines in

Mexico and Canada worth hundreds of millions of dollars, to induce Westernbank to lend

additional funds.

The then-CEO caused Westernbank to lend approximately $142 million and diverted tens of

millions of dollars for his own personal benefit, including to buy a private jet, luxury

homes and cars, luxury hotel stays, and extravagant jewelry and clothing expenditures.

In or around June 2007, Westernbank declared the loan in default and ultimately suffered

losses exceeding $100 million. These losses later triggered a series of events leading to

Westernbank’s insolvency and ultimate collapse. At the time of its collapse, Westernbank

had approximately 1,500 employees and was one of the largest banks in Puerto Rico.

In addition, the then-CEO knowingly deposited a $3 million check at Mellon Bank from the

purported sale of his private jet. At the time of its deposit, he knew that the check was

worthless; he had actually agreed to sell his plane to a different buyer. After receiving

a provisional credit for the check from Mellon Bank, the then-CEO wired out all of the

provisional credit, including a $1 million wire to his personal account in Canada. Upon

Mellon Bank’s request to reverse this $1 million wire, he refused to do so, resulting in

at least a $1 million loss to Mellon Bank.

[Seal - Federal Housing Finance Agency]

Office of Inspector General

Federal Housing Finance Agency

Created by the Housing and Economic Recovery Act of 2008 (HERA), the Federal Housing

Finance Agency (FHFA or Agency) supervises and regulates (1) the Federal National

Mortgage Association (Fannie Mae) and the Federal Home Loan Mortgage Corporation (Freddie

Mac) (together, the Enterprises), (2) the Federal Home Loan Banks (FHLBanks) (collectively,

the regulated entities), and (3) the FHLBanks’ fiscal agent, the Office of Finance. Since

September 2008, FHFA has also served as conservator for the Enterprises. As of year-end

2018, the Enterprises collectively reported approximately $5.4 trillion in assets. The

FHLBanks collectively reported roughly $1.1 trillion in assets.

Also created by HERA, the FHFA Office of Inspector General (OIG) conducts, supervises, and

coordinates audits, evaluations, investigations, and other activities relating to the

programs and operations of FHFA. OIG promotes economy, efficiency, and effectiveness and

protects FHFA and the entities it regulates against fraud, waste, and abuse, contributing

to the liquidity and stability of the nation’s housing finance system. We accomplish this

mission by providing independent, relevant, timely, and transparent oversight of the Agency

to promote accountability, integrity, economy, and efficiency; advising the Director of the

Agency and Congress; informing the public; and engaging in robust enforcement efforts to

protect the interests of American taxpayers.

Background

FHFA serves as supervisor of the Enterprises and the FHLBanks, and as conservator of the

Enterprises. FHFA’s conservatorships of the Enterprises, now in their 11th year, are of

unprecedented scope, scale, and complexity. FHFA’s dual roles continue to present novel

challenges. Consequently, OIG must structure its oversight program to examine FHFA’s

exercise of its dual responsibilities, which differ significantly from the typical

federal financial regulator. Beginning in Fall 2014, OIG determined to focus its resources

on programs and operations that pose the greatest financial, governance, and/or

reputational risk to the Agency, the Enterprises, and the FHLBanks to best leverage its

resources to strengthen oversight.

Our annual Audit, Evaluation, and Compliance Plan describes FHFA’s and OIG’s roles and

missions, explains our riskbased methodology for developing this plan, provides insight

into particular risks within four areas, and generally discusses areas where we will focus

our audit, evaluation, and compliance resources. In addition to our risk-based work plan,

OIG completes work required to fulfill its statutory mandates.

An integral part of OIG’s oversight is to identify and assess FHFA’s top management and

performance challenges and to align our work with these challenges. On an annual basis,

we assess FHFA’s major management and performance challenges. In October 2018, we

identified four challenges (all of which carried over from prior years) and a

management concern. In our view, these are the most serious management and performance

challenges facing FHFA for the foreseeable future and, if not addressed, could adversely

affect FHFA’s accomplishment of its mission. (See OIG, Fiscal Year 2019 Management and

Performance Challenges (October 15, 2018)). During this reporting period, OIG continued

to focus much of its oversight activities on identifying vulnerabilities in these areas

and recommending positive, meaningful actions that the Agency could take to mitigate

these risks and remediate identified deficiencies.

These challenges and the management concern are:

Supervision of the Regulated Entities – Upgrade Supervision of the Enterprises and

Continue Robust Supervision of the FHLBanks

As supervisor of the Enterprises and the FHLBanks, FHFA is tasked by statute to ensure

that these entities operate safely and soundly so that they serve as a reliable source

of liquidity and funding for housing finance and community investment. Examinations of

its regulated entities are fundamental to FHFA’s supervisory mission. Within FHFA, the

Division of Federal Home Loan Bank Regulation (DBR) is responsible for supervision of

the FHLBanks, and the Division of Enterprise Regulation (DER) is responsible for

supervision of the Enterprises.

As a former FHFA Director observed, Fannie Mae and Freddie Mac would be Systemically

Important Financial Institutions (SIFIs), but for the conservatorships, and are subject

to the heightened supervision requirements for SIFIs, except that they are supervised

by FHFA, not the Federal Reserve. Because the asset size of the FHLBanks and Office of

Finance, together, is a fraction of the asset size of the Enterprises and because the

Enterprises are in conservatorship, we determined that the magnitude of risk is

significantly greater for the Enterprises. Since the Fall of 2014, the majority of our

work on supervision issues has focused on FHFA’s supervision of the Enterprises.

Based on our assessments of different elements of DER’s supervision program, over the

past few years, we identified four recurring themes, which were explained in a roll-up

report issued during FY 2017.4 Those themes are:

1. FHFA lacks adequate assurance that DER’s supervisory resources are devoted to

examining the highest risks of the Enterprises.

2. Many supervisory standards and guidance issued by FHFA and DER lack the rigor of

those issued by other federal financial regulators.

3. The flexible and less prescriptive nature of many requirements and guidance

promulgated by FHFA and DER has resulted in inconsistent supervisory practices.

4. Where clear requirements and guidance for specific elements of DER’s supervisory

program exist, DER examiners-in-charge and subordinate examiners have not consistently

followed them.

In that roll-up report, we cautioned that “[w]ithout prompt and robust Agency attention

to address the shortcomings we have identified,” the “safe and sound operation of the

Enterprises cannot be assumed from FHFA’s current supervisory program.” The findings

from subsequent audits, evaluations, and compliance reports regarding FHFA’s

supervision program for the Enterprises identified additional shortcomings. In light

of the observation that the Enterprises would be SIFIs, but for the conservatorships,

FHFA must make a heightened and sustained effort to improve its supervision of the

Enterprises.

We also looked at elements of FHFA’s supervision program for the FHLBanks. While our

reports of that work identified some shortcomings, they did not identify significant

weaknesses. Like any other federal financial regulator, FHFA faces challenges in

appropriately tailoring and keeping current its supervisory approach to the FHLBanks.

Conservatorship Operations – Improve Oversight of Matters Delegated to the Enterprises

and Strengthen Internal Review Processes for Non-Delegated Matters

As conservator of the Enterprises since September 2008, FHFA has expansive authority

to oversee and direct operations of two large, complex financial institutions that

dominate the secondary mortgage market and the mortgage securitization sector of the

U.S. housing finance industry. Under HERA, FHFA, as conservator, possesses all rights

and powers of any stockholder, officer, or director of the Enterprises and is vested

with express authority to operate the Enterprises and conduct their business

activities. Given the taxpayers’ enormous investment in the Enterprises, the unknown

duration of the conservatorships, the Enterprises’ critical role in the secondary

mortgage market, and their uncertain ability to sustain future profitability, FHFA’s

administration of the conservatorships remains a major risk.

Footnote: 4 See OIG, Safe and Sound Operation of the Enterprises Cannot Be Assumed

Because of Significant Shortcomings in FHFA’s Supervision Program for the Enterprises

(OIG-2017-003, Dec. 15, 2016). [End of footnote]

FHFA has delegated authority for many matters, both large and small, to the

Enterprises. FHFA, as conservator, can revoke delegated authority at any time (and

retains authority for certain significant decisions).

Since the Fall of 2014, OIG’s body of work has found that FHFA has limited its

oversight of delegated matters largely to attendance at Enterprise internal

management and board meetings as an observer and to discussions with Enterprise

managers and directors. Read together, our findings in these reports show that,

for the most part, FHFA, as conservator, has not assessed the reasonableness of

Enterprise actions pursuant to delegated authority, including actions taken by the

Enterprises to implement conservatorship directives, or the adequacy of director

oversight of management actions. FHFA also has not clearly defined the Agency’s

expectations of the Enterprises for delegated matters and has not established the

accountability standard that it expects the Enterprises to meet for such matters.

Our work has identified internal control systems at the Enterprises that fail to

provide directors with accurate, timely, and sufficient information to enable them

to exercise their oversight duties. Likewise, we have identified a lack of rigor

by some directors in seeking information from management about the matters for

which they are responsible. We have also identified instances in which corporate

governance decisions generally reserved to the board of directors

have been delegated to management.

As the Enterprises’ conservator, FHFA is ultimately responsible for actions taken

by the Enterprises, pursuant to authority it has delegated to them. FHFA’s

challenge, therefore, is to improve the quality of its oversight of matters it

has delegated to the Enterprises.

Generally, FHFA has retained authority (or has revoked previously delegated

authority) to resolve issues of significant monetary and/or reputational value.

FHFA has established written internal review and approval processes for non-

delegated matters, designed to provide a consistent approach for analyzing and

resolving such matters and for providing decision-makers with all relevant facts

and existing analyses. FHFA faces challenges in ensuring that its established

processes are followed.

Information Technology Security – Enhance Oversight of Cybersecurity at the

Regulated Entities and Ensure an Effective Information Security Program at FHFA

Cybersecurity, as defined by the National Institute of Standards and Technology

(NIST), is the process of protecting information by preventing, detecting, and

responding to attacks. In May 2017, President Trump issued an executive order to

strengthen the cybersecurity of federal networks and critical infrastructure.

The Financial Stability Oversight Council (FSOC) has identified cybersecurity

oversight as an emerging threat for increased regulatory attention. The Council

reported that cybersecurity-related incidents create significant operational

risk, impacting critical services in the financial system, and ultimately

affecting financial stability and economic health.

As cyberthreats and attacks at financial institutions increase in number and

sophistication, FHFA faces challenges in designing and implementing its

supervisory activities for the financial institutions it supervises. These

supervisory activities may be made increasingly difficult by FHFA’s continuing

need to attract and retain highly-qualified technical personnel, with expertise

and experience sufficient to handle rapid developments in technology.

Computer networks maintained by federal government agencies have proven to be a

tempting target for disgruntled employees, hackers, and other intruders. Over

the past few years, cyber attacks against federal agencies have increased in

frequency and severity. As cyber attacks continue to evolve and become more

sophisticated and harder to detect, they pose an ongoing challenge for virtually

every federal agency to fortify and safeguard its internal systems and operations.

As conservator of and supervisor for the Enterprises and supervisor for the

FHLBanks, FHFA collects and manages sensitive information, including personally

identifiable information (PII), that it must safeguard from unauthorized access

or disclosure. Equally important is the protection of its computer network

operations that are part of the nation’s critical financial infrastructure. FHFA,

like other federal agencies, faces challenges in enhancing its information

security programs, ensuring that its internal and external online collaborative

environments are restricted to those with a need to know, and ensuring that its

third-party providers meet information security program requirements.

Counterparties and Third Parties – Enhance Oversight of the Enterprises’

Relationships with Counterparties and Third Parties

The Enterprises rely heavily on counterparties and third parties for a wide array

of professional services, including mortgage origination and servicing. That

reliance exposes the Enterprises to counterparty risk, including the risk that

the counterparty will not meet its contractual obligations, and the risk that a

counterparty will engage in fraudulent conduct. FHFA has delegated to the

Enterprises the management of their relationships with counterparties and

reviews that management largely through its supervisory activities.

Our publicly reportable criminal investigations include inquiries into alleged

fraud by different types of counterparties, including real estate brokers and

agents, builders and developers, loan officers and mortgage brokers, and title

and escrow companies.

In light of the financial, governance, and reputational risks arising from the

Enterprises’ relationships with counterparties and third parties, FHFA is

challenged to effectively oversee the Enterprises’ management of risks related

to their counterparties.

Management Concern: Sustain and Strengthen Internal Controls Over Agency and

Enterprise Operations FHFA’s programs and operations are subject to legal and

policy requirements common to federal agencies. Satisfying such requirements

necessitates the development and implementation of, and compliance with,

effective internal controls within the Agency.

In January 2019, there was a leadership change with the appointment of an

acting FHFA Director, while the Senate considered the President’s nominee for

the next FHFA Director (who was subsequently confirmed and took office in April

2019). Key senior positions within FHFA have been filled on an acting capacity

for a long period of time (e.g., Chief Operating Officer and, until recently,

the Deputy Director of the Division of Conservatorship). Our work demonstrates

that FHFA is challenged to ensure that its existing controls, including its

written policies and procedures, are sufficiently robust, and its personnel are

adequately trained on these internal controls and comply fully with them.

Both Enterprises have also experienced significant leadership changes. For

example, in late March 2019, Fannie Mae appointed a new Chief Executive Officer

(CEO); that individual had been serving as Interim CEO with the departure of the

previous CEO in October 2018. In addition, Freddie Mac announced that its CEO

will retire with its current President to take over as CEO in July 2019. Among

other things, changes in leadership can lead to lack of attention to internal

controls.

Examples of OIG’s Oversight Accomplishments: Audit, Evaluation, and Compliance

Activities

Supervision of the Regulated Entities

FHFA’s Housing Finance Examiner Commissioning Program: $7.7 Million and Four

Years into the Program, the Agency has Fewer Commissioned Examiners

(COM-2018-006, issued September 6, 2018)

In 2011, FHFA acknowledged that the efficiency and effectiveness of its

examination program was impeded by the limited number of commissioned examiners

then in its employ, totaling 46. The Agency agreed to develop a Housing Finance

Examiner commission program (HFE Program) with the stated objectives of providing

examiners with “broadbased knowledge to conduct successful risk-based examinations”

and qualifying them “to lead the examination of a major risk area at Fannie Mae,

Freddie Mac, and the Federal Home Loan Banks.”

Previously, we issued four reports on FHFA’s efforts to increase the size of its

corps of commissioned examiners and two assessments of the HFE Program. During this

semiannual period, we conducted a study to assess whether the HFE Program had

increased the number of commissioned examiners on the FHFA staff and to determine

how FHFA deployed its commissioned examiners and reported our findings. We found

that the Agency has not achieved its goal of increasing the number of commissioned

examiners nor is it on track to do so. Since the Agency began awarding HFE

commissions in 2014, the total number of its commissioned examiners has decreased

from 59 (as of June 2014) to 58 (as of June 2018). Almost seven years after the

Agency committed to develop and implement a commissioning program and $7.7 million

later, the Agency’s examination program continues to be hindered by an insufficient

number of commissioned examiners.

We found the HFE Program suffers from a high non-completion rate. Of the 66

examiners who enrolled when the HFE Program first began in 2013, only 6 completed

the HFE Program and passed its final examination. By June 2018 more than half (36)

were no longer enrolled in the HFE Program. The remaining 24 continued to be enrolled

as of June 1, 2018, almost five years into the approximately four-year program, and

one-third (8) had completed less than 75% of the Program’s requirements after five

years. Since 2014, only 9 individuals have graduated from the HFE Program and

passed the final examination.

We also assessed the Agency’s deployment of its commissioned examiners. FHFA, in its

2013 Performance and Accountability Report, explained that the main objective of the

HFE Program was to produce commissioned examiners who are “qualified to lead”

examinations of major risk areas at the entities supervised by FHFA. However, that

objective has not been fulfilled in practice. DBR records reflect that, for each

of the last three supervisory cycles, commissioned examiners led roughly 75% of annual

DBR exams. DER records show that, for the 2016 and 2017 annual supervisory cycles, DER

initiated a total of 53 targeted examinations (defined by FHFA as “a deep or

comprehensive assessment” of areas of high importance or risk) and none of these 53

targeted exams was led by an HFE commissioned examiner.

Based on our prior reports and the fieldwork for our September 2018 report, we hold

the view that the multiple failures in FHFA’s administration of its HFE Program have

derailed efforts to produce the HFE commissioned examiners that the Agency claimed to

need. We questioned the $7.7 million in costs to develop, implement, and staff the HFE

Program in light of the failure of that Program to yield the anticipated results.

Conservatorship Operations

Special Report on the Common Securitization Platform: FHFA Lacked Transparency and

Exercised Inadequate Oversight Over a $2.13 Billion, Seven-Year Project (OIG-2019-005,

issued March 29, 2019)

In 2012, FHFA directed the Enterprises to build a Common Securitization Platform (CSP

or Platform) to replace their current separate “back-office” systems and to issue a

single mortgage-backed security (single security). As originally envisioned, the CSP

wasintended to facilitate issuance of mortgage-backed securities (MBS) by multiple

market participants in a future housing finance system. In May 2014, the then-FHFA

Director decided to limit the current scope of the Platform to working “for the

benefit of Fannie Mae and Freddie Mac” and committed to transparency in its

development.

The first phase of CSP development, Release 1, was rolled out in November 2016.

Release 1 allowed Freddie Mac to use the CSP to issue single-family fixed-rate MBS.

Under the second phase, Release 2, both Enterprises will use the CSP to issue the

new single security. Release 2 is now scheduled for completion by June 2019.

In December 2016, we reported that FHFA had not fully met its commitment to

transparency around the development of the CSP. We found that the Agency publicly

disclosed only the actual costs incurred to develop and test the CSP; represented

to Congress that, as of the first quarter of 2016, the actual and projected costs

to develop and test the CSP through 2018 totaled $696 million; and did not disclose

to Congress or the public what it knew about the Enterprises’ actual and projected

integration costs. We also found that FHFA had not publicly disclosed the risks to

successful development and implementation of the CSP.

During this reporting period, we conducted a review to determine whether (1) FHFA

honored its commitment to transparency about the CSP by disclosing updated

projections for the total cost (development and integration) of the CSP and its

internal assessment of the risks of this project after December 2016; and (2) FHFA

exercised adequate oversight of the CSP project. We found that: (1) FHFA was not

transparent; and (2) its oversight of the CSP project was inadequate.

FHFA issued a public update in March 2017, in which it projected a total of $1.12

billion in CSP development costs. However, FHFA did not disclose the projected

$955 million cost to integrate the Enterprises’ IT systems into the CSP. Because

it had conducted a thorough review of the program in late 2016, FHFA was aware

that the CSP development was “off track” with a significant risk of untimely

completion and additional costs. However, it disclosed no known issues or risks

in its March 2017 update. It announced that Release 1 had been implemented but

reported that Release 2 would be delayed by six months, until the second quarter

of 2019.

Since March 2017, FHFA has provided no further cost information in public updates.

Our review of internal FHFA documents found that, as of February 2019, FHFA

projected that Platform development costs and Enterprise integration costs through

Release 2 will total $2.13 billion by June 30, 2019. Although the Agency has

asserted that the Platform was developed using standard industry technology and

interfaces, it acknowledged to us that it has yet to develop plans, establish a

timetable, and determine the costs for use of the Platform by any third party.

FHFA’s Approval of Senior Executive Succession Planning at Freddie Mac Acted to

Circumvent the Congressionally Mandated Cap on CEO Compensation (EVL-2019-002,

issued March 26, 2019) and FHFA’s Approval of Senior Executive Succession

Planning at Fannie Mae Acted to Circumvent the Congressionally Mandated Cap on

CEO Compensation (EVL-2019-001, issued March 26, 2019)

During this reporting period, we issued two reports that evaluated FHFA oversight

of the Enterprises’ boards of directors’ succession planning efforts.

Under HERA, FHFA is empowered to operate the Enterprises “with all the powers of

the shareholders, the directors, and the officers” while the Enterprises remain in

conservatorship. FHFA delegated responsibility to the respective boards of

directors to develop a succession plan for the CEO and President positions and

select candidates for vacant CEO and President positions, and the selections are

subject to review by FHFA as conservator. According to FHFA, it has, as a

practical matter, chosen to approve such selections after review. FHFA has

retained the responsibility to

approve compensation actions for senior executive officers.

FHFA reported to us that the then-FHFA Director raised the need for succession

planning with the Fannie Mae Board Chair in 2018, following the CEO’s notice of

his likely departure. In June 2018, the Board Chair submitted the Board’s

written proposed transition plan for directors and senior executive leadership

(Board Transition Plan) to FHFA for approval. The Fannie Mae Board Transition

Plan represented that the statutory cap of $600,000 on compensation for

Enterprise CEOs imposed by the Equity in Government Compensation Act of 2015

created challenges to recruit internal and external qualified candidates for

the CEO position.

To address these challenges, the Board Transition Plan recommended a change to

Fannie Mae’s management structure by filling the positions of President and

CEO with separate individuals. (Since 2008, those positions had been held by

one individual.) Under the Fannie Mae Board Transition Plan, certain

responsibilities previously executed by the individual holding the CEO and

President positions would be assigned to the position of President. The Fannie

Mae Board proposed that the annual compensation for the President position

should be no less than Fannie Mae’s most highly compensated Fannie Mae officer,

which was then $3.25 million. The then-FHFA Director approved the Board

Transition Plan in July 2018.

We found that FHFA’s approval of the Fannie Mae Board Transition Plan acted to

circumvent the congressionally mandated cap of $600,000 on CEO compensation. By

authorizing Fannie Mae to fill the positions of CEO and President with two

separate individuals and transfer substantial responsibilities from the CEO and

President to the President position, FHFA permitted Fannie Mae to compensate its

President at a level more than five times greater than the statutory cap. After

the current President had served in the position for less than seven weeks, the

Board approved an 11% increase in the President’s target compensation, raising

it to $3.6 million per year, which FHFA approved in October 2018. Fannie Mae is

now compensating its interim CEO and President a total of $4.2 million to

execute the same responsibilities for which it had previously paid $600,000.

In addition, we found that the then-FHFA Director overrode internal controls

for processing, tracking, and monitoring requests for conservator approval, which

he was authorized to do, when he determined to review the Fannie Mae Board

Transition Plan directly, without any staff analysis or recommendation. The

decision by the then-FHFA Director to override established FHFA internal controls

for conservator review and approval of an Enterprise request created an

information vacuum within the Division of Conservatorship (DOC) and rendered

it unable to execute its responsibilities.

To address these shortcomings, we recommended that FHFA (1) re-assess the

appropriateness of the annual compensation award of $3.6 million to the Fannie

Mae President; and (2) establish a process for maintaining and monitoring

sensitive conservator requests in its tracking system. FHFA disagreed with

our first recommendation and agreed with our second recommendation.

In a companion report, we focused on FHFA oversight of the Freddie Mac Board

of Directors. FHFA reported that Freddie Mac’s CEO, who has served as CEO

since May 2012, advised the Freddie Mac Board that he intends to retire

during the second half of 2019. In May 2018, the Freddie Mac Board Chairman

provided the then-FHFA Director with a Board Transition Plan that included

recommendations to address this transition. The Freddie Mac Board Transition

Plan stated that the statutory cap on the compensation of Enterprise CEOs of

$600,000 created challenges to Freddie Mac’s ability to recruit qualified

external candidates and an external search could be disruptive to existing

internal leadership. The then-FHFA Director responded in writing to the Board

Transition Plan, advising the Freddie Mac Board that the plan “strikes us

as being very reasonable” and concurred with the Board’s request to forego

an external search. Over the following months, the Freddie Mac Board

Transition Plan was refined to include: designation of the senior executive

who would succeed the CEO after his retirement; creation of a “Deputy CEO”

position to be filled by this designated senior executive for one year;

mentorship of the Deputy CEO by the CEO until his retirement; and a

proposed compensation package for the Deputy CEO position at a level no

less than the highest paid executive who

reported to the CEO (then $3.25 million).

Acting upon a written staff recommendation, the then-FHFA Director approved

this executive compensation package

of $3.25 million for the Deputy CEO position on August 15, 2018. Despite

FHFA’s earlier response to Freddie Mac that the Board Transition Plan was

reasonable, FHFA notified Freddie Mac after August 15, 2018, that the

Enterprise would need to conduct an external search for a CEO and title the

new position “President,” rather than Deputy CEO. FHFA approved creation of

the position of President with the understanding that the individual in that

position would serve as the “understudy” to the CEO and execute only those

responsibilities previously executed by the CEO and now delegated to him over

a one-year period.

We found that FHFA’s approval of a $3.25 million compensation package for the

Deputy CEO position (which was never created) and subsequent approval of the

same compensation for the President position, acted to circumvent the

congressionally mandated cap of $600,000 on CEO compensation. As a result

of FHFA’s approval, Freddie Mac provided a total of $3.85 million in

compensation for the same set of CEO responsibilities for which it

previously paid $600,000. We recommended that FHFA re-assess the

appropriateness of the Freddie Mac President’s $3.25 million compensation.

FHFA disagreed with our recommendation.

Fannie Mae Purchased Single-Family Mortgages, Including those Purchased

through Master Agreements, in Accordance with Selected Credit Terms Set

Forth in its Selling Guide for 2015 – 2017 (AUD-2019-006, issued March 27,

2019)

Fannie Mae manages the quality of its mortgage purchases by requiring

mortgage sellers to comply with its Selling Guide. The Selling Guide sets

forth Fannie Mae’s underwriting standards and eligibility guidelines, as

well as its policies and procedures related to sales of single-family

mortgages to it. Fannie Mae’s underwriting standards are developed, in part,

based on risk-based criteria which enables it to evaluate a borrower’s

willingness and capacity to repay a mortgage and the value of the property

to ensure that it provides adequate collateral for the mortgage. Riskbased

criteria relating to a borrower’s willingness and capacity include the debt-

to-income (DTI) ratio, loan-to-value (LTV) ratio, and credit score while

collateral value is assessed through property valuation. None of these

criteria are considered in a vacuum but are considered together to build a

snapshot of the potential risk level of the mortgage.

Historically, many mortgage sellers sought to sell mortgages to Fannie Mae

that did not meet the underwriting standards and/or eligibility requirements

in the Selling Guide. Fannie Mae captured these negotiated terms, referred

to as variances, with its mortgage sellers in a document called a “master

agreement.” Each master agreement supplemented the general requirements of

the Selling Guide and set forth the additional negotiated terms under

which Fannie Mae agreed to purchase mortgages from the mortgage seller.

We completed an audit in which we sought to assess FHFA’s oversight of

Fannie Mae’s master agreements with its single-family mortgage sellers from

2015 through 2017 (review period). As part of the audit, we analyzed master

agreements for Fannie Mae’s top three single-family mortgage sellers and

found no variation between the terms in the master agreements for DTI ratio,

LTV ratio, credit score, and property valuation method from the terms for the

same element set forth in the Selling Guide.

We also obtained information from FHFA and Fannie Mae and analyzed loan-

level data in FHFA’s Mortgage Loan Integrated System (MLIS) for all single-

family mortgage sellers to determine whether the credit terms for DTI ratio,

LTV ratio, credit score, and property valuation methods for the mortgages

purchased by Fannie Mae differed from those credit terms in the governing

Selling Guide. For the single-family mortgages purchased by Fannie Mae

during the review period (nearly 6.46 million mortgages with a total unpaid

principal balance of $1.49 trillion), through our analysis, we identified

some differences with these credit terms, but those differences were not

material (less than one-tenth of one percent of the mortgages purchased by

Fannie Mae during the review period).

We did, however, identify issues with the reliability of certain data fields

in MLIS. Specifically, we found instances where data fields for our selected

credit terms were either missing information or were shown as “unknown.”

particularly with respect to the data field for property valuation method.

FHFA agreed with our recommendation to address this MLIS data field.

Information Technology Security

External Penetration Test of FHFA’s Network and Systems During 2018 (AUD-

2019- 003, issued February 11, 2019) To support our ongoing oversight of

FHFA’s  implementation of the Federal Information Security Modernization

Act of 2014 (FISMA), we completed an audit during this period to determine

whether FHFA’s security controls were effective to protect its network and

systems against external threats.

We found that FHFA’s security controls successfully prevented us from

gaining unauthorized access to its systems via the internet, wireless

access points, or phishing email. Through a vulnerability scan of the

Internet Protocol addresses registered to FHFA, we identified two medium

severity vulnerabilities related to an outdated encryption protocol

and web cookies; however, we were not able to exploit these vulnerabilities

to gain unauthorized access to FHFA’s systems. Upon receiving our

vulnerability scan reports, FHFA management reported that a plan was

underway  to replace systems with an outdated encryption protocol and FHFA

took action  to address the web cookie vulnerability.

We also performed a test that revealed FHFA employees were susceptible to

email phishing. FHFA agreed with our three recommendations to address these

matters.

Counterparties and Third Parties

FHFA Should Re-evaluate and Revise Fraud Reporting by the Enterprises to

Enhance its Utility (EVL-2018-004, issued September 24, 2018)

HERA requires the Enterprises to establish and maintain procedures designed

to discover and report instances of fraud and possible fraud. In 2010, FHFA

promulgated a regulation to implement HERA’s fraud reporting requirements.

This regulation requires each Enterprise to report to the FHFA Director

instances of fraud and possible fraud relating to the purchase or sale of

fraudulent loans or financial instruments. In addition, FHFA Advisory

Bulletin 2015-02, Enterprise Fraud Reporting, directs the Enterprises to

submit monthly and quarterly fraud status reports. FHFA provided standardized

templates for specifying the information the Enterprises should include in

their monthly and quarterly reports. Similarly, under the Bank Secrecy Act,

the Enterprises are required to report fraud and other suspicious activities

to the Financial Crimes Enforcement Network, a Treasury bureau.

FHFA is responsible for examining and monitoring the Enterprises’ fraud risk

management practices and overseeing the Enterprises’ compliance with FHFA

fraud reporting requirements. FHFA recognizes that timely fraud reporting to

the Agency is essential to maintain the Enterprises’ safe and sound condition.

We reviewed the applicable requirements and guidance governing the Enterprises’

obligations to detect and report fraud, the Enterprises’ fraud detection and

reporting practices, and FHFA’s use of the Enterprises’ fraud reports. We found

that FHFA does not make any documented, systematic use of the content of the

Enterprises’ fraud reports. FHFA advised us that it recently began to analyze

trends of the information in the Enterprises’ fraud reports. While FHFA has

considered using that information for risk analysis, it has not developed any

framework in which to assess that information.

Because Congress required the Enterprises to prepare fraud reports and FHFA has

directed them to submit detailed monthly and quarterly reports to meet this

statutory requirement, we recommended that FHFA re-evaluate the fraud

information  it requires from the Enterprises and revise, as appropriate, its

existing reporting requirements to enhance the utility of these reports with

the goal of using these reports to inform its supervisory activities with

respect to the risk that fraud poses to the Enterprises. FHFA agreed with our

recommendation.

Examples of OIG Investigative Accomplishments

OIG is vested with statutory law enforcement authority that is exercised by

its Office of Investigations (OI). OI conducts criminal and civil

investigations into those, whether inside or outside of government, who

waste, steal, or abuse in connection with the programs and operations of the

Agency and the regulated entities. OI is staffed with special agents (SAs),

investigative counsel, analysts, and attorney advisors who work in field

offices across the nation. OI has offices located within several federal

judicial districts that lead the nation in reported instances of mortgage

fraud: the Southern District of Florida; the Northern District of Illinois;

the District of New Jersey; and the Central District of California.

OI specializes in deterring and detecting fraud perpetrated against the

Enterprises. OI’s focus on fraud committed against the Enterprises is

essential to the well-being of the secondary mortgage market. Collectively,

Fannie Mae and Freddie Mac hold more than $5 trillion worth of mortgages on

their balance sheets. Each year the Enterprises acquire millions of

mortgages worth several hundreds of billions of dollars. The potential for

fraud in these circumstances is significant.

Civil Cases

OI continued to participate in residential mortgage backed securities (RMBS)

investigations and other civil investigations by working closely with U.S.

Attorneys’ offices to investigate allegations of fraud committed by financial

institutions and individuals.

The Royal Bank of Scotland Agrees to Pay $4.9 Billion for Financial Crisis-Era

Misconduct

In August 2018, the Department of Justice (DOJ) announced a $4.9 billion

settlement with The Royal Bank of Scotland Group plc (RBS Group) resolving

federal civil claims that RBS Group’s subsidiaries in the United States (RBS)

misled investors in the underwriting and issuing of RMBS between 2005 and 2008.

The penalty is the largest imposed by DOJ for financial crisis-era misconduct

at a single entity.

Using recordings of contemporaneous calls and emails of RBS executives, the

settlement includes a statement of facts alleged by DOJ (but not admitted or

agreed to by RBS) that details how RBS routinely made misrepresentations to

investors about significant risks it failed to disclose about its RMBS.

For example, RBS’s reviews of loans backing its RMBS (known as “due diligence”)

confirmed that loan originators had failed to follow their own underwriting

procedures, and that their procedures were ineffective at preventing risky

loans from being made. As a result, RBS routinely found that borrowers for the

loans in its RMBS did not have the ability to repay and that appraisals for the

properties guaranteeing the loans had materially inflated the property values

RBS’s RMBS contained, as its Chief Credit Officer put it, “total [expletive

deleted] garbage” loans with “random” and “rampant” fraud that was “all

disguised to, you know look okay kind of . . . in a data file.” RBS never

disclosed that these material risks both existed and increased the likelihood

that loans in its RMBS would default.

RBS’s due diligence practices did not remove fraudulent and high-risk loans

from its RMBS. In fact, RBS executives internally discussed how RBS’s due

diligence process was “just a bunch of [expletive deleted].”

To develop and maintain business relations with originators, RBS agreed to

limit the number of loans it could review (due diligence caps) and/or limit

the number of materially defective loans it could remove from an RMBS (kick-out

caps). As a result, RBS securitized tens of thousands of loans that it

determined or suspected were fraudulent or had material problems without

disclosing the nature of the loans to investors.

Through its scheme, RBS earned hundreds of millions of dollars, while

simultaneously ensuring that it received repayment of billions of dollars it

had lent to originators to fund the faulty loans underlying the RMBS. RBS used

RMBS to push the risk of the loans, and tens of billions of dollars in

subsequent losses, onto unsuspecting investors across the world, including non-

profits, retirement funds, and federally-insured financial institutions. As

losses mounted, and after many mortgage lenders who originated those loans had

gone out of business, RBS executives showed little regard for this misconduct

and made light of it. For example, after RBS’s Head Trader received an e-mail

from a friend stating “[I’m] sure your parents never imagine[d] they’d raise a

son who [would] destroy the housing market in the richest nation on the planet,”

the Head Trader answered, “I take exception to the word ‘destroy.’ I am more

comfortable with ‘severely damage.’”

According to OIG’s Associate Inspector General Jennifer Byrne: “The actions of

RBS resulted in significant losses to investors, including Fannie Mae and Freddie

Mac, which purchased the Residential Mortgage-Backed Securities backed by

defective loans.”

Criminal Cases

11 Individuals and 3 Businesses Charged in National Foreclosure Relief Scheme,

Ohio

In March 2019, 11 people from across the country and three businesses were

indicted for their roles in a scheme to defraud distressed homeowners by falsely

representing that they could help the victims save their homes.

According to the 26-count indictment, the co-conspirators took advantage of

homeowners’ desperation to save their homes and used money from homeowner victims

to personally enrich themselves. It is alleged that co-conspirators were involved

in a multilevel marketing scheme, which promised affiliates commissions by

recruiting distressed homeowners to companies they controlled, including MVP Home

Solutions, LLC, Bolden Pinnacle Group Corp., and Silverstein & Wolf Corp. They

used multiple ways to recruit affiliates, including conference calls and direct

mailings. For example, some co-conspirators hosted weekly conference calls where

participants from across the country dialed in to hear details of the scheme and

share sales strategies. During the calls, co-conspirators encouraged affiliates

to recruit homeowners to their companies on the promise of easy money.

Some co-conspirators also allegedly promoted, organized, and attended conferences

in which affiliates came to hear details of the scheme in person. For example,

some co-conspirators organized and participated in a national conference in

Columbus, Ohio, in April 2015 in which they provided “deep impact training” and

techniques for affiliates to convince homeowners to enroll in Bolden Pinnacle

Group Corp. and Silverstein & Wolf Corp. programs.

Affiliates were encouraged to be aggressive in recruiting homeowners. Affiliates

used online databases and court records to identify vulnerable, financially

distressed homeowners who had recently received notice of foreclosure on their

home.

According to the indictment, some co-conspirators mailed more than 22,000

postcards promising that they could “stop foreclosure” or “stop the sheriff sale”

for a fixed fee. Co-conspirators also reached out to homeowners using

Craigslist ads, websites, emails, and social media platforms.

On the promise of reducing or eliminating mortgage obligations in exchange for a

fee, initial recruiters would collect payments from homeowners and refer the

victims to the co-conspirator’s companies.

Among other things, the referral programs promised to negotiate with mortgage

lenders on the homeowners’ behalf for the purchase of the mortgage notes at a

discount, negotiate the sale of their home and release of their mortgage loans

through a short sale and/or deed in lieu of foreclosure sale, stop an imminent

foreclosure sale, remove the mortgage lien via a tender offer, and achieve

short sale prices at a fraction of the value of the outstanding lien/note.

Further, co-conspirators represented that they had “proprietary” methods or

“legal tactics” to help homeowners stall or completely avoid foreclosure. In

actuality, the indictment says co-conspirators persuaded homeowners to file

chapter 13 bankruptcies in order to delay foreclosure actions.

Co-conspirators allegedly filed skeletal bankruptcy petitions that they called

“pump fakes.” These petitions intentionally failed to disclose the

co-conspirators as preparers and named the homeowners as filing pro se. Any

relief from foreclosure delay was temporary until the bankruptcy court

dismissed the proceeding.

In 2014 alone, one co-conspirator allegedly prepared and filed petitions for

30 homeowners without their knowledge.

The Enterprises suffered losses because of this scheme.

Vice President of Real Estate Management Company and Managing Director of

Commercial Real Estate Financing Firm Pled Guilty in Multi-Million Dollar

Mortgage Fraud Scheme, New York

Between December 2018 and March 2019, Kevin Morgan and Patrick Ogiony were

charged by information and pled guilty to conspiracy to commit bank fraud.

According to court documents, Kevin Morgan and Ogiony, along with

co-defendants Todd Morgan, Frank Giacobbe, and others, conspired to defraud

financial institutions and the Enterprises. Kevin Morgan was employed as a

Vice President at Morgan Management, LLC, a real estate management company

that managed more than 200 multifamily properties. Todd Morgan also was

employed by Morgan Management as a Project Manager. Kevin and Todd Morgan

worked with Frank Giacobbe, who owned and operated Aurora Capital Advisors,

LLC, a mortgage brokerage company, and Patrick Ogiony, an Aurora employee,

to secure financing for properties managed by Morgan Management or certain

principals of Morgan Management.

Kevin Morgan, Ogiony, and others created and provided false information to

lenders, the Enterprises, and servicers, including reporting inflated

revenues and reduced expenses for the properties managed by Morgan

Management.

This resulted in the financial institutions issuing loans for larger

amounts than they would have authorized had they been provided with truthful

information.

The co-defendants misled the financial institutions regarding the occupancy of

properties. For example, Kevin Morgan and Ogiony conspired to provide false

rent rolls to lenders and appraisers on a variety of dates, overstating

either the number of renters in a property and/or the rent paid by occupants;

conspired to provide false and inflated income statements for the properties;

and worked with others to deceive inspectors into believing that unoccupied

apartments were, in fact, occupied.

In one such instance, Kevin Morgan, Ogiony, and others provided false

information to Berkadia Commercial Mortgage LLC and Freddie Mac, in connection

with Rochester Village Apartments at Park Place, a multi-family residential

community owned by certain Morgan Management principals. The false information

included inflated income derived from storage unit rentals, parking revenue,

and apartment leases. Additionally, during the construction phase, apartments

were reported to lenders as “occupied” prior to the issuance of the certificates

of occupancy. At another property, radon testing procedures were falsified to

secure financing.

In addition, Kevin Morgan, Ogiony, and others made misrepresentations to the

lending institutions to conceal the unauthorized use of loan proceeds by Morgan

Management and its principals. Loan funding was used to maintain or improve other

properties managed by Morgan Management, and to satisfy debts associated with

other properties managed by Morgan Management. For example, the defendants

included a fictitious $2.5 million debt in a loan application, purportedly owed

to a Morgan Management controlled entity and created a fabricated payoff letter

for that debt to increase the amount of the loan in connection with a property

known as Autumn Ridge.

Charges are pending against Giacobbe and Todd Morgan. The investigation revealed

fraud in at least 23 loans issued for over $500 million, secured by at least 21

different properties.

Loss calculations are ongoing. Some loans involved in this scheme were purchased

or securitized by the Enterprises.

Ex-Fannie Mae Employee Found Guilty and Fannie Mae Real Estate Owned (REO) Broker

Pled Guilty in Multi-Million Dollar Scheme Involving Property Listings and

Approval of Below-Market Sales, California

In February 2019, Shirene Hernandez was found guilty at trial on charges of wire

fraud and deprivation of honest services involving a scheme where she received

bribes and kickbacks from brokers in exchange for Fannie Mae real estate listings

and for approving the discounted sales of Fannie Mae-owned properties.

According to the evidence presented at a five-day trial, Hernandez was a sales

representative at Fannie Mae. As part of its operations, Fannie Mae acquires

properties through foreclosures and other methods, and then it manages and

sells those properties for Fannie Mae’s benefit. Since at least 2012, Fannie

Mae’s profits have gone to the U.S. Treasury

for the benefit of U.S. taxpayers.

As a sales representative, Hernandez assigned Fannie Mae-owned properties to

real estate brokers and approved sales of the properties based on offers the

brokers submitted. In violation of Fannie Mae rules and federal law, Hernandez

approved sales of Fannie Mae-owned properties at discounted prices to herself

and to the brokers who paid her kickbacks. She also received bribes – mostly

in cash payments – in return for listing opportunities and commissions that

brokers earned on real estate sales.

Hernandez also assigned listings to family members who earned nearly $2 million

in commissions in less than three years. Other brokers who paid kickbacks

earned millions more. For her part in the scheme, Hernandez received more than

$1 million in benefits, including the cash kickbacks that she received, and the

value of a property that she obtained with kickback money.

As part of the scheme, Hernandez purchased a Fannie Mae-owned property in

Sonoma, California, that she was responsible for selling, and she rejected higher,

market-priced offers in favor of her own below-market price. Hernandez purchased

the Sonoma property through intermediaries and affiliates that she controlled,

selling it first to a company affiliated with a broker who was bribing her, then

directing the broker to transfer the property to her sister-in-law, who paid for

the property with a duffel bag filled with $286,450 in cash from Hernandez – far

below the market price. The Sonoma property was rented out and Hernandez received

the rent proceeds.

In a related case, in January 2019, Peter Michno, a broker, was charged and pled

guilty to conspiracy to commit wire fraud involving deprivation of honest services

for his role in this scheme.

According to the plea agreement, Michno was a Fannie Mae-approved REO broker

entitled to receive a commission from the sale of REO properties as compensation

for his services. Michno was not authorized to purchase Fannie Mae REO properties

for himself or for his friends, relatives, and associates or permitted to pay

referral fees, bribes, or kickbacks to Fannie Mae employees.

Michno paid co-conspirators, employed by Fannie Mae, cash bribes and kickbacks in

exchange for the assignment of listings and the approval of below-market sales of

Fannie Mae REO properties to him and his affiliates. Michno then transferred some

of these properties to his co-conspirators as a kickback for the performance of

their official duties.

Former Business Owner Convicted in Federal Court for Over $49 Million Bank Fraud,

Maryland

In August 2018, Mark Gaver was convicted by a federal jury on charges of bank

fraud and money laundering arising from a scheme in which he obtained over $49

million in bank financing for his company Gaver Technologies, Inc. (GTI), using

false and fraudulent financial statements, balance sheets, and certifications of

outstanding accounts receivable.

According to the evidence presented at his seven-day trial, Gaver formed GTI, an

information technology company based in Frederick, Maryland. Gaver submitted

materially false financial documents to Santander Bank, a federally insured bank,

including fraudulent audit reports and contract status reports, to establish and

obtain successive increases in the line of credit from the lender for GTI. Based

upon the false documentation submitted by Gaver, the lender ultimately extended

$50 million in financing to GTI.

The evidence showed that some of the funds obtained from the lender were used by

Gaver to cover regular business expenses and thereby keep GTI open, but Gaver also

diverted half of the loan proceeds—approximately $15 million—to his own personal

use. For example, Gaver used loan proceeds to pay rental fees of private planes that

he used for non-business purposes, as well as to pay for personal pleasure trips to

France, Germany, Mexico, Jamaica, and the Bahamas. Gaver also used the funds to

purchase vacation homes, including a 4,000-square foot condominium with a view of

the Gulf of Mexico in Bonita Springs, Florida, a 2012 Maserati Gran Turismo, a 2011

Mercedes Benz SL Roadster, and a private membership at an exclusive golf club.

Gaver obtained a home equity line of credit that was pledged to the FHLBank of

Pittsburgh. The estimated loss to Santander, a member bank of the FHLBank of

Pittsburgh, is $49 million.

In December 2018, Gaver was sentenced to 17 years in prison, 3 years of supervised

release, and ordered to pay $48,774,308 in restitution and $49,215,606 in forfeiture.

[Seal - Office of Inspector General, U.S. Department of Housing and Urban Development]

Office of Inspector General

U.S. Department of Housing and Urban Development

The HUD OIG conducts independent audits, evaluations, investigations, and other reviews

of HUD operations and programs to promote economy, efficiency, and effectiveness, and

protect HUD and its component entities from fraud, waste, and abuse.

Background

While organizationally located within HUD, the OIG operates independently with separate

budget authority. Its

independence allows for clear and objective reporting to HUD’s Secretary and Congress.

HUD’s mission is to create strong, sustainable, inclusive communities and quality

affordable homes for all. HUD is working to strengthen the housing market to bolster

the economy and protect consumers, meet the need for quality affordable rental homes,

and use housing as a platform for improving quality of life. Its programs are funded

through more than $50 billion in

annual congressional appropriations.

Within HUD are two entities that have major impact on the Nation’s financial system:

the Federal Housing Administration (FHA) and Government National Mortgage Association

(Ginnie Mae). FHA provides mortgage insurance for single-family homes, multifamily

properties, nursing homes, and hospitals. FHA is the largest insurer of mortgages in

the world, having insured more than 47.5 million loans since its inception in 1934.

FHA mortgage insurance provides lenders with protection against losses as the result

of homeowners defaulting on their mortgage loans. In fiscal year 2018, FHA generated

more than $1.3 trillion in insured loans. FHA receives limited congressional

funding and is primarily self-funded through mortgage insurance premiums.

Ginnie Mae is a self-financing, wholly owned U.S. Government corporation within HUD.

It is focused on providing investors a guarantee backed by the full faith and credit

of the United States for the timely payment of principal and interest on mortgage-

backed securities (MBS) secured by pools of government home loans, which are insured

or guaranteed by FHA, HUD’s Office of Public and Indian Housing, the U.S. Department

of Veterans Affairs (VA), and the U.S. Department of Agriculture (USDA). The

purchasing, packaging, and reselling of mortgages in a security form frees

up funds that lenders use to provide more loans.

Ginnie Mae has an outstanding portfolio of MBS securities valued at more than $2

trillion. A majority of the MBS securities consist of FHA-insured mortgages. Ginnie

Mae offers the only MBS securities carrying the full faith and credit guaranty of the

U.S. Government, which means that its investors are guaranteed payment of principal

and interest in full and on time. If an issuer of MBS securities fails to make the

required pass-through payment of principal and interest to investors, Ginnie Mae is

required to assume responsibility for it by defaulting the issuer and assuming

control of the issuer’s MBS securities pools and the servicing of the loans in those

pools.

HUD’s Top Management Challenges

OIG continually looks for ways to meet the needs of HUD’s beneficiaries and to

protect taxpayer dollars. OIG’s oversight efforts focus on identifying and addressing

HUD’s most serious management challenges, several of which relate to financial

oversight:

• Ensuring the Availability of Affordable Housing that is Decent, Safe, Sanitary, and

in Good Repair

• Protecting the FHA Mortgage Insurance Fund

• Administering Disaster Recovery Assistance

• Instituting Sound Financial Management

Identifying these challenges helps HUD and Congress mitigate the primary risks that

hinder HUD in meeting its mission and being able to put taxpayer dollars to the best

use. OIG uses these challenges to target its oversight efforts, as demonstrated in the

following summaries.

Ensuring the Availability of Affordable Housing that is Decent, Safe, Sanitary, and in

Good Repair

Part of HUD’s mission is to create quality, affordable homes for all. The housing that

HUD insures and funds must be decent, safe, sanitary, and in good repair. Economic and

demographic factors, as well as aging housing stock, have created an extreme shortage of

housing that is affordable and safe. HUD’s challenge is to adapt existing programs to

address ever-increasing housing pressures on the Nation’s lowest income residents.

One of HUD’s financial strategies to address affordable housing is to encourage public

housing agencies (PHAs) to transition public housing units to a private-public partnership

model. HUD developed its Rental Assistance Demonstration Program (RAD) to give PHAs a tool

to preserve and improve public housing properties and address the $26 billion nationwide

backlog of deferred maintenance. For fiscal year 2018, Congress increased to 455,000 the

number of public housing units that may participate in RAD. OIG audited a number of PHAs

in fiscal year 2018 to assess their conversion to the RAD program, and is continuing to

conduct PHA RAD audits nationwide in fiscal year 2019. For example:

The Housing Authority of the City of Evansville, IN, Did Not Follow HUD’s and Its Own

Requirements for Units Converted Under the Rental Assistance Demonstration

The Authority of the City of Evansville, IN, did not follow HUD’s and its own requirements

for the units converted under RAD. Specifically, it (1) did not ensure that units complied

with HUD’s housing quality standards before it entered into a housing assistance payments

contract, (2) failed to obtain the services of a HUD-approved independent third party to

perform housing quality standards inspections for units owned by entities it substantially

controlled, and (3) did not apply the correct contract rents for the converted units. As a

result, the Authority could not support the eligibility of more than $1 million in housing

assistance payments to the entities and more than $10,000 in program funds paid to a

contractor for housing quality standards inspection services. Further, the application of

incorrect rents led to the underpayment of housing assistance to the entities, so these

funds were not available for the administration of the Authority’s Project-Based Voucher

Program. OIG made multiple recommendations to correct the identified deficiencies. (Audit

Report: 2018-CH-1003)

Protecting the FHA Mortgage Insurance Fund

HUD is challenged in protecting the FHA mortgage insurance fund, which insures approximately

25 percent of all mortgages in the United States. Through the Mutual Mortgage Insurance

(MMI) fund,5 FHA insures participating lenders against losses when borrowers default on

loans, which allows lenders to make loans to higher risk borrowers. From April 2017 through

March 2018, the MMI fund paid out almost $14 billion in reimbursements for defaulted

loans. For those claims for which the lender conveyed the property to HUD and HUD resold the

property, HUD recovered only about 54 percent of the funds paid out.

Without sufficient controls, oversight, and effective rules, FHA’s MMI fund is at risk of

unnecessary losses. Further, if insurance fees collected from borrowers cannot support the

fund, additional funding from the U.S. Department of the Treasury is required, as authorized

for Federal credit programs.

In protecting the FHA and Ginnie Mae programs, HUD is confronted with

• a lack of sufficient safeguards in FHA’s mortgage insurance program,

• large losses to the insurance fund due to home equity conversion mortgages,

• an increase in Ginnie Mae’s nonbank issuers, and

• potential emerging risks related to a market shift toward an entirely digital mortgage

life cycle.

For more than a decade, OIG has reported the need for more safeguards to protect the FHA

insurance program, and fiscal year 2018 was no exception. For example:

FHA Insured $1.9 Billion in Loans to Borrowers Barred by Federal Requirements

OIG audited FHA insured loans from calendar year 2016 to determine whether FHA insured

loans to borrowers with delinquent Federal debt or who were subject to Federal

administrative offset for delinquent child support.

FHA insured an estimated 9,507 loans, worth more than $1.9 billion, which were not

eligible for insurance because they were made to borrowers with delinquent Federal debt

or who were subject to Federal administrative offset for delinquent child support. OIG

recommended that FHA put more than $1.9 billion to better use by developing a method for

using the U.S. Treasury Do Not Pay portal to identify delinquent Federal debt and

delinquent child support to prevent future FHA insured loans to ineligible borrowers.

(Audit Report: 2018-KC-0001)

HUD Paid an Estimated $413 Million for Unnecessary Preforeclosure Claim Interest and

Other Costs Due to Lender Servicing

Delays

OIG audited FHA’s preforeclosure sale claim process to determine the amount of

unnecessary

preforeclosure claim

interest and other costs that resulted from lender noncompliance with HUD’s loan-

servicing timeframe requirements. HUD paid more than $413 million in unnecessary interest

and other costs for 27,634 preforeclosure claims because lenders failed to complete

servicing actions for defaulted loans within established timeframes. Although the

unnecessary amounts were caused by lenders’ inaction, HUD reimbursed lenders for these

added costs through FHA insurance claims. As a result, the FHA insurance fund incurred

unnecessary and unreasonable costs, and fewer funds were available to pay other claims

or apply toward reducing FHA borrower mortgage insurance premiums. OIG recommended that

HUD implement a change to regulations at 24 CFR (Code of Federal Regulations) Part 203 to

require curtailment of preforeclosure interest and other costs caused by lender servicing

delays, resulting in more than $413 million in funds to be put to better use. (Audit

Report: 2018-LA-0007)

Footnote: 5 The MMI fund is a Federal fund that insures mortgages guaranteed by FHA. The

MMI fund supports both FHA mortgages used to buy homes and reverse mortgages used by

seniors to extract equity from their homes. [End of footnote]

HUD Failed to Enforce the Terms of a Settlement Agreement With Fifth Third Bank Because It

Did Not Record Indemnified Loans in Its Tracking System

OIG worked with HUD to resolve outstanding matters related to two September 2015 agreements

with Fifth Third Bank (FTB) and its principal subsidiary, Fifth Third Bancorp, a bank holding

company. HUD had failed to properly record required indemnifications in its FHA Connection

system; therefore, it did not hold FTB accountable to the terms of the settlement agreements.

OIG recommended that HUD require FTB to reimburse HUD nearly $312,000 for two loans, for which

HUD incurred losses when it sold the properties, and 15 loans for which FHA insurance had been

terminated and HUD had paid loss mitigation claims to FTB. OIG also recommended that HUD record

in FHA Connection the remaining indemnified loans, avoiding more than $47 million in estimated

losses, and that HUD develop and implement controls to ensure that indemnification agreements

that result from legal settlements have been properly recorded in FHA Connection. Finally, OIG

recommended that HUD take appropriate administrative action against FTB for violations of the

settlement agreement. (Memorandum: 2018-CF-0802)

OIG also conducted a civil fraud review of a professional services firm that provides auditing

services to clients throughout the United States.

Deloitte & Touche, LLP, Settled Allegations That It Failed To Conduct Taylor, Bean & Whitaker

Mortgage Corporation’s Audits in Conformance With Generally Accepted Auditing Standards

OIG and the U.S. Attorney’s Office conducted a civil fraud review of Deloitte & Touche, LLP,

a professional services firm that provides auditing services to clients throughout the United

States. Deloitte provided auditing services to its client, Taylor, Bean & Whitaker Mortgage

Corporation (TBW). TBW was an FHA-approved direct endorsement lender and as such, was required

to submit to HUD annual audited financial statements to maintain its status as a direct

endorsement lender. Deloitte served as TBW’s independent outside auditor and submitted audit

reports on TBW’s financial statements for its fiscal years ending April 30, 2002, through

April 30, 2008. Deloitte stated in its reports that it had conducted its audits of TBW in

accordance with generally accepted auditing standards.

Deloitte & Touche, LLP, entered into a settlement agreement with the Federal Government,

agreeing to pay $149.5 million, of which $115 million was to be paid to HUD. Deloitte denied

but settled allegations of alleged conduct in connection with its role as TBW’s independent

outside auditor for fiscal years that ended April 30, 2002, through April 30, 2008. The

settlement agreement was neither an admission of liability by Deloitte nor a concession by

the United States that its claims were not well founded. (Memorandum: 2018-FO-1802)

OIG has several planned and ongoing audits focused on protecting the FHA mortgage insurance

fund. For example, one ongoing audit has the objective of determining whether FHA insured

loans made to borrowers that were ineligible due to delinquent Federal tax debt. OIG expects

to issue this report in fiscal year 2019. Another audit that recently began focuses on whether

FHA insured loans that did not meet the underwriting requirements for special flood hazard

areas. OIG expects to issue this report in fiscal year 2020.

In addition, OIG continues to pursue resolution to concerns reported in previous years. OIG

reported one of its highest concerns in October 2016, which was that OIG projected that HUD

paid claims for nearly 239,000 properties that servicers did not foreclose upon or convey on

time. As a result, HUD paid an estimated $2.23 billion in unreasonable and unnecessary holding

costs over a 5-year period. These excessive costs were allowed to occur because HUD regulations

do not establish a maximum period for filing a claim and do not place limitations on holding

costs when servicers do not meet all deadlines. OIG recommended HUD make regulatory changes to

establish a maximum claim filing period and sufficient limitation on holding costs after

services missed deadlines. To date, HUD has not completed the regulatory changes and our

recommendation remains open. These significant, excessive costs will continue to negatively

affect the MMI fund until the regulatory changes are completed.

OIG also fears continued large losses to the FHA insurance fund due to home equity conversion

mortgages (HECM). HECM is a reverse mortgage program that enables eligible homeowners age 62

and older to borrow funds using the equity in their homes. FHA’s fiscal years 2015 through

2018 annual reports on the status of the MMI fund showed an overall trend of large

fluctuations in the value of the HECM portfolio and consistently negative net cash flows

ranging from negative $1.6 billion to negative $4.5 billion. In total, the HECM program

consumed $13 billion in MMI fund assets and $7 billion in General Insurance fund6 assets over

the 4-year period of fiscal years 2015 through 2018.

OIG is currently conducting an audit with an objective to determine whether HUD designed the

HECM program to control the risk of loss related to assignment claims and ensure program

viability. Our subobjectives are to (1) identify the full cost of the HECM program and

determine whether HUD reported that cost, (2) identify inherent program risks

and existing or potential controls to mitigate risks and control costs, and (3) determine

whether the HECM program can function as a stand-alone program without a Federal subsidy.

OIG expects to issue this report in fiscal year 2019.

HUD is also challenged by the significant increase in the number of nonbanks issuing MBS

pools that Ginnie Mae guarantees. In fiscal year 2018, nonbank issuers accounted for 78

percent of Ginnie Mae’s single-family MBS issuance volume for the year, up from 51 percent

in June 2014 and from 18 percent in fiscal year 2010. As OIG and Ginnie Mae have reported,

the increase in the number of nonbank issuers and their complexity continues to present an

unmitigated challenge for monitoring efforts. As Ginnie Mae wrote in its 2018 Annual Report,

“[a]s more non-banks issue Ginnie Mae’s securities, the cost and complexity of monitoring

increases as the majority of these institutions involve more third parties in their

transactions, making oversight more complicated. In contrast to traditional bank issuers,

non-banks rely more on credit lines, securitization involving multiple players, and more

frequent trading of [mortgage servicing rights].”

In addition, the mortgage industry is moving toward an entirely electronic loan process.

FHA and Ginnie Mae intend to do the same. However, HUD, particularly FHA, has well-known

technology challenges. Risks include information security, data transfers and platform

integration, and system functionality, all of which could lead to fraudulent activities.

OIG continues to have concerns that an increase in demand on the FHA and VA programs will

have collateral implications for the integrity of the Ginnie Mae MBS program, including

the potential for increased fraud. Of particular concern is VA loan churning, in which

lenders encourage veterans to repeatedly refinance their loans, which can result in the

borrower incurring ever increasing fees on their loan. If the fees get too high, the

veteran could lose his or her home. The churning produces profits for the lenders at the

expense of the veterans, which means that lenders, at times, use deceptive practices to

encourage repeated refinances. Since September 2017, the Ginnie Mae – VA Loan Churn Task

Force has been working to address these concerns. Ginnie Mae has notified issuers that

are outliers among market participants to develop corrective action plans. The action

plans are aimed to prevent a few bad actors from raising the cost of homeownership for

millions of Americans. A Ginnie Mae executive said “We expect issuers receiving these

notices to respond quickly, produce a corrective action plan and come into compliance

with our program.”

OIG also helps protect the FHA insurance fund by conducting investigations of alleged

fraud against the fund, and securing recoveries to the fund. OIG completed 126 single-

family investigations of fraud against the FHA insurance fund in fiscal year 2018.

A majority of the investigations focused on loan origination fraud, for both forward and

reverse mortgages. Recoveries from these cases totaled nearly $500 million. For example:

• The co-owner of a mortgage company was sentenced in U.S. District Court in connection

with a guilty plea to 24 counts of wire fraud, 6 counts of bank fraud, and 3 counts of

filing a false tax return. The defendant was sentenced to 60 months incarceration,

followed by 5 years of probation, and ordered to pay $12.7 million in restitution. The

co-owner and three other defendants defrauded numerous lenders into purchasing

refinanced FHA and refinanced conventional mortgages that the mortgage company originated,

for which the first mortgages were not paid off at the time of closing. The defendants

used the closing escrow funds for their personal benefit. OIG, the U.S. Attorney’s Office,

the Federal Bureau of Investigation (FBI), and the Internal Revenue Service Criminal

Investigation division conducted the investigation.

Footnote: 6 The General Insurance fund (GI) provides a large number of specialized

mortgage insurance activities, including insurance of loans for property improvements,

cooperatives, condominiums, housing for the elderly, land development, group practice

medical facilities, nonprofit hospitals, and reverse mortgages. To comply with the FHA

Modernization Act of 2008, activities related to most single-family programs, including

HECM, endorsed in fiscal year 2009 and going forward, are in the MMI fund. The single-

family activities in the GI fund from fiscal year 2008 and prior remain in the GI fund.

[End of footnote]

• A former accountant for a Ginnie Mae-approved loan servicing company was sentenced in

U.S. District Court in connection with a guilty plea to an Information charging the

defendant with reporting false transactions to HUD. The Court sentenced the former

accountant to one year of supervised release and ordered her to pay HUD more than $108,000

in restitution. Over a period of about 18 months, the defendant helped the former owner of

the loan servicing company divert millions of dollars in mortgage payments to an account

that the former owner used for other business and personal expenses. The payments should

have been made to Ginnie Mae investors. The former accountant and former company owner

then falsely reported to Ginnie Mae that the defrauded borrowers had not made those

mortgage payments. Given the shortfall in payments to investors, as well as tax and

insurance payments that were supposed to have been escrowed for borrowers but were not,

Ginnie Mae was forced to reimburse investors and borrowers, resulting in an approximate

$2.8 million loss to HUD. OIG, the U.S. Attorney’s Office, the USDA OIG, the VA OIG, and

the FBI conducted this investigation.

Administering Disaster Recovery Assistance

HUD has taken on significant leadership responsibilities in the area of disaster recovery

assistance. Congress has appropriated more than $84 billion in supplemental funding to HUD

for disaster recovery since 2001. This amount includes $35.8 billion appropriated by

Congress in supplemental appropriations to HUD in 2017 and 2018 for recovery from Hurricanes

Harvey in Texas; Irma in Florida, Georgia, South Carolina, and the U.S. Virgin Islands; Maria

in Puerto Rico and the Virgin Islands; and Nate in Mississippi. These disasters resulted in

the loss of many human lives and massive property destruction. Further, as the Federal

Emergency Management Agency noted, economic recovery is a critical and integral part of

disaster recovery. Disasters not only damage property, but also entire markets for goods and

services. Considerable Federal funds are contributed to State, local, and Tribal economic

recovery as well as to other areas of recovery that necessarily strengthen the economy.

The nature of disaster recovery is inherently risky and susceptible to fraud, given the

complexity and range of challenges experienced when recovering from disasters. Disaster

recovery appropriation funds may take decades to spend, as their purpose is for long-term

recovery, which includes rebuilding homes and communities. HUD awards grants to States and

units of local government for disaster recovery efforts. Over the years, HUD has gained more

experience and made progress in assisting communities recovering from disasters, but it

continues to face these challenges in administering and overseeing these grants:

• codifying the Community Development Block Grant - Disaster Recovery (CDBG-DR) program,

• ensuring that expenditures are eligible and supported,

• ensuring and certifying that grantees are following Federal procurement regulations,

• addressing concerns that citizens encounter when seeking disaster recovery assistance, and

• preventing fraud in disaster recovery assistance.

OIG reported on these areas in recent years, including fiscal year 2018. For example:

HUD’s Office of Block Grant Assistance Had Not Codified the Community Development Block Grant

Disaster Recovery Program OIG audited HUD’s disaster recovery program to determine whether HUD

should codify the CDBG-DR funding as a program in the CFR. Although HUD had managed billions

in CDBG-DR funds since 2002, it has not codified the program because it believed it did not

have the authority under the Robert T. Stafford Disaster Relief and Emergency Assistance Act

and had not determined whether it had the authority under the Housing and Community

Development Act of 1974, as amended. It also believed a Presidential Executive order presented

a barrier to codification, as it required HUD to identify two rules to eliminate before

creating a new codified rule. OIG believes HUD has the authority under the Housing Act of 1974

and it should codify the program. HUD’s use of multiple Federal Register notices to operate the

CDBG-DR program presented challenges to the grantees. For example, 59 grantees with 112 active

CDBG-DR grants, which totaled more than $47.4 billion as of September 2017, had to follow

requirements contained in 61 different Federal Register notices to manage the program. Further,

codifying the CDBGDR program would (1) ensure that a permanent framework is in place for future

disasters, (2) reduce the volume of Federal Register notices, (3) standardize the rules for all

grantees, and (4) ensure that grants are closed in a timely manner. OIG recommended that HUD

work with its Office of General Counsel to codify the CDBG-DR program. (Audit Report:

2018-FW-0002)

The City of New York, NY, Did Not Always Use Disaster Recovery Funds Under Its Program for

Eligible and Supported Costs

OIG audited the City of New York, NY’s Infrastructure Rehabilitation and Reconstruction of

Public Facilities Program to determine whether the City used CDBG-DR funds under its program

for eligible and supported costs. The City did not always use CDBG-DR funds under its

program for eligible and supported costs. Specifically, for one of two projects reviewed, the

City did not (1) have sufficient documentation to show that the use of salary multipliers for

overhead and profit, resulting in more than $594,000 in additional costs, was supported and

eligible; (2) maintain adequate documentation to show compliance with requirements of the

Davis-Bacon Act and related acts; and (3) identify billing and payroll errors made by

subcontractors. As a result, HUD did not have assurance that the City used nearly $598,000

in CDBG-DR funds as intended for matching requirements for other federally funded

infrastructure projects, and HUD could not be assured that funds were disbursed for only

eligible and supported costs that complied with applicable Federal requirements. OIG

recommended that HUD require the City to adequately support identified expenditures or

reimburse its program from non-Federal funds, and strengthen its controls to ensure

compliance with applicable expenditure requirements. (Audit Report: 2018-NY-1007)

Grantees carry out the disaster recovery activities supported by CDBG-DR funding. The

ability of these grantees to accomplish recovery from disasters and do so in an efficient

and effective manner is critical to the recovery of the affected communities. To help HUD

ensure that grantees have this ability, OIG conducts capacity reviews to determine whether

these entities have the capability to administer their CDBG-DR grants in accordance with

applicable regulations and requirements, particularly with regard to financial management,

procurement, monitoring, and reporting. In fiscal year 2018, OIG conducted capacity reviews

of the State of Florida’s Department of Economic Opportunity (2018-AT-1010) and the State

of Texas’ General Land Office (2018-FW-1003). In fiscal year 2019, OIG has planned and

ongoing capacity reviews and compliance audits of Puerto Rico’s Department of Housing,

the U.S. Virgin Island’s Housing Authority, and the State of Texas’ General Land Office,

among others. OIG expects to begin reporting on these audits starting in fiscal year 2019.

OIG is also currently conducting an audit of HUD to determine whether it is adequately

prepared to respond to upcoming natural and man-made disasters. The audit focuses on

disaster policies and procedures regarding interaction with external partners and disaster

survivors, as well as for receiving and distributing disaster funds. OIG is coordinating

this audit with several other Federal agencies and expects to issue a report in fiscal

year 2019 or 2020.

Instituting Sound Financial Management

Over the last several years, HUD’s financial management has been operating at “inadequate”

or “basic” levels of maturity7 due to (1) a weak governance structure, including the lack

of a confirmed Chief Financial Officer for a number of years; (2) ineffective internal

controls; and (3) an antiquated financial management system consisting of legacy systems

and manual processes that have precluded HUD from producing reliable and timely financial

reports As a result, HUD has been unable to achieve an unmodified audit opinion8 on its

financial statements for the last 6 years and has received a disclaimer of opinion for

the last 5 years.

Footnote: 7 U.S. Department of the Treasury, Bureau of the Fiscal Service, Federal

Financial Management Maturity Model. The Maturity Model is a business tool that helps a

CFO self-assess his or her organization’s level of financial management discipline,

effectiveness, and efficiency. A copy of the model can be found at https://www.fiscal.

treasury.gov/fsservices/gov/fit/MaturityModelHandout2017-05-10.pdf. [End of footnote]

One of HUD’s component entities, Ginnie Mae, has also been unable to achieve an

unmodified opinion and has received a disclaimer of opinion for the last 5 years due to

poor governance and a weak internal control framework. Ginnie Mae has been unable to

appropriately account for and support several financial statement line items in accordance

with generally accepted accounting principles, including its nonpooled loan asset

portfolio, which totaled as much as $6 billion at one point. HUD’s unstable financial

management environment weakens public confidence in the government programs HUD

administers and prevents HUD’s stakeholders from being able to rely on HUD’s financial

position.

[Seal - Office of Inspector General, National Credit Union Administration]

Office of Inspector General

National Credit Union Administration

The NCUA OIG promotes the economy, efficiency, and effectiveness of NCUA programs and

operations and detects and deters fraud, waste and abuse, thereby supporting the NCUA’s

mission of providing, through regulation and supervision, a safe and sound credit union

system that promotes confidence in the national system of cooperative credit.

Agency Overview

The National Credit Union Administration (NCUA) is responsible for chartering, insuring,

and supervising Federal credit unions and administering the National Credit Union Share

Insurance Fund (Share Insurance Fund). The agency also manages the Operating Fund,9 the

Community Development Revolving Loan Fund,10 and the Central Liquidity Facility.11

Credit unions are member-owned, not-for-profit cooperative financial institutions formed

to permit members to save, borrow, and obtain related financial services. NCUA charters

and supervises federal credit unions, and insures accounts in federal and most state-

chartered credit unions across the country through the Share Insurance Fund, a federal

fund backed by the full faith and credit of the United States government.

The NCUA’s mission is to provide through regulation and supervision, a safe and sound

credit union system that promotes confidence in the national system of cooperative

credit and its vision is to protect consumer rights and member deposits. NCUA further

states that it is dedicated to upholding the integrity, objectivity, and independence

of credit union oversight. The agency implements initiatives designed to meet these

goals.

Major NCUA Programs

Supervision

NCUA supervises credit unions through annual examinations, regulatory enforcement,

providing guidance in regulations and letters, and taking supervisory and

administrative actions as necessary. The agency’s Office of National Examinations and

Supervision (ONES) oversees examination and supervision issues related to consumer

credit unions with assets greater than $10 billion and all corporate credit unions,

which provide services to consumer credit unions (also known as natural person credit

unions). Due to the relative size of their insured share base, they are deemed

systemically important to the Share Insurance Fund. In addition, the Dodd-Frank Act

gave the Consumer Financial Protection Bureau (CFPB) the authority to examine

compliance with certain consumer laws and regulations by credit unions with assets

over $10 billion.

Footnote: 9 The Operating Fund was created by the Federal Credit Union Act of 1934.

It was established as a revolving fund in the United States Treasury under the

management of the NCUA Board for the purpose of providing administration and service

to the federal credit union system. A significant majority of the Operating Fund’s

revenue is comprised of operating fees paid by federal credit unions. Each federal

credit union is required to pay this fee based on its prior year asset balances and

rates set by the NCUA Board. [End of footnote]

Footnote: 10 The NCUA’s Community Development Revolving Loan Fund, which was

established by Congress, makes loans and Technical Assistance Grants to low-income

designated credit unions. [End of footnote]

Footnote: 11 The Central Liquidity Facility is a mixed-ownership government

corporation the purpose of which is to supply emergency loans to member credit

unions. [End of footnote]

Insurance

NCUA administers the Share Insurance Fund, which is capitalized by credit unions

and provides insurance for deposits held at federallyinsured credit unions nationwide.

The insurance limit is $250,000 per depositor.

Credit Union Resources and Expansion

NCUA’s Office of Credit Union Resources and Expansion (CURE) supports credit union

growth and development, including providing support to low-income, minority, and any

credit union seeking assistance with chartering, charter conversions, by-law amendments,

field of membership expansion requests, and low-income designations. CURE also provides

access to online training and resources, grants and loans, and a program for preserving

and growing minority institutions.

Consumer Protection

NCUA’s Office of Consumer Financial Protection (OCFP) is responsible for consumer

protection in the areas of fair lending examinations, member complaints, and financial

literacy. OCFP consults with the CFPB, which has supervisory authority over credit

unions with assets of $10 billion or more. CFPB also can request to accompany NCUA on

examinations of other credit unions. In addition to consolidating consumer protection

examination functions within the agency, OCFP responds to inquiries from credit unions,

their members, and consumers involving consumer protection and share insurance matters.

Additionally, the office processes member complaints filed against federal credit unions.

Asset Management

NCUA’s Asset Management and Assistance Center (AMAC) conducts credit union liquidations

and performs management and recovery of assets. AMAC assists agency regional offices with

the review of large complex loan portfolios and actual or potential bond claims. AMAC also

participates extensively in the operational phases of conservatorships and records

reconstruction. AMAC’s purpose is to minimize costs to the Share Insurance Fund and to

credit union members.

Office of Minority and Women Inclusion

NCUA formed the Office of Minority and Women Inclusion in January 2011, in accordance with

the Dodd-Frank Act. The office is responsible for all matters relating to measuring,

monitoring, and establishing policies for diversity in the agency’s management, employment,

and business activities, and with respect to the agency’s regulated entities, excluding the

enforcement of statutes, regulations, and executive orders pertaining to civil rights.

Office of Continuity and Security Management

The Office of Continuity and Security Management evaluates and manages security and

ontinuity programs across NCUA and its regional offices. The office is responsible for

continuity of operations, emergency planning and response, critical infrastructure and

resource protection, cyber threat and intelligence analysis, insider threats and

counterintelligence, facility security, and personnel security.

The NCUA Office of Inspector General

The 1988 amendments to the Inspector General Act of 1978 (IG Act) established IGs in

33 designated federal entities (DFEs), including the NCUA.12 The NCUA Inspector General

(IG) is appointed by, reports to, and is under the general supervision of a three-member

presidentially appointed Board. OIG staff consists of ten employees: the IG, the Deputy

IG/Assistant IG for Audit, the Counsel to the IG/Assistant IG for Investigations, the

Director of Investigations, five auditors, and an office manager. OIG promotes the

economy, efficiency, and effectiveness of agency programs and operations, and detects

and deters fraud, waste, and abuse, thereby supporting the NCUA’s mission of facilitating

the availability of credit union services to all eligible consumers through a regulatory

environment that fosters a safe and sound credit union system. OIG supports this mission

by conducting independent audits, investigations, and other activities, and by keeping

the NCUA Board and the Congress fully and currently informed of its work.

Recent Work

We coordinated with our counterparts in CIGFO on issues of mutual interest, including

on the Top Management and Performance Challenges Facing Financial Regulatory

Organizations report that CIGFO issued in September 2018. This report noted that

cybersecurity was the most frequently identified cross-cutting challenge among CIGFO

members and included our observation that the NCUA must continue to strengthen the

resiliency of the credit union system to cyber threats.

In that regard, we currently are conducting an audit of the NCUA’s Information

Systems and Technology Examination Program to determine whether the NCUA provides

adequate oversight of the cybersecurity programs of federal credit unions with

assets of $10 billion or more and all corporate credit unions. This audit follows

our September 2017 audit focusing on the NCUA’s oversight of cybersecurity programs

of credit unions with assets between $250 and $10 billion. Both of these audits

could be instructive for the broader financial sector.

Footnote: 12 5 U.S.C. app. § 8G [End of footnote]

[Seal - U. S. Securities and Exchange Commission]

Office of Inspector General

U. S. Securities and Exchange Commission

The U.S. Securities and Exchange Commission (SEC or agency) Office of Inspector

General (OIG) promotes the integrity, efficiency, and effectiveness of the critical

programs and operations of the SEC and operates independently of the agency to help

prevent and detect fraud, waste, and abuse in those programs and operations, through

audits, evaluations, investigations, and other reviews.

Background

The SEC’s mission is to protect investors; maintain fair, orderly, and efficient

markets; and facilitate capital formation. The SEC strives to promote capital markets

that inspire public confidence and provide a diverse array of financial opportunities

to retail and institutional investors, entrepreneurs, public companies, and other

market participants. Its core values consist of integrity, excellence, accountability,

teamwork, fairness, and effectiveness. The SEC’s goals are focusing on the long-term

interests of Main Street investors; recognizing significant developments and trends

in evolving capital markets and adjusting agency efforts to ensure the SEC is

effectively allocating its resources; and elevating the SEC’s performance by

enhancing its analytical capabilities and human capital development.

The SEC is responsible for overseeing the nation’s securities markets and certain

primary participants, including broker-dealers, investment companies, investment

advisers, clearing agencies, transfer agents, credit rating agencies, and securities

exchanges, as well as organizations such as the Financial Industry Regulatory

Authority, Municipal Securities Rulemaking Board, Public Company Accounting

Oversight Board, Securities Investor Protection Corporation, and the Financial

Accounting Standard Board. Under the Dodd-Frank Wall Street Reform and Consumer

Protection Act of 2010 (Dodd-Frank Act), the agency’s jurisdiction was expanded

to include certain participants in the derivatives markets, private fund advisers,

and municipal advisors.

The SEC’s headquarters are in Washington, DC, and the agency has 11 regional

offices located throughout the country. The agency’s functional responsibilities

are organized into 5 divisions and 25 offices, and the regional offices are

primarily responsible for investigating and litigating potential violations of

the securities laws. The regional offices also have examination staff to inspect

regulated entities such as investment advisers, investment companies, and

broker-dealers. In fiscal year 2018, the SEC employed 4,483 full-time equivalents.

The SEC OIG was established as an independent office within the SEC in 1989 under

the Inspector General Act of 1978, as amended (IG Act). The SEC OIG’s mission is

to promote the integrity, efficiency, and effectiveness of the SEC’s critical

programs and operations. The SEC OIG prevents and detects fraud, waste, and abuse

through audits, evaluations, investigations, and other reviews related to SEC

programs and operations.

The SEC OIG Office of Audits conducts, coordinates, and supervises independent

audits and evaluations of the SEC’s programs and operations at its headquarters

and 11 regional offices. These audits and evaluations are based on risk and

materiality, known or perceived vulnerabilities and inefficiencies, and

information received from the Congress, SEC staff, the U.S. Government

Accountability Office, and the public.

The SEC OIG Office of Investigations performs investigations into allegations

of criminal, civil, and administrative violations involving SEC programs and

operations by SEC employees, contractors, and outside entities. These

investigations may result in criminal prosecutions, fines, civil penalties,

administrative sanctions, and personnel actions. The Office of Investigations

also identifies vulnerabilities, deficiencies, and wrongdoing that could

negatively impact the SEC’s programs and operations.

In addition to the responsibilities set forth in the IG Act, Section 966 of

the Dodd-Frank Act required the SEC OIG to establish a suggestion program

for SEC employees. The SEC OIG established its SEC Employee Suggestion

Program in September 2010. Under this program, the OIG receives, reviews

and considers, and recommends appropriate action with respect to such

suggestions or allegations from agency employees for improvements in the

SEC’s work efficiency, effectiveness, and productivity, and use of its

resources, as well as allegations by employees of waste, abuse, misconduct,

or mismanagement within the SEC.

SEC OIG Work Related to the Broader Financial Sector

In accordance with Section 989E(a)(2)(B)(i) of the Dodd-Frank Act, below is

a discussion of the SEC OIG’s completed and ongoing work, focusing on issues

that may apply to the broader financial sector.

Completed Work

Evaluation of the EDGAR System’s Governance and Incident Handling Processes,

Report No. 550, September 21, 2018

On September 20, 2017, the Chairman of the SEC publicly disclosed that an

incident—specifically, a software vulnerability in a component of the

agency’s Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system—

previously detected in 2016, resulted in unauthorized access to non-public

information. On September 23, 2017, the Chairman, who began his service in

May 2017 and was notified of the incident in August 2017, requested that the

OIG review the agency’s handling of, and response to, the 2016 incident.

In response, the OIG initiated an evaluation. In July 2018, the OIG presented

the Chairman and other SEC Commissioners with the non-public results of its

evaluation relative to the 2016 EDGAR intrusion. Report No. 550 presents the

OIG’s findings related to the information security practices applicable to

the EDGAR system between fiscal years (FYs) 2015 and 2017.

EDGAR is at the heart of the agency’s mission of protecting investors;

maintaining fair, orderly, and efficient markets; and facilitating capital

formation. The availability of accurate, complete, and timely information from

EDGAR is essential to the SEC’s mission and the investing public. Without

adequate controls to ensure the SEC identifies, handles, and responds to

EDGAR system incidents in a timely manner, threat actors could gain

unauthorized access to the system, which could lead to illicit trading,

negative impacts to the economy and public access to filings, and loss of

public confidence in the SEC.

We determined that, between FYs 2015 and 2017, the EDGAR system lacked

adequate governance commensurate with the system’s importance to the SEC’s

mission. In addition, we determined that certain preventive controls did

not exist or did not operate as designed. Moreover, between September 2015

and September 2016, the SEC wasted at least $83,000 on a tool for which the

SEC derived little, if any, benefit. Finally, we found that the SEC lacked

an effective incident handling process. These weaknesses potentially

increased the risk of EDGAR security incidents, and impeded the SEC’s

response efforts. The SEC has since strengthened EDGAR’s system security

posture, including the handling of and response to vulnerabilities. Among

other actions, in August 2017, the agency established a Cyber Initiative

Working Group to oversee and lead a number of priority cyber initiatives

such as an EDGAR security uplift. As this and other work continues,

opportunities for further improvement exist.

We issued our final report on September 21, 2018, and made 14

recommendations to improve the SEC’s EDGAR system governance, security

practices, and incident handling processes. We also noted that open

recommendations from prior OIG work should address some of our

observations, and we encouraged management to implement agreed-to

corrective actions. Management concurred with the recommendations,

which will be closed upon completion and verification of corrective

action.

Because the underlying report contains sensitive information about the

SEC’s information security program, we prepared this summary with

information releasable to the public. An executive summary is also

available on our website at https://www.sec.gov/files/Eval-of-the-EDGAR-

Systems-Governance-and-Incident-Handling-Processes.pdf.

TCP Established Method to Effectively Oversee Entity Compliance With

Regulation SCI but Could Improve Aspects of Program Management, Report

No. 551, September 24, 2018

In recent years, several factors, including a significant number of

systems issues at exchanges and other trading venues, increased concerns

over “single points of failure” in U.S. securities markets. These

concerns contributed to the SEC’s decision to address technological

vulnerabilities and improve agency oversight of the core technology

of key U.S. securities markets entities. In November 2014, the SEC

adopted Regulation Systems Compliance and Integrity (SCI), under which

the agency monitors the security and capabilities of U.S. securities

markets’ technological infrastructure. The SEC’s Office of Compliance

Inspections and Examinations’ (OCIE) Technology Controls Program

(TCP) is responsible for ensuring entities comply with Regulation

SCI and for evaluating whether entities have established, maintained,

and enforced written policies and procedures reasonably designed to

ensure the capacity, integrity, resiliency, availability, and security

of their Regulation SCI systems. We initiated an evaluation to assess

OCIE’s TCP and determine whether the program provided effective oversight

of entities’ compliance with Regulation SCI.

TCP has an established method to effectively oversee entity compliance

with Regulation SCI. The program assesses compliance through its

CyberWatch program and through TCP examinations. However, we

identified opportunities to improve aspects of TCP program management.

Specifically, we found that TCP’s examination manuals in effect at the

outset of our evaluation were outdated, management had not identified or

documented TCP risks and control activities in OCIE’s internal risk and

control matrix, and TCPs’ development of the Technology Risk-Assurance,

Compliance, and Examination Report (TRACER) system—the program’s system

of record—was not well-planned or documented.

• Examination Manuals. The TCP Examination Manual and draft TRACER

Examination User Manual in effect at the outset of our evaluation were

outdated and did not align with TCP examination practices. Management was

in the process of revising the TCP Examination Manual and, on June 25,

2018, released an updated version.

• Risks and Control Activities. TCP management had not identified or

documented the program’s risks and corresponding control activities in

OCIE’s risk and control matrix. Although TCP examinations appear to have

similar risks and controls as other OCIE examinations, documentation we

reviewed did not clearly identify comparable documented control activities

specific to TCP examination processes for all identified risks.

• TRACER Development. Between September 2015 and January 2018, TCP

continued  development of the SEC’s TRACER system at a cost of nearly

$780,000. As the system’s business owner during that time, TCP oversaw

frequent (sometimes weekly) system updates, but did not properly plan or

document its development efforts. TRACER’s purpose and functions evolved

over time as TCP was considering continued development of the system or

migration to an existing OCIE system known as the Tracking and Reporting

Examinations National Documentation System (TRENDS). Certain planned

system capabilities were not realized and it is unclear, based on a lack

of documentation, how TCP assessed or managed system requirements. On

May 4, 2018, TCP management decided to discontinue developing TRACER and

transition its examination program to TRENDS, which is expected to yield

operational and cost savings benefits.

We also identified two other matters of interest for management’s

consideration. First, a majority of TCP staff who responded to a survey we

administered indicated that they either did not receive adequate training

or only sometimes received adequate training. TCP management has completed

a 3-year training plan. We encouraged management to continue to review TCP

staff training to ensure staff members have the knowledge and skills

necessary to perform TCP examinations. Secondly, we identified a gap

in the Office of Acquisitions’ process for reviewing CORs’ files. We suggest

that Acquisitions consider establishing follow-up procedures to address this

gap.

At the outset of our evaluation, TCP management identified ongoing improvement

initiatives and began implementing changes. We issued our final report on

September 24, 2018, and, to further improve TCP program management, we

recommended that OCIE: (1) ensure TCP management updates the TCP Examination

Manual in a timely manner following TCPs’ transition to TRENDS; (2) identify

and document the risks and controls related to TCP operations, and update

OCIE’s risk and control matrix accordingly; and (3) ensure TCP management

properly plans and documents TCP’s transition to TRENDS, and retains all

relevant materials in a central location. Management concurred with the

recommendations, which will be closed upon completion and verification of

corrective action. Because the underlying report contains non-public

information, we prepared this summary with information releasable to the

public. Also, a redacted public version is available on our website at

https://www.sec.gov/files/TCPEstablished-Method-to-Effectively-Oversee-

Entity-Compliance-with-Reg-SCI--But-Could-Improve.pdf.

Although Highly Valued by End Users, DERA Could Improve Its Analytics

Support by Formally Measuring Impact, Where Possible, Report No. 553,

April 29, 2019

The SEC increasingly relies on data and analytics to guide its strategic

and operational activities and to make more informed, effective decisions.

Based on FY 2017 budget information, the SEC spends about $120 million

annually on data management and about $20 million annually on analytics.

Furthermore, the SEC’s Strategic Plan for FY 2018 through FY 2022 and FY

2020 Annual Performance Plan emphasize the agency’s goal of enhancing and

expanding its use of analytics.

The SEC’s Division of Economic and Risk Analysis (DERA) assists the agency

in executing its mission by integrating sophisticated, data-driven analytics

and economic analysis into the work of the SEC. Analytics provided by DERA’s

Office of Risk Assessment (ORA) and Office of Research and Data Services

(ORDS) support exam planning and other agency oversight programs related to

issuers, broker-dealers, investment advisers, exchanges, and other trading

platforms. To assess DERA’s controls over integration of data analytics

into the core mission of the SEC, we initiated an evaluation.

We determined that, although end users highly valued DERA’s analytics

support and believed such analytics were indispensable for risk scoping,

investor protection, detecting illegal conduct, allocating resources more

efficiently, and helping the SEC achieve its mission, ORA and ORDS

management generally did not formally measure the quantitative or

qualitative impact of either office’s analytics support. Management noted

that it tracked end user requests for analytics support, considered repeat

customers as evidence analytics are valued, and identified potential metrics

for measuring impact (such as efficiency gains and end user satisfaction);

however, management had not formalized such metrics.

DERA management and end users of DERA’s analytics acknowledged that it might

be difficult to devise meaningful impact measurement metrics for some

analytics projects. For example, even though ORA analytics identified outliers

that led to at least one Division of Enforcement investigation, not all

analytics produce such directly measurable outcomes. Management was also

apprehensive about burdening end users with requests for feedback regarding

analytics’ impact. However, by not measuring, where possible, the impact of

ORA’s and ORDS’ analytics support, DERA risks limiting its ability to assess

its organizational performance, increase awareness of its analytics

capabilities (including through outreach efforts), and fully integrate

analytics into the work of the SEC in accordance with the agency’s strategic

goals and objectives.

In addition, we reviewed available usage data for two analytics tools that

incorporated ORA analytics and found that end users used and valued both

tools. Although DERA did not regularly review the usage data for one tool

and usage data for the other tool was incomplete, we determined that DERA’s

review of such data would not significantly help the Division meet agency

goals and objectives.

We also assessed DERA’s interactions with the SEC’s other divisions and

offices, including its coordination and outreach efforts, and determined

that staff in other divisions and offices generally viewed interactions with

DERA favorably; duplicative analytics work across the SEC was not apparent;

and DERA proactively engaged in outreach.

However, a majority of respondents to a question in a survey we administered

(22 of 37, or almost 60 percent) expressed an interest in further DERA

outreach. Respondents believed that promoting the nature and benefits (that

is, impact) of DERA analytics and systems could be useful to the SEC’s other

divisions and offices.

Finally, we identified one other matter of interest related to data management.

Although we did not assess the SEC’s data management practices and are not

making any recommendations regarding data management at this time, we noted that

data management is the foundation of analytics. Therefore, it is important to

verify completion of the SEC’s plans to improve in this area. We will continue

to monitor the agency’s plans and progress related to data management.

We issued our final report on April 29, 2019, and to improve its ability to

assess its organizational performance, increase awareness of its analytics

capabilities, and fully integrate analytics into the work of the SEC in

accordance with the agency’s strategic goals and objectives, we recommend that

DERA (1) work with end users of its analytics projects to develop metrics, where

possible, for formally measuring analytics support impact; (2) modify existing

internal tracking processes to include, where possible, analytics impact

measurement; and (3) incorporate the results of analytics impact measurements in

the Division’s outreach efforts. Management concurred with the recommendations,

which will be closed upon completion and verification of corrective action.

This report is available on our website at https://www.sec.gov/files/Although-

Highly-Valued-by-End-Users-DERA-Could-Improve-Report-No-553_0.pdf.

Final Management Letter: Update on the SEC’s Progress Toward Redesigning the

EDGAR System

In September 2017, we reported observations about controls over the SEC’s EDGAR

system enhancements and redesign efforts.13 We noted that the SEC’s EDGAR Redesign

(ERD) program is a multi-year, cross-agency initiative and, since 2014, the SEC

had taken steps to develop and implement a new electronic disclosure system that

meets agency needs, including spending about $10.6 million on related contracts.

Since issuing our September 2017 report, we have continued to monitor the SEC’s

progress toward redesigning the EDGAR system. We did not conduct an audit or

evaluation in conformance with generally accepted government auditing standards

or the Council of the Inspectors General on Integrity and Efficiency’s Quality

Standards for Inspection and Evaluation. However, based on the work performed,

on May 23, 2019, we reported concerns that warrant management’s attention.

Specifically, we determined that:

• The agency’s approach to redesigning the EDGAR system is unclear;

• ERD program cost and schedule estimates presented to agency decision makers

and senior officials were not based on best practices; and

• The EDGAR Business Office (EBO) created a Grand Functional Requirements

Document (Grand FRD) for the redesigned EDGAR system, but did not include

sufficient detail about the system’s security requirements.

On May 7, 2019, we provided SEC management with a draft of our management letter

for review and comment. In its May 17, 2019, response, management concurred with

our overall observations and stated that it remains committed to modernizing and

improving the security, functionality, and maintainability of the EDGAR system.

Although management did not use cost and schedule estimates based on best practices

for its deliberations about the appropriate high-level strategy for the EDGAR system,

management anticipates preparing more detailed estimates, based on best practices,

later in the process. Also, although the Grand FRD did not describe in detail

security requirements for redesigning EDGAR, management anticipates it will obtain

detailed security requirements in a future phase of the project. Finally, management

expects that completed and ongoing work will modernize much of the EDGAR system,

achieve many of the goals of the original EDGAR redesign project, and position the

system for further modernization.

Footnote: 13 U.S. Securities and Exchange Commission, Office of Inspector General,

Audit of the SEC’s Progress in Enhancing and Redesigning the Electronic Data Gathering,

Analysis, and Retrieval System, Report No. 544; September 28, 2017. [End of footnote]

To help us determine whether further action by the OIG is warranted, we requested that,

no later than June 6, 2019, management provide to the OIG the SEC’s approach to

redesigning the EDGAR system and its planned or ongoing actions to (a) manage the ERD

program using reliable cost and schedule estimates based on established methods

and valid data; (b) integrate “functional requirements” with “non-functional

requirements,” including those for security, recoverability, testability, and

maintainability, with sufficient detail that future offerors can propose viable

solutions and designs as part of a future competitive procurement; and (c) further

manage the existing EDGAR system.

The final management letter contains non-public information about the agency’s

efforts to redesign the EDGAR system. We redacted the non-public information to

create this public summary. Our public version of the letter is also available on

our website at https://www.sec.gov/files/Final-Mgmt-Ltr-Update-on-the-SECs-Progress-

Toward-Redesigning-EDGAR.pdf.

Ongoing Work

Evaluation of the Division of Trading and Markets’ Office of Broker-Dealer Finances

The SEC prescribes broker-dealer net capital and risk assessment reporting

requirements through various rules, overseen by the Division of Trading and Markets’

Office of Broker-Dealer Finances (OBDF). On June 10, 2019, we initiated an evaluation

of OBDF’s efficiency and effectiveness. Specifically, we will determine whether OBDF

(1) ensures efficient use of government resources to help achieve organizational

goals and objectives, and (2) provides effective oversight of broker-dealer

compliance with capital and risk reporting requirements, in accordance with

applicable rules and guidance. We expect to issue a report summarizing our

findings during 2020.

Evaluation of the SEC’s Delinquent Filer Program

In 2004, the SEC initiated the delinquent filer program, administered jointly

by the Division of Enforcement and the Division of Corporation Finance, to bring

administrative proceedings under Exchange Act Section 12(j) to revoke the Exchange

Act registrations of securities of issuers that are more than 1-year delinquent in

their Exchange Act reports and have been unresponsive to SEC requests for

compliance.14 At the same time, the Division of Enforcement seeks Commission

approval for trading suspensions under Section 12(k) to suspend trading of the

securities of the non-filing issuers under certain circumstances. On June 10, 2019,

we initiated an evaluation of the SEC’s delinquent filer program to assess the SEC’s

process for identifying, tracking, and notifying delinquent filers and issuing related

revocation orders and/or trading suspensions in accordance with applicable laws,

rules, and regulations. As part of the evaluation, we will also review the Division

of Enforcement’s efforts to decentralize the delinquent filer process. We expect to

issue a report summarizing our findings during 2020.

Footnote: 14 According to a 2004 advice memo, an enhanced delinquent filings

program for issuers was needed because publicly traded companies that are delinquent

in filing Exchange Act reports deprive investors of accurate financial information

upon which to make informed investment decisions. Further, these entities are often

vehicles

for fraudulent stock manipulation schemes. [End of footnote]

[Seal - Special Inspector General for the Troubled Asset Relief Program]

Special Inspector General for the Troubled Asset Relief Program

The Special Inspector General for the Troubled Asset Relief Program (SIGTARP) has

the duty, among other things, to conduct, supervise, and coordinate audits and

investigations of the purchase, management, and sale of assets under the Troubled

Asset Relief Program (TARP) or as deemed appropriate by the Special Inspector

General.

Background

SIGTARP is primarily a Federal law enforcement agency protecting the interests

of the American people by investigating crime at financial institutions that

received TARP funds or at other TARP recipients in housing programs. All TARP

programs are intended to promote financial stability.

When first created, SIGTARP found that financial institution fraud had evolved

from the insider self-dealing fraud that marked the savings and loan crisis, to

escape detection from traditional fraud identification methods of self-reporting

and regulator referrals. SIGTARP created an intelligence-driven approach and

leveraged technological solutions to discover insider crimes at banks that

previously went undetected. Now, as a result of SIGTARP investigations, 105

bankers have been criminally charged and 74 have been sentenced to prison with

more bankers awaiting trial and sentencing.

SIGTARP is applying its intelligence-driven approach to search for crime in

TARP housing and foreclosure prevention programs. TARP recipients include

large mortgage servicers in the Making Home Affordable (MHA) Program, like

Wells Fargo, Bank of America, and JPMorgan Chase.

SIGTARP assesses that the top threat in TARP today is unlawful conduct by

any of the 152 banks and other financial institutions that received $20.1

billion or will continue to receive $3.7 billion for foreclosure prevention

in TARP’s MHA Program. With an uptick in enforcement actions against

financial institutions in MHA, SIGTARP has shifted resources to counter

this threat.

The Most Serious Management and Performance Challenges & Threats of Fraud,

Waste, & Abuse Facing the Government in TARP

SIGTARP identifies the most serious management and performance challenges

and threats facing the Government in TARP. Our selection is based on the

significance and duration of the challenge/threat to the mission of TARP and

to Government interests; the risk of fraud or other crimes, waste or abuse;

the impact on agencies in addition to Treasury; and Treasury’s progress

in mitigating the challenge/threat.

Risk of Fraud, Waste, and Abuse by Large Banks and Others in the Making

Home Affordable Program (Until Sep. 2023)

Unlawful conduct by any of the 152 banks or institutions that received

$20.1 billion or will continue to receive $3.7 billion in TARP’s MHA

program is the top threat in TARP. Treasury will pay up to $3.1 billion

to Ocwen, Wells Fargo, JPMorgan Chase, Bank of America, Nationstar, Select

Portfolio Servicing, CitiMortgage, OneWest/CIT, Bayview Loan Servicing,

and Specialized Loan Servicing along with 131 institutions. These TARP

payments require compliance with the law and Treasury’s rules for the

institutions assisting the 834,206 consumers in all 50 states. Wells

Fargo recently

disclosed in two SEC filings its wrongful denial of homeowners for

admission to the program. Despite enforcement actions and other

wrongdoing by many of these financial institutions, Treasury has

significantly scaled back its compliance reviews. The risk of fraud,

waste, and abuse also jeopardizes the GSEs, FHA, and Veterans Affairs

that participate in MHA.

Risk of Waste and Misuse of TARP Dollars by State Agencies for Their

Own Administrative Expenses in the Hardest Hit Fund (Until Dec. 2021)

Treasury has budgeted $1.1 billion in TARP dollars for administrative

expenses of 19 state agencies to distribute HHF assistance. In March

2019, SIGTARP issued an audit that found state agencies violated

federal cost regulations by charging more than $400,000 in prohibited

travel and conference costs to the Hardest Hit Fund. SIGTARP found

waste, a lack of internal controls at state agencies, and lack of

effective oversight by Treasury. State agencies did not have the

documentation required by Federal regulations to charge the travel

and conferences to HHF. The audit also identified outright waste,

including TARP funds spent on luxury hotels, conferences and

extravagant dinners and receptions. In 2016 and 2017, SIGTARP

identified $11 million in wasteful and unnecessary spending by state

housing agencies, including, for example, catered barbeques, parties,

country club events, leasing a Mercedes, cash bonuses, gym

memberships, gifts, free parking, settlements and legal fees in

discrimination cases, other costs not associated with HHF, and more.

In 2018, SIGTARP issued an audit that found that while Treasury

anticipates millions of dollars in spending on lawyers, accountants,

auditors, consultants, information technology, communications, risk

management, training, and marketing, there is no Federal requirements

for competition.

Risk of Corruption, Anticompetitive Actions, and Fraud in the Hardest

Hit Fund Blight Elimination Program (Until Dec. 2021)

There is a risk of corruption, anticompetitive acts, and fraud as TARP

funds the demolitions of abandoned homes and apartments. The number of

municipalities in the program increased to 378 cities or counties. There

have already been criminal indictments for corruption in HHF.

Risk of Asbestos Exposure, Contaminated Soil, and Illegal Dumping in the

Hardest Hit Fund Blight Elimination Program (Until Dec. 2021)

In November 2017, based on the U.S. Army Corps of Engineers’ findings, SIGTARP

warned that the standard protections in demolition are not present in the TARP

program. The Army Corps found missing industry standard safeguards that protect

against the risk of asbestos exposure, illegal dumping of debris, and

contaminated material filling the hole. Treasury did not implement SIGTARP’s

recommendations, even to require basic documentation of proper asbestos abatement,

certain inspections, landfill receipts for dumping, and receipts showing the

purchase of clean dirt. SIGTARP’s investigation into a demolition contractor for

illegal dumping of contaminated soil in Fort Wayne, Indiana was resolved for over

$800,000 through remediation and a settlement by DOJ under the False Claims Act.

TARP may expand even further in this area: The Economic Growth, Regulatory Relief,

and Consumer Protection Act authorizes Treasury to use TARP dollars to remediate

lead and asbestos hazards in residential properties.

No Complete List or Data Identifying All Contractors and Others Doing Work in the

Hardest Hit Fund Blight Subprogram and What They Were Paid

Treasury and the state agencies do not know, and cannot provide to SIGTARP a

complete list of contractors receiving TARP dollars in the program. SIGTARP and

Treasury cannot conduct oversight over contractors and other entities that are

unknown. Treasury rejected SIGTARP’s 2015 recommendation to maintain a list and

accounting of payments in HHF. SIGTARP’s proactive analysis has identified 2,210

land banks or other partners, contractors, or subcontractors that have done or are

contracted to do work in the program—but given the missing data, we believe the

actual numbers may be much higher. State agency data is incomplete. The data

provided by state agencies to SIGTARP also provides limited detail about the $510.5

million that has been spent in the Blight Elimination Program beyond the first-level

recipient. As a result, there may be hundreds, or perhaps thousands, of additional

unknown subcontractors doing work in the program. Without complete records and

accounting, the program and taxpayers are vulnerable.

Risk of Waste from Weakened Oversight by Treasury of State Agencies in the Hardest

Hit Fund

Starting in October 2018, Treasury has allowed state agencies to shift HHF dollars

between programs and removed caps on administrative expenses (by the greater of

five percent or $50,000). Treasury also decreased oversight in the HHF program in

2018 by reducing OFS personnel charged with providing oversight of the HHF program

by 30%. These Treasury changes increase risk of fraud, waste and abuse because state

agencies can move more TARP money to higher risk subprograms. These changes also have

weakened Treasury oversight of state administrative spending after SIGTARP has proven

waste and misuse of TARP dollars by state agencies. Additionally, GAO found in a

December 2018 study that “Treasury is missing an opportunity to ensure that HFAs are

appropriately assessing their risk.”

SIGTARP’s Investigations Approach

SIGTARP gained expertise in investigating large institutions which resulted in

significant DOJ enforcement actions against Goldman Sachs, Bank of America, JPMorgan

Chase, Morgan Stanley, Ally Financial, Wilmington Trust, Sun Trust Bank, Fifth Third

Bank, Jefferies & Co., and RBS Securities.

SIGTARP’s law enforcement counters threats to public safety and Government interests

by investigating criminal actors and working with the Justice Department to prosecute

those criminal actors. With 278 people sentenced to prison resulting from a SIGTARP

investigation, at an average prison sentence of nearly five years, the threat these

crimes pose is significant. SIGTARP’s ongoing criminal investigations of recipients of

TARP dollars in TARP housing programs promote free and fair trade by improving the

overall condition for competition, and counter threats to public safety and Government

interests, including financial institution fraud, public corruption, antitrust (unfair

competition), contract fraud, and organized crime. Recent DOJ charges, pleas and false

claim settlements continue to demonstrate that these threats are current and real.

Financial Institution Fraud: SIGTARP’s highest priority is investigating banks and other

financial institutions receiving TARP dollars in the Making Home Affordable Program. Our

investigations into TARP banks have already resulted in 104 bankers criminally charged

and 73 sentenced to prison. Many await trial. Our remaining investigative work in

this area focuses on supporting the Justice Department in its efforts to prosecute TARP

bankers. SIGTARP’s work on financial institution fraud supports Justice Department

prosecutions of individuals investigated by SIGTARP, such as international money

laundering charges related to a TARP bank, that help identify and reduce vulnerabilities

in the financial system while stopping abuses by illicit actors.

Public Corruption: The corruption of local officials threatens public safety and fair

competition. State and local officials award contracts under the more than $760 million

Hardest Hit Fund blight demolition program.

Antitrust Violations: Unfair competitive practices in TARP housing programs including

contract steering, bid rigging and price fixing, threatens the quality of work, harms

public safety, threatens fair competition, and results in higher

costs.

Contract Fraud, False Claims/Theft or Bribery in TARP Programs: Demolition contractors

and State agencies play key roles in administering HHF programs. Fraud in any of these

risk areas harm Government interests and fair competition. Organized Crime: Organized

crime in the over $760 million blight demolition program or in TARP banks threatens

public safety, fair competition and harms Government interests.

Selected SIGTARP’s Investigations Results (April 1, 2018 to March 31, 2019)

Wilmington Trust Corporation

In December 2018 and January 2019, a federal court sentenced seven former Wilmington

Trust bankers to prison terms of up to six years. As a result of a SIGTARP investigation,

the bank’s former president, chief financial officer, chief credit officer and controller

were convicted of securities fraud after a trial. Wilmington Trust Bank received a $330

million TARP bailout. As the conspiracy was ongoing and while in TARP, the bank collapsed

and was acquired by M&T Bank at a discount of approximately 46% from the bank’s share

price the prior trading day.

SIGTARP’s investigation uncovered a scheme by bank insiders to conceal the total quantity

of past due loans on its books from the Federal Reserve, the Securities and Exchange

Commission and the investing public. After the trial, a jury convicted former president

Robert Harra, former chief financial officer David Gibson, former chief credit officer

William North, and former controller Kevyn Rakowski of hiding more than $300 million in

loans that were 90 days past due.

At their sentencing, U.S. District Judge Richard G. Andrews said the investigation

uncovered the “the biggest financial crime in Delaware, at least in the past 35 years.”

The court sentenced former president Harra and former chief financial officer Gibson to

six years in prison and ordered them to pay $300,000 each. The court sentenced former

chief credit officer North to four and half years in prison and ordered him to pay

$100,000 and former controller Rakowski to three years in prison. The court separately

sentenced three other Wilmington Trust officers: former head of commercial real estate

Delaware Brian Baily to two and half years, former vice president for commercial real

estate for Delaware

Joseph Terranova to one year and nine months and former commercial real estate

relationship manager for Delaware Peter Hayes to one year and three months.

In October 2017, as part of a criminal investigation Wilmington Trust admitted

wrongdoing and agreed to pay $60 million. Wilmington Trust was the only TARP bank

indicted by the Justice Department.

SIGTARP was joined in the investigation by the Federal Bureau of Investigation, the

Internal Revenue Service-Criminal Investigation, and the Federal Reserve Bank-Office

of Inspector General. The U.S. Attorney’s Office for the District of Delaware

prosecuted the case.

Sonoma Valley Bank of California

In August 2018, a federal court sentenced both the Sonoma Valley Bank CEO Sean

Cutting and Chief Loan Officer Brian Melland to eight years and four months in prison,

and the attorney of a bank borrower to six years and eight months in prison. SIGTARP’s

investigation uncovered that leading up to and during the time Sonoma Valley Bank was

in TARP, the bank officers conspired to commit fraud that would contribute to the

failure of the bank and a complete loss to TARP of $8.6 million. They made millions

in illegal bank loans to “straw” borrowers, knowing the proceeds would go to one bank

borrower who was a real estate developer. They then tried to cover up the scheme by

falsifying the bank’s books and lying to the bank’s regulators.

During the fraud, the bank applied for TARP, with the CEO describing TARP as a “cookie

jar” and saying it only made sense for the bank to take some. After a Federal jury

trial in December 18, 2017, the jury found Cutting and Melland guilty of conspiracy,

bank fraud, wire fraud, attempted obstruction of justice, and other offenses. The real

estate developer was indicted but died prior to the trial when his car drove over a

cliff on Highway 1. The court ordered $19 million in restitution and forfeiture of a

condominium complex involved in the fraud.

SIGTARP was joined in the investigation by the Federal Housing Finance Agency Office

of Inspector General, the Federal Deposit Insurance Corporation Office of Inspector

General, the Marin County Sheriff’s Office, the Sonoma County Sheriff’s Office, and

the Santa Rosa Police Department. The U.S. Attorney’s Office for the Northern District

of California prosecuted the case.

Southern Bancorp

As a result of a SIGTARP investigation, in February 2019, a federal court sentenced

bank officer Michael J. Erickson to two years in prison after he was convicted of

embezzling funds from Southern Bancorp. The court ordered Erickson to pay $1.4

million to Southern Bancorp. Taxpayers lost $2.3 million on the investment; the bank

received a $33.8 million bailout from TARP.

In its investigation, SIGTARP uncovered a scheme where Erickson stole thousands of

dollars for his own personal enrichment from a commercial loan he managed. SIGTARP

was joined in the investigation by the Federal Bureau of Investigation. The U.S.

Attorney’s Office for the Northern District of Mississippi prosecuted the case.

Saigon National Bank

In February 2019, a federal court sentenced Vivian Tat to two years in federal

prison for laundering tens of thousands of dollars in cash. This case is the result

of Operation “Phantom Bank,” targeting TARP recipient Saigon National Bank, which

resulted in six indictments that charge a total of 25 defendants. SIGTARP was

joined in the investigation by the FBI and the IRS Criminal Investigation. The U.S.

Attorney’s Office for the Central District of California prosecuted the case.

First Legacy Community Credit Union of North Carolina

In March 2019, President and CEO of First Legacy Community Credit Union (FLCCU)

Saundra Torrence was sentenced to six months in prison and ordered to pay

$187,066 in restitution for making or causing false entries. SIGTARP’s investigation

uncovered that Scales falsified the credit union’s books, misapplied and stole funds

from the credit union, and fraudulently used the identity of at least one third

party victim to obtain a loan from FLCCU. Torrence’s wrongdoing caused significant

losses to the credit union. The fraudulent entries she made to conceal her

wrongdoing caused the credit union’s reported financial results to be inaccurate.

SIGTARP was joined in the investigation by the FBI. The U.S. Attorney’s Office for

the Western District of North Carolina prosecuted the case.

First State Bank

In October 2018, former First State Bank CEO Joseph Natale, financier Albert

Gasparro, and business owner Gary Ketchum were indicted for their roles in a scheme

to defraud the now defunct First State Bank, which attempted to obtain TARP funds.

The defendants are charged with conspiracy to mislead the FDIC and First State Bank,

conspiracy to commit bank fraud and bank fraud. Former First State Bank legal counsel

Donna Conroy, a conspirator, pleaded guilty in May 2017 and is awaiting sentencing.

SIGTARP was joined in the investigation by the FBI and the FDIC Office of Inspector

General. The U.S. Attorney’s Office for New Jersey is prosecuting the case.

Lone Star Bank

Following a SIGTARP investigation, in September 2018, a Federal court sentenced Lone

Star Bank loan officer Ricky Hajdik to 20 months in prison and sentenced co-conspirator

Hugo Lafuente to 25 months in prison for a conspiracy to defraud the bank out of $1.3

million in loans. Hajdik knew that Lafuente’s income would not qualify for a

construction loan. Hajdik conveyed to loan broker Leonard Tyson an inflated and untrue

income number that LaFuente needed to qualify for the construction loan. Lafuente then

directed Mark Zylker to prepare fraudulent income tax returns that inflated his income,

which Hajdik used for the bank to make the loan. When Lafuente defaulted on this loan

and a Small Business Administration Loan, the bank suffered losses $735,758. TARP

suffered a $1.2 million loss on the bank and the bank missed dividend payments of

 $2.2 million.

SIGTARP was joined in the investigation by the Federal Deposit Insurance Corporation

Office of Inspector General. The U.S. Attorney’s Office for the Southern District of

Texas prosecuted the case.

SIGTARP’s Audit Approach

SIGTARP conducts audits over TARP housing programs, helping promote financial

stewardship by the Government. Much of SIGTARP’s audit work is at the request of

members of Congress. SIGTARP specializes in forensic audits that follow the money,

analyzing general ledgers, credit card statements, invoices, and receipts.

SIGTARP assists Treasury in these efforts by auditing and evaluating housing programs

to determine whether the Government is receiving fair value for its money and that

recipients are spending TARP funds appropriately to accomplish the stated goals. To

promote financial stewardship, SIGTARP reports on fraud, waste, and abuse and makes

recommendations to Treasury (which has oversight of all TARP programs) to recover

wasteful spending and prevent future fraud, waste, and abuse.

Travel and Conference Charges to the Hardest Hit Fund that Violated Federal Regulations

In a March 2019 audit, SIGTARP uncovered that state agencies violated federal cost

regulations by charging HHF $411,658 in prohibited travel and conference costs. Remarking

on the findings, Special Inspector General Goldsmith Romero said, “Flying around the

country, staying at luxury hotels, attending conferences beachside and at other vacation

destinations are not ‘must have’ costs for a local foreclosure prevention program.”

SIGTARP’s Recoveries from Audits and Investigations

SIGTARP continues to assess current and future operations to fulfill its mission and

reduce spending, while supporting financial stewardship by providing recoveries to assist

in funding the Government at the least cost over time. SIGTARP’s investigations and audits

have recovered $10 billion. Fiscal Year 2018 recoveries of more than $314 million,

including more than $294 million recovered for the government, are a 9 times return on

investment from the Fiscal Year 2018 appropriated budget. Already in Fiscal Year 2019,

SIGTARP has recovered $804 million, including more than $336 million paid to the government,

a 35 times annual return on investment from the Fiscal Year 2019 appropriated budget.

[Seal - Office of Inspector General, Department of the Treasury]

Office of Inspector General

Department of the Treasury

The Department of the Treasury Office of Inspector General performs independent, objective

reviews of specific Treasury programs and operations with oversight responsibility for one

federal banking agency – the Office of the Comptroller of the Currency. That federal banking

agency supervises approximately 1,260 financial institutions.

Introduction

The Department of the Treasury (Treasury) Office of Inspector General (OIG) was established

pursuant to the 1988 amendments to the Inspector General Act of 1978. The Treasury Inspector

General is appointed by the President, with the advice and consent of the Senate. Treasury

OIG performs independent, objective reviews of Treasury programs and operations, except for

those of the Internal Revenue Service (IRS) and the Troubled Asset Relief Program (TARP),

and keeps the Secretary of the Treasury and Congress fully informed. Treasury OIG is comprised

of four divisions: (1) Office of Audit, (2) Office of Investigations, (3) Office of Counsel,

and (4) Office of Management. Treasury OIG is headquartered in Washington, DC, and has an

audit office in Boston, Massachusetts, and investigative offices in Greensboro, North Carolina;

Houston, Texas; and Jacksonville, Florida.

Treasury OIG has oversight responsibility for the Office of the Comptroller of the Currency

(OCC). OCC is responsible for approximately 891 national banks, 316 federal savings

associations, and 57 federal branches of foreign banks. The total assets under supervision are

$12.5 trillion. Treasury OIG also oversees four offices created by the Dodd-Frank Wall Street

Reform and Consumer Protection Act (Dodd-Frank) which are (1) the Office of Financial Research

(OFR), (2) the Federal Insurance Office, (3) the Office of Minority and Women Inclusion within

Treasury’s Departmental Offices (DO), and (4) the Office of Minority and Women Inclusion within

OCC. Additionally, Treasury OIG oversees Treasury’s role related to the financial solvency of

the Federal National Mortgage Association (Fannie Mae) and the Federal Home Loan Mortgage

Corporation (Freddie Mac) under the Housing and Economic Recovery Act of 2008 (HERA), to

include Treasury’s Senior Preferred Stock Purchase Agreements established for the purpose of

maintaining the positive net worth of both entities.

Treasury Management and Performance Challenges Related to Financial

Regulation and Economic Recovery

In accordance with the Reports Consolidation Act of 2000, the Treasury Inspector General

annually provides the Secretary of the Treasury with his perspective on the most serious

management and performance challenges facing the Department. In a memorandum to the Secretary

dated October 15, 2018, the Inspector General reported three management and performance

challenges that were directed towards financial regulation and economic recovery.

Those challenges are: Operating in an Uncertain Environment, Cyber Threats, and Anti-Money

Laundering and Terrorist Financing/Bank Secrecy Act Enforcement.15

Operating in an Uncertain Environment

The proposed budget cuts and new requirements imposed by Executive Order (EO) 13781,

Comprehensive Plan for Reorganizing the Executive Branch (March 13, 2017) create an uncertain

environment that affect Treasury’s operations. In its implementation of EO 13781 the Office of

Management and Budget (OMB) required agencies to submit Agency Reform Plans to OMB, which

included long-term workforce plans that are in alignment with their strategic plans. These

plans were to include proposals in four categories: eliminate activities; restructure or merge;

improve organizational efficiency and effectiveness; and workforce management. In June 2018,

after consideration of all Agency Reform Plans, OMB developed it comprehensive “Government-

wide Reform Plan and Reorganization Recommendations” (Government-wide Reform Plan) to

reorganize the Executive Branch.

The Government-wide Reform Plan includes a recommendation to transfer alcohol and tobacco

responsibilities from the Bureau of Alcohol, Tobacco, Firearms and Explosives within the

Department of Justice to Treasury’s Alcohol and Tobacco Tax and Trade Bureau (TTB) in order

to leverage the expertise of TTB. Other potential impacts on Treasury include OMB

recommendations to increase coordination and avoid duplication of agency’s roles in the areas

of small business programs, the housing finance market, and financial literacy and education.

Until OMB and agencies begin discussions with Congress to prioritize and refine the proposals

in the Government-wide Reform Plan, there is looming uncertainty as to the plan’s impact.

Nonetheless, the Department must plan for the potential long-term restricting of certain

functions or offices/bureaus and expected budget cuts.

Cyber Threats

Cybersecurity continues to be a long-standing and serious challenge facing the Nation today.

A reliable critical infrastructure, including information systems and networks, is vital to

our national security and economic stability. Cyber threats are a persistent concern as

Treasury’s information systems are critical to the core functions of government and the

Nation’s financial infrastructure. As cyber threats continue to evolve and become more

sophisticated and subtle, they pose an ongoing challenge for Treasury to fortify and safeguard

its internal systems and operations and the financial sector it oversees.

Attempted cyber attacks against Federal agencies, including Treasury, and financial

institutions are increasing in frequency and severity, in addition to continuously evolving.

Such attacks include distributed denial of service attacks, phishing or whaling attacks,

fraudulent wire payments, malicious spam (malspam), and ransomware. Organized hacking groups

leverage published and unpublished vulnerabilities and vary their methods to make attacks hard

to detect and even harder to prevent. Criminal groups and nation-states are constantly seeking

to steal information; commit fraud; and disrupt, degrade, or deny access to information systems.

Effective public-private coordination continues to be required to address the cyber threat

against the Nation’s critical infrastructure. In this regard, Treasury is looked upon to provide

effective leadership to financial institutions in particular, and the financial sector in

general, to strengthen awareness and preparedness against cyber threats. Anti-Money Laundering

and Terrorist Financing/Bank Secrecy Act Enforcement Identifying, disrupting, and dismantling

the financial networks that support terrorists, organized transnational crime, weapons of mass

destruction proliferators, and other threats to international security continue to be a challenge.

Treasury’s Office of Terrorism and Financial Intelligence (TFI) is dedicated to countering the

ability of terrorist organizations to support such activities through intelligence analysis,

sanctions, and international private-sector cooperation that identify donors, financiers, and

facilitators funding terrorist organizations.

Footnote: 15 The Treasury Inspector General’s memorandum included one other challenge not

directly related to financial regulation and economic recovery: Efforts to Promote Spending

Transparency and to Prevent and Detect Improper Payments. The memorandum also discussed concerns

about two matters: currency and coin production and excise tax reform. [End of footnote]

Disrupting terrorist financing depends on a whole-of-government approach and requires

collaboration and coordination within Treasury and with other Federal agencies. Effective

coordination and collaboration and TFI’s ability to effectively gather and analyze intelligence

information on financial crimes and terrorism requires a stable cadre of staff. TFI filled long

standing vacancies such as the Assistant Secretary of Intelligence and Analysis, which is a key

leadership position that had been vacant for approximately 2 years. Stability, experienced

leadership, and coordination within TFI is imperative to enhance information gathering and

intelligence analysis and increase efficiency.

Completed and In-Progress Work on Financial Oversight

OFR’s Procurement Activities – Contracts

We initiated an audit of OFR’s procurement activities. We reported that OFR effectively and

efficiently acquired goods and services to accomplish its mission and those acquisitions were

made in compliance with applicable procurement regulations. We did not make any recommendations

as a result of our audit; however, in light of OFR’s recent workforce restructuring efforts, we

encouraged the Acting Director to ensure the files of OFR’s contracting officer representatives

are maintained and accessible in the event of any changes in contracting officer representatives’

responsibilities.

OCC’s Supervision of Federal Branches of Foreign Banks (In Progress)

We initiated an audit of OCC’s supervision of federal branches of foreign banks. The objective of

this audit is to assess OCC’s supervision of federal branches and agencies of foreign banking

organizations operating in the United States.

OCC’s Supervision of Wells Fargo Bank (In Progress)

We initiated an audit of OCC’s supervision of Wells Fargo Bank’s sales practices. The objectives

of this audit are to assess (1) OCC’s supervision of incentive-based compensation structures within

Wells Fargo and (2) the timeliness and adequacy of OCC’s supervisory and other actions taken

related to Wells Fargo sales practices, including the opening of accounts.

OCC’s Supervision Related to De-risking by Banks (In Progress)

We initiated an audit of OCC’s supervisory impact on the practice of de-risking16 by banks. The

objectives of this audit are to determine (1) whether supervisory, examination, or other staff of

the OCC have indirectly or directly caused banks to exit a line of business or to terminate a

customer or correspondent account, and (2) under what authority OCC plans to limit, through

guidance, the ability of banks to open or close correspondent or customer accounts, including a

review of laws that govern account closings and OCC’s authority to regulate account closings.

OFR’s Hiring Practices (In Progress)

We initiated an audit of OFR’s hiring practices. The objective for this audit is to determine

whether OFR’s hiring practices are in accordance with Office of Personnel Management, Treasury,

OFR, and other Federal requirements.

OCC’s Controls over Purchase Cards (In Progress)

We initiated an audit of OCC’s controls over purchase cards. The objective for this audit is to

assess the controls in place over OCC’s purchase card use and identify any potential illegal,

improper, or erroneous transactions.

Footnote 16: The Financial Action Task Force defines de-risking as the termination or

restriction, by financial institutions, of business relationships with categories of customers.

[End of footnote]

OCC Human Capital Policies and Planning (In Progress)

We initiated an audit of OCC’s human capital policies and resource planning. The objective for

this audit is to determine whether OCC’s human capital policies and planning align with its

mission and strategic goals.

Failed Bank Reviews

In 1991, Congress enacted the Federal Deposit Insurance Corporation Improvement Act (FDICIA)

amending the Federal Deposit Insurance Act (FDIA). The amendments require that banking

regulators take specified supervisory actions when they identify unsafe or unsound practices

or conditions. Also added was a requirement that the Inspector General for the primary federal

regulator of a failed financial institution conduct a material loss review when the estimated

loss to the Deposit Insurance Fund is “material.” FDIA, as amended by Dodd-Frank, defines

the loss threshold amount to the Deposit Insurance Fund triggering a material loss review as

a loss that exceeds $50 million for 2014 and thereafter (with a provision to temporarily raise

the threshold to $75 million in certain circumstances). The act also requires a review of all

bank failures with losses under these threshold amounts for the purposes of (1) ascertaining

the grounds for appointing Federal Deposit Insurance Corporation (FDIC) as receiver and

(2) determining whether any unusual circumstances exist that might warrant a more in-depth

review of the loss. As part of the material loss review, OIG auditors determine the causes of

the failure and assess the supervision of the institution, including the implementation of

the prompt corrective action provisions of the act.17 As appropriate, OIG auditors also make

recommendations for preventing any such loss in the future.

From 2007 through March 2019, FDIC and other banking regulators closed 538 banks and federal

savings associations. One hundred and forty-two (142) of these were Treasury-regulated

financial institutions; in total, the estimated loss to FDIC’s Deposit Insurance Fund for

these failures was $36.4 billion. Of the 142 failures, 58 resulted in a material loss to

the Deposit Insurance Fund, and our office performed the required reviews of these failures.

During the period covered by this annual report, we completed a material loss review of

Washington Federal Bank for Savings (Washington Federal) located in Chicago, Illinois, whose

failure in December 2017 resulted in a loss to the Deposit Insurance Fund estimated at

$82.6 million. We determined that Washington Federal failed because of fraud18 in the bank’s

loan activity perpetrated by bank employees. The fraudulent activity depleted the bank’s

capital, with the result that the bank was insolvent and in an extremely unsafe or unsound

condition to transact business. Regarding supervision, we found that OCC generally performed

examinations of Washington Federal in accordance with laws, regulations and guidance; however,

we identified weaknesses in the execution of OCC’s supervision of the bank that led to missed

opportunities for timely enforcement actions related to the bank’s loan portfolio.

Specifically, we identified the following supervisory weaknesses: (1) the Supervisory Office

and Examiners-in-Charge (EIC) did not provide sufficient supervision of examination staff

comprised mainly of first-time Assistant Examiners-in-Charge (AEIC) and examiners with limited

experience; (2) examiner conclusions were contradicted by documentation in the OCC work papers;

(3) examiners did not act promptly to address significant weaknesses in the loan portfolio

reporting capability of the bank’s management information system; (4) examiners missed red

flags related to Washington Federal’s loan portfolio and resultantly did not timely expand the

core assessment minimum procedures; (5) examiners did not identify and did not report unsafe

or unsound practices that were contrary to agency guidance and bank policy related to the

appraisal program; and (6) examiners did not identify a lack of independence in the bank’s

lending or loan review function.

We recommended the Comptroller of the Currency: (1) assess the need for additional guidance

related to the supervision of non-commissioned examiners by the EIC and the Supervisory

Office including the need to require that supervision be documented; (2) revise examination

guidance to clarify the roles and responsibilities of an EIC in supervising an examination

team, with an emphasis on reviewing work papers and confirming that conclusions in work papers

are supported by the documentation; (3) reinforce to examiners and provide training where

necessary to ensure they understand: (a) the requirements of OCC Bulletin 2000-20 and the

importance of the bank maintaining sufficient loan portfolio reporting for extensions,

deferrals, renewals, and rewrites of closed-end loans; (b) that bank assurances made to

examiners regarding deficiencies being resolved should be viewed with skepticism unless

support for the assurances is provided and the examiner validates the effectiveness of the

bank’s corrective actions, especially when the deficiencies result in noncompliance with

regulation or law; (c) that expanded procedures are recommended when an examination team is

comprised of examiners in training positions and those with limited experience, including

AEICs; (d) that expanded procedures are recommended for banks, or examination areas, that

are consistently considered low risk; (e) the need to identify and report appraisal exceptions

as required by the Interagency Appraisal and Evaluation Guidelines; and (f ) the need to

identify and address issues of independence in small banks where employees or board members

are participating in more than one function or committee.

Footnote 17: Prompt corrective action is a framework of supervisory actions for insured

institutions that are not adequately capitalized. It was intended to ensure that action is

taken when an institution becomes financially troubled in order to prevent a failure or

minimize the resulting losses. These actions become increasingly severe as the institution

falls into lower capital categories. The capital categories are well-capitalized, adequately

capitalized, undercapitalized, significantly undercapitalized, and critically undercapitalized.

[End of footnote]

Footnote 18: The use of this term “fraud” comes from OCC’s finding in its Supervisory

Memorandum. As of the date of the issuance of this material loss review report (November 7,

2018), no criminal or civil judicial finding of fraud has been made and applied to the bank’s

activities[End of footnote]

[Cover page]

Council of Inspectors General on Financial Oversight

Top Management and Performance Challenges Facing Financial Regulatory Organizations

Approved July 2019

[Images of OIG seals: Board of Governors of the Federal Reserve System Consumer Financial

Protection Bureau, Commodity Futures Trading Commission, Federal Deposit Insurance

Corporation, Federal Housing Finance Agency, United States Department of Housing and

Urban Development, National Credit Union Administration, U.S. Securities and Exchange

Commission, Troubled Asset Relief Program, Treasury]

Top Management and Performance Challenges Facing Financial-Sector Regulatory Organizations

Council of Inspectors General on Financial Oversight

[End of Cover page]

EXECUTIVE SUMMARY

Purpose

The purpose of this report is to consolidate and provide insight into cross-cutting

management and performance challenges facing Financial-Sector Regulatory Organizations in

2019, as identified by members of CIGFO.

Approach

Following a review of 10 TMPC reports issued by CIGFO members, we synthesized the primary

areas of concern facing Financial-Sector Regulatory Organizations. We sought to identify

common insights within the financial sector.

CIGFO Members

• Department of the Treasury (Chair)

• Federal Deposit Insurance Corporation

• Federal Housing Finance Agency

• Commodity Futures Trading Commission

• Department of Housing and Urban Development

• Board of Governors of the Federal Reserve System and the Bureau of Consumer

Financial Protection

• National Credit Union Administration

• Securities and Exchange Commission

• Special Inspector General for the Troubled Asset Relief Program

The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd- Frank Act)

established the Council of Inspectors General on Financial Oversight (CIGFO) to

oversee the Financial Stability Oversight Council (FSOC) and suggest measures to

improve financial oversight. FSOC has a statutory mandate that created collective

accountability for identifying risks and responding to emerging threats to U.S.

financial stability.

The Inspectors General within CIGFO report annually on the Top Management and

Performance Challenges (TMPC) facing their respective Financial-Sector Regulatory

Organizations. This is CIGFO’s second report reflecting the collective input from

the Inspectors General in CIGFO and identifying cross-cutting Challenges facing

multiple Financial-Sector Regulatory Organizations. This report reiterates the

six challenges from our 2018 report and includes an additional challenge for 2019

– Improving Contract and Grant Management.

• Enhancing Oversight of Financial Institution Cybersecurity

• Managing and Securing Information Technology at Regulatory Organizations

• Sharing Threat Information

• Ensuring Readiness for Crises

• Strengthening Agency Governance

• Managing Human Capital

• Improving Contract and Grant Management

It is important to address the Challenges in this report because financial- sector

activities – such as consumer and commercial banking, and funding, liquidity and

insurance services – were identified by the Department of Homeland Security,

Cybersecurity and Infrastructure Security Agency, as National Critical Functions.

Those functions are so vital to the United States that any disruption, corruption,

or dysfunction would have a debilitating effect on U.S. security, the national

economy, and/or public health and safety.

Although Financial-Sector Regulatory Organizations have individual missions, this

report emphasizes the importance of addressing challenges holistically through

coordination and information sharing. Considering issues on a whole-of-Government

approach versus a siloed, agency-by-agency basis allows for more effective and

efficient means to address Challenges through a coordinated approach.

By consolidating and reporting these Challenges, CIGFO aims to inform FSOC,

regulatory organizations, Congress, and the American public of the cross-cutting

Challenges facing the financial sector.

[End of EXECUTIVE SUMMARY]

TABLE OF CONTENTS

BACKGROUND AND OBSERVATIONS

CHALLENGE 1: ENHANCING OVERSIGHT OF FINANCIAL INSTITUTION CYBERSECURITY

CHALLENGE 2: MANAGING AND SECURING INFORMATION TECHNOLOGY AT REGULATORY ORGANIZATIONS

CHALLENGE 3: SHARING THREAT INFORMATION

CHALLENGE 4: ENSURING READINESS FOR CRISES

CHALLENGE 5: STRENGTHENING AGENCY GOVERNANCE

CHALLENGE 6: MANAGING HUMAN CAPITAL

CHALLENGE 7: IMPROVING CONTRACT AND GRANT MANAGEMENT

CONCLUSION

APPENDIX 1: ABBREVIATIONS AND ACRONYMS

APPENDIX 2: METHODOLOGY .

[End of TABLE OF CONTENTS]

BACKGROUND AND OBSERVATIONS

The Dodd-Frank Act established CIGFO to oversee FSOC and suggest measures to

improve financial oversight. FSOC has a statutory mandate that established

collective accountability for identifying risks and responding to emerging

threats to U.S. financial stability.

CIGFO meets regularly to facilitate the sharing of information among Inspectors

General, with a focus on concerns that affect the financial sector and ways to

improve financial oversight. CIGFO publishes an annual report that describes

the concerns and recommendations of each Inspector General and a discussion of

ongoing and completed oversight work. Additionally, Congress authorized CIGFO

to convene working groups to evaluate FSOC’s effectiveness and internal

operations.

CIGFO members include the Inspectors General of the Department of the Treasury,

the Federal Deposit Insurance Corporation, the Commodity Futures Trading

Commission, the Department of Housing and Urban Development, the Board of

Governors of the Federal Reserve System and the Bureau of Consumer Financial

Protection, the Federal Housing Finance Agency, the National Credit Union

Administration, the Securities and Exchange Commission, and the Special

Inspector General for the Troubled Asset Relief Program. CIGFO members

oversee one or more Financial-Sector Regulatory Organizations, as shown in

Figure 1.

Figure 1: CIGFO Membership & Oversight Responsibilities

Table

Row 1;

CIGFO MEMBERSHIP: Department of the Treasury (Chair);

OVERSIGHT OF FINANCIAL- SECTOR REGULATORY ORGANIZATIONS: • Department of the

Treasury • Office of the Comptroller of the Currency;

Row 2;

CIGFO MEMBERSHIP: Federal Deposit Insurance Corporation;

OVERSIGHT OF FINANCIAL- SECTOR REGULATORY ORGANIZATIONS: Federal Deposit

Insurance Corporation;

Row 3;

CIGFO MEMBERSHIP: Commodity Futures Trading Commission;

OVERSIGHT OF FINANCIAL- SECTOR REGULATORY ORGANIZATIONS: Commodity Futures

Trading Commission;

Row 4;

CIGFO MEMBERSHIP: Department of Housing and Urban Development;

OVERSIGHT OF FINANCIAL- SECTOR REGULATORY ORGANIZATIONS: Department of Housing

and Urban Development;

Row 5;

CIGFO MEMBERSHIP: Board of Governors of the Federal Reserve System and Bureau of

Consumer Financial Protection;

OVERSIGHT OF FINANCIAL- SECTOR REGULATORY ORGANIZATIONS: • Board of Governors of

the Federal Reserve System • Bureau of Consumer Financial Protection;

Row 6;

CIGFO MEMBERSHIP: Federal Housing Finance Agency;

OVERSIGHT OF FINANCIAL- SECTOR REGULATORY ORGANIZATIONS: Federal Housing Finance

Agency;

Row 7;

CIGFO MEMBERSHIP: National Credit Union Administration;

OVERSIGHT OF FINANCIAL- SECTOR REGULATORY ORGANIZATIONS: National Credit Union

Administration;

Row 8;

CIGFO MEMBERSHIP: Securities and Exchange Commission;

OVERSIGHT OF FINANCIAL- SECTOR REGULATORY ORGANIZATIONS: Securities and Exchange

Commission;

Row 9;

CIGFO MEMBERSHIP: Special Inspector General for the Troubled Asset Relief Program;

OVERSIGHT OF FINANCIAL- SECTOR REGULATORY ORGANIZATIONS: Special Inspector General

for the Troubled Asset Relief Program;

[End of table]

[End of Figure 1: CIGFO Membership & Oversight Responsibilities]

The Inspectors General within CIGFO, as well as the Inspectors General of other

agencies, annually identify what they consider to be the TMPCs facing their

agency. Each Inspector General’s TMPCs generally appear in the host Agency’s

annual performance and accountability report under the Reports Consolidation

Act of 2000.

On March 26, 2019, CIGFO approved a motion to compile a report identifying the top

Challenges facing Financial-Sector Regulatory Organizations. The Federal Deposit

Insurance Corporation (FDIC) Office of Inspector General (OIG) led the working

group to conduct this analysis and compile this report.

This CIGFO report reflects the collective input from the nine CIGFO Member

Inspectors General and identifies cross-cutting Challenges facing multiple

Financial-Sector Regulatory Organizations. The report reiterates the six

challenges from our September 2018 report, Top Management and Performance

Challenges Facing Financial Regulatory Organizations, with an additional

Challenge for 2019 – Improving Contract and Grant Management.

• Enhancing Oversight of Financial Institution Cybersecurity

• Managing and Securing Information Technology at Regulatory Organizations

• Sharing Threat Information

• Ensuring Readiness for Crises

• Strengthening Agency Governance

• Managing Human Capital

• Improving Contract and Grant Management

This report identifies significant financial-sector cybersecurity challenges.

Financial-Sector Regulatory Organizations are faced with responsibilities to

protect the information held by their respective agencies against cyber attacks,

and to ensure that financial institutions and their third-party service providers

have processes in place to mitigate cyber risks. Financial-Sector Regulatory

Organizations must take a holistic, financial sector-wide view to address

cybersecurity threats because a security incident for any participant has the

possibility of infecting the entire financial sector.

Identifying threats, such as cyber risk and other vulnerabilities, requires the

sharing of information among Government agencies and throughout the entire

financial sector. Financial-Sector Regulatory Organizations face challenges to

ensure effective gathering, analysis, and sharing of timely and actionable threat

information. Absent such threat information, financial sector participants may

not have a full understanding of the risks. This could result in informational

gaps that can negatively impact risk mitigation and supervisory strategies and/or

the financial sector. Financial-Sector Regulatory Organizations must also mitigate

risks and stand ready when necessary to address threats that may escalate into a

crisis. This report observes that Financial-Sector Regulatory Organizations must

ensure that plans and resources are in place to address such crises.

Financial-Sector Regulatory Organizations also face Challenges to govern their

internal operations. Controls should be in place to manage Financial-Sector

Regulatory Organizations appropriately, including ensuring a sufficient workforce

with skillsets to achieve organization missions. Further, controls should be in

place to manage contract and grant funding so that organizations receive

appropriate goods and services and grantees use funds as prescribed by statute

and regulation.

Although Financial-Sector Regulatory Organizations have individual missions, this

report emphasizes the importance of addressing challenges holistically through

coordination and information sharing. Considering issues on a whole-of-Government

approach versus a siloed, agency-by-agency basis allows for more effective and

efficient means to address challenges through a coordinated approach. By

consolidating and reporting these Challenges, CIGFO aims to inform FSOC,

regulatory organizations, Congress, and the American public of the cross-

cutting Challenges facing the financial sector.

[End of BACKGROUND AND OBSERVATIONS]

CHALLENGE 1: ENHANCING OVERSIGHT OF FINANCIAL INSTITUTION CYBERSECURITY

Cybersecurity continues to be a critical risk facing the financial sector. FSOC

recognized in its December 2018 Annual Report that as financial institutions

increase their reliance on technology, there is an increased risk that a

cybersecurity event could have “severe negative consequences, potentially

entailing systemic implications for the financial sector and the U.S. economy.”1

The Office of the Comptroller of the Currency (OCC) echoed this sentiment in its

Semiannual Risk Perspective (Fall 2018), finding that cybersecurity threats

“target operational vulnerabilities that could expose large quantities of

personally identifiable information (PII)2 and proprietary intellectual property,

facilitate misappropriation of funds and data at the retail and wholesale levels,

corrupt information, and disrupt business activities.”3

Footnote 1: The Dodd-Frank Wall Street Reform and Consumer Protection Act of

2010 established FSOC, which has responsibility for identifying risks and

responding to emerging threats to financial stability. FSOC brings together

the expertise of Federal financial regulators, an independent insurance expert,

and state regulators. [End of footnote]

Footnote 2: According to OMB Memorandum 07-16, Safeguarding Against and

Responding to the Breach of Personally Identifiable Information, the term

PII refers to information that can be used to distinguish or trace an

individual's identity, such as their name, Social Security Number, biometric

records, etc. alone, or when combined with other personal or identifying

information that is linked or linkable to a specific individual, such as

date and place of birth, mother’s maiden name, etc. [End of footnote]

Footnote 3: OCC Semiannual Risk Perspective (Fall 2018). [End of footnote]

In February 2018, the White House Council of Economic Advisors estimated that

the United States economy loses between $57 and $109 billion per year to

malicious cyber activity. Cyberattacks—such as distributed denial of service

and ransomware—may be global in nature and have disrupted financial services

in several countries around the world.4 Verizon Communications’ 2019 annual

review of global data breaches across multiple sectors, including the

financial sector, reported that there were more than 41,000 security incidents

and 2,000 data breaches across 65 countries between April 2018 and April

2019.5 This review also found that cyberattacks happen very quickly, with

breaches occurring within seconds, and breach discovery taking months.

Footnote 4: World Bank Group, Financial Sector’s Cybersecurity: Regulations

and Supervision (2018). [End of footnote]

Footnote 5: Verizon Communications Inc., 2019 Verizon Communications Data

Breach Investigations Report, 11th Edition (April 2019). [End of footnote]

A 2018 study by the U.S. Chamber of Commerce and FICO (Fair Isaac

Corporation) evaluated the cyber risk at 2,574 U.S. firms across 10

sectors, including the financial sector. This study provided cybersecurity

ranking scores from 300 (high risk) to 850 (low risk) for each sector as

well as a national average. The cyber risks faced by the finance and banking

sector exceeded eight other sectors and the national average, as shown in

Figure 2.

Figure 2: Cyber Risk Scores Across Ten Sectors

Agriculture & Food 671,

Business Services 704,

Construcion 764,

Energy & Utilities 707,

Finance and Banking 642,

Transportation 709,

Retail and Consumer Services 697,

Media Telecom Tech 619,

Materials & Manufacturing 672,

Health Care 679.

[End of Figure 2: Cyber Risk Scores Across Ten Sectors]

Financial-Sector Regulatory Organizations are responsible for examining financial

institutions to identify Information Technology (IT) risks. The Interagency

Guidelines Establishing Information Security Standards for bank regulators

states that an insured financial institution must “implement a comprehensive

written information security program that includes administrative, technical,

and physical safeguards appropriate to the size and complexity of the institution

and the nature and scope of its activities.”6 Most Financial-Sector Regulatory

Organizations7 conduct IT examinations using the Uniform Rating System for

Information Technology created by the Federal Financial Institutions Examination

Council (FFIEC).8 The primary purpose of the rating system is to assess risks

introduced by IT at institutions and service providers, and to identify those

institutions requiring supervisory attention.9 When examinations identify risks

and weak management practices at institutions, regulators may use enforcement

procedures to address such risks.

Footnote 6: See 12 C.F.R. Part 364, Appendix B and 12 C.F.R. Part 748. The FDIC,

OCC, and Board of Governors of the Federal Reserve issued the Interagency

Guidelines Establishing Information Security Standards. [End of footnote]

Footnote 7: The National Credit Union Administration does not use the Uniform

Rating System for Information Technology. [End of footnote]

Footnote 8: The FFIEC was established on March 10, 1979, pursuant to title X

of the Financial Institutions Regulatory and Interest Rate Control Act of 1978,

Public Law 95-630. The Council is an interagency body empowered to prescribe

uniform principles, standards, and report forms for the federal examination of

financial institutions by the Board of Governors of the Federal Reserve System,

the FDIC, the National Credit Union Administration, the OCC, and the Bureau of

Consumer Financial Protection and to make recommendations to promote uniformity

in the supervision of financial institutions.[End of footnote]

Footnote 9: FFIEC, Uniform Rating System for Information Technology, 64 Fed.

Reg. 3109 (January 20, 1999). [End of footnote]

CIGFO members identified Challenges to keep pace with the changing cybersecurity

landscape. The Federal Housing Finance Agency (FHFA) OIG identified that the

FHFA will be challenged to design and implement supervisory activities for the

financial institutions it supervises. Specifically, the FHFA must ensure that

cybersecurity examination modules are updated in response to changes in the

cybersecurity environment. The FHFA must also recruit and retain a complement

of examiners with the experience and expertise needed to conduct IT examinations,

and ensure those examiners have ongoing training. Similarly, the Board of

Governors of the Federal Reserve System (Federal Reserve Board) and Bureau of

Consumer Financial Protection (Bureau) OIG noted that the Federal Reserve Board

is challenged to ensure that supervised financial institutions manage and

mitigate the risks and vulnerabilities of cyberattacks. The Federal Reserve

Board should ensure that its supervisory approaches keep pace with evolving

cybersecurity threats.

The FDIC OIG also identified cybersecurity as a significant challenge to FDIC-

supervised institutions. The FDIC must ensure the effectiveness and efficiency

of its IT examination work programs. One example would be using data to review

and understand cybersecurity risks across all institutions. The FDIC is also

challenged to have the appropriate number of IT examiners and to keep its

examination staff skillsets up-to-date given the increasing complexity and

sophistication of IT environments at banks. Similarly, the National Credit

Union Administration (NCUA) OIG also noted cybersecurity as a continued and

significant challenge to the stability and soundness of the credit union

industry. The NCUA OIG believes the NCUA must acquire and deploy resources

to enhance its oversight capabilities to maintain safety and soundness.

Financial institutions face increased cybersecurity risk through inter-

connections with financial technology companies. The Group of Twenty’s

Financial Stability Board defined financial technology as “innovation that

could result in new business models, applications, processes, or products

with an associated material effect on financial markets and institutions

and the provision of financial services.”10 Financial technology innovation

includes, for example, mobile wallets, digital currencies, and digital

financial advice.11 The rapid pace of financial technology is being driven

by capital investment, demand for speed and convenience, and

digitization.12 According to the Department of the Treasury (Treasury

Department), from 2010 to 2017, more than 3,330 new technology companies

were formed to serve the financial industry.13 The Treasury Department

also estimated that one-third of online U.S. consumers use at least two

financial technology services—including financial planning, savings and

investment, online borrowing, or some form of money transfer and

payment.14 Further, KPMG estimated that global investment in financial

technology was $57.9 billion in just the first 6 months of 2018.15

Footnote 10: Financial Stability Implications from FinTech, Supervisory

and Regulatory Issues That Merit Authorities’ Attention, (June 27, 2017).

The Financial Stability Board (FSB) was chartered by the Group of Twenty

(G20) on September 25, 2009. The G20 Members include Argentina, Australia,

Brazil, Canada, China, France, Germany, India, Indonesia, Italy, Japan,

Republic of Korea, Mexico, Russia, Saudi Arabia, South Africa, Turkey,

the United Kingdom, the United States, and the European Union (plus Hong

Kong, Singapore, Spain, and Switzerland). The FSB charter aims to promote

global financial stability by coordinating the development of regulatory,

supervisory and other financial-sector policies and conducts outreach to

non-member countries. The G20 members represent about two-thirds of the

world’s population, 85 percent of global gross domestic product, and over

75 percent of global trade. [End of footnote]

Footnote 11: Basel Committee on Banking, Sound Practices – Implications

of Fintech Developments for Banks and Bank Supervisors (February 2018).

[End of footnote]

Footnote 12: Department of the Treasury, A Financial System that Creates

Economic Opportunities: Nonbank Financials, Fintech, and Innovation (July

2018); Basel Committee on Banking, Sound Practices – Implications of

Fintech Developments for Bank and Bank Supervisors (February 2018). [End

of footnote]

Footnote 13: A Financial System That Creates Economic Opportunities:

Nonbank Financials, Fintech, and Innovation (July 2018). [End of footnote]

Footnote 14: A Financial System That Creates Economic Opportunities:

Nonbank Financials, Fintech, and Innovation (July 2018). [End of footnote]

Footnote 15: KPMG, The Pulse of Fintech 2018: Biannual Global Analysis of

Investment in Fintech (July 2018). KPMG is a professional services company.

[End of footnote]

Financial technology companies are interconnected with IT systems at banks,

yet these technology companies may not be subjected to regulatory requirements

for safety and soundness and may not be examined by financial regulators.

Certain banks reported that between 20 and 40 percent of online banking

logins are attributable to financial technology companies, and many banks

represented that they cannot distinguish among computer logins, as to whether

they originate from consumers, data aggregators, or even malicious actors.16

IT system interconnections may provide a pathway for a cybersecurity incident

at a financial technology company to infect the banking system.

Footnote 16: Lael Brainard, Member, Board of Governors of the Federal Reserve

System, Where Do Banks Fit in the Fintech Stack? Remarks delivered at the

Northwestern Kellogg Public-Private Interface Conference on “New Developments

in Consumer Finance: Research & Practice” (April 29, 2017). [End of footnote]

Additionally, when financial institutions have multiple financial technology

services and relationships, they face ambiguity and uncertainty as to the

applicability of certain privacy rules, the Bank Secrecy Act provisions and

regulations, and Anti-Money Laundering standards. Banks and credit unions

may be unsure as to whether they or the service provider must comply with

rules, regulations, and requirements. Moreover, financial institutions face

challenges to have sufficient skilled staff and capabilities to monitor

these risks and operations of financial technology companies.

The FDIC OIG stated that the FDIC faces challenges to ensure that banks have

proper governance and risk management practices around these technologies.

The FDIC may need to increase training and adjust staffing to ensure that

examiners have the skills to effectively supervise the risks involved with

new technology. Further, the FDIC may need to modify examination policies

and procedures that pre-date financial innovation to improve supervision of

financial innovation risk. The NCUA OIG stated that the NCUA faces

significant challenges with technology-driven changes in the financial

landscape that could potentially impact the safety and soundness of the

credit union system and the Share Insurance Fund. The NCUA OIG believes

it is imperative that the NCUA’s examination and supervision program

continues to evolve with emerging financial technologies that represent

not only risks, but also opportunities to the credit union system.

Mitigating Third-Party Service Provider Risk

Banks and credit unions frequently hire third-party Technology Service

Providers (TSP) to perform operational functions on behalf of the financial

institution—such as IT operations and business product lines. TSPs may

further sub-contract services to other vendors. According to the OCC, banks

are increasingly reliant upon TSPs and sub-contractors, and such dependence

creates a high level of risk for the banking industry.17 The OCC indicates

that TSPs are increasingly targets for cybercrimes and espionage and may

provide avenues for bad actors to exploit a bank’s systems and operations.

For example, on December 20, 2018, the Department of Justice announced that

two Chinese nationals were charged with computer intrusion offenses harming

more than 45 service providers whose clients included the banking and finance

industry and the U.S. Government. The hackers targeted service providers in

order to gain unauthorized access to the computer networks of their clients

and steal intellectual property and confidential business information.18

Footnote 17: The FFIEC described the term TSP to include “independent third

parties, joint venture/limited liability corporations, and bank and credit

union service corporations that provide processing services to financial

institutions.” Supervision of Technology Service Providers, FFIEC IT

Examination Handbook InfoBase. [End of footnote]

Footnote 18: Department of Justice Press Release, Two Chinese Hackers

Associated With the Ministry of State Security Charged with Global Computer

Intrusion Campaigns Targeting Intellectual Property and Confidential

Business Information (December 20, 2018). [End of footnote]

A financial institution must manage the interconnections, system interfaces,

and systems access of TSPs and sub-contractors and must implement appropriate

controls.19 Significant consolidation among TSPs caused large numbers of banks

to rely on a few large service providers for core systems and operations

support.20 As a result, a cybersecurity incident at one TSP has the potential

to affect multiple financial institutions.21 A financial institution’s Board

of Directors and senior managers are responsible for the oversight of

activities conducted by a TSP on their behalf to the same extent as if the

activity were handled within the institution.22

Footnote 19: OCC Semiannual Risk Perspective (Spring 2018). [End of footnote]

Footnote 20: OCC Semiannual Risk Perspective (Spring 2018).  [End of footnote]

Footnote 21: OCC Semiannual Risk Perspective (Spring 2018). [End of footnote]

Footnote 22: Financial Institution Letter 44-2008, Guidance for Managing

Third-Party Risk (June 6, 2008). [End of footnote]

The Federal Reserve Board and Bureau OIG identified the need for the Federal

Reserve Board to enhance its oversight of firms that provide technology

services to supervised institutions. Specifically, the Federal Reserve Board

can enhance its oversight by implementing an improved governance structure

and providing additional guidance to examination teams on the supervisory

expectations for such firms. The FDIC OIG also noted challenges with FDIC-

supervised institutions’ oversight of the TSPs with whom they do business.

The FDIC must ensure that supervised financial institutions assess TSP

cybersecurity risks, including due diligence of cybersecurity contract terms.

Financial-Sector Regulatory Organizations play a vital role in addressing

financial institutions’ cybersecurity risk which, if left unchecked, could

threaten the safety and soundness of institutions as well as the stability

of the financial system. Financial-Sector Regulatory Organizations must

ensure that IT examinations assess how financial institutions manage cyber-

security risks, including risks associated with TSPs and new financial

technology, and address such risks through effective supervisory strategies.

[End of CHALLENGE 1: ENHANCING OVERSIGHT OF FINANCIAL INSTITUTION CYBERSECURITY]

CHALLENGE 2: MANAGING AND SECURING INFORMATION TECHNOLOGY AT REGULATORY

ORGANIZATIONS

In March 2019, the Government Accountability Office (GAO) identified

securing Federal systems and information as a high-risk area in need of

significant attention.23 An Office of Management and Budget (OMB) and

Department of Homeland Security (DHS) review of Federal cybersecurity

capabilities at 96 civilian agencies across 76 metrics found that 74

percent (71 agencies) had cybersecurity programs that were either “At

Risk” or “High Risk.24 Further, the Government sector represented a

total of 56 percent of the over 41,000 cybersecurity incidents

identified by Verizon Communications in its 2019 annual review of

global data breaches across multiple sectors.25

Footnote 23: U.S. Government Accountability Office, High-Risk Series:

Substantial Efforts Needed to Achieve Greater Progress on High-Risk Areas,

GAO-19-157SP (March 2019). [End of footnote]

Footnote 24: Federal Cybersecurity Risk Determination Report and Action

Plan (May 2018). “At Risk” meant that some essential policies, processes,

and tools were in place to mitigate overall cybersecurity risk, but

significant gaps remained; while “High Risk” meant that fundamental cyber-

security policies, processes, and tools were either not in place or not

deployed sufficiently. [End of footnote]

Footnote 25: Verizon Communications Inc., 2019 Verizon Communications Data

Breach Investigations Report, 11th Edition (April 2019). [End of footnote]

Financial-Sector Regulatory Organizations’ IT systems house commercially

valuable and market sensitive information. For example, the Securities and

Exchange Commission (SEC) OIG reported that the SEC’s e-Discovery program

alone is approaching one petabyte of data.26 Financial-Sector Regulatory

Organizations may also house significant amounts of personally identifiable

information for bank and credit union officials, depositors, and borrowers.

Without proper safeguards, those IT systems are vulnerable to individuals

and groups with malicious intentions who can intrude and use their access

to obtain sensitive information, commit fraud and identify theft, disrupt

operations, or launch attacks against other computer systems and networks.

Further, interconnections among Financial-Sector Regulatory Organizations

and other Federal and state government agencies or private-sector

institutions increase the likelihood of contagion in which a cybersecurity

incident occurring anywhere within the systems may negatively impact the

entire financial system.27

Footnote 26: One petabyte of data is roughly the equivalent to the amount

that can be stored in about 20 million four-drawer filing cabinets. U.S.

Government Accountability Office, Military Base Realignments and Closures:

The National Geospatial-Intelligence Agency’s Technology Center Construction

Project, GAO-12-770R, (June 29, 2012). [End of footnote]

Footnote 27: Financial Services Sector-Specific Plan 2015 issued jointly

among the Department of the Treasury, Department of Homeland Security,

and the Financial Services Sector Coordinating Council. [End of footnote]

Securing IT from Evolving Threats

According to the GAO, risks to Federal IT systems are increasing.28 Threats

to Federal IT systems include those from witting or unwitting employees as

well as global threats from nation states.29 Federal agencies must develop,

document, and implement department- and agency-wide information security

programs to protect information and information systems.30 Federal agencies

use a common framework developed by the National Institute of Standards and

Technology to manage their cyber risk.31

Footnote 28: GAO, Cybersecurity Challenges Facing the Nation – High Risk

Issue. [End of footnote]

Footnote 29: Worldwide Threat Assessment of the US Intelligence Community,

January 29, 2019 [End of footnote]

Footnote 30: Federal Information Security Modernization Act of 2014,

Public Law No. 113-283. [End of footnote]

Footnote 31: Executive Order 13800, Strengthening the Cybersecurity of

Federal Networks and Critical Infrastructure, May 11, 2017. [End of footnote]

The Department of Housing and Urban Development (HUD) OIG recognized that

HUD faces challenges in the management and oversight of its IT systems. HUD

has demonstrated an inability to incorporate Federally mandated requirements

and key practices into effective operational management of its IT systems.

Persistent IT management challenges have affected HUD’s ability to manage and

oversee key programs. As a result, IT systems vulnerabilities that could lead

to breaches exist within HUD’s IT environment. Since 2007, HUD OIG has made

483 recommendations to HUD management to address IT challenges and 197 of

those recommendations remain open or unresolved.

The FDIC OIG found that the FDIC must continue to strengthen its

implementation of governance and security controls around its IT systems to

ensure proper safeguarding of information. The FDIC OIG identified security

control weaknesses that limited the effectiveness of the FDIC’s information

security program and practices and placed the confidentiality, integrity,

and availability of the FDIC’s information systems and data at risk. For

example, the FDIC had not fully defined or implemented an enterprise-wide

and integrated approach to identifying, assessing, and addressing the full

spectrum of internal and external risks, including those related to cyber

-security and the operation of information systems.

The Federal Reserve Board and Bureau OIG noted that the Federal Reserve

Board’s decentralized IT services results in an incomplete view of security

risks facing the agency as a whole, which impacts the implementation of

an effective information security program. The Federal Reserve Board also

faces challenges in implementing agency-wide processes for managing

vulnerabilities and software inventories. The Federal Reserve Board and

Bureau OIG also found that the Bureau faces challenges in centralizing

and automating processes to better manage insider risks; ensuring that

automated feeds from all systems, including contractor-operated systems,

feed into the Bureau’s security information and event management tool; and

aligning its information security program, policies, and procedures with

the agency’s evolving enterprise risk management program.

The Treasury Department OIG noted challenges with the mitigation of

risks to the Treasury Department’s IT systems posed by interconnection

agreements with other Federal, State, and local agencies as well as third-

party cloud service providers. Similarly, the FHFA OIG found that the

FHFA needs to ensure that access to its internal and external online

collaborative environment is restricted to those with a need for the

information.

The SEC OIG also noted that the SEC must mature its IT security programs

to minimize risks of unauthorized disclosure, modification, use, and

disruption of the SEC’s non-public information. Specifically, the SEC can

improve its management of IT risks, including access, continuous monitoring,

and incident management. Further, the SEC could better manage information

security risks of outside expert services contractors who have access to

sensitive, non-public information.

Modernizing IT Systems

Some Financial-Sector Regulatory Organizations are relying on systems that

are outdated, cannot be adapted to handle increasingly complex tasks, and

are no longer supported by vendors. According to the GAO, use of such systems

increases the vulnerability of unauthorized access to the information within

those systems.32

Footnote 32: U.S. Government Accountability Office, Information Security:

SEC Improved Control of Financial Systems but Needs to Take Additional Actions,

GAO-17-469 (July 2017). [End of footnote]

HUD OIG reported that HUD is using aging technology for most of its

operations – technology that was implemented dating back to 1974. Many of

HUD’s systems remain at risk of failure or exploitation because critical

vendor fixes or updates are no longer available. That situation increases

the risk of possible HUD data breaches. Further, HUD’s legacy systems are

very costly to maintain because of the specialized skills and support needed

to operate them. Over the last 5 years, HUD spent on average 70 to 95 percent

of its $280 million annual IT budget on operations and maintenance.

Similarly, the U.S. Commodity Futures Trading Commission (CFTC) OIG

identified that the CFTC faces challenges because it has not formalized IT

capital planning. Specifically, the CFTC has not established accountabilities

to eliminate manual-intensive legacy systems, reduce high-cost IT functions,

and adopt a modern IT infrastructure. CFTC OIG noted that IT modernization

efforts could yield cost savings and technological efficiencies during

periods of fiscal austerity.

The Treasury Department OIG also noted the impact of uncertain budgetary

funding on the Treasury Department’s IT modernization efforts. The Treasury

Department is challenged to balance cybersecurity requirements with

expenditures for the modernization and maintenance of existing Treasury

Department IT systems.

Enhancing the IT Security Workforce

According to the GAO, “a key component of mitigating and responding to cyber

threats is having a qualified, well-trained cybersecurity workforce.”33 The

GAO has identified, however, that there are cybersecurity workforce skills

gaps across the Federal Government.34

Footnote 33: U.S. Government Accountability Office, Cybersecurity Workforce:

Agencies Need to Improve Baseline Assessments and Procedures for Coding

Positions, GAO-18-466 (June 2018). [End of footnote]

Footnote 34: U.S. Government Accountability Office, High-Risk Series:

Substantial Efforts Needed to Achieve Greater Progress on High-Risk Areas,

GAO-19-157SP (March 2019). [End of footnote]

CIGFO members identified mission challenges related to cybersecurity skills

gaps. The Treasury Department OIG found that many IT security measures lacked

adequate cybersecurity resources and/or management oversight. Similarly, HUD

OIG noted that the maintenance of many of HUD’s systems requires specialized

skills. HUD OIG further noted that turnover among senior leadership and

resource constraints hindered the completion of three IT modernization

projects totaling approximately $370 million.

Cybersecurity threats against Government agencies continue to increase.

Financial-Sector Regulatory Organizations must remain vigilant in their

efforts to institute necessary controls and properly protect the information

entrusted to them.

[End of CHALLENGE 2: MANAGING AND SECURING INFORMATION TECHNOLOGY AT

REGULTORY ORGANIZATIONS]

CHALLENGE 3: SHARING THREAT INFORMATION

On November 16, 2018, the President signed into law the Cybersecurity and

Infrastructure Security Agency Act of 2018 (Act). The Act established the

Cybersecurity and Infrastructure Security Agency (CISA) within the DHS to,

among other things, make the United States cyber and physical infrastructure

more secure by sharing information at all levels of Government and the

private and non-profit sectors.35

Footnote 35: Cybersecurity and Infrastructure Security Act of 2017, House

Report 115-454, 115th Congress, December 11, 2017. [End of footnote]

On April 30, 2019, the CISA published a list of National Critical Functions,

which were defined as, “[t]he functions of government and private sector so

vital to the United States that their disruption, corruption, or dysfunction

would have a debilitating effect on security, national economic security,

national public health or safety, or any combination thereof.”36 The provision

of consumer and commercial banking, funding and liquidity services,

and insurance services were included on the list of National Critical

Functions.37 Rather than relying on prior, sector-specific or asset-based

risk identification, the National Critical Functions construct looks across

sectors to provide a holistic approach to capture risks and dependencies within

and across sectors.38 As shown in Figure 3, the National Critical

Functions are presented in four overarching areas – connect, distribute,

manage, and supply.

Footnote 36: National Critical Functions – An Evolved Lens for Critical

Infrastructure and Security Resilience, DHS Cybersecurity and Infrastructure

Security Agency, April 30, 2019. [End of footnote]

Footnote 37: National Critical Functions – An Evolved Lens for Critical

Infrastructure and Security Resilience, DHS Cybersecurity and Infrastructure

Security Agency, April 30, 2019. [End of footnote]

Footnote 38: National Critical Functions – An Evolved Lens for Critical

Infrastructure and Security Resilience, DHS Cybersecurity and Infrastructure

Security Agency, April 30, 2019. [End of footnote]

Figure 3: National Critical Functions

National Critical Functions Set

Critical Function - CONNECT:

• Operate Core Network

• Provide Cable Access Network Services

• Provide Internet Based Content, Information, and Communication Services.

• Provide Internet Routing, Access, and Connection Services

• Provide Positioning, Navigation, and Timing Services

• Provide Radio Broadcast Access Network Services

• Provide Satellite Access Network Services

• Provide Wireless Access Network Services

• Provide Wireline Access Network Services

Critical Function - DISTRIBUTE:

• Distribute Electricity

• Maintain Supply Chains

• Transmit Electricity

• Transport Cargo and Passengers by Air

• Transport Cargo and Passengers by Rail

• Transport Cargo and Passengers by Road

• Transport Cargo and Passengers by Vessel

• Transport Materials by Pipeline

• Transport Passengers by Mass Transit

Critical Function - MANAGE:

• Conduct Elections

• Develop and Maintain Public Works and Services

• Educate and Train

• Enforce Law

• Maintain Access to Medical Records

• Manage Hazardous Materials

• Manage Wastewater

• Operate Government

• Perform Cyber Incident Management Capabilities

• Prepare for and Manage Emergencies

• Preserve Constitutional Rights

• Protect Sensitive Information

• Provide and Maintain Infrastructure

• Provide Capital Markets and Investment Activities

• Provide Consumer and Commercial Banking Services

• Provide Funding and Liquidity Services

• Provide Identity Management and Associated Trust Support Services

• Provide Insurance Services

• Provide Medical Care

• Provide Payment, Clearing, and Settlement Services

• Provide Public Safety

• Provide Wholesale Funding

• Store Fuel and Maintain Reserves

• Support Community Health

Critical Function - SUPPLY:

• Exploration and Extraction Of Fuels

• Fuel Refining and Processing Fuels

• Generate Electricity

• Manufacture Equipment

• Produce and Provide Agricultural Products and Services

• Produce and Provide Human and Animal Food Products and Services

• Produce Chemicals

• Provide Metals and Materials

• Provide Housing

• Provide Information Technology Products and Services

• Provide Materiel and Operational Support to Defense Research and Development

• Supply Water

Source: Cybersecurity and Infrastructure Security Agency

[End of Figure 3: National Critical Functions]

One key focus of the CISA and the National Critical Functions is collecting

and sharing information, including informing intelligence collection

requirements.39 FSOC noted, in its 2018 Annual Report, the critical

importance to the financial sector of sharing timely and actionable

threat information among the Federal Government and the private sector.

FSOC stated that Federal agencies should consider how to share information

and when possible “declassify (or downgrade classification) of information

to the extent practicable, consistent with national security needs.”40

The GAO also identified various sources of threat information that could

be shared with financial institutions. Figure 4 illustrates how the GAO

captured threat information flows from multiple sources.

Footnote 39: National Critical Functions – An Evolved Lens For Critical

Infrastructure Security and Resilience, Cybersecurity and Infrastructure

Security Agency, National Risk Management Center, April 30, 2019. [End of

footnote]

Footnote 40: FSOC 2018 Annual Report. [End of footnote]

Figure 4: Sources of Threat Information for Financial Institutions

Figure 1: Sources of Threat information for Financial Institutions

[Figure depicting information flow to and/or from Depository Institution]

Entity: Blogs Information Source: Open Information Flow: To

Entity: Media Reports Information Source: Open Information Flow: To

Entity: Security Researchers Information

Source: Open Information Flow:

To Depository Institution

Entity: RSS aggregators Information

Source: Open Information Flow: To

Depository Institution

Entity: Bulletin baords/forums Information

Source: Open Information Flow:

To Depository Institution

Entity: Technology Service Providers Information

Source: Private

Information Flow: To Depository Institution

Entity: Trade Associations Information

Source: Private Information Flow:

To Depository Institution

Entity: SSANS Institute Information

Source: Private Information Flow:

To Depository Institution

Entity: National Cyber-Forensics and Training Alliance Information

Source: Private Information Flow: To Depository Institution

Entity: Payment Processors Information Sharing Council Information

Source: Public/Private Information Flow: To Depository Institution

Entity: Financial Services Sector Coordinating Council Information

Source: Public/Private Information Flow: To Depository Institution

Entity: Federal Bureau of Investigation Inter-Agency information flow:

to - Department of the Treasury Information

Source: Government

Information Flow: To Depository Institution

Entity: National Security Agency Inter-Agency information flow: to -

Department of the Treasury Information Source: Government Information

Flow: To Depository Institution

Entity: Central Intelligence Agency Inter-Agency information flow:

to - Department of the Treasury Information

Source: Government

Information Flow: To Depository Institution

Entity: U.S. Secret Service, Department of Homeland Security Inter-

Agency information flow: to - Department of the Treasury Information

Source: Government Information Flow: To Depository Institution

Entity: US Computer Emergency Readiness Team, Department of Homeland

Security Inter-Agency information flow: to - Department of the

Treasury Information Source: Government Information Flow: To Depository

Institution

Entity: NCIC, National Cybersecurity and Communications Integration

Center, Department of Homeland Security Inter-Agency information flow:

to - Department of the Treasury Information Source: Government

Information Flow: To Depository Institution

Entity: Department of the Treasury Information

Source: Government

Inter-Agency information flow: to - FS-ISAC, Financial Services

Information Sharing and Analysis Center Information Flow: To Depository

Institution

Entity: FS-ISAC, Financial Services Information Sharing and Analysis

Center Information Source: Public/Private Inter-Agency information flow:

To/From - Office of the Comptroller of the Currency

Inter-Agency information flow: To/From - Federal Deposit Insurance

Corporation Inter-Agency information flow: To/From - Federal Reserve

Inter-Agency information flow: To/From - National Credit Union

Administration Information Flow: To/From Depository Institution

Entity: Office of Comptroller of the Currency Information

Source: Government (Member of the Federal Financial Institution

Examination Council) Inter-Agency information flow: To/From - Office

of the Comptroller of the Currency

Inter-Agency information flow: To/From - Federal Deposit Insurance

Corporation Inter-Agency information flow: To/From - Federal Reserve

Inter-Agency information flow: To/From - National Credit Union

Administration Information Flow: To/From Depository Institution

Entity: Federal Deposit Insurance Corporation Information

Source: Government (Member of the Federal Financial Institution

Examination Council)

Inter-Agency information flow: To/From - Office of the Comptroller

of the Currency

Inter-Agency information flow: To/From - Federal Deposit Insurance

Corporation Inter-Agency information flow: To/From - Federal Reserve

Inter-Agency information flow: To/From - National Credit Union

Administration Information Flow: To/From Depository Institution

Entity: Federal Reserve Information

Source: Government (Member of the Federal Financial Institution

Examination Council)

Inter-Agency information flow: To/From - Office of the Comptroller

of the Currency Inter-Agency information flow: To/From - Federal

Deposit Insurance Corporation

Inter-Agency information flow: To/From - Federal Reserve Inter-

Agency information flow: To/From - National Credit Union

Administration Information Flow: To/From Depository Institution

Entity: National Credit Union Administration Information

Source: Government (Member of the Federal Financial Institution

Examination Council)

Inter-Agency information flow: To/From - Office of the Comptroller

of the Currency

Inter-Agency information flow: To/From - Federal Deposit Insurance

Corporation

Inter-Agency information flow: To/From - Federal Reserve

Inter-Agency information flow: To/From - National Credit Union

Administration Information Flow: To/From Depository Institution

Source: GAO + GAO - 15 - 509

[End of Figure 4: Sources of Threat Information for Financial Institutions]

Sharing Threat Information Throughout the Financial Sector

Financial institutions must be prepared to address many threats, and

Financial-Sector Regulatory Organizations must ensure through supervisory

processes that financial institutions are ready to mitigate those risks.

According to the FFIEC, financial institutions should have business

continuity plans that “[a]nalyze threats based upon the impact to the

institution, its customers, and the financial market it serves.”41 Further,

the FFIEC notes that financial institutions should have “a means to collect

data on potential threats that can assist management in its identification

of information security risks.”42

Footnote 41: FFIEC, Business Continuity Planning Booklet, Risk Assessment,

(Available on the FFIEC website). [End of footnote]

Footnote 42: FFIEC IT Examination Handbook Infobase, Information Security

Booklet, II, Information Security Program Management (Available on the FFIEC

website). [End of footnote]

In November 2014, the FFIEC members encouraged financial institutions to

join the Financial Services Information Sharing and Analysis Center (FS-ISAC),

through its Statement on Cybersecurity Threat and Vulnerability Monitoring

and Sharing (Cybersecurity Sharing Statement).43 FS-ISAC is a group of

7,000 member organizations whose purpose is to share timely, relevant, and

actionable security threat information. The Cybersecurity Sharing Statement

also suggested using other resources such as the Federal Bureau of

Investigation’s (FBI) InfraGard,44 U.S. Computer Emergency Readiness Team,45

and Secret Service Electronic Crimes Task Force.46 Threat awareness is

important because financial institutions are links in the chain of financial

services system interconnections; an incident involving one community bank

has the potential to affect the broader financial sector.47 Therefore, as

part of the supervisory examination process, Financial-Sector Regulatory

Organizations must ensure that supervised institutions can receive and

access threat information, and that they have business continuity plans to

address such threats.

The Treasury Department leads financial sector readiness efforts. The

Treasury Department OIG recognized the Department’s challenge to provide

financial-sector leadership, ensure effective public-private coordination,

and strengthen awareness and preparedness against cyber threats. The FDIC

OIG identified challenges for the FDIC to ensure that relevant threat

information is shared with its supervised institutions and examiners as

needed, in a timely manner, to prompt responsive action to address the

threats. Threat information provides FDIC examiners with context to

evaluate banks’ processes for risk identification and mitigation strategies.

Sharing Information to Combat Terrorist Financing, Money Laundering, and

Other Financial Crimes

According to the Director of the Financial Crimes Enforcement Network,

“Financial institutions are often the first to detect and block illicit

financing streams, combat financial crimes and related crimes and bad

acts, and manage risk.”48 Providing the financial sector with information

about illicit activity can help sector participants identify and report such

activities; this assists law enforcement in disrupting money

laundering and other financial crimes.49 Such information is especially

important with the use of virtual currencies to identify illicit actors who

use virtual currency to “… facilitate criminal activity such as human

trafficking, child exploitation, fraud, extortion, cybercrime, drug

trafficking, money laundering, terrorist financing, and to support rogue

regimes and facilitate sanctions evasion.”50

Footnote 50: Financial Crimes Enforcement Network, Advisory on Illicit

Activity Involving Convertible Virtual Currency (May 9, 2019). [End of

footnote]

The Treasury Department OIG reported challenges affecting the Department’s

ability to effectively gather and analyze intelligence information.

Specifically, the Treasury Department must do more to collaborate and

coordinate with other Federal agencies to identify and disrupt financial

networks that support terrorist organizations. The Treasury Department also

faces staffing challenges threatening its ability to ensure effective

gathering and analysis of intelligence information. The Department requested

approximately 100 new analyst positions for Fiscal Year 2019. Those positions

are difficult to fill, however, because of required expertise and the length

of time to process security clearance for such personnel.

Threat information can be considered by financial institutions and Financial-

Sector Regulatory Organizations in developing and examining bank and credit

union mitigation strategies and continuity plans. Absent such threat information,

financial institutions and examiners may lack a full understanding of the risks

facing banks and credit unions, and thus, risk mitigation and supervisory

strategies might have gaps which could affect the safety and soundness of

institutions.

[End of CHALLENGE 3: SHARING THREAT INFORMATION]

CHALLENGE 4 ENSURING READINESS FOR CRISES Source: Federal Emergency Management

Agency

The financial sector is a vital component of the infrastructure of the United

States.

As noted by DHS, “large-scale power outages, recent natural disasters, and an

increase in the number and sophistication of cyberattacks demonstrate the wide

range of potential risks facing the sector.”51

Footnote 51: Department of Homeland Security, CISA, Financial Services Sector

available on the DHS website. [End of footnote]

Financial-Sector Regulatory Organizations support the financial sector by

identifying and mitigating potential systemic problems. When supervisory

mitigation cannot stem risks or economic events overtake such efforts,

Financial-Sector Regulatory Organizations, in conjunction with other Federal

and state regulators, must be ready to stabilize financial markets and provide

disaster aid.

Crisis readiness requires advanced preparation, regardless of whether the

crisis results from financial disruption in the markets, economic turmoil,

a cyber attack, natural disaster, or other event. “When the unexpected,

enterprise-threatening crisis strikes, it is too late to begin the planning

process. Events will quickly spin out of control, further adding to the loss

of reputation and avoidable costs necessary to survive and recover with minimal

damage.”52

Footnote 52: Hastings Business Law Journal, The Board’s Responsibility for

Crisis Governance (Spring 2017). [End of footnote]

Although crises may be different in their cause or complexity, implementation

of fundamental principles allows Financial-Sector Regulatory Organizations,

to plan and prepare for such events. Figure 5 illustrates the Crisis

Management Preparedness Cycle, which includes the following five components:53

Footnote 53: Federal Emergency Management Agency National Incident Management

System. [End of footnote]

• Plan – Supports effective operations by identifying objectives, describing

organizational structures, assigning tasks to achieve objectives, identifying

responsibilities to accomplish tasks, and contributing to the goals.

• Organize – Identifies necessary skillsets and technical capabilities.

• Train – Provides personnel with the knowledge, skills, and abilities to

respond to a crisis.

• Exercise – Identifies strengths and weaknesses through an assessment of gaps

and shortfalls with plans, policies, and procedures to respond to a crisis.

• Evaluate and Improve – Compiles lessons learned, develops improvement plans,

and tracks corrective actions to address gaps and deficiencies identified.

Figure 5: Crisis Management Preparedness Continuous Cycle

Preparedness Cycle.

Step 1 - Plan

Step 2 - Organize/Equip

Step 3 - Train

Step 4 - Exercise

Step 5 - Evaluate/Improve

Source: Federal Emergency Management Agency

[End of figure 5]

Preparing for Potential Financial Institution Disruptions and Failures

It has been more than a decade since Financial-Sector Regulatory Organizations

were called upon to address the financial crisis. An FDIC study described the

financial crisis as two interconnected and overlapping crises.54 The first phase

of the crisis involved systemic threats to the financial system as a whole

through the failure of large financial and non-financial institutions during

2008-2009. The second overlapping phase involved a rapid increase in the number

of smaller troubled and failed banks between 2008-2013. As noted by FDIC Chairman

Jelena McWilliams on April 3, 2019, “[t]here were regulatory gaps leading up to the

crisis—perhaps none more important than the inadequate planning for potential

failure of the largest banks and their affiliates.” 55 As described by Chairman

McWilliams, the lessons learned from the crisis are that large and small banking

institutions must be able to fail “without taxpayer bailouts and without

undermining the market’s ability to function.” 56

Footnote 54: FDIC, Crisis and Response, An FDIC History, 2008-2013 (November 30,

2017). [End of footnote]

Footnote 55: FDIC Chairman Jelena McWilliams, Bank Resolution: A Global Perspective,

International Banker (April 3, 2019). [End of footnote]

Footnote 56: FDIC Chairman Jelena McWilliams, Bank Resolution: A Global Perspective,

International Banker (April 3, 2019). [End of footnote]

Financial-Sector Regulatory Organizations, in conjunction with other Federal and

state regulators, must be prepared to mitigate financial institution risks and, when

necessary, resolve failed banks and credit unions. The Dodd-Frank Act introduced

significant changes since the crisis. The Dodd-Frank Act required that bank holding

companies plan for potential resolution through bankruptcy. The Dodd-Frank Act also

provided new resolution authority to orderly liquidate financial companies in extreme

cases during severe financial crisis. In addition, the FDIC instituted regulations

requiring that insured depository institutions with more than $50 billion in assets

also prepare resolution plans addressing how the FDIC could resolve the institution

under the Federal Deposit Insurance Act. These steps clarify resolution authority,

but Financial-Sector Regulatory Organizations must be able to execute those

resolutions.

The FDIC OIG identified challenges with the FDIC’s readiness to fulfill its

mission to manage receiverships. According to the FDIC, the events of the financial

crisis unfolded more quickly than the FDIC expected and were more severe than the

FDIC’s planning efforts anticipated.57 For example, in July 2008, the FDIC resolved

IndyMac, the most expensive FDIC failure, estimated to cost about $12.3 billion, and

in September 2008, Washington Mutual, the sixth-largest FDIC-insured institution,

also failed. The FDIC had not planned for several large and small banks to fail at

the same time, and these failures occurred at a quicker pace than in previous crises.

The FDIC OIG stated that the FDIC is challenged to ensure that it has the ability

to on-board the staff needed to address escalating crisis workloads. For example,

during the crisis, the FDIC authorized funding for additional personnel but faced

challenges expediting the hiring process to on-board needed staff.

Footnote 57: FDIC, Crisis and Response, An FDIC History, 2008-2013 (November 30,

2017). [End of footnote]

Further, the FDIC faced challenges dealing with the increased volume of contracts

required during the time of crisis. During the financial crisis, the FDIC awarded

over 6,000 contracts totaling more than $8 billion. The size of the FDIC

acquisition staff was initially insufficient, which resulted in delays to modify

existing contracts and award new contracts. The FDIC needed to rapidly hire and

train personnel to oversee the contracts. The FDIC is also challenged to ensure

that it has plans in place to react and respond quickly to a crisis, irrespective

of its cause, nature, magnitude, or scope; ensure those plans are current and

up-to-date; and incorporate lessons learned from past crises and the related

bank failures.

The NCUA OIG also noted several challenges faced by the NCUA pertaining to risks

to the safety and soundness of credit unions and the protection of the National

Credit Union Share Insurance Fund which, similar to the Deposit Insurance Fund,

insures credit union member accounts against losses up to $250,000.58 These risks

include: significant threats posed by cyberattacks, competitive challenges to

credit unions posed by new technology-driven financial products; increasing

competition in the financial services industry; and continuing consolidation

among depository institutions. The NCUA needs to: strengthen the resiliency of

the credit union systems and the agency; work with credit unions to manage risks

of new financial products and services; and continue to monitor consolidation

trends among depository institutions.

Footnote 58: Created by Congress in 1970, NCUA administers the Share Insurance Fund

and insures individual credit union member accounts against losses up to $250,000

and a member’s interest in all joint accounts combined up to $250,000. The Deposit

Insurance Fund is administered by the FDIC and insures account holder deposits in

FDIC insured banks and provides funds to resolve failed banks. [End of footnote]

Preparing to Administer Disaster Aid

HUD plays a substantial role in national disaster recovery initiatives and often

receives more disaster recovery funding than any other Federal agency. After a

national disaster, Congress may authorize additional funding to HUD for the Community

Development Block Grant Program (Community Development Grants) for significant unmet

needs for long-term recovery.59 Since 2001, Congress has awarded HUD more than $84.6

billion for disaster recovery. HUD awards Community Development Grants to state and

local governments who, in turn, may grant money to state agencies, non-profit

organizations, economic development agencies, citizens, and businesses. The state

and local governments provide these funds for disaster relief, long-term recovery,

restoration of infrastructure, housing, and economic revitalization.

Footnote 59: Community Development Block Grant Disaster Recovery Fact Sheet.

[End of footnote]

HUD OIG noted that, by their nature, Community Development Grants pose a risk as

they are provided at a time when a community is recovering from a disaster. HUD

OIG identified that HUD’s Community Development Grant requirements are not codified

in the Federal Register. Instead, HUD issues multiple requirements and waivers for

each disaster in Federal Register notices, which leads to confusion among program

grantees. For example, HUD OIG noted that 59 grantees with 112 active Community

Development Grants totaling more than $47.4 billion were required to follow 61

different Federal Register notices to manage the program. Further, HUD OIG

identified continuing risks to HUD concerning the more than $18 billion in

disaster recovery sent to Puerto Rico during a time when Puerto Rico was close

to filing for bankruptcy.

HUD OIG also reported that HUD is challenged to ensure that grantees have the

capacity to administer Community Development Grants and ensure the funds are

used for eligible and supported items. Since 2006, HUD OIG has completed 120

audits and 6 evaluations of the Community Development Block Grant Program,

identifying $477.4 million in ineligible costs, $906.5 million in unsupported

costs, and $5.5 billion in funds that could be put to better use.

HUD also faces challenges to ensure that grantees follow Federal procurement

regulations. HUD OIG identified that state disaster recovery programs may not

align with Federal procurement requirements. As a result, products and services

obtained through grant funds may not have been purchased competitively at fair

and reasonable prices. HUD OIG also identified challenges in HUD’s ability to

expedite disaster assistance grants while also maintaining adequate safeguards

to deter and detect fraud.

Additionally, HUD OIG found that Americans face challenges in attempting to

receive assistance from HUD and other disaster relief agencies. Citizens face

a circuitous path to receive disaster recovery assistance depending on how,

when, and where they enter the disaster relief process. As a result, citizens

may face significant delays in processing their applications for assistance,

delays in receiving funding, and possible duplication of benefits.

Financial-Sector Regulatory Organizations protect the financial sector and

American citizen when crises strike. Crises in the financial sector may come

from many sources and at any time. Financial-Sector Regulatory Organizations

must plan, prepare, train, exercise, and maintain readiness for scenarios

that could lead to crises.

[End of CHALLENGE 4: SHARING THREAT INFORMATION]

CHALLENGE 5 STRENGTHENING AGENCY GOVERNANCE

According to OMB Circular No. A-123, Management’s Responsibility for Enterprise

Risk Management and Internal Control, (OMB Circular A-123), Federal agencies

face internal and external risks to achieving their missions, including

“economic, operational, and organizational change factors, all of which

would negatively impact an Agency’s ability to meet goals and objectives

if not resolved.”60 To address those risks, Federal leaders and managers

generally must establish a governance structure to direct and oversee

implementation of a risk management and internal control process.61 Enterprise

Risk Management (ERM) and internal controls are components of this governance

framework. OMB defines ERM “as an enterprise-wide, strategically-aligned

portfolio view of organizational challenges that provides better insight

about how to most effectively prioritize resource allocations to ensure

successful mission delivery.”62

Footnote 60: Office of Management and Budget Circular No. A-123, Management’s

Responsibility for Enterprise Risk Management and Internal Control (July 15,

2016). [End of footnote]

Footnote 61: Office of Management and Budget Circular No. A-123, Management’s

Responsibility for Enterprise Risk Management and Internal Control (July 15, 2

016). [End of footnote]

Footnote 62: Office of Management and Budget Appendix A to OMB Circular A-123,

Management Reporting and Data Integrity Risk (June 6, 2018). [End of footnote]

Establishing Enterprise Risk Management

ERM focuses specifically on the identification, assessment, and management

of risk, and it should include these elements:

• A risk management governance structure;

• A methodology for developing a risk profile; and

• A process, guided by an organization’s senior leadership, to consider risk

appetite and risk tolerance levels that serves as a guide to establish strategy

and select objectives.

Figure 6: Enterprise Risk Management Program

Enterprise Risk Management

Strategic Decisions (OMB A-11):

-Mission/Vision, Performance Goal Setting/Metrics, Objective Setting, Establish

Risk Thresholds

Budget Decisions(OMB A-11):

-Policy, President's Budget, Congressional Justification

Program Management (OMB A-11):

-Cross Agency Priority Goals, Agency Priority Goals, Agency Program Reviews

CXO Operations Support (OMB A-123):

- Operational Control Objectives, Report Control Objectives, Comliance Control

Objectives, Risk Assessments

Source: CFO Playbook: Enterprise Risk Management for the U.S. Federal Government.

[End of Figure 6]

OMB urges agencies to adopt an enterprise-wide view of ERM—a “big picture”

perspective— thus synthesizing the management of risks into the very fabric of

the organization; it should not be viewed in “silos” among different divisions

or offices. As shown in Figure 6, ERM should integrate risk management into the

agency’s processes for budgeting, including strategic planning, performance

planning, and performance reporting practices.

The Federal Reserve Board and Bureau OIG found that the Federal Reserve Board

has a complex governance system that creates challenges for the Governors to

effectively carry out their roles and responsibilities and to have an enterprise-

wide view of the management of certain administrative functions. For example,

the Federal Reserve Board and Bureau OIG noted that Federal Reserve Board

guidance does not set clear expectations for communication among Governors

and between Governors and Division Directors. Such communication challenges

may result in the Federal Reserve Board Governors being unaware of certain

activities, and Board officials missing opportunities to leverage the Governors’

knowledge and experience. In addition, the decentralization of information

technology among Divisions does not allow for a complete view of IT security

risks and impedes the ability to have an effective information security program.

Additionally, the Federal Reserve Board Chief Human Capital Officer has had

difficulty implementing enterprise-wide succession planning.

Similarly, the FDIC OIG identified challenges in the FDIC’s implementation of

its ERM program. Although the FDIC began ERM implementation efforts in 2010,

the FDIC currently does not have an enterprise-wide and integrated approach to

identifying, assessing, and addressing the full spectrum of internal and external

risks. As a result, the FDIC faces difficulties integrating risk into its budget,

strategic planning, performance reporting, and internal controls. In addition,

FDIC Divisions and Offices are not able to evaluate risk determinations in the

context of the agency’s overall risk levels, tolerance, and profile. For example,

the FDIC could not be sure that its resources were being allocated toward

addressing the most significant risks in achieving strategic objectives.

Ensuring Effective Internal Controls

As described by the GAO, “a key factor in improving accountability in achieving

an entity’s mission is to implement an effective internal control system. An

effective internal control system helps an entity adapt to shifting environments,

evolving demands, changing risks, and new priorities.”63 OMB Circular A-123

emphasizes the need for agencies to coordinate risk management and strong and

effective internal controls into existing business activities as an integral

part of governing and managing an agency.

Footnote 63: U.S. Government Accountability Office, Standards for Internal

Control in the Federal Government, GAO-14-704G, (September 2014). [End of

footnote]

HUD OIG noted HUD’s continuing struggle with effective oversight controls to

monitor operations and programs. HUD faces challenges to effectively manage its

programs that distribute about $48.2 billion annually to state and local government,

organizations, and individuals through grants, subsidies, and other payments. For

example, in 2018, HUD OIG reports identified more than $1.3 billion in ineligible,

unsupported, unnecessary, or unreasonable costs. HUD OIG also noted that HUD’s lack

of compliance with the GAO’s internal control standards has deprived HUD management

of an important monitoring tool that can provide feedback on the effectiveness and

efficiency of departmental operations.

FHFA OIG identified that internal control systems at Fannie Mae and Freddie Mac,

which are under government conservatorship, fail to provide directors with accurate,

timely, and sufficient information to enable them to exercise their oversight duties

that are delegated to them by FHFA as conservator. Further, the FHFA OIG found that

leadership changes in 2018 and 2019 may lead to a lack of attention to internal

controls.

Governance is an important tool for Financial-Sector Regulatory Organizations to

ensure that they fulfill their missions and responsibilities to citizens and taxpayers.

ERM and internal control programs synthesize the management of Financial-Sector

Regulatory Organizations’ risks into an organization’s culture, so that these risks

may be considered and incorporated into budget, strategic planning, performance

reporting, and internal controls for the agency as a whole.

[End of CHALLENGE 5 STRENGTHENING AGENCY GOVERNANCE]

CHALLENGE 6 MANAGING HUMAN CAPITAL

Financial-Sector Regulatory Organizations rely on the skills of over 117,000 employees

to ensure the safety and soundness of the U.S. financial system.64 In March 2019, the

GAO recognized strategic human capital management as a continuing Government-wide area

of high risk.65 The GAO noted the need for Federal agencies to “measure and address

existing mission-critical skills gaps, and use workforce analytics to predict and

mitigate future gaps so agencies can effectively carry out their missions.”66

Footnote 64: CIGFO Working Group analysis of OPM Fedscope data as of March 2018

available at https://www.fedscope.opm.gov. [End of footnote]

Footnote 65: U.S. Government Accountability Office, High-Risk Series: Substantial

Efforts Needed to Achieve Greater Progress on High-Risk Areas, GAO-19-157SP (March

2019). [End of footnote]

Footnote 66: U.S. Government Accountability Office, High-Risk Series: Substantial

Efforts Needed to Achieve Greater Progress on High-Risk Areas, GAO-19-157SP (March

2019). [End of footnote]

Succession Planning to Fill Leadership Gaps

Government-wide retirement eligibility in 2022 is estimated to be 31.6 percent of all

permanent Federal employees.67 According to the GAO, retirements could cause gaps in

leadership and institutional knowledge and exacerbate existing skill gaps. According

to the Office of Personnel Management (OPM), succession planning for such retirements

forms an integral part of workforce planning and helps ensure an ongoing supply of

qualified staff to fill leadership and other key positions.68 Specifically, OPM

requires that the head of each agency, in consultation with OPM, develop a

comprehensive management succession program, based on the agency's workforce

succession plans, to fill agency supervisory and managerial positions. Agency

succession programs should be supported by employee training and development programs.

Footnote 67: U.S. Government Accountability Office, High-Risk Series: Substantial Efforts

Needed to Achieve Greater Progress on High-Risk Areas, GAO-19-157SP (March 2019).

[End of footnote]

Footnote 68: 5 C.F.R. Part 412. [End of footnote]

The Federal Reserve Board and Bureau OIG cited potential leadership and skills gaps as a

result of a projected increase in numbers of Federal Reserve Board employees becoming

eligible for retirement. Similarly, the FDIC OIG found that the percentage of FDIC employees

eligible to retire more than doubles (2.3 times) over the next 5 years, increasing from

18 percent in 2018 to 42 percent in 2023. Further, the FDIC OIG identified potential

leadership gaps resulting from the retirement eligibility of 66 percent of the Executive

Management employees and another 57 percent of Managers between 2018 and 2022.

HUD OIG also identified that leadership gaps have affected HUD’s management of its programs

and operations. Specifically, constant turnover and extended vacancies in HUD’s most

important political and career executive positions led to poor management decisions and

questionable execution of internal business functions. The SEC OIG also noted that, although

the agency’s multi-year strategic plan identified the need to strengthen human capital

management, the SEC lacked a formal succession plan.

Skills Gap Identification and Mitigation

OPM’s Human Capital Framework requires that agencies use comprehensive data analytic methods

to monitor and address skills gaps and develop gap closure strategies.69 CIGFO members

identified challenges in the identification and mitigation of agency skill set gaps

especially in response to new technologies. The Federal Reserve Board and Bureau OIG found

that the Federal Reserve Board remains challenged to identify a diverse workforce with the

necessary technical, managerial, and leadership skills. Continually evolving workforce

expectations and a highly competitive environment for individuals with specialized skills

presents challenges for the Federal Reserve Board. The FDIC OIG found that the FDIC was

challenged to ensure that examination staff skill sets kept pace with the increasing complexity

and sophistication of IT environments at banks as well as the introduction of new financial

technology. The FDIC OIG also identified examiner skillset imbalances among FDIC regional

offices. As a result, senior examiners may be required to travel more frequently in order to

supervise less experienced staff and sign reports of examination.

Footnote 69: See OPM Human Capital Framework Structure and SEC OIG, The SEC Made Progress

But Work Remains to Address Human Capital Management Challenges and Align With the Human

Capital Framework (September 11, 2018), Report No. 549. [End of footnote]

The Federal Reserve Board and Bureau OIG stated that to address vacancies in the Bureau’s

workforce, the agency is reallocating staff resources through reassignments or detail

opportunities. However, some of these vacancies are for highly specialized skillsets, and

the Bureau may face challenges in identifying the necessary skillsets in its current

workforce. The SEC OIG found that, although the SEC began a skill set assessment project

in 2016, the SEC was delayed in implementing the project. Specifically, as of July 2018,

the SEC had not completed competency assessment surveys or similar reviews to identify and

close skill gaps within SEC divisions, offices, and regional offices.

Financial-Sector Regulatory Organizations’ workforce plays a vital role in ensuring mission

success. Mission success is contingent on each organization’s management of human capital

activities – workforce planning, recruitment, on-boarding, compensation, engagement,

succession planning, and retirement programs – to allow for proactive responses to anticipated

changes and maximize human capital efficiency and effectiveness.

[End of CHALLENGE 6 MANAGING HUMAN CAPITAL]

CHALLENGE 7 IMPROVING CONTRACT AND GRANT MANAGEMENT

The Administration recognized the importance of improving Federal Government acquisitions in

finding that such acquisitions “often fail to achieve their goals because many Federal managers

lack the program management and acquisition skills to successfully manage and integrate large

and complex acquisitions into their projects.”70 In addition, the GAO found that Government

contracting officials were carrying heavier workloads, and thus, it was more difficult for

these officials to oversee complex contracts and ensure that contractors adhered to contract

terms.

Footnote 70: The President’s Management Agenda: Modernizing Government for the 21st Century.

[End of footnote]

Grants are an important policy tool to provide funding to state and local governments, and

nongovernmental entities for national priorities. According to the GAO, effective oversight

and internal control is important to provide reasonable assurance to Federal managers and

taxpayers that grants are awarded properly, grant recipients are eligible, and grants are

used as intended according to laws and regulations.71

Footnote 71: U.S. Government Accountability Office, Grants Management: Observations on

Challenges and Opportunities for Reform, GAO-18-676T (July 25, 2018). [End of footnote]

Strengthening Contract Oversight

According to the GAO’s Framework for Assessing the Acquisition Function at Federal Agencies,

agencies should effectively manage their acquisitions process in order to ensure that

contract requirements are defined clearly and all aspects of contracts are fulfilled.72

Agencies must properly oversee contractor performance and identify any deficiencies.

Footnote 72: U.S. Government Accountability Office, Framework for Assessing the Acquisition

Function at Federal Agencies, GAO-05-218G (September 2005). [End of footnote]

The Special Inspector General for the Troubled Asset Relief Program (SIGTARP) identified

challenges to Treasury Department’s oversight of Troubled Asset Relief Program (TARP) Funds.

Over 150 banks or other institutions have or can receive $23 billion through agreements

entered under the Making Home Affordable Program (MHA Program). The MHA Program pays TARP

dollars when banks and institutions comply with rules and guidelines to modify mortgages to

help struggling homeowners. SIGTARP found that despite enforcement actions and other wrongdoing

of many financial institutions, the Treasury Department is significantly scaling back on MHA

Program compliance reviews.

HUD OIG identified challenges with HUD’s oversight of IT procurement. According to HUD’s Chief

Procurement Officer, fewer than five people were adequately trained and possessed the expertise

to manage IT projects and contracts. HUD lacked well-documented and fully developed selection

processes to ensure consistent application of selection criteria used for applicants for

contracts. In addition, HUD did not have robust processes for contractor oversight and

evaluating contractor performance against expected outcomes to ensure that its contractors

met their obligations.

According to the FDIC OIG, the FDIC relies heavily on contractors for support of its mission,

especially for IT and administrative support services. The FDIC OIG identified a number of

contract challenges at the FDIC, including defining contract requirements, coordination

between contracting and program office personnel, and establishing implementation milestones.

For example, FDIC personnel did not fully understand and communicate the requirements to

transition a nearly $25 million data management services contract from one contractor to

another.

The Federal Reserve Board and Bureau OIG identified that the Bureau needed to strengthen

controls for contract financing and management. Specifically, for one of its largest

contracts, the Bureau did not comply with the Federal Acquisition Regulation requirements

concerning contract financing requirements and documenting annual blanket purchase agreement

reviews. Additionally, Bureau staff did not verify contractor expenses by obtaining and

reviewing supporting source documents. The Federal Reserve Board and Bureau OIG also noted

contracting challenges for the Federal Reserve Board’s oversight of physical infrastructure

changes. The Federal Reserve Board encountered significant delays, scope changes, and cost

increases for renovations to its William McChesney Martin, Jr. building.

The SEC OIG identified challenges with the SEC’s management and oversight of contracts. For

example, the SEC OIG found that contract oversight personnel did not enforce contract

requirements for experts performing work for the SEC. Further, contract oversight personnel

had limited first-hand knowledge of the sufficiency of contract deliverables and therefore

could not determine whether the invoices accurately reflected work performed.

Improving Grant Management

Grants are typically categorized as (1) categorical grants – which restrict funds to narrow,

specific activities; (2) block grants – which are less restrictive funding for broader

categories of activities; and (3) general purpose grants – which allow the greatest amount

of discretion to be used for government purposes. Oversight and internal control of grants

are important to ensure grants are used by eligible participants for allowable purposes.

SIGTARP identified challenges with the Treasury Department’s oversight of TARP expenses

charged by state housing finance agencies to administer the Hardest Hit Fund (HHF), a

grant-like program. The Treasury Department’s $9.6 billion for HHF provides funding to

state housing finance agencies to assist unemployed homeowners and individuals whose

mortgages are greater than their current home’s value. SIGTARP has issued several reports

on Treasury’s lack of oversight for grantees. Between 2016 and 2017, SIGTARP identified

$11 million in wasteful, abusive, and unnecessary funding by states for items such as gym

memberships, parties, and country club events. Further, SIGTARP reported that there is no

Federal requirement for states to use competition when spending funds on fees for

consultants, accountants, and lawyers.

HUD OIG reported that HUD continues to struggle with effective program management of the

nearly $50 billion in Federal funds that HUD passes to state and local governments,

organizations, and individuals in the form of grants, subsidies, and other payments.

Approximately 16 percent of HUD’s annual appropriations are provided as grants through

the Office of Community Planning and Development. HUD OIG identified that 21 of their

audits performed from 2014-2017 found that there was little or no monitoring of grantees.

As a result, HUD did not have assurances that it correctly identified high-risk grantees

or conducted adequate monitoring to mitigate risks.

Financial-Sector Regulatory Organizations rely on contracts and grants to perform their

respective missions. Strong oversight and controls over contract and grant processes are

critical to ensure proper stewardship over taxpayer funds.

[End of CHALLENGE 7 IMPROVING CONTRACT AND GRANT MANAGEMENT]

CONCLUSION

This is the second report developed by CIGFO members to identify cross-cutting Challenges

faced by Financial-Sector Regulatory Organizations. In this report, we continue to

emphasize to policy makers the importance of considering a whole-of-Government approach to

coordination and information sharing to address these Challenges.

Consistent with the mission of Inspectors General, this report helps inform the public by

providing them with information about the important Challenges facing the financial sector

to which most of the public is directly connected through bank or credit union accounts and

mortgages. This report also informs CIGFO members in their identification of future

Challenges and collaboration on reviews addressing cross-cutting Challenges facing the

financial sector.

APPENDIX 1 ABBREVIATIONS AND ACRONYMS

Bureau - Bureau of Consumer Financial Protection

CFTC - Commodity Futures Trading Commission

Challenges - The CIGFO Top Management and Performance Challenges

identified in this report.

CIGFO - Council of Inspectors General on Financial Oversight

CISA - Cybersecurity and Infrastructure Security Agency

DHS - Department of Homeland Security

Dodd-Frank Act - The Dodd-Frank Wall Street Reform and Consumer

Protection Act

ERM - Enterprise Risk Management

FBI - Federal Bureau of Investigation

FDIC - Federal Deposit Insurance Corporation

Federal Reserve Board  - Board of Governors of the Federal Reserve

System

FEMA - Federal Emergency Management Agency

FFIEC - Federal Financial Institutions Examination Council

FHFA - Federal Housing Finance Agency

Financial-Sector Regulatory Organizations - Federal Departments and

Agencies overseen by

CIGFO Inspectors General.

FISMA - Federal Information Security Modernization Act of 2014

FSB - Financial Stability Board

FS-ISAC - Financial Services Information Sharing and Analysis Center

FSOC - Financial Stability Oversight Council

GAO - U.S. Government Accountability Office

HHF - Hardest Hit Fund

HUD - Department of Housing and Urban Development

IT - Information Technology

MHA Program - Making Home Affordable Program

NCUA - National Credit Union Administration

NIST - National Institute of Standards and Technology

OCC - Office of the Comptroller of the Currency

OIG - Office of Inspector General

OMB - Office of Management and Budget

OPM - Office of Personnel Management

SEC - Securities and Exchange Commission

SIGTARP - Special Inspector General for the Troubled Asset Relief

Program

TMPC - Top Management and Performance Challenges

Treasury Department - Department of the Treasury

TSP - Technology Service Provider

[End of APPENDIX 1 ABBREVIATIONS AND ACRONYMS]

APPENDIX 2 METHODOLOGY

Department of the Treasury,

link - https://www.treasury.gov/about/organizational-structure/ig/Agency%20Doc…

Federal Deposit Insurance Corporation,

link - https://www.fdicoig.gov/report-release/top-management-and-performance-challenges-facing-federal-deposit-insurance

Commodity Futures Trading Commission,

link - https://www.cftc.gov/sites/default/files/2018-10/oigmgmtchal082718.pdf

Bureau of Consumer Financial Protection,

link - https://oig.federalreserve.gov/reports/bureau-major-management-challeng…

Department of Housing and Urban Development

link - https://www.hudoig.gov/sites/default/files/2018-11/TMC%20-%20FY%202019…

Board of Governors of the Federal Reserve System

link - https://oig.federalreserve.gov/reports/board-major-management-challenge…

Federal Housing Finance Agency

link - https://www.fhfaoig.gov/Content/Files/FY2019%20Management%20and%20Perfo…

National Credit Union Administration

link - https://www.ncua.gov/files/annual-reports/annual-report-2018.pdf

Securities and Exchange Commission

link - https://www.sec.gov/Inspector-Generals-Statement-on-the-SECs-Mgt-and-Pe…

Special Inspector General for the Troubled Asset Relief Program

link - https://www.sigtarp.gov/Pages/Reports-Testimony-Home.aspx

Footnote: 73 The Special Inspector General for the Troubled Asset Relief

Program issues  to the Treasury Department and has published its assessment

of the most serious management and performance challenges and threats

facing the Government in TARP in its  Quarterly Report to Congress since

October 2017. [End of footnote]

[End of APPENDIX 2 METHODOLOGY]

CIGFO Audit of the Financial Stability Oversight Council’s Monitoring of

International Financial Regulatory Proposals and Developments

May 2019

CIGFO-2019-01

[CIGFO member OIG agency seals]

Table of Contents

Transmittal Letter

Executive Summary

CIGFO Working Group Audit

Background

Audit Approach

FSOC’s Activities to Monitor International Financial Regulatory Proposals and

Devlopments

FSOC Members Consider the Monitoring

Process Adequate

Conclusion

Appendices

Appendix I: Objective, Scope, and Methodology

Appendix II: Prior CIGFO Reports

Appendix III: FSOC Response

Appendix IV: CIGFO Working Group

[End of Table of Contents]

Abbreviations

CIGFO Council of Inspectors General on Financial Oversight

Dodd-Frank Act Dodd-Frank Wall Street Reform and Consumer Protection Act

FSB Financial Stability Board

FSOC or Council Financial Stability Oversight Council

IOSCO International Organization of Securities Commissions

LIBOR London Interbank Offered Rate

RRC Regulation and Resolution Committee

SRC Systemic Risk Committee

Treasury Department of the Treasury

[End of Abbreviations]

Message from the Chair

Dear Mr. Chairman:

I am pleased to present you with the Council of Inspectors General on

Financial  Oversight (CIGFO) report titled, Audit of the Financial Stability

Oversight Council’s Monitoring of International Financial Regulatory Proposals

and Developments.

One of the statutory duties of the Financial Stability Oversight Council

(FSOC) is to monitor domestic and international financial regulatory proposals

and developments, including insurance and accounting issues, and to advise

Congress and make recommendations in such areas that will enhance the integrity,

efficiency, competitiveness, and stability of the U.S. financial markets.

FSOC’s monitoring of international financial regulatory proposals and

developments is conducted in the context of FSOC’s statutory purposes, which

focuses on developments that could pose risks to the stability of the U.S.

financial system.

CIGFO convened a Working Group to assess FSOC’s monitoring of international

financial regulatory proposals and developments. In this resulting audit report,

we concluded that FSOC has a process for monitoring international financial

regulatory proposals and developments. All FSOC members or member

representatives who offered an opinion described FSOC’s monitoring process as

adequate. Although described as adequate, several FSOC members or representatives

offered suggestions for enhancing the process. We encourage FSOC to consider

incorporating into its process the suggestions made by its members to the

extent the suggestions are consistent with FSOC’s focus on identifying and

addressing threats to the stability of U.S. financial system. We are not making

any recommendations to FSOC as a result of this audit.

I would like to take this opportunity to thank the FSOC members for their

support, especially those Department of the Treasury officials who assisted

with this effort.

CIGFO looks forward to working with you on this and other issues. In

accordance with the Dodd-Frank Wall Street Reform and Consumer Protection

Act, CIGFO is also providing this report to Congress.

Sincerely,

/s/

Eric M. Thorson

Chair, Council of Inspectors General on Financial Oversight

[End of Message from the Chair]

Executive Summary

Why and How

We Conducted this Audit

The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act)1

created regulatory and resolution frameworks designed to reduce the likelihood,

and severe economic consequences, of financial instability. The Dodd-Frank Act

established the Financial Stability Oversight Council (FSOC or Council) and

charged it with identifying risks to the nation’s financial stability, promoting

market discipline, and responding to emerging threats to the stability of the

nation’s financial system. Among other duties, Title I of the Dodd-Frank Act

requires FSOC to monitor domestic and international financial regulatory

proposals and developments, including insurance and accounting issues, and to

advise Congress and make recommendations in such areas that will enhance the

integrity, efficiency, competitiveness, and stability of the U.S. financial markets.

The Dodd-Frank Act also created the Council of Inspectors General on Financial

Over-sight (CIGFO), whose members include the Inspectors General with oversight

authority for the majority of FSOC’s member agencies. The Dodd-Frank Act authorizes

CIGFO to convene a Working Group of its members to evaluate the effectiveness and

internal operations of FSOC. In December 2017, CIGFO convened a Working Group to

conduct an audit to assess FSOC’s monitoring of international financial regulatory

proposals and developments for the period of January 2016 to January 2018.2 The

Working Group was led by the Department of the Treasury’s (Treasury) Office of

Inspector General, whose Inspector General is the Chair of CIGFO.

To accomplish the audit objective, the Working Group reviewed the Dodd-Frank

Act to determine FSOC’s statutory purposes and duties. It reviewed FSOC’s governance

documents, annual reports, meeting minutes, and committee meeting agendas. It

also interviewed staff from the FSOC Secretariat at Treasury as well as interviewed

or received responses from FSOC members and member agency representatives to

develop a better understanding of FSOC’s monitoring of international financial

regulatory proposals and developments. The Working Group conducted fieldwork from

February 2018 through June 2018. Appendix I provides additional details about the

objective, scope, and methodology of this audit.

Footnote 1: Public Law No. 111-203, enacted July 21, 2010. [End of footnote]

Footnote 2: See Appendix IV for a listing of Working Group members. [End of footnote]

What We Learned

FSOC monitors international financial regulatory proposals and developments

in several ways. First, FSOC develops and publishes an annual report, which

describes important international financial regulatory proposals and developments,

identifies emerging threats to U.S. financial stability, and can include

recommendations related to these issues. FSOC also follows up on the issues,

threats, and recommendations identified in its annual report. Second, FSOC

members periodically discuss international topics at their meetings, and are

given presentations by experts from relevant member agencies. Third, the staffs

of FSOC member agencies share information on these topics in FSOC’s staff-level

committees, primarily the Systemic Risk Committee (SRC). Finally, some FSOC

member agencies have their own international engagement, which can inform their

participation in FSOC meetings

FSOC members and FSOC member agency representatives expressed their overall

satisfaction with FSOC’s monitoring of international activities and proposals, and

believed that the process was adequate. Several FSOC members offered suggestions for

process enhancements which are included on pages 8 and 9 of this report. We encourage

FSOC to consider incorporating the suggestions made by these members into its

processes to the extent the suggestions are consistent with FSOC’s purposes of

identifying risks to U.S. financial stability, promoting market discipline,

and responding to emerging threats to the stability of the U.S. financial system.

We are not making any recommendations to FSOC as a result of our audit.

FSOC Response

In a written response, Treasury, on behalf of the FSOC Chairperson, acknowledged the

findings and conclusions in this report. The response stated that the suggestions made

by several FSOC members to further enhance the Council’s work will be considered. The

response is provided as Appendix III.

[End of Executive Summary]

CIGFO Working Group Audit

This report presents the results of the CIGFO Working Group’s audit of FSOC’s monitoring

of international financial regulatory proposals and developments. CIGFO is issuing

this report to FSOC and Congress as part of CIGFO’s responsibility to oversee FSOC under

the Dodd-Frank Act. See Appendix II for a listing of previous CIGFO reports.

Background

The Dodd-Frank Act established FSOC to create joint accountability for identifying and

mitigating potential threats to the stability of the nation’s financial system. By creating

FSOC, Congress recognized that protecting financial stability would require the collective

engagement of the entire financial regulatory community. As shown in Figure 1, the

Council consists of 10 voting members and 5 non-voting members and brings together the

expertise of federal financial regulators; state regulators; an insurance expert appointed

by the President, by and with the advice and consent of the Senate; and others.3 The

voting members of FSOC provide a federal financial regulatory perspective as well as

an independent insurance expert’s view. The non-voting members offer different insights

as state-level representatives from bank, securities, and insurance regulators or as the

directors of offices within Treasury — the Office of Financial Research and the Federal

Insurance Office, established in Titles I and V of the Dodd-Frank Act, respectively.

Within Treasury, a dedicated policy office of Treasury staff, led by a Deputy Assistant

Secretary, functions as the FSOC Secretariat and assists in coordinating the work of

the Council among its members and member agencies.

The statutory purposes of FSOC are to:

• identify risks to the financial stability of the U.S. that could arise from the material

financial distress or failure, or ongoing activities, of large, interconnected bank

holding companies or nonbank financial companies, or that could arise outside

the financial services marketplace;

Figure 1: FSOC Council Membership

Federal and Independent Members

• Secretary of the Treasury, Chairperson (v)

• Chairman of the Board of Governors of the Federal Reserve System (v)

• Comptroller of the Currency (v)

• Director of the Bureau of Consumer Financial Protection (v)

• Chairman of the Securities and Exchange Commission (v)

• Chairperson of the Federal Deposit Insurance Corporation (v)

• Chairman of the Commodity Futures Trading Commission (v)

• Director of the Federal Housing Finance Agency (v)

• Chairman of the National Credit Union Administration Board (v)

• Director of the Office of Financial Research

• Director of the Federal Insurance Office

• Independent member with insurance expertise (v)

State Members

State Insurance Commissioner

State Banking Supervisor

State Securities Commissioner

[End of Figure 1: FSOC Council Membership]

• promote market discipline, by eliminating expectations on the part of shareholders,

creditors, and counterparties of such companies that the Government will

shield them from losses in the event of failure; and

• respond to emerging threats to the stability of the U.S. financial system.4

Footnote 4: 12 U.S.C. 5322(a)(1). [End of footnote]

Audit Approach

Our audit objective was to assess FSOC’s monitoring of international financial regulatory

proposals and developments. Our audit scope focused on FSOC’s efforts to monitor

international activities over a 2-year period, January 2016 through January 2018.

To accomplish our objective, participating Offices of Inspector General collected

information from FSOC members and/or FSOC member representatives, through interviews

or self-reporting guided by a questionnaire developed by the CIGFO Working Group,

regarding their perspectives on FSOC’s efforts to monitor international financial

regulatory proposals and developments. In addition, we interviewed officials of the

FSOC Secretariat and reviewed FSOC annual reports and laws applicable to FSOC’s authority

to monitor international financial regulatory proposals and developments. We conducted our

audit fieldwork from February 2018 through June 2018.

FSOC’s Activities To Monitor International Financial Regulatory Proposals And Developments

The Dodd-Frank Act provides that FSOC has the duty to monitor international financial

regulatory proposals and developments, including insurance and accounting issues, and

to advise Congress and make recommendations in such areas that will enhance the integrity,

efficiency, competitiveness, and stability of the U.S. financial markets. FSOC’s monitoring

of international financial regulatory proposals and developments is conducted in the context

of FSOC’s statutory purposes, which focuses on developments that could pose risks to the

stability of the U.S. financial system.

The Dodd-Frank Act does not establish specific guidelines or expectations for how FSOC is to

fulfill its duty to monitor international financial regulatory proposals and developments.

Accordingly, the CIGFO Working Group developed a methodology for reviewing FSOC’s activities

in this regard.

Through our interviews with the FSOC Secretariat and FSOC members and/or representatives

and their responses to the questionnaire developed by the CIGFO Working Group, we

learned that FSOC monitors these activities in several ways: (1) periodic discussion of

international topics at the FSOC principals’5 meetings, including presentations by experts

from relevant member agencies; (2) information sharing at FSOC committee-level meetings;

and (3) the development and publishing of its annual reports, which describe important

international proposals and developments, identify potential emerging threats to U.S.

financial stability, and may include recommendations related to these issues. In

addition, some member agencies have their own international engagement, which can

inform their participation in FSOC meetings.

FSOC Principals and FSOC Committee Meetings

FSOC has a statutory duty to facilitate information sharing and coordination among

its member agencies and other Federal and State agencies.6 Through this role, FSOC

works to address gaps and weaknesses within the regulatory structure that could pose

risks to U.S. financial stability, and to promote a safer and more stable financial

system. FSOC exercises its convening authority both through meetings of FSOC members

and through its staff-level committee structure.

We noted that the principals held 17 meetings

during the audit period and international topics

were discussed at 10 of those meetings.

Footnote 5: Principals are FSOC members, most of whom are heads of federal or state

financial regulatory agencies. [End of footnote]

Footnote 6: 12 U.S.C. 5322(a)(2)(E). [End of footnote]

FSOC operates under a committee structure to promote shared responsibility among its

members and member agencies and to leverage the expertise that already exists at each

agency. These committees consist of senior or staff level representatives from each

of the FSOC members. We identified two primary committees that support the Council’s

monitoring of international activities, FSOC’s Regulation and Resolution Committee (RRC)

and FSOC’s SRC. The RRC is tasked with identifying potential gaps in regulation that

could pose risks to U.S. financial stability, and the SRC is tasked with identifying

risks and responding to emerging threats to the stability of the U.S. financial system.

During the audit period, the RRC held nine meetings to discuss topics that were regulatory

in nature. We were told by an FSOC Secretariat official that most of the topics had

international aspects. Additionally, the SRC held 10 meetings during the audit period

to receive briefings from FSOC member agencies on a range of international topics that

had a bearing or potential bearing on financial stability and to discuss the issues

raised.

Topics discussed during SRC and RRC meetings included: European political and market

developments, the United Kingdom referendum to leave the European Union (known

as Brexit), Basel standards, the European banking sector (including Greece), China’s

economy and potential spillover risks, virtual currency, the London Interbank Offered

Rate (LIBOR), central counterparty supervisory stress tests, and qualified financial

contracts. We determined that many topics discussed at the committee meetings were

raised with the Council and were included, as appropriate, in FSOC’s annual report.

Most FSOC members and/or representatives that we interviewed or coordinated with noted

that the SRC is FSOC’s primary mechanism to monitor international financial regulatory

proposals and developments. The SRC serves as a forum for FSOC members and member

agencies to identify, discuss, and analyze potential risks to U.S. financial stability,

which may extend beyond the jurisdiction of a single agency.

Representatives from one member agency stated that proposals and developments monitored

by these committees are shared with the Deputies Committee,7 sometimes as part of a

committee meeting readout, and sometimes as a standalone presentation. Representatives

from another member agency stated that when there is an international financial

regulatory proposal or development of concern from a financial stability perspective,

the Deputies Committee and/or the Council receive briefings from relevant experts

from FSOC member agencies to inform them about the topic.

Footnote 7: The members of the Deputies Committee are senior officials from each of the

member agencies. This committee coordinates and oversees the work of the other interagency

staff committees. [End of footnote]

In addition, several FSOC members and/or representatives stated that FSOC focuses

more on domestic activities than those of an international nature due to the greater

potential influence of domestic developments on U.S. financial stability. For example,

representatives from one member agency stated that FSOC member agencies that are the

lead on domestic regulatory proposals and developments with financial stability

implications are available to brief FSOC members and/or its committees. Despite the

emphasis on domestic developments, briefings on international financial regulatory

proposals and developments are provided by FSOC member experts.

Annual Reporting

The Dodd-Frank Act requires FSOC to report to Congress annually about: (1) its

activities; (2) significant financial market and regulatory developments; (3) potential

emerging threats to the financial stability of the United States; and (4) recommendations

to: (i) enhance the integrity, efficiency, competitiveness, and stability of U.S.

financial markets; (ii) promote market discipline; and (iii) maintain investor confidence,

among other things. Consistent with this charge, we found that FSOC’s annual reports

described the activities of the Council and its subcommittees, including international

financial regulatory proposals and developments. Most of the FSOC members and/or

representatives we interviewed or coordinated with, told us that FSOC monitors international

financial regulatory proposals and developments through its annual reporting process.

Specifically, many FSOC members and/or representatives participate in FSOC’s annual report

drafting process, which serves as an opportunity for participating members and member

agencies to discuss and provide input about international activities.

FSOC has made no recommendations related to international financial regulatory proposals

and developments in its annual reports, which FSOC has issued to Congress each year since

its inception in 2010. An FSOC Secretariat official told us that should the Council identify

a need to make a recommendation related to an international regulatory proposal or development,

it would likely accomplish this through its annual report.

Individual Member Agencies’ Efforts

Some FSOC member agencies independently monitor international activities within their agencies’

purview and hold discussions with foreign counterparts. The knowledge these member agencies

gain from these activities can be shared among each other and at FSOC meetings. Examples of

agencies’ independent activities include: participation in working groups and committees of

the Financial Stability Board (FSB) and other international organizations,8 and information

sharing with agencies’ international affairs offices. For example, Treasury participates

in the FSB. The Securities and Exchange Commission is active in monitoring international

activities and regulatory developments through a variety of methods, including participation

in international financial regulatory organizations of which it is a member (e.g.,

FSB, International Organization of Securities Commission (IOSCO) and working groups

thereof), and direct engagement with foreign counterparts that are market regulators. The

Commodity Futures Trading Commission conducts its own monitoring of international

financial regulatory proposals through its membership in the IOSCO, the Over-The-

Counter Derivatives Regulators Group, and as an invited guest to working groups and

committees of the FSB. The Federal Deposit Insurance Corporation participates in

international standard-setting bodies and engages in its own discussions with international

supervisors and regulators. The Board of Governors of the Federal Reserve System

monitors international financial developments consistent with its mandate. For example,

the Federal Reserve Board’s Division of International Finance conducts research,

analyzes policies, and reports in the areas offoreign economic activity, U.S. external trade

and capital flows, and developments in international financial markets and institutions.

FSOC Secretariat officials told us that FSOC seeks to avoid duplication or overlap with its

member agencies’ individual efforts in monitoring international developments.

Footnote 8: The FSB was established in April 2009 and serves as an international body that

monitors and makes recommendations about the global financial system. The U.S. member

institutions on the Board are the Board of Governors of the Federal Reserve System, the

U.S. Securities and Exchange Commission, and Treasury. Additional background is available

online at www.fsb.org.

FSOC MEMBERS CONSIDER THE MONITORING PROCESS ADEQUATE

All FSOC members and/or representatives who provided views on this issue described

FSOC’s monitoring of international financial regulatory proposals and developments as

adequate since FSOC’s monitoring process accomplishes its intended purpose, which is

to keep abreast of international issues that may pose risks to the U.S. financial system

and raise awareness of those issues. We note that as a practical matter, FSOC does

not have decision making authority over international financial regulatory proposals

or developments.

A couple of members suggested that FSOC could enhance its monitoring process by

incorporating additional or more focused briefings at its principals and committee

meetings. One of these members suggested that FSOC’s RRC could receive periodic updates

on key international regulatory proposals being considered in various financial sectors

while the SRC could receive periodic updates on international market developments. That

member also suggested that it would be appropriate for the Nonbank Financial Companies

Designations Committee (Nonbank Designations Committee)9 to receive updates regarding the

global systemically important insurers’10 process and/or activities-based approach being

discussed at the International Association of Insurance Supervisors.11 In addition, the

member stated that it would make sense for the principals to receive briefings regarding

the most significant proposals and market developments to the extent that those proposals

and developments may impact U.S. financial stability.

Footnote 9: The Nonbank Designations Committee supports FSOC in fulfilling its

responsibilities to consider, make, and review determinations that nonbank financial

companies shall be supervised by the Board of Governors of the Federal Reserve System and

be subject to enhanced prudential standards, pursuant to the Dodd-Frank Act. [End of

footnote]

Footnote 10: Insurers identified by the FSB as those whose distress or disorderly failure,

because of their size, complexity, and interconnectedness, would cause significant

disruption to the global financial system and economic activity. [End of footnote]

Another member suggested that agencies who participate in international regulatory

coordination and standard-setting bodies could make a greater effort to regularly present

to the SRC, RRC, or other FSOC committees about their coordination efforts with

international regulatory authorities, as appropriate. The member suggested FSOC should

make a greater effort to cover, in committee meetings, the risks posed to systemically

important foreign financial institutions by domestic and international financial regulatory

proposals and developments. According to that member, international topics covered

by the SRC are generally related to international economic or political developments as

opposed to international financial regulatory developments. This member suggested that

FSOC could make a greater effort to connect emerging international risks to international

financial regulatory proposals intended to mitigate those risks. Additionally, this member

stated that greater effort could be made by the SRC to cover international developments

and proposals discussed in FSOC’s annual report.

Additionally, representatives from one FSOC member agency stated that FSOC does not

need to get involved in areas where regulators already exist and should continue monitoring

areas such as risks related to LIBOR, European debt, and the Chinese shadow banking system,

where there is no lead U.S. financial regulatory agency.

Footnote 11: Established in 1994, the International Association of Insurance Supervisors

is the international standard-setting body responsible for developing principles, standards,

and other supporting material for the supervision of the insurance sector and assisting in

their implementation. [End of footnote]

CONCLUSION

We determined that FSOC has a process for monitoring international financial regulatory

proposals and developments. FSOC’s monitoring is evidenced by the discussion of international

topics at FSOC principals’ meetings, information sharing at FSOC committee-level

meetings, and the development and publishing of its annual report.

All FSOC members or member representatives who offered an opinion described FSOC’s process

to monitor international financial regulatory proposals and developments as adequate.

Although they described FSOC’s monitoring process as adequate, several members and/or

representatives offered suggestions for enhancing the process which included, but were

not limited to: (1) asking member agencies who participate in international regulatory

coordination, as well as standard-setting bodies, to regularly present to FSOC’s

committees on coordination efforts with international regulatory authorities; (2)

making a greater effort to cover the risks posed to systemically important foreign

financial institutions by domestic and international financial regulatory proposals

and developments; (3) separating the types of periodic updates received by the SRC and

RRC—specifically, international market updates versus international financial regulatory

proposals, respectively; (4) receiving briefings at principals’ meetings regarding

the most significant international financial regulatory proposals and market developments

to the extent that those activities may impact U.S. financial stability; and (5)

continuing FSOC’s monitoring efforts in areas where no lead financial regulatory

agency exists.

We encourage FSOC to consider incorporating into its process the suggestions made by

its members to the extent the suggestions are consistent with FSOC’s focus on identifying

and addressing threats to the stability of U.S. financial system. We are not making

any recommendations to FSOC as a result of our audit.

FSOC Response

In a written response, Treasury, on behalf of the FSOC Chairperson, acknowledged

its monitoring of international financial regulatory proposals and developments as

outlined in this report. The response stated that the suggestions made by several FSOC

members to further enhance the Council’s work will be considered.

Appendix I:

Objective, Scope, and Methodology

Objective

The audit objective was to assess the Financial Stability Oversight Council’s (FSOC)

monitoring of international financial regulatory proposals and developments.

Scope and Methodology

The scope of this audit included FSOC’s monitoring of international financial regulatory

proposals and developments from January 2016 through January 2018.

To accomplish our objective, we:

• reviewed the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) to

determine FSOC’s statutory purposes and duties;

• interviewed staff from the FSOC Secretariat to determine FSOC’s process of monitoring

international financial regulatory proposals and developments;

• interviewed or coordinated with FSOC members and member agency representatives to obtain

their views and to determine their involvement in FSOC’s process of monitoring international

financial regulatory proposals and developments;

• reviewed past FSOC and Council of Inspectors General on Financial Oversight annual reports,

FSOC’s bylaws, FSOC’s committee charters for the following committees: Data Committee;

Financial Market Utilities and Payment, Clearing and Settlement Activities Committee; Nonbank

Financial Companies Designations Committee; Regulation and Resolution Committee; and the

Systemic Risk Committee;

• reviewed FSOC’s Principals’ meeting minutes, and meeting agendas for FSOC’s Systemic Risk

Committee and Regulation and Resolution Committee (FSOC is not required to prepare meeting

minutes for committee meetings; therefore, we could only review agendas for these groups);

and

• created a questionnaire designed to gather specific information regarding each FSOC member

and member agency’s participation in the monitoring of international financial regulatory

proposals and developments as well as their assessment of FSOC’s work in this area. This

questionnaire was used by each of the Working Group members to facilitate the consistent

collection of information from all interviewees. Several members self-reported their

responses to the questionnaire.

We performed fieldwork from February through June 2018. We conducted this performance

audit in accordance with generally accepted government auditing standards. Those standards

require that we plan and perform the audit to obtain sufficient, appropriate evidence to

provide a reasonable basis for our findings and conclusions based on our audit objectives.

We believe that the evidence obtained provides a reasonable basis for our findings and

conclusions based on our audit objectives.

[End of Appendix 1 Objective, Scope, and Methodology]

Appendix II:

Prior CIGFO Reports

The Council of Inspectors General on Financial Oversight (CIGFO) has issued the following

prior reports:

• Audit of the Financial Stability Oversight Council’s Controls over Non-public Information,

June 2012

• Audit of the Financial Stability Oversight Council’s Designation of Financial Market

Utilities, July 2013

• Audit of the Financial Stability Oversight Council’s Compliance with Its Transparency

Policy, July 2014

• Audit of the Financial Stability Oversight Council’s Monitoring of Interest Rate Risk

to the Financial System, July 2015

• Audit of the Financial Stability Oversight Council’s Efforts to Promote Market

Discipline, February 2017

• CIGFO’s Corrective Verification Action on the Audit of the Financial Stability

Oversight Council’s Designation of Financial Market Utilities, May 2017

• Top Management and Performance Challenges Facing Financial Regulatory Organizations,

September 2018

[End of Appendix II: Prior CIGFO Reports]

Appendix III: FSOC Response

December 19, 2018

The Honorable Eric M. Thorson

Chair, Council of Inspectors General

on Financial Oversight (CIGFO)

1500 Pennsylvania Avenue, NW

Washington, D.C. 20220

Re: Response to Draft Audit Report: CIGFO’s Audit of the Financial Stability Oversight

Council’s Monitoring of International Financial Regulatory Proposals and Developments

Dear Mr. Chairman:

Thank you for the opportunity to review and respond to your draft audit report. Audit of

the Financial Stability Oversight Council’s Monitoring of International Financial Regulatory

Proposals and Developments (the Draft Report). The Financial Stability Oversight Council

(FSOC) appreciates the CIGFO working group’s review of the FSOC’s efforts to monitor

international issues consistent with its statutory duties. This letter responds on behalf of

Secretary Mnuchin, as Chairperson of FSOC, to the Draft Report.

As the Draft Report notes, FSOC monitors international financial regulatory proposals and

developments in several ways, including through the development of its annual reports;

discussions at Council and staff-level committee meetings and other staff-level discussions;

and through the direct international engagement of its member agencies that inform their

participation on FSOC. The report noted that FSOC members and their staffs expressed their

overall satisfaction with FSOC’s monitoring in this area and believe the process is adequate.

CIGFO made no recommendations as a result of the working group review. The Draft Report

notes that several FSOC members offered suggestions to further enhance FSOC’s work, which

we will consider in the future.

Thank you again for the opportunity to review and comment on the Draft Report. We value

CIGFO’s input and look forward to continuing our constructive engagement with you.

Sincerely,

/s/

Bimal Patel

Deputy Assistant Secretary for the Financial Stability Oversight Council

[End of Appendix III: FSOC Response]

Appendix IV: CIGFO Working Group

Department of the Treasury Office of Inspector General, Lead Agency

Eric M. Thorson, Inspector General, Department of the Treasury, and CIGFO Chair

Deborah Harker

Lisa Carter

Jeffrey Dye

Vicki Preston

Virginia Shirley

Clyburn Perry III

Board of Governors of the Federal Reserve System and the Bureau of Consumer Financial

Protection Office of Inspector General

Mark Bialek, Inspector General, Board of Governors of the Federal Reserve System and Bureau of

Consumer Financial Protection

Chie Hogenmiller

Melissa Chammas

Commodity Futures Trading Commission Office of Inspector General

A. Roy Lavik, Inspector General, Commodity Futures Trading Commission

Miguel Castillo

Branco Garcia

Federal Deposit Insurance Corporation Office of Inspector General

Jay N. Lerner, Inspector General, Federal Deposit Insurance Corporation

Robert Fry

Federal Housing Finance Agency Office of Inspector General

Laura Wertheimer, Inspector General, Federal Housing Finance Agency

Marla Freedman

Bob Taylor

Jim Lisle

April Ellison

Securities and Exchange Commission Office of Inspector General

Carl W. Hoecker, Inspector General, Securities and Exchange Commission

Rebecca L. Sharek

Carrie Fleming

[End of Appendix IV: CIGFO Working Group]

[End of report]