---

Last week, the Risk Management Association (RMA), presented their 2024 Annual Risk Management Virtual Conference, offering hours of content on a wide range of credit and lending subjects. Our credit risk professionals were in attendance and have summarized what we feel were the key takeaways around some of the most pressing issues in the banking industry.  We hope that you find this information pertinent and useful.   

Please note that the following summary is assembled based on the opinions of the panelists during the RMA Conference, and is presented here for informational purposes. 

The Economy, CRE and What’s Next

Speaker: Victor Calanog – Manulife Investments

From the top, “We are turning the corner”. But there is uncertainty, which appears to be rising due to political/regulatory change and the shift from rate hikes to rate cuts.

At the beginning of 2024, it was estimated that world GDP would slow, but that changed around June due to rate cuts. These rate cuts are occurring because the threat of inflation is receding – but unfortunately, labor markets are not looking good, which could be a sign of an impending recession. Recessions are a fact of life when it comes to business, and in a long enough timeline, they are always a possibility.

As we begin to turn the corner with rates, we will continue to experience volatility. As lending markets thaw, risk premium will compress as the market becomes more competitive, which will in theory stabilize markets.

Rate changes mean that demand for refinancing will remain high, but lenders will have to step up. As rates have come down, activity has increased, we will be busy in the next 12-15 months. The speaker said that it’s hard to call this the end of a cycle. Usually you do it after it passes. It’s very hard to do it beforehand.

CRE Cap rates flattened in 2022 and ticked up slightly in recent months, but they are stagnant compared to ten-year treasury yield. On the buy side, can’t rely on traditional cap rate compression from the past 10-15 years. Returns from real estate will also remain in flux.

One area of new growth is “cold storage” – a subtype of industrial storage – it is soaring. (refrigerated warehouses). Aging inventory and complex construction are powering this growth. This is huge for food transportation and bio-pharmacy industries that need their inventory to be kept cold. Best markets for this are east coast cities with ports (Baltimore, Philadelphia, NYC).

Using AI to Boost Your Efficiency

Speakers – Erik Shumar and Jenny Wei – Huron Financial Institutions

Representatives from Huron Financial discussed issues with AI in banking. AI has been discussed at RMA for years, but now it has moved past just fraud applications, into potential uses at every area of business.

One panelist said “topic detection” for regulations is a good use of AI as it gives the bank the ability to look at its regulatory inventory, all of the laws and rules governing it, and determine which topics can categorize them. Recent MRA’s have spurred banks’ obligations to map regulatory imperatives to their policies and bank cultures. They can comb the laws and enhance the connections that might not be as clear as they should be to adhere to rules and regulations. In the old days, analysts would look through everything and compile lists and tasks – could take years. Now? By leveraging AI, it can be done within months.

Banks are using Gen AI mostly internally. They are not putting it into public ChatGPT so that the banks have more data protection and cybersecurity controls built-in. That does add to the expense profile and expertise of the staff needed to build and use it, however.

How much is it to start? Depends on the use case, but getting started it’s fairly reasonable. It’s when you get to customizing, repeat use, and owning licenses that the bills really start to pile up. That’s why for some smaller banks, they feel it’s just not worth the expense.

How Banks Can Mitigate Unaffordable Insurance

Speakers: Matt Bryant – Frost Bank, Donald Sheets – Harvard University, Christian deRitis – Moody’s Analytics

How did we get to this place where insurance prices have jumped? Anecdotally, in late 2022 to early 2023, the rising costs of everything, materials and increased property taxes contributed. There had been a steady climb over the last decade, but the pandemic caused an acceleration, specifically in higher building and labor costs.

The recent situation is complicated because many things have been happening all at once – pandemic, changing climate, supply issues, rising costs, litigation and regulatory issues all contributing. Supply chain and building costs are a major reason.

Based in Texas, one speaker commented that where there’s a larger population there is larger possibility for loss with more rooftops for hurricanes and tornadoes to hit. This is intensified by the supply line disruption that increases the cost of repair and replacement.

Another panelist says it’s much more than that – when they started examining the issue, they noticed a larger issue that goes all the way up to the reinsurance levels. Modeling for premiums seems broken, and that is causing panic which impacts the insurers, and no type of insurance, in any region is immune. State Farm is on record saying that enhanced appetite for development results in building in more dangerous areas, which increases the price of insuring homes.

Regulatory Panel Discussion – Heightened Risk Focus for 2025

Speakers: Doreen R. Eberley – FDIC, Scott Hunt – National Credit Union Administration, Grovetta Gardineer – OCC, Jennifer Burns – Federal Reserve Board

Current regulatory focus is on managing liquidity. With the reduction in rates, banks have seen deposits increase and some pressure easing on competition. There is a growing importance of stress testing, and contingency funding plans are still important. It is important for banks to be focused on deposits and customer segmentation. Balance sheet management doesn’t stop with liquidity. Interest rate and price risk should be considered when looking at the balance sheet.

There is a recognition that the regulatory agencies will be conducting contingency funding plan examination – not just at your bank, but also with peers and the industry at large. They need to see which way the tide is going and adjust. Credit unions are bound by regulation to have a federal backstop, but also have a central liquidity facility. Credit unions should consider both if it fits in their strategy.

Commercial credit risk remains moderate and stabilizing, but there are still pockets of risk in regional lending markets. CRE is still a concern. With Multi-Family, some borrower costs are rising faster than income – insurance in particular has become a fast-rising cost. Unfortunately, regulators feel that stress testing of repayment loan capacity is not happening consistently in the industry (as mentioned earlier).

CRE Office – It has been in the spotlight. Banks will need to adjust their analysis to what is currently going on, not what was happening when the loan was booked. Adjusting associated Q-factors for the reserve is now more important than ever.

OCC’s bank supervision operating plan suggests that they will be paying particular attention to consistency with banks’ risk appetite, adequacy of loan reserves and credit risk management practices, and especially their stress testing of the CRE office sector.

There is also a new focus on bank data quality, with the agencies looking for current, comprehensive, and reliable data. But, one must consider whether the data looked at is the proper data. There is an internal effort to ensure that regulators are inquiring about and understanding the right information.

Regarding both data and risk management, sufficiency of risk identification and measurement systems is among the greater challenges that CROs encounter. Challenges come from data integrity/accuracy, disaggregated processes across the bank, and disparate IT systems that create aggregation difficulties.

Proactive and demonstrated risk management is very important because it is the key determinate for a bank staying safe and in compliance for the duration. Especially if a bank starts small and grows, they need to learn and show evidence that they understand the additional risks that come from expanding portfolios.

When it comes to risk, “survivor bias” is a huge factor. People who have weathered previous downturns gain confidence, even if confidence is misplaced and they feel that they can ‘work through it.’ Risk is always evolving. The threats facing borrowers and banks today are very different from historic downturns and shouldn’t be ignored.

Cybersecurity: FDIC is sunsetting the cybersecurity assessment tool (“CAT”). It was originally a status check for banks to see their deficiencies and where they could improve. The tool has served them and community banks well, but the industry has matured and cyber risks have expanded, so the controls have grown and now a second framework is being issued. The industry should work directly with the companies creating the frameworks, so the regulators are “removing that barrier.”

Cybersecurity impacts everything. The use of AI is only fueling cyber threats, and with AI in Fintechs, there are ‘more doors’ for bad actors to get through. This environment heightens the need for good third-party risk management. Throughout their IT supply chain, banks need to reduce the options for complications as a result of a cyber threat. Banks and service providers should have security plans and identify vulnerability factors (use multi-factor authentication, testing of software updates, phased software rollouts, timely patch management and numerous backups.)

Leadership Panel: Today’s Risk Management Challenges in Mid-Tier Banks

Speakers: Rob Edwards – United Community Bank, Nathan Jones – Heartland Financial, USA Inc., Lisa Dow – Umpqua Bank, Paul Hoerig – First United Bank

The biggest challenges and opportunities in 2025 include managing the growing impact of Fintechs. While Fintechs are better with innovation, the banks themselves have to get better with it and marketing themselves. “Fintechs are ‘Amazon easy,’ but banks are not.” Fighting fraud is just getting tougher; we need to use technology to fight it. Maintaining process discipline and still move faster, how do we deal with the pace of change? You must try to spread a high level of risk ownership throughout the organization.

Priorities for 2025 include planning so that “people don’t think that RISK is just a 4-letter word”. You must remain curious as an organization. It is important to maximize vendor relationships and make sure the right talent is in the right roles. Work to retain your talent, and find ways to attract young talent.

On AI: How do you balance the potential for efficiencies and improving processes with the risks? Banks are still in the learning phase—how do we harness the power? Most are using AI for internal needs first, before using with customers. It’s going to be a heavy lift. We use humans to validate AI decisions, but under what circumstances? Banks want to be fast followers with AI but not cutting edge. We must effectively put risk guard rails around the opportunities, i.e, robust policies and controls. Banks must do the due diligence up front to understand the ripple effects.

What are important skills of a CCO or CRO that would be surprising to many? A diverse set of skills and approaches including solving puzzles, showing kindness and a demonstrable conviction towards managing risk. You have to have perspective, must be a good listener, be collaborative and when working with individuals, act to get the most out of them.

M&A Activity in Community Banking

Speakers: Michael Reed – Covington & Burling, Michael Nonaka – Covington & Burling

A view of M&A Landscape: There had been a significant slowdown due to the regulatory framework, uncertain economy, rising interest rates and simply fewer banks to merge. A lot of banks investment portfolios were upside down, and credit and interest rate marks made it challenging to agree on price.
It’ll take a while for investment portfolios and loan portfolios to turn over and make this easier. Lower interest rates are helping with net interest margin. Another growing trend is Credit Unions acquiring banks, as CUs are able to pay more and will continue to be competitive buyers.

It is anticipated that the new administrative changes from the Trump regime will have an impact on M&A. While it will take some time for regulatory leadership to change, things should be more M&A friendly in the future. A return to less subjective supervision should help M&A as well. Anticipate a change in the expertise level of examiners as there will be turnover, forced or otherwise, some for cost reduction reasons.

The 2024 M&A guidelines established more challenging requirements including looking at deposit overlap (concentration risk), and will look at more quantitative requirements going forward in 2025.

Harmonizing the First, Second, and Third Lines of Defense: Strengthening the Three-Legged Stool

Speakers: Humberto Salomon – Citigroup, Saad Aslam – Citizens Bank, Mark Huffstetler – Truist

It is an important system of interdependent checks and balances; to be effective all three lines have a role and must work together for a common goal.
Each of the panelists’ banks handle Loan Review differently: Some consider it the third line as direction comes from the board; and Loan Review provides the board with risk insights. For others, it’s the second line —translating bank risk appetite into actionable guidelines (as enabler, not enforcer); providing clarity and transparency.

Some even consider Loan Review part of the first line — at those banks loan review owns and manages risk; with oversight of credit management of the entire lifecycle of the credit. The 1st and 2nd lines jointly approve credits; perform portfolio management and quality assurance in the business line.

Common areas of concern include lender incentives– we need all lines of defense to manage it (checks & balances). Incentive plans drive behaviors—both good and bad. Banks have to be careful that the third line isn’t just a “Monday morning QB.” We need constant communication between the 3 lines; and criticisms must be constructive.

There needs to be an escalation process to get more eyes on riskier credits—informal, formal, and/or committees. It is best to have earlier conversations before a credit transitions to a distressed state.

On policies and guidelines: Policies drive the ship; they help make sure the 1st line knows how to manage risk, so they need to understand why the policies are important. The policies need to be comprehensive and practical, not overly complex and should be relevant as market conditions change. Policies are what actions are assessed against so they have to be dynamic due to changes in marketplace and in risk appetite. They can’t be too loose or too tight.

On policy exceptions: A good policy creates a path for exceptions, but policies can’t consider every situation, so there need to be exceptions. There is a real need to track exceptions— What is driving exceptions? Is market changing? Is policy too tight? Is staffing too low?

On Regulation: the best way to manage regulators is with absolute transparency—no surprises, you should provide a roadmap and guardrails. It is important to engage with regulators in many different forums; ongoing communication is important. Also important is demonstrating Loan Review’s effective challenge for the regulators. Notations in committee minutes are very important as it documents actions and shows an iterative process. It is valuable to document actions and decisions/rationale.

The Financial Services Industry of Tomorrow: A CEO’s Perspective

Speakers: Debbie Bianucci – Prosight Financial Association, Lynn Harton – United Community Bank

Lynn Harton has been a leader at small and large community banks (United Community Bank is approximately $30B in assets). He says “I spend half my time trying to stay small, the other half growing the bank”. “Culture is critical, you have to talk the talk and walk the walk. It’s just what you do – good people make the difference.” At United Community they have been surveying their customers and employees for 20 years (prior to Lynn’s tenure at the bank) and they share the results with them, and take actions to address issues. They primarily focus on the “good experiences” and work on making them even better.

On the economy – There is uncertainty, so you have to be prepared for anything. Things usually don’t change that quickly, so have contingency plans for just about any possibility. What keeps him up at night? Cyber security and fraud, it requires constant due diligence and testing. Not as worried about credit (“we have great people there”) or IT (“that’s a longer-term play”). He said that a few months ago he would have said “regulatory pressure” was a huge concern as we have been in a “regulatory super cycle” the past few years, but now he believes that will change under the new Administration.

On AI, he believes it’s “over hyped now” but “underhyped in the future”. Now it is mostly used to increase efficiency and speed with normal daily activities, but in the future whole new applications and use cases will be developed. Today it is “helpful, but not a game changer”.

Chat with Acting Comptroller of the Currency – Michael Hsu

Director Hsu says that the industry today reminded him of 2007, and worries about complacency. “Risk management is like doing exercises, you do them every day to stay fit, consistently”. Hsu feels he is a risk manager at heart, if you do the job well, you minimize surprises – “hope for the best but prepare for the worst”. It is important for banks to not lose the trust and confidence of the public.

On 2025 priorities of the OCC, the recently released “Bank Supervision Operating Plan” focuses on three areas: Financial Risk (Credit, Allowance), Operational and Compliance (included Cyber) risks. Currently there’s less focus on the financials risks, more on compliance/operational risk as the OCC believes that is more reflective of banking today.

On the survival of community banks – “We have the largest and most diverse economy in the world. It only makes sense that we have a large and diverse banking system. Banks exist to serve the people and the communities. Community banks offer some things that large banks can’t – targeted services for specific needs.” On the growth of the largest banks, “our economy is growing, so are the banks, and that’s OK, unless they get ‘too big to fail’ – that can be unmanageable. If banks begin to grow and get unmanageable, the Agency will see the signs”.

On AI in banking – “Banks have a good approach to innovation, start small and get sign-offs from the right people, then grow it from there. The challenge is the accountability, that is not clear. If AI hallucinates who is responsible? The developer, the users? It’s a black box. We encourage the banks to learn along with their regulators. We have an opportunity to learn together in a controlled, trustworthy way”.

On Cyber Security – “We have made great progress. The public/private partnership of information sharing has been well-coordinated. We realize that in this framework one weak link impacts us all. But there is still lots of work to do there…fraud is growing everywhere, and the bad guys are getting better. We need constant improvement in our protections. The playing field is constantly changing, and we need a collective industry response. It can erode the trust in banking.”

Looking at 2025: “We will have a ‘vibe shift’ in 2025 – some good, like supporting growth and competition, which can be positive and foster innovation. But, I have concerns as a risk manager. Deregulation can be OK if it’s done smartly. But if it’s a race to the bottom, that’s bad. Talk with your regulators about where the ‘minimum’ is. We need some controls. We don’t want them so weakened that there’s no effective controls at all.”

CEO Spotlight – Managing Diversified Growth in a Changing World

Speakers: Monica Bowe – First Busey Corporation, Priscilla Sims Brown – Amalgamated Bank

Amalgamated Bank was started to support people in the textile trade (“needle workers”) about a 100 years ago, as they could not find a bank that met their needs. Amalgamated now is a $8+ billion in assets with coast to coast presence and close to $50 billion in investment and custodial assets. They consider themselves a “socially responsible bank”. They work with “change makers” and are active in supporting climate change lending, financial health and affordable housing – supporting social and economic justice.

Amalgamated is very focused on its market segment, and its risk management practices reflect deep institutional knowledge of its market segments. The Bank leverages their understanding of the markets to apply rigorous risk management practices for the industries they serve, and also use “data driven” risk management practices.

The CEO of Amalgamated sees opportunities and risks in working with Fintechs – they can be a disrupter, and their barriers to entry seem to be dropping. As they get less regulated, they will be able to compete by lowering the cost of serving customers – gaining efficiencies from their technology to learn how to serve their customers better – “they could leapfrog traditional banking but they aren’t just competitors, we can partner with them and learn from them. They and we can use their tools to learn how to better understand what customers want and how to communicate with them.”

The Bank uses AI and other tools to lower the barrier to knowing customers better – within specific industry segments. “Today we have a leg up on most Fintechs because we use our data to know our customers, but tomorrow that advantage may not be there. We have to learn how to use their tools to stay up with them.”

On 2025 trends and efforts: “It will be an exciting year, with opportunities for innovation and technology. Our customers are getting more sophisticated. We also want to address the growing wealth gap in our country – and we are looking at tools to help us support the lower end. This can be through supporting small businesses and more equitable access to capital. There is also growth in ‘employee power’ – the employee value proposition. We need to make banking a more innovative and exciting place to work and grow.”

“We are looking at innovation in better understanding the customer experience and how customers can apply for credit in an aging society. We are also looking at mid-size business growth – which we feel will be huge. We need to continue to segment our customers to offer them more personalized services.”

Election Outcomes and the Political Climate in 2025 and Beyond

Speaker: Carrie Sheffield – Independent Women’s Forum

Carrie Sheffield, a nationally known economist and journalist, reviewed the possible impact of the change of administration in Washington on the banking industry.

The main issue in discussion by Congress is the reduction of the corporate tax rate, and extending tax cuts for businesses. Congress will use the “Congressional Review Act” which mandates that Congress can review newly instituted regulations. They will use this to scrutinize Biden’s newer regulations – reported to be 56 different items. They will also likely look at recent rules relating to climate change and energy. There is a belief that the recently passed climate disclosure rules published by the SEC, currently tied up in litigation, will now also be repealed.

There is a sense that the Trump administration will look more favorably at Fintechs and Crypto currency as part of the “infrastructure of the future” of banking. Regulators have been accused of “slowing down innovation” in these areas. Domestic manufacturing is likely to also reap benefits from the new administration thanks to promised tax cuts and foreign tariffs likely improving domestic manufacturers profitability and creating a better lending environment for that market.

Another area of emphasis is expected to be a 25 – 30% reduction in government “bureaucracy costs,” though this has not yet been defined, but workforce reduction is likely. There is also likely to be changes in civil service employment contracts that will bring them more in line with non-government positions, reclassifying them so they have less “shielding” from changes in administrations, and less robust benefits. It appears that Elon Musk and his associates will help design ways to reduce government as a way to help reduce the U.S. deficit.

In theory, regulatory relief will mean more profits for industry, and so more deposits and incremental growth in lending.

Changes in immigration will have a large potential impact, particularly the suggested mass deportations. This will put pressure on the agricultural industry, adding to risk in that sector.

Other possible areas of impact discussed during the campaign include:

• Dodd Frank will likely be reviewed and revised – something that has been under discussion already – some believe it has been unfair to community banks in particular
• Interest rate caps on credit cards (which is not as welcomed by bankers)
• Home building on Federal lands
• Tax cuts for first time home buyers
• Possible claw back on the power of the CFPB (though Trump was not successful in this effort before)
• Fed interest rate caps
• Overall roll-backs on home regulatory-related costs

Cybersecurity Lessons and Best Practices Fireside Chat

Speakers: Isio Nelson – ProSight Financial Association, Russ Ayres – Equifax

Equifax experienced a widely publicized data breach a number of years ago and this session was an interview with the then acting CISO (Chief Information Security Officer) of Equifax who talked about lessons learned from that experience – which was an early example of a significant data breach in the financial industry.

What happened? The breach was first recognized by a technician who was doing routine upgrades of certificates on the server used for dispute resolution. The technician noticed attempts to access the server from an overseas address when updating the expired certificate and monitored activity closely after the upgrade. He saw the repeated foreign based incursions, shut down the server and notified management. As it turned out, it was determined that the attack was launched by the Chinese military. Equifax still does not know why they in particular were attacked.

Lessons learned from the experience and remediation efforts included:

• Build a relationship with your local FBI field office. While Equifax had one already, any financial institution can form one, and it is very helpful.
• Don’t underestimate the psychological impact on the people working on the resolution of the problem, it can take a significant toll and lots of long hours.
• Know who to communicate status with at the bank. Clearly legal counsel and Compliance, but also Public Relations.
• Don’t forget to have internal communications with the company staff. They are your brand ambassadors and if they are kept in the dark, it hurts the effort to recover. The CISO stated that he wished he had known that when this incident happened.
• Get industry advice from others that have already gone through these types of events. Their experience is invaluable.

Overall, no matter how thorough and exhaustive your cyber protection processes are, don’t get complacent. Just because nothing shows up in a scan or a test doesn’t mean nothing is there, it just means that your scans or tests didn’t find anything. Having a cyber maturity assessment done is a good start as it can point out areas to focus on, but it’s just a snapshot at the time the assessment is done. A key is to focus on server patch management. It is what can resolve security vulnerabilities.

In the case of Equifax, after the incident, they realized that the company’s culture had to be realigned to make security everyone’s priority. They actually changed some of executive management’s bonus structure to be based on the quality of the company’s cyber security management. This helped realign the company so that data security was part of their DNA.

The lessons Equifax learned were not treated as a corporate a competitive advantage. Instead, the recovery practices and tactics were shared with the industry. They devised a new data security framework that was shared with the industry who also helped to improve it. “Our industry needs to share, and protect our data as a whole. Transparency with each other is a key in this battle with the bad actors out there.”

While fraud and cyber data protection are different disciplines, they can come from the same sources so it’s best to share information internally between those two departments. They can help each other. You must avoid the silos. A good rule of thumb is “if it doesn’t make sense, it’s worth looking at further.”

Chief Credit Officer Leadership Panel: Today’s Risk Management Challenges in Regional and Large Banks

Speakers: Michael Collins – TD Bank USA, F. Clay Gaitskill – KPMG, Lynne Herndon – Western Alliance Bank, Blinn Latta – Bank of America, Melinda Chausse – Comerica Incorporated

KPMG moderated a panel of four large bank CCO’s talking about trends and concerns in today’s credit environment. Key observations included:

• There is a rise in charge-offs in consumer portfolios, and delinquency is edging up as well (they benchmark to 2019– pre-COVID). Those with lower FICO scores are showing more weakening. While unemployment, a key metric, is still pretty good, prices are still high. Discretionary goods are challenged by higher labor costs and interest rates. Inflation hits the lower tier FICO customers more, but there is some optimism in the future as the consumer has proven to be resilient.
• CRE is at the forefront of concern on the commercial side. Downtown Office is a particular concern in the higher interest rate environment. There are also concerns about multi-family and industrial loans, as there is a lot of supply out there. Multi-family is generally OK, but larger banks like to have sponsors with some skin in the game, as even with the challenging interest rate environment, strong sponsors can make up for slow absorption. Lowering interest rates will act as a tailwind. That said, lease renewal risk is real and a longer-term issue. ”If we do have a recession, obviously things could get very bad.”
• Some of the banks on the panel had an “emerging tech firm” book to manage. Comments included that there was a lot of competition out there in that market segment and there was a fair amount of equity out there as well. Banks who have the expertise in this area can do well, while others who don’t know the market well enough can get into trouble. Those banks irked the regulators, which heightened scrutiny on all lenders in this area. A high degree of specialized resources is needed to manage lending in this area effectively.
• Some banks on the panel are finding themselves in competition with private equity. Others see it as an “alternative place to go” if the deal doesn’t work for them. Only recently has private equity really been able to offer competitive deals. They take on higher exposure and are more flexible on leverage than banks typically .
• Climate change and the impact on credit was discussed. Most felt that it was an area to monitor carefully, but no need to take specific action yet, except for the impact on insurance. Smaller businesses are hit particularly hard. The cost of insurance and availability is a growing issue. The problems in Florida were discussed, but most agreed that the climate-related losses were not that high due to the existing insurance and high equity borrowers. It’s a long-term issue but today it is manageable. The concentration risk of too much exposure in Florida today would be a concern.
• Obtaining and retaining senior talent in credit is an issue today that all banks are dealing with. Most larger banks have senior staff with 20 to even 40 years of tenure. Where will the new leadership come from? There is a sense that one credit cycle (10 years) is not enough experience. Credit is a “business of experience” – you have to go through the bad times to understand how to manage it. Today there are few “bankers for life” anymore.

---