82_FR_31278 82 FR 31151 - Agency Information Collection Activities: Information Collection Renewal; Comment Request; OCC Guidelines Establishing Heightened Standards for Certain Large Insured National Banks, Insured Federal Savings Associations, and Insured Federal Branches

82 FR 31151 - Agency Information Collection Activities: Information Collection Renewal; Comment Request; OCC Guidelines Establishing Heightened Standards for Certain Large Insured National Banks, Insured Federal Savings Associations, and Insured Federal Branches

DEPARTMENT OF THE TREASURY
Office of the Comptroller of the Currency

Federal Register Volume 82, Issue 127 (July 5, 2017)

Page Range31151-31153
FR Document2017-14000

The OCC, as part of its continuing effort to reduce paperwork and respondent burden, invites the general public and other federal agencies to take this opportunity to comment on a continuing information collection, as required by the Paperwork Reduction Act of 1995 (PRA). In accordance with the requirements of the PRA, the OCC may not conduct or sponsor, and the respondent is not required to respond to, an information collection unless it displays a currently valid Office of Management and Budget (OMB) control number. The OCC is soliciting comment concerning its information collection titled, ``OCC Guidelines Establishing Heightened Standards for Certain Large Insured National Banks, Insured Federal Savings Associations, and Insured Federal Branches.''

Federal Register, Volume 82 Issue 127 (Wednesday, July 5, 2017)
[Federal Register Volume 82, Number 127 (Wednesday, July 5, 2017)]
[Notices]
[Pages 31151-31153]
From the Federal Register Online  [www.thefederalregister.org]
[FR Doc No: 2017-14000]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF THE TREASURY

Office of the Comptroller of the Currency


Agency Information Collection Activities: Information Collection 
Renewal; Comment Request; OCC Guidelines Establishing Heightened 
Standards for Certain Large Insured National Banks, Insured Federal 
Savings Associations, and Insured Federal Branches

AGENCY: Office of the Comptroller of the Currency (OCC), Treasury.

ACTION: Notice and request for comment.

-----------------------------------------------------------------------

SUMMARY: The OCC, as part of its continuing effort to reduce paperwork 
and respondent burden, invites the general public and other federal 
agencies to take this opportunity to comment on a continuing 
information collection, as required by the Paperwork Reduction Act of 
1995 (PRA).
    In accordance with the requirements of the PRA, the OCC may not 
conduct or sponsor, and the respondent is not required to respond to, 
an information collection unless it displays a currently valid Office 
of Management and Budget (OMB) control number.
    The OCC is soliciting comment concerning its information collection 
titled, ``OCC Guidelines Establishing Heightened Standards for Certain 
Large Insured National Banks, Insured Federal Savings Associations, and 
Insured Federal Branches.''

DATES: Comments must be submitted on or before September 5, 2017.

ADDRESSES: Because paper mail in the Washington, DC area and at the OCC 
is subject to delay, commenters are encouraged to submit comments by 
email, if possible. Comments may be sent to: Legislative and Regulatory 
Activities Division, Office of the Comptroller of the Currency, 
Attention: 1557-0321, 400 7th Street SW., Suite 3E-218, Washington, DC 
20219. In addition, comments may be sent by fax to (571) 465-4326 or by 
electronic mail to [email protected]. You may personally inspect 
and photocopy comments at the OCC, 400 7th Street SW., Washington, DC 
20219. For security reasons, the OCC requires that visitors make an 
appointment to inspect comments. You may do so by calling (202) 649-
6700 or, for persons who are deaf or hard of hearing, TTY, (202) 649-
5597. Upon arrival, visitors will be required to present valid 
government-issued photo identification and submit to security screening 
in order to inspect and photocopy comments.
    All comments received, including attachments and other supporting 
materials, are part of the public record and subject to public 
disclosure. Do not include any information in your comment or 
supporting materials that you consider confidential or inappropriate 
for public disclosure.

FOR FURTHER INFORMATION CONTACT: Shaquita Merritt, OCC Clearance 
Officer, (202) 649-5490 or, for persons who are deaf or hard of 
hearing, TTY, (202) 649-5597, Legislative and Regulatory Activities 
Division, Office of the Comptroller of the Currency, 400 7th Street 
SW., Suite 3E-218, Washington, DC 20219.

SUPPLEMENTARY INFORMATION: Under the PRA (44 U.S.C. 3501-3520), federal 
agencies must obtain approval from OMB for each collection of 
information that they conduct or sponsor. ``Collection of information'' 
is defined in 44 U.S.C. 3502(3) and 5 CFR 1320.3(c) to include agency 
requests or requirements that members of the public submit reports, 
keep records, or provide information to a third party. Section 
3506(c)(2)(A) of title 44 requires federal agencies to provide a 60-day 
notice in the Federal Register concerning each proposed collection of 
information, including each proposed extension of an existing 
collection of information, before submitting the collection to OMB for 
approval. To comply with this requirement, the OCC is publishing notice 
of the proposed collection of information set forth in this document.
    Title: OCC Guidelines Establishing Heightened Standards for Certain 
Large Insured National Banks, Insured Federal Savings Associations, and 
Insured Federal Branches.
    OMB Control No.: 1557-0321.
    Description: The OCC's guidelines codified in 12 CFR part 30, 
appendix D establish minimum standards for the design and 
implementation of a risk governance framework for insured national 
banks, insured federal savings associations, and insured federal 
branches of a foreign bank (bank). The guidelines apply to a bank with 
average total consolidated assets:
    (i) Equal to or greater than $50 billion; (ii) less than $50 
billion if that bank's parent company controls at least one insured 
national bank or insured federal savings association that has average 
total consolidated assets of $50 billion or greater; or (iii) less than 
$50 billion, if the OCC determines such bank's operations are highly 
complex or otherwise present a heightened risk as to warrant the 
application of the guidelines (covered banks). The guidelines also 
establish minimum standards for a board of directors in overseeing the 
framework's design and implementation. These guidelines were finalized 
on September 11, 2014.\1\ The OCC is now seeking to renew the 
information collection associated with these guidelines.
---------------------------------------------------------------------------

    \1\ 79 FR 51518.
---------------------------------------------------------------------------

    The standards contained in the guidelines are enforceable under 
section 39 of the Federal Deposit Insurance Act (FDIA),\2\ which 
authorizes the OCC to prescribe operational and managerial standards 
for insured national banks, insured federal savings associations, and 
insured federal branches of a foreign bank.
---------------------------------------------------------------------------

    \2\ 12 U.S.C. 1831p-1. Section 39 was enacted as part of the 
Federal Deposit Insurance Corporation Improvement Act of 1991, 
Public Law 102-242, section 132(a), 105 Stat. 2236, 2267-70 (Dec. 
19, 1991).
---------------------------------------------------------------------------

    The guidelines formalize the OCC's heightened expectations program. 
The guidelines also further the goal of the Dodd-Frank Wall Street 
Reform and Consumer Protection Act of 2010 to strengthen the financial 
system by focusing management and boards of directors on improving and 
strengthening risk management practices and governance, thereby 
minimizing the probability and impact of future financial crises.
    The standards for the design and implementation of the risk 
governance framework, which contain collections of information, are as 
follows:

Standards for Risk Governance Framework

    Covered banks should establish and adhere to a formal, written risk 
governance framework designed by independent risk management. The 
framework should include delegations of authority from the board of 
directors to management committees and executive officers as well as 
risk limits established for material activities. The framework should 
be approved by the board of directors or the board's risk committee, 
and it should be reviewed and updated, at least annually, by 
independent risk management.

Front Line Units

    Front line units should take responsibility and be held accountable 
by the chief executive officer (CEO) and the board of directors for 
appropriately assessing and effectively managing all of

[[Page 31152]]

the risks associated with their activities. In fulfilling this 
responsibility, each front line unit should, either alone or in 
conjunction with another organizational unit that has the purpose of 
assisting a front line unit: (i) Assess, on an ongoing basis, the 
material risks associated with its activities and use such risk 
assessments as the basis for fulfilling its responsibilities and for 
determining if actions need to be taken to strengthen risk management 
or reduce risk given changes in the unit's risk profile or other 
conditions; (ii) establish and adhere to a set of written policies that 
include front line unit risk limits. Such policies should ensure risks 
associated with the front line unit's activities are effectively 
identified, measured, monitored, and controlled, consistent with the 
covered bank's risk appetite statement, concentration risk limits, and 
all policies established within the risk governance framework; (iii) 
establish and adhere to procedures and processes, as necessary to 
maintain compliance with the policies described in (ii); (iv) adhere to 
all applicable policies, procedures, and processes established by 
independent risk management; (v) develop, attract, and retain talent 
and maintain staffing levels required to carry out the unit's role and 
responsibilities effectively; (vi) establish and adhere to talent 
management processes; and (vii) establish and adhere to compensation 
and performance management programs.

Independent Risk Management

    Independent risk management should oversee the covered bank's risk-
taking activities and assess risks and issues independent of the front 
line units by: (i) Designing a comprehensive written risk governance 
framework commensurate with the size, complexity, and risk profile of 
the covered bank; (ii) identifying and assessing, on an ongoing basis, 
the covered bank's material aggregate risks and using such risk 
assessments as the basis for fulfilling its responsibilities and for 
determining if actions need to be taken to strengthen risk management 
or reduce risk given changes in the covered bank's risk profile or 
other conditions; (iii) establishing and adhering to enterprise 
policies that include concentration risk limits; (iv) establishing and 
adhering to procedures and processes to ensure compliance with policies 
in (iii); (v) identifying and communicating to the CEO and board of 
directors or board's risk committee material risks and significant 
instances where independent risk management's assessment of risk 
differs from that of a front line unit, and significant instances where 
a front line unit is not adhering to the risk governance framework; 
(vi) identifying and communicating to the board of directors or the 
board's risk committee material risks and significant instances where 
independent risk management's assessment of risk differs from the CEO, 
and significant instances where the CEO is not adhering to, or holding 
front line units accountable for adhering to, the risk governance 
framework; and (vii) developing, attracting, and retaining talent and 
maintaining staffing levels required to carry out the unit's role and 
responsibilities effectively while establishing and adhering to talent 
management processes and compensation and performance management 
programs.

Internal Audit

    Internal audit should ensure that the covered bank's risk 
governance framework complies with the guidelines and is appropriate 
for the size, complexity, and risk profile of the covered bank. It 
should maintain a complete and current inventory of all of the covered 
bank's material processes, product lines, services, and functions, and 
assess the risks, including emerging risks, associated with each, which 
collectively provide a basis for the audit plan. It should establish 
and adhere to an audit plan, which is periodically reviewed and 
updated, that takes into account the covered bank's risk profile, 
emerging risks, issues, and establishes the frequency with which 
activities should be audited. The audit plan should require internal 
audit to evaluate the adequacy of and compliance with policies, 
procedures, and processes established by front line units and 
independent risk management under the risk governance framework. 
Significant changes to the audit plan should be communicated to the 
board's audit committee. Internal audit should report in writing, 
conclusions and material issues and recommendations from audit work 
carried out under the audit plan to the board's audit committee. 
Reports should identify the root cause of any material issues and 
include: (i) A determination of whether the root cause creates an issue 
that has an impact on one organizational unit or multiple 
organizational units within the covered bank; and (ii) a determination 
of the effectiveness of front line units and independent risk 
management in identifying and resolving issues in a timely manner. 
Internal audit should establish and adhere to processes for 
independently assessing the design and ongoing effectiveness of the 
risk governance framework on at least an annual basis. The independent 
assessment should include a conclusion on the covered bank's compliance 
with the standards set forth in the guidelines. Internal audit should 
identify and communicate to the board's audit committee significant 
instances where front line units or independent risk management are not 
adhering to the risk governance framework. Internal audit should 
establish a quality assurance program that ensures internal audit's 
policies, procedures, and processes comply with applicable regulatory 
and industry guidance, are appropriate for the size, complexity, and 
risk profile of the covered bank, are updated to reflect changes to 
internal and external risk factors, emerging risks, and improvements in 
industry internal audit practices, and are consistently followed. 
Internal audit should develop, attract, and retain talent and maintain 
staffing levels required to effectively carry out its role and 
responsibilities. Internal audit should establish and adhere to talent 
management processes and compensation and performance management 
programs that comply with the guidelines.

Strategic Plan

    The CEO, with input from front line units, independent risk 
management, and internal audit, should be responsible for the 
development of a written strategic plan that should cover, at a 
minimum, a three-year period. The board of directors should evaluate 
and approve the plan and monitor management's efforts to implement the 
strategic plan at least annually. The plan should include a 
comprehensive assessment of risks that impact the covered bank, an 
overall mission statement and strategic objectives, an explanation of 
how the covered bank will update the risk governance framework to 
account for changes to its risk profile projected under the strategic 
plan, and be reviewed, updated, and approved due to changes in the 
covered bank's risk profile or operating environment that were not 
contemplated when the plan was developed.

Risk Appetite Statement

    A covered bank should have a comprehensive written statement that 
articulates its risk appetite that serves as the basis for the risk 
governance framework. It should contain qualitative components that 
describe a safe and sound risk culture and how the covered bank will 
assess and accept risks and quantitative limits that include sound 
stress testing processes and address earnings, capital, and liquidity.

[[Page 31153]]

Risk Limit Breaches

    A covered bank should establish and adhere to processes that 
require front line units and independent risk management to: (i) 
Identify breaches of the risk appetite statement, concentration risk 
limits, and front line unit risk limits; (ii) distinguish breaches 
based on the severity of their impact; (iii) establish protocols for 
disseminating information regarding a breach; (iv) provide a written 
description of the breach resolution; and (v) establish accountability 
for reporting and resolving breaches.

Concentration Risk Management

    The risk governance framework should include policies and 
supporting processes appropriate for the covered bank's size, 
complexity, and risk profile for effectively identifying, measuring, 
monitoring, and controlling the covered bank's concentrations of risk.

Risk Data Aggregation and Reporting

    The risk governance framework should include a set of policies, 
supported by appropriate procedures and processes, designed to provide 
risk data aggregation and reporting capabilities appropriate for the 
covered bank's size, complexity, and risk profile and to support 
supervisory reporting requirements. Collectively, these policies, 
procedures, and processes should provide for: (i) The design, 
implementation, and maintenance of a data architecture and information 
technology infrastructure that support the covered bank's risk 
aggregation and reporting needs during normal times and during times of 
stress; (ii) the capturing and aggregating of risk data and reporting 
of material risks, concentrations, and emerging risks in a timely 
manner to the board of directors and the OCC; and (iii) the 
distribution of risk reports to all relevant parties at a frequency 
that meets their needs for decision-making purposes.

Talent and Compensation Management

    A covered bank should establish and adhere to processes for talent 
development, recruitment, and succession planning. The board of 
directors or appropriate committee should review and approve a written 
talent management program. A covered bank should also establish and 
adhere to compensation and performance management programs that comply 
with any applicable statute or regulation.

Board of Directors Training and Evaluation

    The board of directors of a covered bank should establish and 
adhere to a formal, ongoing training program for all directors. The 
board of directors should also conduct an annual self-assessment.
    Type of Review: Regular review.
    Affected Public: Businesses or other for-profit.
    Estimated Number of Respondents: 41.
    Estimated Burden per Respondent: 3,776 hours.
    Estimated Total Annual Burden: 154,816 hours.
    Comments: Comments submitted in response to this notice will be 
summarized and included in the request for OMB approval. All comments 
will become a matter of public record. Comments are invited on:
    (a) Whether the collection of information is necessary for the 
proper performance of the functions of the OCC, including whether the 
information has practical utility;
    (b) The accuracy of the OCC's estimate of the burden of the 
information collection;
    (c) Ways to enhance the quality, utility, and clarity of the 
information to be collected;
    (d) Ways to minimize the burden of the collection on respondents, 
including through the use of automated collection techniques or other 
forms of information technology; and
    (e) Estimates of capital or start-up costs and costs of operation, 
maintenance, and purchase of services to provide information.

    Dated: June 23, 2017.
Karen Solomon,
Deputy Chief Counsel, Office of the Comptroller of the Currency.
[FR Doc. 2017-14000 Filed 7-3-17; 8:45 am]
 BILLING CODE 4810-33-P



                                                                              Federal Register / Vol. 82, No. 127 / Wednesday, July 5, 2017 / Notices                                                    31151

                                                  Issued in Washington, DC, on June 28,                  (202) 649–6700 or, for persons who are                or greater; or (iii) less than $50 billion,
                                                2017.                                                    deaf or hard of hearing, TTY, (202) 649–              if the OCC determines such bank’s
                                                Elaine L. Chao,                                          5597. Upon arrival, visitors will be                  operations are highly complex or
                                                Secretary of Transportation.                             required to present valid government-                 otherwise present a heightened risk as
                                                [FR Doc. 2017–14042 Filed 7–3–17; 8:45 am]               issued photo identification and submit                to warrant the application of the
                                                BILLING CODE 4910–9X–P                                   to security screening in order to inspect             guidelines (covered banks). The
                                                                                                         and photocopy comments.                               guidelines also establish minimum
                                                                                                            All comments received, including                   standards for a board of directors in
                                                DEPARTMENT OF THE TREASURY                               attachments and other supporting                      overseeing the framework’s design and
                                                                                                         materials, are part of the public record              implementation. These guidelines were
                                                Office of the Comptroller of the                         and subject to public disclosure. Do not              finalized on September 11, 2014.1 The
                                                Currency                                                 include any information in your                       OCC is now seeking to renew the
                                                                                                         comment or supporting materials that                  information collection associated with
                                                Agency Information Collection                            you consider confidential or                          these guidelines.
                                                Activities: Information Collection                       inappropriate for public disclosure.                     The standards contained in the
                                                Renewal; Comment Request; OCC                            FOR FURTHER INFORMATION CONTACT:                      guidelines are enforceable under section
                                                Guidelines Establishing Heightened                       Shaquita Merritt, OCC Clearance                       39 of the Federal Deposit Insurance Act
                                                Standards for Certain Large Insured                      Officer, (202) 649–5490 or, for persons               (FDIA),2 which authorizes the OCC to
                                                National Banks, Insured Federal                          who are deaf or hard of hearing, TTY,                 prescribe operational and managerial
                                                Savings Associations, and Insured                        (202) 649–5597, Legislative and                       standards for insured national banks,
                                                Federal Branches                                         Regulatory Activities Division, Office of             insured federal savings associations,
                                                                                                         the Comptroller of the Currency, 400 7th              and insured federal branches of a
                                                AGENCY: Office of the Comptroller of the                                                                       foreign bank.
                                                Currency (OCC), Treasury.                                Street SW., Suite 3E–218, Washington,
                                                                                                                                                                  The guidelines formalize the OCC’s
                                                ACTION: Notice and request for comment.                  DC 20219.
                                                                                                                                                               heightened expectations program. The
                                                                                                         SUPPLEMENTARY INFORMATION: Under the                  guidelines also further the goal of the
                                                SUMMARY:    The OCC, as part of its                      PRA (44 U.S.C. 3501–3520), federal                    Dodd-Frank Wall Street Reform and
                                                continuing effort to reduce paperwork                    agencies must obtain approval from                    Consumer Protection Act of 2010 to
                                                and respondent burden, invites the                       OMB for each collection of information                strengthen the financial system by
                                                general public and other federal                         that they conduct or sponsor.                         focusing management and boards of
                                                agencies to take this opportunity to                     ‘‘Collection of information’’ is defined              directors on improving and
                                                comment on a continuing information                      in 44 U.S.C. 3502(3) and 5 CFR                        strengthening risk management
                                                collection, as required by the Paperwork                 1320.3(c) to include agency requests or               practices and governance, thereby
                                                Reduction Act of 1995 (PRA).                             requirements that members of the public
                                                   In accordance with the requirements                                                                         minimizing the probability and impact
                                                                                                         submit reports, keep records, or provide              of future financial crises.
                                                of the PRA, the OCC may not conduct                      information to a third party. Section                    The standards for the design and
                                                or sponsor, and the respondent is not                    3506(c)(2)(A) of title 44 requires federal            implementation of the risk governance
                                                required to respond to, an information                   agencies to provide a 60-day notice in                framework, which contain collections of
                                                collection unless it displays a currently                the Federal Register concerning each                  information, are as follows:
                                                valid Office of Management and Budget                    proposed collection of information,
                                                (OMB) control number.                                    including each proposed extension of an               Standards for Risk Governance
                                                   The OCC is soliciting comment                         existing collection of information,                   Framework
                                                concerning its information collection                    before submitting the collection to OMB                  Covered banks should establish and
                                                titled, ‘‘OCC Guidelines Establishing                    for approval. To comply with this                     adhere to a formal, written risk
                                                Heightened Standards for Certain Large                   requirement, the OCC is publishing                    governance framework designed by
                                                Insured National Banks, Insured Federal                  notice of the proposed collection of                  independent risk management. The
                                                Savings Associations, and Insured                        information set forth in this document.               framework should include delegations
                                                Federal Branches.’’                                         Title: OCC Guidelines Establishing                 of authority from the board of directors
                                                DATES: Comments must be submitted on                     Heightened Standards for Certain Large                to management committees and
                                                or before September 5, 2017.                             Insured National Banks, Insured Federal               executive officers as well as risk limits
                                                ADDRESSES: Because paper mail in the                     Savings Associations, and Insured                     established for material activities. The
                                                Washington, DC area and at the OCC is                    Federal Branches.                                     framework should be approved by the
                                                subject to delay, commenters are                            OMB Control No.: 1557–0321.                        board of directors or the board’s risk
                                                encouraged to submit comments by                            Description: The OCC’s guidelines                  committee, and it should be reviewed
                                                email, if possible. Comments may be                      codified in 12 CFR part 30, appendix D                and updated, at least annually, by
                                                sent to: Legislative and Regulatory                      establish minimum standards for the                   independent risk management.
                                                Activities Division, Office of the                       design and implementation of a risk
                                                Comptroller of the Currency, Attention:                  governance framework for insured                      Front Line Units
                                                1557–0321, 400 7th Street SW., Suite                     national banks, insured federal savings                 Front line units should take
                                                3E–218, Washington, DC 20219. In                         associations, and insured federal                     responsibility and be held accountable
                                                addition, comments may be sent by fax                    branches of a foreign bank (bank). The                by the chief executive officer (CEO) and
                                                to (571) 465–4326 or by electronic mail                  guidelines apply to a bank with average               the board of directors for appropriately
sradovich on DSK3GMQ082PROD with NOTICES




                                                to prainfo@occ.treas.gov. You may                        total consolidated assets:                            assessing and effectively managing all of
                                                personally inspect and photocopy                            (i) Equal to or greater than $50 billion;
                                                comments at the OCC, 400 7th Street                      (ii) less than $50 billion if that bank’s               1 79 FR 51518.
                                                                                                                                                                 2 12 U.S.C. 1831p–1. Section 39 was enacted as
                                                SW., Washington, DC 20219. For                           parent company controls at least one
                                                                                                                                                               part of the Federal Deposit Insurance Corporation
                                                security reasons, the OCC requires that                  insured national bank or insured federal              Improvement Act of 1991, Public Law 102–242,
                                                visitors make an appointment to inspect                  savings association that has average                  section 132(a), 105 Stat. 2236, 2267–70 (Dec. 19,
                                                comments. You may do so by calling                       total consolidated assets of $50 billion              1991).



                                           VerDate Sep<11>2014   17:57 Jul 03, 2017   Jkt 241001   PO 00000   Frm 00113   Fmt 4703   Sfmt 4703   E:\FR\FM\05JYN1.SGM    05JYN1


                                                31152                         Federal Register / Vol. 82, No. 127 / Wednesday, July 5, 2017 / Notices

                                                the risks associated with their activities.              where a front line unit is not adhering               annual basis. The independent
                                                In fulfilling this responsibility, each                  to the risk governance framework; (vi)                assessment should include a conclusion
                                                front line unit should, either alone or in               identifying and communicating to the                  on the covered bank’s compliance with
                                                conjunction with another organizational                  board of directors or the board’s risk                the standards set forth in the guidelines.
                                                unit that has the purpose of assisting a                 committee material risks and significant              Internal audit should identify and
                                                front line unit: (i) Assess, on an ongoing               instances where independent risk                      communicate to the board’s audit
                                                basis, the material risks associated with                management’s assessment of risk differs               committee significant instances where
                                                its activities and use such risk                         from the CEO, and significant instances               front line units or independent risk
                                                assessments as the basis for fulfilling its              where the CEO is not adhering to, or                  management are not adhering to the risk
                                                responsibilities and for determining if                  holding front line units accountable for              governance framework. Internal audit
                                                actions need to be taken to strengthen                   adhering to, the risk governance                      should establish a quality assurance
                                                risk management or reduce risk given                     framework; and (vii) developing,                      program that ensures internal audit’s
                                                changes in the unit’s risk profile or                    attracting, and retaining talent and                  policies, procedures, and processes
                                                other conditions; (ii) establish and                     maintaining staffing levels required to               comply with applicable regulatory and
                                                adhere to a set of written policies that                 carry out the unit’s role and                         industry guidance, are appropriate for
                                                include front line unit risk limits. Such                responsibilities effectively while                    the size, complexity, and risk profile of
                                                policies should ensure risks associated                  establishing and adhering to talent                   the covered bank, are updated to reflect
                                                with the front line unit’s activities are                management processes and                              changes to internal and external risk
                                                effectively identified, measured,                        compensation and performance                          factors, emerging risks, and
                                                monitored, and controlled, consistent                    management programs.                                  improvements in industry internal audit
                                                with the covered bank’s risk appetite                                                                          practices, and are consistently followed.
                                                                                                         Internal Audit
                                                statement, concentration risk limits, and                                                                      Internal audit should develop, attract,
                                                all policies established within the risk                    Internal audit should ensure that the              and retain talent and maintain staffing
                                                governance framework; (iii) establish                    covered bank’s risk governance                        levels required to effectively carry out
                                                and adhere to procedures and processes,                  framework complies with the guidelines                its role and responsibilities. Internal
                                                as necessary to maintain compliance                      and is appropriate for the size,                      audit should establish and adhere to
                                                with the policies described in (ii); (iv)                complexity, and risk profile of the                   talent management processes and
                                                adhere to all applicable policies,                       covered bank. It should maintain a                    compensation and performance
                                                procedures, and processes established                    complete and current inventory of all of              management programs that comply with
                                                by independent risk management; (v)                      the covered bank’s material processes,                the guidelines.
                                                develop, attract, and retain talent and                  product lines, services, and functions,
                                                                                                         and assess the risks, including emerging              Strategic Plan
                                                maintain staffing levels required to carry
                                                out the unit’s role and responsibilities                 risks, associated with each, which                       The CEO, with input from front line
                                                effectively; (vi) establish and adhere to                collectively provide a basis for the audit            units, independent risk management,
                                                talent management processes; and (vii)                   plan. It should establish and adhere to               and internal audit, should be
                                                establish and adhere to compensation                     an audit plan, which is periodically                  responsible for the development of a
                                                and performance management                               reviewed and updated, that takes into                 written strategic plan that should cover,
                                                programs.                                                account the covered bank’s risk profile,              at a minimum, a three-year period. The
                                                                                                         emerging risks, issues, and establishes               board of directors should evaluate and
                                                Independent Risk Management                              the frequency with which activities                   approve the plan and monitor
                                                   Independent risk management should                    should be audited. The audit plan                     management’s efforts to implement the
                                                oversee the covered bank’s risk-taking                   should require internal audit to evaluate             strategic plan at least annually. The plan
                                                activities and assess risks and issues                   the adequacy of and compliance with                   should include a comprehensive
                                                independent of the front line units by:                  policies, procedures, and processes                   assessment of risks that impact the
                                                (i) Designing a comprehensive written                    established by front line units and                   covered bank, an overall mission
                                                risk governance framework                                independent risk management under the                 statement and strategic objectives, an
                                                commensurate with the size,                              risk governance framework. Significant                explanation of how the covered bank
                                                complexity, and risk profile of the                      changes to the audit plan should be                   will update the risk governance
                                                covered bank; (ii) identifying and                       communicated to the board’s audit                     framework to account for changes to its
                                                assessing, on an ongoing basis, the                      committee. Internal audit should report               risk profile projected under the strategic
                                                covered bank’s material aggregate risks                  in writing, conclusions and material                  plan, and be reviewed, updated, and
                                                and using such risk assessments as the                   issues and recommendations from audit                 approved due to changes in the covered
                                                basis for fulfilling its responsibilities                work carried out under the audit plan to              bank’s risk profile or operating
                                                and for determining if actions need to be                the board’s audit committee. Reports                  environment that were not
                                                taken to strengthen risk management or                   should identify the root cause of any                 contemplated when the plan was
                                                reduce risk given changes in the covered                 material issues and include: (i) A                    developed.
                                                bank’s risk profile or other conditions;                 determination of whether the root cause
                                                (iii) establishing and adhering to                       creates an issue that has an impact on                Risk Appetite Statement
                                                enterprise policies that include                         one organizational unit or multiple                      A covered bank should have a
                                                concentration risk limits; (iv)                          organizational units within the covered               comprehensive written statement that
                                                establishing and adhering to procedures                  bank; and (ii) a determination of the                 articulates its risk appetite that serves as
                                                and processes to ensure compliance                       effectiveness of front line units and                 the basis for the risk governance
sradovich on DSK3GMQ082PROD with NOTICES




                                                with policies in (iii); (v) identifying and              independent risk management in                        framework. It should contain qualitative
                                                communicating to the CEO and board of                    identifying and resolving issues in a                 components that describe a safe and
                                                directors or board’s risk committee                      timely manner. Internal audit should                  sound risk culture and how the covered
                                                material risks and significant instances                 establish and adhere to processes for                 bank will assess and accept risks and
                                                where independent risk management’s                      independently assessing the design and                quantitative limits that include sound
                                                assessment of risk differs from that of a                ongoing effectiveness of the risk                     stress testing processes and address
                                                front line unit, and significant instances               governance framework on at least an                   earnings, capital, and liquidity.


                                           VerDate Sep<11>2014   17:57 Jul 03, 2017   Jkt 241001   PO 00000   Frm 00114   Fmt 4703   Sfmt 4703   E:\FR\FM\05JYN1.SGM   05JYN1


                                                                              Federal Register / Vol. 82, No. 127 / Wednesday, July 5, 2017 / Notices                                           31153

                                                Risk Limit Breaches                                      formal, ongoing training program for all              or sponsor, and the respondent is not
                                                   A covered bank should establish and                   directors. The board of directors should              required to respond to, an information
                                                adhere to processes that require front                   also conduct an annual self-assessment.               collection unless it displays a currently
                                                line units and independent risk                            Type of Review: Regular review.                     valid Office of Management and Budget
                                                                                                           Affected Public: Businesses or other                (OMB) control number.
                                                management to: (i) Identify breaches of
                                                the risk appetite statement,                             for-profit.                                              The OCC is soliciting comment
                                                                                                           Estimated Number of Respondents:                    concerning the renewal of its
                                                concentration risk limits, and front line
                                                                                                         41.                                                   information collection titled
                                                unit risk limits; (ii) distinguish breaches                Estimated Burden per Respondent:
                                                based on the severity of their impact;                                                                         ‘‘Assessment of Fees.’’ The OCC also is
                                                                                                         3,776 hours.                                          giving notice that it has sent the
                                                (iii) establish protocols for                              Estimated Total Annual Burden:
                                                disseminating information regarding a                                                                          collection to OMB for review.
                                                                                                         154,816 hours.                                        DATES: You should submit written
                                                breach; (iv) provide a written                             Comments: Comments submitted in
                                                description of the breach resolution; and                                                                      comments by August 4, 2017.
                                                                                                         response to this notice will be
                                                (v) establish accountability for reporting                                                                     ADDRESSES: Because paper mail in the
                                                                                                         summarized and included in the request
                                                and resolving breaches.                                  for OMB approval. All comments will                   Washington, DC area and at the OCC is
                                                                                                         become a matter of public record.                     subject to delay, commenters are
                                                Concentration Risk Management                                                                                  encouraged to submit comments by
                                                                                                         Comments are invited on:
                                                  The risk governance framework                            (a) Whether the collection of                       email, if possible. Comments may be
                                                should include policies and supporting                                                                         sent to: Legislative and Regulatory
                                                                                                         information is necessary for the proper
                                                processes appropriate for the covered                                                                          Activities Division, Office of the
                                                                                                         performance of the functions of the
                                                bank’s size, complexity, and risk profile                                                                      Comptroller of the Currency, Attention:
                                                                                                         OCC, including whether the information
                                                for effectively identifying, measuring,                                                                        1557–0223, 400 7th Street SW., Suite
                                                                                                         has practical utility;
                                                monitoring, and controlling the covered                    (b) The accuracy of the OCC’s                       3E–218, Washington, DC 20219. In
                                                bank’s concentrations of risk.                           estimate of the burden of the                         addition, comments may be sent by fax
                                                Risk Data Aggregation and Reporting                      information collection;                               to (571) 465–4326 or by electronic mail
                                                                                                           (c) Ways to enhance the quality,                    to prainfo@occ.treas.gov. You may
                                                   The risk governance framework                                                                               personally inspect and photocopy
                                                should include a set of policies,                        utility, and clarity of the information to
                                                                                                         be collected;                                         comments at the OCC, 400 7th Street
                                                supported by appropriate procedures                                                                            SW., Washington, DC 20219. For
                                                                                                           (d) Ways to minimize the burden of
                                                and processes, designed to provide risk                                                                        security reasons, the OCC requires that
                                                                                                         the collection on respondents, including
                                                data aggregation and reporting                                                                                 visitors make an appointment to inspect
                                                                                                         through the use of automated collection
                                                capabilities appropriate for the covered                                                                       comments. You may do so by calling
                                                                                                         techniques or other forms of information
                                                bank’s size, complexity, and risk profile                                                                      (202) 649–6700 or, for persons who are
                                                                                                         technology; and
                                                and to support supervisory reporting
                                                                                                           (e) Estimates of capital or start-up                deaf or hard of hearing, TTY, (202) 649–
                                                requirements. Collectively, these
                                                                                                         costs and costs of operation,                         5597. Upon arrival, visitors will be
                                                policies, procedures, and processes
                                                                                                         maintenance, and purchase of services                 required to present valid government-
                                                should provide for: (i) The design,
                                                                                                         to provide information.                               issued photo identification and submit
                                                implementation, and maintenance of a
                                                                                                           Dated: June 23, 2017.                               to security screening in order to inspect
                                                data architecture and information
                                                                                                         Karen Solomon,                                        and photocopy comments.
                                                technology infrastructure that support                                                                            All comments received, including
                                                the covered bank’s risk aggregation and                  Deputy Chief Counsel, Office of the
                                                                                                                                                               attachments and other supporting
                                                reporting needs during normal times                      Comptroller of the Currency.
                                                                                                                                                               materials, are part of the public record
                                                and during times of stress; (ii) the                     [FR Doc. 2017–14000 Filed 7–3–17; 8:45 am]
                                                                                                                                                               and subject to public disclosure. Do not
                                                capturing and aggregating of risk data                   BILLING CODE 4810–33–P
                                                                                                                                                               include any information in your
                                                and reporting of material risks,                                                                               comment or supporting materials that
                                                concentrations, and emerging risks in a                                                                        you consider confidential or
                                                timely manner to the board of directors                  DEPARTMENT OF THE TREASURY
                                                                                                                                                               inappropriate for public disclosure.
                                                and the OCC; and (iii) the distribution                                                                           Additionally, please send a copy of
                                                of risk reports to all relevant parties at               Office of the Comptroller of the
                                                                                                         Currency                                              your comments by mail to: OCC Desk
                                                a frequency that meets their needs for                                                                         Officer, 1557–0223, U.S. Office of
                                                decision-making purposes.                                Agency Information Collection                         Management and Budget, 725 17th
                                                Talent and Compensation Management                       Activities: Information Collection                    Street NW., #10235, Washington, DC
                                                   A covered bank should establish and                   Renewal; Submission for OMB Review;                   20503 or by email to oira submission@
                                                adhere to processes for talent                           Assessment of Fees                                    omb.eop.gov.
                                                development, recruitment, and                                                                                  FOR FURTHER INFORMATION CONTACT:
                                                                                                         AGENCY: Office of the Comptroller of the
                                                succession planning. The board of                                                                              Shaquita Merritt, OCC Clearance
                                                                                                         Currency (OCC), Treasury.
                                                directors or appropriate committee                                                                             Officer, (202) 649–5490 or, for persons
                                                                                                         ACTION: Notice and request for comment.
                                                should review and approve a written                                                                            who are deaf or hard of hearing, TTY,
                                                talent management program. A covered                     SUMMARY:   The OCC, as part of its                    (202) 649–5597, Legislative and
                                                bank should also establish and adhere to                 continuing effort to reduce paperwork                 Regulatory Activities Division, Office of
                                                                                                                                                               the Comptroller of the Currency, 400 7th
sradovich on DSK3GMQ082PROD with NOTICES




                                                compensation and performance                             and respondent burden, invites the
                                                management programs that comply with                     general public and other Federal                      Street SW., Washington, DC 20219.
                                                any applicable statute or regulation.                    agencies to take this opportunity to                  SUPPLEMENTARY INFORMATION: Under the
                                                                                                         comment on a continuing information                   PRA (44 U.S.C. 3501–3520), Federal
                                                Board of Directors Training and                          collection as required by the Paperwork               agencies must obtain approval from the
                                                Evaluation                                               Reduction Act of 1995 (PRA).                          OMB for each collection of information
                                                  The board of directors of a covered                      In accordance with the requirements                 that they conduct or sponsor.
                                                bank should establish and adhere to a                    of the PRA, the OCC may not conduct                   ‘‘Collection of information’’ is defined


                                           VerDate Sep<11>2014   17:57 Jul 03, 2017   Jkt 241001   PO 00000   Frm 00115   Fmt 4703   Sfmt 4703   E:\FR\FM\05JYN1.SGM   05JYN1



Document Created: 2017-07-04 02:00:40
Document Modified: 2017-07-04 02:00:40
CategoryRegulatory Information
CollectionFederal Register
sudoc ClassAE 2.7:
GS 4.107:
AE 2.106:
PublisherOffice of the Federal Register, National Archives and Records Administration
SectionNotices
ActionNotice and request for comment.
DatesComments must be submitted on or before September 5, 2017.
ContactShaquita Merritt, OCC Clearance Officer, (202) 649-5490 or, for persons who are deaf or hard of hearing, TTY, (202) 649-5597, Legislative and Regulatory Activities Division, Office of the Comptroller of the Currency, 400 7th Street SW., Suite 3E-218, Washington, DC 20219.
FR Citation82 FR 31151 

2025 Federal Register | Disclaimer | Privacy Policy
USC | CFR | eCFR