FDICís Receipt and Assessment of Savings Association Subsidiary Notices

March 2008
Report No. AUD-08-007

FDIC OIG, Office of Audits
Federal Deposit
Insurance Corporation

Why We Did The Audit

We initiated the audit at the request of staff from the U.S. Senate Committee on Banking, Housing and Urban Affairs. The objectives of the audit were to determine whether adequate controls are in place to ensure that the FDIC: (1) receives subsidiary notices from savings associations in accordance with the Federal Deposit Insurance (FDI) Act and (2) reviews these notices to assess possible risks posed to the Deposit Insurance Fund.

Background

The FDI Act requires notice to be provided to the FDIC and Office of Thrift Supervision (OTS) 30 days before a savings association establishes or acquires a subsidiary or when the savings association elects to conduct any new activity through a subsidiary under its control. The FDICís Case Manager Procedures Manual establishes procedures for reviewing savings association subsidiary notices in order to determine whether the new subsidiary or activity of an existing subsidiary raises safety and soundness concerns.

As of December 31, 2007, approximately 830 savings associations supervised by the OTS were subject to the subsidiary notice requirements.

During the period January 1, 2005 to December 31, 2007, the FDIC recorded the receipt of 178 savings association subsidiary notices.



Audit Results

The FDIC has established financial institution requirements associated with the receipt of savings association subsidiary notices and has developed a control process for reviewing those notices it receives. Based on our comparison of the number of subsidiary notices recorded by the OTS and the FDIC in their respective systems of record, we determined that the FDIC had not received all subsidiary notices from savings associations. Specifically, for calendar years 2005 through 2007, the OTS reported receiving 215 subsidiary notices; however, during the same period, the FDIC recorded in its Virtual Supervisory Information on the Net (ViSION) system the receipt of only 178 subsidiary noticesó37 fewer notices than the number the OTS recorded. Working with the FDIC, we determined that of the 37 notices, the FDICís records showed there was a valid explanation for 19 notices not being recorded in ViSION. For the remaining 18 notices, we determined the following:

  • in 6 instances the FDIC apparently did not receive required notices from savings associations, as required by the FDI Act;
  • in 5 instances the FDIC received a required notice but did not record the notice in ViSION and did not review the notice for safety and soundness concerns; and
  • as of the date of this report, 7 notices were being researched by FDIC officials to determine the reasons why they were recorded by the OTS and not the FDIC.

Overall, we concluded that the FDIC has an adequate control process for reviewing subsidiary notices recorded as received. We reviewed a sample of 43 notices (24 percent) out of the 178 savings association subsidiary notices the FDIC recorded in ViSION for the period January 1, 2005 to December 31, 2007. We found that the FDIC maintained copies of the notices from the savings associations and had reviewed the notices for possible safety and soundness risks in accordance with its operating procedures. These reviews included obtaining an understanding of the risks of the proposed subsidiary activity, analyzing the savings associationís financial condition, and obtaining the views of OTS personnel regarding the proposal in the notice. Finally, the FDIC sent letters of non-objection to the savings associations notifying them of the results of the FDICís reviews. The FDIC did not identify a concern regarding risk to the Deposit Insurance Fund in any of the reviews.

The report does not contain any recommendations; rather, it provides information for the FDICís consideration in its ongoing management of this program. DSC commented that it is committed to assuring that the FDIC receives subsidiary notices from savings associations in accordance with the FDI Act and that notices are appropriately assessed for possible risks posed to the Deposit Insurance Fund.



FDIC, Federal Deposit Insurance Corporation, Office of Inspector General,Office of Auidts, 3501 Fairfax Drive, Arlington, VA 22226-3500
DATE: March 18, 2008
 
MEMORANDUM TO:Sandra L. Thompson, Director
Division of Supervision and Consumer Protection
 
FROM:Russell A. Rau [Electronically produced version; original signed by Russell A. Rau]
Assistant Inspector General for Audits
 
SUBJECT:FDICís Receipt and Assessment of Savings Association Subsidiary Notices
(Report No. AUD-08-007)
 

This report presents the results of our audit of the FDICís receipt and assessment of savings association subsidiary notices. The Federal Deposit Insurance Act (FDI Act)1 requires that insured savings associations, supervised by the Office of Thrift Supervision (OTS), notify the FDIC and the OTS before the savings association establishes or acquires a subsidiary or engages in any new activity in a subsidiary. The notice provides the FDIC and the OTS with an opportunity to determine whether such action constitutes a serious risk to the safety, soundness, or stability of the insured savings association or is inconsistent with sound banking principles or with the purposes of the FDI Act.

We initiated the audit at the request of staff from the U.S. Senate Committee on Banking, Housing and Urban Affairs. The objectives of the audit were to determine whether adequate controls are in place to ensure that the FDIC: (1) receives subsidiary notices from savings associations in accordance with the FDI Act and (2) reviews the notices to assess possible risks posed to the Deposit Insurance Fund. We conducted this performance audit in accordance with generally accepted government auditing standards. Appendix 1 of this report discusses our audit objectives, scope, and methodology in detail.

BACKGROUND

Added by the Financial Institutions Reform, Recovery, and Enforcement Act of 1989, section 18(m) of the FDI Act requires notice to be provided to the FDIC and OTS 30 days before a savings association establishes or acquires a subsidiary or when the savings association elects to conduct any new activity through a subsidiary under its control.2 The FDIC Rules and Regulations implement section 18(m) of the FDI Act. Specifically, FDIC Rules and Regulations, Part 362.15, Acquiring or establishing a subsidiary; conducting new activities through a subsidiary, provides that:

No state or federal insured savings association may establish or acquire a subsidiary, or conduct any new activity through a subsidiary, unless it files a notice in compliance with ß 303.142(c) of this chapter at least 30 days prior to establishment of the subsidiary or commencement of the activity and the FDIC does not object to the notice.3

The Act and regulations do not require the FDIC to monitor receipt of required notices or provide the FDIC specific authority to take action in the event of non-receipt.

Within the FDIC, the Case Manager Procedures Manual (Procedures Manual) establishes procedures for reviewing savings association subsidiary notices. According to the Procedures Manual, regional office staff (generally, a Case Manager4) are to review notices received from savings associations in order to determine whether the new subsidiary or activity of an existing subsidiary raises safety and soundness concerns. The Case Managers are also required to create a record in the FDICís Virtual Supervisory Information on the Net (ViSION)5 system for each notice received. The record should contain, among other things, a description of the proposed activity in the notice and other pertinent information deemed necessary by the Case Manager.

As of December 31, 2007, approximately 830 savings associations supervised by the OTS were subject to the subsidiary notice requirement. During the period January 1, 2005 to December 31, 2007, the FDIC recorded 178 savings association subsidiary notices in ViSION, as shown in the table below.

Control Issue Enhancement Needed Enhancement Needed Enhancement Needed Enhancement Needed
Atlanta 6 10 12 28
Chicago 8 6 12 26
Dallas 3 4 10 17
Kansas City 1 1 3 5
New York 22 10 16 48
San Francisco 21 15 18 54
Totals 61 46 71 178
Source: ViSION records as of December 31, 2007.


RESULTS OF AUDIT

The FDIC has established financial institution requirements associated with its receipt of savings association subsidiary notices and has developed a control process for reviewing those notices it receives. Generally, the process entails the FDIC reviewing notices received for safety and soundness concerns, entering each subsidiary notice received into ViSION, and notifying the savings association of the results of the review. Further, the Procedures Manual requires that a Summary of Investigation (SOI) form be completed for each notice received and states that comments in the SOI should address conditions or limitations that may be needed to reduce the risk to the insurance fund or address any material safety and soundness concerns resulting from the activity or investment. Additionally, the Procedures Manual states that OTS should be contacted to determine its position regarding the notice and should receive copies of all correspondence.

Based on our comparison of the number of subsidiary notices recorded by the OTS and the FDIC in their respective systems of record, we determined that the FDIC had not received all subsidiary notices from savings associations. Specifically, for calendar years 2005 through 2007, the OTS reported receiving 215 subsidiary notices; however, during the same period, the FDIC recorded in ViSION the receipt of only 178 subsidiary noticesó37 fewer notices than the number the OTS recorded. Working with the FDIC, we determined that of the 37 notices, the FDICís records showed there was a valid explanation for 19 notices not being recorded in ViSION.6 For the remaining 18 notices, we determined that:

Overall, we concluded that the FDIC has an adequate control process for reviewing subsidiary notices recorded as received. We reviewed a sample of 43 notices (24 percent) out of the 178 savings association subsidiary notices the FDIC recorded in ViSION for the period January 1, 2005 to December 31, 2007. We found that the FDIC maintained copies of the notices from the savings associations and completed SOI forms as required by the Procedures Manual.8 Further, the SOIs and other files we reviewed contained sufficient evidence to indicate that the FDIC had reviewed the notices for possible safety and soundness risks. Such evidence included descriptions of the proposed subsidiary activity, analyses of the savings associationís financial condition, and indications of the views of the OTS analyst regarding the proposal in the notice. Finally, the FDIC sent letters of non-objection to the savings associations notifying them of the results of the FDICís reviews. The FDIC did not identify a concern regarding risk to the Deposit Insurance Fund in any of the reviews.

Because the FDIC received the vast majority of subsidiary notices and the causes for the FDIC not receiving, recording, or reviewing a limited number of notices do not point to the need for specific additional controls, we are not making any recommendations at this time. Instead, this information is provided for the FDICís consideration in its ongoing management of this program.




CORPORATION COMMENTS

On March 13, 2008, the Director, DSC, provided a written response to the draft report. DSCís response is provided in its entirety as Appendix 2 of this report. DSC stated that it is committed to assuring that the FDIC receives subsidiary notices from savings associations in accordance with the FDI Act and that notices are appropriately assessed for possible risks posed to the Deposit Insurance Fund.

APPENDIX 1

OBJECTIVE, SCOPE, AND METHODOLOGY

Objectives and Scope

The initial objectives of the audit were to determine whether adequate controls are in place to ensure that the FDIC: (1) receives subsidiary notices from savings associations in a timely manner and (2) reviews these notices to assess possible risks posed to the Deposit Insurance Fund. The first objective required determining whether the FDIC received notices in a timely manner, which is defined by the FDI Act as 30 days before the beginning of subsidiary operations. Such a determination would have required us to contact savings associations and obtain evidence of when the subsidiary began operation, which we decided was outside the scope of this audit. Therefore, the audit concentrated solely on controls related to the receipt of the notices.

Our audit scope focused on subsidiary notices received by the FDIC from savings associations for the period January 1, 2005 through December 31, 2007. From the universe of 178 notices, we selected a non-statistical sample of 43 notices (24 percent) from the New York, San Francisco, Dallas, Chicago, and Atlanta regions.9 We reviewed the notices to determine whether the FDIC had (1) received notification from the savings associations, (2) prepared and signed the SOIs, and (3) sent a copy of non-objection/ objection letters to respective savings associations.

Methodology

To achieve our objectives we performed the following:

  • Conducted interviews with DSC officials to obtain information about the FDICís process for the receipt of subsidiary notices from savings associations.
  • Identified the following FDIC policies and procedures related to subsidiary notices :
    • Case Manager Procedures Manual, sections 20 and 47
    • FDIC delegations of authority
    • Various regional directorís memoranda
  • Queried ViSION to obtain a listing of all subsidiary notices recorded as received by the FDIC from January 1, 2005 through December 31, 2007.
  • Obtained from the OTS a list of subsidiary notices it received from January 1, 2005 through December 31, 2007 and compared that list to the FDICís records.
  • Analyzed subsidiary notices to determine whether the FDIC received and assessed the notices in compliance with applicable FDIC Rules and Regulations and the Procedures Manual.
  • Visited the Atlanta Regional Office to review a sample of its subsidiary notice application files to determine whether the files contained all applicable documentation.

Internal Control

We reviewed the Procedures Manual, which describes the steps the FDIC should follow in reviewing subsidiary notices. Additionally, we interviewed DSC personnel to identify the existence of internal controls for ensuring that subsidiary notices are received and reviewed to assess possible safety and soundness concerns.

Reliance on Computer-processed Data. Our audit objective did not require that we separately assess the reliability of computer-processed data to support our significant findings and conclusions. In performing this audit, we relied on data from the FDICís ViSION system. Notwithstanding a few instances where the notices had not been entered into ViSION, we believe the ViSION data provided a reasonable basis to support our audit tests and conclusions.

Performance Measurement. We reviewed the FDICís 2007 Annual Performance Plan, which did not contain specific strategic goals or objectives that related to our audit or specific performance measures to gauge performance related to receiving and reviewing subsidiary notices.

Compliance with Laws and Regulations

We determined that three FDIC laws/regulations specifically relate to savings association notices:

  • The FDI Act (12 United States Code 1828(M), Section 18(m), Activities of Savings Associations and Their Subsidiaries) - Requires notice to be provided to the FDIC 30 days before an insured savings association establishes or acquires a subsidiary or when an insured savings association elects to conduct any new activity through a subsidiary that the insured savings association controls.
  • FDIC Rules and Regulations Part 303, Subpart H, Activities of Insured Savings Associations - lists filing requirements that should be included in a completed letter notice or letter application.
  • FDIC Rules and Regulations Part 362, Subpart D, Acquiring, Establishing, or Conducting New Activities Through a Subsidiary by an Insured Savings Association - Indicates that no state or federal insured savings association may establish or acquire a subsidiary or conduct any new activity through a subsidiary, unless it files a notice at least 30 days prior to establishment of the subsidiary or commencement of the activity and the FDIC does not object to the notice.

We assessed the risk of fraud related to the audit objective in the course of evaluating audit evidence.


APPENDIX 2

CORPORATION COMMENTS

FDIC, Federal Desposit Insurance, 550 17th Street, NW, Washington D.C., 20429, Division of Supervision and Consumer Protection.
 
DATE:March 13, 2008
 
TO:Russell A. Rau
Assistant Inspector General for Audits
 
FROM:Sandra L. Thompson [Electronically produced version; original signed by Sandra L. Thompson]
Director
 
SUBJECT:Response to Draft Report Entitled:
FDICís Receipt and Assessment of Savings Association Subsidiary Notices
(Assignment No. 2008-006)
 

The Division of Supervision and Consumer Protection appreciates that you found that the FDIC has effective processes and controls for the evaluation of subsidiary notices from savings associations.

We are committed to assuring that the FDIC receives subsidiary notices from savings associations in accordance with the FDI Act and that notices are appropriately assessed for possible risks posed to the Deposit Insurance Fund.





















Footnotes
1 Codified to 12 United States Code 1828(m).

2 Examples of proposed subsidiary activities include: mortgage lending, financial consulting services, and community development activities.

3 This requirement does not apply to any federal savings bank that was chartered prior to October 15, 1982 as a savings bank under state law or any savings association that acquired its principal assets from such an institution.

4 FDIC Circular 6200.3, Delegations of Authority, delegates issuance of a letter of non-objection for a savings association subsidiary notice to the FDIC Case Manager.

5 ViSION provides automated support for many aspects of bank supervision, including safety and soundness examinations.

6 The valid reasons included timing differences between input of the notices into OTS and FDIC systems, notices that were submitted to the OTS but subsequently withdrawn by the savings association, and notices that did not meet the FDIC Rules and Regulations, Part 362, requirement for FDIC notification.

7 According to DSC officials, the FDIC relies on savings associationsí familiarity with Part 362 requirements and on the OTS reminding savings associations, when appropriate, to send notices to the FDIC.

8 Of the 43 notices we sampled, 2 were ultimately withdrawn by the savings associations; therefore, the FDIC was not required to complete an SOI or send a letter of non-objection to the savings association in these cases.

9 The results of a non-statistical sample cannot be projected to the intended population by standard statistical methods. We did not select any notices from the Kansas City region due to the limited number of notices processed by that region during the audit period.
Last updated 4/7/2008