As banks approach the USD 10 billion asset threshold, taking proactive steps to enhance their risk management framework is essential for managing regulatory challenges, preserving profitability, and ensuring operational strength. This paper examines how aligning with regulations, such as CFPB supervision, through a forward-looking strategy can transform compliance into a foundation for sustained growth and exceptional operational performance.
Crossing the USD 10 billion asset threshold is a significant milestone for any bank in the USA, marking a transition from a relatively low-regulatory environment to a more stringent and complex regulatory landscape. But it comes with increased scrutiny, higher compliance costs, and more operational complexity[1]. As US banks approach this threshold, they need to make critical changes across their systems, data, and processes to remain compliant and competitive. Overcoming the USD 10 billion asset threshold significantly changes a bank’s operational landscape, necessitating comprehensive adjustments in systems, data management, and regulatory compliance. To outline the necessary changes, banks should ensure compliance with regulatory requirements and maintain operational efficiency. The aim of this point of view is to cover the key aspects of system changes, data, and process modifications, as well as the relevant regulations that banks must adhere to.
Mid-sized banks in the USA that cross the USD 10 billion threshold face significant regulatory changes, and compliance with the following is essential:
Consumer Financial Protection Bureau (CFPB)
US banks must adhere to CFPB supervision, which includes strict consumer protection rules. These rules cover fair lending practices, privacy policies, and transparency in loan disclosures. Upon reaching the USD 10 billion asset threshold, banks become subject to the CFPB for the first time[2].
Dodd-Frank Act Stress Testing (DFAST)
Under the Dodd-Frank Act (DFA), banks are required to perform periodic stress tests to ensure they can withstand economic shocks. These tests must be integrated into the bank’s capital planning processes and require sophisticated risk modeling tools[3]. However, this is for banks above USD 250 billion in assets, but Comprehensive Capital Analysis and Review (CCAR) is done for banks with at least USD 100 billion in assets[4].
Bank Secrecy Act (BSA) and Anti-Money Laundering (AML) compliance
As banks grow, they face increased scrutiny over AML practices. A larger asset base requires enhanced monitoring for suspicious activities, as well as more rigorous Know Your Customer (KYC) processes.
Volcker rule compliance
The Volcker rule restricts certain trading activities and becomes applicable, impacting profitability and requiring adjustments in business strategies.
Durbin amendment
The Durbin amendment reduces the amount of interchange income a financial institution may collect on debit and credit card transactions[5].
Banks will face higher deposit insurance premiums when crossing this threshold. They need to adjust their financial planning to accommodate this added expense, which is directly tied to the size of their asset base. There are also heightened expectations of consumer protection, fair lending practices, and Unfair, Deceptive, or Abusive Acts or Practices (UDAAPs)
As a result, banks and financial service providers are not only prohibited from strong-arming or deceiving their customers into making unwilling purchases through misleading statements and product information, but their actions are monitored and regulated. Failure to comply will lead to scrutiny enforced by federal organizations like the CFPB and the Federal Trade Commission (FTC).
Banks need to ensure and implement an enhanced Compliance Management System (CMS) that can effectively address the complexities of new regulations built on comprehensive policies, risk assessments, monitoring, training, etc., tailored to risks.
Data accuracy and process efficiency are critical when scaling to USD 10 billion. Banks need to streamline their operational processes and ensure data integrity for regulatory reporting.
Banks must ensure that they have a comprehensive master guideline or documentation system in place to manage compliance. This includes outlining all policies, charters, and risk assessments in a well-organized format for regulators. It’s vital that these documents cover all operational aspects, including capital adequacy, consumer protection, and liquidity.
Banks should develop a stronger internal audit team to ensure that compliance functions are adequately monitored. A “three lines of defense” model is often adopted, where operational managers, risk management teams, and internal auditors work together to monitor risks.
Centralized data repository: Establish a centralized data repository to ensure accurate reporting and compliance with new regulations. Enhanced data analytics capabilities will be essential for risk management and decision-making.
As banks grow, so do their loan portfolios. It is important to enhance loan review processes, especially to meet the CFPB's standards, which are stricter after reaching the USD 10 billion mark. Independent loan review teams should be established to assess credit quality independently from the internal audit
CFPB supervision[6] refers to the process by which the Consumer Financial Protection Bureau (CFPB) oversees certain financial institutions to ensure they comply with federal consumer financial protection laws. Through supervision, the CFPB examines how these companies operate, manage risks, and treat their customers.
Data related to disclosure regarding communications and notice of debt and compliance with the Fair Debt Collection Practices Act (FDCPA) policies and procedures, monitoring, and audit process.
Alternate data is data collected from non-traditional/secondary and tertiary sources, and there is more emphasis and frameworks to be mandated for data governance around alternate data, especially related to customers’ creditworthiness and credit history that is used in credit underwriting.
Data consolidation of pricing discrimination, lending restrictions, and data related to enhanced review.
Effectiveness of information technology in the detection and prevention of data breaches and cyberattacks, suspicious activity, and anomaly detection.
CRCs, banks, loan servicers, and others—that furnish information to the CRCs for inclusion in consumer reports have a significant role to play in the fair and accurate reporting of credit information and are subject to the Fair Credit Reporting Act (FCRA).
Data consolidation of loan originators compensation details and waiver of borrowers’ rights.
Data consolidation related to pandemic relief benefits, periodic statements data.
Use of data and technology for auto loans and identifying and preventing UDAAPs.
Banks crossing the USD 10 billion asset mark must enhance their systems to manage the broader range of regulatory requirements. These institutions will now be subject to oversight from the CFPB and will need to implement the DFAST.
This requires significant investments in:
Advanced bank risk management frameworks, including operational risk teams that can handle sophisticated stress tests, are needed. Risk modeling systems should be upgraded to ensure compliance with DFA requirements.
More robust data management capabilities are essential for gathering the required information for stress testing, capital planning, and liquidity monitoring. Many banks opt to invest in integrated data platforms that provide comprehensive reporting capabilities.
Larger banks face greater cybersecurity threats and are held to stricter IT governance standards. Investments in cybersecurity infrastructure, data encryption, and real-time monitoring systems are essential to avoid breaches and meet regulatory requirements.
As the bank grows, managing third-party risks becomes critical. Banks must establish vendor risk management frameworks to ensure that outsourced functions align with regulatory expectations.
Banks need to work with IT and technology service providers/Managed Service Providers (MSPs)/vendors to help the banks implement their strategic risk platforms and functionalities. For example, recommending a bespoke implementation in a phased manner to de-risk the business across lines of defense. Below is an overview of ensuring empowerment and accountability across lines of defense upon implementing a centralized repository of risk and controls.
While crossing the USD 10 billion asset mark is a significant milestone for any bank, it brings significant regulatory challenges and operational complexities. Early preparation is essential. Banks should invest in upgrading their risk management, data, and compliance systems. Furthermore, collaboration across all business lines, with a strong tone from leadership, is crucial for ensuring a smooth transition into the USD 10 billion+ asset space.
Banks need to ensure adequate staffing and resources to manage compliance effectively, as well as thorough preparation and strategic planning to ensure compliance and mitigate risks associated with growth.
To successfully navigate this threshold, banks must view compliance not as a burden but as an opportunity to build competitive advantages through robust governance and risk management practices.
Click here to know more about our banking risk and compliance practice.
Outcreate Your Business
Outcreate with LTM
Outcreate Together
