On March 31, 2016, the Office of the Comptroller of the Currency (OCC) issued a white paper on the growing intersection between financial services and technology. The OCC stated that "[w]hile banks continue to innovate, rapid and dramatic advances in financial technology (FinTech) are beginning to disrupt the way traditional banks do business. As the prudential regulator of the federal banking system, we want national banks and federal savings associations to thrive in this environment and to continue fulfilling their vital role of providing financial services to consumers, businesses, and their communities." Accordingly, the OCC's white paper was intended to describe the OCC's vision for "responsible innovation" in the federal banking system, defined as "the use of new or improved financial products, services, and processes to meet the evolving needs of consumers, businesses, and communities in a manner that is consistent with sound risk management and is aligned with the bank's overall business strategy." The white paper also discusses the principles that will guide the development of the OCC's framework for evaluating new and innovative financial products and services.
The white paper provided eight principles that will guide the development of its framework for understanding and evaluating innovative products, services and processes that OCC-regulated banks may offer or perform. These principles call for the OCC to: 1) support responsible innovation; (2) foster an internal culture receptive to responsible innovation; (3) leverage agency experience and expertise; (4) encourage responsible innovation that provides fair access to financial services and fair treatment of consumers; (5) further safe and sound operations through effective risk management; (6) encourage banks of all sizes to integrate responsible innovation into their strategic planning; (7) promote ongoing dialogue through formal outreach; and (8) collaborate with other regulators. Each of these principles is summarized below:
(1) Support responsible innovation.
The OCC is considering various reforms to improve its process for understanding and evaluating innovative financial products, services and processes. The goal is an improved process that will provide a clear path for banks and other stakeholders to seek the agency's views and guidance. One possible approach to meet this goal identified by the OCC is the creation of a centralized office on innovation. Alternatively, the OCC proposed potentially adopting a less formal process where an existing unit within the OCC would assume the responsibility as the agency's central point of contact on innovation. The OCC recognized that to be effective, the improved process should clarify agency expectations, particularly those with respect to third-party relationships and partnerships between banks and nonbanks. The OCC further recognized that decision making needs to be expedited, and thus, the OCC will evaluate whether it can streamline some of its licensing procedures, where appropriate, or develop new procedures where existing procedures may not work for certain innovative activities.
(2) Foster an internal culture receptive to responsible innovation.
The OCC recognized that a key component of a successful framework is an agency culture that is receptive to responsible innovation. Thus, the OCC will evaluate its policies and processes, define roles and responsibilities with respect to evaluating innovation, identify and close knowledge and expertise gaps, and enhance communication within the agency and with outside stakeholders. The agency will also develop or augment existing training to reinforce the agency's receptiveness to responsible innovation and develop additional expertise to evaluate the opportunities and risks related to specific types of innovation.
(3) Leverage agency experience and expertise.
The OCC believes its examiners, policy and compliance experts, legal staff, information technology professionals and economists have a deep understanding of the financial system and a growing understanding of the emerging technology that can bring innovative products, services and processes to businesses and consumers, and has stated that the agency will continue to develop expertise in these important areas. The OCC will also consider designating lead experts on responsible innovation who could support bank supervision and provide advice based on a broad view of innovation trends and developments across the federal banking system. In addition, the OCC will regularly evaluate whether it has the appropriate resources to supervise innovation within the federal banking system.
(4) Encourage responsible innovation that provides fair access to financial services and fair treatment of consumers.
The OCC will consider if and how proposed innovation will help banks to fulfill their public purpose in promoting fair access to financial services and fair treatment of consumers. Specifically to encourage responsible innovations that provide fair access to financial services and fair treatment, the OCC plans to share success stories describing how national banks and federal savings associations have innovated to increase access to unbanked and underbanked populations; to increase the speed, efficiency, effectiveness and transparency of financial transactions; and to lend and invest in ways designed to address the credit needs of low- and moderate-income individuals and communities. The OCC may also issue guidance on its expectations related to products and services designed to address the needs of low- to moderate-income individuals and communities.
(5) Further safe and sound operations through effective risk management.
The OCC believes that effective risk management and good corporate governance are fundamental for banks to develop new products, services and processes successfully. In this regard, the white paper explains that banks, nonbanks and bank customers believe that cyber risk is one of the most significant risks facing the financial industry as it implements new technologies. Moreover, risk to customer data through data aggregation and third-party use is increasing. The OCC stressed that banks of all sizes need to ensure that effective corporate governance and risk management meet supervisory expectations when considering new products, services and processes. This includes expectations described in OCC guidance related to strategic planning, evaluating new products and services, using models, operational risk, cybersecurity and managing third-party relationships. The OCC understands its framework must consider how national banks and federal savings associations identify and address risks resulting from emerging technology. The agency also stated that it will continue to improve its ability to understand and monitor emerging risks in the financial industry.
(6) Encourage banks of all sizes to integrate responsible innovation into their strategic planning.
The OCC's framework will consider how banks integrate innovation in their strategic planning processes, as sound strategic decisions are essential for any bank to achieve its business goals and successfully meet the needs of the consumers, businesses and communities it serves. The OCC noted that a bank's decision to offer innovative products and services should be consistent with the bank's long-term business plan, rather than following the latest fad or industry trend. The OCC reminded banks that traditional strategic planning criteria still apply, including: (1) consistency with the bank's corporate governance, business plan and risk appetite; (2) realistic financial projections; (3) adequate staff, both in number and expertise; (4) technology support; (5) consideration of all applicable risks, including reputation and compliance, and appropriate risk management systems and practices; and (6) exit strategies.
(7) Promote ongoing dialogue through formal outreach.
As part of its ongoing outreach activities, the OCC plans to bring together banks, nonbanks and other stakeholders through a forum and a variety of workshops and meetings, including "innovator fairs," to discuss responsible innovation in the financial industry. In addition, the OCC will provide resources, information and guidance through its websites, which may include links to future papers and other resources on responsible innovation for those who want to engage with the OCC. The agency believes these efforts will enable it to: (1) stay abreast of current trends and developments, including new products, services, process improvements and partnerships; (2) understand the underlying reasons and customer needs that drive such developments; (3) promote awareness and understanding of its expectations related to responsible innovation; (4) identify opportunities to improve its ability to respond more quickly, efficiently and effectively to inquiries regarding new products and services, including licensing requests; (5) serve as a more effective resource to institutions interested in innovation; and (6) solicit feedback on how its actions encourage or impede responsible innovation.
(8) Collaborate with other regulators.
The OCC will partner and share information with federal, state and international regulatory agencies, including the Consumer Financial Protection Bureau (CFPB) on innovations promoted by or affecting banks subject to OCC and CFPB supervision. The OCC believes these efforts will promote a common understanding and consistent application of laws, regulations and guidance, and support responsible innovation in the financial services industry. The OCC noted that banking agencies already collaborate successfully on a number of issues, and that with respect to responsible innovation, would: (1) establish regular channels of communication; (2) identify information to share on an ongoing basis or upon request; (3) provide other agencies with such advance notice as is reasonably possible regarding upcoming innovation activities that may be of common interest; and (4) use best efforts to avoid inconsistent communications with supervised entities.
Conclusions
The white paper clearly recognizes the important role that FinTech plays in the banking and technology industries. Moreover, the OCC appears to be committed to being receptive to responsible innovation and to developing additional expertise to evaluate the opportunities and risks related to specific types of innovation. As part of its efforts, we expect to see the OCC continue to devote resources and expertise to the evaluation and development of innovative products and services. Additionally, we expect to see increased collaboration between the OCC and the CFPB, although it remains unclear who amongst the various financial regulators will have the power to write new rules. Accordingly, while the OCC's role is that of a prudential regulator and therefore will view controls as they relate to safety and soundness issues of regulated firms, it would be wise for firms to also incorporate consumer risk into their controls and compliance management systems as they incorporate any new FinTech, since the CFPB will be focused on these areas.
Another clear takeaway from the white paper is that the OCC will continue to be keenly focused on cybersecurity and data protection. In light of the agency's emphasis on proper controls surrounding innovation to guard against risk, particularly cyber risk and data protection, firms should review their current policies and procedures with respect to corporate governance and risk management, especially those related to the consideration new products and services, and firm processes, including strategic planning, operational risk, cybersecurity and managing third-party relationships.
In the interim, the banking industry can review the nine questions posed by the OCC at the conclusion of the white paper under the "Request for Comments" section, to assist the OCC in developing its framework to support responsible innovation in the federal banking system.
If you have any questions regarding these issues or any other issues, please contact the authors of this alert or any of the attorneys in Baker Donelson's Financial Services Litigation group.