MRAs: Get On ‘Em PDQ!
Published in the Winter 2014 issue of The Bankers' Statement
Both state and federal bank regulatory exam reports use references to Matters Requiring Attention (MRAs), Matters Requiring Board Attention (MRBAs) and Matters Requiring Immediate Attention (MRIAs) as mechanisms for bringing issues and concerns to the attention of financial institution boards. These issues and concerns usually, from the viewpoint of the regulators, rise to the level of being sufficiently threatening to the safety and soundness of the institution and require an added focus and a specific timeline on resolution. No matter what the name, boards need to treat these matters seriously and devote their full attention to resolving the issues and concerns that they reflect. For purposes here, all such designations are referred to as MRAs.
In a practical sense, use of these directives by the agencies constitute a “mini-enforcement action” that in fact places the board (and management) in the crosshairs of a potential swift increase in regulatory enforcement proceedings if the MRAs are not addressed to the satisfaction of the agency within the designated timeframes. They may be considered, for all practical purposes, “mini-MOUs” that are effective immediately with regard to the institution and should carry much the same importance and impact with regard to the institution’s response.
As noted, MRAs also serve to reinforce a regulatory message to the board that, from the perspective of the agency, the cited matters are of such importance and pose such potential risk to the institution that they require directed attention of the board on a proactive targeted basis long before the next ensuing exam.
As a result, directors are placed “on notice” of the immediacy of the concern and the risk. They ignore or fail to react promptly and proactively at their peril not only with regard to regulatory actions but also under their fiduciary obligations of care to the institution and its constituencies. And, as noted below based on a new OCC guidance, the impact on national bank and federal thrift directors may be even more direct.
Regulatory Examinations
It is important to note that regular agency examinations really are part of the regulatory “enforcement” process, albeit traditionally the “investigative” phase. While the agencies hold a plethora of weapons in their enforcement arsenals, the examination (and the resulting findings) are the basic regulatory audit tools to identify and to point out risk in the activities of the institution. However, regulatory examinations are not a substitute for self-policing conducted by the institution itself or by utilizing outside assistance, and not a substitute for the boards’ obligation to ascertain that appropriate risk management tools are in place and being used.
Sometimes the agencies determine that while the issue does not require immediate formal enforcement activity, it in fact is potentially too significant and involves too much risk to wait until the next examination. That risk can relate to any number of potential aspects of the operations and financial health of the institution depending on the examination findings, and the MRAs represent a method of addressing findings of particular concern between regular exams. They can also serve as a basis for quickly increasing and intensifying enforcement activities by the agencies should they not be addressed in the manner cited in the report of examination, and therefore must be taken seriously and addressed immediately. Again, in addition to the regulatory enforcement threats posed by lack of responsiveness, MRAs identify serious concerns that place directors on notice of deficiencies that they, in the exercise of their fiduciary responsibilities as directors, must address in order to mitigate the potential liability that accompanies such board awareness. Boards that are placed on notice of a potential risk, and fail to take appropriate action to address that risk, provide the classic recipe for director liability.
Of course not all MRAs rise to the level of immediate potential exposure. MRIAs by their nature tend to relate to immediate issues that are more of a risk to the safety and soundness of the institution, reflect violations of law or regulation, or are repeat criticisms that have escalated in importance and therefore require expedited attention. Timing requirements dictated by the agency will reflect the perceived severity and potential adverse impact of the exposure on the institution. But whether an MRA, an MRBA or an MRIA, each rise to a level of concern that requires board attention and action in order to reduce the likelihood of enhanced enforcement action by the agency, as well as board exposure. And if the issues are that important and the exposure that great, odds are that management and the board should be similarly sufficiently concerned to make certain that the issues are addressed.
Recent Developments
On October 30, 2014, the Office of the Comptroller of the Currency (OCC) issued revised policies and procedures for how the OCC manages MRAs. As noted by the OCC: “MRAs must receive timely and effective action by bank management and follow-up by OCC examiners.”
The OCC materials indicate that MRAs are used by the agency to communicate “concern, cause, consequence, corrective action and commitment.” The OCC materials also reinforce the importance of MRAs and agency expectations with regard to board oversight of prompt attention by management to the cited issues.
Importantly, and perhaps a cause for concern, the OCC issuance includes a “red flag” for national bank and federal thrift directors in that it calls for directors to “ensure” that management implements corrective procedures within the stated timeframes and that the measures are “effective.” The “devil is in the details” as always. The term “ensure” had been a point of significant contention in prior OCC “heightened expectations” guidelines for very large institutions and was eventually removed from those guidelines. The fact that it appears here after such contention in prior large bank guidelines is likely not an oversight but is indicative of actual expectations. Using the term “ensure” connotes a form of “guarantee” by directors of management compliance with MRAs that is inconsistent with traditional director responsibilities, and could well raise additional potential liability issues for directors of national banks and federal thrifts. Use of the term “ensure” further blurs already-foggy lines between regulatory expectations with respect to boards as opposed to management, and is inconsistent with the differences between the statutory and common law legal obligations of boards and management. Much of the determination as to whether measures taken by management in response to an MRA are in fact “effective” involves subjective examiner assessment and is capable of a wide variety of interpretations, particularly with 20-20 hindsight.
Placing directors of national banks and federal thrifts on notice that the OCC expects them to “ensure” that the steps taken by management in response to an MRA are indeed “effective” may result in a significantly different legal standard for those directors as opposed to their state bank counterparts, with correspondingly greater potential liability.
Implementation
Institutions should treat all MRAs as if they are, in fact, enforcement proceedings requiring immediate follow-up, tracking of compliance efforts and documentation of implementation. Creating a record of the institution’s response to the MRA, its implementation of corrective action, and its implementation of protective measures to endeavor to ensure that the risk presented by the issue is addressed going forward is important not only from a regulatory perspective, but also from the perspective of memorializing the board’s actions to address a significant concern and risk of which they now have knowledge and have been placed on notice.
Unlike certain other “red flags” in management, regulatory and audit reports, the MRA has the added weight of having an immediacy attached, including specific dates for addressing the issue at hand. Careful documentation of efforts undertaken to resolve the problem (along with ongoing communication with regulators) will help to avoid future headaches and provide evidence that the matter has been seriously considered and addressed. Boards electing not to pursue MRAs will likely be required by the agency to note the matter in board minutes along with an explanation of why the board chose not to pursue the matter and acknowledging the potential risk … likely “Exhibit A” in the ensuing enforcement action and/or lawsuit.
Conclusions
MRAs are a critical part of the regulatory examination process and help to reinforce the need for proactive action to address potentially damaging concerns identified by the agencies. Importantly, not only do they require proactive action with regulators, but they also place management and boards on notice of important potential risk issues that, if not properly addressed, can create additional exposure.
The OCC guidance is indicative of the importance placed on these actions by all of the agencies and may indeed raise special issues for directors of OCC-regulated institutions. Management and boards should take MRAs seriously. They also should respond quickly to address the issues cited by the MRAs in a prompt and expeditious manner in order to reduce the likelihood of further, more severe regulatory action and enhanced potential liability.