Summary:

Situation Overview: The Office of the Comptroller of the Currency (OCC) finalized revisions to Recovery Planning Guidelines, which substantively change the scope and expectations for recovery plans.

What: The OCC is increasingly focusing on testing banks’ recovery plans to assess if their plans are credible.

Key Affected Parties: All large banks.

In Depth

The OCC’s recovery plans (“OCC Recovery Plans”) are intended to provide management with a set of triggers to quickly identify actual or potential severe stress events, and a playbook of actions to restore capital, liquidity, and operational stability to a bank entity, thereby preventing a potential failure of an entity, and the need for resolution.

The OCC lowered the threshold for Recovery Plans (now $100 billion in total assets[1], down from $250 billion), and expanded the requirements associated with such plans.

This post summarizes the OCC’s changes to the recovery planning process and implications for bank management.

Changes in Recovery Planning Supervisory Guidance:

The table below summarizes the OCC’s Revisions to Recovery Planning Guidelines by bank size:

Per the OCC’s final Recovery Planning Guidelines, there are three major changes:

1. Recovery Planning Guidelines now apply to banks with at least $100 billion in total assets;
2. Banks must incorporate a testing standard for recovery plans;
3. Banks must address the role of non-financial risk (including operational and strategic risk) in recovery plans.

The revisions are effective January 1, 2025, with staggered compliance dates.

Recovery Planning Testing Standard

All banks subject to recovery planning requirements are required to validate the effectiveness of recovery plans.  Testing should be risk-based and reflect the covered bank’s size, risk profile, activities and complexity.

A covered bank should test its recovery plan periodically but not less than annually. Testing should also be conducted following any plan changes due to a material event.

The testing should include each element of the plan, including:

• Simulating severe financial and non-financial stresses (e.g., the scenarios used to develop the plan);
• Ensuring the plan’s financial and non-financial triggers appropriately reflect the bank’s vulnerabilities and can provide timely notice of severe stress;
• Evaluating the credibility of options for recovery (e.g., the ability to raise liquidity quickly, the ability to refresh a virtual data room for sales components);
• Evaluating the ability to produce impact assessments (e.g., the ability to calculate the impact of scenarios on material entities, critical operations, and core business lines for recovery options);
• Escalation procedures;
• Management reports; and
• Communication procedures.

After completing any tests, covered banks should apply a risk-based approach to revise their recovery plan as necessary.

Non-Financial Risks

The OCC’s revised Guidelines emphasize consideration of non-financial risks, including operational and strategic risks. This consideration should be reflected by including non-financial triggers, describing and planning mitigations for non-financial challenges and risks in recovery options, and coordinating with other planning exercises, such as business continuity planning and resilience programs.

What Firms Should Do

Firms should conduct a thorough gap analysis against the requirements of the OCC’s revised Guidelines and identify areas which may require staffing as well as data and technology investment.

Firms that are new to these requirements will need to stand up holistic recovery planning efforts to include the foundational elements of these disciplines (e.g., Board and senior management oversight/engagement; recovery trigger frameworks; data, systems and reporting capabilities; sufficient and skilled personnel allocated to these activities).

All firms should focus on their ability to execute the elements of their plans. We recommend a formalized testing program that systematically reveals how the plan would work in practice, how the plan interacts with other planning exercises (including stress testing, operational resilience planning, and resolution planning) and incorporates lessons learned from these exercises. These tests can take various formats – from full-scale simulations, to tabletop exercises, to rapid refreshes of key components (e.g., updating liquidity and capital metrics) – and should include multiple lines of defense in the execution and evaluation of tests.

Engagement of senior management and the board in targeted exercises also reflects the enterprise-wide nature of an actual recovery and demonstrates the commitment of the firm to regulators. Although the occurrence of these types of deep stress events is rare, the planning and capabilities are most successful when they are incorporated into business-as-usual systems and processes.

Put Patomak’s Expertise to Work

As regulatory expectations continue to evolve to mitigate risks to financial stability, Patomak is ideally situated to advise firms on driving enhancements to recovery planning. Our deep expertise enables us to help you navigate complexities and mitigate risks. Wherever you are in your safety and soundness journey – from advance preparation to stay ahead of the curve, or verifying the adequacy of existing capabilities – Patomak’s suite of services can provide the support you need to succeed. If you would like to learn more about how Patomak can partner with you, please reach out to Diane Daley at ddaley@patomak.com, Mona Elliot at melliot@patomak.com, or Heather Espinosa at hespinosa@patomak.com.

---

[1] Calculated based on the average of total assets reported on the covered bank’s Consolidated Reports of Condition and Income for the four most recent consecutive quarters.