Recovery Planning: OCC Final Rule

KPMG Regulatory Insights

Focus on Risk Governance: Highlights importance of strong risk governance frameworks, including plans for how to respond quickly and effectively to, and recover from, the financial effects of severe stress.
Expanded Scope: Expands the scope of applicable banks $100 billion or more; adds a testing standard; and clarifies the role of non-financial (including operational and strategic) risk in recovery planning.
Focus on Resolutions: Final Guidelines follow FDIC final rule on resolution planning and joint FDIC/FRB final guidance on “living wills”.

__________________________________________________________________________________________________________________________________________

October 2024

The Office of the Comptroller of the Currency (OCC) issues a final rule amending its recovery planning guidelines (Guidelines), which are generally applicable to insured national banks, federal savings associations, and federal branches of foreign banks (collectively, covered banks) meeting or exceeding a certain total assets threshold. The final amendments are substantively as proposed earlier this year, with modifications based on comments received, including clarification that the testing requirement should be risk-based, and extension of the relevant compliance dates.

Effective, January 1, 2025, the final amendments to the Guidelines:

Lower the covered bank threshold from $250 billion to $100 billion in total consolidated assets.
Add a testing standard that mandates periodic, but at least annual, testing to validate the effectiveness of the recovery plan, including by considering each of its elements. Testing should be appropriate for the covered bank’s individual size, risk profile, activities, and complexity, including the complexity of its organizational and legal entity structure.
Clarify that a recovery plan must consider financial risk and non-financial risk (including operational and strategic risks).

Key features of the amended OCC Guidelines require each covered bank to develop and maintain a recovery plan that is specific to that covered bank and appropriate for its individual size, risk profile, activities, and complexity, including the complexity of its organizational and legal entity structure. The plan should consider both financial risk and non-financial risk (including operational and strategic risk), and include the following elements:

Recover Plan Elements	Description
Overview	Overall organizational and legal entity structure, including its material entities, critical operations, core business lines, core management information systems, and interconnections and interdependencies.
Triggers	Financial and non-financial triggers that reflect the bank's specific vulnerabilities.
Options for Recovery	A range of credible options, including execution and timing, to restore financial strength and viability, thereby allowing the bank to continue to operate as a going concern and to avoid liquidation or resolution.
Impact Assessments	For each recovery option, assessment, and description of effects, including implications for capital, liquidity, funding, profitability, material entities, critical operations, core business lines, risk profile as well as potential legal, market, or regulatory obstacles.
Escalation Procedures	Process for escalating decision-making to senior management or the board of directors in response to the breach of any trigger.
Management Reports	Reporting sufficient data and information to senior management or board to make timely decisions regarding the appropriate actions necessary to respond to the breach of a trigger.
Communications Procedures	Process for notifying OCC about significant trigger breaches and actions taken; internal and external communication processes.
Other	Any additional information communicated in writing by the OCC regarding the bank's recovery plan.

Compliance

Compliance with the final Guidelines requires:

Current covered banks (those with $250 billion or more in total consolidated assets) to amend their recovery plans to address nonfinancial risks within 12 months after the effective date and to comply with the testing requirements within 18months after the effective date.
Newly covered banks (those with total consolidated assets between $100 billion and $250 billion as of the effective date) to develop their recovery plans within 12 months and to comply with the testing standard within 24 months.
Banks that become covered banks after the effective date to comply with the Guidelines within 12 months after the date they become a covered bank and to comply with the testing standard within 24 months.