The FRB, FDIC, OCC, NCUA and the State Liaison Committee (the “Agencies”) jointly issued frequently asked questions (“the FAQs) concerning interest rate risk (“IRR”) management. The FAQs update the Agencies’ January 7, 2010 advisory concerning management of IRR by federally insured depository institutions (“institutions”), discussed in the January 12, 2010 Financial Services Alert. The FAQs clarify the Agencies’ position on IRR modeling, reminding institutions to ensure that their IRR assessment processes match their individual risk profiles. The FAQs are divided into sections on risk management and oversight, measurement and monitoring of IRR, stress testing, internal controls and validation, and assumptions.
The FAQs state that institutions must model the risks posed by interest rate changes on both earnings and the economic value of capital, over various time horizons, to ensure that they capture the full spectrum of IRR. Longer time horizons should be considered; a minimum two-year period is recommended, since many risks may not show up in a one-year projection. While community institutions are not required to perform longer-term, five-to-seven year simulations, risk managers may find them helpful in understanding the total IRR picture. While regulators may allow institutions with non-complex balance sheets to employ alternative, less sophisticated measurement processes on a case-by-case basis, all institutions are encouraged to employ earnings simulations, which technology has made increasingly available.
The FAQs note that stress scenarios should generally include rate shocks greater than ±300 basis points. Measuring the potential effects of extreme shocks can be very helpful for risk managers. The appropriate scenarios depend on market conditions: for instance, simulations of a +400 basis point shock may be especially useful in a period of extremely low rates, while simulations of a large negative shock would be less valuable.
The FAQs state that IRR models should include scenarios for repricing mismatch, basis risk, yield curve risk, and options risk. While the exact scenarios will vary based on an institution’s unique risks, most analyses should be run at least annually. For institutions particularly sensitive to one of those risks, the appropriate model for that risk should be run monthly or quarterly.
The FAQs remind institutions that evaluations of new products and strategies must include due diligence of all risks, including IRR. An institution must adjust its IRR models as necessary to account for unique risks posed by any new products.
Should an institution offer any complex and structured products, the FAQs remind the institution to model carefully all embedded loan options that can affect IRR. Relevant attributes include reset dates, reset indices and margins, embedded caps and floors, and any prepayment penalties.
The FAQs further emphasize that institutions that rely on third-party vendor models for measuring IRR risk are responsible for independently verifying the model’s accuracy and appropriateness to the institution’s own risk profile. Model certifications and validations commissioned by vendors will rarely completely satisfy supervisory expectations. In evaluating third-party models, an institution must take into account how well the model handles any highly structured instruments or unique products it offers. Moreover, the institution must ensure it has adequate in-house knowledge if there is a lapse in vendor support.
The FAQs state that assumptions made by institutions should be appropriate to the individual institution, which generally means that industry estimates and default third-party assumptions are inadequate. However, some institutions may not have systems in place to accurately measure certain data points, such as non-maturity-deposit decay rates. In such a case, an institution may use industry estimates as a starting point, while working to develop internal data and taking into account ways in which the industry estimate may be inappropriate to the individual institution—for instance, because of inconsistency in customer behavior across geographic areas.
Finally, at the end of the FAQs, the Agencies provide an appendix with links to prior bank regulatory guidance on IRR management and related matters.