<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

OCC Bulletin 2017-43: Guidance for Risk Management of New Activities

author Michael Berman
1 min read
Oct 30, 2017

New activities and business lines are more than just potential profit centers. They are also potential sources of risk that need to be carefully identified, measured, monitored, reported and controlled. They also need to align with a bank’s overall strategy and business plan and give consumers fair access and treatment when it comes to financial services. That’s the reminder the OCC is sending with OCC Bulletin 2017-43, New, Modified or Expanded Bank Products and Services.

The world of banking has evolved considerably since OCC’s last guidance on the topic in 2004, OCC 2004-20, which was replaced by this issuance. Artificial intelligence and cloud data storing are growing while consumers expect increasingly mobile and real-time products. This creates opportunities but also contributes to strategic, reputation, credit, operational, compliance and liquidity risk, the OCC says. It can impact everything from financial performance and the strategic planning process to risk profiles, banking models and competitiveness.

The best way to ensure sound risk management when adding new activities or altering ones already in place, the OCC says, is to develop an effective risk management system with four key elements:

  1. Due diligence and approvals. The board should ask why the bank is engaging in this activity and what are the risks and benefits.
  2. Policies and procedures. These should specifically outline how risks will be managed.
  3. Change management. Plans for testing, implementing and exiting the activity.
  4. Ongoing monitoring and review. Have a system in place to monitor risk exposure and whether it remains within the bank’s risk tolerance.

These principles are especially important to remember when dealing with third-party vendors, which often facilitate new activities. The guidance mentions third-party vendors no less than 32 times and the original guidance, now replaced with this new update, is referenced in OCC Bulletin 2013-29, Third-Party Relationships.

Banks that don’t embrace risk management systems and install proper controls face issues like errors, losses, failed business objectives, issues with systems and controls, compliance violations, and lawsuits, the OCC warns.

 

Related: Creating Reliable Risk Assessments

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Nrisk Regulatory Compliance Management News & Updates HMDA Risk Mortgage Lenders Ncomply Vendor Management Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Third-Party Vendor Management Business Continuity Cybersecurity Fintech NVendor Strategic Planning Ncyber Ntransmittal Audits & Findings Company Culture OCC Regulatory Updates Audit Nverify Regulatory Compliance Exams FDIC Compliance Management Findings Nfindings NCUA Contract Management Employee Intranet Contract FRB Business Continuity Management FFIEC Findings Management Ncontracts manager Third-Party Vendors Vendor Risk Enterprise Risk Management ABA Bank Access Control Audit Findings Board Portal Call Report Due Diligence Efficiency Employee Engagement Exam findings FIEC Inc. 5000 Internal Audit Management Nboardportal Verify Wealth Management
Ammo for the Budget Battle: How Risk Management Delivers ROI
Risk Management

Ammo for the Budget Battle: How Risk Management Delivers ROI

Oct 3, 2018 2 min read
OCC: Operational Risk Remains Elevated
Risk Management

OCC: Operational Risk Remains Elevated

Jun 6, 2019 2 min read
Risk Management: Knowing When It’s Time to Start Again
Risk Management

Risk Management: Knowing When It’s Time to Start Again

Mar 12, 2019 2 min read