_Increasingly, examination findings, especially “matters requiring immediate attention,” may evidence some of the characteristics of an informal enforcement action.

Regardless of legal status, all enforcement actions involve:

• a regulator’s finding that a certain practice at a regulated institution falls short of supervisory expectations;
• the institution’s commitment to remedy the deficiency within a certain timeframe, along with a plan for doing so;
• ongoing remediation (by the institution) and review (by the regulator) processes; and
• the eventual formal notification that the enforcement action’s conditions have been satisfied.

Following are seven tips for navigating the enforcement process, developed over thirty years of practical experience.

1.  Don't wait!

No institution is ever surprised by an enforcement action. It is typically issued following a negative examination, extensive discussions with examiners, and a formal review of draft documents involving legal counsel. An institution may have six months’ notice—or even more—that it will be subjected to an enforcement action.

However, the timeframe for addressing significant operational issues at large, complex institutions is generally short. An enforcement action typically requires an institution to submit a remediation plan within 90 days of its issuance. Accounting for internal reviews and governance processes, the time for substantive plan development can shrink to as little as 30 days.  

Many banks will be tempted to defer work on an enforcement action until its terms and conditions are finalized. While this approach may appear efficient, it is neither practical nor prudent. First, the perceived efficiency gains are often exaggerated. A well-informed bank will generally have a very good understanding of the actions required to address outstanding issues—rarely are the terms of an enforcement action a surprise. Second, developing solutions to complex operational and regulatory issues, particularly those involve technology enhancements, takes time. And third, if the regulatory process is to be trusted, an enforcement action is designed to remediate a substantive issue with a bank’s operations. It is simply not prudent to wait to address such an issue.

2.  “Overcommit” governance and resources.

A key message supervisors signal through the enforcement process is that an institution’s executive management and board of directors have not paid sufficient attention to a particular issue. If supervisors believe their message hasn’t been effectively communicated through an enforcement action alone, they will continue to escalate the issue, perhaps by issuing civil money penalties or even taking more drastic action.

Consequently, institutions should establish a formal, stand-alone governance process for responding to enforcement actions. This process should ensure that remedial progress is clearly visible to executive management and the board. It should also overcommit resources to guarantee progress meets the conditions of the remediation plan delivered to the regulators.

3.  Address underlying process issues.

Institutions should ensure that their remediation plans address underlying process weaknesses comprehensively, rather than focusing solely on specific issues identified by the supervisors. There is a natural temptation to “narrow the scope” of an enforcement action by urging supervisors to focus on the precise wording of a specific section or paragraph of an order. However, a banking supervisor is unlikely to validate completion of an enforcement action provision if specifically-identified process issues have been addressed but fundamental issues with the underlying process remain outstanding.

4.  Separate substantive remedial actions from specific items in an enforcement action.

An unfortunate reality is that enforcement actions often come in multiples. A bank receiving an enforcement action from the Office of the Comptroller of the Currency is likely to receive a similar (though not identical) action from the Federal Reserve. In more complex institutions, the Federal Deposit Insurance Corporation and a state regulator may also have enforcement interests, as might FinCEN and, in unfortunate circumstances, the Department of Justice.

Each of these institutions may issue an enforcement action requiring specific remedial actions. Although all will address similar topics, each will vary slightly. If an institution ties its remediation plan too tightly to a particular enforcement action, it will be difficult to manage (and report on) each of the variations.  

Therefore, an institutions will benefit developing a logical, theme-based remediation plan to drive all internal remediation and reporting efforts. Elements of this plan should then be mapped to the various enforcement actions, both for progress tracking and reporting back to the issuing agencies.

5.  Tell a story: Communicate progress clearly and regularly.

An institution must tell its remediation “story” to multiple internal and external audiences. This narrative should go beyond simply addressing a ”punch list” of issues identified by an outside third-party. Ideally, a bank undergoing significant remediation will have an overarching remediation goal that aligns with its core business strategy. Clearly and transparently communicating this plan to the board of directors, executive management, remediation teams, and those reviewing remedial efforts is a critical aspect of the remediation process.

This overarching narrative should inform every periodic update required during the pendency of an enforcement action, and, if well developed, can serve as a valuable framework for determining when remediation has been successfully completed.

6.  Consider “validation” and “sustainability” in early planning stages, not as an afterthought.

Regulators will typically not consider a matter closed until an institution has internally validated completion and demonstrated the solution’s longer-term sustainability.  

These activities must be incorporated into an institution’s remediation plan. Validators (typically Internal Audit) need to be part of the initial remediation planning efforts, understand planned remedial steps, and have the resources to complete validation at the appropriate time.

Those planning substantive remediation steps should consider how they will demonstrate sustainability, whether simply through the passage of time (which can take a year or more), regular reporting and escalation processes, or other means.

7.  Be patient. Focus on substantive issues caused by enforcement action, not whether or not the action has been lifted.

Institutions under enforcement actions naturally desire their swift removal. This can lead to tremendous frustration, both because these actions tend to be outstanding for several years and because focusing solely on lifting the order can lead to short-term actions that ultimately prolong the enforcement process.  Moreover, sharing your frustrations with the regulators, even unintentionally, through the equivalent of an “eye roll” at their feedback, can lead to a supervisory conclusion that the institution just doesn’t “get it,” perhaps the most significant, undocumented finding an examiner can make.

Instead, focus on making demonstrable progress against the enforcement action and on addressing those elements that impose substantive constraints on business operations. It is possible, for example, for an institution’s supervisory rating to improve markedly, even while an enforcement action is outstanding. This can lead to a loosening of associated restrictions. Ultimately, much is negotiable. An institution demonstrating a strong commitment to remediation is much better positioned to discuss these issues with a supervisor than one disputing whether sufficient progress has been made.