Loan payment plans approved by the bankruptcy court frequently do not conform to the original loan payment plan contracted at the beginning of the loan. Many times the court approved payment plan calls for a more lengthy maturity, reduced interest or reduced principal for the loan. Questions have arisen concerning the calculation of past due status for these loans and the correct categorization of these loans for Examination Report and Report of Income and Condition purposes.

Chapter 1 POLICY

Loans which have been accorded new payment plans by a bankruptcy court will be deemed to have received a new contractual payment plan and the past due status will be evaluated based upon the new plan. Loans performing according to the court-approved plan will not be considered past due even though the loans are not performing according to the original payment plan. Loan which become delinquent under the court approved plan will be included in the appropriate past due category according to established guidelines.

However, loans which have a court-approved payment plan may be considered restructured debt. Restructured Loans are loans whose terms have been modified, because of a deterioration in the financial position of the borrower, to provide for a reduction of either interest or principal.

Once an obligation has been restructured because of such credit problems, it continues to be considered restructured until paid in full or until time as the terms are substantially equivalent to terms on which loans with comparable risks are being made.

91-2 – Treatment of Mortgage Loan Pools and Mortgage Servicing Rights Acquired from the RTC

The Resolution Trust Corporation (RTC) packages 1 to 4-family residential mortgage loans into pools for sale to various financial institutions and other entities. Questions have arisen concerning the accounting for the loan pools depends upon whether they are to be held for resale or for long-term investment.

POLICY

before the mortgage loan pool can be classified as a long-term investment, the intent and ability of the bank to hold the loans to maturity or for an extended period must be established. A corporate resolution may be used to document management's intent to hold the pool of loans for an extended period of time or until maturity.

Mortgage loan pools acquired from the RTC for long-term investment are to be booked at cost and carried on the bank's balance sheet in the loan category. The subsidiary loan trial may carry the loans on an individual basis or carry a control amount for the block of loans purchased. A premium or discount may be associated with the purchase of this type of asset and must be amortized or accreted over the life of the loans.

A premium exists when a bank purchases the pool of loans at a price in excess of the principle of the loans within the pool. The difference between the purchase price and balance represents the premium which the bank is required to amortize. Amortization may be calculated on an individual loan basis or may be calculated on the entire pool utilizing a weighted average life method. (The remaining life of each loan is determined and totaled. The total life is then divided by the number of loans within the pool.)

A discount exists when a bank purchases a pool of loans at a price below the principle balance of the loans within the pool The difference between the proposed balance and purchase price presents the discount which the bank is required to accrete. Accretion may be calculated on the individual loans or may be calculated on the entire pool utilizing the weighted average life method previously described.

Mortgage loan pools acquired for sale are booked at the lower of cost or principle balance of the loans within the pool. Discounts resulting from the purchase of a loan pool that are held for sale shall not be realized as income until the loans are actually sold. A gain or loss on he sale is the difference between the sale price and the net carrying amount of the pool. This gain or loss will be reported as noninterest income and will not affect the yield on the pool of loans for the carrying period.

Certain costs incurred in block purchases of mortgage loans can be associated with future servicing income and capitalized and amortized over the estimated average term of the mortgage loans. Appropriately capitalized costs can be added to the book value of the loans, and the lower of cost or principle balance has been determined.

Loans are sometimes warehoused for s short period of time and sold under a repurchase agreement (repo). If the loans are not repurchased in accordance with the repo agreement, the lending institution may exercise ownership of the pool of loans. The seller may pay an agreed-upon rate of interest for the use of funds provided by the lending institution. Repos are accounted for as a borrowing and no sale is recorded.

When the interest paid on the short-term warehouse loans is less than interest received on the asset, a positive spread is created for the repo seller. However sometimes interest rates reverse, and short-term rates exceed long-term rates. This results in a negative spread in interest rates for the repo seller which must be charged to current operations as they are incurred.

Mortgage loans pools held for resale should be segregated on the balance sheet. Disclosure must be made of the method used to determine the lower of cost or market value of the loan pools. Capitalization of servicing rights must be disclosed as follows: (a) amount capitalized; (b) method of amortization used; and (c) amount of amortization.

The bank's loan policy is to address the following information for the purchase of mortgage loan pools from the RTC: inclusion of mortgage loan pools on the list of loans suitable for investment; the maturity desired for these type of loans; documentation requirements; assignment of responsibility for oversight of the pool; and guidelines for accounting, assignment of risk rating, and sale of individual loans from the pool or the entire pool. The reserve for loan losses is to be increased according to the risk assigned to this pool of loans.

ACCOUNTING FOR SERVICING RIGHTS

Part of the mortgage loan pool's purchase price may be the right to receive future servicing income. The amount directly attributable to servicing rights shall be deferred with certain limitations. The first limitation is that the amount deferred shall not be more than the difference between the market value (excluding servicing rights) of the loans at the date of purchase and the total purchase must be in accordance with FASB-65 (lower of cost or market). The following conditions must be met:

a. Prior to date of purchase, commitments from investors to purchase the mortgage loans must be obtained, or the commitments must be obtained no later than 30 days after the date of purchase. The commitment must provide for the seller to continue servicing the mortgage loans.

b. If the sales price to the permanent investor exceeds the market value of the loans at date of purchase, the difference must be applied to reduce any amount deferred for mortgage servicing rights.

c. No other costs relating to the purchase of the loans can be deferred.

NOTE: If the above conditions are not met, the cost of the right to receive future servicing income is usually included as part of the cost of the mortgage loans for the purpose of determining lower of cost or market.

The second limitation is that the amount allocated to the right to receive future servicing income cannot exceed the present value of the estimated future net servicing income. Future net servicing income is the difference between the estimated future servicing revenue and the estimated future servicing costs. probable late charges can be included in future revenues. Servicing costs may be determined on an incremental cost basis.

91-3 – Investment in Student Loan Marketing Association (SALLIEMAE) Preferred Stock

Questions have arisen whether state banks may invest in preferred stock of the Student Loan Marketing Association (SALLIEMAE). State Banks are authorized to purchase common stock in this program pursuant to department regulation.

POLICY

Preferred stock in the Student Marketing Association (SALLIEMAE) will be considered an eligible investment for a state bank for purposes of qualifying to offer guaranteed student loans through its program.

92-3 – Debt Cancellation Contracts

An increasing number of state chartered banks are offering debt cancellation contracts as an alternative to the sale of credit life insurance. Debt Cancellation Contracts provide for losses arising from cancellation of outstanding loans upon the death of borrowers. These contracts contain an element of risk which may impact the safe and sound operation of a bank. Activity in this area should be examined to determine the degree of risk and to insure that proper guidelines have been implemented to provide for safe and sound operations.

The United States Court of Appeals for the Eight Circuit ruled on June 25, 1990, in First National Bank of Eastern Arkansas. A National Banking Association, vs. Ron Taylor, Commissioner of the Insurance Department for the State of Arkansas, that national banks can sell "Debt cancellation contracts". On November 13, 1990, the Supreme Court declined to hear the case, thus affirming the 8th Circuit's decision. State chartered banks are authorized to provide for losses arising from the cancellation of outstanding loans upon the death of borrowers by means of a Resolution of the State Banking Board dated July 17, 1984.

POLICY

State chartered banks engaging in the activity of issuing debt cancellation contracts must consider the following:

- The bank's Board of Directors shall have considered the risks inherent in such activity and determined by resolution that the issuance of debt cancellation contracts is an approved product to be provided to certain loan customers of the bank;

- The Board of Directors shall designate the bank's officers eligible to offer the contracts;

- A loan limit shall be established for which the debt cancellation contracts may be sold (it would appear that debt cancellation contracts should only be offered for personal and consumer type loans);

- The bank shall establish a reasonable reserve based on a five year average of mortality losses experienced with past credit life insurance underwriters or other such method deemed acceptable by the State Bank Commissioner;

- The reserves shall be evaluated at least quarterly for adequacy and records supporting the justification for the reserve balance shall be maintained for examiner inspection; and

- The sale of a debt cancellation contract cannot be a condition to the approval of a loan application and should be offered along with similar products that may be available from other sources.

In the event that the debt cancellation contract is negotiated with the provision that a rebate will be made to the customer if the note is paid in full prior to maturity, the fee income shall be periodically recognized in proportion to the bank's performance under the contract. The bank's performance under the contract is the coverage of the risk associated with each contract. Thus, for those contracts in which the coverage is provided evenly during the term of the contract period, the income should be recognized evenly during the term of the contract. In the event the amount of coverage of the contract declines during the term of the contract, the fee should be recognized in proportion to the coverage during the term of the contract.

In the event that the debt cancellation contract is negotiated without a provision for rebate of a portion of the fee as a result of early payoff of the loan, all fees generated from the sale of the debt cancellation contracts shall be posted to non-interest income. Increases in the required reserve established to absorb losses shall be made by provision expense and posted to non-interest expense. Both the unearned portion of the feel and the reserve set aside for possible losses are to be recognized as liabilities on the bank's books.

Disclosure of the costs of debt cancellation contracts are subject to Section 226.4 of Regulation z - Truth in Lending. This disclosure is required for any charge payable directly or indirectly by the consumer and imposed directly or indirectly by the creditor as an incident to or condition of the extension of credit.

Potential liability also exists for the bank customer due to liability to a third party who may become a beneficiary due to inheritance and the impact of inheritance taxes. The bank is encouraged to disclose this fact to customers who may wish to seek tax advise on this issue.

The unreserved portion of the outstanding balances of loans in excess of the reserve balance are not to be considered contingent liabilities and, as such, debt cancellation contracts will have no effect upon risk based capital calculations.

EXAMINATION POLICY

The evaluation of the practices employed by a bank and bank management in the sale of debt cancellation contracts is to inspect for safety and soundness. The product should be offered so as to minimize risk and limit liability. In the event that minimum safeguards are not employed, management and the board of directors are to be cited for violating prudent banking practices and, in instances where risk is more than ordinary, cease and desist orders will be issued.

Agriculture and/or marketing cooperatives frequently issue certificates of equity and capital based certificates to farmers who market their crops through the cooperative. These certificates represent the farmer's ownership in the cooperative and are a "deferred payment" or a "receivable" to the farmer as a portion of payment which the cooperative withholds from the cash amount it pays the farmer for the value of his crop.

The traditional method of payment for such certificates has been full payment of face value at the end of the ten to twelve years. However, any determination of payment is made by the Board of Directors of the cooperative. These certificates have no maturity, have not established market, and are highly illiquid.

92-4 - Treatment of Certificates of Equity and Capital Based Certificates Issued by Agricultural and/or Marketing Cooperatives

Agriculture and/or marketing cooperatives frequently issue certificates of equity and capital based certificates to farmers who market their crops through the cooperative. These certificates represent the farmer's ownership in the cooperative and are a "deferred payment" or a "receivable" to the farmer as a portion of payments which the cooperative withholds from the cash amount it pays the farmer for the value of his crop.

POLICY

State chartered banks that receive certificates of equity and/or capital based certificates through default of the loan customer will be permitted to retain certificates of equity and/or capital based certificates on their books at a fair market value. Market value must be established by reasonable banking practices acceptable to the Bank Commissioner. This valuation must be fully documented and maintained by the bank.

It is the opinion of the Bank Commissioner that the legislative intent of A.C.A. Sec. 23-32-703(c) addressing the holding period for "goods or chattels" coming into a bank's possession as collateral security for loans or any ordinary collection of debts extends to all assets not specifically excluded by statute. (See A.C.A. 23-32-709 and A.C.A. Sec 23-32-303(2)(b)(iii)) Accordingly, these certificates of equity and/or capital based certificates may not be reckoned as a bank asset for a period longer than twelve months.

Under no circumstances may a bank purchase as an investment a certificate of equity and/or capital based certificate.

93-2 – State and Local Government Leases

Act 508 of 1991, the so-called Local Government Lease Act provided a method for structuring a multi-year lease arrangement that local governments could use to obtain capital improvements, equipment, facilities, goods, etc. Certain provisions of the Act provided for payment of interest by the local government. (See Examination Policy 91-4)

An Arkansas Supreme Court decision, Mason Brown v. City of Stuttgart, Arkansas and First Continental Financial Corporation, Case No. 92-849 (February 22, 1993) may have invalidated Act 508 of 1991. The case held that a multi-year lease arrangement that provided for the payment of "interest" by the municipality was a violation of the Arkansas State Constitution, Article 16, Section 1, which prohibits a city from entering into an obligation with interest bearing indebtedness. The court cited several other provisions for invalidating the lease in this case, such as a great penalty for default, and the fact that there was no way to terminate the lease except if an appropriation was not made for it each year.

While the court did not reach the question of the constitutionality of Act 508 of 1992, it did invalidate the lease in this case.

POLICY

Leases between a lender and state and local governments should be scrutinized for evidence of an interest bearing obligation as well as whether there are major penalties for default from the lease agreement.

Such leases, if discovered, should be accorded a special mention classification and the bank should be requested to confer with bank counsel to determine if a new arrangement should be negotiated due to the above cited Supreme Court decision.

93-4 – Correct Accounting Treatment for State Bank Department Assessments

Assessments for state chartered banks in Arkansas are due semi-annually based upon total assets shown in the bank's Report of Condition for the periods ending June 30 and December 31 of each year. These assessments are based upon the last six months of operation of the institution and, as such, are paid in arrears. The correct accounting treatment for this activity would be to accrue this expense with an offsetting liability entry over the six-month period in which the assessments apply and then pay the assessment when billed. It is incorrect to book payment of Bank Department assessments as a prepaid asset and amortize this expense over the six-month period following payment. Assessments booked in this manner should be accorded a loss classification and promptly charged off.

95-1 – Mortgage Banking Activities

MORTGAGE BANKING OVERVIEW

Mortgage banking activities include loan origination, loan production, mortgage servicing, secondary marketing, and other areas such as mortgage banking management, accounting, and reporting. The areas evaluated during an examination should be determined on a case-by-case basis depending upon the size of a particular company and the business activities in which it engages.

Loan origination is the retail operation in which loans are made directly to the public. The loans are processed, underwritten, and closed. These mortgages become part of the "mortgages held for resale" account where they will remain for the two to three month period necessary to complete the recording of the loan documents and to find a permanent investor to purchase the loans. The mortgage banker obtains purchase commitments from permanent investors and submits completed loan documentation packages to the investors for their approvals in satisfaction of the commitments. The mortgage banker maintains a relationship with a variety of permanent investors to whom the originated mortgages are sold.

Loan production is the function in which the mortgage company acts as a wholesaler and purchases loans in bulk or individually from other mortgage bankers, brokers, and bankers. These loans are purchased with the intent to pool the loans and resell in the secondary market. The mortgage company may then pool loans and sell to private or public investors with servicing rights retained or released. Generally servicing is retained in order to generate an ongoing income stream. During the production process, loans may be warehoused. Loans are retained in an inventory either pending commitment to a pool or to speculate on interest rates.

Mortgage servicing is performing the required duties of a mortgage seller such as collecting and remitting payments, managing the tax and insurance escrow accounts, inspecting the properties when required, pursuing delinquent borrowers, foreclosing on the mortgages when necessary, and providing accounting support. Servicing may be done by the lender or by a company acting for the lender. Due to economies of scale, the servicing portfolio must be sizable for the company to be profitable.

MORTGAGE COMPANY MANAGEMENT

Evaluation of management will entail a review of the organizational structure, board supervision, management oversight, management and board reporting, and the adequacy of management control systems. The organizational structure should be reviewed to determine, on a legal entity basis, the relationship between the mortgage banking company, the bank holding company, and any other bank or nonbank subsidiaries. Supervisory oversight is generally provided through the mortgage banking company's board, which may consist of mortgage banking company executives, bank holding company executives, and outside representatives. The examiner should determine whether a separate board exists, its membership and qualifications. Minutes should be reviewed to determine whether directors are fulfilling their fiduciary responsibilities. Directors' duties include: 1) selecting and retaining a competent executive management team; 2) establishing, with management, the company's short and long-term objectives, and adopting operating policies to achieve those objectives in a safe and sound manner; 3) monitoring operations to ensure they are controlled adequately and are in compliance with laws and policies; 4) overseeing the mortgage banking company's business performance; and 5) ensuring that the company meets the community's residential mortgage credit needs. Board reports should include default rates, new loans, liquidity levels, capital needs, policy exceptions, past dues, geographic concentrations, departmental profit and loss statements, and foreclosure rates.

Management should be evaluated in terms of technical competence, leadership skills, administrative capabilities, and knowledge of relevant State and Federal laws and regulations. Without adequate management oversight, excessive errors can occur, fraud or violations of law may go undetected, and financial information may be reported incorrectly. Management should also be evaluated on its ability to plan effectively. Effective planning entails the annual approval of an operating budget and the development of a long-term business plan which helps management anticipate changes in the internal and external environment and respond to changing circumstances. Without appropriate planning, the company can only react to external events and market forces. Compensation of management should also be examined. Compensation based on volume of production may increase risk, conflicts of interest, and an absence of independence.

Management controls consist of internal audit, external audit, quality control, insurance coverage, fraud detection procedures and related employee training programs. The internal audit function is responsible for detecting irregularities, determining compliance with applicable laws and regulations, and appraising the soundness and adequacy of accounting, operating and administrative control systems. The auditor must be independent and should report directly to the board or a designated committee. Small financial institutions may rely solely on their external auditor to perform these functions. Examiners should review the most recent external audit report and note any significant concerns or weaknesses in the company's internal control structure. Management's response to the audit should also be reviewed.

Quality Control services can be provided internally by an independent party or externally. In a small organization there may be little separation between the person underwriting the loan and the individual reviewing it. Quality Control reviews are necessary to test the quality of loans produced and serviced for investors. Investors such as GNMA, FHLMC, and FNMA issue very specific guidelines that must be met with respect to the scope and frequency of such reviews. At a minimum, these investors require that the servicer/seller sample at least ten percent of all closed loans each month for accuracy, completeness, and adherence to agency underwriting standards. The Quality Control person basically re-underwrites the loan, verifies deposits and employment, recomputes the APR, interest rate, loan to value, debt to equity and so forth. The Quality Control function should serve as an early warning system which alerts management to situations which may jeopardize the financial strength, image, or origination and sale capacity of the company. Quality Control should not substitute work performed by the internal audit and loan review functions. Insurance programs should be reviewed to determine whether coverage adequately protects the company and its affiliate against exposure to undue financial risk. The board should review and approve insurance policies at least annually. A letter should also be obtained from the mortgage company's attorney to determine if any pending litigation could cause losses to the bank and or the mortgage company.

MORTGAGE RELATED AGENCIES

Loans are categorized as either government or conventional loans. Government loans generally carry a below-market interest rate and are either insured by the Federal Housing Administration (FHA) or guaranteed by the Veterans Administration (VA). To be insured or guaranteed, a loan must meet agency standards regarding the size, interest rate, and terms. The lender must obtain a certificate of insurance or guarantee in order to qualify a loan for inclusion in a security.

Loans which are not FHA-insured or VA-guaranteed are referred to as conventional loans. Conventional loans are generally originated for larger loan amounts and can be offered with a fixed or variable interest rate. These loans typically require higher down payments and bear market interest rates. Lenders often require borrowers to obtain mortgage insurance coverage in high-ratio loans (generally, any loan with a loan-to-value ratio above 80 percent). In the primary market, private mortgage insurance (PMI) insurers provide coverage for the top 20 to 25 percent of a mortgage loan.

There are three major organizations involved with the facilitation of mortgage loans in both the primary and secondary mortgage markets: Federal National Mortgage Association (FNMA), Government National Mortgage Association (Ginnie Mae or GNMA), and Federal Home Loan Mortgage Corporation (FHLMC or Freddie Mac). The extent of credit risk depends upon the secondary market program under which the loan is originated. GNMA pass-through securities, which are issued by the lender, are backed by pools of FHA-insured or VA-guaranteed mortgages and are fully-guaranteed by the U.S. Government. Pass-through securities provide for monthly installments of interest at the stated certificate rate plus scheduled principal amortization on specific dates, despite the delinquency status of the underlying loans, as well as any prepayments and additional principal reduction. The issuer collects the mortgage payments and after retaining servicing fees, remits monthly payments to the certificate holders. This agency is under general policy direction of HUD.

FNMA operates a secondary market facility for FHA, VA, and conventional loan products which provides a degree of liquidity to holders of mortgage investments. FNMA will purchase FHA approved mortgages from qualified sellers through an auction format, using competitive and noncompetitive bidding procedures, and through convertible standby purchase commitments. These FNMA purchases enable originators to adjust their mortgage inventory levels periodically and maintain their origination capabilities. FNMA will also sell mortgages to qualified buyers which allows the purchasers to meet investor commitments by making up mortgage inventory shortages. The FNMA purchases and sales of the loans are dependent upon market conditions. FNMA guarantees the monthly pass-through of interest, the scheduled amortization of principal, and the ultimate repayment of principal. Participation certificates are not backed by the full faith and credit of the U.S. Government. FNMA is regulated by HUD.

Similar to FNMA, FHLMC is also a private corporation which purchases conventional loans from lenders and sells mortgage-participation certificates which are similar to GNMA pass-through securities. Participation certificates represent an ownership interest in pools of conventional loans. FHLMC guarantees the monthly pass-through of interest, the scheduled amortization of principal, and the repayment of principal. The certificates are not backed by the full faith and credit of the U.S. Government.

Conventional loans are classified as either conforming or nonconforming. Conforming loans must comply with FNMA and/or FHLMC size limitations, underwriting and documentation guidelines. Conforming mortgages may be sold to FNMA or FHLMC on either a recourse or nonrecourse basis. Nonconforming loans that do not meet FNMA or FHLMC guidelines may be sold in the secondary market under a private label structure. Nonconforming loans are often "nontraditional" products such as loans with teaser rates, limited documentation, graduated payment schedules, and "jumbo" loans which exceed maximum agency size requirements.

LOAN ORIGINATION

Loan origination entails five principal steps: 1) application; 2) processing; 3) underwriting; 4) closing and funding; and 5) post closing. Each of these functions should be independent of one another and separately supervised to ensure the quality of the loans produced. Loan originators must be knowledgeable of bank policy, procedures, laws, rules, and regulations. This is a highly regulated industry and noncompliance in any of these areas may disqualify a loan from sale in the secondary market.

Loan origination begins with the completion of a loan application. The applicant authorizes the lender to verify their employment, credit history, bank deposits, and other information which evidences repayment capacity. The loan processing area is responsible for gathering all documents which verify the financial condition of the borrower and the collateral. Processing activities should be controlled through standardized procedures, checklists, and systems. The underwriting unit approves or disapproves applications based on underwriting criteria established by FHA, VA, FNMA, FHLMC, private mortgage insurers, and institutional investors. Once a loan is approved by the underwriter, a commitment letter is sent to the applicant which states the interest rate and terms of the loan. At the loan closing, the legal title to the property passes from seller to buyer and the mortgage banker establishes a first lien on the property to secure the loan. After closing, a post-closing review is performed to ensure that documents were properly executed and underwriting instructions were followed. The post-closing review also identifies any trailing or missing documents which must be tracked and obtained to meet investors' pool certification requirements.

Certain risks are evident in the origination process. Operational inefficiencies can result in high staff turnover, an inability to meet investor documentation requirements, an increasing number of pools which lack final certification, or an unusually high production cost structure. Credit risk and operational inefficiencies may also create liquidity problems and additional interest rate risk if the company is unable to sell its loans in the secondary market. Other risks include product risk, borrower fallout risk, and reverse price risk. Product risk occurs when the product offered or made is not desired on the current secondary markets. If it can be sold, it is often at a steep discount. Borrower fallout risk is the risk that the loan will not close due to an action or inaction of the borrower. Reverse price risk occurs when a commitment is made to sell the loan to an investor at a certain rate prior to committing to the borrower. In the interim, a decrease in rates requires that the loan be delivered at an unexpected discount.

Prior to or at closing, the mortgage banker has an option whether to retain the loan in their own inventory (warehouse); pool loans and sell them to one of the federal agencies, a private investor, or choose to securitize the loans themselves; sell the loan individually; or sell it as part of a loan participation. The size and scale of the mortgage banking entity, liquidity, funding limits, and the product itself influence which decision is made.

00-1 - WAREHOUSING

The term pipeline is typically used to describe mortgages that are in the process of being originated, while warehouse refers to the inventory of mortgages that have been closed and are awaiting sale in the secondary market. Making a distinction between the pipeline and the warehouse is important because the risks of mortgages that are already closed differ from those that have not, and might not, close.

Once a mortgage is closed and the final documents are received, a mortgage leaves the pipeline and enters the warehouse, where it is either held for sale and marketed to investors, or shipped to a prearranged buyer. The amount of non-committed inventory is often restricted by mortgage company policy. Loans maintained in the warehouse with an intent to resell should be marked to market at least quarterly. After write-downs, write-ups to market values in subsequent periods are recorded, but total recorded market value may not exceed cost. The marking to market is often insignificant for loan pools committed to be delivered within a short period of time. The most adversely affected loans will be those held for a longer period of time with unusual features. While mortgages are being held in the warehouse, but before a contract has been signed agreeing to their sale price and terms, the mortgage company bears an enormous risk of the mortgages going down in value as a result of changes in overall interest rates or merely changes in the secondary mortgage market. It is critically important that a mortgage banking operation's interest rate risk is controlled, especially if the company's average pipeline and warehouse volume is significant relative to its capital.

Since a mortgage company typically obtains working capital from the sale of mortgage loans, warehoused loans can impair the sources of funds for new loans. Mortgages held for resale are frequently funded by a "warehouse mortgage" line of credit. This is a collateralized line of credit from a bank which is supported by a pledge of the mortgages in the resale inventory. The warehouse line operates as a revolving line of credit, with additional advances to the company for new mortgages to be placed in "warehouse" and repayments from the proceeds of sales to investors. Warehouse lines are a prime source of liquidity for the mortgage banker operating in the residential mortgage market. Refer to Arkansas State Bank Department Rules and Regulations, Section 5, Page 4 for additional information.

The primary risks in the area of warehousing are interest rate risk, market risk, and product risk. Interest rate risk occurs from holding a product, and it represents the difference between the rate paid for the loan versus the rate it can be sold at on the market. Market risk is the risk that either the market pricing will change or the market perception changes. Product risk is the risk that the product is undesirable to investors.

LOAN PRODUCTION

Wholesale production channels, where contact with the borrower is made by another party, take several forms. Whole loans can be purchased either individually or using bulk commitments. Bulk commitments either require the correspondent to deliver a set amount of loans (mandatory), or deliver all registered loans that close (best effort or optional). Loans are purchased in this manner to increase volume and to expedite the securitization process. Since this entails buying loans from outside sources, certain key factors should be considered and established by mortgage company policy: 1) guidelines for due diligence reviews; 2) definitions of loan products to purchase; 3) amount of loans desired; and 4) authority for purchase approval/commitment letter. The integrity and the independence of the introducing broker should be determined to ensure the purchases are made at arms length. If the mortgage company determines that it wants to proceed with a due diligence review of the loans, individuals are assigned internally or hired externally to perform the review on behalf of the mortgage company. Either way due diligence policies and procedures should be established by the mortgage company. These procedures should define scope, sample size, and specific review guidelines. If an external review team is used, a contract should be written which defines both parties responsibilities and compensation. For purchasers of correspondent production, credit risk increases to the extent that the lender relies on other parties to correctly process and underwrite the loan. Contracts with correspondents should include representations and warranties from the correspondent that loans delivered meet the underwriting requirements of the agency or investor program for which the loan was originated. Risks in this area include: 1) sampling risk; 2) pricing risk; 3) delivery risk; and 4) interest rate risk. Sampling risk is the risk of obtaining a biased sample which does not reflect the overall condition of the portfolio to be purchased. Pricing risk is the risk of offering too much for the loans purchased. Delivery risk is the risk that the loans purchased won't be delivered upon the commitment date or will not conform with the commitment requirements. Interest rate risk is the risk that the rate paid was too much based on the time frame for delivery and what the market will tolerate.

SECONDARY MORTGAGE MARKETING

The marketing department is typically responsible for the development of mortgage products, determination of products to be offered, as well as the establishment of daily mortgage prices. The marketing department which is also referred to as Secondary Marketing, is also responsible for the sale of mortgage loans to investors. The marketing department acts as an intermediary between the borrower and the investor. In a small mortgage company, the president, an executive officer, or a combination of individuals may be responsible for the marketing function.

Marketing activities are generally supervised by a marketing committee, which may consist of the Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, and the executive officers responsible for marketing, production, and servicing/loan administration. The committee is responsible for the formulation of marketing policies, departmental operating procedures, pricing strategies, and parameters governing the use of various mortgage-related products and strategies used to hedge the interest rate risk associated with certain mortgage loans. Bank policy should establish reasonable guidelines for the amount of loans that can be retained in the mortgage pipeline, liquidity levels, levels of uncommitted inventory, number of pools in process (including dollar amounts), approval authority, types of pools and securities in process, pair off procedures and guidelines or restrictions on hedging the current position. Identified risks in this area are: 1) interest rate risk; 2) product risk; 3) investor/counterparty performance risk; 4) fallout risk; and 5) delivery risk. Interest rate risk is the risk arising from timing differences which occur from the point of application to the point of sale to an investor. Product risk is the risk that there is no market for that particular type of loan. Investor/counterparty risk can be reduced by establishing dealer limits to limit the maximum amount of trades outstanding with each firm and monitoring the financial capacity of the brokers and dealers. The company should also ensure that when a loan is sold to an investor the payments for each loan are received in a timely manner. If loans are sold with recourse, management reports should identify and track potential recourse obligations. Fallout risk is the risk the borrower may not qualify for the loan, may walk away from the loan or a contingent event occurs preventing the mortgage loan from closing. Delivery risk is the risk that the commitment to deliver by the mortgage company is unable to be met.

Mortgage pricing decisions are critical because price is the major determinant in the volume of mortgages originated. A neutral price structure sets mortgage prices that are equivalent to the expected price for which the mortgages will be sold to investors, plus a normal servicing spread of 25 to 50 basis points. Daily adjustments are usually made to prices to reflect market changes for future settlement of mortgage-backed securities (MBS). Due to regional or local competition, mortgage banking companies often find it necessary to deviate from a purely neutral pricing strategy to maintain volume in certain markets. However, large deviations from market price in either a lower, or even upward, direction can have adverse consequences. Price cutting could place operational strains on the production and servicing areas. Premium pricing can position the company as a lender of last resort with adverse credit quality implications. The marketing department attempts to minimize price risk by matching origination pricing with the price they expect to receive from investors.

Risk exists that the proportion of loans in the rate-committed pipeline that are expected to close will change with a given change in interest rates. Conservative management, who do not want to take a great deal of interest rate risk, may obtain a forward commitment once they have a certain percentage of the pool/security complete. Speculative management may utilize numerous hedging tools and assume a greater degree of interest rate risk. Mortgage companies use hedging strategies to protect the inventory of closed loans and the rate-committed pipeline against adverse interest rate movements. In order to control exposure to rate movements, management must estimate the percentage of the rate-committed pipeline that is expected to close in the current economic environment. Other products used to hedge inventory loans and the rate-committed pipeline include loans with an adjustable rate feature or other specialized characteristics.

LOAN SERVICING/ADMINISTRATION

In the loan administration or servicing function, the mortgage company is acting as an agent for the investors whose loans are being serviced. While the quality of the serviced assets is not a primary concern of the examiner, the quality of the operations and its impact on the company's earnings are matters of concern. A poor quality portfolio may be very costly to service; therefore, management should recognize the importance of a proper due diligence review prior to purchasing servicing rights. The examiner should be alert to servicing costs that exceed income. The examiner should also review the amortization of mortgage servicing rights to determine whether the amortization period exceeds the average life of the serviced mortgage loan portfolio. Servicing rights, when properly managed, provide a stable source of earnings. Long-term profitability is achieved through efficient processing, cost containment and the attainment of economies of scale.

Mortgage banking companies that originate and sell residential real estate loans in the secondary market often retain the right to service those loans for the investor for a fee. Each investors' servicing funds should be maintained in separate accounts. The servicer's specific responsibilities with regard to each investor are specified in a formal written servicing agreement. The servicer collects the monthly payments from mortgagors, collects and maintains escrow accounts, pays the mortgagors' real estate taxes and insurance premiums, and remits principal and interest payments to the ultimate investors. The servicer also maintains records for the mortgagor, collects late payments on delinquent accounts, inspects property, initiates and conducts foreclosures, and submits regular reports to investors. Additionally, most servicing departments are responsible for customer complaints, retaining complaint logs, channelling complaints and ensuring proper follow-up. Investor reporting and customer complaint records must be complete and accurate.

Servicing agreements establish minimum conditions for the servicer such as its fiduciary responsibilities, audit requirements and fees. Real and contingent liabilities arise out of the contract. Most investors, including the federally-sponsored agencies, hold servicers responsible for full compliance with investor requirements. Investors may require a loan to be purchased or request reimbursement for losses that occur as a result of servicing errors, omissions or improper documentation. The agreements should be reviewed to determine that no additional liabilities, real or contingent, are imposed upon the company beyond its responsibilities as a servicing agent.

Mortgage servicing revenues are derived from five sources. The primary source is the servicing fee. Because this fee is usually expressed as a fixed percentage of the outstanding mortgage loan principal balance, servicing fee revenues decline over time as the loan balance amortizes. The second source of servicing income arises from the interest that can be earned by the servicer from the escrow balance that the borrower often maintains with the servicer. The third source of revenue is the float earned on the monthly loan payment. The opportunity for float arises because of the delay permitted between the time the servicer receives the payment and the time the payment must be remitted to the investor. Ancillary income, such as a late fee charged to the borrower if the monthly payment is not made on time, is another source of revenue. Finally, the servicer might generate fee income by selling mailing lists to third parties.

Many companies have established aggressive growth targets for their servicing portfolios. The usual source of growth in the servicing portfolio is the company's own origination activity. However, it is not uncommon for a company to supplement this growth with bulk or individual purchases of loans or purchased servicing rights from other companies. Portfolio size is reduced through normal runoff, prepayments, and sales of either loans or servicing rights only.

Subservicers can be used to perform the tax services, insurance, etc. The mortgage company continues to be responsible for these activities and errors that may occur. The company's method of evaluating and monitoring the financial condition of its subservicers should also be reviewed. Subservicing agreements should be evaluated in terms of the subservicer's responsibilities, reporting requirements, performance, and fees.

CAPITALIZED SERVICING ASSETS

The right to service mortgages are generally acquired in four ways: (1) the origination of mortgages by the mortgage company that are kept in the portfolio which is called portfolio servicing; (2) the origination of mortgages that are sold with servicing retained which is called retained servicing or originated mortgage servicing rights (OMSR); (3) the purchase of servicing rights from third parties called purchased mortgage servicing rights (PMSR); or (4) as a by-product in a purchase of mortgages and their servicing (servicing released purchase) where a definitive plan for the sale of the mortgages with the servicing rights retained exists at the time the mortgages are acquired, also called purchased mortgage servicing rights (PMSR).

Capitalized servicing assets consist of purchased mortgage servicing rights (PMSR) and excess servicing fee receivables (ESFR). PMSRs are acquired assets which represent the right to service loans owned by investors in exchange for a share of the future cash flows generated by the underlying loans. The purchase price represents the buyer's estimate of the present value of the future servicing fees net of servicing costs. The right to service mortgage loans for investors is an intangible asset which may be acquired separately, in a purchase of mortgage loans, or in a business combination. Statement of Financial Accounting Standards SFAS No. 65, "Accounting for Certain Mortgage Banking Activities, is the relevant accounting guidance for mortgage banking activities. Under SFAS 65, a mortgage banking company shall capitalize the cost of acquiring the right to service a loan as a separate asset if: 1) the loan qualifies as a purchase transaction, and 2) a definitive plan for the sale of that loan exists when the loan is acquired. A definitive plan for sale exists if: a) the mortgage banking company has either obtained, prior to purchase, commitments from permanent investors to purchase the mortgage loans or related mortgage-backed securities, or obtains such a commitment within a reasonable period (i.e. 30 days), and b) the plan includes estimates of the purchase price and selling price.

The initial amount capitalized cannot exceed the lesser of 1) the purchase price of the loan, including any transfer fees paid, in excess of the market value of the loans without servicing rights at the purchase date or 2) the present value of net future servicing income discounted at an appropriate long-term interest rate. Management should be able to substantiate the rate used. The capitalized amount shall be amortized in proportion to, and over the period of, estimated net servicing income.

PMSRs are highly subject to interest rate and prepayment rate risk since the amount of future cash flows is dependent upon the outstanding balances of the underlying mortgage loans. Unanticipated changes in interest rate, prepayment speed, or other valuation assumptions may impair the carrying value of PMSRs and require accelerated amortization or a write-down. The recoverability of the unamortized balance should be evaluated periodically, and amortization and/or the value of the asset should be adjusted accordingly. To the extent impairment is not recognized, PMSR values may be inflated. As a result, assets, earnings, and capital may be overstated. Regulatory guidance requires that PMSR values be evaluated at least quarterly. Evaluation models may be developed in-house or purchased from an outside vendor.

Excess servicing fee receivables are recorded when the mortgage company's fee for servicing mortgages sold exceeds the normal servicing fee for a comparable pool of mortgages. The asset to be recorded represents the present value of the expected future excess fee income. The company should first estimate the amount of excess cash flows that it expects to receive from servicing the loans. The estimated cash flow stream must consider expected prepayments of the underlying mortgages. Next the estimated cash flow stream should be discounted to determine its present value. The discount rate should be an appropriate long-term interest rate that reflects the risks of the assets. Once the amount of the excess servicing fee receivable is determined, it is recorded as an asset. ESFR should be reevaluated at least quarterly to determine the impact of unanticipated prepayments of the underlying cash flows. According to EITF 86-38, the ESFR must be written down to the present value of the estimated remaining future excess service fee revenues. The discount rate used to compute the present value of the estimate future servicing fee income should be the same rate as that used to initially record the asset. Unlike PMSRs, which require that an actual service be performed, ESFRs merely represent the purchase of the right to receive the underlying cash flows. ESFRs are considered tangible assets.

OMSRs represent the future net servicing income which is associated with loans that are originated through a mortgage banking company's own production network. Currently OMSR are not recognized on the balance sheet as an asset distinct from the mortgage. SFAS No. 65 also prohibits the recognition of a mortgage servicing asset representing the normal servicing fee when a mortgage company originates a mortgage loan and then sells it to a third party with the servicing rights retained by the seller; only the excess servicing fee, if any, may be recorded as an asset.

In a press release dated June 21, 1995, an FFIEC Task Force announced recommendations regarding the appropriate regulatory reporting treatment for mortgage servicing rights (MSRs) by banks. The need for this guidance is a result of FASB's issuance of Statement No. 122 "Accounting for Mortgage Servicing Rights," in May 1995. The FFIEC recommended Federal regulators adopt interim capital rules to clarify the regulatory capital treatment for MSRs. Prior to the adoption of Statement No. 122, only PMSRs but not OMSRs could be capitalized as balance sheet assets. Once an institution adopts Statement No. 122, it generally must capitalize OMSRs on a prospective basis. In addition, Statement No. 122 requires all capitalized MSRs (both originated and purchased) to be evaluated for impairment based on their fair values.

For purposes of the bank Reports of Condition and Income, all insured banks must adopt Statement No. 122 for fiscal years beginning after December 15, 1995. For institutions with a calendar year fiscal year that do not elect early option, the March 31, 1996, Call Report will be the first report to be completed in accordance with Statement No. 122. As an interim measure, banks should continue to report PMSRs in Call Report Schedule RC-M, item 6.a, "Mortgage Servicing Rights, " and on the balance sheet in Schedule RC, item 10, "Intangible Assets." OMSRs that are capitalized as balance sheet assets in accordance with Statement No. 122 should be reported in these same Call Report items. The FFIEC's Task Force also recommends that the agencies issue interim capital rules that would apply the same regulatory capital provisions to OMSRs that presently apply to PMSRs. Under the recommended interim approach, capitalized MSRs (both purchased and originated) would be subject to a quarterly valuation requirement and a restriction limiting the amount of MSRs that may be recognized for Tier 1 capital purposes to the lesser of 90 percent of fair value or 100 percent of book value (net of any valuation allowance). In addition, the aggregate amount of PMSRs, OMSRs, and purchased credit card relationship intangibles that may be recognized for regulatory capital purposes would be limited to no more than 50 percent of Tier 1 (core) capital. The quarterly valuations of the fair value of OMSRs would be based on the same regulatory guidance the agencies have issued with respect to determining the fair value of PMSRs.

FINANCIAL ANALYSIS

The analysis of the financial condition of a mortgage company should incorporate a review of primary balance sheet and income statement levels and trends, contingent off-balance sheet liabilities such as the servicing portfolio, asset quality, earnings performance, funding sources and liquidity needs, and capital adequacy. Financial statements should be reviewed to detect assets, liabilities, income or expense items which are either large relative to the company's operations or may post undue financial risk for other reasons. Any unusual trends, which appear inconsistent with the mortgage banking company's normal operation, the current economic and interest rate environment, and the company's growth plans, should be investigated.

The asset side of the balance sheet will consist of items such as cash; marketable securities; mortgage loans available-for-sale; purchased mortgage servicing rights; excess servicing fee receivables; mortgage loans held-to-maturity; reserves for loan and other credit-related losses; other real estate; premises and equipment; and other miscellaneous assets. The examiner should determine whether the accounting treatment for securities and loans is consistent with SFAS No. 115, "Accounting for Certain Investments in Debt and Equity Securities." Under SFAS No. 115, any debt or equity security that has a readily determinable fair value should be classified as either trading, available-for-sale, or held-to-maturity. Loans held for investment may include loans that: 1) do not meet secondary market guidelines and are therefore unsalable; 2) loans that were repurchased from an investor due to poor documentation and/or improper servicing; and 3) loans put back to the mortgage company under recourse agreements.

The liability side of the balance sheet may include: repurchase agreements, commercial paper, revolving warehouse lines of credit, long-term debt instruments, intercompany payables, and equity capital.

Asset quality is evidenced by underwriting standards, borrower performance, and the degree of protection which is afforded by collateral. Credit risk is reduced for an originator when insurance and guarantees are provided by federally-sponsored agencies. However, the originator remains responsible for the quality of loans sold to investors for at least the first 90 days, and any loans sold under recourse arrangements. As a servicer, the company can also be held liable if it does not initiate collection and foreclosure actions in strict accordance with investor servicing agreements. In addition, certain interest losses and expenses relating to collections, foreclosure, and ORE are not fully reimbursable and should be anticipated.

The primary indicators of portfolio problems are: declines in the turnover rate of the "resale" account (the industry turnover has generally averaged about four times a year but does vary with market conditions); consistent losses in the sales of the mortgages; increases in the "investment" category; and write-downs of the value of the "investment" account. It is a general industry practice to price the "resale" inventory at the lower of cost or market each reporting quarter for balance sheet purposes. One of the principal measures of portfolio quality is the delinquency rate. Delinquencies in the report should be presented by portfolio category and spread by the periods past due, such as 15-30 days, 31-90 days, 91-180 days, and 181 days and over. The delinquency status of loans available-for-sale, loans-held-to maturity, and loans serviced for investors should be monitored. Management information systems should also include an internal loan grading system which is consistent with guidelines used by the bank, the parent company, and regulatory agencies. Information to be tracked includes the borrower's ability to meet its payment obligations, collection and foreclosure actions initiated by the servicer, and repurchase requests initiated by a permanent investor or other third party. Appraisal practices should be verified to ensure consistency with state and federal laws and regulations. Mortgage banking companies that are subsidiaries of either state-member banks, state non-member banks, or bank holding companies are subject to the same appraisal standards and requirements as their parent companies. Management should establish and maintain adequate reserves to cover all identified loss exposure. Policies and procedures should clearly state the purpose of each reserve. The level of each reserve account should be evaluated at least quarterly, documented, and replenished as necessary.

Earnings performance should be assessed in terms of the level, composition and trend of net income. The earnings analysis should take into consideration internal factors such as the company business orientation and management's growth plans. The examiner should consider the company's ability to generate positive earnings consistently over time, and the proportionate share of consolidated earnings (or losses) which are a result of this business activity.

Management's ability to satisfy the company's liquidity needs and plan for contingencies without placing undue strain on affiliate bank resources or reliance on the parent bank holding company are crucial. Liquidity needs depend upon the size of the mortgage company's warehouse and the nature and extent of other longer-term assets. Liquidity can quickly erode if investor perceptions of a company's credit standing change. The ability to fund mortgage operations under economic duress and access to alternate liquidity sources become key considerations. Funding instruments may include repurchase agreements, commercial paper, revolving warehouse lines of credit and/or long-term debt. Financial flexibility, which is the ability to obtain the cash required to make payments as needed, should also be evaluated. Cash should be able to be obtained from 1) business operations; 2) liquid assets already held by the company; and 3) deriving funds from external sources via lines of credit, bank borrowing or the money and capital markets through the issuance of debt or equity securities.

Capital must be adequate to absorb potential operating losses, provide for liquidity needs and expected growth, and meet minimum requirements set by third party creditors and investors. At a minimum, a mortgage banking company must meet the nominal capital levels required by investors such as FNMA ($250,000). Companies that have excessive off-balance sheet risk or high growth expectations may require additional capital. Capital levels should be monitored and reported to the company's board of directors regularly to mitigate the risk of inadequate or eroding capital. The examiner should evaluate capital adequacy, the amount of dividends which are upstreamed to the bank or parent company, and the extent to which the parent company can be relied upon to augment the ongoing capital needs of its bank and nonbank subsidiaries. In some instances, the bank or parent company may operate on the premise that the mortgage banking company requires little capital of its own as long as the bank or parent company remains adequately capitalized. The bank or parent company must be prepared to support its subsidiaries should the financial need arise. There are no state/federal guidelines requiring specific capital levels for a mortgage banking company.

OVERVIEW

Critical material can be reviewed at the bank or parent company level to help determine whether or not to go on-site. Some of the determinants of this decision should include: relative size; current earnings performance; overall contribution to the corporation's condition; asset quality as indicated by nonaccrual and delinquency reports; and the condition of the company at a prior examination. From the information provided, it might be determined that the company is operating properly and is in sound condition. Conversely, a deteriorating condition might be detected which would require a more in depth review. Mortgage subsidiaries in unsatisfactory condition should be inspected each time the bank or parent company is inspected. All significant mortgage banking subsidiaries should be fully inspected at least once every three years

POLICY REQUIREMENTS

00-1 - Strategic Planning

Management should develop a strategic plan for the mortgage company or incorporate a long-term business plan for mortgage banking activities into the bank's and/or bank holding company's strategic plan. Characteristics of long-term business plan include:

* Identifying strengths and weaknesses

* Growth targets

* Other strategic initiatives over a one-to-three year time horizon

Goals and objectives should be specific, measurable, understandable, and communicated throughout the organization. To help achieve the goals established, progress must be monitored. The board should review and approve the plan annually.

Mortgage Banking Policy

A well written mortgage banking policy will, at a minimum, address the following:

A. the mortgage banking activities the bank or mortgage company will be involved, including loan production, pipeline and warehouse administration, secondary market transactions, servicing operations, and management of mortgage servicing rights (MSR) and excess servicing fees receivable (ESFR);

B. documentation standards for all aspects of mortgage banking activities, including substantiating the initial book values of MSR and ESFR assigned to each pool of loans, as well as the results of periodic reviews of each asset's book and fair-market value;

C. systems that track and collect required loan documents;

D. impairment analyses, including using the discount rate applied when each MSR and ESFR asset was originally booked and employing realistic prepayment estimates

E. quality control reviews;

F. interest rate risk and liquidity levels;

G. guidelines for due diligence reviews, definitions of loan products to purchase, amount of loans desired, and authority for purchase/commitment letter;

H. guidelines for amount of loans that can be retained in the pipeline, levels of uncommitted inventory, number and dollar amount of pools in process, and approval authority;

I. board review of mortgage banking activity reports including default rates, new loans, liquidity levels, capital needs, past dues, geographic concentrations, departmental profit and loss statements, and foreclosure rates.

SUGGESTED MORTGAGE COMPANY REVIEW AREAS

MANAGEMENT AND BOARD SUPERVISION

1. Review minutes from board and committee meetings to determine whether directors are fulfilling their fiduciary and supervisory responsibilities. Determine if management is providing sufficient information to the board.

2. Determine if any officer is paid based on volume/commissions.

3. Determine if the mortgage company's goals and objectives are incorporated into a

long-term business plan. Determine whether objectives, goals, and growth targets

are reasonable.

4. Evaluate the mortgage banking operations policy manual. Ensure that the policy

addresses such items as: mortgage company's objectives, scope of operations,

description of the lines of approval for transactions, and reporting requirements.

5. Determine the frequency and scope of internal and external audits. Determine if

the audit program adequately addresses: loan origination, mortgage servicing,

secondary mortgage marketing, internal controls, and management information

systems.

6. Review audit reports and management responses to reports prepared by internal

and external auditors, FNMA, GNMA, and HUD.

7. Determine if auditor's exceptions are brought to the attention of the bank's or bank holding company's board and the mortgage company's board.

8. Review the Quality Control plan to determine reasonableness and ensure

compliance with investor requirements.

9. Determine whether Quality Control results are relayed to executive management,

and whether follow-up procedures are adequate to ensure corrective action

10. Review board minutes to ascertain the date the board last reviewed and approved

the insurance program.

11. Review all current and pending litigation of a material nature and determine

whether adequate reserves are maintained to cover anticipated financial exposure.

12. Evaluate staffing requirements and knowledge and skills of executive officers.

13. Evaluate adequacy of management information systems (internal and external).

00-1 - LOAN ORIGINATION

1. Determine the types of mortgage products offered and the company's target

markets. Evaluate portfolio trends for over reliance on one product type and

undue concentrations in one geographic area.

2. Determine whether the level of nonconforming or unsalable loans originated

present undue risk and whether the quality and delinquency trends for such loans

are adequately monitored.

3. Ensure that all mortgage production offices conform to uniform policies for

underwriting, pricing, and product type.

4. Determine if limits are set for uncommitted inventory for the mortgage operation.

Ascertain if a funding limit is set for the loan origination. How is it monitored for

liquidity?

5. Evaluate procedures, checklists and systems for closing loans. Are all required

documents obtained from the borrower before funds are disbursed? If not,

evaluate appropriateness of suspense items.

6. Review Quality Control reports to determine if underwriting concerns are

identified.

7. Determine if the bank monitors fall-out risk for borrower withdrawals and

underwriting concerns.

8. Determine who makes the decision for loans to be warehoused. Is there a dollar

limit for loans committed to be resold in pools or for loans held in uncommitted

inventory? Is there a limit on the length of time it can be carried in inventory?

00-1 - LOAN PRODUCTION

1. Determine if the mortgage operations purchase loans on a wholesale basis. Are

purchases primarily new origination, seasoned loans or both?

2. Determine how the mortgage company is informed that loans are for sale.

3. Determine if there are policies and procedures for Due Diligence Reviews. Do

contracts specify scope, sampling, loan products, compensation, etc.?

4. Does the loan policy limit purchases by loan type? geographic area? product

features (ie ARMs)?

00-1 - SECONDARY MARKETING

1. Review minutes from recent committee meetings to determine the nature and

scope of responsibilities, the frequency of meetings, and the degree to which

oversight over marketing activities is provided.

2. Determine whether loans or securities are sold with recourse. If so, are recourse

obligations monitored? Are recourse losses analyzed by investor and product

type? Are reserves held for recourse loans? Are reserves adequate?

3. Are all mortgage products originated by the mortgage company intended to be

salable in the secondary market? How is actual salability monitored?

4. Are mortgage loans that are not salable generated specifically for the permanent

investment portfolio of either the mortgage banking company or its bank affiliates.

Related intercompany purchase and sale agreements should be reviewed for

compliance with Sections 23A and 23 B of the Federal Reserve Act.

5. What methods do management use to predict the volume of applications that are

expected to "fall out" of the mortgage pipeline. Is methodology well

documented?

6. Determine if any hedging products are used to hedge interest rate risk associated

with inventory loans and rate-locked loan applications in the pipeline? Review

the marketing policy to determine hedging products and strategies.

7. Review information provided to executive management and the board to

determine whether hedging practices are adequately supervised.

8. Review list of approved brokers and dealers. Have appropriate dealer limits been

established and limits adhered to? Are exceptions monitored?

9. Does management monitor the financial capacity of brokers and dealers?

00-1 - LOAN SERVICING AND ADMINISTRATION

1. Determine if a periodic review of services provided by each subservicer is

conducted. The financial condition of each subservicer should be evaluated at

least annually.

2. Has a contingent operating plan been established should subservicers and vendors

be unable to perform their contractual obligations?

3. Are periodic quality control reviews performed on the subservicer? If not, does

the subservicer have their own quality control review?

4. Does a disaster recovery plan exist to cover all servicing functions performed in

house? Verify that backup systems exist should primary systems fail.

5. Review the list of investors for which servicing is performed. Discuss the nature

of any recourse or repurchase provisions and nonreimbursable collection and/or

foreclosure expenses.

6. Determine if an annual analysis of escrow accounts is performed. How are

underages and overages handled?

7. Review procedures for collecting late payments. At what point do collection

efforts start once an account becomes delinquent? (i.e. 20 day requirements for

some investors)

8. Review loan delinquency reports by product type and originator.

9. Determine the number and volume of delinquent loans that were purchased from

the servicing portfolio (buyouts and buybacks). Assess the impact of repurchases

on profitability.

10. Review the system for logging, tracking, and responding to customer complaints.

Has the volume of complaints grown? Are complaints addressed promptly, with

any problems resolved in a timely manner? Review mortgage complaint log and

files and determine if complaints are concentrated in one area.

00-1 - FINANCIAL ANALYSIS

1. Review the mortgage company's financial statements over the previous three year period.

Discuss significant balance sheet and income statement categories with management.

2. Are financial trends consistent with the economic environment, interest rate

movements, and management's intended growth strategy?

3. Obtain a copy of the loans past due 30, 60, and 90 days by loan type.

4. Obtain a list of loans in the process of foreclosure and bankruptcy. Review with

management.

5. Reconcile all other real estate owned by the mortgage banking company to the

general ledger. Compare current appraisals to carrying value for potential

write-downs.

6. Review the reserve account for accuracy and adequacy.

7. Determine the mortgage banking company's liquidity needs based upon a review

of the size of its warehouse and the nature and extent of other longer-term assets.

8. Are sources of liquidity adequate under current conditions and economic duress?

9. Does the company have the ability to obtain the cash required to make payments

as needed? Easy access to lines of credit?

10. Review asset/liability management practices to determine whether funding

maturities closely approximate the maturities of underlying assets or whether a

funding mismatch exists.

11. Are capital levels adequate to absorb potential operating losses, provide for

liquidity needs and expected growth, and meet minimum requirements set by

investors whose loans are serviced and other external parties?

12. Does management adequately monitor and report capital levels to the board of

directors?

13. Is the parent company prepared to support its subsidiaries should the financial

need arise? Are cash dividends paid by the mortgage subsidiary to the parent

company reasonable?

14. Evaluate the overall financial condition of the mortgage company, considering its

asset quality, earnings, liquidity, and capital adequacy.

APPENDIX A: ACCOUNTING LITERATURE

Banks must conform to Regulatory Accounting Principles. Bank holding companies and their direct subsidiaries must conform to Generally Accepted Accounting Principles (GAAP). The following is a list of GAAP governing the mortgage banking industry which are in the form of accounting standards and interpretations.

FASB Statement No. 122, "Accounting for Mortgage Servicing Rights."

SFAS No. 65, "Accounting for Certain Mortgage Banking Activities."

SFAS No. 80, "Accounting for Futures Transactions."

SFAS No. 91, "Accounting for Nonrefundable Fees and Costs Associated with Originating or Acquiring Loans and Initial Direct Costs of Leases."

SFAS No. 115, "Accounting for Certain Investments in Debt and Equity Securities."

Emerging Issues Task Force (EITF) Issue No. 85-13, "Sale of Mortgage Service Rights on Mortgages Owned by Others."

EITF Issue No. 86-38, "Implications of Mortgage Prepayments on Amortization of Servicing Rights."

EITF Issue No. 86-39, "Gains from the sale of Mortgage Loans with Servicing Rights Retained."

EITF Issue No. 88-11, "Allocation of Recorded Investment When a Loan or Part of a Loan is Sold."

EITF Issue No. 89-5, "Sale of Mortgage Loan Servicing Rights."

EITF Issue No. 92-10, "Loan Acquisitions Involving Table Funding Arrangements."

Technical Bulletin No. 87-3, "Accounting for Mortgage Servicing Fees and Rights."

APPENDIX B: REGULATORY GUIDANCE

State and Federal issuances which may be useful in reviewing mortgage banking activities:

23-32-701 A.C.A. - Powers of Banks

FDIC Transactions Between Member State Banks and Their Affiliates

FFIEC Mortgage Servicing Rights

2010.0.1 Policy Statement on the Responsibility of Bank Holding Companies to Act as Sources of Strength to Their Subsidiary Banks

2020.0 - .7 Intercompany Transactions

2050.0 Extensions of Credit to BHC Officials

2060.0 - .6 Management Information Systems

2065.2 Determining an Adequate Level for the Allowance for Loan and Lease Losses

2080.0 - .3 BHC Funding Practices

2130.0 Futures, Forward, and Option Contracts

2150.0 Repurchase Transactions

2190.0 Asset Securitization

2190.0.5 "Interagency Supervisory Policy Statement on Securities Activities"

3070.0 Section 4 (c) (8) - Mortgage Banking

3080.0 Section 4 (c) (8) - Servicing Loans

4000 Financial Analysis

4070 BHC Rating System

95-2 – Retail Sales of Non Deposit Investment Products

I. Introduction

The sale of nondeposit investment products, which is defined for this policy to include equity securities, bonds, mutual funds, and annuities, by Arkansas state chartered banks, has increased over the last few years. To provide guidance for this type of activity, this examination policy has been issued in conjunction with the Interagency State issued February 15, 1994 by the four Federal banking regulatory agencies. A bank's compliance with these policies should be evaluated as a part of the examination process.

Although the Interagency Statement does not generally apply to sales of nondeposit investment products to nonretail customers, such as sales to fiduciary accounts administered by an institution, examiners should apply the recommended examination procedures when retail customers are directed to the institution's trust department where they may purchase nondeposit investment products by simply completing a customer agreement.

II. Authority to Sell NonDeposit Investment Products

A Resolution addressing the sale of securities for bank customers and other are issued by the State Banking Board as of March 8, 1983.

All Arkansas banks were authorized to sell fixed or variable annuities through Act 592 of 1995 which amended A.C.A. Section 23-64-203. This act allowed all banks to be licensed to sell credit life insurance as well as fixed or variable rate annuities.

Individuals that sell nondeposit investment products must be registered with the National Association of Securities Dealers (NASD) and the Arkansas Securities Department. The chart below lists the require examination series an individual must pass before he/she is qualified to sell a particular type of security or nondeposit investment product in Arkansas:

PRODUCT REQUIREMENTS TO SELL

Mutual Funds Series 6 to 7, AND Series 63

Fixed Rate Annuities Fixed annuity license issued by

Arkansas Insurance Department

Variable Rate Annuities Series 6 or 7, AND Series 63

PRODUCT REQUIREMENTS TO SELL

Equity Securities Series 7 or 62, AND Series 63

Government Securities Series 52 or 7, AND Series 63

Municipal Securities Series 52 or 7, AND Series 63

III. Marketing of NonDeposit Investment Products

This examination policy applies to nondeposit investment products marketed through three different methods. The first marketing method is directly through the bank's employees. The second marketing method utilizes employees of a third party, which may or may not be affiliated with the bank and which sell the nondeposit investment products on the bank's premises (including sales or recommendations initiated by telephone or by mail from the bank premises). The third method involves sales of nondeposit investment products resulting from a referral of retail customers by the institution to a third party when the depository institution receives a benefit for the referral.

A majority of all nondeposit investment products are sold by agents of third parties. The bank is able to offer nondeposit investment products to its customers without committing a large part of its personnel to the selling of these products or the time consuming servicing of customer accounts. Third parties include bona fide subsidiaries¹ of the bank, bank affiliated broker/dealers of the bank's holding company, or unaffiliated broker/dealers. Other entities such as insurance companies may be used by banks to sell annuities and other nondeposit investment products.

IV. Risks Associated with the Sale of Non-Deposit Investment Products

With the possible reward of higher fee income comes the added risks associated with the marketing of any product. Three main risks are of supervisory concern. These include litigation risks, compliance risks, and performance risks. All three risks should be assessed by management and the examiner to determine if the risk of selling nondeposit investment products outweighs the rewards of the offered service.

Litigation risks are usually created when a bank does not properly disclose to its customers that its nondeposit investment products:

are not incurred by the FDIC;

are not deposits or other obligations of the institution and are not guaranteed by the institution; and,

are subject to investment risks, including possible loss of the principal invested.

Other litigation risks can be caused by unethical sales techniques such as churning and switching of accounts. The National Association of Securities Dealers (NASD) Rules of Fair Practice expressly governs the sale so securities by broker/dealers and their agents.

Compliance risks are created by noncompliance with all applicable laws of the Securities and Exchange Commission (SEC), NASD, and the Arkansas Securities Department, the Arkansas Insurance Department, and the bank's state and federal regulators. Noncompliance with these agencies could result in enforcement actions, fines , and suspension of the sale of nondeposit investment products by the bank. Banks choosing to sell nondeposit investment products must have a compliance monitoring system to ensure compliance with all applicable laws.

¹Compliance with 12 CFR 337.4 is required for state nonmember banks conducting securities activities through affiliates or subsidiaries.
Performance risks are created when customers become dissatisfied with the performance of their investments. These unhappy customers may withdraw deposits they had with the bank and establish banking relationships with competing institutions. Other performance risks arise when the expense associated with the sale of nondeposit investment products exceeds the income the products generate. Additionally, the sale of non-deposit investment products exposes the bank to additional embezzlement schemes and improprieties. Auditing procedures of a bank choosing to sell nondeposit investment products must be able to identify these additional risks.

V. Examination Procedures of Banks Selling Non-Deposit Investment products

1. Determine the bank's marketing method of Nondeposit Investment Products. For affiliated organizations selling nondeposit investment products, check the Officer's Questionnaire. The Arkansas State Bank Department is granted authority to examine affiliates of any state chartered bank through A.C.A. Section 23-32-1104. Direct inquiries to management may be needed if the bank uses its own employees or a subsidiary, uses an unaffiliated vendor on it premises, or refers its customers to a third party vendor and receives a referral fee. Refer to Retail Sale of Nondeposit Investment Products Examination Procedures Work Papers for additional information.

2. Check with the Department to determine that the broker/dealer firm the subject bank is using has not has "past disciplinary actions" issued by the NASD or the Arkansas Securities Department. The NASD/Arkansas Securities Department has regulatory/examination authority for all broker/dealers and their agents operating in Arkansas. The NASD has agreed to cooperate with the four federal banking agencies in the supervision of banks which sell nondeposit investment products.

3. Complete the Retail Sale of Nondeposit Investment Products Examination Procedures Work Papers. Keep in examination workpapers for future reference.

4. Assess the following factors to be included in the Management comment of the Report of Examination: technical competence regarding nondeposit investment products; compliance with all governing regulations; compliance with internal policies; compliance with the Federal Regulator's Interagency Statement; and contingency risks associated with the sale of nondeposit investment products.

ARKANSAS STATE BANK DEPARTMENT

RETAIL SALE OF NONDEPOSIT INVESTMENT PRODUCTS

EXAMINATION PROCEDURES--WORK PAPERS

Bank Name: Charter number:

Date: Examiner Assigned:

State chartered banks are permitted to engage in sales of nondeposit investment products, provided the Board of Directors has ensured the bank has adequate expertise on hand, and appropriate policies and procedures in place to conduct these activities in a safe and sound manner. If management permits the sale of nondeposit investment products without addressing the aforementioned issues, the bank may be subjected to substantial risks including potential liability to provide restitution to improperly advised customers and possible loss of customer confidence through association with high-risk products.

If the examination procedure does not apply, mark as N.A.

REGISTRATION REQUIREMENTS

Review extent and nature of activity to determine whether the nondeposit

Investment activity is conducted through a subsidiary of the bank, an affiliate of the

bank, or an unaffiliated third party. Under Arkansas Law, banks are directly

exempt from registration requirements as broker/dealers with the Arkansas

Securities Department. Accordingly, if the bank has chosen to directly sell

nondeposit investment products, it can do so through a wholly owned

subsidiary, or an affiliate company owned by the bank's holding company. Any

employees of a wholly-owned bank subsidiary or affiliate organization selling

nondeposit investment products must be registered with the NASD and the

Arkansas Securities Department. Most state chartered banks provide nondeposit

investment products services by referring customers to unaffiliated third parties;

therefore, no registration is needed for the bank's employees making the referrals.

Examiners should refer irregular noncomplying, or questionable activity to the EIC,

who will coordinate inquiries with the Bank Department, and/or Arkansas

Securities Department.

If the activity is conducted through a third party provider selling at the bank's

offices, determine whether the third party provider is registered with the Arkansas

Securities Department.

List the in state officer or partner acting as supervisor of the broker/dealer firm which conducts the customers' nondeposit investment trades. Name/Title

If the activity is conducted by an employee of the bank's subsidiary or an affiliate

of the bank, verify the employee's registration with the Arkansas Securities Department.

If nondeposit investment products are sold in any of the bank's branches, check

for proper licensing of the agents selling the products.

DISCLOSURE AND SUITABILITY

Determine whether adequate verbal and written disclosures are made regarding

the risk of the product.

Review all marketing material, including sample oral sales dialogues, brochures,

lobby displays, and advertising (newspaper, radio, television) copy to determine

that the following are conspicuously disclosed:

Not insured by the FDIC.

Not an obligation of the bank.

Not guaranteed by the bank.

Investment risk, including the possible loss of principal.

Determine whether sales information adequately discloses the associated costs:

Is the product subject to any early withdrawal penalties, surrender charge

penalties, or deferred sales charges?

is the effect of commissions and fees on yields disclosed in a complete

and understandable manner?

Determine whether the product is adequately distinguished from bank products.

If the bank as joint advertising with the nondeposit investment products

seller, does the advertising clearly segregate information?

Do account statements sent to nondeposit investment purchasers

reference the bank in any way?

Do nondeposit products have names that are different and not easily

confused with deposit products?

Determine whether sales activity is adequately segregated from deposit-taking

and other banking functions:

If the product is sold by a bank employee, determine whether the

employee moves to a separate location within he bank to make the

transaction.

determine that no uninsured products are sold from the same desk,

window, or lobby area where insured deposits are transacted. If the

bank's premises are limited, determine that extra emphasis is made in

disclosing the products uninsured status.

Determine the employees who accept retail deposits (tellers) are

prohibited from giving investment advice and from selling retail

nondeposit investment products.

Determine whether bank employees with customer contact have signed

an acknowledgment limiting their sales activity to bank products, if

applicable.

Determine that any dual employee (if applicable) adequately disclose that

they work for both the bank and the broker/dealer.

Determine whether the bank provides any information on its customers (i.e.

maturing CDs) to third party or dual broker/dealers, without the prior written

consent of the customer.

Review the prospectus of products offered for sale to determine whether any

apparently high-risk products are offered. For example, long-term bond funds

or funds composed of nonrated investments generally carry higher risk than

short-term Government or rated municipal funds.

Review the variety and diversity of products offered. Does the bank offer enough

products to provide a range for differing customer needs?

If annuities are offered, determine that the bank is registered with the Arkansas

Insurance Department and that personnel conducting the sales are registered

insurance agents.

Determine whether adequate procedures are employed to determine the

suitability of a product for a customer prior to its sale:

Do sales representatives make a reasonable inquiry into a customer's

financial condition or other investments?

Is inquiry made regarding the customer's comfort level for risk to their

investment principal?

Is inquiry made concerning the customer's investment objective, i.e.,

growth, income, tax deferral?

Review a sample of customer files to determine.

Is there adequate documentation to indicate that the customer understands

that the nondeposit investment is not insured and that the nondeposit

investment is not a bank product?

Do customers sign a disclosure document when the nondeposit account

is opened?

Is appropriate documentation maintained to reflect that the salesperson

had reasonable grounds to believe a recommended investment was

suitable for the customer at the time of the transaction? Is this

determination based on information obtained directly from the customer?

Are the files updated periodically?

MANAGEMENT AND OVERSIGHT ACTIVITY

Evaluate the adequacy of Board-approved written policies and procedures.

These should address, at a minimum:

Supervision of personnel involved in nondeposit investment products.

The roles of other entities selling on bank premises.

The types of products the bank will sell.

The manner in which customers will be informed regarding the uninsured

status of investment products.

The permissible uses of bank customer information; and

How compliance will be monitored.

Review the Board's evaluation of the products being offered in terms of risk,

suitability, etc. Ensure that evaluations are performed on a periodic basis.

Review management reports regularly going to the Boar d to determine whether

they are adequate to supervise the activity.

If the bank is affiliated with a third-party broker/dealer, determine whether the

Board undertook a complete evaluation of the third party before entering into an

agreement by:

Determining the third party's ability to fulfill commitments evidenced by

capital strength and operating results disclosed in current financial data,

annual reported, credit report, etc.;

Inquiring into the entity's general reputation for financial stability and fair

and honest dealings with customers, including an inquiry of past or current

financial institution customers of the entity;

Questioning appropriate State and Federal securities industry

self-regulatory organizations (i.e. National Association of Securities

Dealers), as to formal enforcement actions against the dealer or its

affiliates or associated personnel;

Inquiring, as appropriate, into the licensing status and background of

sales representative(s) to determine experience and expertise; and

Conducting periodic reviews of the entity once a relationship has been

established.

If the activity is conducted through a third-party broker/dealer, review the written

agreement between the bank and the provider to ensure that it:

Requires compliance with all applicable registration and regulatory

requirements;

Indicates that bank management and regulators will be verifying

compliance to applicable laws and regulation;

Includes provisions regarding bank oversight or activity;

Provides examiner access to records of broker's activities at the bank;

Details terms for compensation for bank space, equipment, and

personnel used by the third-party; and

Indemnifies the bank for any claims arising out of the securities

brokerage service.

Determine that background inquiries have been performed on sales personnel

who are bank employees with previous security industry experience. The inquiry

should check for any possible disciplinary history with securities regulators.

Review the resumes and visit the sales personnel employed by the bank to

determine whether they are qualified and adequately trained to sell all nondeposit

investment products offered by the bank. Do they have a thorough product

knowledge and understand customer protection requirements? Have they

received adequate and ongoing training?

Review the level and nature of compensation provided the employee/sales

personnel for reasonability and propriety. Compensation should not operate on

an incentive basis for salespersons if a more appropriate option is available. If

tellers participate in a referral program, banks should not base compensation on

success of sale.

Review the adequacy of audit procedures and policy in the area:

Determine whether written audit procedures and policy are established for nondeposit investment products.

Have audit and compliance personnel been properly trained and

qualified?

Does the compliance function include a system to monitor customer

complaints and periodically review customer accounts to prevent abusive practices?

Does compliance personnel review progress in addressing identified

compliance problems?

Are compliance findings periodically reported to the bank's board of

directors?

determine whether the bank has received a written acknowledgment from its

blanket bond carrier regarding direct or indirect sale of nondeposit investment

products.

EXAMINATION REPORT

If the bank is not involved in any way in retail sales of nondeposit investment

products, state as much in the confidential section of the report.

If the bank is involved in any way in retail sales of nondeposit investment products, discuss activity in the Management Comment. significant activity or weaknesses

should also be discussed in Overall Examination Conclusions. Comments should address the following at a minimum:

Nature of activity, registration

Where it is conducted

Who is involved

Whether products have any particular risk characteristics

Disclosure adequacy

Documentation of suitability

Quality of management and board oversight.

REFERENCES

The following sources of information may be used for further guidance:

Interagency Statement on retail Sales of Nondeposit Investment Products, 2-15-94

12 CFR 337.4 "securities Activities of Subsidiaries of Insured Nonmember Banks: Bank transactions with Affiliated Securities Companies"

OCC Bulletin 94-13 "Examination Procedures for Retail Nondeposit Investment sales", 2-24-94

Boar of Governors of the Federal Reserve System "Examination Procedures for Retail Sales Of Nondeposit Investment Products", 5-31-94

FDIC Transmittal 94-067 "Examination Procedures for Banks Involved with the Sale of Nondeposit Investment Products", 4-28-94

DOB Numbered Memo 88-06 "Unsuitable Investment Practices", 5-20-88

Chapter 42 of the Arkansas Code of 1987 Annotated

97-2 – Disclosure of CAMELS Component Rating

Background

The Uniform Interagency Bank Rating System (the CAMEL Rating System) was developed by the Federal Financial Institutions Examination Council (FFIEC) and has been utilized by the Arkansas State Bank Department for several years. On March 1, 1993, the Arkansas State Bank Department made a decision to advise Boards of Directors of state chartered banks of the entire CAMEL rating assigned pursuant to an examination by this agency. By disclosing all component ratings, it is felt that bank directors are more fully informed of the bank's condition, as indicated by the assigned component ratings, and therefore better equipped to address all financial and operational deficiencies.

Effective July 1, 1997 the updated rating system now referred to as the CAMELS rating system will be utilized by the Arkansas State Bank Department. This rating system is also used by federal bank regulatory agencies. Each bank's Board of Directors are advised of the assigned rating in the examination report, and the rating will not be a matter of public information. The rating disclosed in the examination report is that assigned by the Examiner in Charge and approved by supervisory personnel and the Bank Commissioner as a result of an independent examination by the Arkansas State Bank Department or as a result of a joint or concurrent examination in which the Arkansas State Bank Department participated. While the CAMELS rating assigned by the Arkansas State Bank Department may be the same as that assigned by the respective federal agency, some differences in component and composite ratings may exist. It is important to note that the overall uniform bank rating is not an arithmetic mean of the six component ratings, but the composite rating should be consistent with the individual performance ratings.

Overview of the Rating System

The rating system is based upon a careful evaluation of six critical dimensions of a bank's operations that reflect in a comprehensive fashion an institution's financial condition, managerial performance, compliance with banking regulations and statutes and overall operating soundness. The specific dimensions that are to be evaluated are the following:

Capital Adequacy

Asset Quality

Management

Earnings

Liquidity

Sensitivity To Market Risk

Each of these dimensions is to be rated on a scale of 1 thru 5 in descending order of performance quality. Thus, 1 represents the highest and 5 the lowest (and most critically deficient) level of operating performance.

Each bank is accorded a summary or composite rating that is predicated upon the evaluations of the specific performance dimensions. The composite rating is also based upon a scale of 1 thru 5 in ascending order of supervisory concern. In arriving at a composite rating, each financial dimension must be weighed and due consideration given to the interrelationships among the various aspects of a bank's operations. The delineation of specific performance dimensions does not preclude consideration of other factors that, in the judgment of the examiner or reviewer, are deemed relevant to accurately reflect the overall condition and soundness of a particular bank. However, the assessment of the specific performance dimensions represents the essential foundation upon which the composite rating is based.

Composite Rating

The five composite ratings are defined and distinguished as follows:

Composite 1

Financial institutions in this group are sound in every respect and generally have components rated 1 or 2. Any weaknesses are minor and can be handled in a routine manner by the board of directors and management. These financial institutions are the most capable of withstanding the vagaries of business conditions and are resistant to outside influences such as economic instability in their trade area. These financial institutions are in substantial compliance with laws and regulations. As a result, these financial institutions exhibit the strongest performance and risk management practices relative to the institution's size, complexity, and risk profile, and give no cause for supervisory concern.

Composite 2

Financial institutions in this group are fundamentally sound. For a financial institution to receive this rating, generally no component rating should be more severe than 3. Only moderate weaknesses are present and are well within the board of directors' and management's capabilities and willingness to correct. These financial institutions are stable and are capable of withstanding business fluctuations. These financial institutions are in substantial compliance with laws and regulations. Overall risk management practices are satisfactory relative to the institution's size, complexity, and risk profile. There are no material supervisory concerns and, as a result, the supervisory response is informal and limited.

Composite 3

Financial institutions in this group exhibit some degree of supervisory concern in one or more of the component areas. These financial institutions exhibit a combination of weaknesses that may range from moderate to severe; however, the magnitude of the deficiencies generally will not cause a component to be rated more severely than 4. Management may lack the ability or willingness to effectively address weaknesses within appropriate time frames. Financial institutions in this group generally are less capable of withstanding business fluctuations and are more vulnerable to outside influences than those institutions rated a composite 1 or 2. Additionally, these financial institutions may be in significant noncompliance with laws and regulations. Risk management practices may be less than satisfactory relative to the institution's size, complexity, and risk profile. These financial institutions require more than normal supervision, which may include formal or informal enforcement actions. Failure appears unlikely, however, given the overall strength and financial capacity of these institutions.

Composite 4

Financial institutions in this group generally exhibit unsafe and unsound practices or conditions. There are serious financial or managerial deficiencies that result in unsatisfactory performance. The problems range from severe to critically deficient. The weaknesses and problems are not being satisfactorily addressed or resolved by the board of directors and management. Financial institutions in this group generally are not capable of withstanding business fluctuations. There may be significant noncompliance with laws and regulations. Risk management practices are generally unacceptable relative to the institution's size, complexity, and risk profile. Close supervisory attention is required, which means, in most cases, formal enforcement action is necessary to address the problems. Institutions in this group pose a risk to the deposit insurance fund. Failure is a distinct possibility if the problems and weaknesses are not satisfactorily addressed and resolved.

Composite 5

Financial institutions in this group exhibit extremely unsafe and unsound practices or conditions; exhibit a critically deficient performance; often contain inadequate risk management practices relative to the institution's size, complexity, and risk profile; and are of the greatest supervisory concern. The volume and severity of problems are beyond management's ability or willingness to control or correct. Immediate outside financial or other assistance is needed in order for the financial institution to be viable. Ongoing supervisory attention is necessary. Institutions in this group pose a significant risk to the deposit insurance fund and failure is highly probable.

Performance Evaluation

As already noted, the six key performance dimensions -- capital adequacy, asset quality, management, earnings, liquidity, and sensitivity to market risk -- are to be evaluated on a scale of one to five. The following is a description of the gradations to be utilized in the assignment of performance ratings:

Rating No. 1 - indicates strong performance. It is the highest rating and is indicative of performance that is significantly higher than average.

Rating No. 2 - reflects satisfactory performance. It reflects performance that is average or above; it includes performance that adequately provides for the safe and sound operation of the bank.

Rating No. 3 - represents performance that is flawed to some degree; as such, it is considered fair. It is neither satisfactory nor marginal but is characterized by performance of below average quality.

Rating No. 4 - represents marginal performance which is significantly below average. If left unchecked, such performance might evolve into weaknesses or conditions that could threaten the viability of the institution.

Rating No. 5 - is considered unsatisfactory (poor). It is the lowest rating and is indicative of performance that is critically deficient and in need of immediate remedial attention. Such performance by itself, or in combination with other weaknesses, could threaten the viability of the institution.

Capital Adequacy

A financial institution is expected to maintain capital commensurate with the nature and extent of risks to the institution and the ability of management to identify, measure, monitor, and control these risks.

The capital adequacy of an institution is rated (1 thru 5) based upon, but not limited to, an assessment of the following evaluation factors:

(a) The level and quality of capital and the overall financial condition of the institution.

(b) The ability of management to address emerging needs for additional capital.

(c) The nature, trend, and volume of problem assets, and the adequacy of allowances for loan and lease losses and other valuation reserves.

(d) Balance sheet composition, including the nature and amount of intangible assets, market risk, concentration risk, and risks associated with nontraditional activities.

(e) Risk exposure represented by off-balance sheet activities.

(f) The quality and strength of earnings, and the reasonableness of dividends.

(g) Prospects and plans for growth, as well as past experience in managing growth.

(h) Access to capital markets and other sources of capital, including support provided by a parent holding company.

Ratings

Capital Adequacy rated 1 indicates a strong capital level relative to the institution's risk profile.

A 2 rating indicates a satisfactory capital level relative to the financial institution's risk profile.

A rating of 3 indicates a less than satisfactory level of capital that does not fully support the institution's risk profile. The rating indicates a need for improvement, even if the institution's capital level exceeds minimum regulatory and statutory requirements.

A 4 rating indicates a deficient level of capital. In light of the institution's risk profile, viability of the institution may be threatened. Assistance from shareholders or other external sources of financial support may be required.

Capital adequacy rated 5 indicates a critically deficient level of capital such that the institution's viability is threatened. Immediate assistance from shareholders or other external sources of financial support is required.

Asset Quality

The asset quality rating reflects the quantity of existing and potential credit risk associated with the loan and investment portfolios, other real estate owned, and other assets, as well as off-balance sheet transactions. The ability of management to identify, measure, monitor, and control credit risk is also reflected here.

The asset quality of an institution is rated (1 thru 5) based upon, but not limited to, an assessment of the following evaluation factors:

(a) The adequacy of underwriting standards, soundness of credit administration practices, and appropriateness of risk identification practices.

(b) The level, distribution, severity, and trend of problem, classified, nonaccrual, restructured, delinquent, and nonperforming assets for both on- and off-balance sheet transactions.

(d) The credit risk arising from or reduced by off-balance sheet transactions, such as unfunded commitments, credit derivatives, commercial and standby letters of credit, and lines of credit.

(e) The diversification and quality of the loan and investment portfolios.

(f) The extent of securities underwriting activities and exposure to counterparties in trading activities.

(g) The existence of asset concentrations.

(h) The adequacy of loan and investment policies, procedures, and practices.

(i) The ability of management to properly administer its assets, including the timely identification and collection of problem assets.

(j) The adequacy of internal controls and management information systems.

(k) The volume and nature of credit documentation exceptions.

Ratings

Asset quality rated 1 indicates strong asset quality and credit administration practices. Identified weaknesses are minor in nature and risk exposure is modest in relation to capital protection and management's abilities. Asset quality in such institutions is of minimal supervisory concern.

A rating of 2 indicates satisfactory asset quality and credit administration practices. The level and severity of classifications and other weaknesses warrant a limited level of supervisory attention. Risk exposure is commensurate with capital protection and management's abilities.

A 3 rating is assigned when asset quality or credit administration practices are less than satisfactory. Trends may be stable or indicate deterioration in asset quality or an increase in risk exposure. The level and severity of classified assets, other weaknesses, and risks require an elevated level of supervisory concern. There is generally a need to improve credit administration and risk management practices.

An asset quality rating of 4 is assigned to financial institutions with deficient asset quality or credit administration practices. The levels of risk and problem assets are significant, inadequately controlled, and subject the financial institution to potential losses that, if left unchecked, may threaten its viability.

A rating of 5 represents critically deficient asset quality or credit administration practices that present an imminent threat to the institution's viability.

Management

The capability of the board of directors and management, in their respective roles, to identify, measure, monitor, and control the risks of an institution's activities and to ensure a financial institution's safe, sound, and efficient operation in compliance with applicable laws and regulations is reflected in this rating.

The capability and performance of management and the board of directors is rated (1 thru 5) based upon, but not limited to, an assessment of the following:

(a) The level and quality of oversight and support of all institution activities by the board of directors and management.

(b) The ability of the board of directors and management, in their respective roles, to plan for, and respond to, risks that may arise from changing business conditions or the initiation of new activities or products.

(c) The adequacy of, and conformance with, appropriate internal policies and controls addressing the operations and risks of significant activities.

(d) The accuracy, timeliness, and effectiveness of management information and risk monitoring systems appropriate for the institution's size, complexity, and risk profile.

(e) The adequacy of audits and internal controls to: promote effective operations and reliable financial and regulatory reporting; safeguard assets; and ensure compliance with laws, regulations, and internal policies.

(f) Compliance with laws and regulations and responsiveness to recommendations from auditors and supervisory authorities.

(g) Management depth and succession and the extent that the board of directors and management is affected by, or susceptible to, dominant influence or concentration of authority.

(h) Reasonableness of compensation policies and avoidance of self-dealing.

(i) Demonstrated willingness to serve the legitimate banking needs of the community.

(j) The overall performance of the institution and its risk profile.

Ratings

A 1 rating indicates strong performance by management and the board of directors and strong risk management practices relative to the institution's size, complexity, and risk profile. All significant risks are consistently and effectively identified, measured, monitored, and controlled. Management and the board have demonstrated the ability to promptly and successfully address existing and potential problems and risks.

A rating of 2 indicates satisfactory management and board performance and risk management practices relative to the institution's size, complexity, and risk profile. Minor weaknesses may exist, but are not material to the safety and soundness of the institution and are being addressed. In general, significant risks and problems are effectively identified, measured, monitored, and controlled.

The 3 rating indicates management and board performance that need improvement or risk management practices that are less than satisfactory given the nature of the institution's activities. The capabilities of management or the board of directors may be insufficient for the type, size, or condition of the institution. Problems and significant risks may be inadequately identified, measured, monitored, or controlled.

A 4 rating indicates deficient management and board performance or risk management practices that are inadequate considering the nature of an institution's activities. The level of problems and risk exposure is excessive. Problems and significant risks are inadequately identified, measured, monitored, or controlled and require immediate action by the board and management to preserve the soundness of the institution. Replacing or strengthening management or the board may be necessary.

A rating of 5 indicates critically deficient management and board performance or risk management practices. Management and the board of directors have not demonstrated the ability to correct problems and implement appropriate risk management practices. Problems and significant risks are inadequately identified, measured, monitored, or controlled and now threaten the continued viability of the institution. Replacing or strengthening management or the board of directors is necessary.

Earnings

This rating reflects not only the quantity and trend of earnings, but also factors that may affect the sustainability or quality of earnings. The quantity as well as the quality of earnings can be affected by excessive or inadequately managed credit risk that may result in loan losses and require additions to the allowance for loan and lease losses, or by high levels of market risk that may unduly expose an institution's earnings to volatility in interest rates.

The rating (1 thru 5) of an institution’s earnings is based upon, but not limited to, an assessment of the following evaluation factors:

(a) The level of earnings, including trends and stability.

(b) The ability to provide for adequate capital through retained earnings.

(d) The level of expenses in relation to operations.

(e) The adequacy of the budgeting systems, forecasting processes, and management information systems in general.

(f) The adequacy of provisions to maintain the allowance for loan and lease losses and other valuation allowance accounts.

(g) The earnings exposure to market risk such as interest rate, foreign exchange, and price risks.

Ratings

Earnings rated 1 indicates earnings that are strong. Earnings are more than sufficient to support operations and maintain adequate capital and allowance levels after consideration is given to asset quality, growth, and other factors affecting the quality, quantity, and trend of earnings.

A 2 rating indicates earnings that are satisfactory. Earnings are sufficient to support operations and maintain adequate capital and allowance levels after consideration is given to asset quality, growth, and other factors affecting the quality, quantity, and trend of earnings. Earnings that are relatively static, or even experiencing a slight decline, may receive a 2 rating provided the institution's level of earnings is adequate in view of the assessment factors listed above.

A rating of 3 indicates earnings that need to be improved. Earnings may not fully support operations and provide for the accretion of capital and allowance levels in relation to the institution's overall condition, growth, and other factors affecting the quality, quantity, and trend of earnings.

The 4 rating indicates earnings that are deficient. Earnings are insufficient to support operations and maintain appropriate capital and allowance levels. Institutions so rated may be characterized by erratic fluctuations in net income or net interest margin, the development of significant negative trends, nominal or unsustainable earnings, intermittent losses, or a substantive drop in earnings from the previous years.

A 5 rating indicates earnings that are critically deficient. A financial institution with earnings rated 5 is experiencing losses that represent a distinct threat to its viability through the erosion of capital.

Liquidity

In evaluating the adequacy of a financial institution's liquidity position, consideration should be given to the current level and prospective sources of liquidity compared to funding needs, as well as to the adequacy of funds management practices relative to the institution's size, complexity, and risk profile.

Liquidity is rated (1 thru 5) based upon, but not limited to, an assessment of the following evaluation factors:

(a) The adequacy of liquidity sources compared to present and future needs and the ability of the institution to meet liquidity needs without adversely affecting its operations or condition.

(b) The availability of assets readily convertible to cash without undue loss.

(d) The level of diversification of funding sources, both on- and off-balance sheet.

(e) The degree of reliance on short-term, volatile sources of funds, including borrowings and brokered deposits, to fund longer term assets.

(f) The trend and stability of deposits.

(g) The ability to securitize and sell certain pools of assets.

(h) The capability of management to properly identify, measure, monitor, and control the institution's liquidity position, including the effectiveness of funds management strategies, liquidity policies, management information systems, and contingency funding plans.

Ratings

A liquidity rating of 1 indicates strong liquidity levels and well-developed funds management practices. The institution has reliable access to sufficient sources of funds on favorable terms to meet present and anticipated liquidity needs.

A rating of 2 indicates satisfactory liquidity levels and funds management practices. The institution has access to sufficient sources of funds on acceptable terms to meet present and anticipated liquidity needs. Modest weaknesses may be evident in funds management practices.

A 3 rating indicates liquidity levels or funds management practices in need of improvement. Institutions rated 3 may lack ready access to funds on reasonable terms or may evidence significant weaknesses in funds management practices.

A rating of 4 indicates deficient liquidity levels or inadequate funds management practices. Institutions rated 4 may not have or be able to obtain a sufficient volume of funds on reasonable terms to meet liquidity needs.

The 5 rating indicates liquidity levels or funds management practices so critically deficient that the continued viability of the institution is threatened. Institutions rated 5 require immediate external financial assistance to meet maturing obligations or other liquidity needs.

Sensitivity to Market Risk

Sensitivity to market risk is rated with respect to the degree to which changes in interest rates, foreign exchange rates, commodity prices, or equity prices can adversely affect a financial institution's earnings or economic capital.

Market risk is rated (1 thru 5) based upon, but not limited to, an assessment of the following evaluation factors:

(a) The sensitivity of the financial institution's earnings or the economic value of its capital to adverse changes in interest rates, foreign exchanges rates, commodity prices, or equity prices.

(b) The ability of management to identify, measure, monitor, and control exposure to market risk given the institution's size, complexity, and risk profile.

(d) Where appropriate, the nature and complexity of market risk exposure arising from trading and foreign operations.

Ratings

A sensitivity to market risk rating of 1 indicates that market risk sensitivity is well controlled and that there is minimal potential that the earnings performance or capital position will be adversely affected. Risk management practices are strong for the size, sophistication, and market risk accepted by the institution. The level of earnings and capital provide substantial support for the degree of market risk taken by the institution.

A rating of 2 indicates that market risk sensitivity is adequately controlled and that there is only moderate potential that the earnings performance or capital position will be adversely affected. Risk management practices are satisfactory for the size, sophistication, and market risk accepted by the institution. The level of earnings and capital provide adequate support for the degree of market risk taken by the institution.

A 3 rating indicates that control of market risk sensitivity needs improvement or that there is significant potential that the earnings performance or capital position will be adversely affected. Risk management practices need to be improved given the size, sophistication, and level of market risk accepted by the institution. The level of earnings and capital may not adequately support the degree of market risk taken by the institution.

The 4 rating indicates that control of market risk sensitivity is unacceptable or that there is high potential that the earnings performance or capital position will be adversely affected. Risk management practices are deficient for the size, sophistication, and level of market risk accepted by the institution. The level of earnings and capital provide inadequate support for the degree of market risk taken by the institution.

A rating of 5 indicates that control of market risk sensitivity is unacceptable or that the level of market risk taken by the institution is an imminent threat to its viability. Risk management practices are wholly inadequate for the size, sophistication, and level of market risk accepted by the institution.

Examination Report Disclosure

For examination purposes, the following disclosure should be made on Page 1 of the report:

COMPONENT RATING

Under the Uniform Interagency Bank Rating System, your institution has been rated as follows:

Capital Adequacy - X

Asset Quality - X

Management - X

Earnings - X

Liquidity - X

Sensitivity to Market Risk - X

COMPOSITE RATING

Additionally, component ratings will be disclosed on the appropriate core page of the report. This disclosure will be a simple statement disclosing the rating preceding any comments traditionally made on those pages.

Example:

"Asset Quality is assigned a rating of two."

98 - 1 – Capital Adequacy

Capital is the cushion that enables banks to sustain losses due to economic declines and unanticipated financial setbacks. It is the buffer between unreserved losses and the interest of depositors and creditors. As the ownership interest of shareholders, capital instills discipline and motivates bank managers to exercise prudence in the acceptance and management of risk. Adequate capital promotes public confidence and enables banks to more safely support and stimulate economic growth through the ability to attract deposits at reasonable rates and lend money to qualified borrowers.

The federal bank regulatory agencies have adopted uniform risk based capital guidelines and have agreed on a minimum leverage ratio. The primary objectives of risk based capital are to: 1) make regulatory capital requirements more sensitive to differing risk profiles among banks; 2) factor off-balance sheet risk exposure into the assessment of capital adequacy; 3) minimize disincentives to hold more liquid, low risk assets; and 4) achieve greater consistency in the evaluation of bank capital adequacy world-wide.

POLICY

The Arkansas State Bank Department hereby adopts the capital adequacy guidelines established by the Federal Deposit Insurance Corporation and Federal Reserve System for state-chartered banks. These guidelines establish a minimum capital level for: (1) Total risk-based capital ratio; (2) Tier 1 risk-based capital ratio; and (3) The leverage ratio. Specific capital levels and “capital adequacy categories” are identified below. Minimum capital levels are applicable to well managed banks with strong risk management practices in place, and assigned a composite 1 or 2 CAMELS rating by regulatory agencies. Banks not meeting this criteria will be required to maintain higher capital ratios. The Bank Commissioner retains the authority to require higher capital levels based on the condition of the bank and the performance of management and directors.

CAPITAL CATEGORIES AND MINIMUM CAPITAL LEVELS

A well capitalized bank:

(i) Has a total risk-based capital ratio of 10.0 percent or greater; and

(ii) Has a Tier 1 risk-based capital ratio of 6.0 percent or greater; and

(iii) Has a leverage ratio of 5.0 percent or greater; and

(iv) Is not subject to any written agreement, order, capital directive, or prompt corrective action directive issued by regulatory agencies to meet and maintain a specific capital level.

An adequately capitalized bank;

(i) Has a total risk-based capital ratio of 8.0 percent or greater; and

(ii) Has a Tier 1 risk-based capital ratio of 4.0 percent or greater; and

(iii) Has:

(A) A leverage ratio of 4.0 percent or greater; or

(B) A leverage ratio of 3.0 percent or greater if the bank is rated composite 1 under the CAMELS rating system in the most recent examination of the bank and is not experiencing or anticipating significant growth; and

(iv) Does not meet the definition of a well-capitalized bank.

An undercapitalized bank:

(i) Has a total risk-based capital ratio that is less than 8.0 percent; or

(ii) Has a Tier 1 risk-based capital ratio that is less than 4.0 percent or

(iii) Has:

(A) A leverage ratio that is less than 4.0 percent; or

(B) A leverage ratio that is less than 3.0 percent if the bank is rated composite 1 under the CAMELS rating system in the most recent examination of the bank and is not experiencing or anticipating significant growth.

A significantly undercapitalized bank:

(i) Has a total risk-based capital ratio that is less than 6.0 percent; or

(ii) Has a Tier 1 risk-based capital ratio that is less than 3.0 percent; or

(iii) Has a leverage ratio that is less than 3.0 percent.

A critically undercapitalized bank has a ratio of tangible equity to total assets that is equal to or less than 2.0 percent.

CAPITAL COMPONENTS

Tier 1 or core capital consists of the following: common stock, surplus, noncumulative perpetual preferred stock, undivided profits and capital reserves, minority interest in consolidated subsidiaries, qualifying portions of mortgage servicing assets (generally limited to: 1) 50% of the bank's equity capital exclusive of serving rights; 2) 90% of the original price of the servicing rights; or 3) 90% of the fair market value of those servicing rights), and qualifying portions of purchased credit card relationships, less ineligible intangible assets, identified losses and ineligible gains or losses on available-for-sale securities.

Tier 2 or supplemental capital consists of the following: allowance for loan and leases losses (up to a maximum of 1.25 percent of risk-weighted assets), cumulative perpetual preferred stock, subordinated debt with original maturities greater than five (5) years, limited life preferred stock with original maturities greater than five (5) years, long-term preferred stock with a maturity greater than 20 years, mandatory convertible debt, and other capital instruments in compliance with federal regulations. The maximum amount of tier two capital that may be recognized for risk-based capital purposes is limited to 100 percent of tier one capital. The allowable volume of subordinated debt and limited life preferred stock that may be recognized as part of tier two capital is limited to 50 percent of tier one capital.

POLICY CHANGES

Specifics identified in capital categories, minimum capital levels, and capital components will change in order to remain consistent with modifications adopted by the Federal Deposit Insurance Corporation and the Federal Reserve System.

99-2 – Uniform Rating System for Information Technology

Introduction

The quality, reliability, and integrity of a financial institution or service provider's information technology (IT) affect all aspects of its performance. An assessment of the technology risk management framework is necessary whether or not the institution or a third-party service provider manages these operations. The Uniform Rating System for Information Technology (URSIT) is an internal rating system used by federal and state regulators to uniformly assess financial institution and service provider risks introduced by IT. It also allows the regulators to identify those insured institutions and service providers whose information technology risk exposure or performance requires special supervisory attention. The rating system includes component and composite rating descriptions and the explicit identification of risks and assessment factors that examiners consider in assigning component ratings. Additionally, information technology can affect the risks associated with financial institutions. The effect on credit, operational, market, reputation, strategic, liquidity, interest rate, and compliance risks should be considered for each IT rating component.

The primary purpose of the rating system is to identify those entities whose condition or performance of information technology functions requires special supervisory attention. This rating system assists examiners in making an assessment of risk and compiling examination findings. However, the rating system does not drive the scope of an examination. Examiners should use the rating system to help evaluate the entity's overall risk exposure and risk management performance, and determine the degree of supervisory attention believed necessary to ensure that weaknesses are addressed and that risk is properly managed.

Overview

The URSIT is based on a risk evaluation of four critical components: Audit, Management, Development and Acquisition, and Support and Delivery (AMDS). These components are used to assess the overall performance of IT within an organization. Examiners evaluate the functions identified within each component to assess the institution's ability to identify, measure, monitor and control information technology risks. Each organization examined for IT is assigned a summary or composite rating based on the overall results of the evaluation. The IT composite rating and each component rating are based on a scale of "1" through "5" in ascending order of supervisory concern; "1" representing the highest rating and least degree of concern, and "5" representing the lowest rating and highest degree of concern.

The first step in developing an IT composite rating for an organization is the assignment of a performance rating to the individual AMDS components. The evaluation of each of these components, their interrelationships, and relative importance is the basis for the composite rating. The composite rating is derived by making a qualitative summarization of all of the AMDS components. A direct relationship exists between the composite rating and the individual AMDS component performance ratings. However, the composite rating is not an arithmetic average of the individual components. An arithmetic approach does not reflect the actual condition of IT when using a risk- focused approach. A poor rating in one component may heavily influence the overall composite rating for an institution. For example, if the audit function is viewed as inadequate, the overall integrity of the IT systems is not readily verifiable. Thus, a composite rating of less than satisfactory ("3"-"5") would normally be appropriate.

A principal purpose of the composite rating is to identify those financial institutions and service providers that pose an inordinate amount of information technology risk and merit special supervisory attention. Thus, individual risk exposures that more explicitly affect the viability of the organization and/or its customers should be given more weight in the composite rating.

The FFIEC recognizes that management practices, particularly as they relate to risk management, vary considerably among financial institutions and service bureaus depending on their size and sophistication, the nature and complexity of their business activities and their risk profile. Accordingly, the FFIEC also recognizes that for less complex information systems environments, detailed or highly formalized systems and controls are not required to receive the higher composite and component ratings.

The following two sections contain the URSIT composite rating definitions, the assessment factors, and definitions for the four component ratings. These assessment factors and definitions outline various IT functions and controls that may be evaluated as part of the examination.

Composite Ratings ³

Composite 1

Financial institutions and service providers rated composite "1" exhibit strong performance in every respect and generally have components rated 1 or 2. Weaknesses in IT are minor in nature and are easily corrected during the normal course of business. Risk management processes provide a comprehensive program to identify and monitor risk relative to the size, complexity and risk profile of the entity. Strategic plans are well defined and fully integrated throughout the organization. This allows management to quickly adapt to changing market, business and technology needs of the entity. Management identifies weaknesses promptly and takes appropriate corrective action to resolve audit and regulatory concerns. The financial condition of the service provider is strong and overall performance shows no cause for supervisory concern.

³ The descriptive examples in the numeric composite rating definitions are intended to provide guidance to examiners as they evaluate the overall condition of Information Technology. Examiners must use professional judgement when making this assessment and assigning the numeric rating.

Composite 2

Financial institutions and service providers rated composite "2" exhibit safe and sound performance but may demonstrate modest weaknesses in operating performance, monitoring, management processes or system development. Generally, senior management corrects weaknesses in the normal course of business. Risk management processes adequately identify and monitor risk relative to the size, complexity and risk profile of the entity. Strategic plans are defined but may require clarification, better coordination or improved communication throughout the organization. As a result, management anticipates, but responds less quickly to changes in market, business, and technological needs of the entity. Management normally identifies weaknesses and takes appropriate corrective action. However, greater reliance is placed on audit and regulatory intervention to identify and resolve concerns. The financial condition of the service provider is acceptable and while internal control weaknesses may exist, there are no significant supervisory concerns. As a result, supervisory action is informal and limited.

Composite 3

Financial institutions and service providers rated composite "3" exhibit some degree of supervisory concern due to a combination of weaknesses that may range from moderate to severe. If weaknesses persist, further deterioration in the condition and performance of the institution or service provider is likely. Risk management processes may not effectively identify risks and may not be appropriate for the size, complexity, or risk profile of the entity. Strategic plans are vaguely defined and may not provide adequate direction for IT initiatives. As a result, management often has difficulty responding to changes in business, market, and technological needs of the entity. Self-assessment practices are weak and are generally reactive to audit and regulatory exceptions. Repeat concerns may exist, indicating that management may lack the ability or willingness to resolve concerns. The financial condition of the service provider may be weak and/or negative trends may be evident. While financial or operational failure is unlikely, increased supervision is necessary. Formal or informal supervisory action may be necessary to secure corrective action.

Composite 4

Financial institutions and service providers rated composite "4" operate in an unsafe and unsound environment that may impair the future viability of the entity. Operating weaknesses are indicative of serious managerial deficiencies. Risk management processes inadequately identify and monitor risk, and practices are not appropriate given the size, complexity, and risk profile of the entity. Strategic plans are poorly defined and not coordinated or communicated throughout the organization. As a result, management and the board are not committed to, or may be incapable of ensuring that technological needs are met. Management does not perform self-assessments and demonstrates an inability or unwillingness to correct audit and regulatory concerns. The financial condition of the service provider is severely impaired and/or deteriorating. Failure of the financial institution or service provider may be likely unless IT problems are remedied. Close supervisory attention is necessary and, in most cases, formal enforcement action is warranted.

Composite 5

Financial institutions and service providers rated composite "5" exhibit critically deficient operating performance and are in need of immediate remedial action. Operational problems and serious weaknesses may exist throughout the organization. Risk management processes are severely deficient and provide management little or no perception of risk relative to the size, complexity, and risk profile of the entity. Strategic plans do not exist or are ineffective, and management and the board provide little or no direction for IT initiatives. As a result, management is unaware of, or inattentive to technological needs of the entity. Management is unwilling or incapable of correcting audit and regulatory concerns. The financial condition of the service provider is poor and failure is highly probable due to poor operating performance or financial instability. Ongoing supervisory attention is necessary.

Component Ratings ⁴

Audit

Financial institutions and service providers are expected to provide independent assessments of their exposure to risks and the quality of internal controls associated with the acquisition, implementation and use of information technology.⁵ Audit practices should address the IT risk exposures throughout the institution and its service provider(s) in the areas of user and data center operations, client/server architecture, local and wide area networks, telecommunications, information security, electronic data interchange, systems development, and contingency planning. This rating should reflect the adequacy of the organization's overall IT audit program, including the internal and external auditor's abilities to detect and report significant risks to management and the board of directors on a timely basis. It should also reflect the internal and external auditor's capability to promote a safe, sound, and effective operation.

⁴ The descriptive examples in the numeric component rating definitions are intended to provide guidance to examiners as they evaluate the individual components. Examiners must use professional judgement when assessing a component area and assigning a numeric rating value as it is likely that examiners will encounter conditions that correspond to descriptive examples in two or more numeric rating value definitions.