OCC Guidelines Establishing Standards for Recovery Planning by Certain Large Insured National Banks, Insured Federal Savings Associations, and Insured Federal Branches; Technical Amendments, 66791-66801 [2016-23366]

Agencies

• Office of the Comptroller of the Currency
• DEPARTMENT OF THE TREASURY

[Federal Register Volume 81, Number 189 (Thursday, September 29, 2016)]
[Rules and Regulations]
[Pages 66791-66801]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2016-23366]



========================================================================
Rules and Regulations
                                                Federal Register
________________________________________________________________________

This section of the FEDERAL REGISTER contains regulatory documents 
having general applicability and legal effect, most of which are keyed 
to and codified in the Code of Federal Regulations, which is published 
under 50 titles pursuant to 44 U.S.C. 1510.

The Code of Federal Regulations is sold by the Superintendent of Documents. 
Prices of new books are listed in the first FEDERAL REGISTER issue of each 
week.

========================================================================


Federal Register / Vol. 81, No. 189 / Thursday, September 29, 2016 / 
Rules and Regulations

[[Page 66791]]



DEPARTMENT OF THE TREASURY

Office of the Comptroller of the Currency

12 CFR Part 30

[Docket ID OCC-2015-0017]
RIN 1557-AD96


OCC Guidelines Establishing Standards for Recovery Planning by 
Certain Large Insured National Banks, Insured Federal Savings 
Associations, and Insured Federal Branches; Technical Amendments

AGENCY: Office of the Comptroller of the Currency, Treasury.

ACTION: Final rule and guidelines.

-----------------------------------------------------------------------

SUMMARY: The Office of the Comptroller of the Currency (OCC) is 
adopting enforceable guidelines establishing standards for recovery 
planning by insured national banks, insured Federal savings 
associations, and insured Federal branches of foreign banks with 
average total consolidated assets of $50 billion or more (Final 
Guidelines). The OCC is issuing the Final Guidelines as an appendix to 
its safety and soundness standards regulations, and the Final 
Guidelines will be enforceable by the terms of the Federal statute that 
authorizes the OCC to prescribe operational and managerial standards 
for national banks and Federal savings associations. The OCC is also 
adopting technical changes to the safety and soundness standards 
regulations that are made necessary by the addition of the Final 
Guidelines.

DATES: This final rule and guidelines are effective on January 1, 2017. 
The compliance dates for the Final Guidelines in Appendix E to part 30 
vary, as specified below.

FOR FURTHER INFORMATION CONTACT: Lori Bittner, Large Bank Supervision--
Resolution and Recovery, (202) 649-6093; Stuart Feldstein, Director, 
Andra Shuster, Senior Counsel, Karen McSweeney, Counsel, or Priscilla 
Benner, Attorney, Legislative & Regulatory Activities Division, (202) 
649-5490; or Valerie Song, Assistant Director, Bank Activities and 
Structure Division, (202) 649-5500; or, for persons who are deaf or 
hard of hearing, TTY, (202) 649-5597, 400 7th Street SW., Washington, 
DC 20219.

SUPPLEMENTARY INFORMATION: 

Background

    The financial crisis demonstrated the destabilizing effect that 
severe stress at large, complex, interconnected financial companies can 
have on the national economy, capital markets, and the overall 
financial stability of the banking system. Following the crisis, 
Congress passed the Dodd-Frank Wall Street Reform and Consumer 
Protection Act (Dodd-Frank Act); \1\ among other purposes, the Dodd-
Frank Act was intended to strengthen the framework for the supervision 
and regulation of large U.S. financial companies in order to address 
the significant impact that these institutions can have on capital 
markets and the economy.
---------------------------------------------------------------------------

    \1\ Public Law 111-203, 124 Stat. 1376 (July 21, 2010).
---------------------------------------------------------------------------

    One lesson learned from the crisis is the importance--especially in 
large, complex financial institutions--of a strong risk governance 
framework. In 2014, the OCC formally adopted heightened standards 
guidelines that address the risk governance of large, complex banks 
(Heightened Standards).\2\ The Heightened Standards establish minimum 
standards for the design and implementation of a risk governance 
framework and for a bank's board of directors (board) in overseeing the 
framework's design and implementation. The OCC believes that these 
Heightened Standards further the goals of the Dodd-Frank Act by 
clarifying the OCC's expectation that its regulated institutions have 
robust practices in areas where the crisis revealed substantial 
weaknesses.
---------------------------------------------------------------------------

    \2\ 79 FR 54518 (Sept. 11, 2014) (OCC Guidelines Establishing 
Heightened Standards for Certain Large Insured National Banks, 
Insured Federal Savings Associations, and Insured Federal Branches; 
Integration of Regulations).
---------------------------------------------------------------------------

    Further, in the aftermath of the crisis, it became clear that many 
financial institutions had insufficient plans for identifying and 
responding rapidly to significant stress events that affected their 
financial condition and threatened their viability. As a result, many 
institutions were forced to take significant actions quickly without 
the benefit of a well-developed plan. In addition, recent large-scale 
events, such as destructive cyber attacks, demonstrate the need for 
institutions to plan how to respond to the financial effects of such 
occurrences. Therefore, the OCC believes that a large, complex 
institution should undertake recovery planning to be able to respond 
quickly to and recover from the financial effects of severe stress on 
the institution.\3\ An institution's recovery planning should be a 
dynamic, ongoing process that complements its risk governance functions 
and supports its safe and sound operation. The process of developing 
and maintaining a recovery plan also should cause a covered bank's 
management and its board to enhance their focus on risk governance with 
a view toward lessening the negative impact of future events.
---------------------------------------------------------------------------

    \3\ While the Dodd-Frank Act addresses resolution planning, it 
does not specifically address recovery planning.
---------------------------------------------------------------------------

    In December 2015, the OCC invited public comment on proposed 
guidelines establishing minimum standards for recovery planning by 
insured national banks, insured Federal savings associations, and 
insured Federal branches of foreign banks (together, banks and each, a 
bank) with average total consolidated assets of $50 billion or more 
(together, covered banks and each, a covered bank).\4\ After carefully 
considering the comments we received on the proposed guidelines, the 
OCC is adopting these Final Guidelines as a new Appendix E to part 30 
of our regulations. The OCC, as the primary financial regulatory agency 
for the covered banks, believes that the Final Guidelines will assist 
these banks with their recovery planning efforts, thereby minimizing 
the negative impact of severe stress. We have set forth below a 
detailed description of the proposal, the significant comments we 
received, and the standards contained in the Final Guidelines.
---------------------------------------------------------------------------

    \4\ 80 FR 78681 (Dec. 17, 2015).
---------------------------------------------------------------------------

Summary of Comments on the Notice of Proposed Rulemaking

    The OCC received six comment letters on the proposed guidelines 
from

[[Page 66792]]

national banks, trade associations, and individuals. To improve our 
understanding of the issues raised by commenters, the OCC had a meeting 
with two trade groups and a number of their member institutions, and a 
summary of this meeting is available on a public Web site.\5\
---------------------------------------------------------------------------

    \5\ See https://www.regulations.gov/index.jsp#!documentDetail;D=OCC-2015-0017-0001.
---------------------------------------------------------------------------

    The comments we received generally supported the proposed 
guidelines, acknowledging that recovery planning is an important part 
of risk management and that the use of guidelines, rather than 
regulations, provides both covered banks and the OCC with appropriate 
flexibility. However, the commenters asked the OCC to clarify various 
provisions in the proposal. For example, commenters requested that the 
OCC address the ability of a covered bank to leverage other processes 
in developing its recovery plan and to tailor its plan based on the 
size, risk profile, and complexity of the bank. They also asked the OCC 
to clarify the role of the board with respect to the plan. In addition, 
commenters suggested that the OCC consider tiered compliance dates. As 
discussed more fully below, the OCC has revised the Final Guidelines in 
response to the comments we received and has made other technical and 
clarifying changes.

Enforcement of the Final Guidelines

    The OCC is adopting these Final Guidelines pursuant to section 39 
of the Federal Deposit Insurance Act (FDIA).\6\ Section 39 authorizes 
the OCC to prescribe safety and soundness standards in the form of a 
regulation or guidelines. The OCC currently has four sets of these 
guidelines that are appendices to part 30 of the OCC's regulations. 
Appendix A contains operational and managerial standards that relate to 
internal controls, information systems, internal audit systems, loan 
documentation, credit underwriting, interest rate exposure, asset 
growth, asset quality, earnings, compensation, fees, and benefits. 
Appendix B contains standards on information security, and Appendix C 
contains standards that address residential mortgage lending practices. 
Appendix D contains the Heightened Standards discussed above.
---------------------------------------------------------------------------

    \6\ 12 U.S.C. 1831p-1.
---------------------------------------------------------------------------

    Section 39 prescribes different consequences depending on whether 
an agency issues the standards by regulation or guideline. Pursuant to 
section 39, if a bank \7\ fails to meet a standard prescribed by 
regulation, the OCC must require it to submit a plan specifying the 
steps it will take to comply with the standard. If a bank fails to meet 
a standard prescribed by guidelines, the OCC has the discretion to 
decide whether to require the submission of a plan.\8\ The issuance of 
these standards as guidelines, rather than as regulations, provides the 
OCC with the flexibility to pursue the course of action that is most 
appropriate given the specific circumstances of a covered bank's 
noncompliance with one or more standards and the covered bank's self-
corrective and remedial responses.
---------------------------------------------------------------------------

    \7\ Section 39 of the FDIA applies to ``insured depository 
institutions,'' which, as defined in 12 U.S.C. 1813, includes 
insured Federal branches of foreign banks. While we do not 
specifically refer to these entities in this discussion of the 
enforcement of the Final Guidelines, it should be read to include 
them.
    \8\ See 12 U.S.C. 1831p-1(e)(1)(A)(i) and (ii).
---------------------------------------------------------------------------

    The procedural rules implementing the supervisory and enforcement 
remedies prescribed by section 39 are contained in part 30 of the OCC's 
rules. Under these provisions, the OCC may initiate a supervisory or 
enforcement process when it determines, by examination or otherwise, 
that a bank has failed to meet the standards set forth in the Final 
Guidelines.\9\ Upon making that determination, the OCC may request in 
writing that the bank submit a compliance plan to the OCC detailing the 
steps the institution will take to correct the deficiencies and the 
time within which it will take those steps. This request is termed a 
Notice of Deficiency. Upon receiving a Notice of Deficiency from the 
OCC, the bank must submit a compliance plan to the OCC for approval 
within 30 days.
---------------------------------------------------------------------------

    \9\ The procedures governing the determination and notification 
of failure to satisfy a standard prescribed pursuant to section 39; 
the filing and review of compliance plans; and the issuance of 
orders, if necessary, are set forth in the OCC's regulations at 12 
CFR 30.3, 30.4, and 30.5.
---------------------------------------------------------------------------

    If a bank fails to submit an acceptable compliance plan or fails in 
any material respect to implement a compliance plan approved by the 
OCC, the OCC shall issue a Notice of Intent to Issue an Order pursuant 
to section 39 (Notice of Intent). The bank then has 14 days to respond 
to the Notice of Intent. After considering the bank's response, the OCC 
may issue the order, decide not to issue the order, or seek additional 
information from the bank before making a final decision. 
Alternatively, the OCC may issue an order without providing the bank 
with a Notice of Intent. In such a case, the bank may appeal after-the-
fact to the OCC, and the OCC has 60 days to consider the appeal. Upon 
the issuance of an order, a bank is deemed to be in noncompliance with 
part 30. Orders are formal, public documents, and the OCC may enforce 
them in Federal district court. The OCC may also assess a civil money 
penalty, pursuant to 12 U.S.C. 1818, against any bank that violates or 
otherwise fails to comply with any final order and against any 
institution-affiliated party who participates in such violation or 
noncompliance.

Detailed Description of the Proposed Guidelines, Comments Received, and 
Final Guidelines

    Like the proposal, the Final Guidelines consist of three sections. 
Section I explains the scope of the Final Guidelines, sets forth the 
applicable compliance dates, and defines key terms. Section II sets 
forth the standards for the design and execution of a covered bank's 
recovery plan. Section III describes the responsibilities of a covered 
bank's management and board in connection with the bank's recovery 
plan.

Section I: Introduction

    Scope. As proposed, the guidelines would have applied to any bank 
with ``average total consolidated assets'' equal to or greater than $50 
billion as of the effective date of the guidelines (calculated by 
averaging a bank's total consolidated assets, as reported on the bank's 
Consolidated Reports of Condition and Income (Call Reports), for the 
four most recent consecutive quarters). The preamble to the proposal 
noted that this threshold is consistent with the scope of Federal 
Deposit Insurance Corporation (FDIC) and Board of Governors of the 
Federal Reserve System (Board) regulations that require certain 
entities to prepare resolution plans.\10\ We note that this threshold 
also is consistent with the Heightened Standards threshold, as well as 
the threshold used in section 165 of the Dodd-Frank Act for the 
application of enhanced prudential standards to bank holding companies 
and foreign banking organizations.
---------------------------------------------------------------------------

    \10\ See 12 CFR 381.2(f) and 243.2(f), respectively. See also 12 
CFR 360.10.
---------------------------------------------------------------------------

    The proposal provided that for any bank with average total 
consolidated assets less than $50 billion as of the effective date of 
the guidelines, whose average total consolidated assets subsequently 
reached $50 billion or greater, the guidelines would apply on the as-of 
date of the bank's most recent Call Report used in the calculation of 
the average total consolidated assets. Once a bank's average total 
consolidated assets had reached or exceeded the $50 billion threshold, 
the preamble explained that the bank would have had to comply with the 
guidelines, unless

[[Page 66793]]

and until the OCC specifically determined that compliance was not 
required, even if the bank's average total consolidated assets 
subsequently fell below the $50 billion threshold.
    The OCC received no comments on these provisions and adopts them as 
proposed.
    Compliance date. Although the OCC did not propose a specific 
compliance date, several commenters requested a phased-in compliance 
period. Some commenters suggested a compliance date of 2017 for the 
largest, most complex covered banks and a subsequent compliance date of 
2018 for the remaining covered banks. These commenters stated that the 
phase-in dates should account for the size, risk profile, and 
complexity of a covered bank. Other commenters requested an initial 
compliance date for all covered banks of no earlier than 2018. Another 
commenter suggested that the OCC use a flexible approach when setting a 
compliance date for banks that reach or exceed the $50 billion 
threshold after the effective date of the Final Guidelines.
    The OCC agrees that a phased-in compliance period is appropriate 
and adopts the compliance schedule set forth below, which we believe 
gives covered banks, including those likely to have the least 
experience with recovery planning, sufficient time to prepare their 
plans. Under this schedule, a covered bank with average total 
consolidated assets equal to or greater than $750 billion on the 
effective date of these Final Guidelines should comply within 6 months 
of the effective date. A covered bank with average total consolidated 
assets equal to or greater than $100 billion but less than $750 billion 
on the effective date should comply within 12 months of the effective 
date. A covered bank with average total consolidated assets equal to or 
greater than $50 billion but less than $100 billion on the effective 
date should comply within 18 months of the effective date. Finally, a 
bank with less than $50 billion in average total consolidated assets on 
the effective date, which subsequently becomes a covered bank, should 
comply with the Final Guidelines within 18 months of becoming a covered 
bank.
    Reservation of authority. In order to preserve supervisory 
flexibility, the proposed guidelines reserved the OCC's authority to 
apply the guidelines to a bank with average total consolidated assets 
of less than $50 billion if the agency determined that the bank's 
operations were highly complex or otherwise presented a heightened 
risk. The preamble explained that the OCC expected to use this 
authority infrequently and did not intend to apply the guidelines to 
community banks. The proposed guidelines also reserved the OCC's 
authority to determine that compliance with the guidelines was no 
longer required for a covered bank whose operations no longer were 
highly complex or otherwise no longer presented a heightened risk.
    In either case, when determining whether a bank's or covered bank's 
operations were highly complex or otherwise presented a heightened 
risk, the proposed guidelines stated that the OCC would consider an 
institution's size, risk profile, activities, and complexity, including 
the complexity of its organizational and legal entity structure. The 
guidelines also stated that, when exercising the authority reserved by 
this provision, the OCC would apply notice and response procedures 
consistent with those set out in 12 CFR 3.404.\11\
---------------------------------------------------------------------------

    \11\ As explained in the proposal, these procedures require the 
OCC to provide a bank or covered bank, as appropriate, with written 
notice of its determination to use its reservation of authority, and 
the bank or covered bank would have 30 days to respond in writing. 
The proposal provided that the OCC would consider the failure of a 
bank or covered bank to respond within this 30-day period to be a 
waiver of any objections. At the conclusion of the 30 days, the 
proposed guidelines stated that the OCC would issue a written notice 
of its final determination.
---------------------------------------------------------------------------

    Commenters had no substantive comments on this subsection. However, 
we have added ``scope of operations'' to the factors that we will 
consider in determining whether a bank's or covered bank's operations 
are highly complex or otherwise present a heightened risk. Otherwise, 
the OCC is adopting these provisions as proposed and reiterates that we 
expect to use this authority infrequently and do not intend to apply 
the Final Guidelines to community banks.
    Preservation of existing authority. The proposed guidelines stated 
that neither section 39 of the FDIA nor the OCC's part 30 rules in any 
way limited the authority of the OCC to address unsafe or unsound 
practices or conditions or other violations of law.\12\ We received no 
comments on this provision, and we are adopting it as proposed.
---------------------------------------------------------------------------

    \12\ Section 39 preserves all authority otherwise available to 
the OCC, stating ``The authority granted by this section is in 
addition to any other authority of the Federal banking agencies.'' 
See 12 U.S.C. 1831p-1(g).
---------------------------------------------------------------------------

    Definitions. The proposed guidelines included definitions of 
``average total consolidated assets,'' ``bank,'' ``covered bank,'' 
``recovery,'' ``recovery plan,'' and ``trigger.'' The proposal defined 
the term ``recovery'' to mean timely and appropriate action that a 
covered bank takes to remain a going concern when it is experiencing or 
is likely to experience considerable financial or operational distress 
and provided that a covered bank in recovery had not yet deteriorated 
to the point where liquidation or resolution is imminent. The proposal 
defined ``recovery plan'' as a plan that identified triggers and 
options for a covered bank to respond to a wide range of severe 
internal and external stress scenarios and to restore a covered bank 
that is in recovery to financial and operational strength and viability 
in a timely manner while maintaining the confidence of market 
participants. This definition further stated that neither the plan nor 
the options could assume or rely on any extraordinary government 
support.
    The proposal defined ``trigger'' as a ``quantitative or qualitative 
indicator of the risk or existence of severe stress that should always 
be escalated to management or the board, as appropriate, for purposes 
of initiating a response.'' It stated that the breach of any trigger 
should result in timely notice, accompanied by sufficient information, 
to enable management of the covered bank to take corrective action.
    The OCC received one comment regarding references to the 
``operational'' effects of severe stress in the proposal. The commenter 
stated that a covered bank's recovery plan should address the effects 
of operational stress events (e.g., cyber events, natural disasters, 
unanticipated changes in senior management) only to the extent that 
such stress events affect the bank's financial strength and viability. 
The commenter noted that a covered bank addresses the operational 
effects of stress events in its other risk management plans (e.g., 
disaster recovery, business continuity). The commenter also stated that 
the Final Guidelines would be inconsistent with Board, Financial 
Stability Board, and European Banking Authority recovery planning 
provisions if they stated that a covered bank's recovery plan should 
address the operational effects of severe stress. The OCC agrees--a 
recovery plan should address the financial, not the operational, 
effects of severe stress.
    The proposal defined the term ``recovery plan'' to include 
restoring a covered bank's ``financial and operational strength and 
viability.'' The same commenter noted that the purpose of a recovery 
plan is to help a covered bank restore its financial, not its 
operational, strength and viability. The commenter stated that covered 
banks address the restoration of operational strength and viability in 
other risk

[[Page 66794]]

management plans (e.g., disaster recovery, business continuity). The 
OCC agrees and has revised the definition of ``recovery plan'' by 
removing ``and operational'' to clarify that the purpose of a recovery 
plan is to help a covered bank restore its financial strength and 
viability. While a recovery plan might address operational stress 
scenarios and identify recovery options that are operational in nature, 
the triggers in the recovery plan should alert the bank to the possible 
or actual financial effects of stress, and the recovery options should 
be designed to restore the bank's financial strength and viability. We 
made conforming changes throughout the document to reflect this change.
    The proposal prohibited reliance on extraordinary government 
support in a recovery plan. The OCC received a comment asking it to 
clarify how this prohibition would apply when a foreign government 
controls a covered bank. While we have not changed the prohibition set 
forth in the definition of ``recovery plan,'' the OCC acknowledges that 
exceptions to this prohibition may exist with respect to support of a 
covered bank by a foreign government. We recommend that an affected 
covered bank discuss this situation with its OCC examiner.
    The OCC received no other comments on these definitions. We have 
clarified, however, several terms defined in the Final Guidelines. 
First, we revised the definition of ``covered bank'' to reflect the 
proposal's preamble statement that ``covered bank'' includes a bank 
with average total consolidated assets of less than $50 billion if it 
was previously a covered bank, unless the OCC determines otherwise. 
Second, we changed the word ``distress'' in the definition of 
``recovery'' to ``stress.'' While the term ``distress'' can be used to 
describe either stress itself or the effect of stress, we intended in 
this context to refer to stress itself. Third, we revised the 
definition of ``trigger'' to clarify that the breach of a trigger, not 
the trigger itself, should be escalated and that the escalation should 
be to senior management. Finally, we have clarified that a trigger 
breach can be escalated to either the board or an appropriate committee 
of the board,\13\ and we have made conforming changes throughout the 
document where necessary to address the role of an appropriate 
committee of the board. Except as otherwise noted above, we are 
adopting these definitions as proposed.
---------------------------------------------------------------------------

    \13\ We received a comment requesting that the OCC be flexible 
in applying provisions of the Final Guidelines referencing the board 
or an appropriate committee of the board to Federal branches, which 
do not have boards of directors. In applying the Final Guidelines to 
insured Federal branches that are covered banks, OCC examiners will 
consult with the branch to determine the appropriate person or 
committee to undertake the responsibilities assigned to the board of 
directors or an appropriate committee of the board under the Final 
Guidelines.
---------------------------------------------------------------------------

Section II: Recovery Plan

    A. Recovery plan. Subsection A of the proposal stated that each 
covered bank should develop and maintain a recovery plan appropriate 
for its individual size, risk profile, activities, and complexity, 
including the complexity of its organizational and legal entity 
structure. In response to this statement, commenters requested that the 
OCC clarify its expectations with regard to the length and detail of 
recovery plans and asked that the Final Guidelines elaborate on a 
covered bank's ability to tailor its recovery plan to its particular 
operations.
    We note that a covered bank's recovery plan need only be as long 
and as detailed as is necessary to satisfy these Final Guidelines. The 
OCC does not have any expectations regarding a plan's length or detail, 
nor does it expect that recovery plans will mirror the length or detail 
of resolution plans. Further, the OCC agrees that a covered bank may 
tailor its recovery plan to its unique size, risk profile, activities, 
and complexity. Therefore, a smaller, less complex bank may have a 
shorter, less complex recovery plan. The stress scenarios, triggers, 
and recovery options appropriate for a covered bank that engages 
primarily in retail and commercial banking are likely to be different 
from those for a covered bank that engages in significant trading or 
capital market activities. Those appropriate for a covered bank that 
engages primarily in domestic activities are likely to be different 
from those for a covered bank with extensive foreign activities. For 
the sake of clarity, we have added language to this description stating 
that a recovery plan should be specific to the unique characteristics 
of each covered bank. We have otherwise adopted this subsection as 
proposed.
    B. Elements of recovery plan. Subsection B set forth the eight 
elements of a recovery plan.
    1. Overview of covered bank. The proposed guidelines stated that a 
recovery plan should include a detailed description of the covered 
bank's overall organizational and legal structure, including its 
material entities, critical operations, core business lines, and core 
management information systems. The proposal stated that this 
description should explain interconnections and interdependencies: (i) 
Across business lines within the covered bank; (ii) with affiliates in 
a bank holding company structure; (iii) between a covered bank and its 
foreign subsidiaries; and (iv) with critical third parties. As 
explained in the proposal's preamble, the OCC used the terms 
``interconnections'' and ``interdependencies'' in a manner consistent 
with FDIC and Board resolution plan regulations. The preamble cited the 
following as examples of interconnections and interdependencies: (i) 
Relationships with respect to credit exposures, investments, or funding 
commitments; (ii) guarantees including an acceptance, endorsement, or 
letter of credit issued for the benefit of an affiliate during normal 
periods, as opposed to during a crisis; and (iii) payment services, 
treasury operations, collateral management, information technology 
(IT), human resources (HR), and other operational functions. It 
explained that the plan should address whether a disruption of these 
interconnections or interdependencies would materially affect the 
covered bank and, if so, how.
    Commenters asked the OCC to confirm in the Final Guidelines that 
other terms, including ``material entities,'' ``critical operations,'' 
and ``core business lines,'' may be interpreted consistent with the use 
of those terms elsewhere, such as resolution planning regulations and 
Heightened Standards. The OCC confirms that a covered bank may include 
in its recovery plan concepts and terms used elsewhere, provided the 
bank's resulting recovery plan is consistent with the Final Guidelines. 
In order to facilitate the OCC's understanding of a covered bank's 
recovery planning process, a bank's recovery plan should indicate which 
key terms are drawn from other sources and identify the sources. 
Otherwise, we adopt this element as proposed.
    2. Triggers. The proposal stated that a recovery plan should 
identify triggers that appropriately reflected a covered bank's 
particular vulnerabilities. As explained in the preamble, in order for 
a covered bank to identify such triggers, the bank should design severe 
stress scenarios that would threaten its critical operations or cause 
it to fail if the bank did not implement one or more recovery options 
in a timely manner. The preamble further explained that these scenarios 
should range from those that cause significant hardship to those that 
bring the covered bank close to default, but not into resolution.
    As explained in the proposal, in designing stress scenarios, a 
covered bank should consider a range of bank-specific and market-wide 
scenarios, individually and in the aggregate, that

[[Page 66795]]

are immediate and prolonged. The proposal explained that a covered bank 
should design the stress scenarios to result in capital shortfalls, 
liquidity pressures, or other significant financial losses. The 
preamble included as examples of bank-specific stress scenarios: Fraud; 
a portfolio shock; a significant cyber attack \14\ or other wide-scale 
operational event; an accounting and tax issue; an event that caused a 
reputational crisis and degraded customer or market confidence; and 
other key stresses that management identified. Although not mentioned 
in the proposal, another example of a covered bank-specific stress 
scenario is the failure of the bank's parent company or a significant 
affiliate.
---------------------------------------------------------------------------

    \14\ As explained in the proposal, a significant cyber attack 
includes an event that has an impact on a covered bank's computer 
network(s) or the computer network(s) of one of its third-party 
service providers and that significantly undermines the covered 
bank's data or processes.
---------------------------------------------------------------------------

    Examples of market-wide stress scenarios included: A disruption of 
domestic or global financial markets; a failure or impairment of 
systemically important financial industry participants, critical 
financial market infrastructure firms, and critical third-party 
relationships; significant changes in debt or equity valuations, 
currency rates, or interest rates; the widespread interruption of 
critical infrastructure that significantly degraded operational 
capability; \15\ and other unfavorable economic conditions. It should 
also be noted that stress scenarios are important tools that a covered 
bank uses to determine areas of vulnerability and to help it identify 
the appropriate triggers. While they need not be included in the plan 
itself, they are a critical part of the planning process and should be 
documented for OCC examiners to consider and discuss with a covered 
bank as part of the agency's overall evaluation of a bank's plan.
---------------------------------------------------------------------------

    \15\ As explained in the proposal, an example of this type of 
interruption includes a disruption to a payment, clearing, or 
settlement system that significantly affects the covered bank's 
ability to access that system.
---------------------------------------------------------------------------

    With respect to the development of stress scenarios, commenters 
requested that the Final Guidelines not require a covered bank to 
develop stress scenarios other than those required for supervisory 
stress tests (i.e., Comprehensive Capital Analysis and Review (CCAR) 
and Dodd-Frank Act Stress Testing (DFAST)). We recognize that the 
scenarios used to conduct supervisory stress tests may be appropriate 
for purposes of identifying triggers under these Final Guidelines. 
However, a covered bank should evaluate those scenarios in the context 
of these Final Guidelines and consider whether different or additional 
scenarios are appropriate, including whether these specific scenarios 
are sufficiently severe to cause the bank to be in recovery--i.e., 
scenarios that bring the bank to the brink of resolution.
    The proposal's discussion of the triggers that a covered bank 
should include in its recovery plan explained that these triggers 
should address a continuum of increasingly severe stress, ranging from 
triggers that provide a warning of the likely occurrence of severe 
stress to those that indicate the actual existence of severe stress. It 
stated that the number and nature of triggers should be appropriate for 
the covered bank's size, risk profile, activities, and complexity. As 
the proposal further explained, the nature of a trigger should inform 
the nature of the response. For example, the preamble stated that, in 
some situations, the appropriate response to the breach of a trigger 
should be enhanced monitoring; in other situations, the breach of a 
trigger should result in activating a more specific recovery option set 
forth in the plan or taking other corrective action. As the proposal 
noted, however, the breach of a particular trigger does not necessarily 
correspond to a single recovery option; instead, more than one option 
may be appropriate when a particular trigger is breached.
    The preamble to the proposal stated that quantitative triggers 
included changes in covered bank-specific indicators that reflect the 
covered bank's capital or liquidity position. The proposal stated that 
a covered bank should also consider quantitative triggers other than 
capital or liquidity that may have an impact on its condition, such as 
a rating downgrade; access to credit and borrowing lines; equity 
ratios; profitability; asset quality; or other macroeconomic 
indicators. It also noted that a covered bank should be prepared to act 
if it is at risk, regardless of whether a trigger has been breached or 
the recovery plan includes options that specifically addressed the 
problems the bank faced.
    The proposal also stated that qualitative triggers would include 
the unexpected departure of senior leadership; the erosion of 
reputation or market standing; the impact of an adverse legal ruling; 
and a material operational event that affects the covered bank's 
ability to access critical services or to deliver products or services 
to its customers for a material period of time. In retrospect, we 
believe these scenarios more accurately describe stress events that may 
affect a covered bank's financial strength and viability than triggers 
that indicate the stress. However, while we anticipate that most 
triggers will be quantitative indicators, we have retained the 
reference to qualitative indicators that have a financial effect on a 
bank to allow for those that a bank may identify.
    The proposal noted that a covered bank should review and update its 
triggers, as necessary, to take into account changes in laws and 
regulations and other material events. In addition, it stated that a 
covered bank should consider any regulatory or legal consequences 
resulting from the breach of a particular trigger. We made no changes 
to this element and adopt it as proposed.
    3. Options for recovery. The proposed guidelines stated that a 
recovery plan should identify a wide range of credible options that a 
covered bank could undertake to restore its financial and operational 
strength and viability, thereby allowing the bank to continue to 
operate as a going concern and avoid liquidation or resolution. The 
proposed guidelines further provided that a recovery plan should 
explain how the covered bank would carry out each recovery option, 
describe the timing for each option, and identify options that require 
regulatory or legal approval.
    The preamble to the proposal explained that the recovery plan 
should include a description of the decision-making process for 
implementing each option, outline the steps the bank will follow, 
identify the critical parties to carry out each option, and address 
timing considerations. It also stated that a recovery plan should 
identify obstacles to executing an option and set out mitigation 
strategies to address these obstacles. Finally, the preamble provided 
that the plan should identify those options that would require 
regulatory or legal approval and, consistent with the proposal's 
definition of ``recovery plan,'' that neither the plan nor the options 
may assume or rely on any extraordinary government support.\16\
---------------------------------------------------------------------------

    \16\ The role of extraordinary governmental support in the 
recovery plans of covered banks that are controlled by a foreign 
government is discussed above.
---------------------------------------------------------------------------

    The preamble noted that a covered bank should be able to execute 
plan options within time frames that would allow the options to be 
effective during periods of stress. It also provided examples of 
recovery options, including the conservation or restoration of 
liquidity and capital; the sale, transfer, or disposal of significant 
assets, portfolios, or business lines; steps that reduce the covered 
bank's risk profile;

[[Page 66796]]

the restructuring of liabilities; the activation of emergency 
protocols; organizational restructuring, including divesting legal 
entities in order to simplify the covered bank's structure; and 
implementing succession planning. To facilitate an understanding of how 
the stress scenarios, triggers, and options relate to each other, the 
proposal included the following chart:

------------------------------------------------------------------------
                                                       Possible options
    Examples of severe stress      Possible triggers    in response to
            scenarios                                      triggers
------------------------------------------------------------------------
Idiosyncratic stress: Trading      Tier 1      Issue new
 losses caused by a rogue trader.  capital falls       capital.
                                   below 6%.           Sell
                                   Liquidity   nonstrategic
                                   falls below         assets or
                                   internal bank       businesses.
                                   policy              Reduce
                                   requirements.       loan originations
                                                       or commitments.
Systemic stress: Significant       Short-      Sell
 decline in U.S. gross domestic    term credit         strategic assets
 product, coupled with an          rating falls        or businesses.
 increase in the U.S.              below A-3.          Reduce
 unemployment rate and a                       expenses (e.g.,
 deterioration in U.S.             Nonperforming       business
 residential housing market.       loans rise above    contractions).
                                   a specified         Access
                                   percentage.         the Board's
                                   Market      Discount Window.
                                   capitalization
                                   falls below a
                                   specific limit
                                   for a certain
                                   period of time.
------------------------------------------------------------------------

    As discussed above, the OCC has clarified that the recovery options 
detailed in a recovery plan are those that respond to the financial 
effects of severe stress. To effect this clarification in this element 
of the plan, we have removed ``and operational'' from the description 
of the options for recovery in the Final Guidelines. We otherwise adopt 
this element as proposed. The OCC also notes that a covered bank should 
not view the options in its plan as exclusive or a specific trigger as 
necessitating the execution of a particular option. Rather, a covered 
bank should use its judgment to determine the most appropriate options 
for the bank to take during a period of severe stress.
    4. Impact assessments. The proposed guidelines provided that, for 
each recovery option, a covered bank should assess and describe how the 
option would affect the covered bank. The guidelines stated that this 
impact assessment and description should specify the procedures the 
covered bank would use to maintain the financial and operational 
strength and viability of its material entities, critical operations, 
and core business lines for each recovery option. For each option, the 
recovery plan's impact assessment should address: (i) The effect on the 
covered bank's capital, liquidity, funding, and profitability; (ii) the 
effect on its material entities, critical operations, and core business 
lines, including reputational impact; and (iii) any legal or market 
impediment or regulatory requirement that the bank would need to 
address or satisfy to implement the option.\17\
---------------------------------------------------------------------------

    \17\ Although not mentioned in the proposal, we note that a 
covered bank's assessment of the legal or market impediments or 
regulatory requirements relevant to its recovery options should 
address any timing issues presented by these impediments or 
requirements.
---------------------------------------------------------------------------

    As the preamble explained, the assessment should analyze the effect 
each option would have on the covered bank, including its internal 
operations (e.g., IT systems, suppliers, HR operations) and its access 
to market infrastructure (e.g., clearing and settlement facilities, 
payment systems, additional collateral requirements). The OCC received 
no comments on this provision. Consistent with the discussion above, 
however, we have removed ``and operational.'' Otherwise, we make no 
material changes to this element as proposed.
    5. Escalation procedures. The proposed guidelines stated that a 
recovery plan should clearly outline the process for escalating 
decision-making to senior management or the board, as appropriate, in 
response to the breach of a trigger. The proposal also stated that the 
plan should identify the departments and persons responsible for making 
and executing these decisions and describe the process for informing 
stakeholders (e.g., shareholders, counsel, accountants, regulators) 
when necessary. As the preamble explained, at a minimum, the escalation 
procedures should result in the covered bank taking action before 
remedial supervisory action is necessary.
    The OCC received no substantive comments on this element of the 
plan. However, we have clarified that the breach of any trigger should 
be escalated, which is consistent with the definition of ``trigger.'' 
In addition, we have clarified that the recovery plan should identify 
the departments and persons responsible for executing the decisions of 
senior management or the board (or an appropriate committee of the 
board). Otherwise, we have adopted this element as proposed.
    6. Management reports. The proposed guidelines stated that a 
recovery plan should require reports that provide management or the 
board with sufficient data and information to make timely decisions 
regarding the appropriate actions necessary to respond to the breach of 
a trigger. As explained in the preamble, the reports to management or 
the board should allow them to monitor the covered bank's progress in 
response to the actions taken under the recovery plan. The OCC received 
no comments on this element of the plan. As a clarification, however, 
the OCC has amended the Final Guidelines to state that reports should 
be made to senior management. Otherwise, we adopt the language as 
proposed.
    7. Communication procedures. As provided in the proposed 
guidelines, a recovery plan should provide that the covered bank notify 
the OCC of any significant breach of a trigger and any action taken or 
to be taken in response to such breach and explain the process for 
deciding when a breach of a trigger is significant. The preamble noted 
that a covered bank should work closely with the OCC when executing its 
recovery plan.
    The proposal also stated that a recovery plan should address when 
and how the covered bank will notify persons within the organization 
and other external parties of its actions under the recovery plan. This 
notice is to ensure that all stakeholders are informed in a timely 
manner of how the covered bank has responded or is responding to a 
breach of a trigger. In addition, the proposed guidelines stated that 
the recovery plan should identify how the covered bank would obtain 
required regulatory or legal approvals, in order to ensure that the 
bank receives such approval(s) in a timely manner. The OCC received no 
comments on this element of a recovery plan, and we adopt it as 
proposed.
    8. Other information. As set forth in the proposed guidelines, a 
recovery plan should include any other information that the OCC 
communicates in writing directly to the covered bank regarding the 
bank's recovery plan. The preamble also stated that a well-developed 
recovery plan should consider relevant information included in other 
written

[[Page 66797]]

OCC or Federal Financial Institutions Examination Council material. The 
OCC received no comments on this element of a recovery plan, and we 
adopt it as proposed.
    C. Relationship to other processes; coordination with other plans. 
The proposed guidelines stated that a covered bank should integrate its 
recovery plan into its corporate governance and risk management 
functions and coordinate its recovery planning with its strategic; 
operational (including business continuity); contingency; capital 
(including stress testing); liquidity; and resolution planning. As the 
OCC explained in the preamble, in many cases, these plans may be 
interconnected and require the covered bank to coordinate among them.
    The proposed guidelines also stated that, to the extent possible, a 
covered bank should align its recovery plan with any recovery and 
resolution planning efforts by the covered bank's holding company, so 
that the plans are consistent with and do not contradict each other. As 
the OCC stated in the preamble, some inconsistencies may be unavoidable 
because recovery planning and resolution planning differ: Recovery 
planning addresses a bank as a going concern; resolution planning 
starts from the point of an entity's non-viability. In addition, the 
preamble noted that covered banks are an integral part of bank holding 
company recovery and resolution plans; as a result, it stated that a 
covered bank might be able to leverage certain elements in these other 
plans. As an example, the proposal referenced resolution plans, which 
typically require a bank to map its critical operations. It noted that 
this mapping exercise might be useful to the bank's recovery plan 
description of interconnections and interdependencies.
    The OCC received several comments on this element of the plan 
requesting the OCC to confirm that covered banks are permitted to 
leverage existing processes, such as those for stress testing, 
resolution planning, contingency planning, risk governance, and holding 
company recovery plans, when developing recovery plans. One commenter 
requested that the Final Guidelines permit a covered bank to use its 
holding company's recovery plan to satisfy its obligations under the 
Final Guidelines, if the risk profiles of both entities are 
substantially the same. Another commenter asserted that a covered bank 
should be permitted to leverage its existing governance structure to 
satisfy its management and board responsibilities under these Final 
Guidelines.
    As explained in the preamble to the proposal, the OCC recognizes 
that many covered banks already engage in significant planning, 
including planning responses to cyber attacks, business interruptions, 
and leadership vacancies. Some banks also undertake a range of other 
planning, including strategic, contingency, capital (including stress 
testing), liquidity, and resolution. The same is true for their parent 
holding companies or affiliates. As also noted in the proposal, we do 
not intend for the recovery planning described in these Final 
Guidelines to be needlessly burdensome or duplicative of these other 
planning processes. The OCC expects, however, that a covered bank's 
recovery plan will identify the recovery strategies that are specific 
to that bank and, as appropriate, distinguishable from the recovery 
strategies of its holding company or affiliates. Furthermore, while we 
encourage covered banks to leverage their existing processes, including 
by incorporating or cross-referencing portions or elements of relevant 
plans, in most cases, it is unlikely that a covered bank will be able 
to use a plan prepared for another purpose or entity to satisfy the 
Final Guidelines.\18\ As we have noted previously, the purpose of these 
Final Guidelines is to provide a comprehensive framework for evaluating 
how severe stress would financially affect a covered bank specifically 
and the recovery options that would allow that bank to remain viable 
under such stress.
---------------------------------------------------------------------------

    \18\ When a covered bank comprises a substantial percentage of 
its holding company's assets (i.e., 95%), the holding company's 
recovery plan, if any, may serve as the bank's recovery plan, 
provided that such plan satisfies these Final Guidelines.
---------------------------------------------------------------------------

    The OCC is making several changes to this provision as proposed. 
First, we have revised this subsection so that the Final Guidelines 
themselves state that a covered bank's recovery plan should be specific 
to the unique characteristics of that bank. Second, we are clarifying 
that the other plans identified in the proposed guidelines with which a 
covered bank should coordinate its recovery planning is not an 
exclusive list. Instead, these are examples of other types of plans. 
Third, we are replacing the phrase ``risk management and corporate 
governance'' with ``risk governance,'' which we believe incorporates 
the concepts of both risk management and corporate governance as it 
relates to risk management. Other than these and other minor changes, 
we adopt this provision as proposed.

Section III: Management's and the Board's Responsibilities

    Section III of the proposed guidelines addressed the 
responsibilities of a covered bank's management and board with respect 
to the recovery plan and stated that these responsibilities should be 
included in the bank's recovery plan.
    The proposed guidelines provided that management should review its 
bank's recovery plan at least annually and in response to a material 
event. It further stated that management should revise the plan as 
necessary to reflect material changes in the covered bank's size, risk 
profile, activities, and complexity, as well as changes in external 
threats. The preamble explained that during this review, management 
should consider the ongoing relevance and applicability of the stress 
scenarios used to identify the plan's triggers and revise the recovery 
plan as needed.
    The proposed guidelines also stated that management's review should 
include evaluating the covered bank's organizational structure and its 
effectiveness in facilitating recovery. The preamble explained that 
this review should include its legal structure, number of entities, 
geographical footprint, booking practices (e.g., guarantees, 
exposures), and servicing arrangements. The preamble stated that both 
management and the board should provide justification for the covered 
bank's organizational and legal structures and outline changes that 
would enhance their ability to oversee the covered bank in times of 
stress. As explained in the preamble, a more rational legal structure 
can provide a clearer path to recovery and the operational flexibility 
necessary to implement a recovery plan.
    Several commenters requested that the OCC recognize the need for a 
covered bank to have flexibility regarding the timing of management's 
annual review of its recovery plan. These commenters explained that 
this flexibility would facilitate a covered bank's ability to meet 
deadlines associated with other requirements, such as stress testing. 
The OCC agrees that management should have flexibility to conduct its 
annual reviews on its preferred schedule. As noted in the proposal, OCC 
examiners will assess the appropriateness and adequacy of the covered 
bank's ongoing recovery planning process as part of the agency's 
regular supervisory activities, which we believe will provide covered 
banks with the flexibility they need.
    Commenters also requested the OCC to clarify that it is not 
necessary for

[[Page 66798]]

management to recommend changes to a covered bank's organizational and 
legal entity structure as part of every annual review of the bank's 
recovery plan. The OCC agrees that a covered bank's management should 
only recommend changes to a bank's organizational and legal entity 
structure when such changes are necessary or appropriate.
    The proposed guidelines also stated that the board is responsible 
for overseeing the covered bank's recovery planning process. As part of 
this oversight, the preamble explained that the board should work 
closely with the bank's senior management in developing and executing 
the recovery plan. The proposed guidelines also stated that a covered 
bank's board, or an appropriate committee of the board, should review 
and approve the bank's recovery plan at least annually and as needed to 
address any changes made by management.
    A number of commenters expressed concern that the preamble's use of 
``developing and executing'' to describe a covered bank board's role 
with respect to a recovery plan is inconsistent with a board's 
traditional oversight role. It is not the OCC's intent to expand the 
board's role, and we note that the regulatory text in both the proposal 
and Final Guidelines describe the role of the board as ``oversight.''
    Commenters also asked the OCC to clarify that a covered bank's 
board need only review and approve a bank's plan yearly, and as 
necessary to address significant, as opposed to all, changes to a plan. 
We have amended the Final Guidelines to reflect this and otherwise 
adopt this section as proposed.

Description of Technical Amendments to Part 30

    We also are including with these Final Guidelines technical and 
conforming amendments to the part 30 regulations to add references to 
new Appendix E, which contains the Final Guidelines, where appropriate.

Regulatory Analysis

Paperwork Reduction Act

    The OCC has determined that the Final Guidelines include 
collections of information pursuant to the provisions of the Paperwork 
Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et seq.). In accordance 
with PRA, the OCC may not conduct or sponsor, and an organization is 
not required to respond to, an information collection unless the 
information collection displays a currently valid Office of Management 
and Budget (OMB) control number. The OCC submitted the information 
collections contained in the proposed guidelines to OMB for review and 
approval, pursuant to 44 U.S.C. 3506 and section 1320.11 of the OMB 
implementing regulations (5 CFR part 1320). OMB instructed the OCC to 
examine any public comments it received in response to the proposed PRA 
estimate and to describe in the supporting statement of its next 
collection any relevant comments, as well as the OCC's response to such 
comments. The OCC has re-submitted the information collections to OMB 
in connection with the final rule.
    The collections of information that are subject to the PRA in these 
Final Guidelines are found in 12 CFR part 30, appendix E, sections 
II.B., II.C., and III. Section II.B. of this appendix specifies the 
elements of the recovery plan, including an overview of the covered 
bank; triggers; options for recovery; impact assessments; escalation 
procedures; management reports; and communication procedures. Section 
II.C. of this appendix addresses the relationship of the plan to other 
covered bank processes and coordination with other plans, including the 
processes and plans of its bank holding company. Section III of this 
appendix outlines management's and the board's responsibilities.
    We received one comment on our proposed information collection from 
an individual, which addressed all four of the questions below. First, 
the commenter argued that a stress event that threatens the viability 
of a covered bank is the result of either an event that the bank could 
not have foreseen or failed prudential supervision by the OCC. In 
either case, the commenter argued, a recovery plan will be useless. In 
addition, this commenter argued that if a covered bank treats its 
recovery plan like a prescriptive playbook, the plan will fail and, 
alternatively, if a recovery plan only provides guidelines, the plan 
will have no practical utility.
    In response, as noted above, the OCC believes that stress scenarios 
are important tools that a covered bank uses to determine areas of 
vulnerability and help it identify the appropriate triggers. The OCC 
understands that a covered bank's recovery planning process will not 
result in a plan that identifies every trigger and option for every 
possible scenario--but we do believe that the processes of recovery 
planning and codification of a plan will help a covered bank manage the 
stresses it encounters. With respect to the role of a recovery plan 
during a period of severe stress, as noted above, a covered bank should 
use its judgment to determine the most appropriate options for the bank 
to take to preserve its financial strength and viability.
    The commenter also stated that the OCC's burden estimate was too 
low. The OCC believes that its original estimate was realistic given 
the requirements of the proposed guidelines and has included the same 
estimate in the Final Guidelines. We have adjusted, however, the 
estimate of respondents to reflect the most recent data available.
    In addition, the commenter stated that the agency could enhance the 
quality and utility of the information collection by requiring only 
triggers and response options in its plans. In response, as noted 
above, the OCC believes that stress scenarios are important tools that 
a covered bank uses to determine areas of vulnerability and identify 
appropriate triggers. We include the overview of the covered bank as a 
plan element because a covered bank's organizational and legal entity 
structure is likely to change often; its inclusion will both ensure 
that the bank consider the entire organization in the development of 
its plan and assist the bank in understanding the recovery plan's 
relationship with its other planning efforts.
    The commenter also stated that the proposed information collection 
is duplicative of and redundant to information that the OCC currently 
collects. In response, the OCC recognizes that some information 
necessary for recovery planning may have been compiled or provided to 
the OCC for other purposes. However, we believe that it is necessary 
for a covered bank to assemble this information in the context of 
recovery planning in order to develop an appropriate plan to respond to 
future stresses. We encourage, however, covered banks to leverage, 
including by cross-referencing if appropriate, this prior work. 
Finally, the commenter argued that it is burdensome to ask a covered 
bank to connect its recovery plan with its other plans. In response, 
the OCC notes that a covered bank's various plans are not intended to 
operate in a vacuum and must be compatible with each other in order to 
be effective.
    Title: OCC Guidelines Establishing Standards for Recovery Planning 
by Certain Large Insured National Banks, Insured Federal Savings 
Associations, and Insured Federal Branches
    OMB Control No.: To be assigned by OMB.
    Frequency of Response: On occasion.
    Affected Public: Businesses or other for-profit organizations.
    Burden Estimates:
    Total Number of Respondents: 25.

[[Page 66799]]

    Total Burden per Respondent: 7,543 hours.
    Total Burden for Collection: 188,575 hours.
    Comments should be submitted as provided below and continue to be 
invited on: (1) Whether the proposed collection of information is 
necessary for the proper performance of the OCC's functions, including 
whether the information has practical utility; (2) the accuracy of the 
OCC's estimate of the burden of the proposed information collection, 
including the cost of compliance; (3) ways to enhance the quality, 
utility, and clarity of the information to be collected; and (4) ways 
to minimize the burden of information collection on respondents, 
including through the use of automated collection techniques or other 
forms of IT.
    Because paper mail may be subject to delay, commenters are 
encouraged to submit comments by email to regs.comments@occ.treas.gov, 
if possible. Alternatively, comments may be mailed to Legislative and 
Regulatory Activities Division, Office of the Comptroller of the 
Currency, Attention: 1557-0321, 400 7th Street SW., Suite 3E-218, Mail 
Stop 9W-11, Washington, DC 20219 or faxed to (571) 465-4326. 
Additionally, commenters should send a copy of their comments to the 
OCC's OMB desk officer by: mail to Office of Information and Regulatory 
Affairs, U.S. Office of Management and Budget, New Executive Office 
Building, Room 10235, 725 17th Street NW., Washington, DC 20503; fax to 
(202) 395-6974; or email to oira.submission@omb.eop.gov.
    You may personally inspect and photocopy comments at the OCC, 400 
7th Street SW., Washington, DC 20219. For security reasons, the OCC 
requires that visitors make an appointment to inspect comments. You may 
do so by calling (202) 649-6700. Upon arrival, visitors will be 
required to present valid government-issued photo identification and 
submit to a security screening.
    All comments received, including attachments and other supporting 
materials, are part of the public record and subject to public 
disclosure. Do not enclose any information in your comment or 
supporting materials that you consider confidential or inappropriate 
for public disclosure.
    You may request additional information on the collection from 
Shaquita Merritt, Program Specialist, at (202) 649-6302 or, for persons 
who are deaf or hard of hearing, TTY, (202) 649-5597, Legislative and 
Regulatory Activities Division, Office of the Comptroller of the 
Currency, 400 7th Street SW., Suite 3E-218, Mail Stop 9W-11, 
Washington, DC 20219.

Regulatory Flexibility Analysis

    Pursuant to section 605(b) of the Regulatory Flexibility Act, 5 
U.S.C. 605(b) (RFA), the regulatory flexibility analysis otherwise 
required under section 603 of the RFA is not required if the agency 
certifies that a rule will not have a significant economic impact on a 
substantial number of small entities (defined for purposes of the RFA 
to include commercial banks and savings institutions with assets less 
than or equal to $550 million and trust companies with assets less than 
or equal to $38.5 million) and publishes this certification and a 
short, explanatory statement in the Federal Register with the rule. The 
OCC has determined that the Final Guidelines will have no impact on 
small entities. The Final Guidelines apply only to insured national 
banks, insured Federal savings associations, and insured Federal 
branches of foreign banks with $50 billion or more in average total 
consolidated assets. Although the Final Guidelines reserve the OCC's 
authority to apply them to an insured national bank, insured Federal 
savings association, or insured Federal branch of a foreign bank with 
less than $50 billion in average total consolidated assets if the OCC 
determines such entity is highly complex or otherwise presents a 
heightened risk, the OCC does not expect to determine any small 
entities to be highly complex or otherwise to present a heightened 
risk. Therefore, the OCC certifies that these Final Guidelines will not 
have a significant economic impact on a substantial number of small 
entities.

Unfunded Mandates Reform Act Analysis

    In accordance with section 202 of the Unfunded Mandates Reform Act 
of 1995 (2 U.S.C. 1532), the OCC prepares a budgetary impact statement 
before promulgating any rule that includes a Federal mandate that may 
result in the expenditure by State, local, and tribal governments, in 
the aggregate, or by the private sector, of $100 million or more in any 
one year (adjusted annually for inflation). The OCC has determined that 
these Final Guidelines will not result in expenditures by State, local, 
and tribal governments, in the aggregate, or by the private sector, of 
$100 million or more in any one year (adjusted annually for inflation). 
Accordingly, the OCC has not prepared a budgetary impact statement.

Consideration of Administrative Burdens and Benefits and Effective Date

    Section 302(a) of the Riegle Community Development and Regulatory 
Improvement Act of 1994 (CDRI) (12 U.S.C. 4802(a)) requires the OCC, in 
determining the effective date and administrative compliance 
requirements for new regulations that impose additional reporting, 
disclosure, or other requirements on insured depository institutions, 
to consider, consistent with the principles of safety and soundness and 
the public interest, (1) any administrative burdens that such 
regulations would place on depository institutions, including small 
depository institutions and customers of depository institutions; and 
(2) the benefits of such regulations. In determining the effective date 
and administrative compliance requirements for these Final Guidelines, 
the OCC has considered these burdens and benefits, including the 
requests of commenters for a phased-in compliance period. To this end, 
the Final Guidelines include phased-in compliance dates and recognize 
the need for flexibility with respect to the timing of management's 
annual recovery plan review.
    Section 302(b) of CDRI (12 U.S.C. 4802(a)) requires that new OCC 
regulations, which impose additional reporting, disclosures, or other 
new requirements on insured depository institutions, take effect on the 
first day of a calendar quarter which begins on or after the date on 
which the regulations are published in final form, subject to certain 
exceptions not relevant here. This is in addition to the requirement in 
section 553(d) (5 U.S.C. 553(d)) of the Administrative Procedure Act, 
which requires that a substantive rule be effective no fewer than 30 
days after its publication, subject to certain exceptions not relevant 
here. The effective date of these Final Guidelines is consistent with 
these requirements.

List of Subjects in 12 CFR Part 30

    Banks, Banking, Consumer protection, National banks, Privacy, 
Safety and soundness, Reporting and recordkeeping requirements.

    For the reasons set forth in the preamble, and under the authority 
of 12 U.S.C. 93a, chapter I of title 12 of the Code of Federal 
Regulations is amended as follows:

PART 30--SAFETY AND SOUNDNESS STANDARDS

0
1. The authority citation for part 30 continues to read as follows:


[[Page 66800]]


    Authority:  12 U.S.C. 1, 93a, 371, 1462a, 1463, 1464, 1467a, 
1818, 1828, 1831p-1, 1881-1884, 3102(b) and 5412(b)(2)(B); 15 U.S.C. 
1681s, 1681w, 6801, and 6805(b)(1).


Sec.  30.1   [Amended]

0
2. Section 30.1 is amended by removing, in paragraph (a), ``appendices 
A, B, C, and D'' and adding in its place ``appendices A, B, C, D, and 
E''.

0
3. Section 30.2 is amended by adding a sentence at the end of the 
paragraph to read as follows:


Sec.  30.2   Purpose.

    * * * The OCC Guidelines Establishing Standards for Recovery 
Planning by Certain Large Insured National Banks, Insured Federal 
Savings Associations, and Insured Federal Branches are set forth in 
appendix E to this part.


Sec.  30.3   [Amended]

0
4. Section 30.3 is amended in paragraph (a) by removing ``the OCC 
Guidelines Establishing Standards for Residential Mortgage Lending 
Practices set forth in appendix C to this part, or the OCC Guidelines 
Establishing Heightened Standards for Certain Large Insured National 
Banks, Insured Federal Savings Associations, and Insured Federal 
Branches set forth in appendix D to this part'' and adding in its place 
``the OCC Guidelines Establishing Standards for Residential Mortgage 
Lending Practices set forth in appendix C to this part, the OCC 
Guidelines Establishing Heightened Standards for Certain Large Insured 
National Banks, Insured Federal Savings Associations, and Insured 
Federal Branches set forth in appendix D to this part, or the OCC 
Guidelines Establishing Standards for Recovery Planning by Certain 
Large Insured National Banks, Insured Federal Savings Associations, and 
Insured Federal Branches set forth in appendix E to this part''.

0
5. Appendix E is added to part 30 to read as follows:

Appendix E to Part 30--OCC Guidelines Establishing Standards for 
Recovery Planning by Certain Large Insured National Banks, Insured 
Federal Savings Associations, and Insured Federal Branches

Table of Contents

I. Introduction
    A. Scope
    B. Compliance date
    C. Reservation of authority
    D. Preservation of existing authority
    E. Definitions
II. Recovery Plan
    A. Recovery plan
    B. Elements of recovery plan
    1. Overview of covered bank
    2. Triggers
    3. Options for recovery
    4. Impact assessments
    5. Escalation procedures
    6. Management reports
    7. Communication procedures
    8. Other information
    C. Relationship to other processes; coordination with other 
plans
III. Management's and Board of Directors' Responsibilities
    A. Management
    B. Board of directors

I. Introduction

    A. Scope. This appendix applies to a covered bank, as defined in 
paragraph I.E.3. of this appendix.
    B. Compliance date.
    1. A covered bank with average total consolidated assets, 
calculated according to paragraph I.E.1. of this appendix, equal to or 
greater than $750 billion as of January 1, 2017 should comply with this 
appendix within 6 months from January 1, 2017.
    2. A covered bank with average total consolidated assets, 
calculated according to paragraph I.E.1. of this appendix, equal to or 
greater than $100 billion but less than $750 billion as of January 1, 
2017 should comply with this appendix within 12 months from January 1, 
2017.
    3. A covered bank with average total consolidated assets, 
calculated according to paragraph I.E.1. of this appendix, equal to or 
greater than $50 billion but less than $100 billion as of January 1, 
2017 should comply with this appendix within 18 months from January 1, 
2017.
    4. A bank with average total consolidated assets, calculated 
according to paragraph I.E.1. of this appendix, of less than $50 
billion as of January 1, 2017 but which subsequently becomes a covered 
bank should comply with this appendix within 18 months of becoming a 
covered bank.
    C. Reservation of authority.
    1. The OCC reserves the authority:
    a. To apply this appendix, in whole or in part, to a bank that has 
average total consolidated assets of less than $50 billion, if the OCC 
determines such bank is highly complex or otherwise presents a 
heightened risk that warrants the application of this appendix; or
    b. To determine that compliance with this appendix should not be 
required for a covered bank. The OCC will generally make this 
determination if a covered bank's operations are no longer highly 
complex or no longer present a heightened risk.
    2. In determining whether a bank or covered bank is highly complex 
or presents a heightened risk, the OCC will consider the bank's size, 
risk profile, scope of operations, activities, and complexity, 
including the complexity of its organizational and legal entity 
structure. Before exercising the authority reserved by paragraph I.C.1. 
of this appendix, the OCC will apply notice and response procedures in 
the same manner and to the same extent as the notice and response 
procedures in 12 CFR 3.404.
    D. Preservation of existing authority. Neither section 39 of the 
Federal Deposit Insurance Act (12 U.S.C. 1831p-1) nor this appendix in 
any way limits the authority of the OCC to address unsafe or unsound 
practices or conditions or other violations of law. The OCC may take 
action under section 39 and this appendix independently of, in 
conjunction with, or in addition to any other enforcement action 
available to the OCC.
    E. Definitions.
    1. Average total consolidated assets means the average total 
consolidated assets of the bank or the covered bank, as reported on the 
bank's or the covered bank's Consolidated Reports of Condition and 
Income for the four most recent consecutive quarters.
    2. Bank means any insured national bank, insured Federal savings 
association, or insured Federal branch of a foreign bank.
    3. Covered bank means any bank:
    a. With average total consolidated assets equal to or greater than 
$50 billion;
    b. With average total consolidated assets of less than $50 billion 
if the bank was previously a covered bank, unless the OCC determines 
otherwise; or
    c. With average total consolidated assets less than $50 billion, if 
the OCC determines that such bank is highly complex or otherwise 
presents a heightened risk as to warrant the application of this 
appendix pursuant to paragraph I.C.1.a. of this appendix.
    4. Recovery means timely and appropriate action that a covered bank 
takes to remain a going concern when it is experiencing or is likely to 
experience considerable financial or operational stress. A covered bank 
in recovery has not yet deteriorated to the point where liquidation or 
resolution is imminent.
    5. Recovery plan means a plan that identifies triggers and options 
for responding to a wide range of severe internal and external stress 
scenarios to restore a covered bank that is in recovery to financial 
strength and viability in a timely manner. The options should maintain 
the confidence of market participants, and neither the plan nor the 
options may assume or rely on any extraordinary government support.

[[Page 66801]]

    6. Trigger means a quantitative or qualitative indicator of the 
risk or existence of severe stress, the breach of which should always 
be escalated to senior management or the board of directors (or 
appropriate committee of the board of directors), as appropriate, for 
purposes of initiating a response. The breach of any trigger should 
result in timely notice accompanied by sufficient information to enable 
management of the covered bank to take corrective action.

II. Recovery Plan

    A. Recovery plan. Each covered bank should develop and maintain a 
recovery plan that is specific to that covered bank and appropriate for 
its individual size, risk profile, activities, and complexity, 
including the complexity of its organizational and legal entity 
structure.
    B. Elements of recovery plan. A recovery plan under paragraph II.A. 
of this appendix should include the following elements:
    1. Overview of covered bank. A recovery plan should describe the 
covered bank's overall organizational and legal entity structure, 
including its material entities, critical operations, core business 
lines, and core management information systems. The plan should 
describe interconnections and interdependencies (i) across business 
lines within the covered bank, (ii) with affiliates in a bank holding 
company structure, (iii) between a covered bank and its foreign 
subsidiaries, and (iv) with critical third parties.
    2. Triggers. A recovery plan should identify triggers that 
appropriately reflect the covered bank's particular vulnerabilities.
    3. Options for recovery. A recovery plan should identify a wide 
range of credible options that a covered bank could undertake to 
restore financial strength and viability, thereby allowing the bank to 
continue to operate as a going concern and to avoid liquidation or 
resolution. A recovery plan should explain how the covered bank would 
carry out each option and describe the timing required for carrying out 
each option. The recovery plan should specifically identify the 
recovery options that require regulatory or legal approval.
    4. Impact assessments. For each recovery option, a covered bank 
should assess and describe how the option would affect the covered 
bank. This impact assessment and description should specify the 
procedures the covered bank would use to maintain the financial 
strength and viability of its material entities, critical operations, 
and core business lines for each recovery option. For each option, the 
recovery plan's impact assessment should address the following:
    a. The effect on the covered bank's capital, liquidity, funding, 
and profitability;
    b. The effect on the covered bank's material entities, critical 
operations, and core business lines, including reputational impact; and
    c. Any legal or market impediment or regulatory requirement that 
must be addressed or satisfied in order to implement the option.
    5. Escalation procedures. A recovery plan should clearly outline 
the process for escalating decision-making to senior management or the 
board of directors (or an appropriate committee of the board of 
directors), as appropriate, in response to the breach of any trigger. 
The recovery plan should also identify the departments and persons 
responsible for executing the decisions of senior management or the 
board of directors (or an appropriate committee of the board of 
directors).
    6. Management reports. A recovery plan should require reports that 
provide senior management or the board of directors (or an appropriate 
committee of the board of directors) with sufficient data and 
information to make timely decisions regarding the appropriate actions 
necessary to respond to the breach of a trigger.
    7. Communication procedures. A recovery plan should provide that 
the covered bank notify the OCC of any significant breach of a trigger 
and any action taken or to be taken in response to such breach and 
should explain the process for deciding when a breach of a trigger is 
significant. A recovery plan also should address when and how the 
covered bank will notify persons within the organization and other 
external parties of its action under the recovery plan. The recovery 
plan should specifically identify how the covered bank will obtain 
required regulatory or legal approvals.
    8. Other information. A recovery plan should include any other 
information that the OCC communicates in writing directly to the 
covered bank regarding the covered bank's recovery plan.
    C. Relationship to other processes; coordination with other plans. 
The covered bank should integrate its recovery plan into its risk 
governance functions. The covered bank also should align its recovery 
plan with its other plans, such as its strategic; operational 
(including business continuity); contingency; capital (including stress 
testing); liquidity; and resolution planning. The covered bank's 
recovery plan should be specific to that covered bank. The covered bank 
also should coordinate its recovery plan with any recovery and 
resolution planning efforts by the covered bank's holding company, so 
that the plans are consistent with and do not contradict each other.

III. Management's and Board of Directors' Responsibilities

    The recovery plan should address the following management and board 
responsibilities:
    A. Management. Management should review the recovery plan at least 
annually and in response to a material event. It should revise the plan 
as necessary to reflect material changes in the covered bank's size, 
risk profile, activities, and complexity, as well as changes in 
external threats. This review should evaluate the organizational 
structure and its effectiveness in facilitating a recovery.
    B. Board of directors. The board is responsible for overseeing the 
covered bank's recovery planning process. The board of directors (or an 
appropriate committee of the board of directors) of a covered bank 
should review and approve the recovery plan at least annually, and as 
needed to address significant changes made by management.

    Dated: September 21, 2016.
Thomas J. Curry,
Comptroller of the Currency.
[FR Doc. 2016-23366 Filed 9-28-16; 8:45 am]
 BILLING CODE 4810-33-P