Investment Securities: Risk Management and Lessons Learned

Background And Purpose

The ongoing credit crisis and weak economic environment have given rise to numerous difficulties in managing bank investment portfolios. Relaxed underwriting standards in the residential loan sector, a weak economy, and the downturn in real estate markets have introduced greater credit risk into classes of investment securities that traditionally have little actual or perceived credit risk. In many cases, the initial prices and yields on these securities did not fully reflect their elevated credit risk. As market and underlying credit conditions have deteriorated, credit and liquidity spreads have widened, giving way to valuation declines and, in many cases, significant credit rating downgrades by nationally recognized statistical rating organizations (NRSRO).

This bulletin highlights lessons learned from the current market disruption and re-emphasizes the key principles discussed in the following previously issued OCC guidance: OCC 98-20, "Supervisory Policy Statement on Investment Securities and End-User Derivatives Activities"; OCC 2002-19, "Unsafe and Unsound Investment Portfolio Practices"; and OCC 2004-25, "Uniform Agreement on the Classification of Assets and Appraisal of Securities Held by Banks and Thrifts." This issuance reminds bank management of the important liquidity objectives of a bank's investment portfolio and the supervisory risk management expectations associated with investment portfolio holdings of structured investment securities.

Key Lessons Learned

Undue Reliance on Credit Ratings

In recent years, many banks relied too heavily on credit ratings issued by NRSROs when making investment portfolio decisions. Many banks invested in highly rated tranches of structured securities that were perceived to have little credit risk. However, as the recent market disruption revealed, these highly rated structured securities frequently perform more poorly than single-issuer securities with comparable ratings. This performance is most often due to weak underwriting of the underlying loans or investments and underestimated correlations in defaults across the pool of assets.

Credit ratings for structured products are also more likely to be models-based and assumption driven. Furthermore, the NRSRO ratings are assessments of credit risk only and do not incorporate liquidity or price risk. Accordingly, bank management should be very careful when using credit ratings in making investment portfolio decisions and should be particularly diligent when purchasing structured securities. Bank managers should understand the basis for the rating and should supplement credit ratings with the bank's own internal analysis.

The level of due diligence conducted by bank management should be commensurate with the complexity of the instrument, the materiality of the investment in relation to capital, and the overall quality of the investment portfolio as it relates to serving the liquidity and pledging needs of the bank. The more complex a security's structure, the more due diligence that should be done, even for highly rated securities. Bank management should ensure that they understand the security structure, including how the security will perform in different default environments. Bank managers who do not understand a security's structure and are unable or unwilling to perform independent due diligence should not purchase these investments.

Limited Investment Portfolio Liquidity

Banks have traditionally owned investment securities to support liquidity needs, to achieve asset/liability management objectives, to provide collateral (e.g., for public deposits), and to diversify bank earnings. In recent years, the investment portfolio earnings objectives at many national banks took priority over liquidity objectives, often resulting in bank management purchasing structured investment securities that offered a high yield as well as a high credit rating.

As the financial market turmoil deepened during the past 18 months, some banks found that many of these highly rated securities became increasingly illiquid. Liquidity at some banks has become impaired to the extent that some of these securities cannot readily be converted to cash as needed. While portfolio yield is an important consideration, yield generation should not be the primary motivation when making investment decisions. Bank management should ensure that earnings pressures do not override liquidity needs when making decisions about the composition of the investment portfolio.

Inadequate Valuation of Structured Products

The constrained market liquidity for various structured products has also raised valuation issues for these securities. Banks have found that, in some cases, valuations based upon observable market prices became problematic even for highly rated securities due to a lack of market demand. Given the lack of market activity to establish a market-clearing price, some banks have relied upon models and, in some cases, third parties for valuations. Valuation models are highly sensitive to inputs and assumptions that may be subject to errors and uncertainty. Accordingly, the OCC expects national banks to maintain robust governance processes to ensure compliance with regulatory reporting requirements and fair value accounting guidelines. If a bank is holding or purchasing structured investment securities, bank management should ensure that its valuation process allows for a thorough assessment of projected cash flows and that the probability of default and loss, given default assumptions, is reasonable.

Investment Portfolio Risk Management

National banks should fully understand and effectively manage the risk inherent in their investment activities. Failure to maintain an adequate investment portfolio risk management process, which includes understanding key portfolio risks, is considered an unsafe and unsound practice. Twelve CFR part 1 emphasizes that national bank purchases of investment securities must comply with safe and sound banking practices, in addition to complying with other requirements, such as credit ratings issued by NRSROs. Under 12 CFR1.5, national banks must consider, as appropriate, liquidity and price risk, as well as other risks presented by proposed securities activities.

OCC Bulletin 98-20 communicates supervisory expectations for risk processes that financial institutions should establish and maintain to manage the market, credit, liquidity, legal, operational, and other risks of investment securities. These expectations apply to all securities used for investment purposes, including, but not limited to, money market instruments, fixed-rate and floating-rate notes and bonds, structured notes, mortgage pass-through and other asset-backed securities, and mortgage derivative products. OCC Bulletin 2002-19 further emphasizes the need to have an appropriate risk management framework for the level of risk taken in the investment portfolio, to supplement credit ratings with internal credit analysis, and for bank management to demonstrate an understanding of the structure of the security.

Recently, a number of banks have increased their holdings of more complex, structured investments, such as private label mortgage securities, re-securitizations (or re-REMICs), and pools of trust-preferred securities. Concentrations of such securities heighten the level of risk to earnings and capital and are receiving additional scrutiny from examiners. Banks should have a robust risk management process that demonstrates a thorough understanding and analysis of the underlying risks of these investment portfolio holdings.

The risks in a bank's purchase of private label mortgage securities and trust-preferred securities pools include credit, liquidity, price, and interest rate risks. Policies and risk guidelines should address effectively and comprehensively these risks and concentration limits, as well as a variety of characteristics that may be found in the underlying pool of assets, such as the nature of the collateral, performance of the underlying assets, underwriting specifics, geographic location, and terms of repayment. Banks with significant exposure to concentrations of credit, or those not adequately managing concentration risks, may require capital in excess of regulatory minimums.

It is an acceptable practice for banks to use the services of third parties who compile and provide investment analytics for bank management. However, it is important that management and the board accurately and independently arrive at key accounting and ongoing risk decisions. Effective internal controls should ensure, as practicably as possible, the separation of those advising and executing transactions from those approving accounting methodology and performing revaluations. Examiners have observed instances in which investment analytics and risk conclusions are being prepared by the same parties who sold the securities and/or leverage programs to the bank. Often, these third-party conclusions address other critical matters for which management expertise is required, such as classification, impairment, and capital reporting decisions. Banks that rely on such arrangements are significantly compromising independence and control over key decisions and can expect elevated supervisory scrutiny.

Classification of Investment Securities

OCC Bulletin 2004-25 provides examiners with the flexibility necessary to factor relevant data, including bank management's credit analysis, into risk rating and classification decisions for investment securities. Examiners, generally, will classify investment securities that have at least one subinvestment-grade rating, particularly when the most recent rating change is a downgrade. There may be cases, however, when it would be appropriate for an examiner to "pass" a debt security that is rated below investment quality. Examiners may use such discretion when, for example, the bank has an accurate and robust credit risk management framework and has demonstrated, based on recent materially positive credit information, that the security is the credit equivalent of investment grade. Alternatively, current credit analysis could indicate that classification of an investment-grade security is warranted, particularly when there has not been a recent NRSRO review to confirm the rating. The final classification conclusion should be made independently from a broker or third party, but reasonable facts and analytics prepared by the third party may be considered in formulating the final conclusion. Ratings should not be the sole determinant of the classification, and examiners should not place undue reliance on NRSRO ratings.

Examiners will consider the relevant facts and circumstances in making qualitative assessments of asset quality for institutions with elevated levels of classified assets when a material portion of those assets are investment securities. Assessments should include the nature of the classified securities, the location of the securities in the capital structure of the securitization (i.e., subordinate, mezzanine, senior, super senior), the trends and level of performance in the underlying assets, the price level at which the securities are being carried (and the corresponding rate of discount accretion), the acceptance of such securities as collateral in Federal Reserve and other lending programs, and the overall cash flow structure of securities. For those institutions with elevated classified asset levels, bank management and examiners may use independent assessments of the severity of losses on such securities in the assessment of capital adequacy.

Risk-based Capital Considerations

Under the OCC's risk-based capital rules, a position in a securitization, including private label mortgage-backed securities, asset-backed securities, and trust-preferred securities pools, may require additional capital as NRSRO downgrades occur. Risk weightings for securitized assets, generally, are subject to the Ratings-Based Approach (RBA) detailed in 12 CFR 3, Appendix A, Section 4, Recourse, Direct Credit Substitutes and Positions in Securitizations. The capital implications of the RBA may become extremely pronounced when the security falls below investment grade, particularly when the position is subordinated. For subordinated positions in securitizations rated B or below, a bank is required to hold capital against not only its own investment but also for positions that are supported by the bank's ownership, subject to the low-level exposure rule. Bankers and examiners should be aware of the impact of downgrades on capital adequacy and assure that capital is accounted for appropriately on regulatory reports and considered in risk management and strategic decisions.

Further Information

You may direct questions or comments to Kerri Corn, Director for Market Risk, at (202) 649-6360; or Amrit Sekhon, Director for Capital Policy, at (202) 649-6370.

Timothy W. Long
Senior Deputy Comptroller for Bank Supervision Policy
and Chief National Bank Examiner