July 2024 financial reporting, governance, and risk management

Message from Sydney Garmong, Partner, National Office

Whether it was attending a cookout, watching fireworks, or spending other quality time with family and friends, we hope the Fourth of July holiday provided relaxation.

With the second quarter of 2024 in the rearview mirror, we are seeing earnings results, and so far most banks are reporting stable earnings. Of course, we all are watching results for credit quality and net interest margin.

Two of the largest American Institute of Certified Public Accountants (AICPA) conferences for our industry are just around the corner. This year, the AICPA banking conference and AICPA credit unions conference will occur concurrently Sept. 9-11, 2024, at the Gaylord National Resort & Convention Center, National Harbor, Maryland, just south of Washington, D.C. Here are the discount codes:

The 2024 national AICPA & CIMA Conference on Banks & Savings Institutions – use the code “BAN24” to save $100 on the in-person or the virtual option. This discount may be applied in addition to the early bird discount of $150 – for a total savings of $250 off the regular registration fee – for those who register by Friday, July 26, 2024.
The 2024 AICPA & CIMA Conference on Credit Unions – use the code “CU24” to save $100 on the in-person or the virtual option. This discount may be applied in addition to the early bird discount of $150 – for a total savings of $250 off the regular registration fee – for those who register by Friday, July 26, 2024.

We hope to see you in September. We look forward to keeping you informed and welcome any feedback.

Subscribe now

From the federal financial institution regulators

OCC issues spring 2024 semiannual risk report

On June 18, 2024, the Office of the Comptroller of the Currency (OCC) published its semiannual risk perspective, summarizing key risks and issues faced by the federal banking system. While noting that the system remains sound and that the economy outperformed 2023 forecasts, the report highlights the potential of consumer headwinds as well as the importance of prudent interest rate risk management.

The report highlights key risk themes:

Increasing credit risk, especially pertaining to the office sector and certain multifamily property components of the commercial real estate sector, and a potential slowdown in consumption growth
Market risk, due to pressure on funding costs and net interest margins, although the report observed potential indicators that such pressures might be reaching a peak
Elevated operational risk, due to factors such as cyberthreats, digitization including novel products and services, third-party risk, ongoing risk of check and wire transfer fraud, and increased payment fraud

Regulators adopt final rule on automated valuation models

On June 20, 2024, the OCC, Board of Governors of the Federal Reserve System (Fed), Federal Deposit Insurance Corp. (FDIC), National Credit Union Administration (NCUA), Consumer Financial Protection Bureau (CFPB), and Federal Housing Finance Agency (FHFA) adopted a final rule on algorithmic models that are used to value residential real estate held as mortgage collateral, known as automated valuation models (AVMs). The rule, as mandated by Section 1473 of the Dodd-Frank Wall Street Reform and Consumer Protection Act, imposes new quality control standards and requirements to address the risk of bias that could be incorporated into, and amplified by, these algorithmic models. Under the final rule, mortgage originators and secondary market issuers must adopt policies, practices, procedures, and control systems over the use of AVMs in credit decisions and covered securitization determinations.

These requirements must meet statutory quality control standards “designed to ensure a high level of confidence in the estimates produced by AVMs; protect against the manipulation of data; seek to avoid conflicts of interest; require random sample testing and reviews; and comply with applicable nondiscrimination laws.”

The final rule becomes effective one year after publication in the Federal Register.

FDIC approves final rule on resolution planning requirements for large banks

On June 20, 2024, the FDIC issued a final rule bolstering resolution planning requirements for certain banks. The key provisions target covered insured depository institutions (CIDIs) with at least $100 billion in average total assets (group A CIDIs) and those with $50 billion to $100 billion in average total assets (group B CIDIs).

Under the final rule, a group A CIDI must submit full resolution plans that identify a strategy for its orderly and efficient resolution in the event of the bank’s failure. The final rule designates the “bridge bank approach” as the default identified strategy and does not permit the identified strategy to be a closing weekend sale. A group B CIDI must provide a less detailed informational filing. All covered institutions must be able to demonstrate certain capabilities, including the ability to provide key information to potential bidders in the event of a resolution.

The majority of CIDIs will be required to submit every three years (with limited supplemental interim filings). CIDIs that are affiliates of U.S. global systemically important banking organizations will file full resolution submissions every two years.

The final rule is effective Oct. 1, 2024, with group A’s first full resolution plan under the new rule due at least 270 days after this effective date. Group B reports are due no sooner than Oct. 1, 2025.

OCC proposes new recovery plan requirements for banks over $100 billion in assets

On July 3, 2024, the OCC issued proposed amendments to existing recovery planning guidelines for large banks. The amendments would expand these guidelines to apply to insured national banks, federal savings associations, and federal banks with an average of total consolidated assets of $100 billion or more. The amendments also would require such institutions to calculate average total consolidated assets based on the “total assets” line of their call report rather than the “average total consolidated assets” line.

The proposal includes a new testing standard that would require covered banks to stress test their recovery plans, including individual elements, using a risk-based methodology. Furthermore, it clarifies that covered banks must consider both financial and nonfinancial risk, including operational and strategic risk, in their recovery plans.

Comments are due Aug. 2, 2024.

CFPB extends compliance dates for Section 1071 small-business data collection rules

On June 25, 2024, the CFPB issued an interim final rule, following the Supreme Court’s recent ruling in CFPB v. Community Financial Services Association of America. The interim final rule extends the compliance timeline for the CFPB’s small-business lending rule by 290 days to compensate for the length of the temporary stay imposed by a federal court in Texas prior to the Supreme Court ruling. The new compliance dates are as follows:

Highest volume lenders have a new compliance date of July 18, 2025, and a first filing deadline of June 1, 2026.
Moderate volume lenders have a new compliance date of Jan. 16, 2026, and a first filing deadline of June 1, 2027.
Smallest volume lenders have a new compliance date of Oct. 18, 2026, and first filing deadline of June 1, 2027.

CFPB proposes rule to revise mortgage servicing provisions

On July 10, 2024, the CFPB issued proposed amendments that would enact significant changes to the regulatory framework governing mortgage servicing, intended to streamline requirements, improve communication between borrowers and mortgage servicers, and incentivize mortgage servicers to offer prompt and meaningful options for assistance to distressed borrowers.

The amendments would replace much of the existing loss mitigation framework with a framework based on foreclosure procedural safeguards. These safeguards would require mortgage servicers to immediately offer possibilities for assistance and would prohibit foreclosure proceedings unless all possibilities are exhausted or the borrower has ceased communications with the servicer. The amendments also would limit the fees a servicer may charge while in the process of assisting the borrower. Additional provisions would enhance communications provided in notices to borrowers, including requirements to provide communications in languages other than English.

Comments are due Sept. 9, 2024.

BCBS releases disclosure framework for cryptocurrency exposures

On July 17, 2024, the Basel Committee on Banking Supervision (BCBS) published a final disclosure framework covering banks’ exposure to cryptocurrencies, including standardized tables and templates to help improve availability of information and market discipline regarding these exposures. The BCBS also published amendments to the crypto asset prudential standard, including clarifications to the criteria for stablecoins to receive preferential “Group 1b” designation.

Both the framework and updated standard have an implementation date of Jan. 1, 2026.

From the Securities and Exchange Commission (SEC)

CorpFin director issues statement on cybersecurity incident disclosures

On June 20, 2024, Director of the Division of Corporation Finance (CorpFin) Erik Gerding issued a statement on private disclosures of information on cybersecurity incidents outside of Item 1.05 of Form 8-K. Gerding reminded issuers that, while a recent SEC rule requires disclosure of material cybersecurity incidents, the rule does not preclude companies from privately discussing additional information about such incidents with other parties.

Acknowledging that companies could have concerns that such private discussions could implicate Regulation FD – which “requires public disclosure of any material nonpublic information that has been selectively disclosed to securities market professionals or shareholders” – Gerding emphasized that Regulation FD’s application to communications around cybersecurity incidents is consistent with other public company communications. Therefore, exclusions from Regulation FD could similarly apply – for example, if material nonpublic information is shared with an individual who has a duty of trust or confidence to the issuer, or if the other party expressly agrees to maintain the information in confidence.

CorpFin director shares remarks on the state of disclosure review

On June 24, 2024, Gerding issued a statement detailing his remarks at April’s “SEC Speaks” conference on CorpFin’s annual disclosure review for 2023 and priorities for 2024.

On the 2023 disclosure review, Gerding highlighted top areas of comment including “China-related matters, non-GAAP disclosures, management’s discussion and analysis (MD&A), revenue recognition, and financial statement presentation.” Emerging areas of focus included “market disruptions in the banking industry, cybersecurity risks, the impact of inflation, and disclosure related to newly adopted rules, such as pay versus performance.” In addition, CorpFin continues to monitor China-based companies – those with operations predominantly based in the People’s Republic of China.

Summarizing CorpFin’s priorities for 2024, Gerding emphasized the division’s focus on disclosures related to recently issued accounting pronouncements and areas involving management’s judgment, such as segment reporting (effective for annual periods beginning after Dec. 15, 2023), non-GAAP regulations and rules, critical accounting estimates disclosure in MD&A, and disclosures related to supplier finance programs. Gerding also predicted a continued focus on disclosures related to China-based companies, inflation, and interest rate and liquidity risk.

In addition, Gerding addressed the following disclosure priorities:

Artificial intelligence (AI). Companies should clearly describe their definition of AI, provide specific and tailored disclosures on the material risks and reasonably likely impact of AI on the company and the company’s current or proposed use, and have a reasonable basis for its claims.
China-based companies. Companies should provide “more prominent, specific, and tailored disclosures about China-specific matters.” In line with past Dear Issuer Letters, the division will continue to focus on issues such as variable interest entity structure, financial reporting reliability, the regulatory environment in China, and corporate governance matters for such companies.
Commercial real estate (CRE). Given the continued risk associated with the CRE sector and real estate investment trusts (REITs), companies should evaluate where additional detail could be disclosed to further investor understanding of material risks and mitigating steps taken. CorpFin staff will focus on matters such as how banks disclose disaggregation of loan portfolio characteristics and how office and retail REITs describe default risks, liquidity issues, and other key information. Companies also should remain mindful of the potential impacts of the CRE environment even outside of its impacts on banks and REITs.
Recently adopted SEC rules. Gerding commented on CorpFin’s efforts to monitor and further improve disclosures related to recently adopted rules, including cybersecurity incidents, clawbacks, pay versus performance, universal proxy, and beneficial ownership reporting.

Other remarks from the Practising Law Institute’s “The SEC Speaks in 2024” conference addressing the role of the SEC, rulemaking practices, recent rulemaking, and enforcement matters were shared in the April 2024 issue of the Crowe Financial Institutions Executive Briefing.

SEC adopts final rule on registered index-linked annuities

On July 1, 2024, the SEC adopted a final rule on offerings of registered index-linked annuities and registered market value adjustment annuities (collectively, nonvariable annuities). Under the final rule, such offerings must be registered on Form N-4, the form currently used for registered offerings of most variable annuities. The rule also enacts certain changes for Form N-4 specifically applicable to nonvariable annuities, including new tailored disclosures, and makes other changes applicable to all issuers using the form.

The final rule is effective Sept. 23, 2024. Filers must comply with most of the provisions beginning May 1, 2026.

SEC publishes updates to regulatory flex agenda

On July 8, 2024, the SEC published updates to its spring 2024 agenda. Among other updates, the agenda includes a forecasted next action date of October 2024 for the SEC’s forthcoming rulemaking on incentive-based compensation and the Financial Data Transparency Act.

From the Public Company Accounting Oversight Board (PCAOB)

PCAOB proposes new substantive analytical procedures standard

On June 12, 2024, the PCAOB issued for public comment a proposal to replace the current auditing standard related to an auditor’s use of substantive analytical procedures with a new standard: AS 2305, “Designing and Performing Substantive Analytical Procedures.” The proposed standard would clarify the auditor’s responsibilities when designing and performing substantive analytical procedures, aimed at increasing the likelihood that the auditor will obtain relevant and reliable audit evidence. The proposal includes specific requirements regarding risk assessment and audit evidence, removes duplicative provisions, and reorganizes the standard so it is easier to understand.

Comments are due Aug. 12, 2024.

PCAOB adopts amendments related to technology-assisted analysis

The PCAOB on June 12, 2024, adopted amendments to PCAOB auditing standards AS 1105, “Audit Evidence,” and AS 2301, “The Auditor’s Responses to the Risks of Material Misstatement.” These amendments address aspects of audit procedures that involve technology-assisted analysis of information in electronic form and the responsibilities auditors have when performing procedures using such analysis.

The changes specifically address the auditor’s responsibilities in the following areas:

Using reliable information in audit procedures
Using audit evidence for multiple purposes
Performing tests of details

Subject to approval by the SEC, the amendments will become effective for audits of financial statements for fiscal years beginning on or after Dec. 15, 2025. On June 26, 2024, the SEC posted these amendments for comment with a due date of July 23, 2024.

PCAOB amends rule addressing contributory liability

The PCAOB on June 12, 2024, approved an amendment to PCAOB Rule 3502 which addresses the liability of an associated person of a registered public accounting firm who contributes to that firm’s violations of the laws, rules, and standards that the PCAOB enforces. The amendment, which renamed the rule from “Responsibility Not to Knowingly or Recklessly Contribute to Violations” to “Governing Contributory Liability,” will allow the PCAOB to hold associated persons accountable when they negligently, directly, and substantially contribute to firms’ violations. The amendment more closely aligns the rule with the standard of reasonable care auditors are already required to exercise.

The amendment is subject to approval by the SEC and will become effective 60 days after such approval. Comments were due to the SEC on July 23, 2024.

SEC extends comment periods on new PCAOB standards

The PCAOB on May 13, 2024, adopted two standards. QC 1000, “A Firm’s System of Quality Control,” a new quality control standard, requires all PCAOB-registered firms to identify their risks and design a quality control system that includes policies and procedures to guard against those risks. AS 1000, “General Responsibilities of the Auditor in Conducting an Audit,” addresses the general principles and responsibilities of the auditor, including due professional care, professional skepticism, competence, and professional judgment. Both standards are subject to SEC approval. On July 1, 2024, the SEC extended the comment periods for these standards from July 2, 2024, to July 16, 2024. To accommodate the longer comment period, the SEC also extended the time period within which the SEC must approve or disapprove the proposed rules to Aug. 25, 2024.

SEC appoints PCAOB chair for second term

On June 11, 2024, the SEC announced the appointment of Erica Y. Williams to a second term as PCAOB chair. The term begins on Oct. 25, 2024, and ends on Oct. 24, 2029. The swearing-in ceremony was conducted virtually.