Trade Groups Call for Rescission of OCC Heightened Risk Governance Standards

The Bank Policy Institute and American Association of Bank Directors urged the Office of the Comptroller of the Currency ("OCC") to fully rescind its heightened risk governance guidelines for insured national banks.

In a joint comment letter, the associations responded to the OCC’s proposal to "increase the asset threshold" for applying the guidelines from $50 billion to $700 billion. While they supported the threshold increase as a way to reduce regulatory burden for smaller institutions, the associations argued that the guidelines remain "overly prescriptive" for all banks. They contended that the current framework diverts board and examiner attention away from the management of material financial risks toward procedural compliance and documentation requirements, undermining effective risk governance.

To address these concerns, the associations recommended that the OCC:

1. Rescind the Guidelines or Convert to Guidance: The associations argued that the guidelines should be rescinded for all banks, noting that other regulatory tools already ensure safety and soundness. If retained, they recommended re-issuing the standards as "nonbinding, principles-based supervisory guidance" rather than "enforceable guidelines", and limiting their use as the sole basis for enforcement actions or matters requiring attention.
2. Leverage Parent Company Frameworks: The letter urged the OCC to permit banks to utilize their "parent bank holding company’s enterprise-wide risk governance framework"—without requiring specific approval or meeting the current 95% asset test—to eliminate unnecessary duplication of personnel, systems, and governance efforts.
3. Flexibility in "Three Lines of Defense": The associations called for eliminating rigid requirements regarding the "three lines of defense" model. They recommended allowing banks to define "front line units" as "revenue-generating units" only, clarifying that legal and organization-wide functions do not fit into these lines, and encouraging collaboration rather than adversarial relationships between risk management and business units.
4. Streamline Board Responsibilities: The groups recommended removing prescriptive mandates that burden boards with compliance tasks, such as annual self-assessments and the approval of specific policies like talent management and succession plans. They argued boards should be permitted "to delegate certain functions to... committee[s] or management" to focus on material risks.
5. Refine Audit and Risk Roles: The associations requested revisions to internal audit requirements, specifically suggesting the removal of the obligation to "maintain a 'complete' ... inventory of all of the bank's material processes." They also argued that independent risk management should not be required to maintain a comprehensive inventory of all laws and regulations, noting that examiners currently apply these expectations too broadly.
6. Index Threshold to GDP: If the asset threshold is retained, the associations recommended indexing the dollar amount to "nominal GDP growth to prevent unintended regulatory expansion" over time due to inflation and economic growth.
7. Clarify Reservation of Authority: The letter urged the OCC to establish clear standards and due process protections—including notice and an opportunity to respond—before using its "reservation of authority" to apply the guidelines to banks that fall below the asset threshold based on complexity or risk.