General regulatory framework
How is the business of banking regulated in the
To say that the bank regulatory framework is complex is an
understatement. Four main federal banking agencies regulate
banks and, if the institution is chartered by one of the
states, there will also be a state regulatory agency involved.
The Office of the Comptroller of the Currency (OCC) regulates
all national banks. State-chartered banks are regulated either
by the Federal Deposit Insurance Corporation (FDIC) or the
Board of Governors of the Federal Reserve System (FRB),
depending upon whether the bank elects to become a member of
the Federal Reserve System. The Office of Thrift Supervision
will regulate all state and federally chartered savings and
loan associations. If the bank or savings and loan association
is chartered by one of the states, a state banking agency will
also regulate and supervise the institution.
Bank regulation in the US is comprehensive, and governs
virtually all aspects of the activities of such
What approvals are required in connection with
Specific licences and approvals are required to establish a
bank. These include an authorization from the agency that will
charter the institution (either the OCC or OTS if a nationally
chartered bank or savings institution and the state if
state-chartered), as well as an approval from the FDIC to
accept deposits. Separate approvals will be required to
establish branches in new locations, to merge with or acquire
other banks or financial institutions, and to engage in
specific activities outside a pre-approved laundry list of
permissible activities. Approval will be required before
exercising trust or fiduciary powers.
What supervisory powers do the regulatory
authorities have over banking institutions?
The banking regulatory authorities routinely examine the
activities and condition of banking institutions to determine
whether or not they are being operated in accordance with
statutory and regulatory requirements and in a safe and sound
manner. Banks must routinely file reports with the agencies
regarding their activities and condition. To the extent that
the regulatory authorities determine that corrective action is
required, they have been given a panoply of enforcement
Much of the corrective action taken by the regulatory
authorities is informal, arising from the ongoing dialogue
between the institution and the regulator, but the authorities
may use formal enforcement actions if there is a violation of
law, rule or regulation, violation of an agreement or
commitment to the regulator, or the institution is in an unsafe
or unsound condition or is engaging in unsafe or unsound
banking practices. These powers include the ability to issue
cease-and-desist orders, require that certain actions be
stopped or conditions be corrected; impose civil money
penalties that could range up to $1 million per day per
violation; issue removal and prohibition orders, requiring the
removal of managers, officers, directors or other employees and
prohibiting them from participating in the affairs of a
financial institution; or revoke the deposit insurance of the
institution, thus effectively requiring it to cease operations.
Before the initiation of a formal enforcement action, however,
the regulators are required to provide prior notice of the
basis for the action, and the affected party has the
opportunity for a hearing.
The US has adopted a prompt corrective action
regime, where the regulatory authorities are required to impose
certain restrictions on the activities and operations of an
institution if it fails to meet required capital standards.
Institutions are characterized as well capitalized, adequately
capitalized, undercapitalized, significantly undercapitalized,
or critically undercapitalized depending upon the capital
level. Institutions should remain well capitalized to avoid the
restrictions on activities. To be well-capitalized, an
institution should have a ratio of tier I capital (primarily
common equity and non-cumulative preferred stock) to total
assets of not less than 5%, a ratio of tier I capital to
risk-adjusted assets of not less than 6%, and a ratio of total
capital to risk-adjusted assets of not less than 10%. A
critically undercapitalized institution (one with a ratio of
tier I capital to total assets of less than 2%) will generally
What regulatory regime governs the conduct of
business with customers?
To list all of the regulatory requirements relating to
dealing with customers would be virtually impossible in a
summary such as this. The more important regulations
- Truth in lending, requiring accurate disclosure of the
interest rates and charges on extensions of credit to
- Truth in savings, requiring the accurate disclosure of
interest rates and fees on deposits received from
- State interest and usury limits, setting out maximum
permissible interest rates that may be charged on certain
types of loans.
- Limitations on loans to one borrower, limiting the amount
of loans or other extensions of credit that may be made to a
single borrower and its related parties.
- State and federal privacy laws, limiting the use of
information obtained from consumers.
- Fair lending laws, prohibiting discrimination in
- The Community Reinvestment Act, which requires banking
institutions to assess and meet the credit needs of their
communities, including low- and moderate-income
- Extensive restrictions to transactions with affiliated
What are the capital requirements applicable to
banking institutions in the US?
Banks in the US are subject to the risk-based capital
requirements derived from the Basel Accord, supplemented by a
leverage test. In general, banks are expected to maintain a
ratio of tier I capital to risk-adjusted assets of not less
than 6%, a ratio of total capital to risk-adjusted assets of
not less than 10%, and a ratio of tier I capital to total
(non-risk-adjusted assets) of not less than 5%. The regulators
impose an ever-increasing scheme of restrictions as banks fall
below these standards.
What effect will Basel II have on banking
institutions in the US?
The Basel II requirements will apply only to the large,
internationally active financial institutions in the US. Other
large institutions may elect to comply with the Basel II
requirements if they wish, but compliance will not be
mandatory. Smaller institutions will not be expected to comply.
The Basel II requirements will become applicable for these
large institutions on January 1 2007. The US regulators
continue to discuss whether there should be adjustments to the
Basel II requirements for US institutions.
Do the supervisory requirements include
operational and organizational requirements relating to
internal controls and operational risks?
Internal controls and operational risks are part of the
evaluation of every financial institution and are incorporated
into the on-site supervision carried out by the regulatory
agencies. Since 1991 each financial institution has been
required to certify as to the adequacy of its systems and
controls, and the regulators evaluate the adequacy of such
systems as part of their overall evaluation of the strength of
the institution. These requirements have been strengthened as a
result of the Sarbanes-Oxley Act passed as a result of several
of the corporate accounting scandals of 2002 and 2003.
What are the anti-money laundering obligations
of financial institutions?
The US has long required banks to report large cash
transactions and advise the legal and regulatory authorities of
possible illegal transactions, but the obligations have been
substantially increased as a result of the terrorist activities
of September 11 2001. As a result of the passage of the
so-called USA PATRIOT Act, banks are required to substantially
strengthen their know-your-customer procedures, enhance their
anti-money-laundering programmes, designate a responsible
compliance officer, and implement extensive training and
effective internal auditing function.
Regulation of owners of financial
What approval requirements exist before one may
obtain control of a financial institution?
As a general matter, companies that control banking
institutions are required to register with and are subject to
the examination and supervision of the FRB. Companies include
corporations, partnerships and virtually any other form of
business enterprise. Control is defined as the ownership of 25%
or more of any class of voting stock of the institution,
directly or indirectly, the power to select a majority of the
board of directors of the institution or the power to exercise
a controlling influence over the management or policies of the
institution. Before a company may acquire control, it must
receive the prior approval of the FRB.
Companies that control savings and loan institutions are
required to register with and obtain the approval of the OTS
before obtaining control. Control is defined similarly to that
set out above.
Individuals seeking to obtain control over a financial
institution must first file a notice with the appropriate
federal banking regulatory authority. The regulator has a
limited period to consider the notice, and may deny the notice
if the proposal fails to satisfy managerial and financial
criteria. Control for the purposes of this statute is defined
in the same manner as outlined above; however, control will be
presumed at the 10% level (rather than at 25%) if the
institution has publicly traded shares or if the holder would
become the largest stockholder of the institution.
What activity restrictions are imposed on
controlling owners of financial institutions?
Companies that control banks are known as bank holding
companies, and may only engage in banking, in managing and
controlling banks, and in other activities so closely related
to the foregoing as to be a proper incident thereto. The list
of permissible activities includes a variety of credit related
functions (such as lending and leasing), certain securities
brokerage activities, limited data processing activities and
other activities and services commonly performed by banks in
Bank holding companies that are well capitalized, well
managed and meet certain other financial requirements may
become financial holding companies, and may also engage in a
variety of insurance and securities activities (including
underwriting) and other financial activities.
Bank holding companies are required to obtain prior approval
from the FRB before merging with or acquiring 5% or more of the
shares of another bank holding company or bank. Approvals may
be required before engaging in certain activities, depending
upon the condition of the bank holding company and whether or
not the activity is on the laundry list of permissible
activities for bank or financial holding companies.
Companies that control savings institutions are known as
savings and loan holding companies. Under current law, only
companies engaged in financial activities (similar to those
permissible for financial holding companies) may acquire
control of savings and loan associations, effectively limiting
the activities of such institutions. However, this is a recent
addition to the legal framework of the US. A number of
companies acquired savings institutions before the effective
date of this law, and are not bound by this restriction.
Certain specialized financial institutions, such as credit
card banks, industrial loan companies and trust companies,
while still offering an array of banking services, are not
covered by the bank and savings and loan holding company
restrictions outlined above.
There are no activity restrictions imposed on individuals
that may control financial institutions.
States may impose approval requirements for individuals or
entities before obtaining control of state-chartered
Have there been any recent significant changes
to insolvency legislation in your jurisdiction, or are any such
There have been no significant changes to the insolvency
regime in the US in several years, either as they may affect
corporate entities, financial institutions or individuals. The
US has separate bankruptcy and receivership provisions that
apply to banking institutions, and that those provisions differ
in meaningful ways from the provisions that apply to corporate
Does your jurisdiction operate a deposit
protection or guarantee scheme protecting retail depositors
from loss in the event of insolvency of an authorized
The US has an extensive deposit insurance scheme
administered by the FDIC. Banks and savings institutions are,
with extremely limited exceptions, required to participate in
this system. As a general matter, deposits in a bank are
insured in amounts up to $100,000 per depositor.
If a bank or savings institution becomes insolvent, the FDIC
will appoint a receiver of the institution, and will be
required to handle the receivership. As a practical matter,
insured depositors will have access to their funds (up to the
amount of the deposit insurance) without interruption after the
failure, as the FDIC will generally immediately arrange for
another financial institution to assume those deposit
liabilities. The FDIC has broad powers to sell the failed
institution or its assets, to determine claims against the
institution and otherwise administer its affairs. In
administering the affairs of the insolvent institution, the
proceeds received from the sale of the assets will be allocated
among various classes of creditors, with depositors among the
highest priorities. It is possible that a depositor may receive
more than $100,000 for a large deposit if the proceeds of the
assets are enough. However, as the assets of the institution
are rarely enough to cover the claims of all depositors, it is
likely that a general unsecured creditor of a bank will suffer
some loss as a result of the failure.
Does your jurisdiction have an ombudsman scheme,
arbitration scheme or similar scheme for the resolution of
disputes between a bank and its retail customers other than
through formal legal proceedings?
The US does not have a mandatory ombudsman or arbitration
scheme for the resolution of bank/customer disputes. Banks may
establish ombudsmen if they wish to help avoid formal legal
proceedings, and banks and customers may agree to use
arbitration in connection with disputes. Arbitration clauses
are commonly included in bank/customer agreements and have
generally been upheld by the courts.
John Douglas heads the bank regulatory practice at Alston
& Bird, and practices from the firm's Washington DC and
Atlanta offices. As former general counsel of the FDIC, his
practice involves advising clients in navigating the complex
regulatory structure in the US. As examples, he assisted six
international banks and a card association in the formation of
a large global payments processing company. He represented
senior officers of Riggs Bank, Credit Lyonnais and Freddie Mac
in dealing with regulatory enforcement actions, and is advising
The Bank of New York in an $800 million dispute with the FDIC
over the failure of NextBank.
Alston & Bird LLP
One Atlantic Center
1201 West Peachtree Street
Atlanta, GA 30309-3424
Tel +01 404 881 7880
Fax +01 404 253 8363