Feb 6, 2024

To print this article, all you need is to be registered or login on Mondaq.com. In coordinated actions, the New York State Department ofFinancial Services (NYDFS) and the Federal Reserve Board (FRB)fined the Industrial and Commercial Bank of China, Ltd. (ICBC) andits New York branch (Branch, a New York-based subsidiary) $30million and approximately $2.4 million, respectively. The Branch,which operates under the jurisdiction of both examiningauthorities, was found to have improperly disclosed confidentialsupervisory information (CSI), backdated certain books and records,and failed to self-report the impropriety of its books and recordswhen the issue came to light. These coordinated enforcement actionssignal the regulators' interest and seriousness in protectingCSI and emphasize NYDFS' focus on self-reportingmisconduct. Key Takeaways: NYDFS coordinates with federal prudential regulators forenforcement related to banking institutions. Maintaining confidentiality of CSI is a significant interest ofregulators and disclosure can only be made with approval of therelevant regulatory authority. Financial institutions are expected to have policies andprocedures in place to properly manage recordkeeping and disclosureof CSI. Regulators, particularly NYDFS, have strong expectations forfinancial institutions to self-report certain conduct. Governanceand Self-Reporting Expectations Governance and Self-Reporting Expectations NYDFS has heightened expectations for self-reporting misconduct,which is codified in its regulations. For example, § 300.1(a)of Title 3 of the New York Codes, Rules and Regulations requiresimmediate reporting (upon discovery) of misconduct relating to"embezzlement, misapplication, larceny, forgery, fraud,dishonesty, making of false entries and omission of true entries,or other misconduct, whether or not a criminal offense, in whichany director, trustee, partner, officer, employee (excludingtellers), or agent of such organization is involved." In thisICBC Consent Order , NYDFS found thatthe Branch had violated § 300.1(a) because a bank employeebackdated signatures on certain client certifications in connectionwith its Know Your Customer program. Despite the Branchand ICBC representing that the certifications did not become partof the bank client's files, NYDFS found the action a violationof New York Banking Law § 200-c for failing to maintainappropriate books and records. Furthermore, NYDFS faulted the bankfor failing to immediately report this incident upon discovery,when originally flagged to ICBC by one of its employees in 2017.The issue was internally investigated by ICBC and the investigationconcluded in April 2017 that the records were in fact backdated.The backdating of the records constitutes a false entry, whichNYDFS declared should have been immediately reported. However, ICBCdid not report the incident until January 2018. Despite ICBC takingthe needed action to investigate the issue, NYDFS, in its ConsentOrder, emphasizes its expectations regarding immediateself-reporting. Confidential Supervisory Information CSI can be broadly defined and varies in its scope acrossdifferent state and federal regulators. For example, NYDFS definesCSI as any "reports of examinations and investigations [ofNYDFS-supervised institution and affiliates], correspondence andmemoranda concerning or arising out of such examination andinvestigations, including duly authenticated copy or copiesthereof," as well as any confidential materials shared byNYDFS with any governmental agency or unit. 3 NYCCR § 7.1(1);New York Banking Law § 36.10. Meanwhile, FRB defines CSI as"information that is or was created or obtained in furtheranceof the [Federal Reserve's] supervisory, investigatory orenforcement activities," including reports of examination,inspection and visitation, confidential operating and conditionreports, supervisory assessments, investigative requests fordocuments or other information, and supervisory correspondence orother supervisory communications. 12 C.F.R. §§ 261.Regardless of the definition, regulators are the ultimate owners ofCSI, meaning a financial institution cannot disclose CSI, even toother government agencies, without the written approval of thegoverning regulator. At issue in these consent orders are examination-relateddocuments that generated CSI pursuant to New York Banking Law§ 36.10. These CSI materials were not permitted to bedisclosed without NYDFS and FRB's approval. 3 NYCCR §7.2. ; 12 C.F.R. §§ 261.4, 261.20. However, ICBC failed tocomply with these requirements when transferring a Branch employeeto an overseas affiliate in December 2021. During the transfer, theNew York Branch provided CSI to an overseas affiliate, whodisclosed the CSI to a foreign regulator while the Branch'srequest for authorization to release the CSI was pending or underreview with NYDFS, FRB, and the Federal Reserve Bank of New York.The Branch learned of the CSI breach in December 2021, and did notreport the breach to NYDFS and FRB until two weeks later. In theresulting Consent Order, FRB emphasized the Branch's lack ofadequate controls related to the use and dissemination of CSI. TheNYDFS Consent Order, and similarly the FRB Consent Order , signal the regulators'seriousness in managing CSI and the applicable expectations forimmediate self-reporting of unauthorized disclosures. In addition to the assessed total fines of $32.4 million, bothconsent orders require additional remediation efforts. For example,NYDFS and FRB have each imposed additional non-monetary penaltiesincluding providing periodic progress reports relating to AML/BSAand CSI compliance programs and establishing and reporting oncontrols and governance relating to both. The FRB is also requiringthe designation of a CSI officer who must be a voting member of theBranch's risk management committee. The Bottom Line Financial institutions are expected to have policies andprocedures, internal controls, and adequate governance surroundingthe handling of and protection of CSI, even when dealing withaffiliates. Additionally, in its consent order, NYDFS has made itvery clear how seriously it takes self-reporting and that, in thisinstance, waiting two weeks post-discovery of a reportable incidentdid not meet its "immediate" reporting expectation. The content of this article is intended to provide a generalguide to the subject matter. Specialist advice should be soughtabout your specific circumstances.