OCC Issues Guidance and Establishes Standards Regarding Banks’ Usage of Independent Consultants in Connection with Compliance with Enforcement Actions

by Goodwin

The OCC issued guidance (the “Guidance,” OCC Bulletin 2013-33) that establishes standards that the OCC will use when it requires national banks, federal savings associations or federal branches or agencies (collectively, “Banks”) to employ independent consultants to comply with an enforcement action involving the applicable Bank’s alleged significant violations of law, fraud, or harm to consumers.  In a statement accompanying the Guidance, Comptroller of the Currency Thomas J. Curry stressed that:

 “…while consultants can provide knowledge, expertise and additional resources, [the OCC] must take care to ensure they maintain independence and are subject to appropriate oversight.  The standards [the OCC is] publishing today help [the OCC] achieve those important objectives while ensuring that a consultant’s conclusion is never substituted for the OCC’s supervisory oversight.”

Moreover, the OCC cautioned in the Guidance that a Bank’s use of an independent consultant does not absolve the Bank’s management or board of directors of their responsibility to see that “all needed corrective actions are identified and implemented.”

OCC Assessment of Need for Bank to Retain Independent Consultant in Enforcement Action

The OCC stated in the Guidance that in assessing whether it will require a Bank to retain an independent consultant in an enforcement action, it will consider the following seven factors, among others:

  • the severity of the violations (including their impact on consumers, the Bank and others);
  • the criticality of the function requiring remediation;
  • the OCC’s confidence that Bank management has the ability to identify and correct violations in a timely manner;
  • whether the Bank has the expertise, staffing and resources necessary to take the required corrective actions;
  • the actions already taken by the Bank to correct the violations or address the problematic issues;
  • the type of services the independent consultant would provide; and
  • the available alternatives to the engagement of an independent consultant.

OCC Review of the Consultant Proposed by the Bank

If the OCC determines that it will require a Bank to hire an independent consultant in connection with an enforcement order, it will require the Bank to submit information to the OCC regarding the due diligence that the Bank has conducted regarding the independent consultant it proposes to retain.  In particular, the OCC will seek information concerning the qualifications, independence, resources, expertise, capacity, reputation, information security and document security practices, risk management and reporting, conflicts of interest and financial viability of the proposed independent consultant.  The Bank would also be expected to disclose to the OCC professional disciplinary actions, if any, taken against the proposed independent consultant.  In assessing the independence and level of objectivity of the proposed independent consultant, the OCC expects that a Bank’s submission to the OCC in support of a proposed independent consultant will address, among other things:

  • the scope and volume of other contracts or services provided (or previously provided) by the independent consultant to the Bank;
  • whether the Bank evaluated other independent consultants with the required specialized expertise and level of independence;
  • whether the Bank proposed any mitigating actions to address any potential conflict of interest (or the appearance of a conflict of interest);
  • the amount of the fees to be paid by the Bank to the independent consultant (and any other financial relationship between the Bank and the proposed independent consultant);
  • any business or personal relationship of the independent consultant (or its employees) with a board member or executive officer of the Bank;
  • whether a member of the independent consultant’s staff has previously been employed by the Bank; and
  • other relevant facts and circumstances.

The Guidance also states that, in reviewing the use of a proposed independent consultant, the OCC will evaluate the terms of the Bank’s proposed engagement contract with the independent consultant (and the work plan suggested by the independent consultant) to determine whether the contract and work plan are consistent with the requirements of the OCC’s enforcement action.  The Guidance states that a Bank should ensure that the engagement contract with the independent consultant provides that the independent consultant will:

  • comply with applicable laws and regulations (including those concerning privacy, customer information security and the confidentiality of non-public OCC correspondence and information);
  • maintain complete records;
  • make all work papers, analyses, drafts and reports available to the OCC (upon the OCC’s request);
  • bring to the OCC’s immediate attention disagreements with the Bank about material matters;
  • base its conclusions and recommendations on its own independent and expert judgment; and
  • provide a final report to the board of directors.

The Guidance also provides that the engagement contract with the independent consultant must:

  • identify ongoing requirements concerning reporting by the independent consultant and require that the independent consultant meet these requirements;
  • provide that the OCC may meet or discuss matters privately with the OCC;
  • provide that the OCC must approve in writing any material modifications to the contract, work plan or staffing;
  • provide that the proposed subcontracting of any work be subject to the OCC’s determination that it has no objection to the proposal; and
  • provide that the engagement contract shall be terminated by the Bank if so requested by the OCC “without any objection or right of appeal by the consultant.”

The OCC’s Oversight of the Consulting Engagement

In overseeing a consultancy engagement, the Guidance states that the frequency of the OCC’s interactions with the Bank and the independent consultant will depend upon the facts and circumstances of the matter, the Bank management’s expertise and resources, the nature of the independent consultant’s assignment, and the timeline for completion of the consultancy engagement.  Furthermore, the extent and frequency of the OCC’s monitoring of the consultancy will also reflect the scope and direction of the consultant’s engagement, the nature of the deficiencies or violations that the independent consultant will seek to identify (and with respect to which it will be expected to recommend appropriate remedial actions), and the potential harm (and the materiality of such harm) to consumers and the Bank.

As part of the OCC’s assessment of the Bank’s compliance with the enforcement action, the OCC will review the independent consultant’s final written report of findings and recommendations.  The OCC’s review helps it to determine whether all matters for which the independent consultant was engaged were addressed.  If the OCC is not satisfied, it may request that additional work be performed by the Bank or the consultant.  After the final written report has been reviewed by the Bank’s board of directors and the OCC, the Bank is expected to prepare a plan to address the consultant’s findings and to implement the board of directors’ responses to those findings.  The plan, states the Guidance, should be approved by the Bank’s board of directors and is “subject to OCC review and a written determination of supervisory no objection [by the OCC] before [it] can be implemented.”  As part of the OCC’s review, it will consider whether the Bank’s corrective actions will be sustainable.

IRS Circular 230 Disclosure: To ensure compliance with requirements imposed by the IRS, we inform you that any U.S. tax advice contained in this informational piece (including any attachments) is not intended or written to be used, and may not be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Goodwin | Attorney Advertising

Written by:


Goodwin on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at info@jdsupra.com. In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at: info@jdsupra.com.

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.