Build to Your Balance Sheet, Not to the Supervisory Cycle

Banks often justify investment in governance because supervisors expect it. That is the weaker argument. The stronger argument is that a well-designed governance framework makes the balance sheet perform better.

The supervisory argument is real but unstable and right now it is at a cyclical low. The federal banking agencies have spent the last year deliberately moving supervision away from criticizing policies, process and documentation.

A framework built to satisfy the current supervisory cycle will be wrong within a few years and probably sooner than the rulebook suggests.

Supervisory intensity in U.S. banking has swung on roughly a decade-long cycle looking back forty years. It tightened after the savings and loan crisis and FDICIA, then loosened through the late 1990s. It tightened hard after the 2008 financial crisis and Dodd–Frank. Tailoring under S.2155 followed in 2018–19. The 2023 bank failures brought re-tightening. It is loosening again now.

Nobody running a bank today should build a control environment on the assumption that the current setting is permanent. It is not and history is unusually clear on this point.

What a Robust Process Does on an Ordinary Tuesday

Decision Speed

The most underrated benefit of clear delegated authority is that somebody can act.

When a rate move opens a window to restructure part of the securities portfolio, add a swap or reprice a deposit product, the question is not whether management knows what to do. It is whether anyone is unambiguously authorized to do it before the window closes. In banks with vague delegation, the answer is a call chain, a hastily convened meeting or a wait until the next scheduled ALCO. In a volatile week that costs real basis points and it recurs several times a year.

Robust practice is a written authority matrix: who may execute what, up to what size, under what conditions, with what after-the-fact reporting.

The same structure protects the treasurer, as acting inside clearly delegated authority is defensible and that removes the hesitation which is the genuinely expensive outcome.

Deposit Pricing Discipline

For most banks, deposit pricing is the single largest lever on the income statement. It is also downstream of exactly the same assumption quality that drives your IRR measurement.

A bank that has done real work on deposit behaviour knows which balances are genuinely rate-sensitive, which are relationship-anchored, how betas differ by segment, product and vintage, and where the true marginal cost of funds sits. That bank can hold pricing on the two-thirds of its book that will not move and compete selectively on the third that will.

A bank that has not done that work prices on competitive reflex. It matches a rate posted across town on the entire book because it cannot make the distinction. On a $2 billion deposit base, a 15 basis point avoidable overpayment is $3 million a year, an amount that dwarfs the cost of the deposit study that would have prevented it.

The point for an ALCO is that assumption governance pays twice. The same beta and decay work that makes your EVE defensible makes your pricing decisions sharper. Most banks treat the first as a compliance cost and never collect the second return. On how deposit behaviour itself is shifting, see our article on Deposit Behavioural Modelling in a Changing Rate Environment.

Key-Person Risk

Procedure is institutional memory in written form, which is the argument that lands hardest at community banks and it is rarely made.

Many banks have exactly one person who genuinely understands the models and processes that drive balance sheet decisions. When that person retires or leaves, the model keeps producing output and nobody can defend, challenge or recalibrate it. The bank continues making decisions on numbers it no longer understands, in some cases for years.

Documented procedure is how a bank keeps knowledge when it loses people. That is not a regulatory concept. It is basic operating resilience and for smaller banks it is more acute.

Growing Without Breaking

Controls calibrated for a $3 billion balance sheet do not fail loudly at $12 billion, they degrade quietly. The limits were set when the loan book was simpler and have been amended upward each time they bound, while the ALCO agenda is unchanged from a point when the balance sheet was half the size. Risk ownership was informal because everyone sat on the same floor and it stayed informal after they stopped.

A bank that periodically rebuilds its framework from current capacity, rather than amending last year's version, can absorb growth. One that amends discovers, usually during a stress event, that its control environment describes a bank it no longer is.

Management Time Reclaimed

Weak frameworks generate rework: decisions relitigated because nobody recorded the rationale, questions answered repeatedly because the answer was never written down and exam preparation conducted as a scramble because nothing was maintained in the ordinary course. A functioning framework settles questions once. The return is senior time, which at a growing bank is the scarcest input there is.

Acquisition Readiness

If you intend to buy, a clean governance environment is not optional. Regulatory approval timelines are influenced by supervisory standing and a buyer with unresolved issues moves slowly or not at all. Integration is where the cost shows up, as merging two banks whose policy frameworks, limit structures and delegated authorities do not reconcile creates months of expensive reconciliation, usually discovered after close.

If you may sell, understand that diligence will find the control environment. A buyer who encounters undocumented assumptions, a limits framework repeatedly amended upward and an issue inventory living in three spreadsheets will either discount the price or extend the timeline. The work needed to prevent this takes two years and in most cases, you will only have days.

For any bank whose five-year plan contemplates a transaction in either direction, governance quality is a valuation input.

Confidence and Why It Compounds

These returns share a mechanism that is easy to miss because it is psychological rather than procedural. Each one makes the people running the balance sheet more willing to act.

A treasurer moves faster when authority is unambiguous. A pricing decision gets made on conviction when the betas behind it are defensible. An ALCO escalates early when the limits mean something and the board understands them. None of that is visible in a policy document and all of it shows up in results.

The reverse compounds just as reliably. Where authority is vague and assumptions are undefended, capable people hesitate, decisions drift upward for cover and the bank becomes slower precisely when speed is worth the most.

The Cycle Argument and Why the Relief Is Less Durable Than It Looks

Where the Pendulum Currently Sits

The last twelve months represent a genuine and substantial loosening. We set out the mechanics in Fed Examination Themes for 2026 and OCC Examination Themes for 2026 and the July 2026 capital changes in The Community Bank Leverage Ratio: What to Weigh Before Opting In.

In short, the OCC and FDIC have defined "unsafe or unsound practice" by regulation for the first time and raised the threshold for a Matter Requiring Attention to practices that could reasonably be expected to materially harm financial condition or an actual violation of law.¹ The Federal Reserve is pursuing the same objective under its own authority.² Model risk guidance has been rewritten to state that non-compliance will not itself result in supervisory criticism.³ Community banks no longer face mandatory policy-based examination activities.⁴ The proposal to lift the heightened standards threshold from $50 billion to $700 billion remains pending.⁵

The Wrinkle That Matters

The formal deregulation is comparatively durable. The MRA standard is a codified regulation, and reversing it would require notice-and-comment rulemaking. The rules themselves are unlikely to snap back quickly.

Supervisory posture requires no rulemaking at all. Examination intensity can change through tone, scope decisions, regulator staffing, training emphasis and how aggressively examiners read the phrase "materially harm the financial condition." Every one of those levers moves faster than a rule. A bank can find its examinations meaningfully tougher while the regulation on the page is unchanged.

What Is Unaffected Regardless

Several things did not move and will not move with sentiment. The Section 39 safety and soundness standards remain in force, covering internal controls, information systems, credit underwriting, interest rate exposure and asset growth.⁶ Violations of law and regulation remain independently actionable with no materiality qualifier, which leaves BSA/AML, Regulation O and Regulation W. The CAMELS management component still exists; it simply carries less relative weight. And "well managed" status still gates expedited licensing, financial holding company election and certain acquisition and branching activity.

The 2010 interagency guidance on interest rate risk and on funding and liquidity risk management remains the operative framework for banks below the LCR requirement threshold.⁷

Proportionality — Community, Regional and Mid-Size

Every agency now uses the phrase "commensurate with size, complexity and risk profile," which is frequently misread as "less."

The better reading is that the balance sheet determines the framework, not the asset size. A $900 million bank with a concentrated CRE book, wholesale funding reliance and a long municipal portfolio has a harder IRR governance problem than a $6 billion bank funded entirely by granular retail deposits. Asset size is a proxy and often a poor one.

Bands follow our internal classification. The thresholds map closely onto the Federal Reserve's own supervisory portfolios.

Regional banks are where most governance failure originates. They have outgrown informal coordination but have not built second-line capability at scale. Risk ownership is ambiguous and the ALM model has become genuinely complex while the governance around it is what it was when the bank was a third of the size. The $10 billion crossing brings additional requirements, and the common error is to treat that as a compliance project rather than the moment to rebuild the framework.

Note, while Silicon Valley Bank, Signature Bank and First Republic were already subject to enhanced prudential standards they failed which means meeting regulatory expectations alone does not help. We examine the events that led to those failures in Lessons from the 2023 Banking Stress Events.

What a Robust Implementation Actually Looks Like

1. A Real Distinction Between Policy and Procedure

Policy is a board-level statement of what risk the bank will accept, who may accept it and within what limits. Short, stable, approved annually with genuine discussion. Procedure is management's description of how the work gets done, owned at the line level and changed whenever the process changes without needing a board meeting.

Most weak frameworks conflate the two. The board should own the risk appetite, while management should own the plumbing.

2. Limits That Bind

A limit works when a breach produces a consequence somebody would prefer to avoid. Here is a simple test. When a limit was last breached, what happened? If the limit was revised at the next ALCO, you do not have a limits framework. You have a reporting convention.

Robust practice ties limits to earnings, capital and liquidity capacity rather than to peer comparison. It uses tiered escalation with named owners and defined timeframes, records in writing how each breach was resolved and reaches performance management for repeat breaches. Limit changes should require the same approval level as the original limit, with the rationale documented rather than simply reflected in the next policy version.

3. Assumption Governance as a First-Class Discipline

For an ALCO this is the highest-return governance investment available, because the same work drives both risk measurement and deposit pricing. Model output is an opinion about the future dressed in decimal places, driven overwhelmingly by a handful of behavioural assumptions.

Robust practice means each material assumption is traceable to a dated source: an internal deposit study, an FHLB or peer benchmark, published research. It means sensitivity analysis showing how limit compliance changes under alternative assumptions, so the board can see whether it sits inside its limits comfortably or only under the base case. It means the ALCO minute records which assumptions were challenged and by whom.

The revised model risk guidance removed the annual review expectation. That is a supervisory change, not a financial one. Deposit behaviour shifted materially in 2022–2023 and assumptions calibrated on a decade of near-zero rates were wrong in ways that cost banks their independence.

4. Issue Self-Identification That Works

Banks that find their own problems fix them cheaply, on their own timeline, before they compound. Robust practice is a single issue inventory covering findings from all sources, including internal audit, model validation, line self-assessment, examination and external audit. The inventory should report severity ratings, named owners, target dates and root cause recorded. Aging is reported to the board committee quarterly and there is a defined standard for what "closed" means, validated by someone other than the owner.

There is a supervisory bonus at present: the Federal Reserve now presumptively treats promptly remediated self-identified deficiencies as observations rather than MRAs. The industry should take the win while it is available but should build a robust process because it works.

5. Board Reporting That Supports Decision Making

The test is whether a director who does not work in finance can read the ALCO package and answer three questions. How much are we exposed? Is that within what we said we would accept? If it moves against us, what do we do?

Robust packages lead with position against limit, show trend, disclose key assumption sensitivities and state management's recommended action. Weak packages open with sixty pages of output tables and bury the exception at the tail end of the report.

6. Independent Challenge Appropriate to the Balance Sheet

Independence does not require a consultant, but it requires that the reviewer did not run the model and has enough understanding of accounting, modelling and risk management to be competent. For community banks with increasing complexity that usually means contracting outside. For regional and mid-size banks it means a second line with the standing to say no and direct access to the board or its risk committee.

The Consequences of an Inferior Process

In the order they actually arrive.

First, the Losses

Weak governance rarely produces slow decline. It produces a long period in which nothing appears wrong, followed by a short period in which everything is. The specific channels:

• Missed execution windows, because delegated authority was ambiguous and the decision waited.
• Unhedged or mis-hedged rate exposure, because the measurement system did not surface it or the limit did not bind.
• Contingent liquidity that does not function under stress, because the funding plan was written and never tested, collateral was never operationally positioned, or counterparty relationships were assumed rather than confirmed.
• Capital surprises, because AOCI and EVE impacts were understood in treasury but never translated into a capital plan the board had approved.
• Concentration losses, because limits were set portfolio by portfolio and correlation across them was never measured.

Deposit runs now move at the speed of a mobile app and a group chat. The window between "the ALCO notices" and "the funding is gone" has compressed to days.

Then Optionality

A less-than-satisfactory management or composite rating can delay or block an acquisition, a branch expansion, a charter change or financial holding company election and can move a bank out of expedited licensing treatment. For a bank whose five-year plan depends on a transaction, a governance-driven downgrade is not a compliance cost but a strategic one. Separately, with no regulator involved at all, a buyer's diligence will find a weak control environment and price it.

Then Legal and Fiduciary Exposure

Nothing in the last year altered directors' and officers' duties under state corporate law or the standards applied in receivership litigation. If a bank fails, the question asked afterwards is whether the board established appropriate risk limits and whether management adhered to them and reported honestly. "Our examiner did not raise it" has never been a defence and it is a weaker one now that examiners have been told to stop raising process matters. The board minute recording a challenge, a limit and a decision is the artifact that matters.

Then Counterparties and the Market

Rating agencies, FHLB counterparties, correspondent banks, large depositors and equity analysts all form views on management quality. None waits for a CAMELS rating and none is bound by the agencies' current materiality standard.

Finally, Supervisory Consequences

They still exist. An MRA remains available where a practice is contrary to prudent operation and could reasonably be expected to materially harm financial condition. Violations of law are actionable at full force and the Federal Reserve retains MRAs, MRIAs and enforcement authority.

What has been removed, for now, is the early, cheap, process-level criticism that used to function as a free diagnostic. "For now" is the operative phrase.

Six Questions for Your Next ALCO and Board Risk Committee

Our Perspective

The agencies have made a considered judgment that supervision drifted too far into process and away from financial risk. There is a reasonable case behind it. Examination resource spent on documentation quality at a well-capitalised community bank is resource not spent on the concentration that will actually cause a problem.

But that was a judgment about supervision. It was not a judgment that governance stopped mattering. The OCC said as much when it noted that banks falling outside the heightened standards are still expected to maintain robust risk management, simply on their own design.

The institutions that outperform over the next decade will not be those that best anticipate the next examination cycle. They will be those that built governance around their own balance sheet, making them largely indifferent to shifts in supervisory posture. When the pendulum swings back, and it will, they will already be where the new expectations land, having arrived there for their own reasons.