Mergers and Acquisitions: A Compliance Perspective

PDF version of this article

Successful execution of mergers and acquisitions among financial institutions requires significant attention to detail, to ensure that the systems of the surviving institution function in a way that is consistent with laws, regulations, and safe-and-sound banking practice. A successful merger results in an integration of systems encompassing risk management, information technology, Bank Secrecy Act/anti-money laundering, and compliance with consumer protection laws and the Community Reinvestment Act.

In this article, we focus on the importance of planning for the surviving institution’s compliance with consumer protection regulations and the Community Reinvestment Act (CRA). Compliance problems can ensue, for example, if management is unfamiliar with the regulatory requirements associated with some of the activities of the surviving institution, or if the surviving institution crosses any of a number of compliance reporting thresholds as a result of the merger. The seriousness that regulators attach to such issues is evidenced by the fact that some mergers are not approved because of concerns about the quality of these compliance systems at one or more of the potential merger partners

Proactively addressing consumer compliance risks will help bank management avoid violations and maintain the institution’s Compliance Management System (CMS), which is the framework through which an institution oversees its compliance responsibilities and incorporates applicable requirements into its business practices. This article reviews how compliance with consumer protection laws and regulations plays a critical role after a merger or acquisition is approved, and identifies issues to consider when planning for a merger or acquisition or when conducting post-merger or acquisition compliance-focused due diligence. The discussion is structured around a sample template for due diligence and a case study of the merger of two hypothetical banks.

The Importance of Effective Due Diligence

Due diligence is the primary responsibility of the Board and senior management. However, the depth and scope require the involvement of key personnel, including the Compliance Officer, auditors, and department supervisors throughout the merger or acquisition process. An effective merger due diligence process helps ensure the surviving institution’s consumer compliance posture is maintained during and after a merger or acquisition, as it gives the Board and senior management the information it needs to allocate personnel resources in compliance and operational areas. The Board and senior management’s ability to establish and maintain the surviving institution’s CMS¹ will be evaluated by examiners at the next examination through a risk-focused review and transactional testing. An inadequate CMS can lead to violations and adversely affect the bank’s Consumer Compliance Rating.²

Management should also determine the legal and technological risks associated with mergers or acquisitions. For example, will the surviving institution have the technological infrastructure or framework in place to handle the merger, or has the surviving institution considered all legal risks that may surface from combining products and services?

Regulatory Concerns

Consumer compliance issues, such as those relating to fair lending, Unfair or Deceptive Acts or Practices (UDAP), CRA, or the Servicemembers Civil Relief Act (SCRA), among others, can result in legal and reputational risks for the institution. Understanding early in the transaction how consumer protection rules and regulations apply will strengthen efforts to maintain the integrity of the institution’s operations and the CMS. Table 1 lists due diligence considerations from consumer protection laws, rules, and regulations that may apply to and should be considered during and after a merger or acquisition.

The next section presents a merger case study between Bank 123 and ABC Bank that will give perspective on the regulatory and operational impacts listed in Table 1.

Merger of Bank 123 and ABC Bank

Table 2 outlines a merger scenario between Bank 123 and ABC Bank. Bank 123 will be the surviving institution and is embarking on this merger to grow its deposit and loan base in an MSA and add consumer and residential real estate lending to its portfolio. After the merger, Bank 123 intends to close one ABC Bank branch due to low production activity. Issues identified through due diligence as well as the consumer protection regulatory impacts on Bank 123 are discussed in the section following the table.

Due Diligence of ABC Bank Products and Services

Due diligence analysis of products and services in the loan and deposit areas revealed similarities in product types between the two institutions. ABC Bank also offers additional loan products that Bank 123 does not, such as reverse mortgages and HELOCs, and offers deposit rewards programs. As a result, Bank 123 must modify its CMS to ensure applicable regulatory provisions relating to these lending and deposit products are maintained. For example, Bank 123 management should understand:

• how these specialized products function;
• how existing policies and procedures should be enhanced or revised, including daily product administration and monitoring functions;
• how operating and platform systems can accommodate product functionality on grandfathered accounts, such as providing consistent information in periodic statements, revisions to payment processing (structure and cut-off times), and disclosure content;
• the required depth and scope of training for the Board, senior management, and applicable staff;
• the required depth, scope, and frequency of monitoring controls; and
• the required depth, scope, and frequency of the audit program, if applicable.

The analysis of products and services also identified third-party risks in the deposit and lending areas. Reverse mortgages and deposit rewards are offered and serviced by third-party vendors. Senior management should perform risk assessments on each vendor, considering reputational, strategic, and compliance risks, and conduct comprehensive reviews of vendor contracts. Adjustments to Bank 123’s policies and procedures, monitoring controls, and training program should be made to accommodate the terms of agreements.

Regulatory Impacts on Bank 123

Bank management should determine how the CMS should be modified and/ or expanded to reflect the risks identified through the due diligence process. For example:

Assessment Area and Branching

• Bank 123 will become a HMDA reporter. With little residential lending experience and without the benefit of familiarity with HMDA reporting, Bank 123 should provide training to staff to ensure data integrity.
• Bank 123 management should conduct comprehensive reviews of the MSA demographic and economic characteristics to determine the impact on CRA evaluations. For example, management should consider the assessment area’s demographics and how they change the institution’s CRA performance context, and the effect on the institution’s ability to meet the needs of the community. CRA performance evaluations will now include separate conclusions for performance in the MSA and the contiguous non-MSA area. Bank 123’s prior CRA evaluations likely were focused on small-business and small-farm lending. If Bank 123 maintains residential real estate lending in the MSA, this portfolio could become a primary lending product, further changing the institution’s CRA performance profile.
• Bank 123 will need to post and provide required notices and ensure applicable timelines are allowed to expire before closing the branch.

Assets

The increase in assets would change the institution’s CRA profile from a Small Bank to an Intermediate Small Bank (ISB)²⁷ after two consecutive years of assets above published thresholds. The performance evaluation requirements for an ISB incorporate the Community Development Test, which requires the bank to emphasize qualified community development lending, investments, and services that help meet the needs of its community.

Deposit and Loan Products and  Services

The changes in product sets and management’s decision to maintain or grandfather accounts can:

• Affect and trigger changes-interms notifications under Truth in Savings, Truth in Lending, Electronic Fund Transfers, Expedited Funds Availability, FCRA, and Privacy.
• Affect the ongoing administration and monitoring of consumer credit. Management should determine loans that were in a flood zone, were in foreclosure (subject to the Protecting Tenants at Foreclosure Act and Fair Lending), had funds in escrow, if any payments were late, or had private mortgage insurance to ensure proper notifications were provided and subsequent analysis and maintenance was maintained. Management also should consider changes to servicer notifications under RESPA.
• Impact the surviving institution’s product offering. For example, the addition of HELOCs to Bank 123’s product set would require additional policies and procedures, appropriate training and monitoring, and enhanced product administration, such as ensuring customized disclosures and periodic statement formats are maintained after conversion.

Bank 123 did not previously originate a sufficient number of mortgage loans to require the institution and loan officers to register with the national directory as required by the SAFE Act. Management now will need to monitor activities and enforce SAFE Act procedures when necessary.

Bank 123 would need to provide Regulation E opt-in notices to newly acquired customers before charging customers for overdrafts on applicable transactions (i.e., ATM and one-time POS transactions).

Bank 123 will need to review the rewards program. If the rewards program ceases, notification requirements would be triggered. If these accounts are maintained/grandfathered, management should ensure the bank can maintain the program (i.e., provide rewards when applicable), and monitor the activities of the third party to ensure it provides services as disclosed, to prevent potential Unfair or Deceptive Acts or Practices issues. Management also should consider whether to offer the rewards to new and existing depositors to ensure no portion of the financial institution’s community or depositor base is omitted from receiving product benefits.

Bank 123 should provide comprehensive Fair Lending training to newly acquired loan staff that addresses the specifics of the regulations and the bank’s policies and procedures.

Bank 123 should identify and monitor shared deposit customers, as these customers are allowed to restructure deposit accounts for FDIC deposit insurance purposes.

Affiliates

The sharing of information could impact ABC Bank customers from a Privacy Policy perspective. The type of information shared can be restricted by consumers if the affiliate institution will use customer information to market its products and services. Bank management must determine if information-sharing opt-out notices are warranted.

Conclusion

Effective due diligence of consumer compliance issues is critical in every merger or acquisition transaction. This process helps to ensure a smooth transition for the surviving institution and the maintenance of a satisfactory compliance posture. The information presented in this article can be used as a framework for addressing applicable consumer protection laws, rules, and regulations during the due diligence process.

Matthew Z. Zamora
Senior Compliance Examiner
Division of Depositor and Consumer Protection
mzamora@fdic.gov