Skip Header
U.S. flag

An official website of the United States government

Supervisory Insights

Bank Investment in Securitizations: The New Regulatory Landscape in Brief

Last Updated: April 14, 2023

PDF version of this article

The recent financial crisis provided a reminder of the risks that can be embedded in securitizations and other complex investment instruments. Many investment grade securitizations previously believed by many to be among the lowest risk investment alternatives suffered significant losses during the crisis. Prior to the crisis, the marketplace provided hints about the embedded risks in these securitizations, but many of these hints were ignored. For example, highly rated securitization tranches were yielding significantly greater returns than similarly rated non-securitization investments. Investors found highly rated, highyielding securitization structures to be “too good to pass up,” and many investors, including community banks, invested heavily in these instruments. Unfortunately, when the financial crisis hit, the credit ratings of these investments proved “too good to be true;” credit downgrades and financial losses ensued.

In the aftermath of the financial crisis, interest rates have remained at historic lows, and the allure of highly rated, high-yielding securitization structures remains. Much has been done to mitigate the problems experienced during the financial crisis with respect to securitizations. Congress responded with the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), and regulators developed and issued regulations and other guidance designed to increase investment management standards and capital requirements.

The gist of these new requirements is simple: banks should understand the risks associated with the securities they buy and should have reasonable assurance of receiving scheduled payments of principal and interest. This article summarizes the most pertinent of these requirements and provides practical advice on how the investment decision process can be structured so the bank complies with the requirements.

The guidance and regulations applicable to bank investment activities reviewed in this article are:

The OCC’s 12 CFR, Parts 1, 5, 16, 28, and 160. Alternatives to the Use of External Credit Ratings in the Regulations of the OCC

This OCC regulation implemented Section 939A of the Dodd-Frank Act, which required bank regulators to remove references to credit ratings in regulations pertaining to investments and substitute alternative standards of creditworthiness. The final rule was published in the Federal Register on June 13, 2012 and became effective on January 1, 2013. This rule did not drastically shift prescribed bank practice, but rather clarified examiners’ intent to focus on pre-purchase analysis and credit monitoring. This subject was addressed in a Supervisory Insights article titled, “Credit Risk Assessment of Bank Investment Portfolios.”1

Prior to the changes implemented by the Dodd-Frank Act, the top four rating bands assigned by nationally recognized statistical ratings organizations for fixed-income securities were generally considered “investment grade” by bank regulators. With some exceptions outlined below, bank management is now required to perform appropriate due diligence, and conclude that the risk of default is low and the issuer has adequate capacity to pay the principal and interest as scheduled. The rule also requires banks to understand and evaluate the risks of investment securities. For example, the rule states, “Fundamentally…banks should not purchase securities for which they do not understand the risks.”2 

The OCC’s Guidance on Due Diligence Requirements to Determine Eligibility of an Investment

Concurrent with the final rule, the OCC published guidance on due diligence requirements. The OCC guidance states that the following investment securities are generally not subject to the investment grade determination:

  • U.S. Treasury obligations;
  • U.S. agency obligations;
  • Municipal government general obligations; and
  • Municipal revenue bonds–when the investing bank is considered well-capitalized.

For these types of securities, there is no requirement for the investing bank to determine that default risk is low and the issuer has capacity to make scheduled payments. Management is required to assess the potential risks in the pre-purchase analysis and ongoing monitoring. For municipal general obligation bonds and municipal revenue bonds (in the case of well-capitalized banks), an initial credit assessment and regular credit review are required, but the review is not required to meet the test of determining low default risk and adequate payment capacity. Other types of municipal bonds such as Certificates of Participation (COPs) and Tax Increment Financing (TIFs) are neither general obligations nor revenue bonds and, consequently, banks investing in these instruments are required to determine that default risk is low and payment capacity is adequate in the pre-purchase analysis and ongoing monitoring. The OCC’s guidance stipulates that bank management must understand the inherent risks posed by a security before investing. Specifically, the guidance elaborates on expectations of pre-purchase analysis of structured investments, and declares it unsafe and unsound to purchase a complex security without understanding the structure and analyzing the performance under stressed scenarios. Management’s analysis of a particular investment should be documented; the type of documentation varies with the complexity of the investment instrument. For example, a mediumterm note with no call features may be evaluated with comparatively less documentation, while a mezzanine class of a collateralized loan obligation would require substantial documentation to demonstrate an understanding of the instrument and its anticipated performance in stressed scenarios.

The Supervisory Insights article3 mentioned above addresses this subject in greater depth.

The FDIC’s Part 362, Activities of Insured State Banks and Insured Savings Associations

This rule was published December 1, 1998 and became effective January 1, 1999. The FDIC has published various amendments to the regulation since its original effective date, but the general theme of the rule remains the same: to restrict, without the prior approval of the FDIC, insured state banks and savings associations from engaging in activities and investments that are not permissible for national banks or federal savings associations, respectively. Generally, in applying Part 362, the FDIC considers regulatory restrictions imposed by the OCC on national banks and federal savings associations to apply to state banks and state savings associations engaged in the same activities and investments. As such, provisions in the OCC’s regulation on credit ratings applicable to national banks also apply to state banks. Similarly, provisions in the OCC’s regulation on credit ratings applicable to federal savings associations also apply to state savings associations.

The most recent update to this rule specifically applies the OCC’s rule on credit ratings to state savings associations’ investments in corporate debt. Specifically, state thrifts are prohibited from acquiring a corporate debt security before determining the issuer has adequate capacity to repay the debt according to the original terms. The rule requires ongoing periodic determinations of the issuer’s ability to perform according to the terms of the security; the rule applies to corporate debt purchased before the effective date.

The Basel III Capital Rule

The FDIC issued an interim final rule on September 10, 2013 and later issued a final rule on April 8, 2014. For the risk-based capital requirements of most banks, the final rule was effective on January 1, 2015; banks applying the advanced approaches risk-based capital framework were required to comply with certain aspects of the final rule (including the advanced approaches risk-based capital requirements) by January 1, 2014. The FDIC’s Part 324 implements changes required by the Dodd-Frank Act and elements of the international agreement titled “Basel III: A Global Regulatory Framework for More Resilient Banks and Banking Systems” (December 2010, as revised June 2011). This rule is generally known as the “Basel III Capital Rule.”

The rule addresses capital calculations and assigns risk weights to bank assets and exposures used to determine capital ratios. The supplementary information accompanying the rule explains that a securitization is a credit exposure that results from separating an underlying exposure into at least two tranches with differing levels of seniority. Simply stated, if there is tranching of credit risk, the exposure is a securitization. The rule uses the term “exposure” rather than “asset” because the rule addresses onand off-balance sheet risks; “exposure” encompasses both. The rule’s impact on operational requirements for securitization exposures of banks is contained in Section 324.41(c), which covers due diligence requirements for securitization exposures.

Section 324.42 of the rule states, in effect, that the FDIC (or other applicable bank regulatory agency) may require a supervised institution to assign a 1,250 percent risk weight to a securitization exposure if the institution does not understand the features of a securitization exposure that would materially affect its performance. The nature of the institution’s analysis in this respect “must be commensurate with the complexity of the securitization exposure and the materiality of the exposure in relation to its capital.” Assigning a 1,250 percent risk weight with an eight percent capital requirement would have the economic effect of requiring the bank to hold one dollar of capital for every dollar invested in that particular investment security.

Consider a $1 million investment in the mezzanine tranche of a residential mortgage-backed security (MBS). Assume the underlying loans are exhibiting no significant financial stress, and the subordinate tranche reasonably supports the mezzanine tranche. The exact risk weighting is a function of either the simplified supervisory formula approach (SSFA) or the “gross up approach.” For additional information on the SSFA and a calculation tool, consult Financial Institution Letter, 7-2015, ( The nuances of the calculation are not the focus of this article; this example will use a 150 percent risk weight—a plausible risk weight for a mezzanine tranche. Applying a 150 percent risk weight and an eight percent capital requirement results in a capital charge of $120,000 (150 percent risk weight
* $1 million investment * 8 percent capital requirement = $120,000). Failing to meet the due diligence requirements described above would force the capital charge to $1 million (1,250 percent risk weight * $1 million investment * 8 percent capital requirement = $1 million).

The FDIC’s Part 351, Prohibitions and Restrictions on Proprietary Trading and Certain Interests in, and Relationships with, Hedge Funds and Private Equity Funds

The FDIC’s Part 351 was issued on January 31, 2014, and implements Section 619 of the Dodd-Frank Act. The rule is widely known as the Volcker Rule. Among other things, the Volcker Rule prohibits banks from investing in or sponsoring hedge funds and private equity funds; the rule refers to these as “covered funds.” The rule defines a covered fund as an issuer that is exempt from registration as an investment company under the Investment Company Act of 1940 (often referred to as the “ ‘40 Act”) by way of Section 3(c)(1) or Section 3(c)(7) of the ‘40 Act. Section 3(c) (1) and 3(c)(7) exemptions are applicable when the number of investors is limited and the investors meet either an income test or a net worth test, respectively. Banks, thrifts, and bank holding companies are typically considered qualified investors under 3(c)(7). The effective date of the final rule was April 1, 2014; however, banking entities generally had until the end of the conformance period, July 21, 2015, to comply with most provisions of the Volcker Rule. However, the compliance deadline for investments in and relationships with covered funds that were in place prior to December 31, 2013 has been extended to July 21, 2016, and the Board of Governors of the Federal Reserve System has publicly indicated that it anticipates further action to extend the conformance period for these covered funds to July 21, 2017.

The Volcker Rule specifically excepted loan securitizations from the definition of covered funds. As a result, many traditional securitizations held by banks will be excepted from the Volcker Rule as loan securitizations, provided that the underlying assets are limited to loans and certain other credit-related assets. However, introducing even a minimal allocation to equities, bonded debt, commodities, or other non-qualifying assets could result in the securitization investment being considered a restricted covered fund investment. As such, banks need to understand the assets that underlie the loan securitizations in which they invest.

The Investment Decision: Merging the Various Rules Into a Decision Process

Although each rule described above has a distinct objective, one common element is required for complying with each rule: understanding the key features and risks of the investment.

  • Complying with the OCC’s Rule on Alternatives to Credit Ratings and the FDIC’s Part 362 requires a determination that default risk is low and the issuer has the capacity to perform according to the terms of the debt.
  • Complying with the Basel III capital rule for securitizations requires an understanding of the features of a securitization exposure that would materially affect the performance.
  • Determining the Basel III risk weighting for a securitization tranche requires knowledge of the tranche’s specific position in the cash flow waterfall of the securitization and the performance metrics of the underlying loans (all of which is available initially from the offering circular or prospectus and on an ongoing basis from servicer or trustee reports).
  • Complying with the Volcker Rule requires knowledge of the investment’s registration status and asset composition. If the investment is exempt from registration under the Investment Company Act of 1940, management must determine which section was relied upon for exemption. If Section 3(c)(1) or 3(c)(7) were relied upon, the investment is prohibited by the Volcker Rule unless the underlying assets consist only of loans and other qualifying assets.

In each of these cases, understanding the structure and risk characteristics of the investment is required to comply with the rules, and the decision to invest should be supported by appropriate documentation as discussed below.

Demonstrating an understanding of an investment security requires a knowledge of the details of the instrument (purpose, rate, index/margin for adjustable rate issues, maturity, possible extensions, payments in kind, allowable payment deferrals, repayment source, etc.) and consideration of risk factors that could adversely affect performance. A thorough analysis of the performance resulting from interest rate environments ranging from down 300 400 basis points to up 300 400 basis points is appropriate. (In the present low rate environment, down 300 400 basis points is not a relevant scenario for many securities). The analysis should consider the possibility of a deterioration in the credit quality of the issuer(s) and downturns in the industry and the economy. Different types of securities warrant different analyses. Risks should be considered in light of the bank’s portfolio risk. For instance, a single investment in a collateralized loan obligation (CLO) may not present a concentration of risk; however, when the investment is considered alongside other CLO investments in the bank’s portfolio, a concentration in a single name underlying different CLOs may arise. The plausible adverse scenarios should be considered, and management should be confident that the security’s performance is not unduly exposed to plausible adversities.

Often the window to make an investment decision is small; however, urgency to act does not eclipse the need for a prudent evaluation. The overarching question can be answered immediately: “Is bank management familiar with this investment class?” If a bank investment officer is not familiar with the proposed security, the immediate decision should be to defer the investment decision until management has developed an understanding of the security and its associated risks. These instances should be rare because the bank’s investment policy should connect the expertise of management with the permissible investment strategies. If the bank’s board of directors adopts a new investment strategy for its investment policy, the board should ensure the management team possesses the expertise to execute the strategy. In addition, management can construct a decision framework that implements the board’s investment policy and streamlines the investment selection process. One example is an investment’s expected average life. If the board’s investment policy permits mortgage-backed securities, the policy should also address maximum average expected life of the security and set tolerances for variation in the average life. If the policy requires an investment’s average life to be less than ten years in the current interest rate environment and to extend no more than five years in all interest rate scenarios ranging from down four percent to up four percent, that metric could be incorporated into the decision framework.

Some banks use third-party analytics as inputs to their investment decision process. Regulatory guidance regarding due diligence specifies that management may delegate analysis to third parties, but cannot delegate responsibility for decision-making. Management should be satisfied that third-party providers are independent (the broker selling the security is not independent), reliable, and qualified. Projections and analysis from thirdparty providers should be subjected to hindsight analysis. For example, did the analyst’s projected changes in average life prove to be accurate when a change in interest rates was actually observed? The board of directors should review the decision-making process and ensure that the process adequately implements the investment policy.

Presuming the bank’s investment policy permits the proposed investment, and management understands the basic structure and risks of the investment, the next step is to determine whether the investment requires an investment grade determination. If the investment is issued by the U.S. Treasury or an agency of the U.S. government, an investment grade determination is not required, and the decision can proceed to determining the suitability of the investment for the bank. Although the OCC’s regulation on Alternatives to the Use of Credit Ratings does not require municipal general obligation bonds to satisfy the investment grade criteria to be eligible for investment, the guidance does require an initial credit assessment and ongoing reviews consistent with the risk characteristics of the bond and the overall risk of the portfolio.

If the investment is not a U.S. Treasury, agency, or municipal general obligation bond, or municipal revenue bond (in the case of well-capitalized banks), the next concern should be determining whether the investment is a securitization. Recall that, for purposes of the Basel III Capital Rule, any tranching of credit risk results in a securitization. If the proposed investment is not a securitization, the decision can move to determining default risk and ability to perform. If the investment is a securitization, a reasonable first question would be, “Is the issue registered with the SEC as an investment company?” If so, the decision-maker can determine whether the instrument is investment grade. If the issue is not registered, the next question should be, “What section of the ‘40 Act is invoked to avoid registration?” If either Section 3(c)(1) or 3(c)(7) is used, the investment may be a covered fund under the Volcker Rule. The next step is to assess the underlying assets. If the securitization consists entirely of loans, it is not considered a covered fund for purposes of the Volcker Rule. If any asset class other than loans or other qualifying assets is represented, the security may be deemed a covered fund in which case it would be a restricted investment under the Volcker Rule.

Presuming the previous determinations deem the security acceptable to this point, the analysis can move to judging the default risk and the issuer’s capacity to perform according to the stated terms. Regulatory guidance describes “key factors” to consider when gauging credit risk of corporate bonds, municipal bonds, and structured securities. An example of the type of analysis that could be conducted was described in the Supervisory Insights article4 mentioned above. Finally, periodic reviews are required over the life of the investment. The frequency and intensity of the review should be appropriate in light of the risk posed by the specific investment and overall risk of the bank’s portfolio.

An overview of the information contained in this article regarding the pre-purchase analysis of potential securitization investments is contained in the accompanying flow chart (see page 11), “Pre-purchase Considerations for Prospective Securitization Investment.” A footnote to the flow chart refers to the technical assistance available from the FDIC regarding identifying permissible vs. impermissible investments under the Volcker Rule, and calculating securitization capital requirements using the SSFA.

Pre-purchase considerations for prospective securitization investmen

Documenting Analysis

Demonstrating adherence to the various rules will require documentation, but the documentation is no more than that required to effectively execute management’s responsibilities to acquire and monitor the bank’s investments. Management must demonstrate an understanding of the relevant risks, and, in the case of a securitization, of the features that would materially affect the performance of the investment. Management must consider the impact that changes in average life will have on the results realized on an investment. Realized returns on mortgage-backed securities (MBS) can be particularly sensitive to changes in average life. The extreme examples are “principal-only MBS” and “interest-only MBS.” Extending the average life of a principal-only MBS can drastically erode the realized return. Shortening the life of an interest-only MBS can result in losses. To a lesser degree, every MBS purchased at a premium or discount is subject to similar extension or acceleration risk.

A critical pre-requisite to understanding the risks and features of any given investment is being aware of them. The most authoritative source of this information is the original offering document. In the case of registered corporate bonds, it is a Prospectus; for municipal bonds it is an Official Statement; for securitizations exempt from registration, it is an Offering Circular. The offering document will describe in detail the structure of the security and the known risks confronting it. Financial statements are required to determine capacity to perform for corporate bonds and municipal bonds. For structured investments, the periodic trustee reports are required to adequately monitor the investment’s performance. The same document is required to determine whether the issue complies with the Volcker Rule and to gather the necessary data to risk weight the asset.

Collectively, the rules described in this article call for the same documentation that prudent investment management requires. Management may rely on additional documentation or third-party research to support the decision to purchase, retain, or sell a particular investment. Examples are indentures, pooling and servicing agreements, special servicer reports, third-party research, and analytical services. Third-party research lacking independence, such as research authored by the broker selling the security, should be verified with independent sources. All documentation should be included in the investment file along with evidence that management has weighed the information when making a decision. When documentation is incomplete, examiners may cite the deficiency in the examination report on the schedule of “Assets with Credit Data or Collateral Documentation Exceptions.” If acceptable credit quality is not evident, examiners may determine a security, or portfolio of securities, is subject to Adverse Classification. If warranted, the deficiency may be included on the “Examination Conclusions and Comments” page or the “Risk Management Assessment” page. Deficient documentation practices, and/or inadequate credit quality, if sufficiently material, may affect the Asset Quality rating and the Management rating. A poor performing securities portfolio can erode the other rating elements as well.


The adversity of the financial crisis has forced investors and regulators from a comfortable perch of relying on credit ratings. Regulators recognize that credit judgment and analytical talent have long existed in successful banks; the rules discussed in this article remind bank boards of directors to exercise similar credit judgment and analytical skill with respect to the bank’s investment portfolio. Regulators crafted rules to establish standards of evaluation and documentation. Bank boards and managers are expected to implement prudent practices and make well-informed investment decisions that can be reasonably forecasted to withstand inevitable adversities such as deteriorating sectors, general economic downturns, and adverse interest rate movements.

Robert G. Hendricks
Capital Markets Policy Analyst
Division of Risk Management Supervision

1 See  “Credit Risk Assessment of Bank Investment Portfolios,” Supervisory Insights, Volume 10, Issue 1, Summer 2013.

212 CFR Parts 1, 5, 16, 28, and 160. Federal Register, Vol. 77, No. 114, Wednesday, June 13, 2012, page 35254.

3 See for example the Asset Growth and Earnings sections

4 Ibid.