Federal Deposit Insurance Corporation
Office of Inspector General
Federal Deposit Insurance Corporation - Office of Inspector General

Claims Administration System Functionality

This is the accessible text file for FDIC OIG report number EVAL-18-002 entitled 'Claims Administration System Functionality' .

This text file was formatted by the FDIC OIG to be accessible to users with visual impairments.

We have maintained the structural and data integrity of the original printed product in this text file to the extent possible. Accessibility features, such as descriptions of tables, footnotes, and the text of the Corporation’s comments, are provided but may not exactly duplicate the presentation or format of the printed version.

The portable document format (PDF) file also posted on our Web site is an exact electronic replica of the printed version.

Federal Deposit Insurance Corporation Office of Inspector General

FDIC OIG Logo

March 2018

EVAL-18-002

Evaluation Report

Office of Program Audits and Evaluations

Executive Summary

Claims Administration System Functionality

The Claims Administration System (CAS) is a mission-critical system that FDIC personnel use to identify depositors’ insured and uninsured funds in failing and failed financial institutions. For every failing institution, FDIC uses CAS before the failure to estimate the amount of uninsured deposits in order to determine the least costly form of resolution. When an insured deposit transaction is the least cost resolution, the FDIC uses CAS during the closing weekend to determine the amount of the depositors’ funds that are insured and can be transferred to an acquiring institution or paid out directly to the depositors. The capabilities of CAS affect the FDIC’s ability to pay deposit insurance claims in a prompt and accurate manner. Prompt and accurate payment of deposit insurance is essential to the FDIC’s mission because it helps to maintain public confidence in the FDIC, the banking system, and overall financial stability of our nation.

Our evaluation objective was to determine the extent to which CAS has achieved the Division of Resolutions and Receiverships’ (DRR) performance expectations for capacity, timeliness, and accuracy in making insurance determinations.

Results

CAS has substantially met the FDIC’s expectations for capacity, timeliness, and accuracy in making insurance determinations for most insured institutions. Recognizing the difficulties in resolving a large institution over a closing weekend, the FDIC issued rules intended to mitigate potential shortfalls in CAS capability, but at a cost to the banking industry. Accordingly, the largest financial institutions (those with 2 million or more deposit accounts) are required to configure their information systems and data to enable the FDIC to make insurance determinations. However, further simulation and testing for failing and failed large bank scenarios would also provide the FDIC with greater certainty of CAS’s capabilities. This testing would facilitate resolution planning for potential large bank failures and decrease the risk of untimely insurance determinations.

The FDIC has not fully validated the maximum processing capacity of CAS. In the original justification for CAS in 2006, FDIC program officials initially expected that CAS could make insurance determinations for an institution of any size, up to 5 million deposit accounts. Because the FDIC recognized that it could not achieve this expectation due to the account complexities at larger institutions, the FDIC adjusted its expectations so that CAS should be able to make insurance determinations for institutions with up to 2 million deposit accounts. According to FDIC executives, the current development efforts should move CAS forward in achieving capacity expectations.

CAS improved timeliness of insurance determinations compared to the predecessor system through process automation and ongoing system improvements. The Federal Deposit Insurance Act requires the FDIC to provide depositors with access to insured funds “as soon as possible.” The FDIC’s goal is to provide depositors at failed institutions with access to their insured funds within one or two business days of failure. Although the FDIC has never failed to meet its timeliness standard for insurance determinations to date, due to the volume and complexity of large bank deposit platforms, CAS may not be able to meet the FDIC’s one or two business day goal for the largest institutions. In such cases, the FDIC may withhold a portion of the failed institution’s deposits until an insurance determination can be made.

Regarding accuracy in making insurance determinations, CAS has reduced the risk of inaccurate insurance determinations as compared to the predecessor system by decreasing the opportunity for human error through automation and implementation of process controls. The FDIC strives to provide an accurate estimate of uninsured deposits as one component of the least cost test during pre-closing, to ensure that each depositor receives the maximum deposit payment allowable by law, and to minimize any overpayment of deposit amounts during closing. In this regard, the FDIC believes that CAS capabilities and procedures provide reasonable assurance of the accuracy of insurance determinations.

Recommendations

We recommend that the FDIC (1) conduct additional testing regarding CAS capacity in making insurance determinations; (2) conduct additional testing regarding CAS timeliness in making insurance determinations; and (3) document performance expectations for capacity, timeliness, and accuracy to provide parameters for testing.

[End of Executive Summary]

Contents

Background

Evaluation Results

Improved Capacity But Needs Further Testing

Improved Timeliness But Needs Further Testing

Accuracy in Insurance Determinations

Conclusion and Recommendations

Other Matter

Corporation Comments and OIG Evaluation

Appendices

1. Objective, Scope, and Methodology

2. Deposit Insurance Categories

3. CAS Insurance Determination Process

4. Glossary

5. Acronyms and Abbreviations

6. Corporation Comments

7. Summary of the Corporation’s Corrective Actions

Tables

1. Resolution Transaction Types (September 2010 – December 2017)

2. Events Testing CAS Capacity

Figures

1. Timeline of CAS Use in Failing and Failed Financial Institution Resolutions

2. CAS Insurance Determination Process

[End of Contents]

[FDIC OIG letterhead, FDIC OIG logo, Federal Deposit Insurance Corporation, Office of Inspector General, Office of Program Audits and Evaluations]

March 16, 2018

Bret D. Edwards, Director, Division of Resolutions and Receiverships

Subject Claims Administration System (CAS) Functionality

The Federal Deposit Insurance Corporation (FDIC) insures deposits up to the legal limit of $250,000. Should an insured depository institution1 fail, the FDIC must resolve the institution in the least costly manner and make a timely insurance determination for each insured depositor. The Claims Administration System (CAS) is a mission-critical system2 that FDIC personnel use to ascertain depositors’ insured and uninsured funds in failing and failed financial institutions. For every failing institution, the FDIC uses CAS before the failure to estimate the amount of uninsured deposits in order to determine the least costly form of resolution.3 When an insured deposit transaction is the least cost resolution, the FDIC uses CAS during the closing weekend to determine the amount of the depositors’ funds that are insured and can be transferred to an acquiring institution or paid out directly to the depositors. For all failures, CAS is the system of record for the deposits of the failed institution.

Footnote 1: Certain terms that are underlined when first used in this report are defined in Appendix 4, Glossary.[End of footnote]

Footnote 2: A mission-critical or high-priority application is one in which the damage or disruption to the systems would cause the most impact on the organization, mission, and other networks and systems. National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems. [End of footnote]

Footnote 3: The Federal Deposit Insurance Corporation Improvement Act (FDICIA) requires the FDIC to resolve failed institutions using the least costly method to reduce impact on the Deposit Insurance Fund (DIF), commonly referred to as the least cost transaction (Public Law No. 102-242, 105 Stat. 2236 (1991)).[End of footnote]

The capabilities of CAS affect the FDIC’s ability to pay deposit insurance claims in a prompt and accurate manner. Prompt and accurate payment of deposit insurance is essential to the FDIC’s mission, because it helps to maintain public confidence in the FDIC, the banking system, and overall financial stability of our nation.

Our evaluation objective was to determine the extent to which CAS has achieved the Division of Resolutions and Receiverships’ (DRR) performance expectations for capacity, timeliness, and accuracy in making insurance determinations. We conducted this evaluation in accordance with the Council of the Inspectors General on Integrity and Efficiency’s Quality Standards for Inspection and Evaluation.

Background

As of June 30, 2017, the FDIC insured 5,787 institutions of which 5,011 were commercial banks and 776 were savings institutions. The insured institutions have total assets greater than $17 trillion and total deposits of approximately $13.1 trillion.4 Currently, if any of these institutions fail, CAS will be used in the resolution of the institution.

Footnote 4: A bank’s assets (future economic benefit) include loans to individuals, commercial loans, real estate owned by the bank, and securities. Deposits are the bank’s primary liability (future obligation). [End of footnote]

The FDIC as Financial Institutions’ Deposits Insurer

The FDIC insures deposits up to the current statutory limit of $250,000 and promotes sound banking practices of insured institutions. In its unique role as deposit insurer, and in cooperation with other federal and state regulatory agencies, the FDIC promotes the safety and soundness of insured depository institutions and the stability of the U.S. financial system. It identifies, monitors, and addresses risks to the Deposit Insurance Fund (DIF)5 through its bank examination process. When an insured depository institution fails, the FDIC is appointed as the receiver. In this role, the FDIC is responsible for recovering the maximum amount possible from the disposition of the receivership’s assets and for resolving the receivership’s claims.

Footnote 5: An insurance fund used to protect insured financial institution depositors from loss due to institution failures. The FDIC is the administrator of the DIF. [End of footnote]

Deposit Insurance Limit and Categories

The Federal Deposit Insurance Act (Act) provides that “the net amount due to any depositor at an insured depository institution shall not exceed the Standard Maximum Deposit Insurance Amount (SMDIA). . . .”6 The Act also provides that in applying the SMDIA, which is currently at $250,000, the FDIC “shall aggregate the amounts of all deposits in the insured depository institution which are maintained by a depositor in the same capacity and the same right for the benefit of the depositor. . . .”7

Footnote 6: 12 U.S.C. § 1821(a)(1)(B). [End of footnote]

Footnote 7: 12 U.S.C. § 1821(a)(1)(C). [End of footnote]

Based on the Act, the FDIC recognizes 14 separate categories of deposit accounts that are insured separately up to the SMDIA. The number and variety of insurance categories contributes to the complexity in making insurance determinations for a failed institution. Each individual deposit account must be properly identified by ownership and insurance category to make an accurate insurance determination. Appendix 2 summarizes the categories of deposit accounts that are separately insured by the FDIC.

Failed Bank Resolution Process

DRR manages the resolution process. The Claims Administration Section (Claims Section) within the Receivership Operations Branch of DRR operates CAS and makes insurance determinations for failing and failed financial institutions during the resolution process.

Resolution activities begin when an institution’s primary regulator notifies the FDIC of a potential failure. Upon notification, the FDIC, in conjunction with the primary regulator, contacts the failing institution’s chief executive officer and arranges for DRR specialists to go to the institution to gather information in preparation for the potential closing. During this on-site visit, DRR analyzes the institution’s financial and operational structure. DRR then selects the resolution option that results in the least cost to the DIF. Currently, the FDIC uses the following resolution methods: Purchase and Assumption (P&A), Payout, Insured Deposit Transfer (IDT), and Deposit Insurance National Bank (DINB).8

Footnote 8: In a P&A transaction, a healthy institution agrees to purchase some or all of the assets of the failed institution and assumes some or all of the liabilities, including all deposits (P&A All Deposits) or just insured deposits (P&A Insured Deposits), consistent with the terms of the P&A agreement. In a payout, the FDIC, as insurer, pays all the insured depositors of the failed financial institution, usually by check, the insured deposit amount. In an Insured Deposit Transfer (IDT), the FDIC transfers the insured deposits of the failed institution to one or more insured depository institutions, called an Agent Bank, which acts as a paying agent for the FDIC on insured deposits. Under certain circumstances, the FDIC will charter a new national bank or federal savings association called a DINB. A DINB transaction is considered a hybrid of a payout and an IDT, with the DINB assuming and paying out insured transactional accounts over a limited period of time (typically 30 days). After the payout is complete through the DINB, its charter expires and its existence ceases. [End of footnote]

As discussed earlier, DRR uses CAS to make insurance determinations at two points in the resolution process—deposit insurance estimates during pre-closing for consideration in determining the least costly form of resolution and during closing in the event the FDIC has to transfer insured deposits to an acquiring institution or to the account owner (in the event of a deposit payout). The vast majority of resolutions are P&A All Deposit transactions that do not require DRR to make an insurance determination over a closing weekend. Of the 241 resolutions completed since 2010, the FDIC used P&A All Deposit transactions in 233 bank failures; therefore, while the agency used CAS to make preliminary insurance determinations during pre-closing and other deposit account reconciliations during closing, the insurance determinations were not made over a closing weekend. An insurance determination is not required at closing for a P&A All Deposits resolution because the acquiring institution assumes all deposits of the failed institution. In such resolutions, the deposit account holder would not lose any of their deposit amounts, regardless of whether the deposit amounts are insured or uninsured. In the remaining eight cases, the FDIC used CAS to make an insurance determination over a closing weekend. Table 1 shows the resolution transaction types and when an insurance determination is required:

Table 1: Resolution Transaction Types (September 2010 – December 2017)

Row 1; Resolutions Transaction: [Check mark]; Insurance Determination Required? - Pre-Closing: Insurance Determination Required? Closing: 233; Number:

Row 2; Resolutions Transaction: [Check mark]; Insurance Determination Required? - Pre-Closing: [Check mark]; Insurance Determination Required? Closing: 1 Number:

Row 3; Resolutions Transaction: [Check mark]; Insurance Determination Required? - Pre-Closing: [Check mark]; Insurance Determination Required? Closing: 4 Number:

Row 4; Resolutions Transaction: [Check mark]; Insurance Determination Required? - Pre-Closing: [Check mark]; Insurance Determination Required? Closing: 3 Number:

Source: DRR Claims Administration and the FDIC’s Failed Bank List

[End of table]

Figure 1: Timeline of CAS Use in Failing and Failed Financial Institution Resolutions

Pre-Closing - (Notification up to Closing Weekend)

This phase begins when the institution’s primary regulator notifies the FDIC of a potential failure and ends just prior to Closing Weekend. CAS activities include:

· Deposit download file is loaded into CAS.

· CAS is used to make preliminary insurance determinations.

· Based on CAS’s estimate of uninsured depositors, DRR publishes the Uninsured Deposit Estimate Memorandum (UDEM) for use in determining the least cost resolution.

Closing - (Friday Afternoon – Monday Morning)

This phase begins when a failed institution closes and ends when an Acquiring Institution reopens it on the next business day or payout begins (called the Closing Weekend). CAS activities include:

· Final deposit download file is loaded into CAS.

· CAS is used to make insurance determinations (for insured transactions only).

· Financial transaction sent to DRR accounting.

Post-Closing - (Re-Opening/Payout – Close of Receivership)

This phase begins when the acquiring institution re-opens the failed institution or payout begins and ends when the receivership closes. CAS activities include:

· Post-closing reports are generated.

· Deposit Insurance case files are resolved. · Deposit account holds are managed.

· Claims Section processes broker accounts (if any).

[End of figure]

Role of CAS in Making Insurance Determinations

CAS provides a central repository of claims data used by DRR to prepare pre-closing estimates of insured and uninsured deposits, to manage failed institution closures, and to administer the subsequent claims processing and tracking. CAS comprises two sub-systems: CAS Deposit Insurance (DI) and CAS Non-Deposit Claims (NDC). Together these systems assist DRR in preparing for the potential failure of a financial institution and processing claims arising from the failure of a financial institution.

CAS DI is used for three purposes: (1) to determine the amount of uninsured funds held at a potentially failing institution, (2) to determine the amounts to pay depositors for their insured funds, and (3) to transfer all deposits to an acquiring institution. The initial estimate of uninsured deposits is one component in making the least cost transaction determination.9 FDIC Claims Section personnel use CAS NDC to process claims made primarily by non-deposit creditors against a failed financial institution, including subordinated debt holders and stockholders. Because we sought to review CAS capabilities for insurance determinations, we limited our analysis to CAS DI.10

Footnote 9: The uninsured deposits estimate establishes the amount of uninsured deposits as a component of the least cost test. The uninsured deposits determination is also used, among other things, to estimate the claims on the receivership. [End of footnote]

Footnote 10: Any subsequent use of the term “CAS” refers to the CAS DI sub-system. [End of footnote]

CAS automatically makes insurance determinations by aggregating a financial institution’s deposit data by insurance category for each depositor. For example, if a depositor has a personal account in a financial institution with a balance of $150,000 and another account in the same institution for a sole proprietorship business with a balance of $150,000, those accounts would be aggregated under the single ownership accounts insurance category. In this example, the combined balance would be $300,000, of which $250,000 would be insured and $50,000 would be uninsured. If the owner had deposits in any other insurance categories, such as joint ownership or retirement accounts, the owner also would be eligible for deposit insurance up to $250,000 for each of those account categories. DRR Claims Section personnel perform a manual review, called exceptions processing, of all depositor cases with a balance in excess of $250,000 for accuracy in categorization, ownership, and/or matching. Figure 2 illustrates the insurance determination process described above. Appendix 3 presents the CAS insurance determination process in greater detail.

Figure 2: CAS Insurance Determination Process

(flow chart)

Failed or Failing Institution’s deposit data is downloaded to CAS

Extract, Transform, and Load (ETL) Process

Deposit Account Owners are Identified

CAS aggregates data by Owners and Insurance Categories

CAS balances are reconciled to failed institution’s deposit account records

Depositor Cases over $250,000 are identified as Exceptions

Exceptions are assigned to individual Claims Personnel in CAS

Claims Personnel review Exceptions for accuracy in ownership and categorization and make corrections in CAS

Joint Checker Report

Second-Level Reviewer checks Exceptions Processing and either approves or rejects

UDEM is prepared (Pre-Closing Only)

At Closing, Financial Transactions are transmitted to DRR Accounting (Payout or Transfer to another institution)

Source: OIG Review of DRR Claims Manual and Interviews

[End of figure]

The FDIC’s Investments in CAS and Its Evolution

In 2002, DRR began formally planning a replacement of its legacy system for claims administration, the Receivership Liability System (RLS), and it engaged five contractors to define requirements for the new system. These efforts included revising the claims process and planning for CAS. In 2003, DRR presented options for the new CAS to the FDIC’s Capital Investment Review Committee (CIRC). The CIRC approved the CAS project to proceed with comprehensive planning in April 2003.

The FDIC has developed and implemented three major versions of CAS. During the past 12 years, the FDIC has spent a total $45.8 million on CAS development.

CAS 1.0. In October 2006, DRR and the Division of Information Technology (DIT) recommended to the FDIC Board of Directors that the FDIC adopt the product approved by the CIRC, called CAS. The recommended product would automate insurance determinations and facilitate the quick release of funds for any size institution. CAS would replace the existing claims system, RLS, which had been in use since July 1999. The Board Case analysis determined that RLS was outdated, not scalable, and could only handle institutions with up to 150,000 depository accounts.11 DRR and DIT anticipated that CAS would have sufficient capacity to process an institution as large as five million depository accounts.12 Further, according to the Board Case, CAS would also produce efficiencies and reduce costs in the FDIC’s claims process, regardless of the institution size, and it would improve capabilities, including technological upgrades, data integration, flexibility, scalability, and customer service. The FDIC anticipated savings resulting from reduced overtime salaries and travel expenses. The FDIC spent $37.5 million on the CAS 1.0 investment.13

Footnote 11: A Board Case is a written justification for proposed action presented to the FDIC’s Board of Directors for their consideration and decision. [End of footnote]

Footnote 12: The Board Case and the CAS 1.0 contract both specified that CAS should be able to make insurance determinations for institutions that had up to five million deposit accounts.

However, the contract did not address timeliness in making insurance determinations. [End of footnote]

Footnote 13: DRR initially estimated, and the FDIC Board approved, $21.7 million in capital investment funding to develop CAS 1.0. In June 2008, the FDIC Board approved an additional $7.6 million to complete CAS 1.0 development. The FDIC spent $28.1 million of the Board-approved funding. The FDIC also spent $9.4 million in operational funds (non-capital investment funding) associated with CAS development. [End of footnote]

CAS 2.0. In July 2012, DRR and DIT recommended an upgrade to CAS to replace a technology that no longer met the requirements of CAS. The upgrade was projected to reduce the time needed to perform insurance determinations over a closing weekend by 50 percent. The FDIC spent $5.2 million on the CAS 2.0 investment.

CAS 3.0. In July 2015, DRR and DIT requested funding for a series of functional enhancements to further improve the performance of CAS. The proposed enhancements to CAS, called the Deposit Resolution Optimization (DRO) project, would enable the FDIC to perform insurance determinations for larger institutions in a timely manner. According to the FDIC, CAS would accomplish this by reducing average processing time for deposit insurance determinations and the amount of time needed by Claims Section personnel to perform exceptions processing.14 DRR and DIT estimated that these upgrades would decrease the amount of time to input institutions’ data into CAS by up to 20 percent and deposit claims processing time by up to 35 percent. These benefits would be realized through functional enhancements to CAS in three releases, including:

- Release 1: Implementing a CAS data refresh capability,15

- Release 2: Reengineering data transformation and load processing,16 and

- Release 3: Reengineering the Outstanding Official Item, DINB, and Broker Deposit modules to incorporate the enhancements implemented in Releases 1 and 2.

Footnote 14: DRR Claims Section personnel manually review the accounts of depositors whose aggregate balance of accounts exceeds $250,000 to ensure the accuracy of the automated insurance determination for those accounts. This process is called exceptions processing. [End of footnote]

Footnote 15: Data refresh enables the system to retain Claims Section personnel’s pre-closing insurance estimation work that was based upon early downloads of deposit data for later use when performing insurance determinations with post-closing deposit data.[End of footnote]

Footnote 16: Reengineering data transformation and load processing would facilitate the conversion of an institution’s deposit data into a compatible format for use in CAS.[End of footnote]

As of June 20, 2017, the FDIC had spent approximately $3.1 million of the $10.8 million authorized by the FDIC Board on the CAS 3.0 investment.

Deposit Insurance Related Rules

According to DRR executives, the accelerated pace of the consolidation within the banking industry since 2005 has been unprecedented. In the third quarter of 2005, there were 8,854 insured institutions. By the third quarter of 2017, insured institutions decreased by 3,117 or 35 percent to 5,737 institutions. This consolidation created complex banking information systems throughout the industry. Large banks17 often have multiple deposit systems resulting from mergers with other banks. Complex account types further increase the difficulty in making insurance determinations for large banks. Consequently, rulemaking on insurance determinations has complemented CAS enhancement efforts and mitigated limitations in CAS capability.

12 C.F.R. § 360.9. This rule, which became effective on August 18, 2008, requires covered institutions to post and remove provisional holds on depositor accounts and provide a standard data format for generating deposit account and customer data.

The rule is intended to allow the deposit and other operations of a large insured depository institution . . . to continue functioning on the day following failure. The rule also is intended to permit the FDIC to fulfill its legal mandates regarding the resolution of failed insured institutions to provide liquidity to depositors promptly, enhance market discipline, ensure equitable treatment of depositors at different institutions and reduce the FDIC’s costs by preserving the franchise value of a failed institution.18

Footnote 18: 73 Fed. Reg. 41195 (Jul. 17, 2008).[End of footnote]

This rule is intended to give DRR the time that it needs to make an accurate insurance determination for a large bank resolution while providing customers access to a portion of their funds on deposit.19

Footnote 19: The FDIC has never implemented provisional holds per 12 C.F.R. § 360.9 for a bank failure.[End of footnote]

Because § 360.9 did not adequately address the challenges inherent in making timely and accurate insurance determinations in large institution failures, the FDIC issued another rule to help ensure timely resolution of the largest institutions – 12 C.F.R. Part 370. When issuing the new rule, the FDIC explained,

While Section 360.9 would assist the FDIC in fulfilling its legal mandates regarding the resolution of a failed institution that is subject to that rule, the FDIC believes that if the largest of depository institutions were to fail with little prior warning, additional measures would be needed to ensure the prompt and accurate payment of deposit insurance to all depositors . . . . Because of the potential problems posed by delays in determination and payment of deposit insurance, improved strategies must be implemented to ensure that deposit insurance can be paid promptly.20

Footnote 20: 81 Fed. Reg. 87735 (Dec. 5, 2016).[End of footnote]

12 C.F.R. Part 370. This rule requires covered institutions to have Information Technology (IT) systems that are capable of accurately calculating the deposit insurance coverage for each deposit account in accordance with the insurance determination rules21 within 24 hours after the FDIC is appointed as receiver. The rule became effective on April 1, 2017, and banks covered by the rule must be in compliance by April 2020. It applies to institutions with two million or more deposit accounts. As of June 2016, the 38 institutions that would be covered by this rule had between 2 million and 87 million deposit accounts. Of the 38 covered institutions, 13 had over 5 million deposit accounts, thereby exceeding DRR’s originally planned capacity for CAS.

As such, according to DRR executives, the FDIC will not use CAS in failed institution resolutions covered by Part 370, but will use CAS for those institutions with fewer than two million deposit accounts. DRR has made an insurance determination for an institution with more than two million deposit accounts. Nevertheless, DRR believes there are good reasons to continue optimization of CAS capacity for making insurance determinations. For example, 12 C.F.R. Part 370 is not in full effect until April 2020, so CAS is the only option for a very large bank failure until then. Further, DRR has not used CAS to make an insurance determination for a large bank failure during a closing weekend, and the CAS optimization is intended to result in more timely insurance determinations.

When issuing Part 370, the FDIC determined that coverage should start at two million accounts. Financial institutions with over two million deposit accounts generally have their own unique IT systems, or multiple platforms as a result of mergers and acquisitions. The FDIC also concluded that institutions with more than two million deposit accounts had the necessary resources to handle the technical challenge of making insurance determinations for their customers.

The FDIC estimated the total cost to covered institutions to comply with the requirements of Part 370 at $386 million.22 The FDIC noted that this cost is small in comparison to the covered institutions’ revenues and expenses and noted that industry costs represent 0.25 percent of pre-tax net income for the 38 covered institutions.

Footnote 22: The total estimated cost of the rule is $478 million, of which, $386 million will be borne by covered institutions and the remainder will be borne by depositors and the FDIC. [End of footnote]

The FDIC reported that benefits of the rule will accrue broadly to the public, bank customers, banks not covered by the rule, and the covered institutions. These benefits include ensuring prompt and efficient deposit insurance determinations; preserving the liquidity of deposit funds; enabling the FDIC to more readily resolve failed institutions; reducing the costs of failure of a covered institution by increasing the FDIC’s resolution options; and promoting long-term stability in the banking system.23 The FDIC reported that the rule should also benefit covered institutions by leading to efficiencies in managing customer data, improving their ability to serve their customers, and increasing their depositors’ confidence that deposit insurance can be paid promptly.

Footnote 23: The rule promotes long term stability by reinforcing public confidence in the banking system and reducing the misperception that uninsured depositors at large banks are less likely to incur losses in the event of failure than their counterparts at smaller institutions.[End of footnote]

Evaluation Results

CAS improved capacity, timeliness, and accuracy in making insurance determinations over the legacy RLS system. DRR did so by automating the insurance determination process, implementing controls that help ensure accuracy, and improving CAS to increase its capabilities.

However, CAS may not be able to meet the FDIC’s goals for capacity and timeliness for some large institutions. DRR had originally envisioned that CAS would have the capacity to make insurance determinations for financial institutions of any size. This included a system development expectation that CAS would be able to make an insurance determination for an institution with up to five million deposit accounts. DRR has made a pre-closing insurance determination using CAS for an institution with over 2.5 million accounts but has not tested CAS’s capacity further over a closing weekend.

As DRR and contractor staff developed CAS, the complexities of making an insurance determination for large institutions became apparent. DRR determined that inconsistent and incomplete institution records, combined with different and complex IT depositor information systems, created challenges for the FDIC in making prompt insurance determinations. To mitigate these challenges, the FDIC issued rules requiring large institutions to configure their deposit accounts in a standard format and develop the capability to calculate deposit insurance amounts. These rules should help to mitigate possible CAS limitations in capacity or timeliness in making insurance determinations for a large bank.

Improved Capacity But Needs Further Testing

DRR has not yet tested the maximum processing capacity of CAS. The original Board Case for CAS involved an expectation that CAS could make insurance determinations for an institution of any size, up to five million deposit accounts. Because the FDIC later recognized that it could not achieve this goal due to the account complexities at larger institutions, DRR subsequently adjusted its expectations for CAS capacity with the issuance of Part 370.

Currently, DRR expects that CAS should be able to make insurance determinations for institutions as large as two million deposit accounts (see section on 12 C.F.R. Part 370 for further discussion). This updated expectation was necessary because field testing revealed the complexities in making insurance determinations for larger institutions as discussed above. Additionally, through consultations with the banking industry, the FDIC determined that it would not be able to load the account data for the largest banks into CAS in a timely manner, since it would present a technical challenge too difficult to overcome. To mitigate these challenges, the FDIC issued two rules that required large institutions to configure their deposit accounts and customer data in a standard format; create protocols for implementing provisional holds; and for the largest institutions (2 million deposit accounts or more), develop the capability to calculate deposit insurance coverage for their customers. The cost to covered institutions to implement these two rules is projected to be $75 million (§ 360.9) and $386 million (Part 370), respectively.

Evidence of CAS Capacity

DRR’s Claims Section tested the capacity of CAS to make insurance determinations for financial institutions of various sizes, including an institution with over 2.5 million deposit accounts. DRR completed this testing primarily using actual deposit downloads for a potentially troubled institution while making preliminary insurance determinations. DRR completed at least one simulated closing using CAS for a large bank (1.4 million deposit accounts) in December 2013. Table 2 summarizes the major events in which DRR has tested the capacity of CAS.

Table 2: Events Testing CAS Capacity

Source: DRR Claims Administration

Row 1 Event: Actual failed institution - payout; Date: October 2012; Approximate Number of Deposit Accounts: 12,000; Results: DRR made a timely insurance determination over a closing weekend for an insured deposit payout.;

Row 2 Event: “CAMCO” Simulation (Large Bank insurance determination over a closing weekend); Date: December 2013; Approximate Number of Deposit Accounts: 1.4 million; Results: DRR tested improvements in exceptions processing from CAS 1.0 to CAS 2.0; although timeliness improved, DRR was not able to complete exceptions processing over a closing weekend.;

Row 3 Event: Actual pre-closing insurance determination for a Large Bank; Date: September 2016; Approximate Number of Deposit Accounts: 2.5 million; Results: DRR completed a preliminary insurance determination during pre-closing for a potentially troubled institution.;

Source: DRR Claims Administration

[End of table 2]

DRR’s Claims Section plans to continue to test CAS capacity by making preliminary insurance determinations in CAS for failing institutions. DRR’s Claims Section has also created a test bank with 5 million deposit accounts which it plans to process in CAS after Release 3 is completed, which is anticipated to occur in 2019. DRR does not have an estimated timeframe to complete this testing. According to DRR executives, the current DRO effort should move CAS forward in achieving the original performance expectations for capacity. DRR has released CAS Data Refresh (DRO Release 1) and is scheduled to release DRO Release 2 in April 2018. This upgrade is designed to reengineer data transformation and load processing. DRO Release 3 will further enhance scalability of CAS for use in resolving large banks. Nevertheless, DRR remains uncertain of whether CAS could be used to make an insurance determination on the largest institutions. However, Part 370, once implemented, should address the risk that FDIC may not be able to timely resolve a large failed institution.

We are recommending that DRR continue to conduct additional testing regarding CAS’s capacity in making insurance determinations. We are also recommending that DRR explicitly document its performance goal for CAS capacity (i.e., making insurance determinations for failed institutions with up to 2 million deposit accounts). Documenting this information will help ensure that officials involved in improving and optimizing CAS have a common understanding of the capacity goal.

Improved Timeliness But Needs Further Testing

CAS improved timeliness of insurance determinations as compared to RLS, the predecessor system, through process automation and ongoing system improvements. The Federal Deposit Insurance Act requires the FDIC to provide depositors with access to insured funds “as soon as possible.”24 The FDIC’s goal is to provide depositors at failed institutions with access to their insured funds within one or two business days following failure.25 However, there is a risk that CAS may not be able to meet the FDIC’s timeliness goal for the largest institutions as explained below. Nevertheless, according to DRR officials, the FDIC has never failed to meet its own timeliness standard for insurance determinations, regardless of the claims processing system in use.

Footnote 24: 12 U.S.C § 1821(16)(f). [End of footnote]

Footnote 25 The FDIC, Division of Resolutions and Receiverships Claims Manual, Page IV-R-1, November 2016.;[End of footnote]

Comparison of CAS and RLS Timeliness

CAS increases the timeliness of the insurance determination process compared to RLS by automating the insurance determination process and significantly decreasing the amount of manual processing required for accurate insurance determinations. RLS sorted the bank’s data by account. With respect to RLS, Claims Section personnel printed the sorting report26 and manually aggregated the deposits by owner and type. Claims Section personnel then manually determined the insured and uninsured amounts for each depositor, and then updated the data and manually re-entered it into RLS.

Footnote 26: The sorting report displays all of the deposit accounts from the failing institution’s deposit download.

Conversely, CAS sorts the bank's data by owner and type of account and automatically makes an insurance determination. As discussed earlier, Claims Section personnel review all depositor cases with a balance greater than $250,000 as exceptions. In a sample of failing banks DRR provided to the Office of Inspector General (OIG), about 2 percent of the failing institutions’ deposit accounts required exceptions processing.27 RLS required every claim to be reviewed manually for an insurance determination. CAS requires a review of only a small percentage of depositor cases during exceptions processing. Notwithstanding, the time required to complete exceptions processing impacts the timely resolution of large banks.

Footnote 27: DRR provided the OIG a data sample for 10 failing banks that included the total number of deposit accounts and the total cases resolved in exceptions processing for each failing bank. Since a case includes all accounts for an owner, we estimated that each case would have three deposit accounts. This enabled us to estimate the number of deposit accounts that Claims Section personnel reviewed in exceptions processing. We divided the number of deposit accounts reviewed for exceptions processing by the total number of deposit accounts at the failing institutions to determine the percentage of deposit accounts reviewed in exceptions processing. [End of footnote]

DRR Use and Testing of CAS Timeliness

Since its implementation in September 2010, DRR has used CAS to resolve 241 failed banks. Eight of those resolutions required CAS to complete insurance determinations over a closing weekend, the largest of which had 12,750 deposit accounts.28 However, the FDIC has tested CAS’s ability to process larger deposit files over a closing weekend.

Footnote 28: CAS has been used 241 times for failed bank resolutions; 8 of those times were used for insurance determinations over a closing weekend; for the other 233 resolutions, CAS made preliminary insurance determinations during pre-closing and completed account reconciliations (with no insurance determinations necessary) during closing.[End of footnote]

“CAMCO” Simulation. When the FDIC deployed CAS 2.0 in October 2013, DRR tested the updated system to compare its performance to the prior version of CAS. The test sought to (1) determine the number of hours to complete insurance determinations, (2) reevaluate a data set tested in the prior CAS environment to compare the processing times from both versions of CAS, and (3) test the capacity and performance of CAS for a large deposit download. The test processed deposit insurance determinations for a simulated institution with over 1.4 million deposit accounts under closing weekend conditions.

DRR found that there was a reduction in the amount of time it took to process exceptions for this data set. However, the reduction was not substantial enough to process a deposit download of this size over a closing weekend.29 DRR found that CAS 2.0 decreased the time for Claims Section personnel to process a single exception case by 48 percent and increased the number of cases processed per hour for both first and second-level reviews by 87 and 76 percent, respectively.

CAS Data Refresh. The CAS 3.0 (DRO) data refresh release resulted in a reduction in processing time, greater than the projected 35-percent goal indicated in the DRO Board case. DRR tested three institutions by comparing results of a download file with data refresh against the same file without data refresh.30 The CAS 3.0 data refresh realized a 92-percent reduction in processing time for a small bank, an 80-percent time savings for a medium-sized, complex bank, and a 44-percent time savings for a large complex bank.

Footnote 30: Data refresh enables the system to retain Claims Section personnel’s pre-closing insurance estimation work that was based upon early downloads of deposit data for later use when performing insurance determinations with post-closing deposit data. Prior to data refresh capability/functionality, Claims Section personnel would have to engage in exceptions processing each time an updated deposit file was loaded into CAS. [End of footnote]

DRR has taken steps to improve the timeliness of insurance determinations using CAS. While DRR has not rigorously tested CAS’s ability to make timely insurance determinations during an actual closing weekend scenario, DRR has used CAS in hundreds of pre-closing situations to make insurance determinations for least cost test purposes. DRR officials indicated such successful use of CAS in pre-closing situations suggests that the FDIC would be able to perform closing weekend insurance determinations timely. Notwithstanding, when DRR evaluated CAS’s ability to make insurance determinations for a simulated large bank (over 1.4 million deposit accounts), DRR determined that Claims Section personnel would not have been able to complete manual exceptions processing to ensure an accurate insurance determination for an institution of this size over a closing weekend. DRR maintains that upgrades to CAS since that simulation improved CAS’s timeliness, but this expectation has not been verified in a similar scenario or live test for a bank of this size during a closing weekend. We are recommending that DRR continue to test CAS under various scenarios to provide greater certainty of CAS’s timeliness capabilities and to further assist DRR in planning for large bank failures. We are also recommending that the FDIC document specific performance expectations for CAS timeliness.

Accuracy in Insurance Determinations

CAS has reduced the risk of inaccurate insurance determinations as compared to RLS by decreasing the opportunity for human error through automation and implementation of process controls. DRR’s goals for CAS accuracy are to provide an accurate estimate of uninsured deposits as one component of the least cost test during pre-closing, to ensure that each depositor receives the maximum deposit insurance payment allowable by law, and to minimize any applicable deposit overpayment amounts during closing. In this regard, DRR believes that CAS capabilities and procedures provide reasonable assurance on the accuracy of insurance determinations.

Insurance Determination Process Automation and Controls

We observed DRR’s use of CAS, including exceptions processing for a failing bank, reviewed policies and procedures on CAS processing, and interviewed Claims Section personnel and DRR executives on how CAS supports the claims process. The implementation of CAS automated the insurance determination process. The predecessor system, RLS, required Claims Section personnel to make insurance determinations manually, which increased the risk of inaccuracies. CAS automatically makes an insurance determination upon loading a failing bank’s deposit data into the system. This reduces the risk of errors resulting from extensive manual processing as required in RLS.

Further, we determined that DRR implemented several automated and manual controls that help to ensure the accuracy of CAS insurance determinations. These include:

- Claims Section personnel analysis of system-generated reports that display the results of the CAS insurance determination;

- Claims exceptions processing review of all cases with deposit balances of $250,000 and above to further mitigate the risk of an inaccurate insurance determination;

- Second-level review of exceptions processing decisions by a reviewer with expertise in CAS and claims administration. CAS will not allow Claims Section personnel to transfer the deposit file to DRR accounting absent approval by a second-level reviewer;

- Use of the joint checker report31 to mitigate the risk that the FDIC will overpay joint account claims; and

- When the FDIC makes an insured deposit payout, Claims Section personnel meet with each potentially uninsured customer and verify their claims thereby validating or correcting the results of the CAS insurance determination. We are recommending that FDIC specifically document performance metrics for CAS accuracy; doing so will provide clarity and direction.

Conclusion and Recommendations

As discussed above, CAS has substantially met DRR’s expectations for capacity, timeliness, and accuracy in making insurance determinations for most institutions; however, DRR has not verified CAS’s ability to make insurance determinations for large banks over a closing weekend. Complementary rulemaking has mitigated potential shortfalls in CAS capability, but further simulation and testing for realistic failing and failed bank scenarios would provide DRR with greater certainty of CAS’s capabilities. This greater certainty would facilitate resolution planning for potential large bank failures and decrease the risk of untimely insurance determinations.

Recommendations

We recommend the Director, Division of Resolutions and Receiverships:

(1) Conduct additional testing regarding CAS capacity in making insurance determinations.

(2) Conduct additional testing regarding CAS timeliness in making insurance determinations.

(3) Document performance expectations for capacity, timeliness, and accuracy to provide parameters for testing.

Other Matter

CAS Business Continuity Planning

One of the primary purposes of the FDIC is to resolve failed banks quickly and efficiently to preserve and promote public confidence in the U.S. financial system. CAS plays a vital role in that effort. Therefore, the FDIC must have the ability to restore CAS following a business interruption or emergency event.

DRR and DIT have taken steps to help ensure that CAS can be recovered within established timeframes. As a mission-essential/critical application, CAS follows the FDIC's overarching business continuity plan. This plan prescribes standards and a methodology for restoring the functionality of mission-critical IT systems and applications. In addition, DRR and DIT have completed a CAS Business Impact Analysis and Application Contingency Plan, which are required for mission-critical applications. The FDIC also conducts periodic tests of the CAS contingency plan to assess its ability to recover the system during a disaster scenario.

In our 2017 security evaluation report required by the Federal Information Security Modernization Act of 2014 (FISMA),32 we noted that the FDIC’s ability to maintain or restore critical IT systems and applications during a disaster was limited. Therefore, the FDIC could not be sure that it could maintain or restore its mission-essential functions during an emergency within applicable timeframes. At the close of our FISMA audit, the FDIC developed a plan to address these contingency planning issues. In addition, in December 2017, the FDIC’s Board of Directors provided initial authorization to commence work on a 2-year Backup Data Center Migration Project. The project involves remediating designated application systems and databases, such as CAS, that support mission-essential functions to ensure that they can be recovered within targeted timeframes and migrating them to a new and expanded backup data center. This effort is intended, in part, to address the risk posed by the geographic proximity of the FDIC’s current backup data center to its primary data center.

Footnote 32: Audit of the FDIC’s Information Security Program—2017 (AUD-18-001) October 25, 2017. The Executive Summary is publicly available at https://www.fdicoig.gov/sites/default/files/publications/18-001AUD.pdf. [End of footnote]

Corporation Comments and OIG Evaluation

DRR provided a written response dated March 14, 2018, to a draft of this report. The response is presented in its entirety in Appendix 6. DRR concurred with the report’s three recommendations, proposed actions to address the recommendations, and plans to implement the recommendations by October 31, 2018. These recommendations will remain open until the OIG confirms that planned actions have been completed and are responsive. Appendix 7 contains a summary of the Corporation’s corrective actions.

Appendix 1

Objective, Scope, and Methodology

Objective

Our evaluation objective was to determine the extent to which CAS has achieved the Division of Resolutions and Receiverships’ performance expectations for capacity, timeliness, and accuracy in making insurance determinations.

We performed our work from May 2017 to September 2017 in accordance with the Council of the Inspectors General on Integrity and Efficiency’s Quality Standards for Inspection and Evaluation.

Scope and Methodology

The scope of this evaluation focused on reviewing DRR’s use of CAS33 to perform insurance determinations on failing and failed financial institutions. Our evaluation included reviewing CAS-related documentation and developing an understanding of financial institution depositor data processing by CAS to determine insured and uninsured funds. We conducted our evaluation at the FDIC offices in Arlington, Virginia, and Dallas, Texas.

footnote 33: CAS comprises two sub-systems: CAS Deposit Insurance (DI) and CAS Non-Deposit Claims (NDC). We limited our evaluation to CAS DI. [End of footnote]

To address our evaluation objective, we gained an understanding of DRR’s performance expectations for CAS by analyzing both documentary evidence supporting the FDIC’s financial investment in CAS and CAS procurement-related documents. We also conducted a walk-through of the CAS insurance determination process to develop an understanding of DRR personnel’s roles and responsibilities in using CAS and CAS data processing and outputs. We also reviewed applicable public laws and rules, and FDIC policies and procedures related to insurance determination. We interviewed FDIC personnel including:

- DRR Receivership Operations and Business Program Management to verify how the CAS insurance determination process is executed in practice and to verify DRR’s performance expectations for CAS;

- DRR Complex Financial Institutions Branch on rulemaking related to insurance determination;

- Experienced Claims Section personnel in DRR Receivership Operations to compare and contrast the strengths and weakness of CAS and RLS;

- DRR Information Security Staff to discuss CAS business continuity planning; and

- Division of Finance, Corporate Management Control Branch, to review risk management practices for the current CAS development effort.

[End of Appendix 1]

Appendix 2

Deposit Insurance Categories

The Federal Deposit Insurance Act (Act) provides that “the net amount due to any depositor at an insured depository institution shall not exceed the Standard Maximum Deposit Insurance Amount (SMDIA). . . .”34 The Act also provides that in applying the SMDIA, which is currently at $250,000, the FDIC “shall aggregate the amounts of all deposits in the insured depository institution which are maintained by a depositor in the same capacity and the same right for the benefit of the depositor. . . .”35

Footnote 34: 12 U.S.C. § 1821(a)(1)(B). [End of footnote]

Footnote 35: 12 U.S.C. § 1821(a)(1)(C).[End of footnote]

Based on the Act, the FDIC recognizes 14 separate categories of deposit accounts that are insured separately up to the SMDIA.

[Table]

Row 1; Insurance Category: Employee Benefit Plan Accounts; Description: Certain employee benefit plans are insured on a “pass-through” basis provided the interests of the participants are ascertainable and noncontingent.

Row 2; Insurance Category: Certain Retirement Plan Accounts; Description: Deposits in an insured depository institution made in connection with the following types of retirement plans shall be aggregated and insured in the amount of up to $250,000 per participant: (i) Any individual retirement account described in section 408(a) of the Internal Revenue Code of 1986 (26 U.S.C. 408(a)); (ii) Any eligible deferred compensation plan described in section 457 of the Internal Revenue Code of 1986 (26 U.S.C. 457); and (iii) Any individual account plan defined in section 3(34) of the Employee Retirement Income Security Act (29 U.S.C. 1002) and any plan described in section 401(d) of the Internal Revenue Code of 1986 (26 U.S.C. 401(d)), to the extent that participants and beneficiaries under such plans have the right to direct the investment of assets held in individual accounts maintained on their behalf by the plans.;

Row 3; Insurance Category: Accounts Held by Government Depositors; Description: Each official custodian of funds of the United States lawfully depositing such funds in an insured depository institution shall be separately insured up to the SMDIA in the aggregate for all time and savings deposits; and up to the SMDIA in the aggregate for all demand deposits. Each official custodian of funds of any state of the United States, or any county, municipality, or political subdivision thereof, lawfully depositing such funds in an insured depository institution in the state comprising the public unit or wherein the public unit is located (including any insured depository institution having a branch in said state) shall be separately insured up to the SMDIA in the aggregate for all time and savings deposits; and up to the SMDIA in the aggregate for all demand deposits.;

Row 4; Insurance Category: Public Bond Issues Accounts; Description: Where an officer, agent, or employee of a public unit has custody of certain funds which by law or under a bond indenture are required to be set aside to discharge a debt owed to the holders of notes or bonds issued by the public unit, any deposit of such funds in an insured depository institution shall be deemed to be a deposit by a trustee of trust funds of which the noteholders or bondholders are pro rata beneficiaries, and the beneficial interest of each noteholder or bondholder in the deposit shall be separately insured up to the SMDIA.;

Row 5; Insurance Category: Accounts Deposited by an Insured Depository Institution Pursuant to the Bank Deposit Financial Assistance Program of the Department of Energy; Description: Funds deposited by an insured depository institution pursuant to the Bank Deposit Financial Assistance Program of the Department of Energy shall be separately insured in an amount not to exceed the SMDIA for each insured depository institution depositing such funds.;

[End of table]

[End of Appendix 2]

Appendix 3

CAS Insurance Determination Process

DRR uses CAS to make insurance determinations at two points in the resolution process—during pre-closing for the purpose of determining the least costly form of resolution and during closing in the event the FDIC has to transfer insured deposits to an assuming institution or to the account owner (in the event of a deposit payout). The CAS insurance determination process is illustrated in Figure 2 and described below:

(flow chart)

Failed or Failing Institution’s deposit data is downloaded to CAS

Extract, Transform, and Load (ETL) Process

Deposit Account Owners are Identified

CAS aggregates data by Owners and Insurance Categories

CAS balances are reconciled to failed institution’s deposit account records

Depositor Cases over $250,000 are identified as Exceptions

Exceptions are assigned to individual Claims Personnel in CAS

Claims Personnel review Exceptions for accuracy in ownership and categorization and make corrections in CAS

Joint Checker Report

Second-Level Reviewer checks Exceptions Processing and either approves or rejects

UDEM is prepared (Pre-Closing Only)

At Closing, Financial Transactions are transmitted to DRR Accounting (Payout or Transfer to another institution)

Source: OIG Review of DRR Claims Manual and Interviews

- DRR receives failing or failed institution bank data (deposit download) from the failing or failed bank and prepares the file(s) for upload into CAS, known as staging and data load preparation work.

- Bank data is loaded into CAS through the extract, transform, and load (ETL) process.

- CAS identifies owners based on names, addresses, and Tax Identification Numbers and assigns customer identification numbers to each matched owner. In addition, CAS creates “loose groups” that tie accounts to each other based on matching criteria to further assist Claims Section personnel in identifying related owners that might not have been matched during the ETL process.

- CAS aggregates data by:

- Depositor Case – all accounts for an owner sorted by insurance category.

- Claim – all accounts for an owner within a specific insurance category.

- Account – individual specific accounts.

- CAS automatically processes insurance determinations for all claims by grouping related accounts within each insurance category and calculating the total amount on deposit for that claim.

- Once the upload is complete, DRR Claims Section personnel verify that the CAS download balances reconcile with the failed institution’s deposit account records using available institution reports (trial balances, ledgers, bank provided data, etc.) prior to performing the exceptions processing function.

- Claims Section personnel then perform exceptions processing, which is a review through CAS of all Depositor Cases with a balance of over $250,000 for accuracy in categorization, ownership, and/or matching.

- If an error is found, Claims Section personnel make manual adjustments to the bank data in CAS to correctly reflect the appropriate information (e.g., adjusting a beginning balance loaded into CAS to a corrected ledger balance at closing or correcting ownership for an account).

- After Claims Section personnel review an exception, with or without corrections, the Claims Section personnel will send the exception to a second-level reviewer. The second-level reviewer either accepts or rejects the Claims Section personnel’s analysis and/or corrections. This review is captured in the CAS audit trail.

- Claims Section personnel run the CAS joint checker report after exceptions processing. This report helps ensure that the actual number of owners identified by CAS for a joint ownership account that exceeds $250,000 is accurate. For example, assume the bank had an account titled “Maryann Kelly Lawrence Smith” in the amount of $300,000. CAS could interpret this name as two separate joint owners: (1) Maryann Kelly and (2) Lawrence Smith, assign an ownership balance of $150,000 for each of the two owners, when in fact there is actually only one owner for the account. Since exceptions processing would only review cases with ownership balances over $250,000 this account would not be part of the initial review for exceptions processing and the FDIC could erroneously pay out $50,000 that should otherwise be uninsured. The joint checker report mitigates the risk that the FDIC will pay joint account claims to single account owners.

- For files processed prior to closing weekend, Claims Section personnel prepare the Uninsured Deposit Estimate Memorandum (UDEM). This memorandum presents the uninsured amounts identified at the bank based on the pre-closing file.

These steps are performed during pre-closing in order to facilitate a least cost calculation and are repeated (except for preparing the UDEM) during closing if the resolution type requires an insurance determination (e.g., in the event of a deposit payout).

[End of Appendix 3]

Appendix 4

Glossary

Acquiring Institution - The financial institution taking over some or all of the business of a failed institution.

Application Contingency - Plan The FDIC Application Contingency Plan provides application-specific information in the event of a major interruption or disruption of Virginia Square IT services.

Business Continuity Plan - The documentation of a predetermined set of instructions or procedures that describe how an organization’s mission/business processes will be sustained during and after a significant disruption.

Business Impact Analysis - An analysis of an information system’s requirements, functions, and interdependencies used to characterize system contingency requirements and priorities in the event of a significant disruption.

Claims - An assertion of the indebtedness of a failed institution to a depositor, general creditor, subordinated debt holder, or shareholder.

Deposit Insurance Fund - (DIF) An insurance fund responsible for protecting insured financial institution depositors from loss due to institution failures. It was established on March 31, 2006, as a result of the 2005 legislation requiring the merger of the Bank Insurance Fund and the Savings Association Insurance Fund pursuant to enacted deposit insurance reform legislation. The FDIC is the administrator of the DIF.

Extract, Transform, and Load (ETL) - An automated process that Business Information Systems execute to load a financial institution’s depositor data (account information from the failing or failed institution) into CAS.

Federal Information Security Management Act (FISMA) - An Act passed by the 107th Congress in December, 2002 that requires each federal agency to develop, document, and implement an agency-wide program to provide information security for the information and systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other sources.

Franchise Value - Franchise value is the future income stream that results from the acquisition of a failed financial institution.

Insurance Determination - The process of determining a failed financial institution’s insured deposits in accordance with the FDIC’s deposit insurance regulations.

Insured Deposit Transaction - An insured deposit transaction refers to any resolution type that requires the FDIC to make an insurance determination at the financial institution closing, including an insured deposits payout or a purchase agreement with an acquiring institution that includes only insured deposits.

Insured Depository Institution - A depository institution in which the deposits are insured pursuant to the Federal Deposit Insurance Act, including a foreign bank having an insured branch.

Least Cost Resolution - The Federal Deposit Insurance Corporation Improvement Act requires the FDIC to implement a resolution alternative that is determined to be least costly to the DIF of all possible resolution alternatives, including liquidation of the failed institution.

Primary Regulator - The regulatory agency responsible for the supervision and regulation of a federally insured depository institution. The FDIC shares this responsibility with other federal regulators and with state banking authorities. The Office of the Comptroller of the Currency is responsible for supervising national banks and thrifts; the Federal Reserve is responsible for supervising both state member banks in conjunction with state regulators, and bank holding companies; and the FDIC, in conjunction with state regulators, is responsible for supervising state nonmember banks and state-chartered savings banks.

Provisional Holds - A process to bar access to some or all of a customer’s account pending the results of the insurance determination.

Receiver - A person or entity, including a government agency, appointed to handle the assets and liabilities of a failed insured depository institution. A receiver succeeds to all the interests and property owned by the failed institution.

Resolution - The disposition plan for a failed institution, designed to protect insured depositors and minimize the losses to the insurance fund that are expected from covering insured deposits and disposing of the institution’s assets.

Standard Maximum Deposit Insurance Amount (SMDIA) - Deposit insurance regulations provide separate deposit insurance coverage for funds based on ownership rights and capacities up to a maximum of $250,000 per owner.

Uninsured Deposit Estimate Memorandum (UDEM) - A memorandum that contains an estimate of uninsured deposits at a failing institution as of a specific date.

[End of Appendix 4]

Appendix 5

Acronyms and Abbreviations

CAS Claims Administration System

C.F.R. Code of Federal Regulations

CIRC Capital Investment Review Committee

DI Deposit Insurance

DIF Deposit Insurance Fund

DINB Deposit Insurance National Bank

DIT Division of Information Technology

DRO Deposit Resolution Optimization

DRR Division of Resolutions and Receiverships

ETL Extract, Transform, and Load

FDIC Federal Deposit Insurance Corporation

FISMA Federal Information Security Management Act

IDT Insurance Deposit Transfer

NDC Non-Deposit Claims

P&A Purchase and Assumption

RLS Receivership Liability System

SMDIA Standard Maximum Deposit Insurance Amount

UDEM Uninsured Deposit Estimate Memo

U.S.C. United States Code

[End of Appendix 5]

Appendix 6

[FDIC letterhead, FDIC logo, Federal Deposit Insurance Corporation, Division of Resolutions and Receiverships, 3701 Fairfax Drive, Arlington, VA 22226]

TO: E. Marshall Gentry, Assistant Inspector General for Program Audits and Evaluations Office of Inspector General

FROM: Bret D. Edwards, Director, Division of Resolutions and Receiverships

SUBJECT: Management Response to Draft Evaluation Report Entitled, Claims Administration Systems (CAS) Functionality (Assignment No. 2017-014)

The Federal Deposit Insurance Corporation (FDIC) has completed its review of the Office of Inspector General’s (OIG) draft evaluation report entitled Claims Administration System (CAS)

Functionality (Assignment No. 2017-014) dated February 27, 2018.

We appreciate the OIG’s analysis and findings regarding CAS Functionality. In particular, we recognize the mission critical nature of CAS within the deposit insurance determination process, and its specific effect on FDIC’s ability to pay deposit insurance claims in a prompt and accurate manner.

The report indicates that CAS has yet to be utilized for an insurance determination in a larger bank failure where there was not an acquirer. While this is true, CAS has been utilized in a contingency planning deposit insurance estimate for a bank with more than two million deposit accounts. The FDIC in order to improve CAS’s capacity and timeliness initiated the Deposit Resolution Optimization (DRO) project, which although not completed has resulted in efficiencies and decreased time frames for insurance determinations. Additionally, the FDIC has issued the Large-Bank Deposit Determination Modernization Rule (12 C.F.R. §360.9) and the Recordkeeping for Timely Deposit Insurance Determination Rule (12 C.F.R. §370) to address bank failures with a large number of deposit accounts.

In its report, the OIG indicates that the Division of Resolutions and Receiverships (DRR) should establish performance expectations for CAS, as well as continue to test CAS’s capacity and timeless. FDIC management concurs with the recommendations. We are committed to addressing each of the recommendations and continuing to improve CAS and the deposit insurance claims process.

Below is a description of the FDIC’s specific corrective actions for each OIG recommendation.

Recommendation #1: We recommend that the Director, DRR, conduct additional testing regarding CAS capacity in making insurance determinations.

DRR Response: DRR concurs with this recommendation.

Corrective Action: To assess CAS capacity in making insurance determinations, DRR will conduct a test and document load times for at least two million accounts.

Completion Date: October 31, 2018

Recommendation #2: We recommend that the Director, DRR, conduct additional testing regarding CAS timeliness in making insurance determinations.

DRR Response: DRR concurs with this recommendation.

Corrective Action: To assess CAS timeliness in making insurance determinations, DRR will document the performance testing methodology for the DRO project Release 2 and document the results

of the performance testing for Release 2. Additionally, DRR will provide the methodology and test results for performance testing for timeliness for Release 1, which was completed in

October 2017.

Completion Date: October 31, 2018

Recommendation #3: We recommend that the Director, DRR, document performance expectations for capacity, timeliness, and accuracy to provide parameters for testing.

DRR Response: DRR concurs with this recommendation.

Corrective Action: DRR will document the established testing parameters for performance expectations for capacity, timeliness and accuracy in relation to Recommendation #1 and #2.

Completion Date: October 31, 2018

[End of Appendix 6]

Appendix 7

Summary of the Corporation’s Corrective Actions

This table presents management’s response to the recommendations in the report and the status of the recommendations as of the date of report issuance.

Row 1; Rec.No.: 1; Corrective Action: Taken or Planned: DRR will conduct a test and document load times for at least 2 million accounts.; Expected Completion Date: October 31, 2018; Monetary Benefits: N/A; Resolved:a Yes or No: Yes; Open or Closedb: Open;

Row 2; Rec.No.: 2; Corrective Action: Taken or Planned: DRR will document the performance testing methodology for the DRO project release 2 and document the results of the performance testing for Release 2.

Additionally, DRR will provide the methodology and test results for performance testing for timeliness for Release 1, which was completed in October 2017. Expected Completion Date: October 31, 2018 Monetary Benefits: N/A; Resolved:a Yes or No: Yes; Open or Closedb: Open;

Row 3; Rec.No.: 3; Corrective Action: Taken or Planned: DRR will document the established parameters for Performance expectations for capacity, timeliness, and accuracy in relation to recommendations 1 and 2. Expected Completion Date: October 31, 2018 Monetary Benefits: Resolved:a Yes or No: Open or Closedb: Open;

a Recommendations are resolved when —

1. Management concurs with the recommendation, and the planned, ongoing, and completed corrective action is consistent with the recommendation.

2. Management does not concur with the recommendation, but alternative action meets the intent of the recommendation.

3. Management agrees to the OIG monetary benefits, or a different amount, or no ($0) amount. Monetary benefits are considered resolved as long as management provides an amount.

b Recommendations will be closed when the OIG confirms that corrective actions have been completed and are responsive.

[End of table]

[End of Appendix 7]

3501 Fairfax Drive

Room VS-E-9068

Arlington, VA 22226

(703) 562-2035

The OIG’s mission is to prevent, deter, and detect waste, fraud, abuse, and misconduct in FDIC programs and operations; and to promote economy, efficiency, and effectiveness at the agency.

[End of report]

Print Print
Close