WASHINGTON — Acting Comptroller of the Currency Michael Hsu called on bank supervisors to zero in on the most pressing banking issues, rather than trying to cover every possible issue, which he says can dilute their efforts and effectiveness.
"Supervisors are fond of process and have a by-the-book orientation … however, [this] can morph from being a tool to being a cage," Hsu said Tuesday. "We supervisors are just as prone to falling into that trap, especially after facing public criticism, when fear of making mistakes is highest."
In remarks before the Joint European Banking Authority and European Central Bank International Conference in Frankfurt, Germany, he emphasized the need for supervisors to shift toward a robust risk-based approach, moving beyond the rigid, checklist-driven mindset that he says can limit supervisory effectiveness. Effective "risk-based supervision," according to Hsu, requires prioritizing the most significant risks and maintaining flexibility to adapt to changing circumstances.
Hsu also noted that the biggest challenge in risk-based supervision is dealing with areas that are not prioritized. While supervisors shouldn't be held accountable for issues in deprioritized areas, he argued they're often expected to be aware of every detail in every bank. This unrealistic expectation can lead to a checkbox mentality rather than true risk-based oversight. Hsu suggested a distinction between supervisory lapses in less critical areas versus those related to more dire supervisory issues.
"The problem with check-the-box supervision is that there are a lot of boxes to check, and each box is given equal weight. This ensures comprehensiveness, but artificially limits our ability to focus supervisory attention where it is needed most," he said. "Risk-based supervision shifts accountability for outcomes from individual on-site supervisory teams and their managers to the agency's most senior executives responsible for prioritization, collaboration, resource allocation, and quality control."
Hsu described supervision as an unsung craft, rarely making headlines except for when things go terribly wrong, like the public scrutiny placed on
When the banking system navigates significant events smoothly, he argued, supervision often can be taken for granted. For example, in 2022, despite a
The acting comptroller said this imbalance — between the often invisibility of successes and significant visibility of failures in supervision — can significantly influence how supervisors operate.
"When there is a headline-grabbing negative incident — such as a bank failure, compliance or operational breakdown, or violation of law — supervisors understand they may be subject to intense criticism," he said. "This can cause them to become unnecessarily cautious, defensive, or to second-guess themselves … [and] result in supervisors seeking safety in closely adhering to pre approved checklists and processes rather than exercising judgment and discretion."
The acting comptroller said complicating the role of supervisors is the significant growth and increased complexity of large banks over the past 30 years. Thirty years ago, only five U.S. banks had assets exceeding $100 billion, with a combined total of $800 billion of assets. Today, he noted that number has expanded to 32 large banks with a collective total of over $17 trillion of assets.
The regulator emphasized that given the growth and increasing complexity of firms, prioritizing agility and credibility are also crucial for effective supervision. To achieve this, he noted
Hsu emphasized that bank supervision relies heavily on building close relationships between banks and their supervisors through ongoing dialogue, alongside formal examinations and other monitoring activities. He compared supervision to exercise because its effects accumulate over time, even if the immediate impacts are not always noticeable. This continuous monitoring, Hsu explained, helped banks endure recent systemwide disruptions that severely affected other industries, such as airlines. This summer's
"OCC supervisors have been examining and pushing banks to improve their cyber, operational, and IT risk management capabilities for years because of the prevalence of legacy systems, deferred maintenance, and underinvestment," he said. "Banks' relative resilience in the face of the CrowdStrike disruption was due in part to those supervisory efforts."
