Federal regulators will no longer examine banks for reputation risk, but that may not end the risk.
In recent years, regulators’ concerns about bank reputation risk may have dissuaded banks from pursuing technology-driven offerings of innovative products or services, like banking as a service or cryptocurrency. That’s primed for a change, after regulators announced earlier this spring that they would no longer examine banks for reputation risk. But the absence of supervision for reputation risk doesn’t mean that reputation risk doesn’t exist — or that a bank won’t experience consequences because of loss of trust. Legal experts cautioned that banks still need to approach managing operational and reputation risks thoughtfully and holistically as they pursue novel or innovative lines of business.
“Banks still absolutely have to care about reputation,” says Julie Hill, dean of the law school at the University of Wyoming, who has written about regulators’ interest in reputation risk. She says the change gives bankers greater space to incorporate the opinions and perspectives about reputation from other stakeholders.
Reputational risk is “the potential that negative publicity regarding an institution’s business practices, whether true or not, will cause a decline in the customer base, costly litigation, or revenue reductions,” according to the Federal Reserve Board. Hill says regulators’ interest in how a bank was managing reputation risk gave them “a lot of power” if they expressed concerns or disapproval.
Examiners’ interest in bank reputation risk caught the attention — and criticism — of policymakers concerned about “debanking,” or the denial of banking services. In April Senate testimony, Treasury Secretary Scott Bessent said he asked bank regulators “to consider removing reputational risk as a basis for supervisory criticism, and that effort is well underway.”
Regulators’ disapproval could discourage a bank that wanted to add novel business lines or provide banking services to controversial customers over concerns that it could increase the institution’s reputation risk. It’s hard to know specifically how much reputation risk figured in among other risks regulators observed at banks that wanted to offer blockchain or cryptocurrency products or services, but recently released communications from the Federal Deposit Insurance Corp. indicate regulators were clearly worried about these business lines.
“I do think banks were staying away from crypto because of reputation risk and regulators,” says Kimberly Monty Holzel, a partner in Goodwin’s financial services and fintech practice. “There are so few banks doing anything touching crypto now. … It’s probably not just the business risk.
The Office of the Comptroller of the Currency announced in March that it was removing references to bank reputation risk from its Comptroller’s Handbook booklets and guidance issuances and instructed examiners to no longer examine for reputation risk. Shortly after, Travis Hill, the acting chairman of the FDIC, said the agency was working on rulemaking that would prohibit examiners from “criticizing or taking adverse action against institutions” over reputational risk concerns.
The law professor Hill, who is not related to the FDIC acting chairman, argues that reputational risk is a derivative risk, one that arises out of another type of risk that banks should focus on managing. For example, a bank could receive bad press after a customer data breach. To avoid that risk, it makes more sense to focus on managing the underlying information security weaknesses rather than the reputational fallout. Her analysis lines up with the OCC’s continued expectation that banks “engage in sound risk management practices, operate in a safe and sound manner, and comply with applicable laws and regulations.”
Banks care deeply about their reputations. Most bankers want to be cautious, serious and safe. The erosion of public trust “can have immediate and tangible impacts on a bank’s stability,” says Chris Friedman, a partner at Husch Blackwell. Friedman adds that because many banks rely on technology service partnerships, banks’ reputations also suffer due to outdated technology or disrupted service offerings if their vendor experiences an outage.
But technology partnerships aren’t the only way banks have incurred reputation risk in recent years. They can experience reputational damage if employees act dishonestly or illegally, as was the case with Wells Fargo & Co.’s fake account scandal from 2002 to 2016. Additionally, Hill’s research mentioned other recent examples of reputation risk at banks, such as a bank having unpopular policies or fees, or providing financial services to a gun rights advocacy group, payday lenders or oil and gas companies.
Now, it’s up to banks to figure out what kind of reputation they want to have — for customers, employees or partners. Hill stresses examiners still have many regulations they can cite when providing feedback to institutions — they just need to be specific about the deficiencies. And Friedman recommends that banks pay more attention to external signals, like customer complaints and reviews or bad press, that could serve as a proxy for deeper issues within compliance or operations. As executives consider new products, services or partnerships, they will need to think about how much reputation risk they’re willing to take, how they’ll gauge their institution’s reputation in the market and measure changes over time.
“Regardless of whether a regulator thinks something is going to cause a good reputation or a bad reputation, it’s common knowledge that reputation can still tank a business one way or another,” says Goodwin’s Monty Holzel.
Previous