Preparing Banks for the Next Round of Challenges While the Sun Is Still Shining

Fifteen years ago, in the shadow of the 2008 financial crisis, Congress adopted the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank), the most significant change to financial regulation since the Gramm-Leach-Bliley Act in 1999. Since the enactment of Dodd-Frank, banks and their holding companies have increased their capital, endured stress tests and developed contingency and resolution plans to be implemented in the event of a future crisis. The COVID-19 pandemic provided a real-time stress test of several Dodd-Frank tools, as regulators authorized banks to use their Dodd-Frank-imposed capital and liquidity buffers to respond to the challenges presented by the effects of the pandemic. Such prompt action likely helped to stave off the collapse of the U.S. and global economies, preventing multiple bank failures.

There have been relatively few bank failures since key provisions of Dodd-Frank were implemented, although some of the largest and most rapid failures in U.S. history occurred in 2023 without triggering Dodd-Frank reforms (see FDIC Failed Bank Information – Silicon Valley Bank and Review of Federal Reserve’s Supervision and Regulation of Silicon Valley Bank). While through the end of the second quarter of 2025, U.S. banks continued to show strong financial strength, increasing economic uncertainty and a weakened commercial real estate sector that has not fully recovered since COVID-19 could lead to the softening of U.S. bank balance sheets and potential failures.

As only a few banks have failed over the past few years, a generation of bankers has never experienced a severe economic downturn; moreover, seasoned bankers have not recently dealt with the mighty arsenal of weapons available to regulators to protect the safety and soundness of insured banks in the United States. These provisions at the bank level primarily target supervisory resolution of capital, managerial and operational deficiencies. Foremost among these are the Prompt Corrective Action (PCA), Operational and Managerial Standards (OMS), Troubled Condition (TC), Capital Directive, which imposes Individual Minimum Capital Ratio (IMCR) rules and the “traditional” enforcement powers (collectively, Regulatory Intervention Rules). 

Given the broad authority available to the federal bank regulators under the Regulatory Intervention Rules to significantly impact the operations and management of banks and their holding companies, it is important to understand the scope of these rules, their consequences and the ways to mitigate their adverse effects. Failure to (a) anticipate and prevent potential actions that may be taken by a regulator under these rules and (b) adequately resolve deficiencies raised by regulators can result in a downward spiral of supervisory and enforcement actions — ranging from CAMELS exam rating downgrades, memoranda of understanding, supervisory agreements and formal enforcement actions (e.g., cease and desist orders and civil money penalties) to, in the case of troubled institutions, a potential death spiral ending in government seizure.

I. Liability Risk to Bank Directors and Officers

Before we discuss the Regulatory Intervention Rules, it is worth highlighting that directors and officers (D&Os) of failed banks face unique risks as compared to other industries. In its capacity as a receiver of a failed bank, the FDIC is authorized to initiate civil litigation against D&Os in their individual capacity based on alleged gross negligence and breach of fiduciary duty. In addition, the federal banking agencies may bring administrative cases against D&Os of any bank for unsafe and unsound practices that led to the bank failure. Finally, relevant state agencies have enforcement authority to take various actions against D&Os. Therefore, all bank and bank holding company D&Os need to fully understand the limits of indemnification provisions in their agreements and their insurance policies, as small differences in language may result in significant differences in coverage.

Moreover, understanding the limits to which a bank may indemnify a D&O is important. Uniquely, as compared to laws regulating other industries, federal banking law restricts the extent to which banks and their holding companies can indemnify D&Os from penalties resulting from an order or settlement with the banking agency. However, a bank or its holding company can make indemnification payments to purchase D&O insurance that is “reasonable,” provided that the insurance policy may not be used to pay or reimburse the D&O for the cost of paying a monetary penalty assessed against such person. Such insurance policies, however, may cover legal expenses and judgments arising from civil actions (e.g., shareholder lawsuits).

II. Key Regulatory Intervention Rules: What Can Regulators Do and How?

Section 38 of the FDIA: The PCA Rules — What are They?

Section 38 of the Federal Deposit Insurance Act (FDIA) establishes a comprehensive framework to address capital deficiencies and supervisory problems of banks. The PCA framework is indexed primarily, but not exclusively, to capital levels as the trigger of regulatory intervention. As such, it is a system of escalating supervisory oversight and scrutiny, operating restrictions, and sanctions and penalties based primarily on a bank’s capital levels. It is composed of five major categories: Well Capitalized, Adequately Capitalized, Undercapitalized, Significantly Undercapitalized and Critically Undercapitalized. Of these, the three most significant categories are Well Capitalized, Adequately Capitalized and Undercapitalized, discussed below. As a bank’s capital condition deteriorate, federal regulators can increasingly restrict a bank’s operations, culminating with closing down the bank if necessary.

PCA directives are considered to be a type of enforcement order under the enforcement provisions of Section 8 of the FDIA, and failure to comply with a PCA directive can result in cease-and-desist orders, civil money penalties, bans from the banking industry and judicial enforcement measures.

Well Capitalized — Not to Be Confused With ‘Things are Fine’

As the name implies, a “well capitalized” bank is one that “significantly exceeds” all of its required capital requirements. Being well capitalized generally puts the bank outside of the regulatory zone of concern for purposes of the PCA rules. However, it is not by any means a shield from regulatory consequences or action under the Regulatory Intervention Rules, because of two major exceptions. First, under the PCA rules, well-capitalized institutions may actually be reclassified as “adequately capitalized” by a regulator (see discussion below), based on criteria other than capital, if a regulator concludes that the bank is in an unsafe or unsound condition, or is engaged in unsafe or unsound practices and has not corrected the deficiency. The regulator has to provide written notice of its intent to reclassify a bank downward. Procedures do exist to permit banks to contest the need for a reclassification and can require the regulator to order an informal hearing. Second, a well-capitalized bank can become subject to an IMCR (discussed below) if a regulator believes a bank does not have sufficient capital to support its portfolio or operational risk.

Adequately Capitalized — Why are We Here and How Do We Get Out?

Becoming “adequately capitalized,” or otherwise being downgraded from well capitalized by a regulator, has two major regulatory consequences in addition to higher FDIC insurance premiums:

• A general prohibition on accepting brokered deposits (subject to waiver); an
• Possible imposition of certain PCA restrictions.

Section 29 of the FDIA — Restrictions on Brokered Deposits

Section 29 of the FDIA prohibits any bank that is adequately capitalized from directly or indirectly accepting, renewing or rolling over any brokered deposits, absent applying for and receiving a waiver from the FDIC. On a case-by-case basis, the FDIC may waive the prohibition upon a finding that brokered deposit activities pose no safety and soundness risk to a bank. Frequently, in granting a waiver, the FDIC will limit the volume of brokered deposits an adequately capitalized bank may accept. Moreover, waivers may be revoked at any time.

From a liquidity and funding perspective, it is important to note that Section 29 captures a wide variety of deposit origination activity that may not, on first glance, appear to be “brokered” deposits in a market sense; thus, for example, Section 29 specifically includes within its scope any employee of a bank who directly or indirectly engages in the solicitation of deposits from offering interest rates that are significantly higher (i.e., more than 75 basis points) than the prevailing rate in the bank’s normal market area.

For banks that partner with fintechs to offer and deliver deposit products, restrictions under Section 29 could be especially challenging, as absent an exemption from the brokered deposit rules, fintechs could be deemed to be deposit brokers. As a result, if their bank cannot accept brokered deposits, a fintech could need to move its program to another bank, potentially imposing significant interruptions to their operations.

Sections 38(d) and (e) of the FDIA — Operating Restrictions

A regulator may also require an adequately capitalized institution to comply with one or more of the restrictions in Sections 38(d) and (e), as if the institution were undercapitalized. These restrictions include:

• Prohibition on capital distributions;
• Prohibition on payments of management fees to controlling parties;
• Requirement to submit a capital restoration plan;
• Restrictions on asset growth; and
• Prior regulator approval for acquisitions, branching and entering new lines of business — essentially prohibiting growth.

Adequately capitalized status significantly increases supervisory oversight over a bank and can be the prelude to becoming undercapitalized, absent raising additional capital to become well capitalized again, or engaging in a merger or acquisition transaction.

Supervisory or enforcement action typically is imposed by a regulator in this situation. However, when a regulator determines that a bank has a realistic chance of resolving its capital challenges in a short time frame, a regulator may forbear for a short period of time from seeking a formal supervisory or enforcement action.

Undercapitalized — For Whom the Bell Tolls?

Once a bank has reached the undercapitalized level, it has likely been subject to a cease-and-desist order and other formal supervisory sanctions and becomes subject to a broad menu of operating and managerial restrictions:

• Capital distributions prohibited;
• Payment of management fees to controlling person prohibited;
• A capital restoration plan required within 45 days of becoming undercapitalized;
• Asset growth prohibited or restricted, or bank is required to shrink;
• Prior approval by a regulator required for acquisitions, branching and new lines of business;
• Regulator may require sale of securities, or, if grounds for conservatorship or receivership exists, direct the bank to merge or be acquired;
• Restrict affiliate transactions;
• Restrict or prohibit activities of the bank or its subsidiaries determined to pose excessive risk to institution;
• Require institution to elect new directors, dismiss directors or senior executive officers or employ qualified senior executive officers to improve management;
• Prohibit acceptance of deposits from correspondent banks;
• Require prior approval of capital distributions by holding companies;
• Require a holding company to divest the bank, the bank to divest subsidiaries and/or the holding company to divest other affiliates;
• Require bank to take any other action a regulator determines will “better achieve” PCA objectives;
• Prohibit material transactions outside the usual course of business;
• Prohibit amending the institution’s bylaws/charter;
• Prohibit any material changes in accounting methods; or
• Prohibit golden parachutes, change in control or excessive compensation or bonuses.

Section 32 of the FDIA: Troubled Condition Rules — Understanding the Consequences of Being in ‘Troubled Condition’

Pursuant to Section 32 of the FDIA, changes in senior officers and directors are subject to prior regulatory non-disapproval. As part of their review, regulators will scrutinize proposed compensation arrangements for such individuals, including golden parachute limitations. The Troubled Condition rule apply when:

• A bank does not comply with its minimum capital requirements;
• A bank is in “troubled condition”;
• The regulator has notified a bank, in connection with its review of a capital restoration plan required under Section 38 of the FDIA, that a notice is required; or
• A bank is a holding company and is in “troubled condition.”

The term “troubled condition” means (12 C.F.R. 5.51(c)(7)):

• The bank or holding company has a 4 or 5 composite CAMELS rating;
• A holding company is either (a) designated by a regulator to have an unsatisfactory CAMELS rating or (b) notified in writing by the regulator that it has an “adverse effect” on its bank subsidiary;
• The bank or holding company is subject to any formal supervisory or enforcement action or PCA relating either to safety, soundness and financial viability, unless otherwise notified by the regulator; or
• The bank or holding company is otherwise informed in writing that it is in troubled condition.

A regulator can waive the prior notice requirement and permit an individual to serve as a director or senior executive officer before filing a notice if the regulator issues a written finding that:

• Delay would threaten the safety or soundness of the bank;
• Delay would not be in the public interest; or
• Other extraordinary circumstances exist that justify waiver of prior notice.

Bank holding companies may also be subject to these prior notice requirements.

IMCR Rules

Under the IMCR rules, minimum capital levels higher than those generally required under the general capital rules may be required by a regulator. An IMCR may be established upon a determination that the bank’s capital is or may become inadequate in view of its “circumstances,” which can include:

• A bank receiving special supervisory attention;
• A bank that has or is expected to have losses resulting in capital inadequacy;
• A bank that has a high degree of exposure to credit, prepayment, interest rate, credit concentration, nontraditional activities or similar risks;
• Poor liquidity or cash flow;
• High proportion of off-balance sheet risks;
• Excessive growth presenting supervisory problems;
• Inadequate underwriting policies, standards or procedures for loans or investments;
• The potential to be adversely affected by the activities or condition of its holding company, affiliates, subsidiaries or other persons or entities with whom it has significant business relationships, including credit concentration;
• Portfolio with weak credit quality or a significant likelihood of financial loss, or loans in nonperforming status or in which borrowers fail to comply with prepayment terms; or
• Record of operational losses above peer averages, management deficiencies or poor record of supervisory compliance.

The IMCR rules specify that an appropriate IMCR cannot be determined solely through the application of “a rigid mathematical formula or wholly objective criteria.” The rules further state that the decision will necessarily be “based in part on the subjective judgment grounded in [the] agency expertise” of the regulator.

The regulator must notify a bank in writing of a proposed IMCR, set a schedule for compliance with the new requirement and identify the specific cause for determining that an IMCR is necessary. A bank must respond within 30 days, but the time period for response may be shortened by a regulator for good cause. In such scenarios, a bank may offer any “information on whether an IMCR is required, what the IMCR should be and schedule for compliance.” Based on a review of the bank’s response, the regulator will issue a written decision on the IMCR. Upon receipt of the decision by the bank, it becomes binding and represents final agency action.

Section 39 of the FDIA: OMS Rules

Section 39 requires all regulators to establish safety and soundness standards. Section 39 of the FDIA supplements the capital-based PCA system with a complementary scheme designed to address noncapital safety and soundness-related managerial and operational standards. Pursuant to Section 39, the regulators have adopted the Interagency Guidelines Establishing Standards for Safety and Soundness. The Interagency Statement primarily addresses prescribed (1) operational managerial standards and (2) prohibitions on compensation that constitute an unsafe and unsound practice. A bank will be subject to an enforcement action under Section 8 of the FDIA if, after being notified that it is in violation of one or more safety and soundness standards under Section 39, the bank fails to submit an acceptable Safety and Soundness Compliance Plan (SSCP) or fails in any material respect to implement an accepted SSCP. Section 39 does not in any manner limit the authority of a regulator under any other provision of law to take any other supervisory or enforcement action to address unsafe or unsound practices or conditions, violations of law or other practices.

The rules specify the required content of SSCPs. Upon receipt of an SSCP, the regulator generally will provide written notice within 30 days of whether the plan has been approved or whether additional information is needed regarding the plan. Failure to comply with an accepted plan will likely result in formal enforcement action.

‘Traditional’ Enforcement Actions

The “traditional” enforcement powers granted to the regulators under Section 8 of the FDIA are significant. Whenever a bank is in an unsafe or unsound condition, is engaging or about to engage in an unsafe or unsound practice, or is violating or has violated a law, rule, regulation or condition imposed in writing, a regulator may initiate cease-and-desist proceedings against the bank or individuals or entities affiliated with the bank. Such proceedings may be preceded by an informal enforcement action such as a memorandum of understanding or supervisory agreement. Under certain conditions, a regulator may seek to formally remove individuals from participating in the affairs of the bank and of any other insured depository institution[1] and may seek to impose civil money penalties against both the bank and the individuals participating in its affairs. Far more common than PCA directives, these enforcement powers are frequently used by the regulators to effect changes in a bank or holding company where a regulator has concerns.

Important to remember is that, while there are various procedural safeguards built into the traditional enforcement powers (e.g., notice, opportunity for a hearing before an administrative law judge, right to appeal), these proceedings, in practice, highly favor the regulators. Virtually all enforcement actions are resolved by consent between a regulator and the bank or individual; it is the rare case that goes through the administrative hearing process, and rarer still is the bank or individual the party that ultimately prevails. However, the banking agencies’ ability to rely on the administrative hearing process to extract penalties is in question following the holding in SEC v. Jarkesy, in which the U.S. Supreme Court held that a defendant was entitled to a jury trial when the SEC seeks civil penalties. Of note, the OCC and FDIC both face pending Seventh Amendment challenges to their ability to seek legal remedies and civil penalties in the U.S. Court of Appeals for the Fifth Circuit.[2]

Facing Waterloo

While a regulator has significant weapons to address problem banks, ultimately the regulators are under a statutory obligation to resolve troubled banks in a manner that avoids or minimizes losses to the Deposit Insurance Fund. To meet this goal, each regulator possesses an ultimate weapon — the authority to appoint the FDIC as receiver or conservator over the affairs of a problem bank. Such action can only occur if a bank triggers one of the statutory grounds for the appointment of a receiver, and grounds exist based on capital, unsafe or unsound practices or management failures. At this point, all shareholder interests are eliminated, the bank’s board of directors and management are typically replaced and the bank is either sold, in whole or in part, through a FDIC bidding process or, in rare circumstances, liquidated.

To fully understand the challenges facing a problem bank, it is important for boards of directors and bank management to understand when regulators are authorized to seize a problem bank.

Grounds for receivership (see e.g., 12 U.S.C. 1821(c)) based upon a bank’s capital include situations where a bank:

• Has assets less than its obligations to its creditors (commonly known as capital insolvency);
• Is likely unable to pay its obligations or meet its depositors’ demands in the normal course of business (commonly known as liquidity insolvency);
• Is critically undercapitalized;
• Has incurred, or is likely to incur, losses that will deplete all or substantially all of its capital, and there is no reasonable prospect for the bank to become adequately capitalized without federal assistance;
• Is undercapitalized and (1) has no reasonable prospect of becoming adequately capitalized, (2) fails to become adequately capitalized when required to do so, (3) fails to submit a capital restoration plan acceptable to its regulator within time frames prescribed or (4) materially fails to implement its capital restoration plan; and
• Otherwise has insufficient capital.

Moreover, grounds for receivership exist based upon violations of law or unsound practices, such as:

• A substantial dissipation of assets or earnings due to any violation of statute or regulation or any unsafe or unsound practice;
• A violation of law or regulation, or an unsafe or unsound practice or condition, that is likely to cause insolvency or substantial dissipation of assets or earnings, weaken the bank’s condition or otherwise seriously prejudice the interests of the bank’s depositors or the Deposit Insurance Fund; or
• The bank is in an unsafe or unsound condition to transact business.

Finally, a receivership can be imposed due to a variety of critical management failures, such as:

• The bank’s board of directors consisting of fewer than five members;
• A willful violation of a final cease and desist order; or
• The concealment of the bank’s books, papers, records or assets, or refusal to submit the bank’s books, papers, records or affairs for inspection to a bank examiner.

A regulator merely has to document a problem that the bank triggers on one ground, but frequently will cite to multiple grounds to mitigate challenges to its use of its ultimate weapon.[3]

III. Action Plan: What Should Banks Be Doing Now?

Be Aware of Danger Signs

It is important for banks and their holding companies to be aware of the danger signs that may lead to the imposition by their regulators of the Regulatory Intervention Rules.

If any of the following occurs, a bank and its holding company are well advised to promptly retain outside counsel experienced in bank regulatory, supervisory and enforcement matters to assist in formulating strategies designed to minimize the potential application of — or, hopefully, seeking to avoid — the consequences of the Regulatory Intervention Rules:

• CAMELS component or overall rating downgrade below a 2;
• Significant exam criticism;
• Capital deficiencies;
• Loan portfolio issues that may impact capital levels or pose increased risk;
• Economic conditions in the bank’s market area that may adversely impact the bank’s residential, consumer or construction lending activities;
• Actual or threatened MOUs, supervisory agreements, consent orders or cease-and-desist orders; or
• Formal or informal regulatory directives related to capital, dividends, stock repurchases, reducing classified assets restrictions or growth regarding either a specific bank or holding company.

Potential Action Required

At minimum, good business planning and adequately responding to exam criticisms and/or potential supervisory or enforcement action is extremely important and not to be understated. Depending on the regulatory or business issues presented (or perceived by the regulators), the following actions may be required by a bank and/or its holding company:

1. Successful renegotiation, forbearance or extension of terms of lines of credit or other borrowings to avoid default events;
2. The monitoring of the financial soundness of material third-party service providers, including relationships with fintechs;
3. The monitoring and testing of sources of liquidity, considering:
   • Federal Reserve Discount Window, including prepositioning of collateral;
   • Reliance on brokered deposits;
   • Significant numbers of uninsured depositors;
   • Silent deposit outflows caused by electronic withdrawals; and
   • FHLB-secured collateral that could adversely impact other pledges;
4. Capital raising transactions through private placements, or public offerings of equity or debt securities;
5. Potential strategic merger or business combinations, which requires the:
   • Identification of key advisors (investment bankers, accountants and attorneys);
   • Preparation of non-disclosure agreements with appropriate parties; and
   • Creation of virtual and/or physical data-rooms;
6. Strategic sales of assets or business lines with the goals of (a) selling classified assets, (b) selling good assets to raise capital, and/or (c) narrowing business focus to core bank products or services;
7. Upgraded/updated compliance risk management policies and staffing;
8. Potential securities disclosure of adverse business or regulatory developments through Form 8-K and press releases;
9. Possible board and/or management changes;
10. Review of employment agreements and identification of potential golden parachute provisions;
11. Physical separation of bank records from holding company records;
    • Making sure to review policies as to what constitutes bank and holding company property to ensure that records are properly retained by each entity;
12. Customer education programs addressing maximization of FDIC deposit insurance strategies;
13. Review of and potential increases of D&O insurance and indemnification coverage; and
14. Preparation of communication plans within a bank, holding company as well as with customers, including:
    • Appointing authorized spokespeople;
    • Monitoring social media; and
    • Monitoring traditional media.

Conclusion

Being strategically prepared to handle an actual or threatened launch of the Regulatory Intervention Rules by a regulator will go a long way to minimizing their potential impact. Just as in previous times of economic uncertainty, forewarned is forearmed.