Top bank risks for 2024 | ABA Banking Journal (2024)

Compliance risk, interest rates, credit top banker, expert concerns going into the new year.

By John Hintze

Hardly a year goes by without major events, whether geopolitical, financial, or something completely unanticipated like a global pandemic, that dramatically impact financial markets, the economy, and banks. Last year was no exception, and 2024 is on track to remain a challenging environment — even without any completely unexpected surprises.

The collapse of Silicon Valley Bank and two other large banks in early 2023 put a spotlight on interest rate risk management. The suddenness and severity of their fall ramped up investors’ and regulators’ scrutiny of banks across the sector and the risks they face, likely a factor in the drumming bank stocks have taken since. Meanwhile, banks were already dealing with significant risks, including cyber attacks and fraud, depositors shifting funds to higher-return investments, and the effects of the pandemic on both their investment and loan portfolios. Rather than finding resolutions, those risks only seemed to grow last year and become more complex.

That trend is clearly continuing into 2024, with risks such as cybersecurity amplified by the rapid adoption of artificial intelligence and in particular generative AI technologies. The greatest worry expressed by bankers and experts, however, appears to be onslaught of regulatory changes. Even those not going into effect well after 2024 are likely to keep bankers up at night in the year ahead as they analyze the potential operational and strategic impacts and how to address them. “The biggest stress is what’s on the horizon, more than what bankers are dealing with immediately,” says ABA EVP Ginny O’Neill.

Banks face a barrage of regulatory scrutiny and rules

The regulatory rules and issues just keep layering on top of each other, with little apparent coordination among the various regulators or consideration about what their combined impact will be. In the meantime, banks must prepare systems and train staff to comply with the requirements — and given the complexity, even prepared banks can face compliance risk.

“From the final Community Reinvestment Act rules to Rule 1071 and various other CFPB-related rules and considerations, banks will need to continue to invest a significant amount of time and talent to ensure they meet their compliance obligations,” says Kristina Schaefer, CRCM, CERP, general counsel, chief risk officer and chief administrative officer at First Bank and Trust, a $1.7 billion-asset institution headquartered in Sioux Falls.

Among the most significant, even for small banks, is Dodd-Frank Act Section 1071, final rules for which the CFPB finalized last March. It essentially levies onto banks’ small business lending the type of reporting, data collection and hygiene currently required for consumer credit. (As previously reported, banks with more than 2,500 covered credit transactions would have faced a tight compliance date of Oct. 1 of this year, and those with as few as 100 transactions by Jan. 1, 2026, but due to a lawsuit brought by ABA and the Texas Bankers Association, enforcement of the final rule is suspended until the Supreme Court rules on a challenge to the constitutionality of the CFPB’s funding, and the new compliance deadlines will be stretch out by that amount of time.)

Nevertheless, banks will have plenty to do this year, including preparing their systems, software and other changes necessary to be compliant. Small business lending typically occurs in different divisions in a bank, ranging from Small Business Association loans to equipment financing to credit cards, and banks will have to collect normalized data to report annually to the CFPB. The rule “can dramatically reshape small business lending, because institutions may not be able to price the risk like they do today,” explains David Kelly, CRCM, CERP, chief risk officer at $28 billion-asset FirstBank, headquartered in Lakewood, Colorado.

Section 1071 requirements have also been incorporated into the Community Reinvestment Act final rule, which regulators updated in October in a 1,500-page final rule. Kelly says the new CRA requirements may be problematic for smaller banks operating in more confined geographical markets, since pushing to reach certain metrics may lead to greater credit risk. Plus, banks are increasingly competing against nonbank credit providers not subject to the rule. “When only banks have to hit certain metrics, it can create risk in the banking sector,” Kelly says.

Also on the horizon is the banking regulators’ Basel III “endgame” proposal issued last July. In in a September report, EY says it “will fundamentally alter how banks with over $100 billion or more of assets approach risk-based regulatory capital and capital management.” The proposal will likely increase the banks’ risk-weighted assets, the report said, and require smaller ones to enhance their risk data and technology capabilities and controls.

Elevated rates present a range of risks

More urgently, the Federal Reserve has extended more than $100 billion in loans to mostly regional banks through its post-SVB Bank Term Funding Program, and those banks must either repay the loans by March 11 if the program is not extended, says George Goncalves, head of U.S. macro strategy at MUFG Securities Americas.

“It boils down to another manifestation of interest-rate risk, which has really held back the regional banks,” Goncalves says, pointing to ongoing higher interest rates increasing deposit costs and squeezing bank margins, as wells as potentially resulting in more losses if fixed-income investments are not kept in held-to-maturity accounts.

In addition, there’s been significant interest-rate volatility over the past few years. Matthew Tevis, managing partner and head of Chatham Financial’s financial institutions team, says recent moves of 20 basis points or more in the 10-year Treasury bond’s rate are not unusual. “Our balance-sheet risk management team, which is now helping banks manage their asset-liability risk, is having a record year,” he says. He adds that business picked up significantly soon after March’s regional bank failures and has gained momentum as clients seek to protect themselves against different scenarios, often using pay-fixed swaps either to extend liabilities or shorten asset duration.

The higher cost of deposits, in some cases prompting banks to let them run off, has resulted in increasing challenges that can create business risks. Tevis notes, for example, a client that had originated a sizable loan and faced difficulties in finding bank participants to share in the credit. “Even during the crisis was saw last March and April and into May, we didn’t hear as much about banks slowing down loan originations because of liquidity,” Tevis says.

Credit issues are starting to emerge

Just as banks’ margins are tightening, their loans are showing signs of deterioration. ABA’s Economic Advisory Committee, made up of chief economists from North America’s largest banks, expects credit conditions to worsen in the coming months. Delinquencies for both consumer and commercial debt remain relatively low, but they are rising. That’s to be expected in an economy facing headwinds, but a few commercial real estate sectors are facing more fundamental changes. Malls and other retail shopping outlets, for example, have long been under pressure as consumers increasingly shop online, and remote work during the pandemic accelerated that trend. Even more worrisome for banks are office buildings high vacancy rates.

Cristian deRitis, deputy chief economist at Moody’s Analytics, says about $1.5 trillion in CRE loans are maturing over the next few years. If depressed rental incomes don’t justify refinancing loans, banks will have to decide whether to pursue foreclosures or modifications in hopes of a recovery down the road. “I expect prices of office buildings to fall around 30 percent from their peak over the next three to four years, some much more,” deRitis says.

Banks’ third-quarter earnings reports indicated the CRE repricing process is picking up steam. For example, $13.5 billion-asset OceanFirst Bank attributed its net income dropping to $19.7 million from the second quarter’s $26.8 billion to higher deposit costs and writing down of a nonperforming CRE loan secured by a Manhattan office building, to $8.8 million from $17 million. Meanwhile, PNC Financial Services, with nearly $560 billion in assets, reported nonperforming loans increasing by $210 million, or 11 percent, “primarily due to an increase in commercial real estate nonperforming loans, partially offset by lower consumer nonperforming loans.”

While the largest banks carry the bulk of CRE loans, regionals are likely to be most affected by CRE credit deteriorating. “It’s big business for very large banks, but percentage-wise it’s relatively small,” says Adrian Ungureanu, managing principal at management consultancy Capco. “For community and regional banks, however, the portion of overall CRE risk they hold is smaller than the big banks, but as a portion of their businesses it’s higher.”

Fraud supercharged by AI

Elevated deposit rates will push banks to grow fee income and cut costs, says Mary Clouthier, CRCM, CERP, the chief risk officer at Cornerstone Capital Bank in Texas, but overdoing it can create its own risks. “Wholesale cost-cutting efforts should not cut into investments in technology and IT talent that are warranted both to protect the bank and grow its business,” she explains.

Cybersecurity continues to rank as a top risk across corporate America, and the rapid commercialization of AI has provided cybercriminals with a more effective tool both to penetrate banks’ systems and to perpetrate scams. “We have seen first-hand several scams involving phone calls that are using voices created by this technology,” Schaefer says, in a “much more realistic — and sometimes terrifying — version of the ‘grandparents scam,’” in which the perpetrator usually impersonates a family member to ask for financial assistance or get information.

ABA EVP Paul Benda says check fraud remains a major risk for banks, but top-of-mind is the weaponization of widely available generative AI to accelerate fraudulent schemes, whether to fool voice or knowledge-based authentication procedures or to draft and send out phishing emails at scale. “There’s fear now that if the conflict between Israel and Hamas spreads wider, state actors like Iran could pursue banking sector attacks, which it has done in the past,” Benda says.

Demand for expertise to fortify a bank’s systems against cyberattacks has become increasingly hard to find and expensive, and AI is adding another complication. “Somebody might look really good on paper, but they may using AI tools to fake it,” even potentially when responding to question during a Zoom interview, Kelly says. He adds that AI, which has long been used as a tool in compliance and risk management, has its pluses, and his bank is looking at generative AI to speed up the coding process to improve its systems, as well as to generate letters and communications to clients much more quickly.

Geopolitical shocks from out of the blue

Nobody predicted COVID-19 or the extent of last year’s bank upheaval, so it’s unsurprising that bankers are worried about the risks in 2024 that nobody expects.

Kelly at FirstBank says that “first and foremost” he is focused on where the economy is headed and the factors that could impact it, such as the Fed raising rates and taking other actions to reduce liquidity in the economy. “This is a very interesting time in the economic cycle, and it’s unclear whether there will be an economic soft or hard landing, and if it’s the latter what steps can be taken to reverse it,” Kelly explains.

The MUFG macro strategy team thinks the Federal Reserve is likely to decouple from other central banks and start to lower rates as the economy slows, Goncalves says. If other central banks do not follow its lead, he added, that could potentially divert foreign capital away from the U.S. and thus reducing capital coming into the broader U.S. financial system, keeping the cost of capital high for regional and community banks. “That might crowd out lending activity in the U.S.,” Goncalves says.

Goncalves adds that inflation tends to mask companies’ issues because everybody can raise prices at the same time, but when inflation falls, only the stronger brands and companies will maintain market share. “So we would probably see delinquencies and defaults pick up.”

Perhaps harder to hedge, but especially relevant today, are extreme risks that could emerge from the wars in Ukraine and Gaza, tensions with China or, as is often the case with what amount to catastrophic events, from completely unexpected corners. “All three banking regulators have called out geopolitical risk management,” says Ungureanu. “Even community banks are expected to have a framework in place geopolitical risk, whether domestic or international.”

John Hintze is a frequent contributor to ABA Banking Journal.