With the release of a bulletin offering guidance on the use of independent consultants in the course of an enforcement action, the Office of the Comptroller of the Currency put banks of all sizes on notice about their expected due diligence of consultants.

The standards set forth in OCC 2013-33, “Use and Review of Independent Consultants in Enforcement Acts: Guidance for Bankers,” establish how the OCC assesses the need to require a bank to hire an independent consultant “as part of an enforcement action to address significant violations of law, fraud or harm to consumers.”

Consultants are often required by the agency when addressing significant deficiencies with bank programs related to the Bank Secrecy Act, the need to file or amend suspicious activity reports and significant consumer law violations of Section 5 of the Federal Trade Commission Act, which prohibits unfair or deceptive practices. Bank management and the board of directors are not absolved by the use of a consultant, the agency said, nor is the consultant considered a substitute for the final supervisory judgment of the OCC.

The determination to require a bank to engage an independent consultant is made on a case-by-case basis, the OCC said. Factors to be considered by the agency include the severity of the violations (including the impact on consumers), the agency’s confidence in the bank management’s ability to perform the necessary actions to identify and correct the violations, alternatives to the use of an independent consultant, the importance of the function to be addressed by the consultant, and the services to be provided by the consultant.

Once the decision to use an independent consultant has been made, the bank must submit information about the proposed consultant (such as qualifications and terms of engagement), document the due diligence conducted by the bank for review, and seek the OCC’s written “no objection” to its consultant choice and the proposed contract. The bulletin presented three areas of particular importance during the review process: the necessary due diligence, the independence of the consultant, and the engagement contract and work plan.

Due diligence must be conducted prior to proposal of an independent consultant, including consideration of issues such as expertise, capacity, reputation, information security and document custody practices, and the disclosure of any professional disciplinary actions, the bulletin advised.

The OCC placed great emphasis on the need for the consultant to maintain strict independence from bank management. Direct conflicts – like the use of a consultant who has previously reviewed the transactions at issue or the relevant policies and procedures – could cause the agency to disqualify the consultant, the bulletin cautioned, as could the appearance of a conflict of interest. A review of the consultant’s independence is intended to “establish that the consultant can perform its work with a high level of objectivity such that the results of the engagement are free of any potential bias and that the work is based on the consultant’s own independent and expert judgment,” the agency explained.

When submitting information to the OCC, banks should be aware that the agency will consider several factors. The independent consultant’s relationship with the bank, including prior work dating back three years, will be considered along with any specialized expertise of the consultant and the availability of other consultants. If potential conflicts do exist, the bank should provide information about possible means to mitigate the conflict. Financial, business and personal relationships should also be disclosed between the consultant and the bank and its executives and board members.

Finally, the OCC will review the engagement contract and work plan for the proposed independent consultant. The bank’s plan should establish compliance with all applicable laws and regulations, the bulletin noted, as well as the maintenance of complete records, an assurance that disagreements about material matters will be brought to the OCC’s attention, and that the conclusions and recommendations of the consultant will be based on his or her own independent judgment. Work papers, drafts and reports should all be available to the OCC upon request, and the agency should be able to meet privately with the consultant.

Oversight by the OCC continues throughout the enforcement action and therefore the length of the bank’s relationship with the independent consultant. The more serious the violations involved, the greater the oversight and more significant the monitoring of the consultant, the agency cautioned. Depending upon the action, periodic reports and meetings between the bank, consultant and the OCC may be necessary.

During the process, “if at any time the OCC determines that the work of the independent consultant is not consistent with the requirements of the enforcement action or the terms of the engagement, the OCC will asses whether to require the parties to modify or terminate the engagement or whether to take action,” according to the bulletin.

The agency will review the consultant’s final written report of findings and recommendations to the board of directors and management to ensure that the bank has appropriately addressed and corrected the violations and that corrective actions are sustainable. If not, the OCC may tell the bank or the independent consultant to get back to work.

The bulletin noted that independent consultants are also used by banks – particularly community banks – for more “functional” engagements, such as correcting operations and management deficiencies. Because the issues being addressed in those situations do not involve “significant” violations of law, fraud or harm to consumers, the OCC’s level of oversight is lower and the concern for independence “may not be as critical,” the agency said, adding that appropriate due diligence is still required.

To read OCC 2013-33, click here.

Why it matters: “Properly used, independent consultants can help further important supervisory objectives, particularly in the context of enforcement actions,” Comptroller Thomas J. Curry said in a press release about the bulletin. “However, while consultants can provide knowledge, expertise and additional resources, we must take care to ensure they maintain independence and are subject to appropriate oversight.” Banks not supervised by the OCC should consider this yet another “best practice” guidance that their regulators would endorse for all vendor selections. The guidance pillar requirements of expertise, resources and independence can make the selection of lower-cost and off-brand consultants risky for addressing significant violations such as anti-money laundering noncompliance, as well as awkward, as the limited number of qualified potential consultants for complex cases invariably includes many former senior examiners from the OCC and the other banking agencies.