Despite a bank's best efforts to comply with all US legal requirements, there's always a danger that banking regulators may issue a public enforcement order requiring it to address some operational defects.

When the US Treasury Department, the Federal Reserve Board, the New York Banking Department or other federal and state banking regulators take action against a bank, the consequences can be costly.

A banking enforcement action can generate negative publicity, require extensive remedial actions and lead to substantial monetary penalties. The costs can mount even higher when a bank fails to respond properly to regulators. US offices of non-US banks, with head offices that often do not understand the US regulatory system, can be particularly vulnerable in the event of an enforcement action.

Kathleen Scott, counsel in White & Case's Banking Advisory practice, explains the circumstances in which enforcement orders usually arise and steps banks should consider if a regulator indicates that it intends to issue an enforcement order.

Q: Let's start with the factors that tend to trigger enforcement actions. What typically causes US banking regulators to take action against a bank?

Over the past several years, as concern over compliance issues has grown, US regulatory enforcement activity has heated up. The most common areas of concern, aside from capital and liquidity issues, are statutory or regulatory violations and the presence of unsafe or unsound conditions that must be corrected.

Many of the most recent US public banking enforcement orders have dealt with allegations such as a lack of anti-money-laundering compliance, management inefficiency, inadequate policies and procedures regarding restrictions on lending to insiders, insufficient oversight by an international bank's head office over its US offices, failure to comply with safe and sound lending practices, deficiencies in internal audit functions and noncompliance with restrictions on affiliate transactions.

Q: When a federal or state banking regulator issues an enforcement order, how serious can its effects be?

Failing to ensure full regulatory compliance can be extremely costly for a bank. US banking regulators have a variety of enforcement options available to them. They can send a nonpublic communication to a bank regarding a condition that needs to be addressed, require a bank to enter into a public written agreement or issue a cease and desist order.

Regulators can impose civil monetary penalties in the range of millions of dollars. For example, just recently, the US bank subsidiary of a foreign bank was required to pay the US Treasury Department and the New York State Banking Department a $12 million penalty for failing to implement adequate internal controls and for violating other federal and state anti-money-laundering regulations. This is in addition to the millions of dollars the bank probably also spent in hiring lawyers and accountants, conducting forensic reviews and engaging in remedial compliance activities.

And the ultimate sanction is to shut a bank down. For a bank organized in the US, this means revoking its charter. For a non-US bank, this means denying it a license to maintain a direct office in the US.

Q: What types of less drastic remedies can regulators demand?

US regulators often require banks to correct what the regulators perceive as unsafe and unsound conditions or violations of law and regulations.

A review of recent public enforcement orders shows that regulators typically direct banks to undertake a wide variety of remedial actions. These can include retaining an accounting firm to conduct a forensic audit, hiring outside experts to draft or revise bank policies and procedures, prohibiting or restricting lending to insiders, strengthening risk management, compliance or oversight functions, hiring new officers for certain positions, conducting reviews to determine whether required reports were filed and, if necessary, back-filing any required reports.

Q: So once a bank learns that regulators plan to issue an enforcement order, what should it do?

The key steps are to take an order seriously, hire the necessary resources to deal with it effectively and be diligent about compliance.

When US regulators indicate that they intend to issue an enforcement order, a bank should not automatically assume a worst-case scenario. In most cases, regulators chiefly want to ensure that banks operate in a safe and sound manner. The enforcement order will clarify these expectations in a formal document which the bank's senior management or directors must then sign.

Another important initial step for banks is to review previous public orders. Many enforcement orders contain boilerplate provisions that do not vary significantly. So once the bank understands the general outline of what the regulators will require, it can look to previous orders for an indication of remedial actions it may need to carry out.

Q: What guidance can you offer banks looking for advisors to help them handle an enforcement action?

First of all, it's important to work with lawyers who have experience in dealing with bank regulators. A bank's relationship with its regulators need not be adversarial from the start, since all parties share the common goal of making sure the bank acts in a safe and sound manner and executes an effective business plan.

Once regulators have indicated that they will require an independent review of management, transactions, policies, procedures, controls or other operations, the bank should start searching as soon as possible for outside assistance. It should speak with several outside experts and identify one that can begin work as soon as the order is signed. In most cases, regulators must approve consultants' engagement letters. So if the bank has selected an outside expert and discussed the form of the engagement letter, it will be able to quickly present a draft engagement letter to the regulators for review once the order is issued.

In hiring outside advisors, a bank should also interview more than one company and not automatically gravitate to the lowest bidder. Many US offices of non-US banks may have a hard time convincing their head offices of the need to pay the high fees that sometimes can be charged by consultants such as accountants. But US employees of the bank should stress to the head office that the money will be well-spent if the regulatory problems are resolved promptly and effectively.

Q: Do any issues affect non-US banks in particular?

Enforcement orders can perplex many non-US banks, which may not be as familiar with the workings of the US banking system.

One issue that arises frequently with non-US banks is that executives in the head office outside the US may not comprehend the seriousness of the situation and the consequences of noncompliance. In most cases, US regulators want proof that a bank's senior management is serious about resolving any compliance problems. Senior managers at the bank should be involved actively in responding to enforcement actions. This means traveling to the US to attend meetings with bank regulators when a proposed order is discussed and any follow-up meetings relating to compliance with the order.

Another important point is to keep the regulators in the bank's country of origin informed about the enforcement action. US regulators maintain relationships with most other banking regulators around the world. They attend the same conferences and work together to craft international standards in such areas as capital, money laundering and terrorist financing. They also share information about their banks. If a non-US bank learns about a potential enforcement action, the bank should inform its home country regulator promptly and seek any necessary assistance in complying with the order.

Q: If a bank is unsuccessful in dealing with regulators, how easily can it contest an enforcement order in court?

Court challenges to enforcement orders rarely succeed. US courts generally defer to federal and state banking regulators so long as the regulators can show that there was a reasonable basis for the actions and that they did not behave in an arbitrary and capricious manner. Regulators have a broad mandate to ensure the safety and soundness of the US banking system. So any remedial steps they order generally are deemed within the scope of their authority.

Q: Any last words for a bank facing an enforcement action?

Scott: Most important is that a bank should not seek to do only the minimum amount necessary. Instead, it should seek the best solution that will prevent any regulatory issues from recurring. Getting it right the first time, even when that means going above and beyond what is required, can prevent a lot of problems in the future.