Tom Heintjes: Welcome to another Economy Matters podcast. I'm Tom Heintjes, managing editor of the Atlanta Fed's Economy Matters magazine, and today we're joined by Mike Johnson, executive vice president of Supervision and Regulation at the Atlanta Fed. As 2017 winds down, we thought it would be a good time to have Mike back on the podcast to take a look at the year in banking. Mike, it's a pleasure to have you back on the podcast.
Mike Johnson: Thanks, Tom—always great to be here.
Photo: David Fine
Heintjes: Mike, let's look back at the year in banking from the 30,000-foot level, and we'll get into the nitty-gritty a little later. How would you generally characterize the southeastern banking industry in 2017?
Johnson: Well, Tom, coming from the depths of the crisis, I'm glad to say that I would describe it as stable and continuing to improve and consolidate.
Heintjes: We saw some slowing of loan growth in the third quarter. Do you think this is a transitory event—sort of a blip on the radar screen?
Johnson: Yes, that's a great question. We certainly did. But time will tell, obviously, whether it's transitory or just a pause. If it's a pause, I actually don't think that that's a bad thing. Remember, over the long horizon, loan growth frankly should grow at about the same level as GDP [gross domestic product], right?
Heintjes: Right.
Johnson: Loan growth previously was pretty robust across almost all loan segments, whether it's retail, commercial, commercial real estate, and so on. So a little bit of a pause is probably not a bad thing at this point in time, but something to keep our eye on for the future—again, because of that tight correlation to GDP. If it's a bit of a pause basically to make sure that we're not loosening underwriting standards and that lending is responsive to reasonable demand—I think it's a good thing.
Heintjes: Right. Well, did you observe this—I'll say slower loan growth—across banks of all sizes, or was it peculiar to one segment of banks versus others? How would you characterize that?
Johnson: Pretty much across the board, banks of all sizes. And actually what's kind of interesting was, across pretty much all loan categories as well. So community banks and large banks, they tend to have a little bit of a different loan mix. But we did see a little slowing in loan growth in the last quarter across both of them. Why? Because there was slowing, as I said earlier, both in wholesale and retail segments. Now, again, also remember that that slowing, for the most part, was a slowing in growth, not necessarily an aggregate slowdown in lending overall.
Heintjes: That's a great distinction.
Johnson: I think that's important to keep in mind.
Heintjes: Right. Well, Mike, how would you generally assess credit risk for banks these days? We're all aware of the pounding that banks took on commercial real estate [CRE] during the recession, but how does the CRE segment look to you currently?
Johnson: The good news, with respect to CRE, is I think we as regulators—and of course, the banks that we supervise—learned a lesson and are sticking for the most part to the learnings from the lesson. I hope I said that in a relatively intelligent manner! [laughs] I think we're still seeing a lot better underwriting, a lot better credit risk management practices—strength in limits, strength in sublimits, if you will. So breaking commercial real estate down into its various segments—whether that be multifamily, warehouse, things of that nature—and then having limits within that. A lot better market analysis and changes to the mix of loans that institutions are willing to underwrite based on that market analysis. So I think the fundamental underwriting standards and lessons learned—we're really seeing that banks are sticking to those. Unfortunately, there are a few exceptions here and there, but I think that's a real positive for the industry.
Then the other question is, what's happening in commercial real estate markets themselves? And I think that's a little bit of a mixed question, because of course it depends on what product type you're in, and what market you're in.
Heintjes: Sure, one size doesn't fit all.
Johnson: Right, one size doesn't fit all. There are a few markets and a few segments that we're keeping our eyes on—you know, markets that tend to be higher growth—I think, for the most part, justified by fundamentals. But you really have to keep your eyes on it, because those fundamentals can shift pretty quickly.
Heintjes: Sure; keeping in mind the lessons we've recently learned, too.
Johnson: You bet.
Heintjes: I want to turn from that segment to another important bank segment, and that is auto lending. I occasionally read references to auto lending levels being quite high. How would you characterize the auto lending segment?
Johnson: Quite high. [laughter]
Heintjes: Simply put. [laughter]
Johnson: Yes. I think what you've read has been accurate. Of course, that's a function of auto sales having been quite high, and somebody's got to finance that. But that in and of itself, as long as it's reasonable loan demand that is effectively underwritten, is not a bad thing. So I think for the most part it's been positive, but there are a few concerns that we've been watching. One that goes back to the fundamentals of underwriting is lending tenors—basically the duration of the loan itself—tend to be getting longer, which is a bit of a mixed bag, because cars are actually lasting longer, so that's something that we're watching. FICO scores are going lower, so banks are tending to go down a little bit lower in the credit box, if you will.
Heintjes: What can we infer from that, if anything?
Johnson: I think we can infer from that that there still remains a robust demand for new and used cars across all segments of the population. However, if you want to continue to grow loans in the auto space, you have to ensure that you're serving all segments of the population, including those lower FICO bands. But as banks move down that space, they are actually taking on more credit risk, and it's our job to make sure that that, again, is effectively underwritten, that there are strong risk management practices in place, that they're doing this ensuring that pricing is appropriate and there's an appropriate return on that, and so on.
But those are things that we're watching; and I would also add to this, with the increase in auto lending—particularly in indirect auto lending—an area that we have seen some pockets of concerns is fair lending. So think of indirect auto this way: somebody else actually has the direct interface with the customer, and making sure that there are no intended, or unintended, biases built into that decision. That's part of the Bank's responsibility, and that's something that we look at very closely. We have high expectations in that regard, and we're really keeping a pretty strong eye on it in the auto lending space.
Heintjes: That's interesting—I didn't know that our supervisors looked at that particular aspect of the lending market.
Johnson: Bear in mind that we look at institutions both from a safety and soundness perspective, as well as compliance with laws, regulations, including consumer protection laws.
Heintjes: Right, great. Mike, I want to get your attention turned to changes in interest rates. Over the last year or so, we've seen some increases in interest rates. I wonder what effect these increases have had on banks' margins? I assume, naturally, it's benefited them, yes?
Johnson: Yes. Banks have positioned themselves for the positive effects of a rise in interest rates for quite some time. [laughs]
Heintjes: They've been waiting for this. [laughter]
Johnson: They've been looking for this, yes. And it has been very beneficial. You can actually see the direct correlation between this slow and gradual rise in interest rates with banks' net interest margins—particularly at the community bank level, which tends to be more sensitive to that approach. The larger banks have more options and often manage themselves closer to a neutral position. But yes, it's been very positive.
One interesting thing on the interest rate piece that we are keeping our eye on, but we haven't seen happen yet, is actually the impact on the deposit side. As interest rates rise, clearly the goal here is that the spread between your loans and your deposits increases, and a bank can have a higher net interest income. But there are two sides to that equation—there's the liability deposit side as well. We haven't really seen the interest rate rises pass through to that piece of the equation yet. We're keeping our eye on it. Why are we keeping our eye on it? Well, one—there's the earnings piece, but also, there's the liquidity implications of doing that. You can envision a scenario where you might have some pricing competition, and that pricing competition—depending on which side you're on and what trade-off decisions you want to make, because it has an implication for earnings—it could also have an implication for liquidity and whether those deposits stay or leave.
Heintjes: Is this something you think banks can look forward to in terms of the changes in the deposit side? Or is it just something that they're monitoring?
Johnson: Yes, it's interesting—nobody really knows. We're actually in uncharted waters with interest rates as low as they have been for so long, so forecasting customer behavior—your forecast is probably as good as mine, because we haven't been here before. But if we return to an interest rate environment that we saw 10 or 15 years ago, which one would describe as…well, one our age might describe it as more normal. [laughs]
Heintjes: We'd be more into charted waters at that point?
Johnson: Yes, we'd be more back into charted waters. And back in those charted waters, the mix of core deposits versus higher—and time/money market deposits, things of that nature—if it reverts back to precrisis levels, that's going to have a dramatic impact on earnings, and the overall benefit of a rising rate environment could find itself reversing pretty quick.
Heintjes: Well, next time you're on here, we'll look back at this conversation and see where things stand. Mike, I know you talk to bankers all the time, and so does your staff. And when you talk to them, what concerns do you hear expressed on a regular basis? Are there any common themes that they talk about, in terms of their concerns?
Johnson: There are huge common themes, Tom. That's a great question. So it's compliance costs, compliance costs, and if you spend more time with them, more compliance costs.
Heintjes: So there's a real unanimous feeling there?
Johnson: Right. Obviously, there are more rules in the post Dodd-Frank environment, but there are also more rules that have been promulgated—for example, by the CFPB [Consumer Financial Protection Bureau], which was created out of Dodd-Frank. So we hear compliance costs pretty much across the board. But if I was going to be very specific—mortgage is an example where some banks have actually exited the business, because with higher compliance costs you basically have to do a certain volume, have certain economies of scale, in order to justify being in that business these days.
Heintjes: That's a drastic step.
Johnson: Yes, it is, it is. I think the rules were all very well intentioned, but there are implications from that, and I think it's incumbent upon us—and when I say "us," the collective government and regulatory regime—to continue to look at that and make sure that the costs and benefits are appropriately in alignment.
Heintjes: Right. Well, Mike, I asked you in here to take a look back at 2017, and one of the stories of 2017 was the very exceptionally active hurricane season. Hurricane Irma made landfall in our district, and Harvey affected Houston and the nearby Gulf region. What were the effects of hurricanes on banks in the region? I guess that southeastern banks have gotten pretty experienced dealing with the aftermath, making cash available to the public, and so forth. What did you hear?
Johnson: Yes, well, that clearly is part of the story line of 2017, isn't it? First and foremost, I would agree with you that unfortunately banks have a lot of experience in dealing with natural disasters, including hurricanes. But the good news is they've learned from those experiences, and I think their response, frankly, has been tremendous.
So what are some of the immediate concerns, with respect to a hurricane? Access to public services—and in many ways, banking institutions are that public service. Particularly when there's power outages, access to cash becomes king. I've heard nothing but really positive, glowing stories about our banks and their ability to maintain their facilities, deliver cash, respond to meet other lending needs in the aftermath of hurricanes. So I really, really want to emphasize and support and thank the industry for their response. It just shows you what an important component the financial services sector is to the overall health of both individuals and the economy at large.
Having said that, you typically see a spike in problem loans right after a hurricane. But typically then you would also see that being made up over the longer-term horizon as new construction comes in, as insurance claims are met, and things of that nature. So loan demand kind of makes up for the initial problem assets. In these two hurricanes, the amount of forecasted problems—we still need more time to determine the actual results—but the initial forecasted problems in out-of-the-box loan loss provisioning expenses have been relatively low.
Heintjes: That's good.
Johnson: Yes.
Heintjes: That's great. I didn't really read any reports of people not being able to access cash or liquidity this time, so it seems like people really have their chops down in terms of these catastrophic events that we occasionally encounter.
Johnson: Yes, I think the biggest question is just the physical logistics. For example, I know when the Florida Keys was hit very, very hard, and how to get in and out of the Keys—there's only one way in and one way out, and when that's shut down it's pretty hard to get cash down there. So that took a few days. But once the physical logistics can be overcome, I think the preparedness really shines through.
Heintjes: Well, Mike, I want to switch gears a little and get you to talk a bit about cybersecurity, which is a very hot topic in your industry. Can you discuss the role of cybersecurity, specifically as it applies to banks? We hear so much about hacking and breaches, and the bad actors are only getting more inventive. How do you see the Fed's perspective on banking and cybersecurity having evolved over the years?
Johnson: Yes, well we can go in many directions, and we can have an entire lengthy podcast on this question, Tom. [laughter]
Heintjes: I might hold you to that, so be careful. [laughter]
Johnson: That wasn't an offer—it was just a comment, but we can do that. What's interesting about cybersecurity is you have so many different types. You asked about banks' role. Well, one type is theft and fraud. Banks still—you know, why do you rob the bank? Because that's where the money is. Well, you still have the same component as it relates to hacking into a bank, taking control of accounts, etc. But also customer fraud, where it may be easier to hack a bank customer but then spoof that customer in a way that causes the customer to request, for example, maybe a wire transfer. The bank is the conduit for that, even though the bank itself wasn't hacked. So you have the fraud piece, which could be a bank-specific piece or a bank customer piece. But funds flow through the bank, and the bank is part of that process.
Then you have the larger data breaches, and data hacks and so on, that banks have to continue to remain diligent with regard to. They're dealing with these threats from multiple dimensions. And I heard somebody say this a while back, and so I've kind of latched onto it. I hope people don't cringe when I say this, but I think cybersecurity is kind of like Y2K—do you remember that?
Heintjes: Sure.
Johnson: But it's Y2K with no end date.
Heintjes: Right, right. And Y2K ended up being sort of a nonevent, which this is not a nonevent—this is real.
Johnson: Yes, this is a real event. And once again we can go back and debate Y2K, but it ended up, I think because of a lot of work and preparedness, being a nonevent. And I hope for most banks cyber is that same thing, because of work and preparedness. Now our focus as supervisors, we're obviously not the technicians and not involved in looking at settings on specific servers or things of that nature. But we want to make sure that there's an appropriate risk management framework in place to deal with cyber, that deals with preventive, detective, and corrective controls, just like we would any other type of operational risk.
Heintjes: Actually, that segues perfectly to my next question, which is—while we're talking about the risk posed by cybercrime—I wanted to ask you: what does good risk management in general look like to a bank supervisor?
Johnson: Yes, well…that's a great question again, and I think you can pretty much take cyber, credit risk, everything, and think of it in the same spectrum. To a certain extent there may be multidimensions to this. I already mentioned preventive, detective, and corrective controls—that's probably one easy way of thinking about more operational risk-type elements. But I think the most important thing that we as supervisors, frankly, are looking for in terms of risk management is a risk management program that is self-sustaining and proactive. In other words, does the institution itself have the ability to identify issues and concerns, to implement corrective actions relative to those issues and concerns, and to be self-reflective around those issues and concerns and look across the enterprise to see whether there are other gaps? That proactive piece is something that I think is really important.
Self-identification, self-correcting, self-reflective is another way to think about a good, robust risk management system. But there's also the tone from the top that drives it and makes it all work. And that's what is the overall institution's risk tolerance, what is the board of directors' and senior management's risk tolerance for the firm? How does that risk tolerance flow through decision-making, when it comes to new products and new services, changing market conditions, and market dynamics? Things of that nature. But the watchword that I would put out there is a proactive risk management system, as opposed to a reactive one.
Heintjes: I guess—getting back to your Y2K analogy—the hard part would be never becoming complacent, I guess.
Johnson: Exactly.
Heintjes: Because when you're complacent, that's when something bad can happen.
Johnson: Yes. So take that example and apply the word "proactive" to it. The threat environment and the threat landscape is constantly changing, so how you approach it from a risk management standpoint has to also be constantly changing and adapting, otherwise you do become complacent—the world changes, moves past you, and you're exposed.
Heintjes: Right, there you go. Well, Mike, I know I asked you to come on here to talk about the past year, but I'm going to ask you, if you're willing to, to take out your crystal ball for a moment and look at 2018. Do you see 2018 being overall a continuation of trends we've observed in 2017? Is there anything in particular you'll be keeping your eye on in the year ahead?
Johnson: Well, that's a great question, Tom. I probably shouldn't say this, but I'm going to say it anyway.
Heintjes: Thank you!
Johnson: If I had a crystal ball, I might not be working here. [laughter] But I do think in many ways it will be a continuation. Now, I can't predict legislative initiatives—I can't predict things like tax policy and so on—but from a risk standpoint, as we think about it, cyber is our number-one risk that we're focused on. It's the number-one risk at almost every institution we talk about—I don't think that's changing. Banks need to continue to focus on credit risk management and underwriting standards, because also—I'm not going to take out a crystal ball and predict where the economy's going to go. Other people at the Fed have that job. So I think that's important to us. We already touched on a little bit of commercial real estate, some of the retail components, auto, credit card—things of that nature would be on the radar screen. But again, these are more in that continuation piece.
The one thing that I would throw out there, though, from the Fed's standpoint—we do have a new vice chair of supervision in Randal Quarles in Washington, and we will—assuming Governor Powell is confirmed and becomes Chairman Powell—have new leadership there. So I think in this theme of continuation, I've had the privilege of working with Governor Powell for a while now and have met but don't know Vice Chair Quarles very well. But I'm really looking forward to working with them.
Where I'm going with this is, I think they're very focused on continuing to review what's been put in place in a post Dodd-Frank environment, making sure that it's effectively tailored for the institutions that we supervise, and that we have an appropriate supervisory regime for the times. And I think those are the right things to focus on.
Heintjes: Right. I think that's very well said. Well, Mike, I want to thank you again for speaking with us today, and thanks for sharing your thoughts. It's been really interesting.
Johnson: Yes, thank you, Tom. I appreciate it.
Heintjes: And that brings us to the end of another episode of the Economy Matters podcast. Again, I'm Tom Heintjes, managing editor of Economy Matters magazine, and I've been speaking with Mike Johnson, executive vice president over Supervision and Regulation at the Atlanta Fed.
Heintjes: I encourage you to visit our digital magazine, Economy Matters, at frbatlanta.org. There you'll find a great deal of banking information, including a brand new edition of "ViewPoint" from Mike's Supervision and Regulation Division, which offers a very nice snapshot of current banking conditions. And lastly, I hope you'll join us next month when we discuss workforce development with Stuart Andreason, director of the Atlanta Fed's new center, the Center for Workforce and Economic Opportunity. I hope you'll be here for that conversation. And from all of us here at the Atlanta Fed, I hope you have a very happy new year—see you in 2018.