V

Prepared by: Tom Conahan Index:

Date: 12/13/01 DOC Library: Goal 1
Job Code: 250045 DOC Number: 333942

Interview With OCC Re:

9/11
Reviewed by: Toni Gillich
Review Date: _January 4. 2001

Record of Interview

Purpose To determine the immediate impact of the September 11 attacks on

National Banks and to learn of OCC's longer term plans to respond.

Contact Method Interview

Contact Place Office of the Comptroller of the Currency

250 E Street, N.W.

Washington, D.C.

Contact Date November 29, 2001

Participants Office of the Comptroller of the Currency (OCC):

Mike Brosnan, Deputy Comptroller for Risk Evaluation, (202) 874-4660

Ralph Sharpe, Deputy Comptroller, Technology, (202) 8744-572

Vernon Stafford, Director, Large Bank Supervision, (202) 874-5190

Kevin Bailey, Core Policy,

Laura McAuliffe, Senior Advisor OIG/GAO Liaison, (202) 874-4603

GAO

Mr. James McDermott, Assistant Director, FMCI

Ms. Toni Gillich, Analyst, FMCI

Pagel Record of Interview

r
Prepared by: Tom Conahan Index
Date: 12/13/01 DOC Library:
Job Code: 250045 DOC Number:

Mr. Tom Conahan, Senior Analyst, FMCI

Unless otherwise noted, the OCC officials said the following: a

Comments/Remarks

National Banks There were no significant disruptions to National Banks from the
September 11 attacks. There were some minor disruptions, like ATM
Experience No Major machines that did not work and branches that had to be closed in the
Disruptions lower Manhattan area, but these were generally minor, localized
problems. Because the commercial paper market was not functioning for
a couple of days, some firms drew down their credit lines with banks,
resulting in greater credit risk. The Federal Reserve made funds available
to enhance banks' liquidity, but no national banks needed them. However,
the Federal Reserve's offer of funds served as a psychological boost.
National banks did take advantage of the lower discount rate however.

While banks' credit exposures increased significantly in the first 4 or 5

business days, it was done thoughtfully and the OCC monitored the
situation throughout. Counter party credit exposures went in some cases
from about $lbillion a day to about $5 billion. Banks were thoughtful in
making their business decisions, but they also wanted to be good citizens.
The OCC officials stressed that they were monitoring the situation
continually. The officials note that among the companies that were
drawing down their credit lines were the airlines, which were losing larg<"~
amounts of money. The officials said that the airline industry's problem,
were not enough to truly affect the banking industry, but they did
represent a "body blow."

The OCC tried to act with common sense in the days following the
attacks. There were a number of smaller issues that emerged such as
granting specific banks the authority to close branches. Such requests
came from banks in the lower Manhattan area, but also other areas, such
as in the Sears Tower in Chicago, which seemed vulnerable after the
attacks. Banks had the authority to close branches on the 11th. Other
issues involved some banks wanting to move funds in ways that might
violate certain rules, such as 23 A. While these communications were
often informal, they were handled on a case-by-case basis and were
handled responsibly. Both the banks and the OCC wanted to act as "good
citizens" in the period following the attacks. The emphasis was on
maintaining confidence in the system. On the 14th, U.S. regulators issued a
memo on how balance sheets may balloon (attached). The officials said
that they were willing to exercise some forbearance on specific issues, but
this simply meant that they were willing to talk. Prompt Corrective Action
would not kick in for technical violations. However, there were no blanket
approvals of any particular activities.

In the days following the attacks the OCC participated in a number of -

conference calls with other agencies to share information. They noted
that the President's Working Group operated well during this period. The-

Page 2 Record of Interview

Prepared by: Tom Conahan Index:
Date: 12/13/01 DOC Library:
Job Code: 250045 DOC Number:

other agencies that participated in these calls included other bank

regulators, insurance regulators, and securities regulators. The OCC
officials said that these calls worked well.

The key to all of the regulators' efforts in the days following the attacks,
was to maintain overall confidence and return to normalcy.

Comptroller Hawke was grounded because of the prohibition on flying,

but he and other senior OCC officials were in contact with examiners on
site at the banks to determine what was going on. The officials noted that
the Y2K planning done by banks was helpful in surviving this crisis.

Lessons Learned The officials said that the attacks caused OCC officials to think a lot about
contingency planning for possible future attacks or other highly disruptive
events. For example, while senior OCC officials were spread throughout
the country at the time of the attacks, they were reasonably successful in
communicating with the rest of the agency because the OCC offices in
Washington were unaffected by the attacks. The attacks prompted OCC
officials to consider how they would proceed if their main offices were
damaged or somehow affected. They would need back up communication
facilities. They are developing updated phoned lists, etc.

On October 31 there was an interagency meeting to discuss the

implications of the September 11 attacks. While the consensus was that
contingency plans worked pretty well in the affected areas, they need to
be revisited. One of the challenges is developing a framework to deal with
a wide variety of different contingencies. No one contemplated attacks of
the sort that occurred on September 11, which required that banks move
their entire operations. The officials noted that the framework should
include consideration of the staffs' psychological as well as physical
needs.

On October 25, BITS, which is the technology group of the Financial

Services Roundtable, had a forum to consider the implications of the
attack, which included representatives from the regulatory agencies.
Their deliberations were similar to those that occurred at the interagency
meetings. They noted that prior to the attacks, most of the planning for
disaster recovery was data-centered. These attacks showed that the
needs of people, both psychological and physical, must be considered.

Most guidance on contingency planning, including OCC's

Comptroller's Handbook for Information Technology, is based on 1996
guidance from the FFIEC. The regulators are now considering what
changes need to be made to this guidance based on lessons learned from
the attacks. OCC has prepared a document for Treasury that summarizes
where things stand at this point, (attached) identifying current gaps in
preparedness. The banking industry is working primarily through BITS to
improve the industry's preparedness. The OCC is hoping to leverage off of
this work in updating their guidance.

Page 3 Record of Interview

Prepared by: Tom Conahan Inde.
Date: 12/13/01 DOC Library:
Job Code: 250045 DOC Number:

The OCC officials noted that certain issues in this regard have been
brought into sharp focus. For example, as has been publicized, some
institutions, with one particularly noteworthy example, thought they haa
separate data lines from their facilities only to learn that they were routed
through the same switching station. Another issue that emerged in this
case is the need to locate facilities and their back-ups further apart from
one another.

The officials noted that some banks are rethinking their consolidation
plans. For example, Fleet was in the process of consolidating three data
centers located along the East Coast into a single center. The have now
reconsidered their plan. The officials note that many national banks have
diverse locations. For example, Bank of America has a number of diverse
locations and withstood 9/11 quite well. A recent trend among large
national banks toward consolidation of facilities is likely to reverse itself
in the future as the benefits of dispersion become clear.

Banks are going to have to consider a number of issues as they engage in

their contingency planning. Currently only a few firms provide these
services; the market may grow. As mentioned earlier, one issue that
banks must consider is the impact of events like 9/11 on people. In the
past, the focus has been on machines and where they are located and how
they interact. However, the psychological and physical impact on the key
people required to run those machines must also be considered. Banks
have to think about how many people should possess certain skills, in
case some are lost. The officials noted that the fundamentals of
contingency planning really have not changed, but the contingencies for
which banks have to prepare have.

The OCC officials also commented on the concentration of certain market

functions in small numbers of firms, such as was the case with BONY and
Cantor Fitzgerald. They noted that they cannot, as regulators, dictate
some changes to the market, like what lines of business banks may or
should pursue. The market will determine such things.

The officials said that preparations for possible disruptions associated

with Y2K helped in preparing for this crisis. They mentioned that
programs to enhance telecommunications access for key individuals, such
as the GETS and TSP programs helped where they were accessible but, in
some cases, OCC staff began to turn in their access cards containing the
codes they would need to access the systems. This was unfortunate. OCC
is looking at the idea of having its staff hold on to these cards.

The Importance of Bank The OCC officials said that another issue that has gained some attention
in light of the attacks is that of the importance of bank capital. September
Capital 11 showed that even the best capitalized bank can suffer serious damage
to its operations if its data systems, or telecommunications lines are
disrupted or destroyed. Banks' back office operations are the keys. A
group of banks including Mellon Bank and State Street Bank have been
vocal on the issue of the importance of capital versus back office

Page 4 Record of Interview

Prepared by: Tom Conahan Index:
Date: 12/13/01 DOC Library:
Job Code: 250045 DOC Number:

operations and internal controls, stating that the latter are the matters of
most importance. The OCC officials suggested we review a piece written
by Karen Shaw Petrou discussing the events of September 11, that notes
that capital was not the key, but liquidity and capital (attached).

There is currently discussion in the industry about revising the Basle

Accord, in terms of operational risk. Some industry analysts believe that
9/11 confirmed that capital is not the issue for operational risk; rather, it is
back-office processing and internal controls. There is an industry group
consisting of Mellon, States Street, and others who are looking at asset
management issues and the Pillar II assessment process that supplements
specific capital allocations. The effects of the attacks on financial
institutions and markets have fueled this debate domestically and abroad,
as many believe that the problems were more related to liquidity and
confidence. The key question being discussed is how much capital should
banks hold against a certain contingency.

Page 5 Record of Interview