United States: Basel II Final Credit Risk Mitigation, Securitization, Equity Exposure, Operational Risk And Disclosure Rules
(Financial Services Alert – Developments of Note)

1. Basel II Final Credit Risk Mitigation, Securitization, Equity Exposure, Operational Risk and Disclosure Rules
2. Materials from CCOutreach National Seminar Posted on SEC Website

3. SEC Publishes Release Proposing Mutual Fund Disclosure Changes
4. SEC and FINRA Announce Date of CCOutreach BD National Seminar

Basel II Final Credit Risk Mitigation, Securitization, Equity Exposure, Operational Risk and Disclosure Rules

The final rulemaking (the "Rule") regarding Basel II by the federal banking agencies (the "Agencies"), discussed (as to the scope and credit-based asset aspects) in the November 6, 2007 Alert, also provides a framework for addressing capital and risk management issues in the context of credit risk mitigation ("CRM"), securitization transactions, equity exposures, operational risk and disclosure. These issues, and the changes from the Notice of Proposed Rulemaking ("NPR") issued in 2006 as well as the international Basel Accord (the "International Accord"), are discussed in this Article.

I. CRM. The Rule focuses on CRM techniques that banks can use to offset the capital affects of various credit exposures.

Collateral – Wholesale/Retail Exposures. In the case of wholesale exposures, the collateral generally affects the loss given default ("LGD") estimation process; for retail exposures the probability of default ("PD") and LGD estimation process is principally impacted. The Rule does not contain specific regulatory requirements about the nature of the collateral or how a bank incorporates it into PD or LGD estimates. However, the bank must ensure that all documentation used in collateralizing a transaction is legal, valid, binding and enforceable under applicable law, and should conduct sufficient legal review to have a well-founded conclusion that the documentation meets this standard. Among other things, when reflecting the credit risk mitigation effects of collateral, a bank should (1) consider the correlation between the obligor risk and the collateral; (2) consider any currency and/or maturity mismatch; and (3) use historical recovery rates where available.

Collateral – Securities Finance. The Rule also discusses how, with respect to repo-style transactions, eligible margin loans and collateralized OTC derivative contracts (all as defined below), a bank may be able to adjust exposure at default ("EAD") rather than LGD using either a collateral haircut approach (i.e., net exposure, plus add-ons depending on the type of collateral and any currency mismatch) or an internal models methodology (i.e., a model that estimates EAD at the level of a netting set including a cross-product netting set, and generally is based upon the Basel Trading Activities paper described in the July 26, 2005 Alert). The simple Value-at-Risk ("VaR") methodology is also available when assessing repo-style transactions and eligible margin loan transactions (collectively with the collateral haircut and the internal models methodologies, the "Methodologies"). OTC derivative transactions also may involve the current exposure (similar to the current rules) approach.

Much of the comment on this aspect of the Rule focused on definitions. The Rule defines a "repo-style" transaction as a repo or reverse repo, or a securities borrowing or lending transaction (including as agent with an indemnity), subject to several conditions. Notably, in response to industry comment, the Rule modifies the close-out condition for repo-style transactions to make it consistent with the 2006 securities borrowing rule (i.e., permissible if overnight or unconditionally cancellable). The definition of "eligible margin loan" is substantially the same as in the NPR, with the Agencies declining to loosen the requirement that the bank be able to terminate the loan quickly in the event of default or bankruptcy. An "OTC derivative contract" is a derivative contract not traded on an exchange that requires the daily payment and receipt of cash-variation margin. As to "financial collateral" (e.g., cash, long-term debt at least BB-, short-term debt at least A-3, publicly-traded equities, and daily quoted mutual fund shares), the Agencies declined to add any additional categories of assets to the definition, other than conforming residential mortgages, and maintained the requirement of a first security interest in the US (but permitted the legal equivalent outside the US).

The securities finance Methodologies are substantially the same as in the NPR. However, in response to industry comment, the Rule permits any type of collateral (not just financial collateral, as is otherwise the case) to be used to mitigate the counterparty risk of repo-style transactions included in the bank’s VaR-based measure under the market risk rule. The Rule also specifies that while a bank may choose any of the three Methodologies, it must use the same one for all similar exposures (but may use different Methodologies for different risk profiles). The Rule also permits the use of qualifying bi-lateral master netting agreements to cover product groups of such transactions. With respect to the requirement that a master netting agreement be enforceable (and the rights not stayed or avoided) in relevant jurisdictions, the Rule clarifies that the following are considered "relevant jurisdictions": the jurisdiction where each counterparty is chartered or formed (and if a branch is involved, then the jurisdiction of the branch); the jurisdiction that governs the transactions covered by the agreement; and the jurisdiction that covers the master netting agreement itself. Moreover, in response to industry comment, the rule does not require a reasoned legal opinion for each master netting agreement governing OTC derivatives.

Guarantees: Wholesale/Retail Exposures. The Rule also addresses guarantees. When covering wholesale exposures, guarantees may adjust either the PD or LGD of the wholesale exposure. The requirements for the guarantee are largely the same as in the NPR, except that (1) the Agencies added a provision generally precluding an affiliate from providing an eligible guarantee (other than sister banks, and certain brokers and insurance affiliates), and (2) the Agencies also added a requirement that the guarantee cannot increase in price to the bank if the reference entity’s credit quality deteriorates. The Rule does not impose the same limits and requirements on retail exposures, but emphasizes that banks must have strong supporting data for their decisions.

The Rule also discusses the extent to which credit derivatives can hedge wholesale exposures, and the effect of maturity or currency mismatches. The Rule permits double default treatment (i.e., the PDs of both the obligor of the hedged exposure and the protection provider are factored into the exposure’s capital requirement) for certain hedged exposures, with the eligible providers of such protection effectively limited to financial firms (with the Rule adding foreign financial firms) whose normal business includes credit protection.

A bank that satisfies certain operational requirements and observes restrictions on the provision of implicit recourse to securitizations originated by it must use the securitization framework set forth in the Rule for on-balance sheet or off-balance sheet credit exposure that arises from the tranching of credit risk of financial assets representing wholesale, retail or equity exposures. Provided that there is a tranching of credit risk, securitization exposures could include financial asset exposures such as asset-backed and mortgage-backed securities, loans, lines of credit, liquidity facilities, and financial standby letters of credit, credit derivatives and guarantees, loan servicing assets, servicer cash advance facilities, reserve accounts, credit enhancing representations and warranties and credit enhancing interest only strips. Both traditional securitizations and synthetic securitizations are covered by the Rule.

Risk-Weighting Approaches. The proposed securitization framework contains three general approaches for determining the risk based capital requirement for a securitization exposure: a Ratings-Based Approach (the "RBA"), an Internal Assessment Approach (the "IAA") and a Supervisory Formula Approach (the "SFA"). In contrast to the framework for wholesale and retail exposures, the securitization framework does not permit a bank to rely on its internal assessments of risk parameters of a securitization exposure. Rather, this framework relies principally on two types of information to determine risk-based capital charges: (1) a NRSRO-like evaluation of the risk; and (2) the capital requirements for the underlying exposures if they had not been securitized.

RBA. Under the RBA, the risk-based capital requirement per dollar of securitization exposure would depend on the applicable external rating or inferred rating of the exposure and whether that rating reflects a long-term or short-term assessment of the exposure’s credit risk, the seniority of the exposure and the granularity of the underlying exposures. The risk weight for a low investment grade securitization exposure (e.g., BBB-) is 100%. For more highly rated securitization positions the risk weights range from 7% to 75% based on the rating (graduation within a rating category) and seniority of the securitization exposure and the granularity of the pool. For high non-investment grade securitization exposures (e.g., BB+ to BB-) risk weights range from 250% to 650%. A bank must deduct from regulatory capital certain below investment grade exposures.

IAA. The IAA is the only approach under the securitization framework under which a bank may use its own internal assessment of credit quality. It is only applicable to securitization exposures to an asset-backed commercial paper ("ABCP") program, such as a liquidity facility or credit enhancement. In order to use the IAA, a bank must receive prior written approval (rather than no-objection, as requested by commenters) from its primary federal banking supervisor. In order to receive such approval the bank must demonstrate that its internal assessment process and the ABCP program meet certain qualification requirements, and the securitization exposure must initially be internally rated at least equivalent to investment grade, and must be based on publicly available rating criteria used by an NRSRO.

SFA. Under the SFA, the risk-based capital requirement per dollar of securitization exposure is derived by applying seven factors to a single complicated formula that reflects a blend of credit risk modeling results and supervisory judgments. The seven factors cover the size and seniority of the tranche, the securitization exposure’s proportion of the tranche in which it resides, the granularity and loss given default of the underlying exposures and the risk-based capital requirements and expected credit losses for the underlying exposures if the bank held them directly on its balance sheet. A bank only may use the SFA to determine its risk-based capital requirement for a securitization exposure if the bank can calculate each of the seven inputs on an ongoing basis. The SFA formula effectively imposes a 7% risk-weight floor on any securitization exposure for which the SFA approach is used, thus reducing incentives for regulatory capital arbitrage between the RBA (which also has an effective 7% minimum) and the SFA.

Hierarchy of Risk-Weighting Approaches. Generally speaking, a specific securitization exposure must be risk weighted (or deducted from capital) in accordance with one of these approaches in accordance with the following hierarchy:

First, despite industry objection to the NPR, a bank must deduct from tier 1 capital any after-tax gain-on-sale resulting from a securitization and must deduct from total capital (equally from tier 1 and tier 2) any portion of a credit enhancing interest only strip that does not constitute a gain on-sale.

Second, a bank must apply the RBA to any other securitization exposure that has the requisite number of external or inferred ratings to qualify for the RBA. For an originating bank the requisite number remains two; for an investing bank the requisite number is one.

If a securitization exposure does not qualify for the RBA but is an exposure to an ABCP program—such as a credit enhancement or liquidity facility—the bank may apply the IAA (if the bank, the exposure, and the ABCP program qualify for the IAA) or the SFA (if the bank and the exposure qualify for the SFA) to the exposure.

If a securitization exposure is not a gain-on-sale or a credit-enhancing interest-only strip, does not qualify for the RBA and is not an exposure to an ABCP program for which the bank is applying the IAA, the bank may apply the SFA to the exposure if the bank is able to calculate the SFA risk factors for the securitization exposures.

Lastly, if a securitization exposure does not qualify for treatment as described above, the bank must deduct the exposure from total capital.

Notwithstanding the foregoing, the total risk-based capital requirement for all securitization exposures held by a single bank associated with a single securitization may not exceed the sum of (i) the bank’s total risk-based capital requirement for the underlying exposures as if the bank directly held the underlying exposures and (ii) despite industry objections, the bank’s total expected credit loss for the underlying exposures. The Rule contains several other exceptions to the general hierarchy described above to address certain particular issues, including the regulatory capital treatment of overlapping exposures to ABCP programs (a bank is not required to hold duplicative capital), the permissible use of the IAA approach (if available) for non-financial assets, excluding from risk-weighted assets ABCP programs that are consolidated on the bank’s balance sheet under GAAP, and excluding undrawn portions of "eligible" servicer advance facilities related to a securitization and early amortization features in revolving securitization structures. Generally speaking, the regulatory capital treatment of these issues under the Rule is consistent with the treatment of them under existing regulations and supervisory guidance.

Synthetic Securitizations. In general, the Rule’s treatment of synthetic securitizations is identical to that of traditional securitizations and that described in the NPR. Owing to the complexities of synthetic securitizations, the Rule contains extensive guidance for buyers and sellers of credit protection with respect to the application of the hierarchy of securitization approaches to tranched risk transfers using credit derivative instruments in a variety of circumstances, including first-loss tranches, mezzanine tranches, super-senior tranches and nth-to-default swaps and synthetic securitizations in which credit protection is provided by a special purpose entity that collateralizes its obligations. In order for a bank to receive credit for risk transfer through the use of credit risk mitigants, it must satisfy several conditions as to, among other things, the nature of the mitigant, the absence of risk with respect to the transfer, and enforceability.

Excess Spread. The Rule also addresses excess spread, as in the NPR, by assessing a risk-based capital requirement that, in general, is linked to the likelihood of an early amortization event to address the risks that early amortization of a securitization poses to originating banks. The Rule expands the situations where the originating bank does not have to hold capital to include (in addition to when early amortization is caused by events not relating to the underlying exposures, as in the NPR) when investors in the securitizations remain fully exposed to future draws by borrowers even after an early amortization event. The Rule does not permit other exemptions provided for in the International Accord.

With respect to equity exposures under the credit risk rules (as opposed to the market risk rules described in the September 26, 2006 Alert) a banking institution has the option to use either a simple risk-weight approach ("SRWA") or an internal models approach ("IMA") to calculate exposures not

part of an investment fund. Despite industry comment, the Rule does not provide for the 10 year grandfathering for existing exposures provided by the International Accord. Moreover, despite industry comment, the Agencies did not provide greater flexibility to "mix and match" the use of the SRWA and the IMA on different exposures.

Calculating the Carrying Value. For purposes of making any of the equity exposure calculations (either for the SRWA or the IMA, or even for the special rules regarding investment funds), a bank must calculate its "adjusted carrying value" for each exposure. For on-balance sheet exposures, adjusted carrying value generally is the bank’s carrying value for the exposure reduced by unrealized gains excluded from a bank’s capital. For off-balance sheet exposures, the adjusted carrying value generally is the effective notional principal amount of the exposure determined by reference to an equivalent on balance sheet exposure. The Rule clarifies the treatment of unfunded equity commitments. If the unfunded commitment is unconditional, then the bank must use the notional amount of the commitment. If it is conditional, then the bank may use its best estimate of the amount funded during economic downturn conditions.

Effect of Hedging. Like the NPR, the Rule provides a mechanism for banks to identify hedged pairs (i.e., two equity exposures that form an "effective hedge" and are either publicly-traded or have a return based primarily on a publicly-traded exposure), and provides a special calculation of the risk capital resulting from them. To have an effective hedge, among other things, the exposures generally must have equivalent remaining maturities, documentation specifying the effectiveness of the hedge, and in fact be effective.

SRWA. Under the SRWA, a bank generally (subject to an exception for sovereigns and similar high quality exposures and investment funds) assigns a 100% risk weight to the effective portion of a hedge pair, a 300% risk weight to publicly-traded exposures (generally a security traded on a US or foreign national exchange), and a 400% risk weight to non-publicly traded exposures. The SRWA provides a concept of "non-significant equity exposures", which have a 100% risk weight and the Rule defines as having an aggregate adjusted carrying value (excluding, e.g., exposures with less than a 300% risk weight, certain hedged pairs, and certain exposures to investment funds which themselves have non-equity exposures) that does not exceed 10% of the bank’s tier 1 capital plus tier 2 capital.

IMA. Banks must first obtain regulatory approval to use the IMA. While the Rule does not require banks to have a VaR approach to use the IMA, or even a single model to cover all exposures, the bank’s model(s) must have the accuracy of a VaR methodology and be able to assess the potential decline in equity exposures, be appropriate for the complexity of the bank’s holdings, and adequately capture both general market risk and idiosyncratic risks. A bank may apply the IMA only to its publicly traded equity exposures or to its publicly traded and non-publicly traded exposures, but in either event must exclude certain highly rated equity exposures (e.g., those that would receive a 0-20% risk weight under the SRWA). The IMA does not provide for a 10% non-significant equity exposure threshold. Unlike in the NPR, banks are not required to have daily market prices for all modeled equity exposures. The Rule also imposes a supervisory floor on the risk weights resulting from the IMA, generally 200% in the case of publicly-traded equity exposures, and 300% in the case of non-publicly traded exposures.

Investment Funds. The Rule also devotes a subsection to the treatment of equity exposures with respect to investment funds (i.e., funds with (despite industry objection) no material liabilities, and that consist principally of financial assets) in which a banking institution holds an interest. Basically, the Rule allows three different approaches to these exposures (banks can choose different approaches for different funds): the Full Look-Through Approach, the Simplified Modified Look-Through Approach, and the Alternative Modified Look-Through Approach. Under the Full Look-Through Approach, a bank either (1) must be able to compute a risk-weighted asset amount for each exposure held by the investment fund as if it were held by the bank directly, or (2) pursuant to industry comment, may use the bank’s IMA to calculate the capital charge. The Simplified Modified Look-Through Approach permits a bank to set a risk-weighted asset amount for a fund equal to the adjusted carrying value of the exposure multiplied by the highest risk weight in a Rule-provided table for any exposure that the fund is permitted to hold under its governing documents. The Rule provides a new lower (7%) risk weight to most money market funds. Finally, under the Alternative Modified Look-Through Approach, a bank may assign the adjusted carrying value of an investment fund on a pro-rata basis to different risk-weight categories according to the investment limits for different asset classes in the fund’s governing documents (with conservative adjustments if the fund governing documents would permit aggregate limits on all investment categories in the fund to exceed 100%). In response to industry comment, regardless of the approach chosen the Rule no longer sets a general floor equal to 7% of the adjusted carrying value of the bank’s equity exposure to investment funds, on either an individual or aggregate basis.

The Rule also provides the qualification and quantification requirements for the operational risk component of Basel II. To qualify, the bank must have appropriate (1) operational risk management processes ("Management Processes"), (2) data and assessment systems, and (3) quantification systems.

Management Processes. Management Processes must be independent of business line management. Moreover, Management Processes must establish and document a process to identify, measure, monitor and control operational risk and operational loss events in bank products, activities, processes and systems. For these purposes an "operational loss event" is defined as an event that results in a loss resulting from any of the following: (1) internal fraud, (2) external fraud, (3) employment practices and workplace safety, (4) clients, products and business practices, (5) damage to physical assets, (6) business disruption and system failures, and (7) execution, delivery and process management. While the Rule does not require the Management Processes to develop systems to capture internal loss event data according to these seven categories, unlike in the NPR the Rule does require the bank to map data into those categories.

Data and Assessment Systems. These systems must incorporate the following four elements on an ongoing basis: (1) internal operational loss event data, (2) external operational loss data, (3) results of scenario analysis, and (4) assessments of the bank’s business environment and internal control. "Operational losses," which provide the basis of the operational risk capital charge, include all expenses associated with an event, except opportunity costs and costs related to risk avoidance enhancements. A bank’s systems must capture specified internal loss data (e.g., loss amounts, dates and recoveries) beyond certain minimum thresholds, based generally on a 5 year historical period (despite industry objection). The bank similarly must capture external loss data (i.e., losses at organizations other than the bank. Whereas those two factors are based on historical data, business environment and internal controls is more forward looking, and relies on a bank’s assessment of the strength of its controls and business environment, with validation through back testing. Scenario analyses also are forward looking based on expert opinions and other well reasoned evaluations, and are particularly useful where there is insufficient other data for a particular risk.

Quantification. The bank must be able to use this data to calculate operational risk exposure, defined as the 99.9% distribution of operational losses over a 1 year horizon (not incorporating the effects of offsets or mitigants). The Rule does not require any particular weighting of the four data inputs set forth above. The bank must perform this calculation using a unit of measure that does not combine different risk profiles. The estimates for calculating the capital charge is the sum of these units, unless the bank is able to demonstrate "dependence" between risk exposures.

Creating the Credit Charge. Under the Rule, the capital charge for a bank qualifying under the advanced measurement approaches ("AMA") would incur a capital charge equal to the sum of (1) expected operation losses ("EOL"), perhaps with certain offsets, and (2) unexpected operational losses ("UOL"). To qualify as an eligible offset to EOL, the amounts held by the bank must (1) be generated by the bank’s internal business practices to absorb highly predicable, stable losses, and (2) be available to cover EOL over a 1 year horizon (e.g., securities processing and credit card fraud). The bank also

may take into account risk mitigants, such as insurance, in an amount equal to up to 20% of the risk based capital requirement for operational risk (after EOL offsets). Despite industry objection, the Rule requires banks to demonstrate that any potential mitigant other than insurance covers operational risk losses in a manner equivalent to holding regulatory capital.

As to Pillar 3 of US Basel II, disclosure, the Rule varies little from the NPR. The Rule maintains the extensive disclosure tables: Scope of Application (to whom it applies); Capital Structure (Tier 1 and 2 components); Capital Adequacy (assets from different sources); Credit Risk; General Disclosures; Credit Risk: Disclosures for Portfolios Subject to IRB Risk-Based Capital Formulas; General Disclosure for Counterparty Credit Risk of Securities Finance Transactions; Credit Risk Mitigation; Securitization; Operational Risk; Equities Not Subject to Market Risk Rule; and Interest Rate Risk for Non-Trading Activities. A bank must begin these disclosures with its first transitional floor period, and its board of directors must adopt a policy detailing its approach to disclosure.

Generally, the Rule did make certain changes causing the US disclosure requirements to be more consistent with the International Accord. For example, while the NPR required disclosures at the top tier US level (even for foreign entities), the Rule only requires them at the global top tier level. However, as to timing issues, although the International Accord only requires disclosures on a semi-annual basis, the Rule requires them quarterly (within 45 days of calendar quarter-end). The Rule also requires a senior officer to attest to the fact that the disclosures meet the Rule’s requirements.

The SEC website for the CCOutreach for fund and adviser chief compliance officers ("CCOs") now includes two handouts from the recently held CCOutreach National Seminar – one addressing key areas of risk associated with derivative investments and the other providing forensic measures for funds and advisers. The former is in the form of a recent speech by Gene Gohlke in which he discusses mutual fund directors’ oversight of derivative use and the issues on which he would focus if he were a fund director. The speech includes a detailed discussion of the following 12 areas of risk:

• Adviser Intellectual and Financial Resources
• Due Diligence Processes - Investment Management and Operations
• Investment Risk Management
• Risk Disclosure to Investors
• Insider Trading Policy and Code of Ethics Coverage
• Liquidity/Illiquidity
• Leverage - Disclosure and Statutory Limitations
• Valuation
• Back Office Capabilities
• Compliance Procedures
• CCO Role
• Ongoing Updates to Fund Board

The handout on forensic testing measures provides examples of forensic tests designed to assess compliance in the following areas:

• Portfolio management and trade allocation
• Brokerage arrangements and execution
• Valuation
• Personal trading
• Safety of client assets
• Marketing and performance advertisements

The SEC issued the formal release describing its proposal to (a) revise prospectus disclosure requirements for registered open-end management investment companies ("mutual funds") and (b) create a new summary disclosure document for use in mutual fund sales. This proposing release will be the subject of a Client Alert that will be circulated to Alert readers.

The SEC and FINRA (formerly the NASD) announced that the National Seminar inaugurating the new CCOutreach BD program for broker-dealer Chief Compliance Officers ("CCOs") will be held March 7, 2008 at SEC headquarters in Washington, D.C. (For more on the CCOutreach BD program, which is modeled after the ongoing CCOutreach Program for the CCOs of registered investment advisers and registered investment companies, see the November 6, 2007 Alert .)

Goodwin Procter LLP is one of the nation’s leading law firms, with a team of 700 attorneys and offices in Boston, Los Angeles, New York, San Diego, San Francisco and Washington, D.C. The firm combines in-depth legal knowledge with practical business experience to deliver innovative solutions to complex legal problems. We provide litigation, corporate law and real estate services to clients ranging from start-up companies to Fortune 500 multinationals, with a focus on matters involving private equity, technology companies, real estate capital markets, financial services, intellectual property and products liability.

This article, which may be considered advertising under the ethical rules of certain jurisdictions, is provided with the understanding that it does not constitute the rendering of legal advice or other professional advice by Goodwin Procter LLP or its attorneys. © 2007 Goodwin Procter LLP. All rights reserved.