Learning the rules

Information on three far-reaching compliance and reporting guidelines.

by Robert Allan McLellan

Basel II
Basel II—also known as the Basel Capital Accord—is an international initiative by a committee of bankers under the auspices of the International Bank of Settlements (BIS) in Basel, Switzerland. Participating countries include Belgium, Canada, France, Germany, Italy, Japan, Luxembourg, the Netherlands, Spain, Sweden, Switzerland, United Kingdom and the United States.

The Accord refines the guidelines that govern how much capital banks in the member countries must hold in reserve.It also ensures uniformity in the way banks and banking regulators approach risk management across national borders. Essentially, Basel II implementation involves identifying credit, market and operational risks and allocating adequate capital to cover potential loss. Participants in the Accord must be fully compliant by December 2006.

The Accord defines a framework of three pillars to increase financial stability:

• Minimum regulatory capital requirements for credit, operational, and market risks.
• Supervisory oversight of the minimum requirements and other capital issues.
• Disclosure requirements providing market discipline on adequate capital.

One significant benefit to the banking industry is that Accord rules are sensitive to the varying degrees of risk presented by different types of lending to different types of borrowers. Banks will be able to make meaningful capital allowances for loans secured by collateral versus loans that are not secured, resulting in a broader array of funding sources.

However, with banks set to gain more control over how they assess their risks and reserve for those risks, Basel II compliance will also require financial institutions to change their public disclosure policies and submit to the regulatory review of their capital adequacy. It will be more important than ever for banks to retain and report key information about their risk profiles and capitalization levels.

While the Accord is expected to continue to evolve, it will most likely comprise smaller, iterative modifications rather than the wholesale changes witnessed so far. During the next few years, Basel II compliance will be the single greatest challenge—and opportunity—for banks.

The Accord will require significant changes to bank policies, procedures and methods. As a result, banks will need to access, integrate and analyze data to provide timely risk intelligence across credit, operational and market risks. This translates into a need for the right data model to collect and store a minimum of three to five years worth of historical data. Banks will also need to ensure data integrity and timeliness and be able to not only assess the rating grades but also combine them with models for assessing exposure loss for various maturity spectrums.

In spite of the challenges, Basel II will provide banks with opportunities to realize many managerial and financial benefits, including having more capital available for investments, reducing financial risks, cutting costs associated with risk management, streamlining processes and improving organizational credibility in the marketplace.

More information can be found at http://www.bis.org/publ/bcbsca.htm.

The Gramm-Leach-Bliley Act
The Gramm-Leach-Bliley Act (GLBA)—also called Financial Services Modernization Act—went into effect on November 12, 1999. The GLBA is intended primarily to ease or repeal certain business prohibitions for financial institutions such as banks, stock brokerage firms, insurance companies, loan companies, credit card issuers and credit bureaus, but it also imposes new privacy protections for customers of financial institutions.

The GLBA—to be implemented fully by 2007—repeals the 66-year-old Glass-Steagall Act, which prohibited banks, securities firms and insurance companies from affiliating. The new act provides a more sensible, straightforward path toward financial integration. As a result, it opens up competition and modernizes the nation's financial industries by breaking down barriers between banking and other related areas.

The GLBA also offers protection for consumers. Financial institutions must develop, implement and maintain a comprehensive, documented information-security program that contains administrative, technical and physical safeguards appropriate to the size and complexity of the institution, the nature and scope of its activities, and the sensitivity of its customer information. The act also requires institutions to inform their customers of plans to share nonpublic information with a third party so that the customer has the opportunity to voice opposition or opt out.

Perhaps the bigger story of financial modernization and GLBA compliance is how the Internet and other, newer technologies are transforming the way financial services and vital information are produced and delivered. Technological developments require bank regulators to understand the risks presented by changing processes, as well as knowing how to implement the risk management systems that will enable them to identify, monitor and control those risks.

For more about the GLBA and its technological and business impacts, go to http://banking.senate.gov/conf/grmleach.htm.

by Katherine Porter

The Health Insurance Portability and Accountability Act
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a multi-faceted act with two main components: Title I Health Insurance Reform and Title II Administrative Simplification. The goals and objectives of the HIPAA legislation are to reduce healthcare fraud and abuse, enforce standards for health information, guarantee security and privacy of health information, and give workers the assurance of health insurance access, portability and renewal even in the event there is a pre-existing medical condition. Healthcare providers, health plans and healthcare clearinghouses (referred to as "covered entities") are all subject to HIPAA regulations.

In terms of security and privacy, HIPAA protects against misuse of information that identifies an individual and/or information that can be transmitted electronically. Covered entities are permitted to use any information about an individual as long as it is necessary for proper medical treatment, payment or healthcare operations. Any other use must be disclosed to and agreed to by the individual. HIPAA also requires covered entities to use a standard data format that allows information to be passed among providers without having to change format.

HIPAA compliance requires covered entities to develop a standardized IT methodology; to develop a method for tracking all disclosures for purposes other than medical treatment, payment and healthcare operations; and to provide proof of compliance as required by the regulation. In some cases, meeting these requirements calls for a complete overhaul of a provider's IT infrastructure. For more complete information about HIPAA requirements, go to http://www.hhs.gov/ocr/hipaa/. T