Under the rules of Dodd Frank, bank regulatory agencies must each review any references to (or requirements in) the use of credit ratings in regulations. The agencies must then change those references to ones that reflect standards of creditworthiness deemed to be appropriate. In short, Congress didn't like the way financial investors had come to depend on credit ratings and the cozy nature of the business that showed up during the credit crisis. As such, Dodd Frank sought to remove the industry's dependence on credit ratings when investing, calculating capital ratios or anywhere else that rating might have been used prior to the crisis. Well, the OCC has fired the first shot here and other agencies are likely to follow (or even look to adopt this one). In short, the latest guidance on this subject proposes amending the definition of "investment grade" (in 12 CFR Part 1) to no longer reference credit ratings and instead become those where the issuer has an adequate capacity to meet financial commitments under the security for the projected life of the investment. Adequate capacity is further defined to mean an issuer that can meet their financial commitments, the risk of default by the obligor is low and the full and timely repayment of principal and interest is expected. Those investments that meet this new standard will be deemed to have good to very strong credit quality. As part of any examination, banks have to be able to show their investment securities meet credit quality standards, but instead of just being able to point to a credit rating, how are banks going to do that now? The OCC provides additional guidance here, starting at the top with the position that banks must have a risk management process that ensures credit risk (including credit risk in the investment portfolio), is effectively identified, measured, monitored, and controlled. That is regulatory speak for "you had better be able to demonstrate that what you are doing makes sense, or you can expect to get more definitive direction from us." The good news is that banks are lenders, but the bad news is that CFOs are not, so bridging this gap is going to be interesting when it comes to investments. Perhaps that is why the OCC went further and focused on due diligence as part of the process. Here, the regulator said banks need to have a process in place to determine whether an investment security is permissible (or safe for that matter). Specifically, the process could include internal analyses, third party research, analytics (that can include external credit ratings), internal risk ratings, default statistics and other sources of information as appropriate for the security. The key from the regulator's viewpoint is that the due diligence process should go as deep as is required to fully understand and evaluate each individual security's credit quality, structure complexity and size. Structure matters here, as regulators expect banks to perform a deeper analysis if the structure is complex - even if the credit quality is perceived to be high. Regulators expect banks to understand the structure of each investment and how that investment security will perform in different default environments and before the security is purchased. Looking even more specifically at municipal bonds for instance, the OCC indicates common things banks are expected to do include evaluating the soundness of a municipality's budgetary position and stability of its tax revenues; understand local demographics and economics; and confirm capacity to pay through internal credit analysis and/or other third party analytics as may be required. As you see here, we have moved from simply saying "it's AAA" to more robust and thorough risk management processes that now include credit, but also encompass liquidity, price, interest rate and other risks.
This probably isn't the final version of this, given all the intricacies and dependence on ratings the industry will have to adjust to, but it does give you a good gauge on where things are going. To avoid regulatory pitfalls and protect the bank, grab a copy of the guidance (even if you aren't an OCC bank) and start thinking about how you are going to do this going forward.