Examiners will assign a composite and component ratings based on a 1 to 5 numeric scale. A ``1'' rating is the highest rating, indicating the strongest performance and practices and least degree of supervisory concern. A ``5'' rating is the lowest rating, indicating the weakest performance and the highest degree of supervisory concern. In most cases, a composite rating of ``4'' or ``5'' will result in formal enforcement action. In addition, a rating of ``4'' or ``5'' will be treated as ``Unsatisfactory'' as that term is used in OTS regulations and guidance (for example, see 12 CFR 502.29 for purposes of determining the condition component in a holding company's assessment calculation or 12 CFR 563.555 in defining a savings and loan holding company that is in troubled condition).

Examiners will use the following descriptions to assign composite and component ratings to SLHCs.
Description of the Rating System Elements

Composite Rating

The composite rating is the overall assessment of the holding company enterprise as reflected by its organizational structure, risk management, capital and earnings. The composite rating encompasses both a forwardlooking and current assessment of the consolidated enterprise, as well as an assessment of the relationship between the companies in the enterprise. The composite rating is not a simple numeric average of the CORE components; rather, the composite rating reflects OTS's judgment of the relative importance of each component to the operation of the holding company enterprise. Some components may receive more weight than others depending on the SLHC's activities and risk profile. Assignment of a composite rating may incorporate any factor that significantly affects the overall condition of the holding company enterprise, although generally the composite rating is closely related to the component ratings assigned.

Composite 1. A holding company enterprise in this group is sound in almost every respect and generally has components rated 1 or 2. Any weaknesses are minor, and the board of directors and management can correct them in the normal course of business. The enterprise is able to withstand economic, financial, and risk exposure changes because of an effective organizational structure, solid risk management practices, more than sufficient capital and strong earnings. Cash flow is more than sufficient and adequately services debt and other obligations. This holding company enterprise exhibits strong performance and risk management practices relative to its size, complexity, and risk profile.

Composite 2. A holding company enterprise in this group is fundamentally sound but may have modest weaknesses. The board of directors and management are capable and willing to correct any weaknesses.
[[Page 72446]]
Generally, no component rating should be more severe than 3 for this holding company enterprise. The organizational structure, risk management practices, capital and earnings create stability, and this holding company enterprise is capable of withstanding business fluctuations. Cash flow is adequate to service obligations. Overall, risk management practices are satisfactory relative to the enterprise's size, complexity, and risk profile.

Composite 3. A holding company enterprise in this group raises some degree of supervisory concern in one or more of the component areas, with weaknesses that range from moderate to severe. The magnitude of the deficiencies is generally not severe enough to rate a component more severely than 4. Management may lack the ability or willingness to effectively address weaknesses within appropriate time frames. The holding company enterprise's capital structure and earnings leave it less resistant to adverse business conditions. The effectiveness of the organizational structure and risk management practices may be less than satisfactory relative to the enterprise's size, complexity, and risk profile. However, there is only a remote threat to the holding company enterprise's continued viability.

Composite 4. A holding company enterprise in this group has serious financial or managerial deficiencies that result in unsatisfactory performance. The supervisory concerns, which management and the board are not satisfactorily addressing, range from severe to critically deficient. A holding company enterprise in this group generally does not have sufficient capital and earnings to withstand adverse business fluctuations. The effectiveness of the organizational structure and risk management practices are generally unacceptable relative to the enterprise's size, complexity, and risk profile. The enterprise may place undue pressure on subsidiaries to meet its cash flow by upstreaming imprudent dividends or fees. Unless there is prompt action to correct these conditions, future viability could be impaired.

Composite 5. The magnitude and character of the risk management or financial weaknesses of a holding company enterprise in this category could lead to insolvency without immediate aid from shareholders or supervisory action. The volume and severity of problems are beyond the board and management's ability or willingness to control or correct. The effectiveness of the organizational structure and risk management practices are inadequate relative to the enterprise's size, complexity, and risk profile. The inability to prevent liquidity or capital depletion places the holding company enterprise's continued viability in serious doubt.

Capital Adequacy (C) Component Rating

C reflects the adequacy of an enterprise's consolidated capital position, from a regulatory perspective and an economic capital perspective, as appropriate to the holding company enterprise. During OTS's review of capital adequacy, OTS will consider the risk inherent in an enterprise's activities and the ability of capital to absorb unanticipated losses, support business activities including the level and composition of the parent company and subsidiaries' debt, and support business plans and strategies.

Capital Rating 1. A rating of 1 indicates that the consolidated holding company enterprise maintains a more than sufficient amount of capital to support the volume and risk characteristics of its business lines and products; to provide a significant cushion to absorb unanticipated losses; and to fully support the level and composition of borrowing. In addition, the enterprise has more than sufficient capital to support its business plans and strategies, it has the ability to enter capital markets to raise additional capital as necessary, and it has a strong capital allocation and planning process.

Capital Rating 2. A rating of 2 indicates that the consolidated holding company enterprise maintains sufficient capital to support the volume and risk characteristics of its business lines and products; to provide a sufficient cushion to absorb unanticipated losses; and to support the level and composition of borrowing. In addition, the enterprise has sufficient capital to support its business plans and strategies, it has the ability to enter capital markets to raise additional capital when necessary, and it has a satisfactory capital allocation and planning process.

Capital Rating 3. A rating of 3 indicates that the consolidated holding company enterprise may not maintain sufficient capital to support the volume and risk characteristics of certain business lines and products; the unanticipated losses arising from the activities; or the level and composition of borrowing. In addition, the enterprise may not maintain a sufficient capital position to support its business plans and strategies, it may not have the ability to enter into capital markets to raise additional capital as necessary, or it may not have a sufficient capital allocation and planning process. The capital position of the consolidated holding company enterprise could quickly become insufficient if there is deterioration in operations.

Capital Rating 4. A rating of 4 indicates that the capital level of the consolidated holding company enterprise is significantly below the amount needed to ensure support for the volume and risk characteristics of certain business lines and products; the unanticipated losses arising from activities; and the level and composition of borrowing. In addition, the weaknesses in the capital position prevent the enterprise from supporting its business plans and strategies, it may not have the ability to enter into capital markets to raise additional capital as necessary, or it has a weak capital allocation or planning process.

Capital Rating 5. A rating of 5 indicates that the level of capital of the consolidated holding company enterprise is critically deficient. Immediate assistance from shareholders or other external sources of financial support is required.

Organizational Structure (O) Component Rating

The O component is an assessment of the operations and risks in the holding company enterprise. In the O component, OTS evaluates the organizational structure, considering the lines of business, affiliate relationships, concentrations, exposures, and the overall risk inherent in the structure.

OTS's analysis under the O component considers existing as well as potential issues and risks. OTS pays particular attention to the following types of risk in assigning the O rating:
Type of risk Description
Credit/Asset................. Credit risk arises from the potential that a borrower or counterparty will fail to perform on an obligation. Asset risk is the risk related to market changes or performance of a financial asset.
Market....................... Market risk is the risk to a financial institution's condition resulting from adverse movements in market rates or prices, such as interest rates, foreign exchange rates, or equity prices. [[Page 72447]]
Liquidity.................... Liquidity risk is the potential that an institution will be unable to meet its obligations as they come due because of an inability to liquidate assets or obtain adequate funding (funding liquidity risk) or that it cannot easily unwind or offset specific exposures without significantly lowering market prices because of inadequate market depth or market disruptions (market liquidity risk).
Operational.................. Operational risk arises from the potential that inadequate information systems, operational problems, breaches in internal controls, fraud, or unforeseen catastrophes will result in unexpected losses. Transaction risk arises from problems with service or product delivery. This risk is a function of internal controls, information systems, employee integrity, and operating processes.
Legal/Compliance............. Legal risk arises from the potential that unenforceable contracts, lawsuits, or adverse judgments can disrupt or otherwise negatively affect the operations or condition of a banking organization. Compliance risk is the risk to earnings or capital arising from violations of, or nonconformance with, laws, rules, regulations, prescribed practices, or ethical standards. Reputation................... Reputation risk is the potential that negative publicity regarding an institution's business practices, whether true or not, will cause a decline in the customer base, costly litigation, or revenue reductions. Country/Sovereign............ Country risk arises from the general level of political, financial, and economic uncertainty in a country, which impacts the value of the country's bonds and equities. Sovereign risk is the risk that a central bank will impose foreign exchange regulations that will reduce or negate the value of foreign exchange contracts. It also refers to the risk of government default on a loan made to a country or guaranteed by it. Contagion/Systemic........... Contagion entails the risk that financial difficulties encountered by a business line or subsidiary of a holding company could have an adverse impact on the financial stability of the enterprise and possibly even on the markets in which the constituent parts operate. Systemic risk is defined by financial system instability, potentially catastrophic, caused or exacerbated by idiosyncratic events or conditions in financial intermediaries. Impacted areas include: market value of positions, liquidity, creditworthiness of counterparties and obligors, default rates, liquidations, risk premia, and valuation uncertainty.
Concentration................ The exposure to losses due to a concentration (assets, liabilities, off balancesheet) at the subsidiary, business line, and/or enterprise level. IntraGroup Transactions..... Exposures to risk that result from transactions between affiliates. Strategic And Execution...... Strategic and execution risk is the risk to earnings or capital arising from adverse business decisions or improper implementation of those decisions. This risk is a function of the compatibility of an organization's strategic goals, the business strategies developed to achieve those goals, the resources deployed against these goals, and the quality of implementation. The resources needed to carry out business strategies are both tangible and intangible. They include communication channels, operating systems, delivery networks, and managerial capacities and capabilities. Strategic risk focuses on more than an analysis of the written strategic plan. It focuses on how plans, systems, and implementation affect the enterprise's franchise value. It also incorporates how management analyzes external factors that impact the strategic direction of the company. Insurance
Pricing and Underwriting Risk The risk that pricing and underwriting practices are inadequate to provide for the risks assumed.
Reserving Risk............... The risk that actual losses or other contractual payments reflected in reported reserves or other liabilities will be greater than estimated.

Organizational Structure Rating 1. A rating of 1 indicates that the organizational structure, including the nature and level of risks associated with the affiliates' activities, poses minimal concern. Management controls and monitors intragroup exposures. Any concerns posed by strategic plans, the control environment, concentrations, legal or reputational issues, or other types of risk within the enterprise are minor, and management and the board can address them in the normal course of business.

Organizational Structure Rating 2. A rating of 2 indicates that the organizational structure exhibits minor weaknesses, but the nature and level of risks associated with the holding company's activities are unlikely to be material concerns. Intragroup exposures, including servicing agreements, are generally acceptable, but isolated transactions or exposures may present limited cause for regulatory concern. Concerns posed by strategic plans, the control environment, concentrations, legal or reputational issues, or other types of risks within the enterprise are modest, and management and the board can address them in the normal course of business.

Organizational Structure Rating 3. A rating of 3 indicates that there are organizational structure weaknesses that raise supervisory concern. The nature and level of risks associated with the holding company activities are moderately likely to cause concern. Intragroup exposures, including servicing agreements, may have the potential to undermine the financial condition of other companies in the enterprise. Strategic growth plans, weaknesses in the control environment, concentrations, legal or reputational issues, or other types of risk within the enterprise may cause regulatory concern. The enterprise may have one or more entities in the structure that could adversely affect the operation of other entities in the enterprise if management does not take corrective action.

Organizational Structure Rating 4. A rating of 4 indicates that there are weaknesses in the organizational structure of the enterprise, and/or the nature and level of risks associated with the holding company's activities are, or have a considerable likelihood of becoming, a cause for concern. Intragroup exposures, including servicing agreements, may also have the immediate potential to undermine the operations of companies in the enterprise. Strategic growth plans, weaknesses in the control environment, concentrations, legal or reputational
[[Page 72448]]
issues, or other types of risk within the enterprise may be of considerable cause for regulatory concern. The weaknesses identified could seriously affect the operation of one or more companies in the enterprise.

Organizational Structure Rating 5. A rating of 5 indicates that there are substantial weaknesses in the organizational structure of the enterprise, and/or the nature and level of risks associated with the activities are, or pose a high likelihood of becoming, a significant concern. Strategic growth plans, a deficient control environment, concentrations, legal or reputational issues, or other types of risk within the enterprise may be of critical concern to one or more companies in the enterprise. The weaknesses identified seriously jeopardize the continued viability of one or more companies in the enterprise.

Risk Management (R) Component Rating

R represents OTS's evaluation of the ability of the directors and senior management, as appropriate for their respective positions, to identify, measure, monitor, and control risk. The R rating underscores the importance of the control environment, taking into consideration the complexity of the enterprise and the risk inherent in its activities.

The R rating includes an assessment of four areas: board and senior management oversight; policies, procedures, and limits; risk monitoring and management information systems; and internal controls. These areas are evaluated in the context of inherent risks as related to the size and complexity of the holding company's operations. They provide a consistent framework for evaluating risk management and the control environment. Moreover, a consistent review of these four areas provides a clear structure and basis for discussion of the R rating. Risk management element Description
Governance/Board and Senior This area evaluates the adequacy and Management Oversight. effectiveness of board and senior management's understanding and management of risk inherent in the holding company enterprise's activities, as well as the general capabilities of management. It also considers management's ability to identify, understand, and control the risks within the holding company enterprise, to hire competent staff, and to respond to changes in risk profile or changes in the holding company's operating sectors. Policies, Procedures, and This area evaluates the adequacy of Limits. policies, procedures, and limits given the risks inherent in the activities of the consolidated enterprise and its stated goals and objectives. OTS's analysis considers the adequacy of the enterprise's accounting and risk disclosure policies and procedures. Risk Monitoring and This area assesses the adequacy of risk Management Information measurement and monitoring, and the Systems. adequacy of the holding company's management reports and information systems. Includes a review of the assumptions, data, and procedures used to measure risk and the consistency of these tools with the level of complexity of the enterprise's activities. Internal Controls............ This area evaluates the adequacy of internal controls and internal audit procedures, including the accuracy of financial reporting and disclosure and the strength and influence of the internal audit team. Includes a review of the independence of control areas from management and the consistency of the scope coverage of the internal audit team with the complexity of the enterprise.
Insurance
Reinsurance.................. Reinsurance is purchased by insurance companies to transfer risk. It provides a means to transfer risk for specific lines of business or geographic territories to provide catastrophe protection or to stabilize or reduce volatility in underwriting results.

Risk Management Rating 1. A rating of 1 indicates that management effectively identifies and controls all major enterprise risks. Management is fully prepared to address risks emanating from new products and changing market conditions. The board and management are forwardlooking and active participants in managing risk. Management ensures that appropriate policies and limits exist and that the board understands, reviews, and approves them. Policies and limits are supported by risk monitoring procedures, reports, and management information systems that provide management and the board with the information and analysis necessary to make timely and appropriate decisions in response to changing conditions. Risk management practices and the enterprise's infrastructure are flexible and highly responsive to changing industry practices and current regulatory guidance. Staff has sufficient expertise and depth to manage the risks assumed. Internal controls and audit procedures are sufficiently comprehensive and appropriate to the size and activities of the holding company. There are few noted exceptions to the enterprise's established policies and procedures, and none is material. Management effectively and accurately monitors and manages the enterprise consistent with applicable laws, regulations, and guidance, and in accordance with internal policies and procedures. Risk management processes are fully effective in identifying, monitoring, and controlling risks.

Risk Management Rating 2. A rating of 2 indicates that the enterprise's management of risk is largely effective, but exhibits some minor weaknesses. Management and the board demonstrate a responsiveness and ability to cope successfully with existing and foreseeable risks in the business plans. While the enterprise may have some minor risk management weaknesses, management and the board have recognized and are resolving these problems. Overall, board and senior management oversight, policies and limits, risk monitoring procedures, reports, and management information systems are satisfactory and effective. Risks are controlled and do not require additional supervisory attention. The holding company enterprise's risk management practices and infrastructure are satisfactory, and management makes appropriate adjustments in response to changing industry practices and current regulatory guidance. Staff expertise and depth are generally appropriate to
[[Page 72449]]
manage the risks assumed. Internal controls may display modest weaknesses or deficiencies, but they are correctable in the normal course of business. The examiner may have recommendations for improvement, but the weaknesses noted should not have a significant effect on the condition of the enterprise.

Risk Management Rating 3. A rating of 3 signifies that there are moderate deficiencies in risk management practices and, therefore, there is a cause for additional supervisory attention. One or more of the four elements of sound risk management is not acceptable, which precludes the enterprise from fully addressing one or more significant risks to its operations. Certain risk management practices need improvement to ensure that management and the board are able to identify, monitor, and control all significant risks. In addition, the risk management structure may need improvement in areas of significant business activity, or staff expertise may not be commensurate with the scope and complexity of business activities. Management's response to changing industry practices and regulatory guidance may not be sufficient. The internal control system may be lacking in some important aspects, leading to continued control exceptions or failure to adhere to written policies and procedures. The risk management weaknesses could have adverse effects if management does not take corrective action.

Risk Management Rating 4. A rating of 4 represents deficient risk management practices that fail to identify, monitor, and control significant risk exposures in material respects. There is a general lack of adequate guidance and supervision by management and the board. One or more of the four elements of sound risk management is deficient and requires immediate and concerted corrective action by the board and management. The enterprise may have serious identified weaknesses that require substantial improvement in internal control, accounting procedures, or adherence to laws, regulations, and supervisory guidance. The risk management deficiencies warrant a high degree of supervisory attention because, unless properly addressed, they could seriously affect the condition of the holding company enterprise.

Risk Management Rating 5. A rating of 5 indicates a critical absence of effective risk management practices in identifying, monitoring, or controlling significant risk exposures. One or more of the four elements of sound risk management is wholly deficient, and management and the board have not demonstrated the capability to address these deficiencies. Internal controls are critically weak and could seriously jeopardize the continued viability of the enterprise. If not already evident, there is an immediate concern about the reliability of accounting records and regulatory reports and the potential for losses if corrective measures are not taken immediately. Deficiencies in the enterprise's risk management procedures and internal controls require immediate and close supervisory attention. Earnings (E) Component Rating

E reflects the consolidated holding company enterprise's overall financial performance, including measures such as the quality of consolidated earnings, profitability, and liquidity. OTS's review of this area considers the level, trend, and sources of earnings on a consolidated level as well as for material legal entities or business lines. OTS also assesses the ability of earnings to augment capital and to provide ongoing support for an enterprise's activities.

Within this component, OTS also considers the liquidity of the enterprise. This rating reflects the consolidated holding company enterprise's ability to attract and maintain the sources of funds necessary to achieve financial efficiency, support operations, and meet obligations. OTS evaluates the funding conditions for each of the material legal entities in the holding company structure to determine if any weaknesses exist that could affect the funding profile of the consolidated enterprise.

Earnings Rating 1. A rating of 1 indicates that the consolidated holding company enterprise's overall financial performance is solid. The quantity and quality of earnings for material business lines and subsidiaries are sufficient to make full provision for the absorption of losses and/or accretion of capital in light of asset quality and business plan objectives. The enterprise has strong liquidity levels along with welldeveloped funds management practices. The parent company and subsidiaries have reliable and sufficient access to sources of funds on favorable terms to meet present and anticipated liquidity needs.

Earnings Rating 2. A rating of 2 indicates that the consolidated holding company enterprise's financial performance is adequate. The quantity and quality of the earnings for major business lines and subsidiaries are generally adequate to make provision for the absorption of losses and/or accretion of capital in light of asset quality and business plan objectives. The enterprise maintains satisfactory liquidity levels and funds management practices. The parent company and subsidiaries have access to sufficient sources of funds on acceptable terms to meet present and anticipated liquidity needs. Modest weaknesses in funds management practices may be evident, but management and the board can correct those weaknesses in the normal course of business.

Earnings Rating 3. A rating of 3 indicates that the consolidated holding company enterprise's financial performance exhibits modest weaknesses. Major business line and subsidiary earnings are not fully adequate to make provisions for the absorption of losses and the accretion of capital in relation to the business plan objectives. The financial performance of this enterprise may reflect static or inconsistent earnings trends, chronically insufficient earnings, or less than satisfactory asset quality. This enterprise's liquidity levels or funds management practices may need improvement. The enterprise may lack ready access to funds on reasonable terms or may evidence significant weaknesses in funds management practices at the parent company or subsidiary levels. However, these deficiencies are correctable in the normal course of business with sufficient board and management attention.

Earnings Rating 4. A rating of 4 indicates that the consolidated holding company enterprise's financial performance is weak. Major business line or subsidiary earnings are insufficient to provide for losses and the necessary accretion of capital. The enterprise may exhibit erratic fluctuations in net income, poor earnings (and the likelihood of a further downward trend), intermittent losses, chronically depressed earnings, or a substantial drop from previous performance. The liquidity levels or funds management practices of this holding company enterprise may be deficient. The enterprise may not have or be able to obtain a sufficient volume of funds on reasonable terms to meet liquidity needs at the parent company or subsidiary levels.

Earnings Rating 5. A rating of 5 indicates that the consolidated holding company enterprise has poor financial performance and one or more business lines or subsidiaries are experiencing losses. In addition, such losses, if not reversed, represent a distinct threat to the enterprise's solvency through
[[Page 72450]]
erosion of capital. Further, the liquidity levels or funds management practices are critically deficient and may threaten continued viability. The enterprise requires immediate external financial assistance to meet maturing obligations or other liquidity needs.

Dated: December 14, 2007.

By the Office of Thrift Supervision.
John M. Reich,
Director.
[FR Doc. E724742 Filed 121907; 8:45 am]
BILLING CODE 672001P

FOR FURTHER INFORMATION CONTACT Donna Deale, Director, Holding Companies and Affiliates, (202) 9067488.