	The Year 2000 Poses a Serious Problem for Banks

The Federal Deposit Insurance Corporation is the deposit insurer of approximately 11,000 banks and saving institutions. Together, these institutions are responsible for about $6 trillion in assets and have insured deposits totaling upwards of $2.7 trillion. The letter, which included a statement from the interagency Federal Financial Institutions Examination Council, described the Year 2000 problem and highlighted concerns about the industry’s Year 2000 readiness. In May 1997, FDIC issued a more detailed awareness letter that described the five-phase approach to planning and managing an effective highlighted external issues requiring management attention, such as reliance on vendors, risks posed by exchanging data with external parties, and the potential effect of Year 2000 noncompliance on corporate borrowers; discussed operational issues that should be considered in Year 2000 planning, such as whether to replace or repair systems; related its plans to facilitate Year 2000 evaluations by using uniform directed banks to (1) inventory core computer functions and set priorities for Year 2000 goals by September 30, 1997, and (2) to complete programming changes and to have testing of mission-critical systems underway by December 31, 1998. Concerns With FDIC’s Efforts to Ensure Banks Are Year 2000 Ready

The primary challenge facing FDIC, and indeed all the banking regulators, in providing a level of assurance that the banking industry will successfully address the Year 2000 problem is time. FDIC’s late start in developing an industry assessment is further compounded by two other factors: (1) its initial assessment and the follow-on assessment to be completed in June 1998 are not collecting all the data required to be definitive about the status of individual banks and (2) key guidance—being developed under the auspices of FFIEC—needed by banks to complete their own preparations is also late which, in turn, could potentially hamper individual banks’ abilities to address Year 2000 issues. While this guidance is needed, it would have been more appropriate to make it available before banks began completing their assessment phase efforts. Guidance Late for Bank Interaction With Vendors

Regulators have found that some financial institutions, relying on third-party data processing servicers or purchased applications software, have not taken a proactive approach in ensuring Year 2000 compliance by their vendors. In its May 1997 letter, the regulators also recommended that banks begin developing processes to periodically assess large corporate customer Year 2000 efforts and to consider writing Year 2000 compliance into their loan documentation, and FDIC later informed its institutions that the Year 2000 risks associated with corporate customers and reliance on vendors would be included in FDIC’s follow-up assessments. Concerns With FDIC’s Efforts to Correct Its Internal Systems

FDIC internal systems are critical to the day-to-day operation of the corporation. Specifically, FDIC has yet to fully assess its 40 mission-critical systems. Compounding this problem is the fact that FDIC has yet to develop contingency plans for its mission-critical systems and core business processes. In addition, FDIC had not yet prepared a contingency plan to ensure continuity of its core business processes. In conclusion, Mr. Chairman, we believe that FDIC has a good appreciation for the Year 2000 problem and has made significant progress since last year.
Why GAO Did This Study

Pursuant to a congressional request, GAO discussed the progress being made by the Federal Deposit Insurance Corporation (FDIC) in ensuring that the thousands of banks it oversees are ready to handle the year 2000 computer conversion challenge.

What GAO Found

GAO noted that: (1) the year 2000 problem poses a serious dilemma for banks due to their heavy reliance on information systems; (2) it also poses a challenge for FDIC and the other bank regulators who are responsible for ensuring bank industry readiness; (3) regulators have a monumental task in making sure that financial institutions have adequate guidance in preparing for the year 2000 and in providing a level of assurance that such guidance is being followed; (4) further, regulators will likely face some tough decisions on the readiness of individual institutions as the millennium approaches; (5) GAO found that FDIC is taking the problem very seriously and is devoting considerable effort and resources to ensure that the banks it oversees mitigate year 2000 risks; (6) FDIC has been very emphatic in alerting banks to the year 2000 problem and has conducted a high-level assessment of the industry's year 2000 readiness; (7) despite aggressive efforts, FDIC still faces significant challenges in providing a high level of assurance that individual banks will be ready; (8) FDIC--as were the other regulators--was late in addressing the problem; (9) consequently, it is behind the year 2000 schedule recommended by both GAO and the Office of Management and Budget (OMB); (10) compounding this problem is that critical guidance, although under development, has not been released by the Federal Financial Institutions Examination Council (FFIEC) for banks and other financial institutions on contingency planning, assessing risks caused by corporate customers (borrowers), and assessing risks associated with third-party automated system service providers; (11) this guidance should have been provided earlier so that banks would have had more time to factor the guidance into their own assessments and plans; (12) additionally, FDIC's ability to report on individual banks' status in preparing for the year 2000 is limited by insufficient information being reported by bank examiners; (13) FDIC also needs to correct its internal systems used to support agency functions and has initiated efforts to do this; (14) FDIC is behind in assessing whether these systems are year 2000 compliant; and (15) although OMB guidance states that the assessment phase should have been completed in mid-1997, FDIC has not yet fully assessed its mission critical systems or established contingency plans in case systems repairs and replacements are not in place on time or do not work as intended.