In addition, financial institutions depend on public infrastructure, such as telecommunications and power networks, to carry out critical business operations, such as making electronic fund transfers, verifying credit card transactions, and making ATM transactions. Regulators Have Taken Positive Actions to Mitigate Year 2000 Risks

Since June 1996, when their Year 2000 oversight efforts began, the five financial institution regulators have taken a number of important steps to alert financial institutions of the risks associated with the Year 2000 problem and to assess what these institutions are doing to mitigate the risks. In addition, the regulators provided extensive guidance to assist financial institutions in critical Year 2000 tasks, including guidance on (1) contingency planning, (2) mitigating risks associated with critical bank customers (e.g., large borrowers and capital providers), (3) mitigating risks of using data processing servicers and software vendors to perform financial institution operations, (4) testing to demonstrate Year 2000 compliance, (5) establishing effective Year 2000 customer awareness programs, and (6) addressing Year 2000 risks associated with fiduciary services. To assess what institutions are doing to mitigate Year 2000 risks, the regulators performed a high-level and detailed assessment of bank, thrift, and credit union efforts. Significant Year 2000 Challenges Ahead for Financial Institutions and Regulators

Despite the regulators’ strong efforts to assess industrywide compliance and remediate their own systems, several complex and difficult challenges remain in achieving Year 2000 compliance. Regardless of good practices and good progress, less than 16 months remain to the century date change. Because of the limited number of technical examiners and the large number of entities to be examined, we have recommended to the regulators that they (1) determine how many technical examiners are needed to adequately oversee the Year 2000 efforts of the institutions, data processing servicers, and software vendors and (2) develop a strategy for obtaining these resources and maintaining their availability. Developing these plans promptly is paramount to minimizing the risk of not having enough time to implement a viable plan for dealing with institutions that cannot successfully complete their efforts. Given the fact that many countries are behind schedule in addressing the Year 2000 problem, it will be essential for regulators to (1) ensure that financial institutions have adequately identified and mitigated their international risks and (2) prepare contingency plans for handling disruptions caused by problems abroad. The carriers are working to test their networks but until the tests are completed and the results made public, it is not clear to what degree—if any—financial institutions and the public will be subject to telecommunications disruptions. Looking forward, the challenge is for the regulators to make the best use of limited resources in the time remaining and to ensure that they are ready to take swift actions to address those institutions that falter in the later phases of correction and to address disruptions caused by international and public infrastructure Year 2000 failures. In addition, they have undertaken efforts to determine what conditions will constitute Year 2000 failures and what actions can be taken to quickly address failures.
Why GAO Did This Study

Pursuant to a congressional request, GAO discussed the year 2000 risks facing financial institutions and the federal regulators, focusing on the: (1) actions taken to date to mitigate these risks; and (2) challenges that lay ahead as institutions and regulators face the more complex and difficult activities of their year 2000 programs.

What GAO Found

GAO noted that: (1) the regulators have made good progress in assisting banks, thrifts, and credit unions in their year 2000 efforts as well as identifying which institutions are at a high risk of not remediating their systems on time; (2) they have also recognized the risk and potential impact of year 2000-induced system failures on their own core business processes and have implemented rigorous efforts to mitigate these risks; (3) nevertheless, there are still serious challenges ahead that could threaten the financial institution industry's ability to successfully meet the year 2000 deadline; (4) with less than 16 months remaining before the year 2000 deadline, the regulators are faced with the daunting task of overseeing the efforts of more than 22,000 financial institutions, service providers, and software vendors with a relatively finite number of examination personnel; (5) in the next few months, many of these entities will be undertaking the most complex and difficult stage of correction--testing; (6) it will be necessary for regulators to ensure that they have enough technical resources to review institution efforts during this crucial phase; (7) beginning in early 1999, regulators will be pressed to take quick actions against institutions that cannot successfully complete their year 2000 efforts; (8) but before they can do so, they need to determine what will constitute financial institution year 2000 failures, what regulatory options can be effectively used, and when they would be implemented; (9) the U.S. economy is intrinsically linked to the international banking and financial services sector, yet many countries and their financial institutions are reported to be behind schedule in addressing their year 2000 problem; (10) working with their foreign counterparts, the regulators will need to identify and define global year 2000 risks and work cooperatively to mitigate those risks; (11) the regulators will also need to develop contingency plans in case there are unforeseen problems; (12) financial institution credit, deposit, and payment flows are critically dependent on public infrastructure such as telecommunications and electric power networks; (13) however, until critical readiness assessments and tests are completed and made available to the public, it is not clear whether there will be uninterrupted telecommunications and power service; and (14) regulators will need to develop contingency plans that anticipate year 2000-related disruptions in the public infrastructure.