We found that the factual basis provided for  many of these certifications lacked key information (discussions of data  sources or methodologies and of broader economic impacts, or  definitions for key criteria) for understanding the analyses regulators used  to support their conclusion. Regulators generally did not define the criteria they  used for “substantial number” and “significant economic impact” in their  certifications. Limited information. Many RFA-Required Analyses Had Weaknesses

In many recent regulatory flexibility analyses, the evaluation of key  components—potential economic effects and alternative regulatory  approaches—was limited. goal of RFA. Most Regulators Lacked Documentation of Regulatory Flexibility Analysis and Certifications for Most Rules

For most rules we reviewed, regulators (five of six) were unable to  provide documentation supporting their regulatory flexibility analyses or  certification decisions, although the extent of documentation varied by  regulator (see table 5). Regulatory Guidance Generally Does Not Include Policies or Procedures for Ensuring Consistent and Complete RFA Analyses

		Most of the Regulators Have Established General Guidance for Complying with RFA Requirements

Most regulators (five of six) have established written guidelines that  restate the statutory requirements for certification and for preparing the  regulatory flexibility analyses and provide some additional guidance for  staff conducting the analyses, as shown in table 6. However, they  generally have not developed comprehensive policies and procedures to  assist staff in complying with RFA, which may contribute to the  weaknesses we identified in some certifications and regulatory flexibility  analyses. Without such policies and procedures,  regulators’ ability to consistently and effectively meet RFA objectives may  be limited. As previously  mentioned, federal internal control standards state the importance for  agency management to establish policies and procedures needed to  achieve objectives. Recommendations for Executive Action

We are making a total of 10 recommendations among the six financial  regulators we reviewed:  FDIC should develop and implement specific policies and procedures for  how it will consistently comply with RFA requirements and key aspects of  Office of Advocacy and OMB guidance that include the following three  elements: processes for creating and maintaining documentation sufficient to  support analysis of economic impact and alternatives; processes for disclosing the methodology—including criteria for  assessing significant economic impact and substantial number of  small entities—and data sources of economic analysis supporting  certification determinations and regulatory flexibility analyses; and processes for considering to the extent practicable a rule’s potential  economic impacts on small entities, including for evaluating broad  economic impacts of regulations in certification determinations and  assessing alternatives that could minimize impact on small entities. (Recommendation 7)
CFTC should develop and implement specific policies and procedures for  how it will consistently comply with RFA requirements and key aspects of  Office of Advocacy and OMB guidance that include the following four  elements: processes for creating and maintaining documentation sufficient to  support analysis of economic impact and alternatives; processes for disclosing the methodology—including criteria for  assessing significant economic impact and a substantial number of  small entities—and data sources of economic analysis supporting  certification determinations and regulatory flexibility analyses; processes for considering to the extent practicable a rule’s potential  economic impacts on small entities, including for evaluating broad  economic impacts of regulations in certification determinations and  assessing alternatives that could minimize impact on small entities;  and  in developing policies and procedures for section 610 reviews, include  processes for determining which rules require review, posting notices  of upcoming reviews in the Federal Register, maintaining  documentation supporting the analysis and conclusions of RFA- required considerations, and establishing procedures for publicly  disclosing the review or summaries (such as in the Federal Register  or on the agency’s website). Appendix I: Objectives, Scope, and Methodology

The objectives of this report were to (1) analyze the trends in financial  regulators’ application of Regulatory Flexibility Act (RFA) requirements in  their recent rulemakings; (2) examine the extent to which financial  regulators performed analyses for rules they certified would not have a  significant economic impact on a substantial number of small entities; (3)  examine the extent to which financial regulators performed regulatory  flexibility analyses and the analyses’ effects on their rulemakings; (4)  examine the extent to which financial regulators established policies,  procedures, and criteria for complying with RFA requirements; and (5)  examine the extent to which financial regulators performed retrospective  reviews required by RFA. For the purposes of this report, financial regulators are the Consumer  Financial Protection Bureau (CFPB), the Board of Governors of the  Federal Reserve System (Federal Reserve), Federal Deposit Insurance  Corporation (FDIC), Office of the Comptroller of the Currency (OCC),  Commodity Futures Trading Commission (CFTC), and the Securities and  Exchange Commission (SEC). We identified a total of 66 final  rules that included certifications. For these rules, we  obtained and reviewed internal workpapers from the financial regulators  related to the initial and final regulatory analyses. The Small Business Administration’s Office of Advocacy does  not make any recommendation on coordination in its RFA guide. None of the rules we reviewed with initial and final flexibility analyses that  were issued by individual regulators indicated that the regulator had  coordinated with other agencies.
Why GAO Did This Study

Since the 2007–2009 financial crisis, federal financial regulators have issued hundreds of rules to implement reforms intended to strengthen the financial services industry. Financial regulators must comply with rulemaking requirements such as RFA when drafting and implementing regulations. Congress included a provision in statute for GAO to study these financial services regulations annually.
This annual report examines the extent to which and how financial regulators performed required RFA analyses and established policies and procedures for complying with RFA requirements, among other objectives. GAO reviewed the RFA section of financial regulators' Federal Register notices of rulemaking, related internal workpapers, and policies and procedures for conducting RFA analyses. GAO also determined the extent to which regulators' analyses reflected RFA requirements, guidance issued by the Office of Advocacy, and OMB guidance on regulatory analysis. GAO's review covered certifications in 66 final rules and regulatory flexibility analyses in 39 proposed and final rules.

What GAO Found

To comply with the Regulatory Flexibility Act (RFA), agencies generally must assess the rule's potential impact on small entities and consider alternatives that may minimize any significant economic impact of the rule (regulatory flexibility analyses). Alternatively, agencies may certify that a rule would not have a significant economic impact on a substantial number of small entities. GAO found several weaknesses with the analyses of six financial regulators (Board of Governors of the Federal Reserve System, Office of the Comptroller of the Currency, Federal Deposit Insurance Corporation, Securities and Exchange Commission, Commodity Futures Trading Commission, and Consumer Financial Protection Bureau) that could undermine the goal of RFA and limit transparency and public accountability, as shown in the following examples.
Certifications. In certifications for rules that regulators determined may affect small entities, regulators conducted analyses to support their conclusions. GAO found many analyses across all regulators lacked key information the Small Business Administration's Office of Advocacy and the Office of Management and Budget (OMB) recommend. Missing information included discussions of data sources or methodologies, consideration of broader economic impacts of the rulemaking (such as cumulative economic impacts of regulations), and definitions of the criteria regulators used for “substantial number” and “significant economic impact.”
Regulatory flexibility analyses. In many of the initial and final regulatory flexibility analyses that GAO reviewed, financial regulators' evaluation of key components required by RFA—potential economic effects and alternative regulatory approaches—was limited. Most regulators (five of six) also did not disclose data sources or methodologies used for their analyses, as OMB recommends. For most rules GAO reviewed, regulators (five of six) were unable to provide documentation supporting their regulatory flexibility analyses, as OMB recommends, including analyses supporting certification decisions. However, the extent of documentation varied by regulator.
Federal internal control standards state the importance for agency management to establish policies and procedures to achieve objectives. All but one of the financial regulators have guidelines that restate RFA requirements for certification and for preparing regulatory flexibility analyses and provide some information on how to approach these analyses. However, these regulators generally have not developed specific policies and procedures to assist staff in complying with RFA, which may contribute to the weaknesses GAO identified in the analyses. For example, regulators' guidance generally did not include procedures for evaluating a rule's potential economic impact; identifying and assessing regulatory alternatives that could minimize impact on small entities; disclosing methodology and data sources; and creating and maintaining documentation that supports findings. By not developing and implementing comprehensive policies and procedures for RFA analyses, regulators' ability to consistently and effectively meet RFA objectives may be limited.

What GAO Recommends

GAO is making a total of 10 recommendations among the six financial regulators reviewed, including that regulators develop and implement specific policies and procedures for consistently complying with RFA requirements and related guidance for conducting RFA analyses. Five agencies generally agreed with the recommendations and one did not provide written comments.