U.S. banks grappled with a number of challenges last year, from inflation and rapidly rising interest rates to the collapse in crypto to the Russia-Ukraine conflict. Despite these headwinds, most institutions appear well-positioned to whether the economic downturn many believe is coming. However, regulatory concerns persist — about systemic risks, consumer protections, cybersecurity, financial inclusion, and data governance, among other issues.

Bank leaders should keep current on developments in Washington to help ensure their institutions meet compliance obligations and remain well-positioned for the future. Recently, on Banking with Interest, I discussed a number of regulatory issues with legendary bank lawyer and Sullivan & Cromwell Senior Chair H. Rodgin Cohen, including the too-big-to-manage debate, scrutiny of M&A and its impact on dealmaking, the Fed’s plans to boost capital requirements, the need for digital-asset regulations, and much more.

What follows is our conversation, edited for length and clarity.

Are some banks really too big to manage?
It’s a fair question, but keep in mind that banking organizations, particularly the largest, are subject to a complex web of laws, regulations, and guidance — which are often ambiguous and almost always involve subjectivity in their interpretation and application. In addition, regulatory expectations and interpretations can change over time. Large banks also are under virtually continuous examination by their regulators and have more compliance personnel per dollar of revenue than any other type of business organization. With so many people examining for compliance, it’s inevitable more violations will be found.

There are real advantages to large banks: they bring credit, the breadth of financial services, and the convenience a modern economy needs. I don’t mean to excuse obvious violations or failures of controls, but before one reaches the conclusion that banks are too big to manage, they should strongly consider these benefits.

Regulators have taken a tougher stance on M&A. You’ve compared it to a line from Casablanca — they wait and they wait and they wait. What does that mean for the industry?
There’s a cost to time. In 2021, the two largest bank transactions were approved in about five months. Today, applications from large banks are taking a year or more to approve. When you increase the amount of time, you lose customers and employees. There’s the additional loss of business opportunities and revenue, and expense synergies get further delayed.

Something I want to point out is the Fed’s data on processing time, which shows a clear dichotomy between the time it takes to approve a protested application versus a nonprotested application. Agencies should reconsider what constitutes a substantive, credible protest because the differential between protested and nonprotested seems to occur irrespective of the protester’s credibility.

Is there a way for banks to satisfy regulatory concerns over M&A other than waiting longer? Or do they just need to understand approval is going to take a year instead of six months?
I think your premise is correct; it’s a question of time rather than substance. If you look at the approval orders from the Federal Reserve and OCC on the U.S. Bank/MUFG Union Bank and BMO/Bank of the West transactions — the largest approvals in some time. It’s not merely that they were approved, it’s that the analyses the agencies used were comparable to analyses used in the past — which should be the case because the statute is the same.

Is there an asset threshold where regulators won’t approve a deal?
I don’t know if regulators will say there is one, and they should be cautious because Congress has acted twice on this issue — first in the mid-1990s, then with Dodd-Frank. The tests were not in terms of absolute dollars, but in the percentage of nationwide deposits in the first case and nationwide liabilities in the second. I think a percentage test makes more sense.

Regulators have signaled more scrutiny of bank-fintech relationships. What are they looking for?
It depends on the type of fintech. Several banks have suffered significant losses from their relationships with crypto companies. When you look at the most recent release from the agencies, their attitude seems to be “unsafe at any speed.” So with regard to crypto fintechs, the message is clear: it’s a red light.

With the more traditional fintechs, it’s a cautionary yellow light. The concern is that some fintechs are engaging in improper or illegal practices, particularly in the context of consumer protection. Some worry banks are a transmission vehicle for fintechs to get into questionable consumer and small-business products and services. Regulators are telling banks they’re going to hold them responsible under their vendor-management obligations if those products and services violate laws and regulations.

Most analysts believe Fed Vice Chair Michael Barr is going to raise capital requirements, but they don’t know the levers he’s going to pull to do it. How do you see this playing out?
I do think the Federal Reserve is going to raise the requirements. This Federal Reserve has made it clear it no longer considers capital neutrality a goal, and that suggests it won’t be met. This isn’t because capital requirements are going down, it’s because they’re going up.

There are many levers to pull, and more than one will be pulled. For instance, at many large banks, the stress-test process is the most capital-constraining, and it doesn’t take much to change it. You can change the economic assumptions to assume more of a market correction, higher unemployment, or any number of economic factors. Most important are the assumptions on whole categories of loan losses. Take a category of loans that represent, say, 20% of a bank’s loan portfolio, increase the percentage losses by 25% over a time horizon, and capital requirements will increase proportionately.