Item 1. Business
ITEM 1. BUSINESS
We are Capital Bancorp, Inc., a bank holding company and a Maryland corporation established in 1998, operating primarily through our wholly owned subsidiary, Capital Bank, N.A., a commercial-focused community bank based in the Washington, D.C. and Baltimore metropolitan areas. We serve businesses, not-for-profit associations and entrepreneurs throughout the region. Capital Bank is headquartered in Rockville, Maryland and operates a branch-lite model through four commercial bank branches, one mortgage office and two loan production offices.
Capital Bank currently operates three divisions: Commercial Banking, Capital Bank Home Loans, and OpenSky ™ . Our Commercial Banking division operates primarily in the Washington, D.C. and Baltimore metropolitan areas and focuses on providing personalized service to commercial clients throughout our area of operations. Capital Bank Home Loans and OpenSky ™ both leverage Capital Bank’s national banking charter to operate as national consumer business lines; Capital Bank Home Loans acts as our residential mortgage origination platform and OpenSky ™ provides nationwide, digitally-based, unsecured
5
credit cards as well as secured credit cards to under-banked populations and those looking to rebuild their credit scores.
In addition to the three divisions of Capital Bank, Church Street Capital also operates as a wholly owned subsidiary of Capital Bancorp, Inc. CSC originates and services a portfolio of primarily mezzanine loans with certain characteristics that do not meet Capital Bank’s general underwriting standards, but command a higher rate of return.
In addition to its subsidiaries discussed above, Capital Bank, N.A. and Church Street Capital, Capital Bancorp, Inc. owns all of the stock of Capital Bancorp (MD) Statutory Trust I (the “Trust”). The Trust is a special purpose non-consolidated entity organized for the sole purpose of issuing trust preferred securities.
Commercial Banking Division
The Commercial Banking division operates out of four full service banking locations, each of which is in the Washington, D.C. Metropolitan Statistical Area (“MSA”), and its full service banking location in Columbia, Maryland in the Baltimore, Maryland MSA. Additionally, we have two loan production offices, one located in the Washington, D.C. area and one in Columbia, Maryland. Our Commercial Banking division’s commercial loan officers and commercial real estate loan officers provide commercial and industrial, or C&I, commercial real estate, including lender finance loans, and construction lending solutions to business clients in Capital Bank’s operating markets.
Lender finance loans are loans to companies used to purchase finance receivables or extend finance receivables to the underlying obligors and are secured primarily by the finance receivables held by our borrowers.
Construction lending is a core competency of our Commercial Banking division. Our construction loan portfolio provides Capital Bank with short duration, higher yield loans. Our construction lending is focused on commercial and residential construction projects within the Washington, D.C. and Baltimore-Columbia-Towson, Maryland metropolitan operating areas, with limited exposure to suburban subdivision tract development.
In addition to its loan officers who have incentives and goals to drive core deposit growth, our Commercial Banking division currently has a team of business development officers concentrating on continuing to diversify Capital Bank’s funding sources away from wholesale funding and towards core deposit funding.
Capital Bank Home Loans Division
Capital Bank Home Loans (“CBHL”) originates conventional and government-guaranteed residential mortgage loans on a national basis, for sale into the secondary market and in certain circumstances for our loan portfolio. Loans sold into the secondary market are sold servicing released. Our residential loan portfolio aims to retain high-quality, lower risk loans which support the Company’s business strategies. A portion of the retained residential portfolio is represented by mortgage loans on primary residences within Capital Bank’s operating markets to individuals who own businesses where Capital Bank may also pursue a commercial lending relationship and has a vested interest in maintaining the fullest possible control of the lending relationship.
In 2023, as the mortgage refinance market continued to contract in response to increasing market interest rates, CBHL continued to focus on purchase originations. Purchase origination volume was 91.7% for the year ended December 31, 2023, compared to 80.6% for the year ended December 31, 2022.
6
Approximately 62.8% of CBHL loan originations by volume occur within Capital Bank’s operating markets in Maryland, Virginia and Washington, D.C. The remainder of originations are national in scope and originate primarily through a consumer direct channel that utilizes consumer marketing, including through social media applications.
OpenSky ™ Secured Credit Card Division
The OpenSky ™ Division provides secured, partially secured and unsecured credit cards on a nationwide basis.
The secured credit cards require a minimum initial deposit of $200 and permit maximum initial deposits of $3,000 per card and $10,000 per individual. This business line focuses on under-banked populations and those looking to rebuild their credit scores. In order to obtain a secured credit card from us, the customer must select a credit line amount that the customer is willing to secure with a matching deposit amount. A deposit equal to the full credit limit of the card is made into a noninterest-bearing demand account with the Bank. Once the account is opened, the deposit is required to be maintained throughout the life of the card. The customer’s funding of the deposit account is collateral and it is not a consideration in the credit card approval process, but is a prerequisite to activating the credit line. Once the customer’s deposit account has been funded, the credit line is activated and the collateral funds are generally available to absorb any losses on the account that may occur. Given the secured nature of the cards, credit checks are not required at the time of application.
The partially secured credit card uses our proprietary scoring model, which considers among other things, credit score and repayment history (typically a minimum of six months of on-time repayments, but ultimately determined on a case-by-case basis), to offer certain existing customers an unsecured line in excess of their secured line of credit. As each customer’s secured account ages, we obtain credit scores to baseline the customer’s improvement as an input into any decision to extend unsecured credit.
The unsecured credit card was added, for qualifying customers, in the fourth quarter of 2021 to expand the OpenSky ™ product offering. The addition of the unsecured card allows for an uninterrupted experience for OpenSky ™ customers who can now more easily continue in their journey from a secured to unsecured credit card.
OpenSky ™ cards operate on a fully digital and mobile platform with all marketing and application procedures conducted through its website or mobile applications. OpenSky ™ credit cards have floating interest rates, which are beneficial to us in a rising rate environment, and we believe the OpenSky ™ secured credit card product may provide a counter-cyclical benefit as more people may wish to enter its target segment of credit rebuilders during an economic downturn. Credit card eligibility for all product offerings is based on identity and income verification. Our prior experience has shown that approximately 20% of our secured credit cards will experience a charge-off within the first year of issuance primarily due to the relative inexperience of this under-banked population in effectively managing credit card debt. As of December 31, 2023, approximately 12.3% of our secured credit card portfolio was delinquent by 30 days or more.
Capital Bank evaluates its OpenSky ™ customers using analytics that track consumer behaviors and score each customer on risk and behavior metrics. These real-time monitoring capabilities give our management insight into the credit trends of our portfolio on a consumer-by-consumer basis, allowing us to identify potential fraud situations and mitigate any associated losses, as well as to obtain insights into how to optimize the profitability and life cycle of each account. The model utilizes data proprietary to Capital Bank.
7
Our Business Strategy
Regulations, technology and competition have fundamentally impacted the economics of the banking sector. We believe that by using technology-enabled strategies and advice-based solutions, we can deliver attractive shareholder returns in excess of our cost of capital. We have adopted the following strategies that we believe will continue to drive growth while maintaining consistent profitability and enhancing shareholder value:
Deliver premium advice-based solutions that drive organic loan and core deposit growth with corresponding net interest margin
• Serve as financial partners to our customers, helping them to grow their businesses through advice-based financial solutions;
• Endeavor to provide comprehensive loan and deposit solutions to our customers that are tailored to their needs, and leverage data, analytics, and financial technology to improve the customer experience;
• Scale our consumer fee-based platforms by investing in fintech capabilities and digital marketing to deliver high impact products and services and differentiated customer experience;
• Capitalize on market dislocation from recent in-market acquisitions to continue to attract top sales talent, and acquire new commercial banking relationships from local competitors; and
• Selectively add banking centers where sales teams have already proved an ability to capture market share and leverage customer relationships.
Leverage technology to improve the customer experience and loyalty and deliver operational efficiencies
• Use solution structuring and customized technology implementation as differentiators to add value to clients with complex needs and enhance our relationships within our existing customer base;
• Deploy technologies that better support our lending associates and simplify our processes;
• Maximize the potential of web-based and mobile banking applications to drive core funding while maintaining our branch-lite business model; and
• Enhance cross-selling capabilities among our OpenSky ™ , Capital Bank Home Loans and Commercial Banking division customers.
Increase scale in our consumer fee-based platforms through delivery of high value products and services
• Utilize our customer acquisition system, Apollo, and leverage our investment in a new core processing system, together with our expertise in data, analytics and marketing, to deliver new products and services and grow our secured credit card business;
• Retain OpenSky ™ customers that “graduate” from our secured credit product through the limited use of partially and fully unsecured credit products; and
• Expand our purchase-oriented mortgage loan sales both in-market and in adjacent markets through the hiring of qualified mortgage originators and continue to improve on our direct to consumer marketing channels.
8
Pursue acquisitions opportunistically
• Seek strategic acquisitions in the Washington, D.C., Baltimore, Maryland, and surrounding metropolitan areas;
• Evaluate specialty finance company opportunities where we can add value through increasing interest and fee income and leveraging our management’s expertise and existing strategic assets; and
• Use our management’s and Board’s expertise to structure transactions that minimize the integration and execution risk for the Bank.
Sustainability
We aspire to be the most valued and trusted community bank within the markets we serve. We understand our obligation to both our shareholders and the communities we serve -- to be an institution that achieves superior financial performance, while contributing to society through the delivery to our customers of services that enlarge access, equity and opportunity.
We focus our environmental, social, and governance (“ESG”) efforts on issues that are important to our business and to our key stakeholders. Our mission is to support businesses, help people and strengthen communities, as well as to grow our operations and revenue. Essential to this mission is our commitment to provide long-term, sustainable financial and social value to our stakeholders, including the communities we serve, our shareholders and our employees.
Employees and Human Capital Resources
At December 31, 2023, we employed 299 persons, of which 277 were employed on a full-time basis. None of our employees are represented by any collective bargaining unit or are a party to a collective bargaining agreement. We believe the relationship with our employees to be excellent and we have been named a Best Bank to Work For by American Banker for four of the past five years. Our ability to attract and retain employees is a key to our success. We offer a competitive total rewards program to our employees, flexible work arrangements, and monitor the competitiveness of our compensation and benefits programs in our various market areas.
The Company prides itself on being a values-driven organization, where employees are empowered to share Ideas that keep the organization on track. Our company core values guide each team member to:
• Act as an Owner
• Practice Balanced Risk Management
• Challenge the Norm
• Leverage the Team
We believe that these values enable our success with our customers and have helped us build a fun, vibrant and accountability driven culture. In addition, we are committed to developing our staff through internal/external training programs, including through use of online training resources and by affording all levels of leadership within the organization to participate in leadership development programs.
9
Available Information
The Company provides access to its SEC filings through its website at www.capitalbankmd.com. After accessing the website, the filings are available upon selecting “Investor Relations.” Reports available include the Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and all amendments to those reports as soon as reasonably practicable after the reports are electronically filed with or furnished to the SEC. Further, the SEC maintains an internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC at www.sec.gov. The information on, or accessible through, our website or any other website cited in this Annual Report on Form 10-K is not part of, or incorporated by reference into, this Annual Report on Form 10-K and should not be relied upon in determining whether to make an investment decision.
SUPERVISION AND REGULATION
General
We are extensively regulated under both federal and state law. These laws restrict permissible activities and investments and require compliance with various consumer protection provisions applicable to lending, deposit, brokerage and fiduciary activities. They also impose capital adequacy requirements and conditions on a bank holding company’s (“BHC”) ability to repurchase stock or to receive dividends from its subsidiary banks. We are subject to comprehensive examination and supervision by the Board of Governors of the Federal Reserve (“Federal Reserve”), and the Bank is subject to comprehensive examination and supervision by the Office of the Comptroller of the Currency (“OCC”). We are required to file with the Federal Reserve quarterly and annual reports and such additional information as the Federal Reserve may require pursuant to the Bank Holding Company Act of 1956 (“BHC Act”). The Federal Reserve may conduct examinations of BHCs and their subsidiaries. The Bank’s deposits are insured by the FDIC, through the Deposit Insurance Fund (“DIF”). As a result of this deposit insurance function, the FDIC also has certain supervisory authority and powers over the Bank as well as all other FDIC insured institutions. The Company’s and the Bank’s regulators generally have broad discretion to impose restrictions and limitations on our operations. Bank regulation is intended to protect depositors and consumers and not shareholders. This supervisory framework could materially and adversely impact the conduct and profitability of our activities.
To the extent that the following information describes statutory and regulatory provisions, it is qualified in its entirety by reference to the text of the applicable statutory and regulatory provisions. Legislative and regulatory initiatives, which necessarily impact the regulation of the financial services industry, are introduced from time to time. We cannot predict whether or when potential legislation or new regulations will be enacted, and if enacted, the effect that new legislation or any implemented regulations and supervisory policies would have on our financial condition and results of operations. The Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), by way of example, contains a comprehensive set of provisions designed to govern the practices and oversight of financial institutions and other participants in the financial markets. The Dodd-Frank Act made extensive changes in the regulation of financial institutions and their holding companies. Some of the changes brought about by the Dodd-Frank Act were modified by the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 (the “Regulatory Relief Act”), signed into law on May 24, 2018. The Dodd-Frank Act has increased the regulatory burden and compliance costs borne by the Company. The Dodd-Frank Act also modified the standard by which state consumer financial laws may be applied to national banking associations, such as the Bank. The application of that standard by state regulators and the courts may cause the Bank’s compliance burden and costs to increase. Moreover, bank regulatory agencies appear to be increasingly aggressive in responding to concerns and trends identified in examinations, which could result in higher frequency initiation of enforcement actions against financial institutions to address credit quality, liquidity, risk management and capital adequacy, as well as other safety and soundness concerns.
10
Regulation of Capital Bancorp, Inc.
We are registered as a BHC under the BHC Act and are subject to regulation and supervision by the Federal Reserve. The BHC Act requires us to secure the prior approval of the Federal Reserve before we own or control, directly or indirectly, more than 5% of the voting shares or substantially all of the assets of any bank or thrift, or merge or consolidate with another bank or thrift holding company. Further, under the BHC Act, our activities and those of any nonbank subsidiary are limited to: (i) those activities that the Federal Reserve determines to be so closely related to banking as to be a proper incident thereto, and (ii) investments in companies not engaged in activities closely related to banking, subject to quantitative limitations on the value of such investments. Prior approval of the Federal Reserve may be required before engaging in certain activities. In making such determinations, the Federal Reserve is required to weigh the expected benefits to the public, such as greater convenience, increased competition and gains in efficiency, against the possible adverse effects, such as undue concentration of resources, decreased or unfair competition, conflicts of interest and unsound banking practices.
Regulation of Capital Bank
The operations and investments of our Bank are subject to the supervision, examination and reporting requirements of the National Bank Act and the regulations of the OCC as well as other federal banking statutes and regulations, including with respect to the level of reserves that our Bank must maintain against deposits, restrictions on the types, amount, and terms and conditions of loans it may originate, and limits on the types of other activities in which our Bank may engage and the investments that it may make. The OCC also has the power to prevent the continuance or development of unsafe or unsound banking practices and other violations of law. Because our Bank’s deposits are insured by the FDIC to the maximum extent provided by law, it is also subject to certain FDIC regulations, and the FDIC has backup examination authority and some enforcement powers over our Bank. If, as a result of an examination of our Bank, the regulators should determine that the financial condition, capital resources, asset quality, earnings prospects, management, liquidity or other aspects of the Bank’s operations are unsatisfactory or that the Bank or our management is violating or has violated any law or regulation, various remedies are available to the regulators. Such remedies include the power to enjoin unsafe or unsound practices, require affirmative action to correct any conditions resulting from any violation or practice, issue an administrative order that can be judicially enforced, direct an increase in capital, restrict growth, assess civil monetary penalties and remove officers and directors. The regulators also may request the FDIC to terminate the Bank’s deposit insurance.
Capital Adequacy Guidelines
Bank holding companies and banks are subject to various regulatory capital requirements administered by state and federal agencies. See “Part II, Item 8. Financial Statements and Supplementary Data - Notes to Consolidated Financial Statements - Note 14, Capital Standards” for additional regulatory capital information, including the Bank’s and Company’s Leverage Ratio as of December 31, 2023.
Community Reinvestment Act
The CRA requires the federal banking regulatory agencies to assess all financial institutions that they regulate to determine whether these institutions are meeting the credit needs of the communities they serve, including their assessment area(s) (as established for these purposes in accordance with applicable regulations based principally on the location of branch offices). In addition to substantial penalties and corrective measures that may be required for a violation of certain fair lending laws, the federal banking agencies may take compliance with such laws and CRA into account when regulating and supervising other activities. Under the CRA, institutions are assigned a rating of “outstanding,” “satisfactory,” “needs to improve,” or “unsatisfactory.” A rating that is less than “satisfactory” may substantially inhibit the Bank’s opportunities for future growth. An institution’s record in meeting the
11
requirements of the CRA is based on a performance-based evaluation system, and is made publicly available and is taken into consideration in evaluating any applications it files with federal regulators to engage in certain activities, including approval of a branch or other deposit facility, mergers and acquisitions, office relocations, and expansions into non-banking activities. Our Bank received an “outstanding” rating in its most recent CRA evaluation which was in 2021.
In October 2023, the OCC, together with the FRB and FDIC, issued a joint final rule to modernize the CRA regulatory framework. The final rule is intended, among other things, to adapt to changes in the banking industry, including the expanded role of mobile and online banking, and to tailor performance standards to account for differences in bank size and business models. The final rule introduces new tests under which the performance of banks with over $2 billion in assets will be assessed. The new rule also includes data collection and reporting requirements, some of which are applicable only to banks with over $10 billion in assets. Most provisions of the final rule will become effective on January 1, 2026, and the data reporting requirements will become effective on January 1, 2027.
Anti-Terrorism, Money Laundering Legislation and OFAC
The Bank is subject to the Bank Secrecy Act and the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (the “USA PATRIOT Act”). These statutes and related rules and regulations impose requirements and limitations on specified financial transactions and accounts and other relationships intended to guard against money laundering and terrorism financing. The principal requirements for an insured depository institution include (i) establishment of an anti-money laundering program that includes training and audit components, (ii) establishment of a “know your customer” program involving due diligence to confirm the identities of persons seeking to open accounts and to decline to open accounts for those persons unable to demonstrate their identities, (iii) the filing of currency transaction reports for deposits and withdrawals of large amounts of cash and suspicious activities reports for activity that might signify money laundering, tax evasion or other criminal activities, (iv) additional precautions for accounts sought and managed for non-U.S. persons and (v) verification and certification of money laundering risk with respect to private banking and foreign correspondent banking relationships. For many of these tasks, a bank must keep records to be made available to its primary federal regulator. Anti-money laundering rules and policies are developed by a bureau within the Financial Crimes Enforcement Network, but compliance by individual institutions is overseen by its primary federal regulator.
The Bank has established anti-money laundering and customer identification programs and it maintains records of cash purchases of negotiable instruments, files reports of certain cash transactions exceeding $10,000 (daily aggregate amount), and reports suspicious activity that might signify money laundering, tax evasion or other criminal activities pursuant to the Bank Secrecy Act.
The Treasury Department’s Office of Foreign Assets Control (“OFAC”) administers and enforces economic and trade sanctions against targeted foreign countries, persons, non-governmental organizations, associations, and criminal networks, among others, as defined by various Executive Orders and Acts of Congress. OFAC publishes lists of persons that are the target of sanctions, including the List of Specially Designated Nationals and Blocked Persons. Financial institutions are responsible for, among other things, blocking accounts of and transactions with sanctioned persons and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked and rejected transactions after their occurrence. If the Company or the Bank finds a name or other information on any transaction, account or wire transfer that is on an OFAC list or that otherwise indicates that the transaction involves a target of an OFAC-administered sanctions program, the Company or the Bank generally must freeze or block such account or transaction, file a suspicious activity report, and notify the appropriate authorities. Banking regulators examine banks for compliance with the economic sanctions regulations administered by OFAC.
The Bank has implemented policies and procedures to comply with the foregoing requirements.
12
Federal Home Loan Bank Membership
The Bank is a member of the FHLB. Each member of the FHLB is required to maintain a minimum investment in the Class B stock of the FHLB. The Board of Directors of the FHLB can increase the minimum investment requirements in the event it has concluded that additional capital is required to allow it to meet its own regulatory capital requirements. Any increase in the minimum investment requirements outside of specified ranges requires the approval of the Federal Housing Finance Agency. Because the extent of any obligation to increase the level of investment in the FHLB depends entirely upon the occurrence of a future event, the Company is unable to determine the extent of future required potential payments to the FHLB. Additionally, if a member financial institution fails, the right of the FHLB to seek repayment of funds loaned to that institution will take priority (a super lien) over the rights of all other creditors.
Dividends and Share Repurchases
The ability of the Company to pay dividends or to repurchase its common stock, and the ability of the Bank to pay dividends to the Company, may be restricted due to several factors including: (a) the Maryland General Corporate Law ("MGCL," in the case of the Company), (b) covenants contained in any subordinated debentures and borrowing agreements in existence now or that may exist in the future, (c) restrictions on the ability of the Bank to declare dividends under the National Bank Act and OCC regulations (in the case of the Bank), and (d) the general supervisory authority of the FRB and the OCC. Our ability to pay dividends to our stockholders or to repurchase shares of our common stock is subject to the restrictions set forth in the MGCL.
Notification to the FRB is required prior to our declaring and paying a cash dividend to our stockholders during any period in which our quarterly and/or cumulative twelve‑month net earnings are insufficient to fund the dividend amount, among other requirements. Under such circumstances, we may not pay a dividend should the FRB object until such time as we receive approval from the FRB or no longer need to provide notice under applicable regulations. In addition, prior approval of the FRB may be required in certain circumstances prior to our repurchasing shares of our common stock.
In connection with the decision regarding dividends and share repurchase programs, our Board will take into account general business conditions, our financial results, projected cash flows, capital requirements, contractual, legal and regulatory restrictions on the payment of dividends by the Bank to the Company and such other factors as may be deemed relevant. We can provide no assurance that we will continue to declare dividends on a quarterly basis or otherwise or to repurchase shares of our common stock. The declaration of dividends by the Company is subject to the discretion of our Board.
Customer Information Privacy and Cybersecurity
The FRB and other bank regulatory agencies have adopted guidelines for safeguarding confidential, personal, non‑public customer information. These guidelines require each financial institution, under the supervision and ongoing oversight of its board of directors or an appropriate committee thereof, to create, implement, and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazard to the security or integrity of such information, and protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. We have adopted a customer information security program to comply with these requirements.
The Gramm‑Leach‑Bliley Act of 1999 (the “GLBA”) requires financial institutions to implement policies and procedures regarding the disclosure of non-public personal information about consumers to non‑affiliated third parties. The GLBA requires disclosures to consumers on policies and procedures regarding the disclosure of such non-public personal information and, except as otherwise required by law, prohibits disclosing such information except as provided in the Bank’s policies and procedures. We
13
have implemented privacy policies addressing these restrictions that are distributed regularly to all existing and new customers of the Bank.
In March 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing Internet-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.
In November 2021, the federal bank regulatory agencies issued a joint rule establishing computer-security incident notification requirements for banking organizations and their service providers. This rule requires new notification requirements when a banking organization experiences a computer-security incident.
State regulators have been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements.
In July 2023, the SEC adopted rules requiring registrants to disclose material cybersecurity incidents experienced and describe the material aspects of their nature, scope and timing. The rules, which supersede previously interpreted guidance published in February 2018, also require annual disclosures describing a company’s cybersecurity risk management, strategy and governance. These SEC rules, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations. See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity and Item 1C. Cybersecurity for a further discussion of the Company’s risk management strategies and governance processes related to cybersecurity.
Interchange Fees
Under the Durbin Amendment to the Dodd-Frank Act, the FRB adopted rules establishing standards for assessing whether the interchange fees that may be charged with respect to certain electronic debit transactions are “reasonable and proportional” to the costs incurred by issuers for processing such transactions. Interchange fees or “swipe” fees are charges that merchants pay to the Company and other card-issuing banks for processing electronic payment transactions. The FRB has ruled that for financial institutions with assets of $10 billion or more the maximum permissible interchange fee for an electronic debit transaction is the sum of 21 cents per transaction and 5 basis points multiplied by the value of the transaction. The FRB also has rules governing routing and exclusivity that require issuers to offer two unaffiliated networks for routing transactions on each debit or prepaid product. In October 2023, the Federal Reserve issued a proposal under which the maximum permissible interchange fee for an electronic debit transaction would be the sum of 14.4 cents per transaction and 4 basis points multiplied by the value of the transaction. While financial institutions with less than $10 billion in assets, like the Company, are exempt, there is concern that these requirements will eventually be pushed down to all financial institutions, which would negatively impact the Company’s non-interest income.
14
Consumer Financial Protection Bureau
The Dodd-Frank Act created a new, independent federal agency called the Consumer Financial Protection Bureau (“CFPB”), which is granted broad rulemaking, supervisory and enforcement powers under various federal consumer financial protection laws, including the Equal Credit Opportunity Act, Truth in Lending Act, Real Estate Settlement Procedures Act, Fair Credit Reporting Act, Fair Debt Collection Act, the Consumer Financial Privacy Provisions of the Gramm-Leach-Bliley Act, and certain other statutes. The CFPB has examination and primary enforcement authority with respect to depository institutions with $10 billion or more in assets. Smaller institutions are subject to rules promulgated by the CFPB but continue to be examined and supervised by federal banking regulators for consumer compliance purposes. The CFPB has authority to prevent unfair, deceptive, or abusive practices in connection with the offering of consumer financial products. In January 2024, the CFPB proposed rules that would subject (with certain exceptions) overdraft services provided by financial institutions with more than $10 billion in assets to the provisions of the Truth in Lending Act and other consumer financial protection laws. Although the CFPB excluded banks with under $10 billion in assets from this rule, the Company is currently evaluating the potential impact of the proposed rules and monitoring developments with respect thereto based on the CFPB’s apparent concern around deposit-related fee assessment. On March 5, 2024, the CFPB issued a final rule amending provisions in Regulation Z that govern credit card late fee charges to lower the safe harbor amount for past due fees that a credit card issuer can charge on consumer credit card accounts from up to $41 to $8 and eliminates a higher safe harbor dollar amount for late fees for subsequent violations of the same type. This rule only applies to card issuers, that together with their affiliates, have one million or more open credit card accounts. Smaller card issuers, like the Bank, may continue to charge a higher safe harbor threshold for credit card late fees and automatically increase the safe harbor dollar amount based on the Consumer Price Index. Although the final rule exempts smaller card issuers, the Company will continue to monitor penalty fee policies, particularly as the CFPB and other regulators have demonstrated a focus on regulating so-called junk fees.
Deposit Insurance
The Bank is a national banking association, regulated by the OCC. The Bank accepts deposits, and those deposits have the benefit of FDIC insurance up to the applicable limits established by law. The applicable statutory limit for FDIC insurance for most types of accounts is $250,000.
Under the FDIC's risk-based deposit premium assessment system, the assessment rates for an insured depository institution are determined by an assessment rate calculator, which is based on a number of elements that measure the risk each institution poses to the Deposit Insurance Fund. The calculated assessment rate is applied to average consolidated assets less the average tangible equity of the insured depository institution during the assessment period to determine the dollar amount of the quarterly assessment. Under the current system, premiums are assessed quarterly and could increase if, for example, criticized loans and leases and/or other higher risk assets increase or balance sheet liquidity decreases.
Under the Federal Deposit Insurance Act, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC. In the event any insured depository institution, such as the Bank, is placed into FDIC receivership due to the termination of deposit insurance, or for any other reason, and the institution is sold or liquidated, the chances of the institution's parent BHC's shareholders recovering any value is very unlikely.