Pub 10 2022 Issue 4


Learn more and register: Emerging Bank Leaders is an exciting program developed by bankers to provide networking, education, and career development opportunities for the next generation of bank leaders! JOIN OUR TEAM! Annual Membership Only $50! Includes access to: Networking Events Mentor Match Program Leadership Opportunities on EBL Committees Access to Leadership Insights from Bank Executives Community Service Banker Meet-Ups ..And More!

Issue 4. 2022 1 Howard M. Headlee President Becky Wilkes Executive Vice President Sara Matute Vice President Beth Parker Director of Education Brian Comstock Director of Communications & Marketing UBA Staff CONTENTS ©2022 Utah Bankers Association | The newsLINK Group, LLC. All rights reserved. Utah Banker is published four times each year by The newsLINK Group, LLC for Utah Bankers Association and is the official publication for this association. The information contained in this publication is intended to provide general information for review, consideration and banker education. The contents do not constitute legal advice and should not be relied on as such. If you need legal advice or assistance, it is strongly recommended that you contact an attorney as to your circumstances. The statements and opinions expressed in this publication are those of the individual authors and do not necessarily represent the views of Utah Bankers Association, its board of directors, or the publisher. Likewise, the appearance of advertisements within this publication does not constitute an endorsement or recommendation of any product or service advertised. Utah Banker is a collective work, and as such, some articles are submitted by authors who are independent of Utah Bankers Association. While Utah Bankers Association encourages a first-print policy, in cases where this is not possible, every effort has been made to comply with any known reprint guidelines or restrictions. Content may not be reproduced or reprinted without prior written permission. For further information, please contact the publisher at 855.747.4003. 2 The Bottom Line By Howard Headlee, President and CEO, Utah Bankers Association 3 Upcoming UBA Events 2023 4 Washington Update Reining in a Regulator Gone Rogue By Rob Nichols, President and CEO, American Bankers Association 6 UBA Development Programs 7 UBA Fall Compliance Conference By Brian Comstock, Director of Communications & Marketing, Utah Bankers Association 8 Recent Developments in NSF Representments By Shaun Harms, Principal, FORVIS 10 The Edulogue By Beth Parker, Director of Education, Utah Bankers Association 11 Emerging Bank Leaders “Igniting Leadership” Conference By Brian Comstock, Director of Communications & Marketing, Utah Bankers Association 12 Risk Management of Third-Party Relationships By Tracey Levandoski, CRCM, CrossCheck Compliance, LLC 15 UBA Bank Executive Winter Conference By Brian Comstock, Director of Communications & Marketing, Utah Bankers Association 16 Bankers on the Move 17 Executive Development Program Class of 2022 20 Banks Need a Game Plan for Today’s Interest Rate Environment By Rob Blackwell, Chief Content Officer, IntraFi 22 Bank Kudos 26 Climate Change and Climate Risk Management for Banks By Julia A. Gutierrez, Director of Education, Compliance Alliance 28 UBA Associate Members 31 Managing CRE Exposure in an Uncertain Market By Jay Kenney, SVP & SouthwestRegional Manager, PCBB 8 26 20 31 2 The Bottom Line Howard Headlee President and CEO Utah Bankers Association Many people today have become so invested in political narratives that the reality right in front of them can become blurred. In some cases, the inability to focus on what is real is driven by innocent confusion. In others, it is the result of a conscious intent to deceive. Either way, when our policies are driven by narrative instead of reality, we inevitably experience pain. Eventually, reality always prevails, and whatever distance we have put between ourselves and reality must be reconciled, at a cost. I have a front-row seat at the intersection where the extreme ESG narrative and the markets collide, a collision I have seen coming for a while now. Even though people attribute different meanings to the letters ESG, most agree that a commitment to the environment, fair treatment of all people, and good governance are essential in a free society. However, some political advocates have used these principles to attempt to unilaterally impose their extreme agenda. The narrative used to promote the extreme ESG agenda is complex, passionate, and powerful. Like all narratives, it contains just enough facts to drive its loyalists to demand a full and unqualified surrender from any and all opposition. For them, any dispute or denial is unacceptable. As we enter the winter months, we all appreciate the fossil fuels that heat our homes. In Utah, this is mostly natural gas, and there is no cleaner alternative today for keeping our homes warm. Financing the exploration, recovery and transmission of natural gas today is essential and does not preclude better energy alternatives in the future. But apparently, those committed to the extreme ESG narrative disagree. Their commitment to their narrative would separate us from reality and lead to pain, or in this case, even death. As with all political narratives, pushback, debate, and discovery are essential. The key here is to focus the debate on reality, and from various points of view. However, the debate becomes more dangerous when opponents fight the extreme ESG narrative by constructing their own passionate narrative. Combating a narrative with an opposing narrative instead of focusing the debate on the facts leads everyone further from reality and exacerbates societal pain. Fortunately, many public officials and leaders of community and business remain committed to making decisions based on reality. Bankers are an important part of this group. Our job is to allocate our community’s precious, limited capital to the best and highest good. Of course, there can be a healthy discussion about what is “best” and “highest,” but that is ultimately determined by the realities of the market, not political narratives. During a recent Congressional hearing, a promoter of the extreme ESG narrative confronted the leader of the largest bank in America, demanding his bank stop making loans to the oil and gas industry. His response was perfect: “That would be the road to Hell in America.” He was right! We live in a Democratic Republic, and if a member of Congress wants to starve the oil and gas industry of capital, she needs to draft legislation and get the votes to make it law. That’s her job. Subverting that process by unilaterally pressuring banks to stop lending to legal businesses essential to our health and safety would indeed be the road to Hell for America. As we fashion our responses to some of today’s most dangerous political narratives, policymakers should de-escalate by focusing their efforts on facts, not fears, to ensure their remedies remain connected to reality and avoid unintended and unnecessary pain in the long run. n

Issue 4. 2022 3 FDIC Community Bankers Workshop Wasatch Retreat Center Salt Lake City, UT January 26 February 9-10 Ag Outlook & Conference Dixie Event Center St. George, UT March 9 IT & Cybersecurity Conference Virtual Event April 13 Women in Banking Conference Radisson Hotel Salt Lake City, UT June 25-28 115th Annual UBA Convention Sun Valley, Idaho September TBA 7th Annual Utah Banks & Partners Golf Classic Old Mill Golf Course Salt Lake City, UT September 26 Community Reinvestment Conference Rice-Eccles Stadium Salt Lake City, UT November 6-8 Fall Compliance Conference Location TBA November TBA Emerging Bank Leaders Conference Location TBA December 1 Bank Executive Winter Conference Little America Hotel Salt Lake City, UT Mark your calendar! More information at UTAH.BANK. 4 Washington Update Rob Nichols President and CEO American Bankers Association REINING IN A REGULATOR GONE ROGUE In an American Banker op-ed earlier this year, I called out the CFPB under the leadership of Rohit Chopra as a “regulator gone rogue.” I’m not alone in my criticism: in September, 12 Republican lawmakers took the bureau to task over what they called a “radical and highly-politicized agenda unbounded by statutory limits.” Unfortunately, the bureau has continued to push legal boundaries on several different fronts in recent months. Another alarming step by the Chopra bureau was its decision to update the UDAAP section of its exam manual in a way that fundamentally upends the regulatory approach to fair lending supervision and enforcement, without providing industry stakeholders or the public the opportunity to provide feedback through the notice and comment process under the Administrative Procedure Act. Instead, the CFPB chose to take a backdoor route to expand its authority – giving itself the ability to examine for alleged disparate treatment or impact across all areas of bank operations using the authorities granted by the DoddFrank Act under its authority to prevent “unfair, deceptive or abusive acts or practices.” In reality, the CFPB’s authority to enforce anti-discrimination laws is limited to credit products. It’s clear that this move is an attempt by the bureau to set itself up as a “super-regulator” of financial practices using authority Congress did not give it. First, the bureau has waged an aggressive PR campaign against so-called “junk fees” – using a term it coined to demonize the legitimate fees, including overdraft fees, that banks charge consumers for the products and services they offer. Throwing these fees in with things like concert ticket processing fees, resort fees and other surprise fees charged by retailers and hospitality businesses was a deliberate move to confuse the public about the well-disclosed fees they currently pay. (For the record, banks don’t charge resort or ticket fees, nor does the CFPB have authority to regulate those types of fees.)

Issue 4. 2022 5 “To be clear: ABA fully supports the fair enforcement of the nation’s anti-discrimination laws. We simply believe these laws should be enforced by regulators within the boundaries set by Congress.” To be clear: ABA fully supports the fair enforcement of the nation’s anti-discrimination laws. We simply believe these laws should be enforced by regulators within the boundaries set by Congress. This updated manual does not qualify. Given that the bureau has not seen fit to rescind the manual – despite previous calls from ABA and other trade groups – we were left with no choice but to pursue legal action. ABA’s lawsuit – filed in late September jointly with the U.S. Chamber of Commerce, the Longview Chamber of Commerce, the Texas Bankers Association, the Independent Bankers Association of Texas, the Texas Association of Business and the Consumer Bankers Association – alleges violations of the APA in three ways. First, the bureau is exceeding its statutory authority outlined in Dodd-Frank, which is clear that “unfairness” under UDAAP and discrimination are distinct concepts that should not be conflated. Second, the updated manual is “arbitrary and capricious,” in violation of the APA. Finally, it violates the APA’s procedural requirements because it constitutes a legislative rule that failed to go through notice and comment. It’s never our preference to take legal action against a regulator. And this lawsuit doesn’t mean we’ve given up on finding common ground with the bureau. In fact, on issues like the need to protect consumer data, the need to make sure nonbanks face the same regulatory requirements as banks for similar activities, or the importance of relationship banking, our goals are very much aligned. But when a regulator – any regulator – takes a step like this to dramatically expand its regulatory reach without authorization from Congress or any opportunity for the public to weigh in, ABA will respond on behalf of our members and the industry we represent. n Email Rob at FEEL SECURE. BE SECURE. Contact us today! 801.489.9600 Video Surveillance Electronic Alarm Systems Vault and Safe Locks Access Control Under Counter Steel Pneumatic Drive Up Equipment Deal Drawers Audio/Visual Sound Systems Networking/Structured Wiring

UBA DEVELOPMENT PROGRAMS 2023 LEARN MORE AT UTAH.BANK/DEVELOPMENT A six course program to further develop basic analytical and specialized skills necessary to effectively support the commercial or business lending functions in the bank. Classes begin March 15 CREDIT ANALYST DEVELOPMENT PROGRAM A comprehensive 12-month course for aspiring executives to step up their career and for institutions to invest in the strong bank leaders of tomorrow. Classes begin January 19 EXECUTIVE DEVELOPMENT PROGRAM The CLDP course emphasizes the entire commercial loan life cycle, and provides participants with current lending approaches, as well as an updated focus on key analytics and regulatory issues. Classes begin September 7 COMMERCIAL LENDING DEVELOPMENT PROGRAM

Issue 4. 2022 7 The UBA Fall Compliance Conference took over the Doubletree Hotel in Park City for three cold and snowy days, Oct. 25-27, 2022. Over the course of the conference, attendees heard from several compliance and subject experts, including multiple sessions with David Dickinson from Banker’s Compliance Consulting, Julia Gutierrez from Compliance Alliance, Monika McCarthy from CrossCheck Compliance, and Stephanie Lyon from Ncontracts. The group also got the latest industry news and trends from a regulator panel and a UDAAP panel, as well as an economic overview from Robert Spendlove, a discussion of operational risk management by Terry Lee of Protecht, a political update from UBA President Howard Headlee, two different sessions on crypto-related topics, and more. After the business sessions, attendees let their hair down with some fun networking activities, including a spirited Catapult Competition and a lively – and at times intense – Jeopardy! contest. We look forward to seeing everyone again in 2023! UBA FALL COMPLIANCE CONFERENCE By Brian Comstock, Director of Communications & Marketing, Utah Bankers Association 8 Assessment of non-sufficient funds fees (NSF) on representments of items, such as Automated Clearing House (ACH) withdrawals and checks, have been a heightened risk issue for financial institutions. While this is not a new issue because checks have been represented for decades, the volume of electronic transactions over that same period has drastically increased. The lack of clarity around how much one bill hitting a consumer’s account could cost them in a negative balance situation creates the heightened risk for unfair, deceptive, or abusive acts or practices (UDAAP). The FDIC noted this information in the March 2022 Supervisory Highlights; however, on Aug. 18, 2022, a Financial Institution Letter (FIL), Supervisory Guidance on Multiple Representment NSF Fees1, was issued. In the FIL, the FDIC notes the issuance of this guidance presents an elevated risk of violations of law and harm to customers. The guidance outlines the consumer compliance, third-party, and litigation risks associated with the handling of NSF and provides for several risk management procedures to assist institutions in minimizing the risks related to potential unfair or deceptive practices. Based on these areas outlined, there are a few takeaways institutions need to be prepared for regarding representments: 1. Account Disclosures – Deposit account disclosures, such as terms and conditions, truth in savings disclosures, and RECENT DEVELOPMENTS IN NSF REPRESENTMENTS By Shaun Harms, Principal, FORVIS fee schedules, must be updated to show that representments of items can occur and could result in multiple fees to the customer. 2. Unfair Practices – The FDIC specifically noted that while revising disclosures may address the risk of deception, doing so may not fully address the unfairness risk of assessing NSF fees on the same item represented multiple times. This means the disclosure change alone may not be the full solution for this issue, more of a bandage for now. 3. Third-Party Risk – Third parties, including core processors, often play significant roles in processing payments, such as identifying and tracking represented items and providing systems that determine when NSF fees are assessed. Such third-party arrangements may present heightened UDAAP risk if not properly managed. Institutions are expected to maintain adequate oversight of third-party activities and appropriate quality control over products and services provided through third-party arrangements. When a utility bill payment, for example, is presented up to four times by the utility company’s processor of batch ACH transactions, it could result in four charges to the customer. That could significantly impact the average consumer who does not understand or realize they can be charged multiple times for the same utility bill, and institutions need to identify any risks or controls they can put in place. Industry system providers in this

Issue 4. 2022 9 space are not ready for the handling and discernment between items and when it is a representment instead of a newly presented item. Some vendors have reported updates will not be ready until 2023 for this issue; some could be as late as midyear. This is the immediate issue, and institutions cannot be expected to review each NSF manually. Until a solution is presented, there will continue to be a risk for the institutions. The question is, what can you do now to help minimize the UDAAP risk? The FDIC addressed its approach in the guidance issued as follows: “When exercising supervisory and enforcement responsibilities regarding multiple representment NSF fee practices, the FDIC will take appropriate action to address consumer harm and violations of law. The FDIC’s supervisory response will focus on identifying representment-related issues and ensuring correction of deficiencies and remediation to harmed customers. In reviewing compliance management systems, the FDIC recognizes an institution’s proactive efforts to self-identify and correct violations. Examiners will generally not cite UDAP violations that have been self-identified and fully Shaun Harms serves as the principal for the Financial Services Practice out of FORVIS’ Little Rock office. His expertise is within the regulatory compliance area and focuses on community financial institutions. He has 19 years of consulting experience and has worked with more than 100 banks with their compliance and Bank Secrecy Act (BSA) programs and is a featured speaker at many events. In reviewing compliance management systems, the FDIC recognizes an institution’s proactive efforts to selfidentify and correct violations. corrected prior to the start of a consumer compliance examination. In addition, in determining the scope of restitution, the FDIC will consider an institution’s record-keeping practices and any challenges an institution may have with retrieving, reviewing, and analyzing re-presentment data, on a case-by-case basis, when evaluating the time period institutions utilized for customer remediation. Failing to provide restitution for harmed customers when data on re-presentments is reasonably available will not be considered full corrective action. If examiners identify violations of law due to re-presentment NSF fee practices that have not been self-identified and fully corrected prior to a consumer compliance examination, the FDIC will evaluate appropriate supervisory or enforcement actions, including civil money penalties and restitution, where appropriate.” Therefore, if you are an FDIC-supervised institution, you need to be proactive and try to identify potentially harmed customers and develop a plan for corrective action. This may include a lookback for restitution. If you are not an FDIC-supervised institution, you should remain on high alert because this has escalated quickly and could with the other agencies as well. n 801.532.1500 RQ&N_Tingey Award Print Ad_Final.indd 1 11/9/22 2:22 PM 1. 10 THE EDULOGUE: BANK TRENDS FOR 2023 By Beth Parker, Director of Education, Utah Bankers Association Banks want to attract and retain talent but cannot compete based on remuneration alone to motivate staff. They must create a cohesive team, a likable workplace culture, and a productive learning environment to support their employees' professional and financial development. Creating a cohesive environment that facilitates learning and development will be a top trend in the banking industry in 2023. It is evident that the disruption caused by the pandemic has transformed how people’s practices will be configured in the banking industry for a long time to come. From enabling remote working to focusing on human capital needs like reskilling the workforce and managing digital disruptions, training and development will be critical to building an agile, collaborative, and learning-focused organization. Given how quickly the financial sector is entering the digital sphere, upskilling is essential. To function more effectively in the modern workplace, the banking professional's role must be adjusted to include digitalization and digitization skills. “If digitization is a conversion of data and processes, digitalization is a transformation.” More than just making existing data digital, digitalization embraces the ability of digital technology to collect data, establish trends and make better business decisions. The top goal for bank leadership and HR in the banking sector will be assisting managers and staff in managing data. To be successful, the bank of the future will need to embrace emerging technology, remain flexible to adopt evolving business models, and put employees and customers at the center of every strategy. The banking industry is positioned to witness a whirlwind of changes in the coming year. These trends will transform processes and systems and shape the future of the industry. Banking the training and development of staff. Go to the Education & Events tab at to find the certification, webinar, and ondemand training programs you need to make 2023 the best training year yet. n The banking industry is positioned to witness a whirlwind of changes in the coming year. organizations in this fast-paced world of work will have to go beyond simply coping with change. They will need to face challenges head-on and learn to be agile in the face of disruptive changes. Utah Bankers Association partners with the American Bankers Association, OnCourse Learning, and SBS Cybersecurity to assist Utah banks with

Issue 4. 2022 11 The “Igniting Leadership” Conference – held Nov. 16, 2022 – brought together nearly 100 Emerging Bank Leaders at the beautiful new Zions Tech Center in Midvale, UT, with another 50 or so joining via Zoom. Attendees heard from an impressive lineup of knowledgeable speakers, taking away practical and actionable lessons to apply at their banks today and into the future. UBA Chairman Matt Bloye welcomed the group in the morning, advising everyone to outwork and “out-prepare” the competition and to think strategically about their careers by finding suitable mentors. Then Jeff Strong, former Global President of Johnson & Johnson, discussed leading through crisis. According to Strong, crisis is the best measure and test of a leader, but it’s critical to be prepared by establishing the framework and tools before they are needed. Emerging Bank Leaders Board Chair Hannah Packard gave an update about the EBL community and the exciting year ahead, leading into “Utah Bankers Ignite!”, a fast-paced showcase of four colleagues – Valerie Morrison of Regions | EnerBank, Jessica Sorensen of Zions Bank, Jeff Meyer of Zions Bancorporation, and Becky Wilkes of the Utah Bankers Association. The “edutaining” session didn’t disappoint, inspiring the audience by hitting on topics like gratitude, overcoming obstacles, the challenges of remote work, and living in the moment. The next speaker was Brad Baldwin, President & CEO of First Utah Bank, and he offered several tips and ideas for successful leadership. Baldwin stressed the importance of understanding your company and the industry, and though leadership is very personal, doing simple and practical things will make people follow. Mentoring Committee Chair Valerie Morrison shared information about EBL Mentor Match. Four EBL members shared their experiences with the program, reminding the audience to own their development and that using this tool is a great way to achieve it. After lunch, James Hadlock from Blunovis talked about mental well-being. Leaders are key to creating a sense of value and belonging in the workplace, and they must foster a safe environment and provide resources for people who might need help. Next, Central Bank Chairman Matt Packard shared some leadership insights, recommending that everyone find an outlet to burn stress to remain calm and resilient in a crisis. Author Mark Carpenter closed things out by discussing conf lict and how determining motives and listening are imperative to develop understanding and building trust. He wrapped up the conference with a fun speed networking exercise, applying the numerous lessons learned throughout the day. Keep up to date with Emerging Bank Leaders and learn more about the many program benefits at n EMERGING BANK LEADERS “IGNITING LEADERSHIP” CONFERENCE By Brian Comstock, Director of Communications & Marketing, Utah Bankers Association 12 RISK MANAGEMENT OF THIRD-PARTY RELATIONSHIPS By Tracey Levandoski, CRCM, CrossCheck Compliance, LLC On July 19, 2021, the regulatory agencies issued Proposed Interagency Guidance on Third-Party Relationships: Risk Management. The proposed guidance consolidates all prior guidance, offers a detailed framework covering all stages in the life cycle of third-party relationships, and takes into account the level of risk, complexity, and size of the bank, as well as the nature of the third-party relationship. While it is unclear when the proposal will be finalized, the principles of sound third-party risk management remain the same. Governance and Oversight Under current guidance, the bank’s board of directors and senior management are ultimately responsible for managing activities conducted through third-party relationships to the same extent as if the activities were handled directly by the bank. The proposed guidance states that using third parties does not diminish the bank’s responsibility to perform an activity in a safe and sound manner and in compliance with applicable laws and regulations. For evidence that the regulators will not allow a bank to outsource its accountability and responsibility to third-party providers, one only needs to read a few consent orders in which banks were held accountable for the actions of their third-party providers. The Primary Focus of Third-Party Risk Management – Significant vs. Critical Current guidance focuses the attention of third-party risk management on significant relationships and further defines what types of relationships should be considered significant, such as providers who:  Introduce a new relationship or a new bank activity;  Perform critical functions for the bank;  Have access to sensitive customer information;  Market bank products or services;  Provide products or services involving subprime lending or card payment transactions; or  Pose risks that could significantly affect earnings, capital, or the bank’s reputation. Additionally, the nature of risk in the context of the current or planned use of a third party should be understood in conjunction with the risk areas you consider in everything else you do:  Strategic Risk – Does the use of the third-party’s services align with the bank’s strategic goals?  Reputation Risk – What risk does using the third party contribute to the bank’s good name in the community?  Operational Risk – Do the third party’s processes integrate compatibly with the bank’s processes?  Transaction Risk – What is the risk of the third party’s failure to perform as expected?  Credit Risk – What is the credit risk of the third party? What credit risk does the third party introduce when using proprietary credit models for underwriting loans on the bank’s behalf (for example)?  Compliance Risk – What is the exposure if the third party violates laws or fails to comply with the bank’s internal policies? The proposed guidance is intended for all third-party relationships but is especially important for relationships that are relied on to a significant extent entail greater risk and complexity, and involve critical activities. Critical activities:  Cause significant risks if the third party fails to meet expectations  Have significant customer impacts  Require significant investment in resources to implement the activity and manage the risk  Cause a major impact on the bank’s operations if an alternative must be found or the activity must be brought in-house Regardless of the approach to defining significant or critical service providers, the bank should implement a sound methodology for designating which relationships receive more comprehensive oversight and risk management. The Risk Management Process Under the current guidance, the key to the effective use of a third party is to appropriately assess, measure, monitor, and control the risks associated with the relationship, which includes

Issue 4. 2022 13 a risk assessment, due diligence, contract structuring and review, and ongoing oversight. The proposed guidance significantly expands risk management by introducing the Third-Party Relationship Life Cycle. The Life Cycle starts with the first step of planning, which includes not only a risk assessment that, at a minimum, considers the risk areas described above; identifies performance criteria, internal controls, reporting needs, and necessary contractual requirements; assesses management’s ability to provide adequate oversight; and contemplates the consequences of the provider’s failure. In addition to the risk assessment, planning includes the commensurate steps for appropriate risk management. Planning should be a collaboration among members of management with the requisite expertise and may involve managers from across the bank’s business lines, such as compliance, information technology, and legal counsel, in addition to the area directly impacted by the third party’s product or service. The next step of the Life Cycle is due diligence commensurate with the criticality of the proposed activity and level of risk identified in the risk assessment. Due diligence should include an assessment of the provider’s ability to perform as expected considering its financial condition, business experience, and operational resilience; comply with the bank’s policies as well as applicable federal and state laws; and operate in a safe and sound manner. In some cases, an onsite visit may be warranted. After a provider has been selected, the contract negotiation considers service level agreements, required reporting, compliance with applicable laws and regulations, the bank’s right to audit the provider, complaint and dispute resolution, and the use of subcontractors, among other provisions. Following contract execution and provider onboarding, ongoing monitoring should be performed commensurate with the risk level determined during the planning stage. Ongoing monitoring may be similar to the initial due diligence, with an added focus on fulfilment of contract requirements, and should include an update to the risk assessment based on the results of the monitoring. The final stage of the Life Cycle is the termination of the relationship, which should be handled efficiently to minimize the impact on operations and the bank’s customers. However, termination should really be contemplated during the planning stage, including considering the implications if the provider fails to perform to expectations or, in the worst-case scenario, the provider ceases operations. Woven into the proposed guidance is a focus on fourth parties – a third-party provider’s subcontractors – and bank management The proposed guidance significantly expands upon risk management by introducing the Third-Party Relationship Life Cycle which is depicted in the following Stages of the Risk Management Life Cycle graphic. Source: Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, and Office of the Comptroller of the Currency. Proposed Interagency Guidance on Third-Party Relationships: Risk Management. The use of subcontractors must be considered during all stages of the Life Cycle. → 14 must ensure that if a third-party provider uses subcontractors for any part of the bank’s outsourced activities, the third party provides adequate oversight of its subcontractors. The use of subcontractors must be considered during all stages of the Life Cycle. Oversight of the Third-Party Risk Management Program The Third-Party Relationship Life Cycle also contemplates oversight of the third-party risk management program. While the regulators’ compliance management system (CMS) examination procedures do not include provider oversight as a formal component of the CMS, they do state that compliance expectations extend to provider relationships. Therefore, thirdparty risk management should be incorporated into the bank’s CMS, including:  Policies and procedures that define risk/criticality, minimum due diligence and ongoing monitoring activities based on risk, and minimum contract provisions; and address oversight of and accountability for the program  Training for bank staff responsible for third-party oversight  Monitoring, testing, and audit of the program  Complaint management related to third-party providers Third-party risk management continues to be an increasing regulatory focus. Understanding the details of sound risk management outlined in the proposed guidance and enhancing your third-party risk management program commensurate with the risk level of your bank’s service provider relationships will place the bank in a more favorable position for the next regulatory examination. n Tracey is a managing director at CrossCheck Compliance LLC and a regulatory compliance and risk management professional with over 30 years of experience in the financial services industry. Prior to joining CrossCheck, Tracey was Senior Vice President, Compliance at Standard Bank & Trust, now Old National Bank; and, before that, she was Assistant Vice President, Community Bank Examinations at the Federal Reserve Bank of Chicago. She also previously held positions in compliance, accounting, and operations at community banks. Having worked as both a prudential regulator and in banking institutions, Tracey has demonstrated expertise in compliance, including extensive knowledge of lending and deposit regulations, with a recent concentration on fintech. Tracey can be reached at Utah's #1 Small Business Lender. Eric and Jason Stevens Owners, Maple Leaf Company SBA 504 loan recipients Learn more at: BIG THINGS COME IN SMALL BUSINESSES 801 .474.3232 | mwsbf .com SBA 504 LOAN.

Issue 4. 2022 15 UBA BANK EXECUTIVE WINTER CONFERENCE By Brian Comstock, Director of Communications & Marketing , Utah Bankers Association The UBA closed its conference year with the Bank Executive Winter Conference at the Little America Hotel in Salt Lake City on Dec. 2, 2022. Appropriately titled “The New Year Risk Radar,” this year’s event painted a clear picture of where we are as an industry and what lies ahead in 2023. Wells Fargo Economist Charlie Dougherty kicked off the proceedings with an economic forecast. In his view, it is “more likely than not” that we will see a recession in the second half of next year, but Utah’s population and job growth, among other factors, will hopefully mean a mild downturn. The Regulator Panel is always a highly-anticipated session during this conference, and this year’s group – Paul Dimapawi from the Federal Reserve Bank of San Francisco, Kurt Raney from the OCC, Darryle Rude from the Utah DFI, and Wade Walker from the FDIC – had many insights into their top-of-mind issues, including the “Cs” (cannabis, climate, cybersecurity, CRA, crypto, CRE) and labor force. And they advised the audience that ESG bills are coming from both sides, but their main concern will be risk management, not politics. Next, ABA President Rob Nichols sat down with Howard Headlee to discuss the recent midterm elections and how they might impact banking. Nichols laid out areas where the ABA is on the offensive (SAFE Act), where they are playing defense (Durbin/Marshall Bill), and where they are monitoring (FDIC nominees, House and Senate committees, and the regulatory environment). He also had very firm words about the “misguided” assault on fees – “We should be able to charge fees for services” – and in opposition to the creation of a CBDC – “Let banks be banks.” During lunch, Nichols addressed the UBA Executive Development Program Class of 2022, and the conference concluded with the presentation of the graduates. See page 17 for more. n 16 most recently as a Senior Area Retail Leader for KeyBank’s Utah South region. Amanda Wiscomb joins Key Private Bank as a Senior Financial Planner for Utah. She has more than 15 years of experience in financial services, previously working for Goldman Sachs, Zions Bank, and Silicon Valley Bank. Altabank Altabank welcomed Rebecca Chavez-Houck to their board of directors in October. Known throughout Utah for her contributions to the nonprofit and governmental sectors, she is a managing member of Aspira Public Affairs, an organization providing community outreach planning, media relations, constituent services development, and women’s leadership training, with a particular focus on underrepresented groups. JR Vera has been promoted to Senior Vice President and named manager of the bank’s Northern Region, where he will oversee branches in Salt Lake County, from Riverton to Salt Lake City. JR joined Altabank in early 2022 as a Commercial Loan Officer. He was previously with Chase Bank. Russ Packer has been promoted to Branch Manager in the Altabank Draper branch. Russ joined Altabank 10 months ago from Intercap Lending and has experience as a commercial loan officer with Wells Fargo. First Community Bank Mike Padovich has been promoted to Senior Vice President, Business Development Officer at First Community Bank Utah, Division of Glacier Bank. Mike’s skills and talents have led to extreme growth in the branch he previously managed, and he will be able to use those skills to help other branches in our communities. KeyBank Tyler Blout has been promoted to Utah Market Retail Leader for KeyBank, overseeing 30 branches in Utah, including the new American Fork branch that opened in May 2022. Blout has served in retail banking roles at KeyBank for more than 15 years, BANKERS ON THE MOVE

Issue 4. 2022 17 Congratulations to the 2022 graduates of UBA’s Executive Development Program, honored this year at the Bank Executive Winter Conference at the Little America Hotel on Dec. 2, 2022. This was the 10th group to go through the program, and this year’s class of 41 joins an elite group of 299 EDP alumni throughout the state. We are excited to watch them lead the industry into a very bright future! EXECUTIVE DEVELOPMENT PROGRAM CLASS OF 2022 → 18 2022 GRADUATES Steve Alsup Regional Banking Senior Manager, Wells Fargo Destinee Anderson VP BSA & OFAC Officer, First Community Bank Blaine Bitton Controller, Optum Bank Jenny Bressler Training Director, Central Bank Tim Brosnan VP, Director,Portfolio Management, FinWise Bank Matthew Brunson Senior Vice President, Strategic Partnership Platforms, TAB Bank Raphael Chibota Enterprise Risk Analyst, Glacier Bancorp Jake Christensen Corporate Relationship Manager, Zions Bank Chris Comber VP of Credit Administration, FinWise Bank Brad Dissinger VP of Credit Administration, FinWise Bank Steven Drakulich VP, Community Banking Manager, Hillcrest Bank Casey Dyreng VP/Lending Manager, State Bank of Southern Utah Eli Farnsworth Operations Manager, First Utah Bank Alan Garcia SVP, Commercial Credit Operations, Underwriting Manager, Celtic Bank Breann Garfield AVP Consumer Lending, First Community Bank Luke Harrison Business Development Officer, State Bank of Southern Utah Tyler Heaps Mortgage Dept Manager, Vice President, Central Bank Cindee Himelright VP, Portfolio Manager - Residential Construction & Consumer, Bank of Utah Angie Hunter AVP Account Operations, TAB Bank Ryan Kendrick Director, Credit Policy and Governance, WEX Bank Kraig Kerr Associate Vice President Data Services, TAB Bank

Issue 4. 2022 19 There are limited seats remaining for the 2023 Executive Development Program. Classes start on Jan. 19, 2023. For more information on the program and how to register, visit n 2022 GRADUATES David Kirby SVP, Director of Business Banking, Practice Pathways, Zions Bank Kanita Lipjankic VP, Construction Finance, Celtic Bank Charlie Machinski Associate Vice President, Strategic Project Management, Medallion Bank Mary McBride VP, Digital Experience & Sales Manager, Bank of Utah Nathan Mills VP, Marketing and Training, FinWise Bank Jeff Morton VP & Manager, Marketing Division, Regions | EnerBank Tim Negus Branch Manager, VP, Zions Bank Rob Packer Director of Talent and Learning Development, Altabank Jared Peterson Assistant Manager / Loan Officer, Central Bank Whitney Sanders AVP, Portfolio Manager, TAB Bank Melissa Snell VP/Commercial Loan Officer, Brighton Bank Lance Stott Vice President / Lending Manager, State Bank of Southern Utah Bruce Sweeten Chief Credit Officer, Comenity Capital Bank Jared Taylor AVP Relationship Manager, Bank of Utah Cooper Thomas Director, Deposit Operations, Nelnet Bank Sommer Uzelac VP, EB Accounting Manager, Regions | EnerBank Mike Wells VP Relationship Manager, Bank of Utah Justin Willey Credit Manager, Medallion Bank Christopher Ziebert VP, Director of Data Services, FinWise Bank Eric Zupon AVP, Credit Analyst, First Utah Bank 20 What are you seeing right now vis-a-vis banks and bank balance sheets? The majority of banks aren’t overly concerned about losing relationships. They’re facing deposit pressures in a few areas, but the funds they’ve lost have been mostly discretionary. However, things are about to get interesting. That sounds ominous. What do you mean? During the last rising-rate environment, the Fed took nearly two years to increase rates by 200-225 basis points, and deposit-rate changes were nearly three times as responsive to the second hundred basis points as they were to the first. Similarly, during the period leading up to the Great Recession, we had a 425-basispoint move. Things were pretty tame during the first 200 basis points, but by the third and fourth hundred, the proverbial gloves came off. Rates have now risen uncharacteristically aggressively in a short period of time – in fact, the delta between market rates and what banks are paying has never gotten this wide this fast. Even if depositors aren’t looking to move their money, it’s hard for them to ignore what’s happening. Additionally, during the pandemic, we made it easier to do things electronically and conditioned customers to avoid branches. Today, banking practices are very different than they were three or four years ago. So the dynamics are about to get really interesting, notwithstanding the excess liquidity still out there. What’s your advice to banks? Have a clearly documented game plan. (Many banks don’t.) Start by figuring out how much money you can, or are willing to, let leave; then determine which deposits are most valuable and prioritize those. Next, divide your deposit base into manageable pieces. Start by rank-ordering your largest-balance relationships; this will help with one-off conversations. Second, review your mass-market, traditional banking relationships. Third, review the “tweeners,” or those that aren’t quite whales but larger discretionary balances that could be at risk (mid-tier balances comingled with operating balances in those traditional accounts). Get your people in a room to assess the elasticity of deposits in each sector and your value proposition for those different consumer types, specifically, whether it’s driven by rate or other factors. Figure out your pricing strategy for each and how much outflow you’re willing to accept in each area and why. You recently wrote that all banks have what appear to be core deposits but are actually Trojan Horses. What did you mean? Monies that look like core deposits but have a high potential for disintermediation. Municipal deposits are one kind of Trojan Horse. Large commercial balances are another – many businesses have funds sitting in their banks that dwarf what they need for operations, but they’re also facing cost pressures, and it’s hard to ignore the opportunity to pick up notably incremental yield on BANKS NEED A GAME PLAN FOR TODAY’S INTEREST RATE ENVIRONMENT By Rob Blackwell, Chief Content Officer, IntraFi As the Federal Reserve aggressively hikes interest rates to tamp down inf lation, depositors are starting to demand more for their money. Results from IntraFi’s most recent quarterly survey of bank executives indicate the trend is likely to continue. Ninety-five percent of respondents expect funding costs to go up, and 71% said deposit competition will increase. But this doesn’t mean banks have to let macroeconomic forces or competitors dictate their strategies. Matt Pieniazek, president and CEO of Darling Consulting Group, recently joined me on the Banking with Interest podcast to discuss how banks should think about their balance sheets in the current interest-rate environment. He explains why all institutions need clearly documented game plans, how to extricate rate from the value proposition, why rising rates are a good thing, and much more. What follows is our conversation, edited for length and clarity:

Issue 4. 2022 21 their excess cash. If they do need money, many will “borrow” from themselves. The third kind is CDs. CD balances have contracted notably through this cycle, but much of that is CDmentality money sitting in savings accounts, now accounts, or money markets that’s going to move back into CDs. What should banks be thinking about if rates keep rising? Everyone seems to get overly fixated on rising rates and how high they might go, but no matter what a bank’s interest rate risk profile is, the worst scenario for this industry would be for rates to do an about-face and head lower for three reasons: 1) Funding costs can only go so low, but assets will keep pounding down until eventually everybody’s margins get squeezed – it’s just a matter of how quickly and to what degree; 2) declining rate environments are highly correlated with declining economic environments, which are highly correlated with asset-quality challenges, delinquencies, and elevated reserves; and 3) when economic activity slows, the outlook for loan growth darkens. How is social media adding to deposit pressures? It’s definitely having an effect. But banks need to remember that there’s always somebody paying more than them. If rate were the most important variable, every other bank would go out of business, and you’d have one big bank paying the highest rates. The point I’m making is that if banks fuel conversations about rate to where it becomes the main topic of discussion, they’re communicating that their value proposition is mainly tied to rate instead of the other things they bring to the table. Conversely, depository institutions that believe in their value propositions will do well during this cycle because they’ll know where they can be proactive. They’ll experiment more, try more things. What are your thoughts on strategies for banks that aren’t dealing with excess liquidity? I’ll start by saying there are many banks with concentrations of large balances that don’t want pricing on these to upset the apple cart. They don’t want a handful of accounts messing up their core deposit strategies, so they’ve been paying higher rates than usual. Then they’ve been going and selling the money into a deposit network, such as IntraFi’s, through its One-Way Sell program. This enables them to effectively lower their deposit costs and keep the money out of their deposit expenses by moving it off the balance sheet, knowing they can bring it back on if necessary. Public banks with valuations that reflect a highly inelastic core-deposit base through prior cycles don’t want to change the Street’s perception with beta moves that have nothing to do with their true base of core deposits. They’d prefer to move all their discretionary monies into repos, so they become a borrowing cost, or just sweep them off so they can actually generate some fee income and, in effect, slow the rise in their deposit costs. They’re also starting to worry about reputation risk, which is a first for me (and I’ve been doing this for a long time). Coming back to your question, banks that are borrowing money are actually pushing local market pricing up. They don’t match wholesale, but they’ve got a long runway given the delta between market rates and what other banks are paying. They’ll pay a lot more than other institutions, but they’ll also save a lot. Right now, borrowing banks are facing high opportunity costs, so if they’re dealing with a larger account, they’re more apt to pay up or negotiate. Otherwise, they’ll just have to replace them with something substantially more expensive. Loan growth was good in the second quarter, but in the third quarter, there were signs of it faltering. What have you been hearing? There’s a clear consensus that pipelines have peaked. When we talk to banks about forecasts, many anticipate making half as many loans next year as they will make this year. Hurdle rates are up because of interest rates, there’s lots of uncertainty surrounding any kind of real estate, and businesses aren’t as comfortable making investments right now. Banks themselves are pulling back on some concentrations, asking tougher questions. We’ve seen a lot of disruption in the past two years from COVID and other factors. How should banks be thinking about ALCOs right now? Way too many ALCOs tend to be more of a reporting function that spends too much time creating detailed decks that do little more than give people headaches. Then, toward the end of meetings, they’ll shoehorn in conversations on what to do. Those institutions have it backward. ALCO should feed strategy. It should be a profit center, not the cost center it tends to be. What are the biggest mistakes banks are making today? One is that they’re not changing loan pricing to levels that represent fair, risk-adjusted returns. They’re letting the liquidity overhang get in the way. The majority of banks – not all – are knowingly doing deals at perhaps the tightest spreads ever. But their business models don’t support FHLB plus 150 to 200. They don’t support SOFR plus 150 to 175. They don’t support prime minus 100 or more. Banks have to get away from all that. They can’t let irrational/desperate competition dictate their ongoing lending strategies. They need to improve their balancing act. Another is that many banks don’t socialize the logic underpinning their value propositions. They don’t explain how to deflect objections to those who work on the front lines. They don’t institute formal feedback loops, either. Banks should never underestimate the importance of communication, coaching, and guidance. When we talk to banks about forecasts, many anticipate making half as many loans next year as they will make this year.