Regulatory Framework

OCC TPRM, FFIEC, FDIC Part 365, Reg ZZ, ECB NPL Guidelines, Basel III — synthesized as practitioner reference.

NPL workout engagements operate inside a layered regulatory framework. US national banks answer to the OCC; state-chartered banks to state regulators plus the FDIC; bank holding companies to the Federal Reserve; consumer-protection compliance to the CFPB; cross-border activity to the European Central Bank for European NPL portfolios. Below: the regulations that most frequently determine what a workout advisor can and cannot do, how an institution structures the engagement, and what documentation the bank examiner expects to see.

This is practitioner reference, not regulatory opinion. Discussion below reflects publicly-available regulatory framework synthesis. Specific compliance opinions for an institution or transaction require qualified bank regulatory counsel.

1. OCC Bulletin 2023-17 — Interagency Guidance on Third-Party Relationships

The Office of the Comptroller of the Currency, jointly with the Federal Deposit Insurance Corporation and the Board of Governors of the Federal Reserve System, issued Bulletin 2023-17 establishing risk-management expectations for banking organizations engaging third-party relationships. The guidance applies across the lifecycle: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination.

The Five Lifecycle Stages

• Planning. The bank assesses whether the third-party relationship is appropriate given strategic objectives, risk appetite, and resource capacity. For an NPL workout advisor engagement, planning includes whether the bank has the in-house capacity to handle the workout or whether external specialization is warranted.
• Due diligence and third-party selection. Assessment of the vendor's ability to perform as expected, adherence to bank policies, regulatory compliance posture, and ability to conduct activities in a safe and sound manner. For NPL workout advisors, due diligence typically reviews track record, references, professional licensure, regulatory clean record, AI-tooling-and-disclosure posture, and engagement-letter terms.
• Contract negotiation. Documented terms including scope, deliverables, pricing, conflict resolution, regulatory compliance representations, audit rights, and termination triggers.
• Ongoing monitoring. Periodic reassessment of vendor performance, regulatory posture, and risk profile throughout the engagement.
• Termination. Documented exit process including knowledge transfer, return of bank-confidential information, and ongoing-obligation handling.

Risk-Based Proportionality

Sound third-party risk management is risk-based. A community bank engaging an NPL workout advisor for a $2M loan workout applies lighter documentation than a regional bank engaging a vendor for a $200M portfolio review. The 2024 Community Bank TPRM Guide explicitly recognizes proportionality — community banks should not be held to the same documentation depth as large national banks for equivalent activities.

2. OCC 2024 Community Bank TPRM Guide

The May 2024 Community Bank TPRM Guide implements Bulletin 2023-17 for the community-bank-sized institution. Key practitioner takeaways for NPL workout vendor engagement:

• Lighter documentation appropriate for proportionate risk. Engagement letter + reference checks + license verification + AI-tooling disclosure is often sufficient for community-bank NPL workout vendor engagement.
• Ongoing monitoring need not be formal quarterly review. Status calls + interim deliverable review + post-engagement debrief can satisfy ongoing monitoring requirements for proportionate-risk engagements.
• Contract termination must be documented. Even community banks must document the formal end of the engagement and the disposition of bank-confidential information.

3. FFIEC Compliance Rating System

The Federal Financial Institutions Examination Council established a compliance rating system in 1980, updated effective March 31, 2017. The current system evaluates a bank's overall compliance program on a 1-to-5 scale (1 = strong; 5 = critically deficient). Compliance expectations explicitly extend to third-party relationships — a bank's TPRM posture for workout vendor engagement is evaluated as part of the overall compliance examination.

For workout vendors, this means engagement-letter terms, ongoing-monitoring documentation, and disclosure posture matter not only for the immediate engagement but as inputs to the bank's overall compliance rating. Vendors that produce vendor-ready documentation packages (engagement letter + scope + deliverable list + disclosure terms + termination protocol) reduce the bank's documentation burden in the next FFIEC examination cycle.

4. FDIC Part 365 — Real Estate Lending Standards

FDIC Part 365 establishes minimum standards for real estate lending practices, including loan-to-value limits, real estate appraisal requirements, and supervisory loan-to-value limit policies. For NPL workouts specifically, Part 365 informs:

• Workout valuations. When a bank modifies or restructures a real-estate-secured NPL, the appraisal documentation must satisfy Part 365 standards if the modification changes the LTV calculation or extends amortization beyond Part 365 thresholds.
• Real-estate-collateralized DPO transactions. When a bank sells a real-estate-secured note at a discounted payoff, the documentation supporting the discount must demonstrate that the discount reflects fair market value under Part 365-compliant appraisal methodology.
• Note sale price documentation. When a bank disposes of an NPL portfolio through note sale, the bid documentation should reflect Part 365-aligned valuation methodology to support the bank's pricing decision in the examination record.

5. Regulation ZZ — Truth in Lending Modifications

Regulation ZZ (12 CFR Part 1026) implements the Truth in Lending Act and applies to residential mortgage modifications, restructurings, and workouts. For NPL workouts touching residential mortgages, Reg ZZ informs:

• Modification disclosures. When a residential mortgage is modified through workout, certain disclosures may be required depending on the modification structure.
• Foreclosure-rescue boundary. Reg ZZ requirements intersect with state foreclosure-rescue regulations (in Arizona, ARS 33-2201 et seq.) and with FTC Mortgage Assistance Relief Services Rule (MARS / FTC MAP Rule). Practitioners must navigate the intersection carefully.
• Practice scope discipline. NPL workouts touching residential mortgages require Reg ZZ awareness even when the workout advisor is not the regulated entity — the advisor's framing of the workout options must not inadvertently put the bank on the wrong side of Reg ZZ disclosures.

6. ECB NPL Guidelines (Cross-Border Reference)

The European Central Bank issued the NPL Guidelines in March 2017 and updated them in 2018, establishing supervisory expectations for European banks managing non-performing loan portfolios. While ECB Guidelines do not directly apply to US workouts, they're load-bearing reference for US distressed debt funds active in European NPL acquisitions — Cerberus (€22B+ European distressed assets), Apollo, Lone Star, and other US-based funds operate substantial European NPL platforms.

Key ECB NPL Guidelines Components

• Governance and operations. Banks must have a dedicated NPL management function with clearly defined governance, separated from origination, with reporting lines independent of the originating business unit.
• Forbearance. Definitions and treatment of forbearance measures (loan modifications offered to borrowers in financial difficulty).
• NPL recognition. Definitions of default and non-performing status aligned with EBA technical standards.
• Impairment measurement. IFRS 9 expected-credit-loss framework application to NPL portfolios.
• Valuation of immovable collateral. Frequency, methodology, and independence requirements for real estate collateral underlying NPL portfolios.
• Disposal strategy. Bank's NPL reduction strategy must be documented and consistent with the bank's risk appetite.

For US fund-side counterparties evaluating European NPL portfolio acquisitions, ECB Guidelines inform expected documentation quality from the European seller bank — bid diligence should expect Guidelines-compliant documentation depth and challenge any portfolio where it's absent.

7. Basel III Risk-Weighting

The Basel III framework, implemented in the US through OCC, FDIC, and Federal Reserve capital rules, assigns risk weights to bank assets that determine regulatory capital requirements. NPL portfolios attract higher risk weights than performing loans, with the risk weight depending on:

• Collateral type. Real-estate-secured NPLs typically attract 100% risk weight; unsecured commercial NPLs may attract 150% risk weight.
• Provisioning level. Higher loan-loss provisioning reduces risk-weighted asset impact; insufficient provisioning amplifies it.
• Past-due bucket. Loans 90-180 days past due may attract different treatment than loans 180+ days past due.

For workout decisions, Basel III capital impact is a frequently-underweighted factor. A workout path that converts an NPL into a performing loan via modification frees up risk-weighted capital — sometimes worth more to the bank than the difference in expected loss between workout paths. Workout advisors who model the capital impact of each workout path provide higher-value analysis than those who model only expected loss.

8. CFPB Supervision and Examination Manual

The Consumer Financial Protection Bureau Supervision and Examination Manual addresses consumer-protection compliance for federally-regulated financial institutions, including bank consumer-mortgage workout activity. The Manual explicitly extends consumer-protection expectations to third-party relationships — bank vendors handling consumer-mortgage workouts must satisfy CFPB-aligned consumer-protection posture (clear disclosures, no UDAAP — unfair, deceptive, or abusive acts and practices — in the workout offering, accurate communications, documented dispute-resolution channels).

For NPL workout vendors touching consumer mortgages, CFPB-aligned engagement-letter language and disclosure posture protects both the bank and the vendor. Engagement letters should explicitly acknowledge CFPB scope where applicable and document the vendor's UDAAP discipline.

The Practitioner View — How These Frameworks Interact

The frameworks above don't operate in isolation. A typical NPL workout engagement might touch:

• OCC TPRM for the bank-vendor engagement structure
• FFIEC Compliance Rating implications for the bank's overall compliance posture
• FDIC Part 365 for workout valuation and appraisal documentation
• Reg ZZ if residential mortgages are touched
• Basel III capital impact analysis for workout path selection
• CFPB scope if consumer-protection compliance applies
• ECB Guidelines if cross-border European NPL acquisition is in scope

An AI-augmented practice maintains a Compliance Knowledge Base that cross-references all of these regimes — a single workout decision can be evaluated against all applicable regulatory dimensions in parallel rather than sequentially. This is the Harvard AGENT framework expansion: banking regulation as a 4th regime cluster on top of the existing real estate, finance, and federal/nuclear regime clusters in the Multi-Domain Compliance Layer Agent class project (Harvard Agentic AI Intensive, summer program).

About the Operator

George Howell Ward · Arizona Real Estate Salesperson SA528635000 · Landmark ACM, LLC · Agentic AI Consultant

Wharton Real Estate Investment & Analysis Certificate · UC Berkeley B.S. Civil Engineering (Construction Management emphasis) · Arizona KB-1 Commercial and Residential Contractor (25 years; GWGC LLC ROC #344366) · Harvard Agentic AI Intensive (summer program). Full bio at georgehowellward.com.