Uncategorized

By: Amanda Roth Last week, we discussed how pricing with competition is important to ensure sound decision practices are being implemented in the domains of loan pricing and profitability.  The extreme of pricing too high for the market can obviously be detrimental to your organization.  The other extreme can be just as dangerous. Pricing for your profitability, regardless of what the competition is charging in your area, has a few potential issues associated with it regarding management of risk.  For example, the statistics state you can charge 5 percent in your “A” tier and still be profitable, but the competition is charging 7.5 percent for the same tier.  You may be thinking that by offering 5 percent you will attract the “best of the best” to your organization.  However, what your statistics may not be showing you is the risk outside of your applicant base.  If you significantly change the customers you are bringing in, does your risk increase as well, ultimately increasing the cost associated with each loan?   Increased costs will reduce or even eliminate the profitability you had expected. A second potential issue is setting the expectation within the marketplace.  It is often understood with the consumers that when changes occur to the interest rate at the federal level, there will be changes at their local financial institution.  These changes are often very small.  By undercutting your competition by such an extreme amount, your customers may question any attempts to raise rates more than 50bp, if you do experience increased costs as a result of the earlier situation or any other factors.  A safer strategy would be to charge between 6.5 percent and 7 percent, which allows you to obtain some of the best customers, ensure stability within the market, and take advantage of additional profitability while it is available.  This is definitely a winning strategy for all -- and an important consideration as you develop your portfolio risk management objectives.    

By: Amanda Roth Doesn’t that sound strange: Pricing WITH competition?  We are familiar with the sayings of pricing for competition and pricing to be competitive, but did you ever think you would need to price with competition?  When developing a risk-based pricing program, it is important to make sure you do not price against the competition in any extreme.  Some clients decide they want to price lower than the competition regardless of how it impacts their profitability.  However, others price only for profitability without any respect to their competition.  As we discussed last week, risk-based pricing is 80 percent statistics, but 20 percent art -- and competition is part of the artistic portion. Once you complete your profitability analysis (refer to 12/28/2009 posting), you will often need to massage the final interest rate to be applied to loan applications.  If the results of the analysis are that your interest rate needs to be 8.0 percent in your “A” tier to guarantee profitability, but your competition is only charging 6.0 percent, there could be a problem if you go to market with that pricing strategy.  You will probably experience most of your application volume coming to an end, especially those customers with low risk that can obtain the best rates of a lender.  Creativity is the approach you must take to become more competitive while still maintaining profitability.  It may be an approach of offering the 6.0 percent rate to the best 10 percent of your applicant base only, while charging slightly higher rates in your “D” and “E” tiers. Another option may be that you need to look internally at processing efficiencies to determine if there is a way to decrease the overall cost associated with the decision process.  Are there decision strategies in place that are creating a manual decision when more could be automated?  Pricing higher than the market rate can be detrimental to any organization, therefore it is imperative to apply an artistic approach while maintaining the integrity of the statistical analysis. Join us next week to continue this topic of pricing with competition which is, again, an important consideration when developing a risk-based pricing program.  

By: Tom Hannagan Apparently my last post on the role of risk management in the pricing of deposit services hit some nerve ends. That’s good. The industry needs its “nerve ends” tweaked after the dearth of effective risk management that contributed to the financial malaise of the last couple of years. Banks, or any business, can prosper by simply following their competitors’ marketing strategies and meeting or slightly undercutting their prices. The actions of competitors are an important piece of intelligence to consider, but not necessarily optimal for your bank to copy. One question is regarding the “how-to” behind risk-based pricing (RBP) of deposits. The answer has four parts. Let’s see. First, because of the importance and size of the deposit business (yes, it’s a line of business) as a funding source, one needs to isolate the interest rate risk. This is done by transfer pricing, or in a sense, crediting the deposit balances for their marginal value as an offset to borrowing funds. This transfer price has nothing to do with the earnings credit rate used in account analysis – that is a merchandising issue used to generate fee income. Fees, resulting from account analysis, when not waived, affect the profitability of deposit services, but are not a risk element. Two things are critical to the transfer of funding credit: 1) the assumptions regarding the duration, or reliability of the deposit balances and 2) the rate curve used to match the duration. Different types of deposit behave differently based on changes in rates paid. Checking account deposit funds tend to be very loyal or “sticky” - they don’t move around a lot (or easily) because of rate paid, if any. At the other extreme, time deposits tend to be very rate-sensitive and can move (in or out) for small incremental gains. Savings, money market and NOW accounts are in-between. Since deposits are an offset (ultimately) to marginal borrowing, just as loans might (ultimately) require marginal borrowing, we recommend using the same rate curve for both asset and liability transfer pricing. The money is the same thing on both sides of the balance sheet and the rate curve used to fund a loan or credit a deposit should be the same. We believe this will help, greatly, to isolate IRR. It is also seems more fair when explaining the concept to line management. Secondly, although there is essentially no credit risk associated with deposits, there is operational risk. Deposit make up most of the liability side of the balance sheet and therefore the lion’s share of institutional funding. Deposits are also a major source of operational expense. The mitigated operational risks such as physical security, backup processing arrangements, various kinds of insurance and catastrophe plans, are normal expenses of doing business and included in a bank’s financial statements. The costs need to be broken down by deposit category to get a picture of the risk-adjusted operating expenses. The third major consideration for analyzing risk-adjusted deposit profitability is its revenue contribution. Deposit-related fee income can be a very significant number and needs to be allocated to particular deposit category that generates this income. This is an important aspect of the return, along with the risk-adjusted funding value of the balances. It will vary substantially for various deposit types. Time deposits have essentially zero fee income, whereas checking accounts can produce significant revenues. The fourth major consideration is capital. There are unexpected losses associated with deposits that must be covered by risk-based capital – or equity. The unexpected losses include: unmitigated operational risks, any error in transfer pricing the market risk, and business or strategic risk. Although the unexpected losses associated with deposit products are substantially less than found in the lending products, they needs to be taken into account to have a fully risk-adjusted view. It is also necessary to be able to compare the risk-adjusted profit and profitability of such diverse services as found within banking. Enterprise risk management needs to consider all of the lines of business, and all of the products of the organization, on a risk-adjusted performance basis. Otherwise it is impossible to decide on the allocation of resources, including precious capital. Without this risk management view of deposits (just as with loans) it is impossible to price the services in a completely knowledgeable fashion. Good entity governance, asset and liability posturing, and competent line of business management, all require more and better risk-based profit considerations to be an important part of the intelligence used to optimally price deposits.      

By: Amanda Roth The reality of risk-based pricing is that there is not one “end all be all” way of determining what pricing should be applied to your applicants.  The truth is that statistics will only get you so far.  It may get you 80 percent of the final answer, but to whom is 80 percent acceptable?  The other 20 percent must also be addressed. I am specifically referring to those factors that are outside of your control.  For example, does your competition’s pricing impact your ability to price loans?  Have you thought about how loyal customer discounts or incentives may contribute to the success or demise of your program?  Do you have a sensitive population that may have a significant reaction to any risk-base pricing changes?  These questions must be addressed for sound pricing and risk management. Over the next few weeks, we will look at each of these questions in more detail along with tips on how to apply them in your organization.  As the new year is often a time of reflection and change, I would encourage you to let me know what experiences you may be having in your own programs.  I would love to include your thoughts and ideas in this blog.  

By: Tom Hannagan This blog has often discussed many aspects of risk-adjusted pricing for loans. Loans, with their inherent credit risk, certainly deserve a lot of attention when it comes to risk management in banking. But, that doesn’t mean you should ignore the risk management implications found in the other product lines. Enterprise risk management needs to consider all of the lines of business, and all of the products of the organization. This would include the deposit services arena. Deposits make up roughly 65 percent to 75 percent of the liability side of the balance sheet for most financial institutions, representing the lion’s share of their funding source. This is a major source of operational expense and also represents most of the bank’s interest expense. The deposit activity has operational risk, and this large funding source plays a huge role in market risk – including both interest rate risk and liquidity risk. It stands to reason that such risks are considered when pricing deposit services. Unfortunately it is not always the case. Okay, to be honest, it’s too rarely the case. This raises serious entity governance questions. How can such a large operational undertaking, not withstanding the criticality of the funding implications, not be subjected to risk-based pricing considerations? We have seen warnings already that the current low interest rate environment will not last forever. When the economy improves and rates head upwards, banks need to understand the bottom line profit implications. Deposit rate sensitivity across the various deposit types is a huge portion of the impact on net interest income. Risk-based pricing of these services should be considered before committing to provide them. Even without the credit risk implications found on the loan side of the balance sheet, there is still plenty of operational and market risk impact that needs to be taken into account from the liability side. When risk management is not considered and mitigated as part of the day-to-day management of the deposit line of business, the bank is leaving these risks completely to chance. This unmitigated risk increases the portion of overall risk that is then considered to be “unexpected” in nature and thereby increases the equity capital required to support the bank.

By: Amanda Roth The final level of validation for your risk-based pricing program is to validate for profitability.  Not only will this analysis build on the two previous analyses, but it will factor in the cost of making a loan based on the risk associated with that applicant.  Many organizations do not complete this crucial step.  Therefore, they may have the applicants grouped together correctly, but still find themselves unprofitable. The premise of risk-based pricing is that we are pricing to cover the cost associated with an applicant.  If an applicant has a higher probability of delinquency, we can assume there will be additional collection costs, reporting costs, and servicing costs associated with keeping this applicant in good standing.  We must understand what these cost may be, though, before we can price accordingly.  Information of this type can be difficult to determine based on the resources available to your organization.  If you aren’t able to determine the exact amount of time and costs associated with the different loans at different risk levels, there are industry best practices that can be applied. Of primary importance is to factor in the cost to originate, service and terminate a loan based on varying risk levels.  This is the only true way to validate that your pricing program is working to provide profitability to your loan portfolio.  

By: Amanda Roth To refine your risk-based pricing another level, it is important to analyze where your tiers are set and determine if they are set appropriately.  (We find many of the regulators / examiners are looking for this next level of analysis.) This analysis begins with the results of the scoring model validation.  Not only will the distributions from that analysis determine if the score can predict between good and delinquent accounts, but it will also highlight which score ranges have similar delinquency rates, allowing you to group your tiers together appropriately.  After all, you do not want to have applicants with a 1 percent chance of delinquency priced the same as someone with an 8 percent chance of delinquency.  By reviewing the interval delinquency rates as well as the odds ratios, you should be able to determine where a significant enough difference occurs to warrant different pricing. You will increase the opportunity for portfolio profitability through this analysis, as you are reducing the likelihood that higher risk applicants are receiving lower pricing.  As expected, the overall risk management of the portfolio will increase when a proper risk-based pricing program is developed. In my next post we will look the final level of validation which does provide insight into pricing for profitability.  

By: Amanda Roth As discussed earlier, the validation of a risk based-pricing program can mean several different things. Let’s break these options down. The first option is to complete a validation of the scoring model being used to set the pricing for your program. This is the most basic validation of the program, and does not guarantee any insight on loan profitability expectations. A validation of this nature will help you to determine if the score being used is actually helping to determine the risk level of an applicant. This analysis is completed by using a snapshot of new booked loans received during a period of time usually 18–24 months prior to the current period. It is extremely important to view only the new booked loans taken during the time period and the score they received at the time of application. By maintaining this specific population only, you will ensure the analysis is truly indicative of the predictive nature of your score at the time you make the decision and apply the recommended risk-base pricing. By analyzing the distribution of good accounts vs. the delinquent accounts, you can determine if the score being used is truly able to separate these groups. Without acceptable separation, it would be difficult to make any decisions based on the score models, especially risk-based pricing. Although beneficial in determining whether you are using the appropriate scoring models for pricing, this analysis does not provide insight into whether your risk-based pricing program is set up correctly or not. Please join me next time to take a look at another option for this analysis.

By: Roger Ahern It’s been proven in practice many times that by optimizing decisions (through improved decisioning strategies, credit risk modeling, risk-based pricing, enhanced scoring models, etc.) you will realize significant business benefits in key metrics, such as net interest margin, collections efficiency, fraud referral rates and many more.  However, given that a typical company may make more than eight million decisions per year, which decisions should one focus on to deliver the greatest business benefit? In working with our clients, Experian has compiled the following list of relevant types of decisions that can be improved through improvements in decision analytics.  As you review the list below, you should identify those decisions that are relevant to your organization, and then determine which decision types would warrant the greatest opportunity for improvement. • Cross-sell determination • Prospect determination • Prescreen decision • Offer/treatment determination • Fraud determination • Approve/decline decision • Initial credit line/limit/usage amount • Initial pricing determination • Risk-based pricing • NSF pay/no-pay decision • Over-limit/shadow limit authorization • Credit line/limit/usage/ management • Retention decisions • Loan/payment modification • Repricing determination • Predelinquency treatment • Early/late-stage delinquency treatment • Collections agency placement • Collection/recovery treatment  

I have already commented on “secret questions” as the root of all evil when considering tools to reduce identity theft and minimize fraud losses.  No, I’m not quite ready to jump off  that soapbox….not just yet, not when we’re deep into the season of holiday deals, steals and fraud.  The answers to secret questions are easily guessed, easily researched, or easily forgotten.  Is this the kind of security you want standing between your account and a fraudster during the busiest shopping time of the year? There is plenty of research demonstrating that fraud rates spike during the holiday season.  There is also plenty of research to demonstrate that fraudsters perpetrate account takeover by changing the pin, address, or e-mail address of an account – activities that could be considered risky behavior in decisioning strategies.  So, what is the best approach to identity theft red flags and fraud account management?  A risk based authentication approach, of course! Knowledge Based Authentication (KBA) provides strong authentication and can be a part of a multifactor authentication environment without a negative impact on the consumer experience, if the purpose is explained to the consumer.  Let’s say a fraudster is trying to change the pin or e-mail address of an account.  When one of these risky behaviors is initiated, a Knowledge Based Authentication session begins. To help minimize fraud, the action is prevented if the KBA session is failed.  Using this same logic, it is possible to apply a risk based authentication approach to overall account management at many points of the lifecycle: • Account funding • Account information change (pin, e-mail, address, etc.) • Transfers or wires • Requests for line/limit increase • Payments • Unusual account activity • Authentication before engaging with a fraud alert representative Depending on the risk management strategy, additional methods may be combined with KBA; such as IVR or out-of-band authentication, and follow-up contact via e-mail, telephone or postal mail.  Of course, all of this ties in with what we would consider to be a comprehensive Red Flag Rules program. Risk based authentication, as part of a fraud account management strategy, is one of the best ways we know to ensure that customers aren’t left singing, “On the first day of Christmas, the fraudster stole from me…”  

For the past couple years, the deterioration of the real estate market and the economy as a whole has been widely reported as a national and international crisis. There are several significant events that have contributed to this situation, such as, 401k plans have fallen, homeowners have simply abandoned their now under-valued properties, and the federal government has raced to save the banking and automotive sectors. While the perspective of most is that this is a national decline, this is clearly a situation where the real story is in the details. A closer look reveals that while there are places that have experienced serious real estate and employment issues (California, Florida, Michigan, etc.), there are also areas (Texas) that did not experience the same deterioration in the same manner. Flash forward to November, 2009 – with signs of recovery seemingly beginning to appear on the horizon – there appears to be a great deal of variability between areas that seem poised for recovery and those that are continuing down the slope of decline. Interestingly though, this time the list of usual suspects is changing. In a recent article posted to CNN.com, Julianne Pepitone observes that many cities that were tops in foreclosure a year ago have since shown stabilization, while at the same time, other cities have regressed. A related article outlines a growing list of cities that, not long ago, considered themselves immune from the problems being experienced in other parts of the country. Previous economic success stories are now being identified as economic laggards and experiencing the same pains, but only a year or two later. So – is there a lesson to be taken from this? From a business intelligence perspective, the lesson is generalized reporting information and forecasting capabilities are not going to be successful in managing risk. Risk management and forecasting techniques will need to be developed around specific macro- and micro-economic changes.  They will also need to incorporate a number of economic scenarios to properly reflect the range of possible future outcomes about risk management and risk management solutions. Moving forward, it will be vital to understand the differences in unemployment between Dallas and Houston and between regions that rely on automotive manufacturing and those with hi-tech jobs. These differences will directly impact the performance of lenders’ specific footprints, as this year’s “Best Place to Live” according to Money.CNN.com can quickly become next year’s foreclosure capital. ihttp://money.cnn.com/2009/10/28/real_estate/foreclosures_worst_cities/index.htm?postversion=2009102811 iihttp://money.cnn.com/galleries/2009/real_estate/0910/gallery.foreclosures_worst_cities/2.html  

By: Tom Hannagan Understanding RORAC and RAROC I was hoping someone would ask about these risk management terms…and someone did. The obvious answer is that the “A” and the “O” are reversed. But, there’s more to it than that. First, let’s see how the acronyms were derived. RORAC is Return on Risk-Adjusted Capital. RAROC is Risk-Adjusted Return on Capital. Both of these five-letter abbreviations are a step up from ROE. This is natural, I suppose, since ROE, meaning Return on Equity of course, is merely a three-letter profitability ratio. A serious breakthrough in risk management and profit performance measurement will have to move up to at least six initials in its abbreviation. Nonetheless, ROE is the jumping-off point towards both RORAC and RAROC. ROE is generally Net Income divided by Equity, and ROE has many advantages over Return on Assets (ROA), which is Net Income divided by Average Assets. I promise, really, no more new acronyms in this post. The calculations themselves are pretty easy. ROA tends to tell us how effectively an organization is generating general ledger earnings on its base of assets.  This used to be the most popular way of comparing banks to each other and for banks to monitor their own performance from period to period. Many bank executives in the U.S. still prefer to use ROA, although this tends to be those at smaller banks. ROE tends to tell us how effectively an organization is taking advantage of its base of equity, or risk-based capital. This has gained in popularity for several reasons and has become the preferred measure at medium and larger U.S. banks, and all international banks. One huge reason for the growing popularity of ROE is simply that it is not asset-dependent. ROE can be applied to any line of business or any product. You must have “assets” for ROA, since one cannot divide by zero. Hopefully your Equity account is always greater than zero. If not, well, lets just say it’s too late to read about this general topic. The flexibility of basing profitability measurement on contribution to Equity allows banks with differing asset structures to be compared to each other.  This also may apply even for banks to be compared to other types of businesses. The asset-independency of ROE can also allow a bank to compare internal product lines to each other. Perhaps most importantly, this permits looking at the comparative profitability of lines of business that are almost complete opposites, like lending versus deposit services. This includes risk-based pricing considerations. This would be difficult, if even possible, using ROA. ROE also tells us how effectively a bank (or any business) is using shareholders equity. Many observers prefer ROE, since equity represents the owners’ interest in the business. As we have all learned anew in the past two years, their equity investment is fully at-risk. Equity holders are paid last, compared to other sources of funds supporting the bank. Shareholders are the last in line if the going gets rough. So, equity capital tends to be the most expensive source of funds, carrying the largest risk premium of all funding options. Its successful deployment is critical to the profit performance, even the survival, of the bank. Indeed, capital deployment, or allocation, is the most important executive decision facing the leadership of any organization. So, why bother with RORAC or RAROC? In short, it is to take risks more fully into the process of risk management within the institution. ROA and ROE are somewhat risk-adjusted, but only on a point-in-time basis and only to the extent risks are already mitigated in the net interest margin and other general ledger numbers. The Net Income figure is risk-adjusted for mitigated (hedged) interest rate risk, for mitigated operational risk (insurance expenses) and for the expected risk within the cost of credit (loan loss provision). The big risk management elements missing in general ledger-based numbers include: market risk embedded in the balance sheet and not mitigated, credit risk costs associated with an economic downturn, unmitigated operational risk, and essentially all of the strategic risk (or business risk) associated with being a banking entity. Most of these risks are summed into a lump called Unexpected Loss (UL). Okay, so I fibbed about no more new acronyms. UL is covered by the Equity account, or the solvency of the bank becomes an issue. RORAC is Net Income divided by Allocated Capital. RORAC doesn’t add much risk-adjustment to the numerator, general ledger Net Income, but it can take into account the risk of unexpected loss. It does this, by moving beyond just book or average Equity, by allocating capital, or equity, differentially to various lines of business and even specific products and clients. This, in turn, makes it possible to move towards risk-based pricing at the relationship management level as well as portfolio risk management.  This equity, or capital, allocation should be based on the relative risk of unexpected loss for the different product groups. So, it’s a big step in the right direction if you want a profitability metric that goes beyond ROE in addressing risk. And, many of us do. RAROC is Risk-Adjusted Net Income divided by Allocated Capital. RAROC does add risk-adjustment to the numerator, general ledger Net Income, by taking into account the unmitigated market risk embedded in an asset or liability. RAROC, like RORAC, also takes into account the risk of unexpected loss by allocating capital, or equity, differentially to various lines of business and even specific products and clients. So, RAROC risk-adjusts both the Net Income in the numerator AND the allocated Equity in the denominator. It is a fully risk-adjusted metric or ratio of profitability and is an ultimate goal of modern risk management. So, RORAC is a big step in the right direction and RAROC would be the full step in management of risk. RORAC can be a useful step towards RAROC. RAROC takes ROE to a fully risk-adjusted metric that can be used at the entity level.  This  can also be broken down for any and all lines of business within the organization. Thence, it can be further broken down to the product level, the client relationship level, and summarized by lender portfolio or various market segments. This kind of measurement is invaluable for a highly leveraged business that is built on managing risk successfully as much as it is on operational or marketing prowess.

By: Kari Michel The U.S. government and mortgage lenders have developed various loan modification programs to help homeowners better manage their mortgage debt so that they can meet their monthly payment obligations. Given these new programs, what is the impact to the consumer’s score? Do consumer scores drop more if they work with their lenders to get their mortgage loan restructured or if they file for bankruptcy? The finding from a study conducted by VantageScore® Solutions* reveals that a delinquency on a mortgage has a greater impact on the consumer’s score than a loan modification. Bankruptcy, short sale, and foreclosure have the greatest impact to a score. A bankruptcy or poor bankruptcy score can negatively impact a consumer for a minimum of seven years with a potential score decrease of 365 points. However, with a loan modification, consumers can rehabilitate their scores to an acceptable risk level within nine months.  This depends on them bringing all their delinquent accounts to current status. Loan modifications have little impact on their consumer credit score and the influence on their score can range from a 20 point decrease to an increase of 30 points. Lenders should proactively seek out a mortgage loan modification before consumers experience severe delinquency in their credit files and credit score trends. The restructured mortgage should provide sufficient cash availability to remain with the consumer.  This ensures that any other delinquent debts can be updated to current status. Whenever possible, bankruptcy should be avoided because it has the greatest consequences for the lender and the consumer. *For more detailed information on this study, Credit Scoring and Mortgage Modifications: What lenders need to know, please click on this link to access an archived file of a recent webinar:  http://register.sourcemediaconferences.com/click/clickReg.cfm?URLID=5258

The value of a good decision can generate $150 or more in customer net present value, while the cost of a bad decision can cost you $1,000 or more.  For example, acquiring a new and profitable customer by making good prospecting and approval and pricing decisions and decisioning strategies may generate $150 or much more in customer net present value and help you increase net interest margin and other key metrics.  While the cost of a bad decision (such as approving a fraudulent applicant or inappropriately extending credit that ultimately results in a charge-off) can cost you $1,000 or more. Why is risk management decisioning important? This issue is critical because average-sized financial institutions or telecom carriers make as many as eight million customer decisions each year (more than 20,000 per day!).  To add to that, very large financial institutions make as many as 50 billion customer decisions annually.  By optimizing decisions, even a small 10-to-15 percent improvement in the quality of these customer life cycle decisions can generate substantial business benefit. Experian recommends that clients examine the types of decisioning strategies they leverage across the customer life cycle, from prospecting and acquisition, to customer management and collections.  By examining each type of decision, you can identify those opportunities for improvement that will deliver the greatest return on investment by leveraging credit risk attributes, credit risk modeling, predictive analytics and decision-management software.        

Well, here we are nearly at the beginning of November and the Red Flags Rule has been with us for nearly two years and the FTC’s November 1, 2009 enforcement date is upon us as well (I know I’ve said that before).  There is little value in me chatting about the core requirements of the Red Flags Rule at this point.  Instead, I’d like to shed some light on what we are seeing and hearing these days from our clients and industry experts related to this initiative: Red Flags Rule responses clients 1. Most clients have a solid written and operational Identity Theft Prevention Program in place that arguably meets their interpretation of the Red Flags Rule requirements. 2. Most clients have a solid written and operational Identity Theft Prevention Program in place that creates a boat-load of referrals due to the address mismatches generated in their process(es) and the requirement to do something with them. 3. Most clients are now focusing on ways in which to reduce the number of referrals generated and procedures to clear the remaining referrals via a cost-effective and automated manner…of course, while preventing fraud and staying compliant to Red Flags Rule. In 2008, a key focus at Experian was to help educate the market around the Red Flags Rule concepts and requirements. The concentration in 2009 has nearly fully shifted to assisting the market in creating risk-based authentication programs that leverage holistic views of a consumer, flexible tools that are pointed to a consumer based on that person’s authentication and risk profile. There is also an overall decisioning strategy that balances risk, compliance, and resource constraints. Spirit of Red Flags Rule The spirit of the Red Flags Rule is intended to ensure all covered institutions are employing basic identity theft prevention procedures (a pretty good idea).  I believe most of these institutions (even those that had very robust programs in place years before the rule was introduced) can appreciate this requirement that brings all institutions up to speed.  It is now, however, a matter of managing process within the realities of, and costs associated with, manpower, IT resources, and customer experience sensitivities.