The full text on this page is automatically extracted from the file linked above and may contain errors and inconsistencies.
U.S. Bancorp Residential Mortgage Servicing FEDERAL RESERVE CONSENT ORDER ACTION PLAN This is a summary excerpt of U.S. Bancorp’s overall Comprehensive and Supplemental Action Plans as first approved by the Board of Directors on April 18, 2011, subsequently amended by Board approval on July 18, 2011, and regularly updated to reflect current status. Privileged and U.S. Bancorp Confidential December 9, 2011 Table of Contents Background .....................................................................................................................................3 Summary of the Effectiveness Reviews .........................................................................................4 A. Enterprise Risk Management ................................................................................................4 B. Enterprise Compliance Program ............................................................................................6 C. Internal Audit .........................................................................................................................7 Summary of the Federal Reserve Consent Order Action Plan .......................................................9 Governance ...................................................................................................................................12 A. Commitment of the Bank ....................................................................................................12 B. Project Management ............................................................................................................13 Resourcing .....................................................................................................................................14 A. U.S. Bank Resources ...........................................................................................................14 B. External Resources .............................................................................................................14 Conclusion ....................................................................................................................................15 Appendix A: Federal Reserve Consent Order Action Plan .........................................................16 Privileged and U.S. Bancorp Confidential 2 December 9, 2011 Background Pursuant to the terms of the Consent Order issued by the Comptroller of the Currency (“OCC”) dated April 13, 2011 (the “OCC Order”) and the Consent Order issued by the Board of Governors of the Federal Reserve System (the “FRB”) dated April 13, 2011 (the “FRB Order” and, collectively with the OCC Order, the “Orders”) to U.S. Bank National Association and U.S. Bank National Association ND and to U.S. Bancorp, respectively (collectively, the “Bank”), the Bank submitted a Comprehensive Action Plan responding to both Orders along with a Supplemental Action Plan (collectively, the “Plan”) on July 13, 2011. The Supplemental Action Plan reflects additional plans prepared as a result of reviews and assessments of the Bank’s residential mortgage loan servicing, loss mitigation, and foreclosure activities and operations (“Residential Mortgage Servicing” or “RMS”) conducted in accordance with requirements of the Orders, as well as, single point of contact relationship management requirements issued by the OCC after the Bank’s initial submission. The FRB Order, as well as portions of the OCC Order, requires the Bank to strengthen enterprise-wide risk management, internal audit, and compliance programs (collectively, the Bank’s “Corporate Oversight Programs”) concerning Residential Mortgage Servicing. As a result, all governance, Board oversight, and reporting actions are broadly focused on Residential Mortgage Servicing. Based on specific additional requirements contained within the OCC Order, as well as the Bank’s own review and assessment, the majority of Plan actions are focused on residential mortgage loan collections (primarily 60 days and more post-delinquency), loss mitigation (including loan modification), foreclosure, bankruptcy and real estate owned activities (collectively, “Residential Mortgage Default Management” or “RMDM”). The terms of the OCC Order require that the Plan include the following categories: • An acceptable compliance program for Residential Mortgage Servicing; • Acceptable policies and procedures for the Bank’s use of third parties related to Residential Mortgage Servicing, particularly as relates to the use of foreclosure counsel and other third-parties providing foreclosure related services; • An acceptable plan to ensure controls and oversight of the Bank’s activities with respect to the Mortgage Electronic Registration System (“MERS”); • An acceptable plan for the completion of an independent foreclosure review; • An acceptable plan for the operation of the Bank’s reporting and management information systems (“MIS”) for Residential Mortgage Servicing ; Privileged and U.S. Bancorp Confidential 3 December 9, 2011 • An acceptable plan for effective coordination of communications with borrowers related to Residential Mortgage Default Management activities; and • An acceptable plan to conduct a comprehensive risk assessment of Residential Mortgage Servicing. The terms of the FRB Order require the following additional categories: • An acceptable plan to strengthen Board oversight of the Bank’s enterprise-wide risk management, internal audit, and compliance programs concerning Residential Mortgage Servicing; and • Acceptable plans to enhance the Bank’s enterprise-wide risk management, internal audit, and compliance programs with respect to Residential Mortgage Servicing. This Federal Reserve Consent Order Action Plan (this “FRB Plan”) is an excerpt of the Plan, specifically describing activities and plans to enhance the Board’s oversight and the Bank’s Corporate Oversight Functions with respect to Residential Mortgage Servicing. Appendix A details the Bank’s plans as they relate to each of the paragraphs of the FRB Orders and includes references to the Plan. When fully implemented, the Plan is designed to ensure that the Bank’s Residential Mortgage Servicing activities comply with all applicable legal requirements, the requirements of the Orders, Summary of the Effectiveness Review In accordance with the terms of the FRB Order, the Bank engaged Promontory Financial Group to evaluate the effectiveness of the Bank’s existing enterprise-wide risk management, compliance, and internal audit practices related to Residential Mortgage Servicing (the “Effectiveness Review”). Promontory’s findings and recommendations are summarized below. A. Enterprise Risk Management The Bank’s Enterprise Risk Management (“ERM”) function was reviewed against standards set forth by regulatory agencies and the BIS, including: • FRB – SR 95-51 (SUP): Rating the Adequacy of Risk Management Processes and Internal Controls at State Member Banks and Bank Holding Companies, November 14, 1995; • FRB – SR 089-/CA 08-12: Guidance for the Consolidated Supervision of Domestic Bank Holding Companies that are Large Complex Banking Organizations, Attachment A.1, October 16, 2008; Privileged and U.S. Bancorp Confidential 4 December 9, 2011 • BIS – Sound Practices for the Management and Supervision of Operational Risk, December 2010; • OCC – Comptroller’s Handbook: Large Bank Supervision, January 2010; 2001-47: Third-Party Relationships: Risk Management Principles, November 1, 2001; and Comptroller’s Handbook: Mortgage Banking, March 1996, March 1998; and • General operational risk management expectations and regulatory requirements from the Basel II Accord. The Bank has a well-established ERM program which is documented in its Enterprise Risk Management Policy and evidenced in management and Board reporting, as well as risk assessment and capital planning practices. The ERM program was designed to provide strong oversight with regard to all risk categories and to comply with FRB and OCC supervisory guidance. The Bank has established limits for operational risk, including compliance and legal risk, and follows the Basel II Accord event protocols for data capture and analysis. Reputation risk is managed similarly to compliance and legal matters, as the Bank has a zero-tolerance policy with regard to actions that may damage the Bank’s reputation. This standard is well established in the Bank’s culture. Performance against established tolerances and peer data is regularly monitored by management and the Bank’s Corporate and Executive Risk Committees, as well as the Board, including appropriate committees such as the Risk Management Committee. The Bank also employs a “Risk Control Self-Assessment” process and a scenario analysis process to assess operational risk levels and internal controls. The ERM function is independent and has appropriate authority and stature across the Bank. Residential Mortgage Servicing is included in the scope of the ERM Program, along with all other Bank business activities. The Effectiveness Review identified the following areas for enhancement: • Certain items could be more clearly delineated within the ERM Policy, including o Roles, responsibilities and procedures for periodic updates to the Bank’s risk appetite and risk tolerance metrics. o Roles, responsibilities and procedures over the capital planning process, including stress testing. • Summary reports are routinely provided to senior executives and the Risk Committee but have historically not included detailed Residential Mortgage Servicing information. More extensive reports regarding mortgage servicing and default management activities are warranted. Privileged and U.S. Bancorp Confidential 5 December 9, 2011 • Quality assurance processes are risk-based and did not previously encompass state laws regarding foreclosure activities that were handled by outside attorneys. Such activities should be expanded to encompass Residential Mortgage Servicing requirements. • The Bank’s mortgage servicing policies and procedures vary among servicing locations. Some of the differences are appropriate (e.g., FDIC requirements regarding Loss Share assets), but consistency in policies is an important governance standard. Continued efforts to consolidate and enhance mortgage servicing policies and procedures are warranted. • The Bank’s Vendor Risk Management Program has previously excluded outside attorneys. Therefore, foreclosure attorneys were not subject to the same due diligence requirements and oversight as other vendors. Revisions to the Vendor Risk Management Program are warranted to ensure that attorneys, consulting firms, and other third parties (including MERSCORP, Inc.) engaged in Residential Mortgage Servicing activities are appropriately and comprehensively addressed. • The Bank has recently restructured its Residential Mortgage Default Management unit, including the unit’s reporting lines. Other personnel changes have also been recently implemented. Organizational charts should be updated and kept current. B. Enterprise Compliance Program The Bank’s Enterprise Compliance Program (“ECP”) was reviewed against standards set forth by regulatory agencies and the BIS, including: • FRB - SR 08-08/CA 08-11: Compliance Risk Management Programs and Oversight at Large Banking Organizations with Complex Compliance Profiles, October 16, 2008; • FRB – SR 95-51 (SUP): Rating the Adequacy of Risk Management Processes and Internal Controls at State Member Banks and Bank Holding Companies, November 14, 1995; • BIS – Compliance and the Compliance Function in Banks, April, 2005; and • OCC – Comptroller’s Handbook: Compliance Management System, August, 1996. The Bank has a well-established ECP, which is documented in the Corporate Compliance Charter and evidenced in management and Board reporting. The ECP was designed to provide strong oversight with regard to all relevant compliance risk categories and to comply with FRB and OCC supervisory guidance. The Bank has established limits on compliance risk and has a zero-tolerance policy with regard to actions that may damage the Bank’s reputation. This standard is well-established in the Bank’s culture. The Bank’s Corporate Compliance Division employs extensive testing and monitoring procedures. The Board, senior management, and the Privileged and U.S. Bancorp Confidential 6 December 9, 2011 Corporate Compliance function have established a sound compliance risk management program and oversight framework. The Corporate Compliance Division is independent of business lines, avoids conflicts of interest, and is the final authority on all compliance-related issues and disputes. The Effectiveness Review identified the following areas for enhancement: • There are certain items that could be more clearly delineated within the Bank’s Corporate Compliance Policy, including items related to Board oversight, dispute resolution, and investigation procedures. • Training is generally comprehensive, but the Bank does not maintain specific training requirements for Corporate Compliance management or for business line compliance officer positions. Training programs should be expanded to include position-specific training requirements for new Corporate Compliance management personnel and business line compliance personnel. • The Bank has an annual compliance planning process and documents its plans for each calendar year in advance. Since certain compliance activities may not be conducted each calendar year, the entire compliance cycle typically extends beyond twelve months. The Bank should establish a comprehensive compliance plan to delineate all compliance activities through the complete cycle and to review the plan at least annually to ensure that new or revised regulations or compliance-related issues are accounted for. • Corporate Compliance has maintained adequate staffing levels despite increasing workloads in Residential Mortgage Servicing, particularly with regard Residential Mortgage Default Management. Corporate Compliance will have an increasing role in related oversight, so the Bank should continue to assure adequate staffing for Corporate Compliance staff. • The Bank’s mortgage servicing policies and procedures vary among mortgage servicing locations and did not previously address all compliance-related requirements with regard to the foreclosures. The Bank should finalize and implement the Residential Mortgage Default Management Compliance Policy and Program, together with detailed procedural guidelines. Further, enhanced Compliance Quality Assurance testing and monitoring plans for the foreclosure area are in development and will be implemented when finalized. C. Internal Audit The Bank’s Internal Audit Program was reviewed to determine its effectiveness with respect to Residential Mortgage Servicing activities and operations. Corporate Audit Services (“CAS”) Privileged and U.S. Bancorp Confidential 7 December 9, 2011 performs the internal audit function for the Bank. CAS reports functionally to the Audit Committee of the U.S. Bancorp Board of Directors (the “Audit Committee”). The Internal Audit Program was reviewed for compliance with the standards established by the IIA and regulatory guidance applicable to the internal audit, including: • IIA's International Standards for the Professional Practice of Internal Auditing, and • OCC – Comptroller’s Handbook: Large Bank Supervision, January 2010. CAS’s Internal Audit Program is documented in its CAS Charter, Policies and Procedures Manual, and Annual Audit Plan. Internal audit activities are reflected in reports to the Board Audit Committee as well as Reports of Audit and monitoring reports. The Internal Audit function is independent and has the appropriate authority, access to people, data and information, relationships with business lines, and standing within the Bank to perform its responsibilities. Residential Mortgage Servicing is included in the scope of the Internal Audit program, along with all other Bank business activities. The Bank establishes risk tolerances, and CAS provides the Audit Committee with objective, risk-centric assurances with respect to risk management, control and governance processes. CAS also provides independent and objective assessments of the adequacy, effectiveness, and efficiency of risk acceptance, transfer and mitigation processes to senior management. The Effectiveness Review identified the following areas for enhancement: • The planning cycle for the 2011/2012 Audit Plan was completed in October 2010, prior to the Consent Order. CAS began analyzing the impact of the Consent Order matters on the approved 2011 Audit plan as early as December 2010, but the revision process could not be completed until the full scope of audit requirements to comply with the conditions of the Consent Order were understood. Additional steps to refine the 2011/2012 Audit Plan to make explicit those scheduled audits that relate directly to Residential Mortgage Servicing activities are warranted. • ECP and ERM are undertaking a series of enhancements to their operations that will require validation by CAS after implementation. Given its important role in assessing ERM and ECP processes, it is important for CAS to schedule audits over the ERM and ECP areas on an ongoing basis and to highlight scheduled audits for the Audit Committee and other stakeholders. • Audit Staffing has experienced a number of vacancies in recent periods, but CAS has been able to meet its responsibilities by employing substantial overtime usage and through the use of external subject matter experts. Given the recent and continuing expansion of internal audit activities with regard to mortgage servicing, maintaining Privileged and U.S. Bancorp Confidential 8 December 9, 2011 adequate internal audit resources will continue to be of critical importance. CAS should continue to work closely with Human Resources to expeditiously fill CAS Auditor vacancies and ensure that adequate qualified staffing of the audit function is maintained with regard to Residential Mortgage Servicing activities. The Bank should also continue to use external subject matter experts to augment Bank staff as appropriate. • CAS past practice was to accept management assertions that corrective action in response to audit findings was implemented and effective and wait until the next scheduled audit to validate the claim. In late 2010, CAS directed that validation of corrective action be scheduled no later than the timeframes specified in the CAS Policies and Procedures Manual following management assertion regarding corrective action. It is equally imperative to ensure that, where business lines disagree with Internal Audit Findings, issues are escalated to the Audit Committee in accordance with written protocols and procedures. The audit finding resolution and escalation processes should be enhanced in accordance with internal written policies and the CAS Policies and Procedures Manual. • Summary of the Federal Reserve Consent Order Action Plan This FRB Plan is the result of the Bank’s review of Consent Order requirements and reflection on the Bank’s existing policies, programs and processes as they relate to Residential Mortgage Servicing. Specifically, this FRB Plan is informed by three major bodies of work: investigative work performed since the completion of the horizontal exam, Promontory Financial Group’s Effectiveness Review, and implementation experience gained since the Bank’s original submission of the Plan on April 22, 2011. The FRB Plan includes actions in response to each paragraph of the FRB Order as follows: • Paragraph 1: Source of Strength. This section describes activities to dedicate resources, organize actions and manage their execution to respond to the Orders. The Board has established a special Compliance Committee which meets monthly, or more frequently as needed, to oversee the Bank’s response to the Orders. In addition, both internal and external resources have been dedicated to the development and execution of the Plan. Refer to pages 18-20 of the FRB Plan (Appendix A) for the specific action items. • Paragraph 2: Board Oversight. The Bank’s plans to increase Board oversight of risks associated with Residential Mortgage Servicing are described in this section. Refer to pages 21-28 of FRB Plan (Appendix A) for the specific action items. These actions include: Privileged and U.S. Bancorp Confidential 9 December 9, 2011 o Review and revision of the corporate Enterprise Risk Management Policy to clarify the risk appetite and capital planning processes; o Revision or development of other corporate policies/programs as they relate to the management of Residential Mortgage Servicing risks, specifically the Corporate Compliance Charter and the Residential Mortgage Default Management Compliance Policy and Program, which outlines compliance responsibilities, an overall framework for managing compliance risk, and specific policies to be adopted in the execution of day-to-day default management activities; o Development of risk limits and tolerances with respect to Residential Mortgage Servicing; o Review and revision of the Corporate Vendor Management Policy to extend risk management of independent contractors, consulting firms, law firms, or other third parties who are engaged to support Residential Mortgage Default Management activities; o Review and enhancement of processes to evaluate resources dedicated to the ERM, ECP and Audit programs with respect to Residential Mortgage Servicing, including consideration of the adequacy of headcount by function and level, as well as their requisite qualifications and skills; o Enhancement of Board reporting to facilitate the Board’s oversight of Residential Mortgage Servicing as monitored by ERM, ECP and Audit. Enhancements will include implementation of regular Board reporting to monitor actions to comply with the Orders, as well as improvements in the reporting of risks and remediation activities to address any items identified by regulators or as self-identified by the Bank’s risk management programs. • Paragraph 3: Enterprise Risk Management Program. Key items to enhance the Bank’s ERM program as a result of the Effectiveness Review are described in this section. Refer to pages 29-36 of FRB Plan (Appendix A) as well as Section XII of the Supplemental Plan (Appendix C) for specific action items. These items include: o Enhancement of the Bank’s risk assessment processes by expanding consideration of Residential Mortgage Servicing risks in the 2011 Operational Risk Scenario Analysis Workshops and the 2011 RCSA process; o Review of the ERM Policy as it relates to how risk exposure is considered in the capital planning process; Privileged and U.S. Bancorp Confidential 10 December 9, 2011 o Amendment of the Corporate Vendor Risk Management Policy and development of RMDM Third Party Guidelines to ensure a comprehensive vendor risk management program related to Residential Mortgage Servicing; and o Enhancement of business line risk management and Corporate Compliance functions to ensure appropriate RMDM controls, effective policies and procedures, and compliance with SR 08-08. • Paragraph 4: Enterprise Compliance Program. Key items to enhance the Bank’s ECP as a result of the Effectiveness Review are described in this section. Refer to pages 37-47 of FRB Plan (Appendix A) as well as Section XIII of the Supplemental Plan (Appendix C) for specific action items. These items include: o Development of the previously referenced Residential Mortgage Default Management Compliance Policy and Program as well as its adoption through the development and implementation of new Residential Mortgage Default Management Compliance Guidelines; o Enhancement of the Bank’s annual Enterprise Compliance Risk Assessment related to Residential Mortgage Servicing compliance risks; o Expansion of Compliance Quality Assurance testing related to Residential Mortgage Servicing ; o Development and implementation of formal group-wide training for Residential Mortgage Default Management personnel to include compliance policies and guidelines; o Enhancement of legal and regulatory change control processes; and o Enhancement of personnel practices to assure the independence of personnel with primary compliance responsibilities in accordance with SR 08-08. Paragraph 5: Internal Audit. Key items to enhance the Bank’s Audit program as a result of the Effectiveness Review are described in this section. Refer to pages 48-55 of FRB Plan (Appendix A) as well as Section XIV of the Supplemental Plan (Appendix C) for specific action items. These items include: o Expanding the scope of the 2011 and future audit schedules to fully encompass Residential Mortgage Servicing, and the mortgage servicing-related Enterprise Compliance Program and Enterprise Risk Management functions; o Revising the annual audit planning process to ensure a robust multi-year riskbased audit process; Privileged and U.S. Bancorp Confidential 11 December 9, 2011 o Ensuring timely resolution of, and better documentation and tracking of, audit findings; o Evaluating, on a regular basis, staffing levels required to support the expanded scope of the audit programs and improving practices to secure needed resources and expertise; and o Formalizing working agreements between CAS and the business lines through the implementation of service level agreements. • Paragraph 6 & 7: Approval, Implementation and Progress Reports. The Bank will continue to meet the Reserve Board’s requirements for the approval and implementation of plans and the submission of reports. Refer to pages 56-58 of FRB Plan (Appendix A) for the specific action items. These include: o Submitting its Supplemental Enhancement Plans (for ERM, ECP and CAS) based on its Effectiveness Reviews within the applicable time periods of the Order; o Within 10 days of FRB approval, adopting the plans and implementing them in accordance with the plan or regulatory time frames; and o Monitoring changes to the plans and incorporating new or changes to legal requirements and supervisory guidance of the Board of Governors, and submitting the revisions with the Bank’s regular progress reports to the FRB within 30 days after the end of each calendar quarter. Appendix A details the Bank’s plans with respect to each of the paragraphs of the FRB Order. This FRB Plan will be implemented as expeditiously as possible, not to exceed the timeframes prescribed in the Orders. Governance A. Commitment of the Bank Executive management and the Board are fully committed to meeting the letter and the spirit of the Orders through the establishment of enhanced policies and procedures to strengthen compliance and standardize risk management with respect to the Bank’s Residential Mortgage Servicing activities. To this end, the Bank has established the oversight structure described below. 1. Compliance Committee The Boards have established a single special Compliance Committee to oversee the Bank’s execution of the Plan. The Committee’s charter is broad and gives it responsibility and authority to oversee the project and ensure its successful completion in a timely fashion. Privileged and U.S. Bancorp Confidential 12 December 9, 2011 The Compliance Committee meets monthly, or more as needed, and provides reports in accordance with the terms of the Orders until the Plan is completed. The Committee receives formal progress reports on a monthly basis prepared by the Chair of the Project Group. In addition, the Committee has also instructed the Chair of the Project Group and the members of the Executive Steering Group to notify the Compliance Committee on a timely basis should any issue arise that materially impacts the timely completion of the Plan. The Project Group and the Executive Steering Group are described below. 2. Implementation Oversight Execution of the Plan is overseen by an Executive Steering Group and a Project Group formed for this purpose. The Executive Steering Group receives regular updates regarding the progress of the implementation efforts. The Project Group is comprised of the heads of each Plan workstream plus other key Bank senior managers who actively contribute to the implementation efforts. The Group meets on a weekly basis. B. Project Management The Bank has established the following project management framework to ensure the successful completion of its implementation efforts: • The Project Group is accountable for leading all project-related efforts. The Group reviews and directs progress of all action items within the individual workstreams at its weekly meetings. • Bank Workstream Leads are required to report to the Working Group on a weekly basis. The Leads are responsible for the execution of workstream plans and the successful completion of workstream deliverables. • Regular Progress Reports are prepared and discussed in accordance with the Bank’s project governance structure (i.e., reports to the Executive Steering Group and the Boardlevel Compliance Committee) and the requirements of the Orders themselves (i.e., reports to the full Boards, to the Deputy Comptroller and the Examiner-in-Charge, and to the FRB). • A Project Management Office has been established to facilitate implementation of the Plan. The Project Management Office communicates Project Group decisions to the workstreams; holds regular meetings with the workstream leaders, both individually and collectively, to monitor progress against Plan action items and steps; and identifies issues or dependencies that may impede progress, put Plan due dates at risk, or require a change to the Plan itself. The Office monitors and controls changes to the Plan and the Plan schedule. In addition, the Office prepares progress reports, escalates items for Privileged and U.S. Bancorp Confidential 13 December 9, 2011 management action and, where appropriate, takes action to assure that any gaps or issues are rapidly addressed. • The Bank retained Promontory Financial Group to design and execute a Validation and Testing Program for all implementation actions and deliverables, in accordance with the Orders. As part of the program, the Bank has adopted documentation standards to evidence satisfaction of all requirements of the Orders. Resourcing A. U.S. Bank Resources Implementation of the Plan has called importantly and directly on the following areas of the Bank: • The Boards of U.S. Bancorp, U.S. Bank National Association, and U.S. Bank National Association ND; • Board-level Compliance Committee; • Corporate Compliance, Corporate Audit Services and Enterprise Risk Management; • Bank Senior Management; and • Credit Administration, Corporate Legal, and Human Resources. The Bank has made personnel and resources from each of these areas available, as necessary, to direct, perform and assist in implementation of the Plan. To that end, the Bank formed a dedicated internal project team under the direction of the Bank’s Deputy Chief Risk Officer. Most project team members are senior level managers who have substantive experience in mortgage servicing, credit administration, human resources, and compliance. The Bank has directed additional internal resources to the execution of the implementation plan, as necessary, to meet the required timeframes and deliverables. The Bank also responded to the findings of the staffing assessment, as described above, and added resources, as required, in Residential Mortgage Default Management operations as well as Corporate Audit Services, Corporate Compliance and Corporate Risk Management to ensure compliance as well as the safety and soundness of its Residential Mortgage Servicing on a going forward basis. B. External Resources The Bank is fully committed to securing all necessary resources to respond to the Orders in an effective and timely manner. Privileged and U.S. Bancorp Confidential 14 December 9, 2011 To that end, the Bank has retained a number of legal and consulting experts to assist in its response to the Orders. Among others, the Bank retained Promontory Financial Group to provide the following assistance in connection with the Orders: • To perform the risk assessments and effectiveness reviews as required by the Orders; • To design and execute a testing program to validate that completed actions and deliverables fully satisfy the requirements of the Orders; • To assist in the overall project management of the effort; and • To supplement the Bank’s internal staffing, as needed. Promontory resources are specialists in mortgage servicing, risk assessment, compliance, internal audit, project management and policies/procedures development. Conclusion The Boards are committed to the timely completion of the Plan and to ensuring that, upon its implementation, the Bank achieves and maintains effective mortgage servicing, foreclosure and loss mitigation processes, as well as associated risk management, compliance, quality control, audit, training, staffing, and related functions. The Boards believe that the completion of the Plan will address the concerns the OCC and Federal Reserve have raised about the Bank’s residential mortgage servicing and foreclosure practices. Privileged and U.S. Bancorp Confidential 15 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan As of December 9, 2011 This plan is a summary excerpt of the Bank’s overall Comprehensive and Supplemental Action Plans (respectively, the “CAP” and the “SAP”) as first approved by the Board of Directors on April 18, 2011, subsequently amended by Board approval on July 18, 2011, and regularly updated to reflect current status. Privileged & U.S. Bancorp Confidential - 16 - December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Table of Contents Paragraph 1: Source of Strength .............................................................................................................................................................. 18 Paragraph 2: Board Oversight .................................................................................................................................................................. 21 Paragraph 3: Enterprise Risk Management Program ............................................................................................................................... 29 Paragraph 4: Enterprise Compliance Program ......................................................................................................................................... 37 Paragraph 5: Internal Audit ...................................................................................................................................................................... 48 Paragraphs 6 & 7: Approval, Implementation, and Progress Reports ..................................................................................................... 56 Status Color Key: Blue = Complete Green = In Progress with No Concern Yellow = In Progress with Some Concern Red = Requires Management Attention Privileged & U.S. Bancorp Confidential - 17 - December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 1 Requirement Source of Strength General Oversight The board of directors of USB shall take appropriate steps to fully utilize USB’s financial and managerial resources, pursuant to section 225.4(a) of Regulation Y of the Board of Governors (12 C.F.R. § 225.4(a)), to serve as a source of strength to the Banks, including, but not limited to, taking steps to ensure that the Banks comply with the Consent Order issued by the OCC regarding the Banks’ mortgage servicing activities. The Board of Directors (the “Board”) for U.S. Bancorp (“the Bank”) has taken prompt action to dedicate resources and organize actions to respond to the Consent Orders. The Board has established a special Compliance Committee to oversee the Bank’s execution of the Plan through monthly, or more frequently as needed, meetings. The Bank’s executive management has also established a Project Group, headed by the Bank’s Deputy Chief Risk Officer, to actively direct the implementation process. The Project Group includes members from Compliance, Risk, Internal Audit, Human Resources, and leaders from the Residential Mortgage Servicing line of business, as well as external resources retained to assist with project efforts. The Bank also has prepared a comprehensive action plan (the “Action Plan”) describing actions that the Bank has taken or will take to comply with the Consent Order, incorporating additional actions identified as a result of completion of the effectiveness reviews required under the Consent Order (the “Effectiveness Reviews”). Action Item Target Due Date Action Plan Cross-Reference Complete I.a.1.00 Identify committee members and draft charter. Complete I.a.1.01 Approve formation of and charter for committee. Complete I.a.1.02 Conduct kickoff meeting. Complete I.a.1.03 Complete I.b.1.00 Complete I.b.1.01 Complete I.b.1.02 Complete I.b.1.03 Complete I.b.1.04 Complete See below Detailed Steps Form Compliance Committee. Initiate Action Plan Project. Designate overall project group lead. Secure internal project personnel and designate workstream leads. Engage external resources to assist with development and execution of the Action Plan Conduct kickoff meetings with workstream leads. Prepare Action Plan. Privileged & U.S. Bancorp Confidential - 18 - Status December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 1 Source of Strength Action Item Target Due Date Action Plan Cross-Reference Complete I.b.3.01 Prepare consolidated Action Plan. Complete I.b.3.02 Prepare narrative overlay. Complete I.b.3.03 Extend Action Plan to include Supplement Enhancement Plans for ERM, ECP, and Internal Audit. Complete I.f.1.05 Complete See below Complete I.c.1.01 Complete I.c.1.02 Complete I.c.1.03 Ongoing I.e.1.00 Design monthly reporting package for the Compliance Committee. Complete I.e.1.01 Conduct April 2011 meeting of the Compliance Committee. Complete I.e.1.02 Conduct May 2011 meeting of the Compliance Committee. Complete I.e.1.03 Conduct June 2011 meeting of the Compliance Committee. Complete I.e.1.04 Conduct July 2011 meeting of the Compliance Committee. Complete I.e.1.05 Complete I.e.1.06 Complete I.e.1.07 Complete I.e.1.08 Detailed Steps Review Consent Order requirements and current Bank practices; prepare project plans for each workstream. Obtain Board oversight of initial plans for Consent Order compliance. Approve corporate resolutions to enter into the Consent Orders and form Compliance Committee. Approve plan to strengthen Board oversight for submission to FRB. Approve Action Plan to achieve compliance with OCC and FRB Consent Orders and submit in accordance with the requirements of each . Conduct monthly meetings of the Compliance Committee. Conduct August 2011 meeting of the Compliance Committee. Conduct September 2011 meeting of the Compliance Committee. Conduct October 2011 meeting of the Compliance Committee. Privileged & U.S. Bancorp Confidential - 19 - Status December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 1 Source of Strength Action Item Privileged & U.S. Bancorp Confidential Detailed Steps Conduct November 2011 meeting of the Compliance Committee. Establish ongoing responsibilities and processes for the conduct of future monthly Compliance Committee meetings - 20 - Status Target Due Date Action Plan Cross-Reference Complete I.e.1.09 Ongoing I.e.1.10 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 2 Board Oversight (a) Requirement Board Policies Policies to be adopted by the board of directors that are designed to ensure that the ERM program provides proper risk management with respect to Mortgage Divisions’ loan servicing, Loss Mitigation, and foreclosure activities, particularly with respect to compliance with the Legal Requirements, and supervisory standards and guidance as they develop; The Bank’s Action Plan includes enhancements to the process for establishing the Bank’s risk limits and tolerance metrics, which was approved and monitored by the Board. The Board will also oversee the revision/development, adoption, and implementation of important policies that impact Residential Mortgage Servicing, including the Enterprise Risk Management Policy 1, the Compliance Charter, the Vendor Management Policy, and the new Residential Mortgage Default Management Compliance Policy and Program. The latter outlines risk management responsibilities and the overall framework for managing risk in default management activities. The Bank has adopted ERM, Compliance (both Corporate and Line of Business) and Vendor Management policy changes and is continues to review/revise its ERM Policy related to risk limits and tolerances. Action Item Detailed Steps Ensure development of appropriate risk limits and tolerances with regard to RMDM and regular review of the associated risk limits by Residential Mortgage Servicing, Credit Administration, Bank senior management and the Board’s Risk Management Committee. Approve risk limits and tolerances with regard to Residential Mortgage Servicing and monitor bank performance in relation to approved limits and tolerances. Approve appropriate risk tolerances with regard to Residential Mortgage Servicing. Incorporate additional risk tolerance metrics into reporting and scorecard as appropriate. Status Target Due Date Action Plan Cross-Reference 11/30/11 XII.c.2.00 1/31/12 See below 4/30/12 I.c.2.05 1/31/12 XII.c.4.00 1 The Enterprise Risk Management Policy is the Board approved, enterprise-wide policy that establishes the Bank’s framework for effective enterprise risk management, including oversight and governance, key constituent roles and responsibilities, and core risk management processes. Privileged & U.S. Bancorp Confidential - 21 - December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 2 Board Oversight Action Item Obtain Board approval of new/revised policies with respect to Residential Mortgage Servicing activities. Detailed Steps Review and approve the revised ERM Policy regarding how risk exposure is considered in the capital planning process. Review and approve the revised ERM Policy regarding risk tolerances and limits. Review and approve any changes to the Bank’s Compliance Charter related to Default Management. Review and approve new Corporate Residential Mortgage Default Management Compliance Policy and Program. Review and approve changes to the corporate Vendor Management Policy to ensure proper risk management of third-parties providing foreclosure or related services. Monitor implementation and compliance with Board approved policies through regular Board reporting. Privileged & U.S. Bancorp Confidential - 22 - Status Target Due Date Action Plan Cross-Reference 4/30/12 See below Complete XII.a.5.03 4/30/12 XII.a.5.06 Complete 1.c.2.01 Complete 1.c.2.02 Complete I.c.2.04 Complete VI.5.05 XII.a.6.02 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 2 Requirement Board Oversight Third Party Management (b) Policies and procedures to ensure that the ERM program provides proper risk management of independent contractors, consulting firms, law firms, or other third parties who are engaged to support loan servicing, Loss Mitigation, or foreclosure activities or operations, including their compliance with the Legal Requirements and USB’s internal policies and procedures, consistent with supervisory guidance of the Board of Governors; The Bank has implemented actions to ensure that the ERM program provides for proper oversight of independent contractors, consulting firms, law firms, or other third parties who are engaged to support Residential Mortgage Servicing activities, as described in the following chart. Specifically, the corporate Vendor Management Policy has been revised regarding its applicability to foreclosure counsel; In addition, the Bank has developed Residential Mortgage Default Management guidelines for the use of third parties providing foreclosure or related services. Action Item Ensure that the ERM program provides proper risk management of independent contractors, consulting firms, law firms, or other third parties who are engaged to support Residential Mortgage Servicing activities, including their compliance with the Legal Requirements and USB’s internal policies and procedures, consistent with supervisory guidance of the Board of Governors. Detailed Steps Review and approve changes to the corporate Vendor Management Policy to ensure proper risk management of third-parties providing foreclosure or related services. Ensure oversight of the Vendor Risk Management Program by Risk Management as set forth in the Enterprise Risk Management Policy. Oversee the implementation of enhanced Line of Business vendor management procedures in accordance with the revised corporate Vendor Management Policy. Oversee the development of Guidelines with respect to the retention, monitoring and oversight of third-parties providing foreclosure or related services in connection with Residential Mortgage Default Management activities. Monitor the implementation of the revised vendor policies, guidelines, and procedures as relate to foreclosure attorneys and other third parties providing foreclosure related services. Privileged & U.S. Bancorp Confidential - 23 - Status Target Due Date Action Plan Cross-Reference Ongoing See below Complete I.c.2.04 Ongoing XII.a.8.04 Complete See below Complete I.f.1.06 Complete I.f.1.07 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 2 Board Oversight (c) Requirement Staffing Steps to ensure that USB’s ERM, audit, and compliance programs have adequate levels and types of officers and staff dedicated to overseeing Mortgage Divisions’ loan servicing, Loss Mitigation, and foreclosure activities, and that these programs have officers and staff with the requisite qualifications, skills, and ability to comply with the requirements of this Order, and The Bank has taken steps to both ensure that the Bank’s ERM, audit, and compliance programs and the Residential Mortgage Default Management lines of business have adequate staffing, in terms of the number of employees by function and level, as well as their requisite qualifications and skills. Actions to enhance ongoing processes and reporting continue, as indicated on the chart below. Action Item Ensure that USB’s current ERM, audit, and compliance programs have adequate levels and types of officers and staff dedicated to overseeing Residential Mortgage Servicing, and that these programs have officers and staff with the requisite qualifications, skills, and ability to comply with the requirements of the Orders. Establish ongoing processes to ensure that USB’s ERM, audit, and compliance programs maintain adequate levels and types of officers and staff dedicated to overseeing Residential Mortgage Servicing, and that these programs have officers and staff with the requisite qualifications, skills, and ability to comply with the Privileged & U.S. Bancorp Confidential Target Due Date Action Plan Cross-Reference Complete See below Review the results of the assessment of ERM, ECP, and Audit staffing and plan as incorporated into the Effectiveness Review and Enhancement Plans. Complete XII.b.1.00 Review the results of the Residential Mortgage Default Management staffing assessment and plan, as performed in response to OCC Consent Order requirements. Complete I.c.3.01 Approve the initial enhanced resource plan for the Mortgage Servicing Audit Schedule. Complete XIV.c.1.02 Assure existing processes to review overall ERM, ECP, and Audit staffing adequately consider needs related to the oversight of Residential Mortgage Servicing. 1/31/12 XII.b.1.04 1/31/12 See below Detailed Steps - 24 - Status December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 2 Board Oversight Action Item requirements of the Orders. Privileged & U.S. Bancorp Confidential Target Due Date Action Plan Cross-Reference Formalize a quarterly process to re-evaluate and review staffing needs to complete the Mortgage Servicing Audit Schedule, including Board reporting of audit hour metrics. Complete XIV.c.1.03 Formalize a quarterly process to re-evaluate and review staffing needs to complete the RMDM Compliance Quality Assurance (CQA) schedule, including Board reporting of CQA testing hour metrics, as part of the annual compliance planning process enhancements. 1/31/12 XIII.a.2.09 Develop and implement processes for conducting semiannual staffing assessments for Line of Business, Default Management, activities , including Board reporting of significant changes. Complete IX.4.00 Enhance regular Board reporting to include metrics with respect to Line of Business, Default Management, staffing such as workload (e.g., loan files per specialist), trends in staffing and workload, and performance related indicators (e.g., call abandonment rates and adherences to target timelines). 1/31/12 VI.5.06 Assure existing processes to review overall ERM, ECP, and Audit staffing needs adequately consider needs related to the oversight of Residential Mortgage Servicing. 1/31/12 XII.b.1.04 Detailed Steps - 25 - Status December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 2 Requirement Board Oversight Information and Reports (d) Steps to improve the information and reports that will be regularly reviewed by the board of directors regarding loan servicing, Loss Mitigation, and foreclosure activities and operations, including, compliance risk assessments, and the status and results of measures taken, or to be taken, to remediate deficiencies in loan servicing, Loss Mitigation, and foreclosure activities, and to comply with this Order. USB will enhance the Board’s oversight of Residential Mortgage Servicing operations as monitored by ERM, ECP, and Audit through the implementation of regular Board reporting to monitor actions to comply with the Consent Orders, as well as through improvements in the reporting of risks and remediation activities (as identified by regulators or as self-identified by the Bank’s risk management programs), as detailed in the chart below. Additional enhancements, particularly with respect to staffing, risk assessments, and the status of the remediation deficiencies, are underway. Action Item Establish regular Board reporting to monitor actions to comply with the Orders. Detailed Steps Design monthly reporting package for the Compliance Committee, as required by the OCC Order. Enhance Audit Committee reporting to include updates regarding the status of Corporate Audit Services actions with respect to the OCC and FRB Consent Orders. Enhance Risk Management Committee reporting to include updates regarding the status of overall actions to comply with the OCC and FRB Consent Orders. Design quarterly progress reporting package for the full Board, as required by the OCC and FRB Consent Orders. Review results of assessments and reviews conducted in response to Consent Order requirements. Review results of Effectiveness Evaluation for ERM, Compliance, and Internal Audit. Approve enhancement plans for submission to FRB. Review Initial Comprehensive Risk Assessment as required by the OCC Consent Order. Review Risk Management Remediation Plan as required by the OCC Consent Order. Review Foreclosure Review Report and Remediation Plan as required by the OCC Consent Order. Privileged & U.S. Bancorp Confidential - 26 - Status Target Due Date Action Plan Cross-Reference Complete See below Complete I.e.1.01 Complete I.f.1.08 Complete I.f.1.09 Complete I.e.2.01 Ongoing See below Complete I.c.1.04 Complete I.c.3.02 Complete I.c.3.03 7/15/12 I.c.3.04 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 2 Board Oversight Action Item Enhance regular Board reporting to facilitate the Board’s oversight of ongoing Residential Mortgage Servicing operations as monitored by ERM, ECP, and Audit including risk information as well as information regarding the remediation of deficiencies in these activities (as identified by regulators or as self-identified by the Bank’s risk management programs). Privileged & U.S. Bancorp Confidential Detailed Steps Monitor execution of Management Information Systems (“MIS”) reporting actions as detailed in the MIS workstream section of the Action Plan, including review of existing MIS environment, development of MIS enhancement plans, and implementation of enhanced MIS. Develop and implement enhanced quarterly Board reporting related to Line of Business Default Management operations as monitored by ERM, ECP, and Audit including: - Business activity metrics (e.g., loss mitigation and foreclosure volumes) - Performance standards (e.g., timelines and other targets) - Complaints - Vendor oversight - Results of line of business quality control testing - Results of CQA testing - Results of Audits and regulatory exams - Status of the remediation of deficiencies. Establish regular Board progress reporting regarding Compliance testing calendar execution, including any testing related to RMDM activities and open issues, and the status of issue remediation. Enhance Audit Committee quarterly updates to highlight RMDM audit activities, including open issues and the status of issue remediation. Review and enhance ongoing Board reporting with regard to Residential Mortgage Servicing risk assessments (i.e. the annual comprehensive risk assessment and any business as - 27 - Status Target Due Date Action Plan Cross-Reference Ongoing See below Complete Section VI Complete VI.5.05 XII.a.6.02 Complete XIII.a.2.08 Complete XIV.a.2.04 1/31/12 XII.a.6.03 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 2 Board Oversight Action Item Privileged & U.S. Bancorp Confidential Detailed Steps usual assessments performed by ERM, ECP and Audit) and the status of the remediation of identified deficiencies. - 28 - Status Target Due Date Action Plan Cross-Reference December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 3 Risk Management Program Requirement Evaluation of Effectiveness The plan shall be based on an evaluation of the effectiveness of USB’s current ERM program in the areas of residential mortgage loan servicing, Loss Mitigation, and foreclosure activities and operations, and recommendations to strengthen the ERM in these areas. In accordance with the terms of the Consent Order, Promontory Financial Group, LLC (“Promontory”) evaluated the Bank’s Enterprise Risk Management (“ERM”) Program with respect to Residential Mortgage Servicing activities and operations. Findings and recommendations of this Effectiveness Review contributed to the development of plans to enhance the program. Action Item Retain consultants to perform risk assessment and effectiveness review of risk oversight functions with respect to Default Management activities. Detailed Steps Prepare to conduct assessments. Define and agree on methodology for conducting the risk assessment. Define and agree on methodology for conducting the effectiveness review of the risk oversight functions (Enterprise Risk Management, Corporate Audit Services, and Corporate Compliance). Identify team and assign responsibilities. Evaluate the effectiveness of USB’s risk oversight programs with respect to Default Management activities. Conduct and complete the effectiveness evaluation of Enterprise Risk Management. Provide recommendations to enhance the risk oversight programs covering Default Management activities (recommendations regarding the Compliance program will be addressed by the Compliance workstream). Develop plans to enhance risk oversight programs with respect to Default Management activities. Privileged & U.S. Bancorp Confidential Develop a plan to enhance the ERM program with respect to Residential Mortgage Servicing based on the result of the Effectiveness Review. - 29 - Status Target Due Date CAP/SAP Cross-Reference Complete VIII.1.00 Complete VIII.2.00 Complete VIII.2.01 Complete VIII.2.02 Complete VIII.2.03 Complete VIII.3.00 Complete VIII.3.01 Complete VIII.3.04 Complete VIII.4.00 Complete VIII.4.01 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 3 Risk Management Program Action Item Privileged & U.S. Bancorp Confidential Detailed Steps Submit supplemental enhancement plans to the FRB for approval. - 30 - Status Target Due Date CAP/SAP Cross-Reference Complete VIII.4.04 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 3 Risk Management Program Requirement Program Scope (a) Ensure that the fundamental elements of the risk management program and any enhancements or revisions thereto, including a comprehensive annual risk assessment, encompass loan servicing, Loss Mitigation, and foreclosure activities; The Effectiveness Review by Promontory, in conjunction with the Bank’s own investigative work, identified certain opportunities to better ensure that the ERM program encompasses residential mortgage loan servicing activities. Those areas included potential enhancements to the risk assessment process, the ERM Policy, vendor risk management activities, reporting, and mortgage servicing policies. Action steps were developed to fully address each of the issues noted, and are included in the Bank’s CAP and SAPs as indicated in the chart below. All steps have been completed except for final changes to the ERM Policy and the last steps regarding improvements in the operational risk assessment process. Action Item Enhance consideration of mortgage servicing risks in Operational Risk Scenario Analysis Workshops. Target Due Date CAP/SAP Cross-Reference Complete XII.a.1.00 Integrate evaluation of mortgage origination process and foreclosure process risks into the 2011 operational risk scenario workshops. Complete XII.a.1.01 Review key business units for applicability of these risks. Complete XII.a.1.02 Facilitate discussion of these risks during applicable workshops. Complete XII.a.1.03 Ongoing XII.a.2.00 Complete XII.a.2.01 Complete XII.a.2.02 12/31/11 XII.a.2.03 Ongoing XII.a.2.04 12/15/11 XII.a.3.00 Detailed Steps Enhance consideration of mortgage servicing risk in RCSA process. Review and approve business unit RCSA certifications. Review risk management impacts for year-end 2011 RCSA and implement appropriate risk management enhancements. Track any improvement plans that may be relevant to RCSA risks. Enhance consideration of reputational risk with regard to mortgage servicing in Business Risk Scenario Workshops. Privileged & U.S. Bancorp Confidential - 31 - Status December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 3 Risk Management Program Target Due Date CAP/SAP Cross-Reference Complete XII.a.3.01 Complete XII.a.3.02 Complete XII.a.3.03 12/15/2011 XII.a.3.04 Conduct Annual Mortgage Servicing Risk Assessment. 8/14/2012 XV.c.1.00 Revise the ERM Policy as it relates to how risk exposure is considered in the capital planning process. Complete XII.a.5.02 Prepare and seek Board approval of the revised ERM Policy. Complete XII.a.5.03 Implement and distribute the revised ERM Policy. Complete XII.a.5.04 4/30/12 XII.a.5.05 Prepare and seek Board approval of the revised ERM Policy. 4/30/12 XII.a.5.06 Implement and distribute the revised ERM Policy. 4/30/12 XII.a.5.07 Complete See below Complete VI.5.04 XII.a.6.01 Complete VI.5.05 XII.a.6.02 Ongoing XII.a.4.00 Action Item Detailed Steps Evaluate risk information obtained from the Operational Risk Scenario process and other relevant sources. Work with Corporate Treasury to prepare documentation for Business Risk Workshop. Facilitate Business Risk Scenario Workshop and obtain opinions regarding scenarios related to mortgage origination and foreclosure risks as well as strategic and reputational risk. Report results to Corporate Treasury for capital modeling purposes. Revise the ERM Policy as it relates to risk tolerances and limits. Enhance management and Board reporting with regard to Residential Mortgage Servicing. Develop and implement an enhanced quarterly senior management reporting related to RMDM, including operational performance and risk indicators. Develop and implement an enhanced quarterly Board reporting related to RMDM, including operational performance and risk indicators. Monitor actions taken to secure compliance with the provisions of FRB Consent Order, and the results thereof, with particular focus on the effectiveness of new Privileged & U.S. Bancorp Confidential - 32 - Status December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 3 Risk Management Program Action Item policies, programs and procedures with respect to Residential Mortgage Servicing compliance and thirdparty service provider management. Ensure that the Bank’s Vendor Risk Management Program (“VRMP”) covers all third party vendors regarding Residential Mortgage Servicing. Privileged & U.S. Bancorp Confidential Target Due Date CAP/SAP Cross-Reference Ongoing See below Amend and obtain approval for the Corporate Vendor Risk Management Policy. Complete III.2.00 XII.a.8.01 Develop and obtain approval for the RMDM Third Party Management Guidelines. Complete Implement the revised VRMP. Complete Ensure oversight of VRMP by Risk Management as set forth in the ERM Policy. Ongoing Detailed Steps - 33 - Status III.3.00 III.4.00 XII.a.8.02 III.5.00 XII.a.8.03 XII.a.8.04 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 3 Risk Management Program Requirement Compliance with supervisory guidance (b) Ensure that the risk management program complies with supervisory guidance of the Board of Governors, including, but not limited to, the guidance entitled, “Compliance Risk Management Programs and Oversight at Large Banking Organizations with Complex Compliance Profiles,” dated October 16, 2008 (SR 08-08/CA 0811); and The Effectiveness Review by Promontory, in conjunction with the Bank’s own investigative work, identified certain opportunities to better ensure that the ERM program complies with supervisory guidance of the Board of Governors. Those areas included potential enhancements to testing and monitoring processes, independence of the corporate compliance function, and ongoing staffing assessments. Action steps were developed to fully address each of the issues noted, and are included in the Bank’s CAP and SAPs as indicated in the chart below. All action steps have been completed except for formalized staffing review processes. Action Item Target Due Date CAP/SAP Cross-Reference Complete XII.b.2.00 Ensure appropriate communication of the Corporate Compliance “Roles and Responsibilities” document to reinforce the independence of Compliance function. Complete XII.b.2.01 Review and enhance, as necessary, the Corporate Compliance onboarding and annual review processes to reinforce the Corporate Compliance “Roles and Responsibilities” expectations. Complete XII.b.2.02 Complete XIII.b.2.00 Perform gap analysis of Legal Requirements, as defined by the FRB Consent Order. Complete XIII.b.2.01 Implement enhanced quality control testing and monitoring for RMDM. Complete XIII.b.2.02 Develop specific testing programs for RMDM. Complete XIII.b.2.03 Enhance ongoing processes to report results via RMDM metrics reporting process. Complete XIII.b.2.04 Detailed Steps Ensure continuing compliance with SR08-08. Design a line of business quality control program to routinely monitor and test key procedures and compliance controls for mortgage default-related activities. Privileged & U.S. Bancorp Confidential - 34 - Status December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 3 Risk Management Program Action Item Conduct an initial review of staffing levels in ERM, ECP, and Audit with respect to Residential Mortgage Servicing. Target Due Date CAP/SAP Cross-Reference Complete See below Evaluate, as part of the Effectiveness Review, resources dedicated to the ERM, ECP, and Audit Oversight Functions with respect to Residential Mortgage Servicing, including consideration of: staffing levels vs. workloads; levels of officers vs. staff; requisite qualifications, skills, and ability. Complete XII.b.1.00 Identify staffing required to execute the Mortgage Servicing Audit Schedule. Complete XIV.c.1.01 1/31/12 See below Formalize a quarterly process to re-evaluate and review staffing needs to complete the Mortgage Servicing Audit Schedule, including Board reporting of audit hour metrics. Complete XIV.c.1.03 Formalize a quarterly process to re-evaluate and review staffing needs to complete the RMDM CQA schedule, including Board reporting of CQA testing hour metrics, as part of the annual compliance planning process enhancements. 1/31/12 XIII.a.2.09 Assure existing processes to review overall ERM, ECP, and Audit staffing needs adequately consider needs related to the oversight of Residential Mortgage Servicing. 1/31/12 XII.b.1.04 Detailed Steps Review and strengthen processes to identify and monitor staffing needs in ERM, ECP, and Audit with respect to Residential Mortgage Servicing. Privileged & U.S. Bancorp Confidential - 35 - Status December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 3 Risk Management Program Requirement Risk Limits (c) Establish limits for compliance, legal, and reputational risk and provide for regular review of risk limits by appropriate senior management and the board of directors or authorized committee of the board of directors. The Effectiveness Review by Promontory in conjunction with the Bank’s own investigative work, identified certain opportunities to better document the Bank’s risk limits with regard to compliance, legal, and reputational risks. Those areas included potential enhancements to risk limit metrics, as well as communicating and reporting such limits. Action steps were developed to fully address each of the issues noted, and are included in the Bank’s CAP and SAPs, as indicated in the chart below. Action Item Detailed Steps Ensure appropriate risk limits and tolerances with regard to RMDM. Work with appropriate corporate control functions, including, Credit, Treasury, and ERM to evaluate current risk limits related to RMDM as reflected on the Bank’s scorecard presented regularly to the Board. Ensure development of appropriate risk limits and tolerances with regard to RMDM and regular review of the associated risk limits by Residential Mortgage Servicing, Credit Administration, Bank senior management the Board’s Risk Management Committee Reinforce the Bank’s “zero tolerance” policy with regard to compliance violations as well as any actions that are detrimental to the Bank’s reputation via the Bank’s annual code of ethics and business conduct certification process. Incorporate additional risk tolerance metrics into reporting and scorecard as appropriate. Privileged & U.S. Bancorp Confidential - 36 - Status Target Due Date CAP/SAP Cross-Reference 1/31/12 See below Complete XII.c.1.00 11/30/11 XII.c.2.00 12/31/11 XII.c.3.00 1/31/12 XII.c.4.00 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 4 Requirement Enterprise Compliance Program Evaluation of Effectiveness The plan shall be based on an evaluation of the effectiveness of USB’s current ECP in the areas of residential mortgage loan servicing, Loss Mitigation, and foreclosure activities and operations, and recommendations to strengthen the ECP in these areas. In accordance with the terms of the Consent Order, Promontory evaluated the Bank’s Enterprise Compliance Program (“ECP”) with respect to Residential Mortgage Servicing activities and operations. Findings and recommendations of the Effectiveness Review contributed to the development of plans to enhance the ECP program. Action Item Retain consultants to perform risk assessment and effectiveness review of risk oversight functions with respect to Default Management activities. Detailed Steps Prepare to conduct assessments. Define and agree on methodology for conducting the risk assessment. Define and agree on methodology for conducting the effectiveness review of the risk oversight functions (Enterprise Risk Management, Corporate Audit Services, and Corporate Compliance). Identify team and assign responsibilities. Evaluate the effectiveness of USB’s risk oversight programs with respect to Default Management activities. Conduct and complete the effectiveness evaluation of Corporate Compliance program. Provide recommendations to enhance the risk oversight programs covering Default Management activities (recommendations regarding the Compliance program will be addressed by the Compliance workstream). Develop plans to enhance risk oversight programs with respect to Default Management activities. Privileged & U.S. Bancorp Confidential Develop a plan to enhance USB’s ECP with respect to Residential Mortgage Servicing based on the result of the Effectiveness Review. - 37 - Status Target Due Date Action Plan Cross-Reference Complete VIII.1.00 Complete VIII.2.00 Complete VIII.2.01 Complete VIII.2.02 Complete VIII.2.03 Complete VIII.3.00 Complete VIII.3.03 Complete VIII.3.04 Complete VIII.4.00 Complete VIII.4.03 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 4 Enterprise Compliance Program Action Item Privileged & U.S. Bancorp Confidential Detailed Steps Submit supplemental enhancement plans to the FRB for approval. - 38 - Status Target Due Date Action Plan Cross-Reference Complete VIII.4.04 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 4 Enterprise Compliance Program (a) Requirement Program Scope Ensure that the fundamental elements of the ECP and any enhancements or revisions thereto, including a comprehensive annual risk assessment, encompass residential mortgage loan servicing, Loss Mitigation, and foreclosure activities; The Effectiveness Review by Promontory, as well as the Bank’s own investigative work, identified certain opportunities for enhancement of the ECP. Those areas included potential enhancements to documents regarding policy and procedures as well as the annual risk assessment and other compliance planning processes. Action steps were developed to fully address each of the issues noted and are included in the Bank’s CAP and SAPs as indicated in the chart below. Policy and procedures enhancements are complete. Action Item Ensure that policies and procedures with regard to Residential Mortgage Servicing are consistent and comprehensive. Target Due Date Action Plan Cross-Reference Complete XIII.a.1.00 Review the Compliance Charter and enhance, as necessary, to encompass Residential Mortgage Servicing. Complete XIII.a.1.01 Develop a RMDM Compliance Policy and Program. Complete XIII.a.1.02 Develop Residential Mortgage Default Management Compliance Guidelines (the “RMDM Guidelines”). Complete XIII.a.1.03 Obtain Board approval of any changes to the Compliance Charter related to Residential Mortgage Servicing activities and the RMDM Compliance Policy and Program. Complete XIII.a.1.04 Obtain management approval of the new RMDM Guidelines. Complete XIII.a.1.05 Ongoing XIII.a.2.00 1/31/12 XIII.a.2.01 11/30/11 XIII.a.2.02 Detailed Steps Enhance annual processes designed to ensure the continuing effectiveness of compliance programs with respect to Residential Mortgage Servicing. Complete annual review of Compliance Charter. Introduce a comprehensive annual compliance planning process. Privileged & U.S. Bancorp Confidential - 39 - Status December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 4 Enterprise Compliance Program Action Item Privileged & U.S. Bancorp Confidential Detailed Steps Status Target Due Date Action Plan Cross-Reference Enhance the annual Enterprise Compliance Risk Assessment process to include a risk rating of applicable regulations. Complete Complete XIII.a.2.03 - 40 - December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 4 Enterprise Compliance Program Conduct an annual Enterprise Compliance Risk Assessment which comprehensively addresses Residential Mortgage Servicing risks Ongoing XIII.a.2.04 Prepare a 2012 compliance testing calendar in accordance with the revised processes and enhanced risk ratings. 12/31/11 XIII.a.2.05 Obtain Board review and approval of the 2012 compliance testing calendar. 1/30/12 XIII.a.2.06 Evaluate Corporate Compliance oversight of business line compliance policies and training. 12/31/11 XIII.a.2.07 Establish regular Board progress reporting regarding compliance testing calendar execution. 1/30/12 XIII.a.2.08 Ongoing XIII.a.3.00 Identify positions, duties and responsibilities for staff required to execute compliance functions for Residential Mortgage Servicing. Complete XIII.a.3.01 Hire and train compliance managers to perform Residential Mortgage Servicing compliance functions. Complete XIII.a.3.02 Obtain approval of the resource plan. Complete XIII.a.3.03 Hire and train additional staff to perform Residential Mortgage Servicing CQA testing. Complete XIII.a.3.04 Establish ongoing processes to assess Residential Mortgage Servicing-related staffing needs. Complete XIII.a.3.05 Conduct annual performance assessments to ensure that staff maintains effectiveness ensuring compliance with applicable laws and Bank policy. Ongoing XIII.a.3.06 Expand compliance resources to enhance coverage on Residential Mortgage Servicing matters. Privileged & U.S. Bancorp Confidential - 41 - December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 4 Requirement Enterprise Compliance Program Compliance with Legal Requirements and Supervisory Guidance (b) Ensure compliance with the Legal Requirements and supervisory guidance of the Board of Governors; and The Effectiveness Review by Promontory, in conjunction with the Bank’s own investigative work, identified certain opportunities to better ensure compliance with Legal Requirements and supervisory guidance of the Board of Governors. Those areas included potential enhancements to RMDM testing and monitoring processes, vendor risk management activities, employee training and bank-wide personnel practices. Action steps were developed to fully address each of the issues noted and are included in the Bank’s CAP and SAPs as indicated in the chart below. Testing and monitoring and vendor management items are complete and the training courses have been developed as planned. Action Item Design an enhanced CQA program for Residential Mortgage Servicing. Target Due Date Action Plan Cross-Reference Complete XIII.b.1.00 Perform gap analysis of Legal Requirements as defined by the FRB Consent Order . Complete XIII.b.1.01 Implement the enhanced CQA program for Residential Mortgage Servicing. Complete XIII.b.1.02 Develop specific testing programs for Residential Mortgage Servicing activities. Complete XIII.b.1.03 Enhance ongoing processes to report results through existing CQA process. Complete XIII.b.1.04 Complete See below Complete III.2.00 Complete III.3.00 III.4.00 Detailed Steps Review and revise vendor management policies and procedures as relate to Residential Mortgage Default Management. Analyze current corporate Vendor Management Policy as the basis for Residential Mortgage Default Management ThirdParty Vendor Management Guidelines. Develop guidelines with respect to the retention, monitoring and oversight of third-parties providing foreclosure or related services in connection with Residential Mortgage Default Management activities. Implement Guidelines for Vendors providing Residential Privileged & U.S. Bancorp Confidential - 42 - Status Complete III.5.00 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 4 Enterprise Compliance Program Action Item Mortgage Default Management related services. Target Due Date Action Plan Cross-Reference Complete III.5.01 Complete III.5.02 Complete III.5.03 Complete III.5.04 Complete XIII.d.1.00 Develop training strategy/approach. Complete XIII.d.1.01 Develop a 3-module course; make available for access through the USB Learning Management System. Complete XIII.d.1.02 Obtain senior management, Legal and Compliance review and sign-offs on materials. Complete XIII.d.1.03 Enhance ongoing processes to roll-out Default Management training. Complete XIII.d.1.04 Enhance ongoing process to track training completion. Complete XIII.d.1.05 1/31/12 XIII.d.2.00 10/31/11 XIII.d.2.01 Detailed Steps Communicate new Guidelines to Vendors providing Residential Mortgage Default Management related services. Conduct initial assessment and certification of foreclosure attorneys as prescribed by the Residential Mortgage Default Management Third-Party Vendor Guidelines and launch corrective actions as required. Conduct initial review of non-attorney vendors providing Residential Mortgage Default Management related services for compliance with RMDM Vendor Guidelines and launch corrective actions as required. Implement standard vendor management protocols for foreclosure attorneys. Develop and implement formal group-wide training for Default Management personnel to include Compliance policies and guidelines. Establish training guidelines for new Compliance Officers, in both Corporate Compliance and the Business Lines, who serve specific business areas in operational support roles. Define training objectives/principles for new compliance officers serving in operational support roles to specific Privileged & U.S. Bancorp Confidential - 43 - Status December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 4 Enterprise Compliance Program Target Due Date Action Plan Cross-Reference Develop new Compliance Officer training guidelines. 12/31/11 XIII.d.2.02 Obtain approval of guidelines. 12/31/11 XIII.d.2.03 Approve new training guidelines for compliance officers. 12/31/11 XIII.d.2.04 Implement new training guidelines For compliance officers 1/31/12 XIII.d.2.05 Complete See below Ensure appropriate communication of the corporate compliance “Roles and Responsibilities” document to reinforce the independence of compliance function. Complete XII.b.2.01 Review and enhance, as necessary, the Corporate Compliance onboarding and annual review processes to reinforce the Corporate Compliance “Roles and Responsibilities” expectations. Complete XII.b.2.02 Identify Business Line Compliance Personnel (“BLCP”) who have “primary” business line compliance management responsibilities. Complete XIII.b.3.01 Develop a detailed outline for BLCP that establishes formal reporting relationships and emphasizes BLCP accountability to Corporate Compliance in the performance of compliance related responsibilities. Complete XIII.b.3.02 Develop a plan where Corporate Compliance will handle decisions and actions for annual budgets, performance Complete XIII.b.3.03 Action Item Detailed Steps Status business areas. Adjust personnel practices to ensure continuing compliance with SR08-08 in particular as relates to the independence of individuals with primary compliance management responsibilities. Privileged & U.S. Bancorp Confidential - 44 - December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 4 Enterprise Compliance Program Action Item Detailed Steps reviews, hiring decisions and remuneration involving BLCP. Approve outline and plan and communicate to applicable BLCP. Complete annual performance and compensation plan reviews for BLCP. Privileged & U.S. Bancorp Confidential - 45 - Status Target Due Date Action Plan Cross-Reference Complete XIII.b.3.04 12/31/11 & Ongoing XIII.b.3.05 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 4 Requirement Enterprise Compliance Program Changes to Legal Requirements and Supervisory Guidance (c) Ensure that policies, procedures, and processes are updated on an ongoing basis as necessary to incorporate new or changes to the Legal Requirements and supervisory guidance of the Board of Governors. The Effectiveness Review by Promontory , in conjunction with the Bank’s own investigative work, identified certain opportunities to better ensure that policies, procedures, and processes are updated as necessary. Those areas included potential enhancements in the Bank’s change control processes and procedures as well as resources dedicated to monitoring changes in Legal Requirements and supervisory guidance. Action steps were developed to fully address each of the issues noted and are included in the Bank’s CAP and SAPs as indicated in the chart below. Change control enhancements are complete. Action Item Strengthen Legal Requirement change control in Corporate Compliance with respect to RMDM. Build out Legal Department resources needed with respect to monitoring developments in Residential Mortgage Servicing Legal Requirements, particularly as they relate to state requirements with the intent to insource this function in the future. Privileged & U.S. Bancorp Confidential Target Due Date Action Plan Cross-Reference Complete See below Engage outside counsel, as an interim solution, to monitor and advise the Bank of developments with respect to Legal Requirements as they relate to Residential Mortgage Servicing activities, particularly for state-specific and other non-federal requirements. Complete II.1.01 XIII.c.1.01 Develop a protocol to communicate regulatory requirement changes on a routine, basis to Residential Mortgage Servicing personnel as appropriate. Complete II.1.05 XIII.c.1.02 Develop a protocol for reviewing regulatory changes to determine their impact on policies and procedures and to develop plans to achieve compliance. Complete II.1.05 XIII.c.1.03 Implement the Residential Mortgage Servicing Legal Requirements protocol. Complete II.1.05 XIII.c.1.04 Review Corporate Compliance change control processes to ensure effective integration Complete XIII.c.1.05 12/31/11 XIII.c.2.00 Detailed Steps - 46 - Status December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 4 Enterprise Compliance Program Action Item Privileged & U.S. Bancorp Confidential Target Due Date Action Plan Cross-Reference Identify resource needs to meet enhanced Legal Requirements for Residential Mortgage Servicing. Complete XIII.c.2.01 Fill identified vacancies. 12/31/11 XIII.c.2.02 Detailed Steps - 47 - Status December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 5 Audit Requirement Evaluation of Effectiveness The plan shall be based on an evaluation of the effectiveness of USB’s current internal audit program in the areas of residential mortgage loan servicing, Loss Mitigation, and foreclosure activities and operations, and recommendations to strengthen the internal audit program in these areas. In accordance with the terms of the Consent Order, the Bank’s Internal Audit Program was evaluated with respect to Residential Mortgage Servicing activities and operations by Promontory Financial Group, LLC (“Promontory”). Findings and recommendations of the Effectiveness Review contributed to the development of plans to enhance the program. Action Item Retain consultants to perform risk assessment and effectiveness review of risk oversight functions with respect to Default Management activities. Detailed Steps Prepare to conduct assessments. Define and agree on methodology for conducting the risk assessment. Define and agree on methodology for conducting the effectiveness review of the risk oversight functions (Enterprise Risk Management, Corporate Audit Services, and Corporate Compliance). Identify team and assign responsibilities. Evaluate the effectiveness of USB’s risk oversight programs with respect to Default Management activities Conduct and complete the effectiveness evaluation of Corporate Audit Services. Provide recommendations to enhance the risk oversight programs covering Default Management activities (recommendations regarding the Compliance program will be addressed by the Compliance workstream). Develop plans to enhance risk oversight programs with respect to Default Management activities. Privileged & U.S. Bancorp Confidential Develop an enhanced Internal Audit program with respect to Residential Mortgage Servicing based on the result of the Effectiveness Review. - 48 - Status Target Due Date CAP/SAP Cross-Reference Complete VIII.1.00 Complete VIII.2.00 Complete VIII.2.01 Complete VIII.2.02 Complete VIII.2.03 Complete VIII.3.00 Complete VIII.3.02 Complete VIII.3.04 Complete VIII.4.00 Complete VIII.4.02 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 5 Audit Action Item Privileged & U.S. Bancorp Confidential Detailed Steps Submit supplemental enhancement plans to the Reserve Bank for approval. - 49 - Status Target Due Date CAP/SAP Cross-Reference Complete VIII.4.04 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 5 Audit Requirement Audit Scope (a) Ensure that the internal audit program encompasses residential mortgage loan servicing, Loss Mitigation, and foreclosure activities; The Effectiveness Review by Promontory, in conjunction with the Bank’s own investigative work identified certain opportunities to better ensure that the internal audit program encompasses residential mortgage loan servicing. Those areas included expansion of the audit schedule for Residential Mortgage servicing as well as enhancements to the annual audit planning process. Action steps were developed to fully address each of the issues noted, and are included in the Bank’s CAP and SAPs as indicated in the chart below. The 2011 audit schedule was expanded in accordance with the action steps and the audit planning procedures have been amended as planned. Action Item Develop and implement an expanded 2011 audit schedule for Residential Mortgage Servicing. Detailed Steps Target Due Date Complete CAP/SAP Cross-Reference VIII.4.02 XIV.a.1.00 Review scope of Mortgage Servicing activities. Complete XIV.a.1.01 Assess risk associated with mortgage servicing business activities. Complete XIV.a.1.02 Develop risk-based mortgage servicing audit program. Complete XIV.a.1.03 Develop audit schedule and estimate audit hours required. Complete XIV.a.1.04 Submit revised mortgage servicing audit schedule to Audit Committee for approval. Complete XIV.a.1.05 Implement revised mortgage servicing audit schedule. Complete XIV.a.1.06 11/30/11 XIV.a.2.00 Review and revise the annual audit planning procedures. Complete XIV.a.2.01 Obtain approval of changes to annual planning procedures. Complete XIV.a.2.02 Develop the 2012 audit plan for Residential Mortgage Servicing according to the revised procedures. 11/30/11 XIV.a.2.03 Review and revise the annual audit planning process with respect to Residential Mortgage Servicing. Privileged & U.S. Bancorp Confidential Status - 50 - December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 5 Audit Requirement Periodic Reviews of ECP and ERM Effectiveness (b) Periodically review the effectiveness of the ECP and ERM with respect to residential mortgage loan servicing, Loss Mitigation, and foreclosure activities, and compliance with the Legal Requirements and supervisory guidance of the Board of Governors; The Effectiveness Review by Promontory, in conjunction with the Bank’s own investigative work, identified certain opportunities to enhance reviews of ECP and ERM activities with respect to residential mortgage loan servicing activities. Those areas primarily involved expansion of the audit schedule over such activities. Action steps, all of which are now complete, were developed to fully address each of the issues noted, and are included in the Bank’s CAP and SAPs as indicated in the chart below. Action Item Review the Effectiveness Review findings and enhance the 2011 audit schedule with respect to ECP and ERM. Privileged & U.S. Bancorp Confidential Target Due Date CAP/SAP Cross-Reference Complete See below Obtain results of the Promontory Effectiveness Review of ECP and ERM. Complete VIII.3.04 XIV.b.1.01 Develop a risk-based audit program for Mortgage Servicing ECP and ERM activities including testing of the effectiveness review recommendations. Complete VIII.4.00 XIV.b.1.02 Incorporate into Mortgage Servicing Audit Schedule for approval and implementation. Complete XIV.b.1.03 Detailed Steps - 51 - Status December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 5 Audit Requirement Audit Staffing (c) Ensure that adequate qualified staffing of the audit function is provided for residential mortgage loan servicing, Loss Mitigation, and foreclosure activities; The Effectiveness Review by Promontory in conjunction with the Bank’s own investigative work, identified certain opportunities to better ensure appropriate staffing of the audit function with regard to residential mortgage loan servicing. Those areas included potential enhancements to staffing assessment and hiring processes. Action steps were developed to fully address each of the issues noted, and are included in the Bank’s CAP and SAPs as indicated in the chart below. The staffing assessment has been completed and hiring processes enhanced. Action Item Identify and monitor staffing requirements to execute the Mortgage Servicing Audit Schedule. Target Due Date CAP/SAP Cross-Reference Complete XIV.c.1.00 Identify staffing required to execute the Mortgage Servicing Audit Schedule. Complete XIV.c.1.01 Approve the resource plan for the Mortgage Servicing Audit Schedule. Complete XIV.c.1.02 Formalize a quarterly process to re-evaluate staffing needs to complete the plan. Complete XIV.c.1.03 Complete XIV.c.2.00 Improve the internal tracking process, including reporting metrics, to identify requisitions that are proving difficult. Complete XIV.c.2.01 Identify and engage a preferred list of external recruiting agencies to use when requisitions are deemed difficult. Complete XIV.c.2.02 10/31/11 XIV.c.3.00 Complete XIV.c.4.00 Detailed Steps Strengthen processes to secure resources for difficult-tofill Audit positions. Review audit staff compensation levels against the Bank’s current market-based salary plans. Work with Human Resources to develop a plan and timeline regarding the implementation of adjustments for those individuals requiring salary revisions. Identify audit engagements where external subject matter expertise is required to meet the audit objectives, Privileged & U.S. Bancorp Confidential - 52 - Status December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 5 Audit Action Item and secure appropriate resources from our approved vendors (e.g., KPMG, Deloitte, Protiviti). Privileged & U.S. Bancorp Confidential Detailed Steps - 53 - Status Target Due Date CAP/SAP Cross-Reference December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 5 Audit (d) Ensure timely resolution of audit findings and follow-up reviews to ensure completion and effectiveness of corrective measures; Requirement Audit Findings, Reporting and Escalation (e) Ensure that comprehensive documentations, tracking, and reporting of the status and resolution of audit findings are submitted to the audit committee; and (f) Establish escalation procedures for resolving any differences of opinion between audit staff and management concerning audit exceptions and recommendation, with any disputes to be resolved by the audit committee. The Effectiveness Review by Promontory, in conjunction with the Bank’s own investigative work, identified certain opportunities to better ensure that audit findings are appropriately reported and resolved. Those areas included potential enhancements to the CAS Policies and Procedures manual, expanded reporting processes, and more formalized relationships between CAS and the business lines. Action steps were developed to fully address each of the issues noted and are included in the Bank’s CAP and SAPs as indicated in the chart below. Action Item Review and update the CAS Policies and Procedures manual regarding the timely resolution of audit findings and conduct of follow-up reviews. Target Due Date CAP/SAP Cross-Reference 12/31/11 XIV.d.1.00 Review existing resolution and follow-up. 10/31/11 XIV.d.1.01 Draft changes to the CAS Policies and Procedures manual regarding timely resolution and follow-up. 11/15/11 XIV.d.1.02 Approve any changes to the CAS Policies and Procedures manual regarding timely resolution and follow-up. 11/30/11 XIV.d.1.03 Implement any changes to the CAS Policies and Procedures manual regarding timely resolution and follow-up. 12/31/11 XIV.d.1.04 12/31/11 XIV.e.1.00 10/31/11 XIV.e.1.01 Detailed Steps Review and update the CAS Policies and Procedures manual regarding the documentation, tracking and reporting status and resolution of CAS findings. Review existing documentation. Privileged & U.S. Bancorp Confidential - 54 - Status December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraph 5 Audit Action Item Target Due Date CAP/SAP Cross-Reference Draft changes to the CAS Policies and Procedures manual regarding documentation. 11/15/11 XIV.e.1.02 Approve any changes to the CAS Policies and Procedures manual regarding documentation. 11/30/11 XIV.e.1.03 Implement any changes to the CAS Policies and Procedures manual regarding documentation. 12/31/11 XIV.e.1.04 12/31/11 XIV.e.2.00 Complete XIV.f.1.00 12/31/11 XIV.g.1.00 Inventory the list of data sources currently used by TSG. Complete XIV.g.1.01 Prioritize the list of Service Level Agreements (SLAs) that need to be secured and propose a timeline for completing those agreements. Complete XIV.g.1.02 Develop a standard template to use when documenting an SLA. Complete XIV.g.1.03 Negotiate and formalize the SLAs with the technical support and data owners for data sources identified as part of the data source inventory with respect to Residential Mortgage Servicing. 12/31/11 XIV.g.1.04 Detailed Steps Expand the status reporting process to include distribution to business line management. Highlight the issue escalation process to the audit staff as part of a standard Professional Practices communication. Formalize relationships with business lines and/or business line technical support. Privileged & U.S. Bancorp Confidential - 55 - Status December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraphs 6 & 7 Approval, Implementation, and Progress Reports Requirement Submission of Enhancement Plans USB shall submit written plans that are acceptable to the Reserve Bank within the applicable time periods set forth in paragraphs 3,4, and 5 of this Order Pursuant to the terms of the FRB Consent Order, the Bank submitted enhancement plans, based upon the Effectiveness Reviews, for ERM, Compliance, and Internal Audit on July 13, 2011. Action Item Obtain Board oversight of the Effectiveness Review and resultant enhancement plans. Detailed Steps Status Review results of Effectiveness Review for ERM, Compliance, and Internal Audit. Approve enhancement plans for submission to FRB. Develop plans to enhance risk oversight program with respect to Default Management activities. Submit supplemental enhancement plans to the FRB for approval. Requirement Adopt Plans Target Due Date CAP/SAP Cross-Reference Complete See below Complete I.c.1.04 Complete VIII.4.00 Complete VIII.4.04 Within 10 days of approval by the FRB, USB shall adopt the approved plans and program. Upon adoption, USB shall implement the approved plans and thereafter fully comply with them. Upon FRB approval, the Bank will adopt the enhancement plans. The submitted enhancement plans are in the process of being implemented, but The Bank will make changes, as needed, to comply with the approved versions of the plans, when available. Action Item Obtain Board oversight regarding the adoption of the Enhancement Plans. Detailed Steps Adopt ERM, Compliance, and Internal Audit enhancement plans following FRB approval. Privileged & U.S. Bancorp Confidential - 56 - Status Target Due Date CAP/SAP Cross-Reference 6/20/11 See below 6/20/11 I.c.1.05 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraphs 6 & 7 Approval, Implementation, and Progress Reports During the term of this Order, the approved plans shall not be amended or rescinded without the prior written approval of the Reserve Bank. Requirement Changes to Plans During the term of this Order, USB shall revise the approved plans as necessary to incorporate new or changes to the Legal Requirements and supervisory guidance of the Board of Governors. The revised plans shall be submitted to the Reserve Bank for approval at the same time as the progress reports described in paragraph 7 of this Order. The Bank logs all changes to the plans and reviews changes monthly with the Board Compliance Committee and quarterly with the Board Risk Committee and full Board. New or changes to legal requirements and supervisory guidance from the Board of Governors are monitored and incorporated into the plans as needed. Revised plans are submitted to the FRB along with the quarterly progress reports, upon request, and if material changes require approval. Action Item Perform project change control over plans and deliverables. Detailed Steps Design and launch change control program to consider bank initiated and regulatory mandated changes to Action Plan. Monitor material changes to the Action Plan schedule after initial submissions; if any, submit to the Compliance committee and Bank supervisors for approval. Monitor material changes to deliverables after initial submission; if any, submit to the Compliance Committee and the Bank Supervisors for approval. Privileged & U.S. Bancorp Confidential - 57 - Status Target Due Date CAP/SAP Cross-Reference Ongoing I.f.3.00 Complete I.f.3.01 Ongoing I.f.3.02 Ongoing I.f.3.03 December 9, 2011 U.S. Bancorp Federal Reserve Consent Order Action Plan A Summary Excerpt of the Bank’s Overall Comprehensive and Supplemental Action Plans As of December 9, 2011 Paragraphs 6 & 7 Requirement Approval, Implementation, and Progress Reports Written Progress Reports Within 30 days after the end of each calendar quarter following the date of this Order, the board of directors of USB or authorized committee of the board of directors shall submit to the Reserve Bank written progress reports detailing the form and manner of all actions taken to secure compliance with the provisions of this Order and the results thereof. The Reserve Bank may, in writing, discontinue the requirement for progress reports or modify the reporting schedule. In compliance with the FRB Consent Order, the Bank has submitted quarterly progress reports to the Board, and to the FRB on July 19, 2011 and October 19, 2011. The third quarterly report will be submitted prior to the end of January 2012. Future reports will continue to be submitted until the FRB modifies or discontinues the reporting schedule. Action Item Target Due Date CAP/SAP Cross-Reference Ongoing I.e.2.00 Design quarterly reporting package for the Board. Complete I.e.2.01 Prepare 1st quarterly progress report and submit to Board. Complete I.e.2.02 Submit 1st quarterly progress report to the OCC and FRB. Complete I.e.2.03 Complete I.e.2.04 Submit 2nd quarterly progress report to the OCC and FRB. Complete I.e.2.05 Prepare 3rd quarterly progress report and submit to Board. 1/5/12 I.e.2.06 Submit 3rd quarterly progress report to the OCC and FRB. 1/30/12 I.e.2.07 Establish ongoing responsibilities and processes for the submission of quarterly progress reports for as long as required by the FRB consent order. 1/30/12 I.e.2.08 Detailed Steps Report Quarterly Progress. Prepare 2nd quarterly progress report and submit to Board. Privileged & U.S. Bancorp Confidential - 58 - Status December 9, 2011