EXHIBIT 99.3
UNITED STATES OF AMERICA
BEFORE THE
BOARD OF GOVERNORS OF THE FEDERAL RESERVE SYSTEM
------------------------------------------
Written Agreement by and among :
:
FIFTH THIRD BANCORP :
Cincinnati, Ohio :
:
FIFTH THIRD BANK :
Cincinnati, Ohio :
:
FEDERAL RESERVE BANK :
OF CLEVELAND :
Cleveland, Ohio :
:
and :
:
STATE OF OHIO DEPARTMENT OF :
COMMERCE, DIVISION OF :
FINANCIAL INSTITUTIONS :
Columbus, Ohio :
------------------------------------------
WHEREAS, Fifth Third Bancorp, Cincinnati, Ohio ("Fifth Third"), a
registered bank holding company, owns and controls its lead subsidiary bank,
Fifth Third Bank, Cincinnati, Ohio (the "Bank"), a state chartered bank that is
a member of the Federal Reserve System, and five other subsidiary banks, Fifth
Third Bank, Grand Rapids, Michigan; Fifth Third Bank, Indiana, Indianapolis,
Indiana; Fifth Third Bank, Kentucky, Inc., Louisville, Kentucky; Fifth Third
Bank, Northern Kentucky, Inc., Covington, Kentucky; and Fifth Third Bank,
Florida, Naples, Florida (the "Subsidiary Banks"), which are state chartered
banks that are members of the Federal Reserve System;
WHEREAS, on its own behalf and on behalf of the Bank and the Subsidiary
Banks, Fifth Third is addressing deficiencies noted by the Federal Reserve Bank
of Cleveland (the "Reserve Bank") and the Ohio Division of Financial
Institutions (the "Division") and is taking steps to enhance and improve its
risk management, internal controls, financial accounting, audit, and information
technology functions, as well as its management and corporate governance
policies and procedures;
WHEREAS, in recognition of Fifth Third's efforts to work in cooperation
with the Reserve Bank and the Division, its progress in implementing corrective
actions, and its commitment to assuring the availability of resources necessary
to address deficiencies, Fifth
Third, the Bank, the Reserve Bank, and the Division have mutually agreed to
enter into this Written Agreement (the "Agreement"); and
WHEREAS, on March 25, 2003, the boards of directors of Fifth Third and
the Bank, at duly constituted meetings, adopted resolutions authorizing and
directing ▇▇▇▇▇▇ ▇. ▇▇▇▇▇▇▇▇, ▇▇., President and Chief Executive Officer of
Fifth Third and the Bank, to enter into this Agreement on behalf of Fifth Third
and the Bank, respectively, and consenting to compliance by Fifth Third and the
Bank and their institution-affiliated parties, as defined in sections 3(u) and
8(b)(3) of the Federal Deposit Insurance Act (the "FDI Act") (12 U.S.C. 1813(u)
and 1818(b)(3)), and the Bank's regulated persons, as defined in Ohio Revised
Code section 1121.01(A), with each and every applicable provision of this
Agreement.
NOW, THEREFORE, Fifth Third, the Bank, the Reserve Bank, and the
Division agree as follows:
Management Review
1. (a) Fifth Third shall complete its engagement of an independent
management consultant (the "Corporate Consultant") to conduct a review of the
structure, functions, composition, and performance of Fifth Third's and the
Bank's management and boards of directors (the "Corporate Review"), and to
prepare a written report (the "Corporate Consultant's Report") that includes
findings, conclusions, and written descriptions of any management or operational
changes recommended as a result of the Corporate Review. The primary goals of
the Corporate Review shall be, first, to assist Fifth Third's board of directors
in the development of adequate board and management structures that are staffed
by qualified and trained personnel suitable to the needs of the Fifth Third
consolidated organization and, second, to improve corporate governance practices
at the board of directors, committee and management levels. The Corporate Review
shall, at a minimum, address, consider, and include:
(i) An evaluation of the effectiveness of the boards of
directors of Fifth Third and the Bank, as well as their committees, in carrying
out their oversight responsibilities, including but not limited to, an
evaluation of the adequacy of information provided to the boards of directors
and committees, and the frequency of board of directors and committee meetings;
(ii) an assessment of the adequacy throughout the
consolidated organization of the identification and reporting of deficiencies
and weaknesses to senior management and the boards of directors;
(iii) an evaluation of the management structures of Fifth
Third and the Bank, including recommendations regarding the type and number of
senior officer and officer positions needed to manage and properly supervise the
affairs of Fifth Third, the Bank, and the Subsidiary Banks; and
(iv) an evaluation of each senior officer of Fifth Third and
the Bank to determine whether the individual possesses the ability, experience,
and other qualifications
2
required to competently perform present and anticipated duties, to adhere to
established policies and procedures, and to comply with the requirements of this
Agreement.
(b) Within 10 days of this Agreement, but prior to the
commencement of the Corporate Review, to the extent not already provided, Fifth
Third and the Bank shall submit to the Reserve Bank and the Division for
approval an engagement letter that delineates: (i) the scope of the Corporate
Review; (ii) the date of submission of the Corporate Consultant's Report, not to
exceed 90 days after the date of approval of the engagement letter by the
Reserve Bank and the Division; and (iii) the proposed Corporate Consultant
resources to be dedicated to the Corporate Review.
(c) Fifth Third and the Bank shall fully cooperate with the
Corporate Consultant and agree that the Corporate Consultant will have complete
access to all employees, books, records, documents, and communications necessary
to conduct the Corporate Review. A copy of the Corporate Consultant's Report
shall be provided to the Reserve Bank and the Division at the same time that it
is provided to Fifth Third and the Bank.
(d) Within 60 days after Fifth Third's and the Bank's receipt of
the Corporate Consultant's Report, Fifth Third and the Bank shall submit an
acceptable joint written management plan to the Reserve Bank and the Division
describing specific actions that the boards of directors propose to take to
fully address the findings and recommendations of the Corporate Consultant's
Report.
2. Within 180 days of receipt of the Corporate Consultant's Report,
and thereafter not less frequently than semi-annually, Fifth Third's and the
Bank's boards of directors shall review management's adherence to written
policies and procedures in the areas of risk management, internal controls,
financial accounting, audit, information technology, corporate governance,
financial and regulatory reporting, and compliance and shall prepare written
findings and conclusions of this review along with written descriptions of any
management or operational changes that are made as a result of the review. The
occurrence of the semi-annual review shall be noted in the minutes of the boards
of directors meetings, and the written findings and information reviewed by the
boards of directors to conduct this review shall be maintained for subsequent
regulatory review.
Risk Management
3. Within 90 days of this Agreement, Fifth Third and the Bank shall
submit to the Reserve Bank and the Division an acceptable joint written plan
designed to strengthen and improve the risk management processes for the
consolidated organization that covers its operations, products, and financial
activities, including but not limited to, information technology, wire transfer,
account reconciliation, and treasury and trust operations. The plan shall, at a
minimum, address, consider, and include:
(a) An enterprise-wide, independent structure, overseen by an
experienced senior executive level risk management officer, designed to ensure
the evaluation of all functional risk management processes, identification and
monitoring of aggregate risk exposures,
3
and reporting of enterprise-wide risk exposures in all areas to senior
management and Fifth Third's board of directors;
(b) improvements to the oversight of risk management processes by
the boards of directors, including but not limited to, timely response to
identified deficiencies and risks;
(c) policies and procedures to establish controls, define
responsibilities, and set risk tolerance levels for the consolidated
organization;
(d) policies and procedures to identify and assess all risks
associated with new operations, products, and financial activities and to ensure
that internal controls to manage those risks are in place;
(e) improvements to management information systems and reporting
procedures to ensure the accuracy of data provided to management and the board
of directors, including but not limited to, the performance of independent
validations of market risk models;
(f) strengthened internal controls for the consolidated
organization that are designed to effectively manage risks; and
(g) training for appropriate personnel at Fifth Third, the Bank,
and the Subsidiary Banks in all risk management areas.
Accounting, Financial, and Internal Controls
4. Within 90 days of this Agreement, Fifth Third and the Bank shall
jointly submit to the Reserve Bank and the Division acceptable written
accounting policies and procedures for the consolidated organization designed to
enhance the accounting control environment; to strengthen procedures for access
to books and records, including the general ledger; to strengthen internal
account opening processes and charge-off processes and controls; and to provide
a sound accounting framework, with appropriate guidance on accounting matters.
The accounting policies and procedures shall also specifically address account
reconciliation processes and controls and shall, at a minimum, address,
consider, and include:
(a) Standardized processes to perform accurate and timely account
reconciliations, consistent with generally accepted accounting principles
("GAAP"), including use of standard reconciliation formats and procedures;
(b) timely and independent review and approval of reconciliations;
(c) appropriate segregation of duties with respect to the
preparation, review and approval of account reconciliations;
(d) appropriate action with respect to identified aged items,
including but not limited to, timely and appropriate charge-offs and timely and
accurate reports to management;
4
(e) retention and availability of work papers and other records of
reconciliations for internal and external audit review and regulatory review;
and
(f) training of all personnel engaged in the account
reconciliation function to ensure that they have sufficient skills and knowledge
to perform accurate reconciliations consistent with GAAP.
5. Fifth Third shall continue to work with the independent firm it
previously retained with the approval of the Reserve Bank and the Division to
complete by March 31, 2003, a full reconciliation of all internal accounts of
Fifth Third, the Bank, the Subsidiary Banks, and all nonbank subsidiaries, as of
December 31, 2002. By April 11, 2003, Fifth Third shall resolve any remaining
unreconciled items in accordance with the applicable charge-off policy.
6. Within 90 days of this Agreement, Fifth Third and the Bank shall
submit to the Reserve Bank and the Division acceptable joint written policies
and procedures designed to strengthen internal controls throughout the
consolidated organization. The policies and procedures shall address internal
control criticisms noted in the report of the examination of Fifth Third and the
Bank conducted by the Reserve Bank and the Division, commenced on November 12,
2002 (the "Report of Examination"), including but not limited to, criticisms in
the areas of account reconciliation and treasury operations, and shall also, at
a minimum, address, consider, and include:
(a) Management information systems to ensure that appropriate
management personnel receive timely and accurate reports necessary to
effectively manage business risks and correct weaknesses and deficiencies; and
(b) appropriate segregation of duties in all areas, including but
not limited to, the funds transfer function, and treasury and trust operations.
Financial Statements and Regulatory Reports
7. Fifth Third and the Bank shall take actions designed to ensure that
all general ledger accounts are reconciled on at least a monthly basis to ensure
accurate regulatory reporting and disclosures required under banking and
securities laws. Records of such reconciliations shall be maintained for
internal and external audit review and for subsequent regulatory review.
8. Fifth Third and the Bank shall take all actions as are necessary to
ensure that each regulatory report, including Forms Y-9C and Reports of
Condition and Income, accurately reflects Fifth Third's and the Bank's condition
on the date for which it is filed, and that all records indicating how the
report was prepared are maintained for subsequent supervisory review.
Internal Audit
5
9. (a) Within 10 days of this Agreement, Fifth Third shall engage an
independent firm acceptable to the Reserve Bank and the Division to conduct a
review of the enterprise-wide internal audit function and to prepare a written
report that includes findings, conclusions, and descriptions of any managerial
or operational changes recommended as a result of the review. The terms of the
engagement letter shall provide that the independent firm will submit its report
within 60 days of its engagement and will provide a copy of its report to the
Reserve Bank and the Division at the same time that it is provided to Fifth
Third. The review and report shall address, consider, and include, at a minimum:
(i) The independence of the internal audit function;
(ii) the responsibilities and activities of the audit
committee;
(iii) the adequacy of information provided to the audit
committee;
(iv) the adequacy of audit staffing;
(v) the adequacy of audit planning and risk assessments;
(vi) the coverage, frequency and scope of internal audits;
(vii) the adequacy of internal audit work programs; and
(viii) the adequacy of formal management responses to audit
findings.
(b) Within 30 days after Fifth Third's receipt of the independent
review of the internal audit function, Fifth Third shall submit an acceptable
written plan to the Reserve Bank and the Division describing specific actions
that Fifth Third's board of directors propose to take to fully address the
findings and recommendations of the review.
(c) Within 45 days after Fifth Third's receipt of the independent
review of the internal audit function, Fifth Third shall review Fifth Third's
previously adopted 2003 audit plan in consideration of the findings and
recommendations of the internal audit review and shall revise the plan
accordingly. The revised 2003 audit plan shall be approved by Fifth Third's
board of directors, or an appropriate committee thereof. The revised 2003 audit
plan shall require that any deviation from the audit plan be immediately
reported, in writing, to the audit committee and the board of directors.
10. Fifth Third's internal audit department shall submit a written
audit plan for each year subsequent to the year of this Agreement to Fifth
Third's board of directors, or an appropriate committee thereof, no later than
November 30th of the preceding year. The written audit plan shall detail the
scope, nature, and scheduling of all audit work to be conducted for the
consolidated organization in all areas for the year. The plan shall cover all
operational areas and shall require that any deviation from the audit plan be
immediately reported, in writing, to the audit committee and the board of
directors. All plans required by this paragraph shall be
6
approved by Fifth Third's board of directors, or an appropriate committee
thereof, and retained and made available for subsequent regulatory review.
7
Strategic Plan and Budget
11. (a) Within 180 days of this Agreement, Fifth Third shall submit to
the Reserve Bank and the Division a written enterprise-wide strategic plan and
budget concerning Fifth Third's proposed business activities for the three-year
period beginning in 2004. The plan and budget shall, at a minimum, provide for
or describe:
(i) The responsibilities of Fifth Third's board of directors
regarding the definition, approval, implementation and monitoring of the
strategic plan and budget, and the procedures designed to ensure that the board
of directors fulfills such responsibilities;
(ii) development and adoption of policies, procedures,
controls, and processes required to ensure the safe and sound operation of new
activities and products as well as expanded functions;
(iii) establishment of protocols designed to ensure that all
areas of operations, including back office, are appropriately funded and that
the organization's infrastructure keeps up with anticipated growth; and
(iv) financial performance objectives, including plans for
asset growth, earnings, liquidity, and capital supported by detailed quarterly
and annual pro forma financial statements, including projected budgets, balance
sheets and income statements.
(b) For each year subsequent to the year of this Agreement, Fifth
Third shall prepare a written update to the enterprise-wide strategic plan and
budget. Such updates shall be included in the minutes of the boards of directors
meetings and maintained for subsequent regulatory review.
Information Technology
12. Within 90 days of this Agreement, Fifth Third and the Bank shall
submit to the Reserve Bank and the Division an acceptable joint written plan
designed to improve the information technology function of the consolidated
organization. The plan shall, at a minimum, address, consider, and include:
(a) Performance of an enterprise-wide information security risk
assessment, as required by Appendix D-2 to Part 208 of Regulation H and Appendix
F to Part 225 of Regulation Y of the Board of Governors, designed to enable
Fifth Third and the Bank to meet all applicable requirements for protecting
nonpublic customer information, and to assist Fifth Third and the Bank in making
future adjustments to safeguards as appropriate;
(b) enhancements to Fifth Third's and the Bank's existing
policies, procedures and controls that address physical and logical information
security, including but not limited to, physical access to work areas, and user
access to business applications;
8
(c) an evaluation of electronic payment platforms to identify and
correct any weaknesses in policies and procedures related to physical and
logical information security; and
(d) implementation of procedures and controls to increase the
effectiveness and integrity of the program change processes of the consolidated
organization.
Funds Transfer Activities
13. (a) Within 10 days of this Agreement, Fifth Third and the Bank
shall engage an independent firm acceptable to the Reserve Bank and the Division
to conduct a review of funds transfer activities, evaluate improvements in funds
transfer activities, and prepare a report with findings and recommendations to
improve and strengthen, where needed, funds transfer activities.
(b) Within 10 days of this Agreement, but prior to the
commencement of the independent firm's review of funds transfer activities, to
the extent not already provided, Fifth Third and the Bank shall submit to the
Reserve Bank and the Division for approval an engagement letter that delineates:
(i) the scope of the review; and (ii) the date of submission of the independent
firm's report, not to exceed 90 days after the date of approval of the
engagement letter by the Reserve Bank and the Division. A copy of the report
shall be provided to the Reserve Bank and the Division at the same time that it
is provided to Fifth Third.
(c) Within 30 days after Fifth Third's and the Bank's receipt of
the independent firm's report, Fifth Third and the Bank shall submit an
acceptable joint written plan to the Reserve Bank and the Division that
describes the specific actions that the boards of directors propose to take to
fully address the findings and recommendations of the report.
Treasury and Trust Operations
14. (a) Within 90 days of this Agreement, Fifth Third and the Bank
shall complete their revision of the policies, procedures and controls in the
treasury operations area.
(b) Upon completion of the revision required by paragraph 14(a),
Fifth Third and the Bank shall engage an independent firm acceptable to the
Reserve Bank and the Division to conduct a review of the treasury operations
area and prepare a written report that includes findings, conclusions and
recommendations to further strengthen, where needed, the policies, procedures
and controls, including but not limited to, management reporting, critical
operating processes, separation of duties, and staff training and expertise. The
terms of the engagement shall provide that the independent firm will submit its
report within 60 days of its engagement and will provide a copy of its report to
the Reserve Bank and the Division at the same time that it is provided to Fifth
Third and the Bank.
(c) Within 30 days after Fifth Third's receipt of the third party
report, Fifth Third and the Bank shall submit an acceptable joint written plan
to the Reserve Bank and the Division that describes the specific actions that
the boards of directors propose to take to fully address the findings and
recommendations of the independent firm's report.
9
15. By June 30, 2003, Fifth Third and the Bank shall complete the
ongoing project to reconstruct treasury transactions conducted from March 1,
2000 through September 30, 2002 (the "Reconstruction Project"). Thereafter,
Fifth Third and the Bank shall take the following steps:
(a) Upon completion of the Reconstruction Project, Fifth Third and
the Bank shall engage an independent firm acceptable to the Reserve Bank and the
Division to review and validate the Reconstruction Project. The terms of the
engagement shall provide that the independent firm will prepare a written report
that includes findings, conclusions and written descriptions of any deficiencies
in the Reconstruction Project and recommendations for corrections. The terms of
the engagement shall provide that the independent firm will submit its report
within 30 days of its engagement and will provide a copy of its report to the
Reserve Bank and the Division at the same time that it is provided to Fifth
Third and the Bank.
(b) Within 10 days of receipt of the independent third party
review and validation of the Reconstruction Project, the boards of directors
shall ensure that all charge-offs and recoveries identified by the
Reconstruction Project are appropriately reflected in the Bank's Reports of
Condition and Income.
16. Within 90 days of this Agreement, Fifth Third and the Bank shall
submit to the Reserve Bank and the Division acceptable joint written policies
and procedures designed to strengthen management oversight of trust operations
and improve the accuracy of the books and records of the trust operations area
for the consolidated organization. These procedures shall include, at a minimum,
corrective steps to address criticisms noted in the Report of Examination,
including but not limited to, those in the areas of settlement accounts, system
settlement, system access, and physical security.
Compliance Committee
17. Within 15 days of this Agreement, the boards of directors of Fifth
Third and the Bank shall establish a joint committee to monitor compliance with
the provisions of this Agreement (the "Compliance Committee"). The Compliance
Committee shall be comprised of three or more outside directors who are not
officers or employees of Fifth Third, the Bank, any of the Subsidiary Banks or
any nonbank subsidiary; who do not directly or indirectly own more than ten
percent of the outstanding shares of Fifth Third; and who do not serve in the
capacity of an executive officer or policy making officer of any entity that
owns more than ten percent of Fifth Third. At a minimum, the Compliance
Committee shall keep detailed minutes of each meeting and shall report its
findings to Fifth Third's and the Bank's boards of directors on a monthly basis.
Effect and Terms of Agreement
18. The written plans, policies, procedures, and engagement letters
required by paragraphs 1(b), 1(d), 3, 4, 6, 9(b), 12, 13(b), 13(c), 14(c), and
16 of this Agreement shall be submitted to the Reserve Bank and the Division for
review and approval. Acceptable plans,
10
policies, and procedures, and acceptable engagement letters shall be submitted
within the time periods set forth in this Agreement. Fifth Third and the Bank,
as appropriate, shall adopt the approved plans, policies, procedures, and
engagement letters within 10 days of approval by the Reserve Bank and the
Division and then shall fully comply with them. During the term of this
Agreement, the approved plans, policies, procedures, and engagement letters
shall not be amended or rescinded without the prior written approval of the
Reserve Bank and the Division.
19. Within 30 days after the end of each calendar quarter (June 30,
September 30, December 31, March 31) following the date of this Agreement, Fifth
Third and the Bank shall furnish a joint written progress report detailing the
form and manner of all actions taken to secure compliance with the provision of
this Agreement, and the results thereof, to the Reserve Bank and the Division.
20. All communications regarding this Agreement shall be sent to:
(a) ▇▇▇▇▇▇ ▇. ▇▇▇▇▇▇▇▇, ▇▇.
President and Chief Executive Officer
Fifth Third Bancorp
▇▇ ▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇
▇▇▇▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇
(b) ▇▇▇▇▇▇ ▇. ▇▇▇▇▇▇, ▇▇.
Senior Vice President
Federal Reserve Bank of Cleveland
▇▇▇▇ ▇▇▇▇ ▇/▇▇/ ▇▇▇▇▇▇
▇▇▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇-▇▇▇▇
(c) ▇. ▇▇▇▇▇ ▇'▇▇▇▇▇▇▇
Superintendent of Financial Institutions
State of Ohio
Department of Commerce
Division of Financial Institutions
▇▇ ▇▇▇▇▇ ▇▇▇▇ ▇▇▇▇▇▇ - ▇▇/▇▇/ ▇▇▇▇▇
▇▇▇▇▇▇▇▇, ▇▇▇▇ ▇▇▇▇▇-▇▇▇▇
21. The provisions of this Agreement shall be binding on Fifth Third,
the Bank, and each of their institution-affiliated parties in their capacities
as such, and their successors and assigns.
22. Each provision of this Agreement shall remain effective and
enforceable until stayed, modified, terminated, or suspended by the Reserve Bank
and the Division.
23. Notwithstanding any provision of this Agreement, the Reserve Bank
and the Division may, in their discretion, grant written extensions of time to
Fifth Third and the Bank, as appropriate, to comply with any provision of this
Agreement.
11
24. The provisions of this Agreement shall not bar, estop or otherwise
prevent the Reserve Bank, the Board of Governors of the Federal Reserve System,
the Division, any other federal or state agency or department from taking any
other action affecting Fifth Third, the Bank, the Subsidiary Banks, any nonbank
subsidiary, or any of their current or former institution-affiliated parties and
their successors and assigns.
25. This Agreement is a "written agreement" for the purposes of, and is
enforceable by the Board as an order issued under, section 8 of the FDI Act (12
U.S.C. 1818).
26. This Agreement is a "written agreement" under Section 1121.32(A),
1121.33(A)(1)(a)(iv) and 1121.35(A) of the Ohio Revised Code. Violation of a
written agreement is grounds for the Division to pursue a cease and desist
order, civil money penalties, and/or the removal of any "regulated person" as
defined under Section 1121.01(A) of the Ohio Revised Code.
IN WITNESS WHEREOF, the parties have caused this Agreement to be
executed as of the 26/th/ day of March, 2003.
Fifth Third Bancorp Federal Reserve Bank of Cleveland
By: /s/ ▇▇▇▇▇▇ ▇. ▇▇▇▇▇▇▇▇, ▇▇. By: /s/ ▇▇▇▇▇▇ ▇. ▇▇▇▇▇▇, ▇▇.
----------------------------- --------------------------
▇▇▇▇▇▇ ▇. ▇▇▇▇▇▇▇▇, ▇▇. ▇▇▇▇▇▇ ▇. ▇▇▇▇▇▇, ▇▇.
Senior Vice President
Fifth Third Bank State of Ohio, Department of Commerce
Division of Financial Institutions
By: /s/ ▇▇▇▇▇▇ ▇. ▇▇▇▇▇▇▇▇, ▇▇. By: /s/ ▇. ▇▇▇▇▇ ▇'▇▇▇▇▇▇▇
----------------------------- -----------------------
▇▇▇▇▇▇ ▇. ▇▇▇▇▇▇▇▇, ▇▇. ▇. ▇▇▇▇▇ ▇'▇▇▇▇▇▇▇
Superintendent of
Financial Institutions
12
