Background Financial Regulators Regulators for the Banking  Industry All depository institutions that have federal deposit insurance have a  federal prudential regulator, which generally may issue regulations and  take enforcement actions against institutions within its jurisdiction (see  table 1). The securities and futures markets are regulated under a combination of  self-regulation (subject to oversight by the appropriate federal regulator)  and direct oversight by the Securities and Exchange Commission (SEC)  and Commodity Futures Trading Commission (CFTC), respectively. SEC  regulates the securities markets, including participants such as corporate  issuers, securities exchanges, broker-dealers, investment companies,  and certain investment advisers and municipal advisors. SEC’s mission  is to protect investors; maintain fair, orderly, and efficient markets; and  facilitate capital formation. SEC also oversees self-regulatory  organizations—including securities exchanges, clearing agencies, and  the Financial Industry Regulatory Authority—that have responsibility for  overseeing securities markets and their members; establishing standards  under which their members conduct business; monitoring business  conduct; and bringing disciplinary actions against members for violating  applicable federal statutes, SEC’s rules, and their own rules. CFTC is the primary regulator for futures markets, including futures  exchanges and intermediaries, such as futures commission merchants.  CFTC’s mission is to protect market users and the public from fraud,  manipulation, abusive practices, and systemic risk related to derivatives  subject to the Commodity Exchange Act, and to foster open, transparent,  competitive, and financially sound futures markets. CFTC oversees the  registration of intermediaries and relies on self-regulatory organizations,  including the futures exchanges and the National Futures Association, to  establish and enforce rules governing member behavior. CFTC and SEC  jointly regulate security futures (generally, futures on single securities and  narrow-based security indexes). CFTC and SEC serve as primary  regulators for certain designated financial market utilities. In addition, Title VII of the Dodd-Frank Act expands regulatory  responsibilities for CFTC and SEC by establishing a new regulatory  framework for swaps. The act authorizes CFTC to regulate swaps and  SEC to regulate security-based swaps with the goals of reducing risk,  increasing transparency, and promoting market integrity in the financial  system. CFTC and SEC share authority over mixed swaps—that is,  security-based swaps that have a commodity component. Consumer Financial Protection  Bureau The Dodd-Frank Act transferred consumer financial protection oversight  and other authorities over certain consumer financial protection laws from  multiple federal regulators to the Consumer Financial Protection Bureau  (CFPB). The Dodd-Frank Act charged CFPB with responsibilities that  include the following: ensuring that consumers are provided with timely and understandable  information to make responsible decisions about financial  transactions; ensuring that consumers are protected from unfair, deceptive, or  abusive acts and practices and from discrimination; monitoring compliance with federal consumer financial law and taking  appropriate enforcement action to address violations;  identifying and addressing outdated, unnecessary, or unduly  burdensome regulations; ensuring that federal consumer financial law is enforced consistently,  in order to promote fair competition; ensuring that markets for consumer financial products and services  operate transparently and efficiently to facilitate access and  innovation; and  conducting financial education programs. Furthermore, the Dodd-Frank Act gave CFPB supervisory authority over  certain nondepository institutions, including certain kinds of mortgage  market participants, private student loan lenders, and payday lenders. Regulatory Flexibility Act The uniform application of new or revised regulations can have a  comparatively greater impact on smaller entities than on larger entities  because the smaller entities have small staffs with which to face  expanded demands and a smaller asset and income base with which to  absorb increases in compliance costs. RFA was enacted in 1980 in part  to address this disparity. The act requires that federal agencies, including  the financial regulators, engaged in substantive rulemaking analyze the  impact of proposed and final regulations on small entities and, when there  may be a significant economic impact on a substantial number of small  entities, to consider any significant regulatory alternatives that will achieve  statutory objectives while minimizing any significant economic impact on  small entities. RFA defines “small entity” to include small businesses,  small governmental jurisdictions, and certain small not-for-profit  organizations. RFA does not seek preferential treatment for small entities, require  agencies to adopt regulations that impose the least burden on small  entities, or mandate exemptions for small entities. Rather, it requires  agencies to examine public policy issues using an analytical process that  identifies, among other things, barriers to small business competitiveness  and seeks a level playing field for small entities, not an unfair advantage.  Unless the head of the agency certifies that the proposed regulation  would not have a significant economic impact upon a substantial number  of small entities, RFA requires regulators to prepare an initial regulatory  flexibility analysis for each draft rule that requires a notice of proposed  rulemaking. These analyses must contain an assessment of the rule’s  potential impact on small entities and describe any significant alternatives  to the rule that would reduce its burden on small entities while achieving  statutory objectives (see table 2 for more information). RFA requires that regulators publish in the Federal Register their initial  regulatory flexibility analysis, or a summary, with the proposed rule.  Following a public comment period, RFA requires regulators to conduct a  similar analysis when they promulgate the final rule—the final regulatory  flexibility analysis. This analysis must address any comments received on  the initial regulatory flexibility analysis and include a description of the  steps the agency took to minimize the rule’s significant economic impact  on small entities, consistent with statutory objectives. Agencies then must  publish the final analysis, or a summary, with the final rule. If the head of the agency certifies in the Federal Register that the rule  would not have a significant economic impact on a substantial number of  small entities, agencies do not have to conduct the initial or final  analysis. Certifications must include a statement providing a factual  basis for the certification. Agencies may make a certification in lieu of the  initial or final analysis, and can choose to certify at both points. Figure 1  illustrates the decision process that agencies must follow to comply with  RFA. Section 610 of RFA requires agencies to review, within 10 years of a final  rule’s publication, those rules assessed as having a significant economic  impact on a substantial number of small entities to determine if they  should be continued without change, amended, or rescinded (consistent  with statutory objectives) to minimize any significant economic impact on  small entities. Section 610 requires that agencies publish in the Federal  Register a list of the rules that have a significant economic impact on a  substantial number of small entities and are to be reviewed pursuant to  section 610 during the upcoming year. These notices alert the public to  the upcoming review and permit interested parties to submit their  comments on the rule’s impact on small entities. The Dodd-Frank Act, which established CFPB, amended RFA to impose  additional rulemaking requirements for CFPB for certain proposed rules.  Specifically, when CFPB conducts rulemakings it expects will have a  significant economic impact on a substantial number of small entities it  must convene Small Business Review Panels, comprising employees  from CFPB, the Small Business Administration’s Chief Counsel for  Advocacy, and Office of Management and Budget’s (OMB) Office of  Information and Regulatory Affairs. The panels must seek direct input  from a representative group of small entities that would be affected by  CFPB’s rulemakings. The panels must be conducted before publication of  an initial regulatory flexibility analysis (in effect, before the proposed rule  is issued for public comment). RFA designates certain responsibilities to the Small Business  Administration’s Chief Counsel for Advocacy, including monitoring agency  compliance with RFA and reviewing federal rules for their impact on small  businesses. Executive Order 13272 requires the Office of Advocacy to  provide notifications about RFA requirements and training to all agencies  on complying with RFA. The Office of Advocacy published guidance on  complying with RFA in 2003 (updated in 2012 and August 2017), which  was designed to be a step-by-step guide for agency officials. The Small Business Administration publishes size standards to determine  eligibility for classification as a small entity. Generally, to qualify as a  small entity the annual asset threshold for banks is $550 million in assets;  for financial investment and related activities, the annual revenues  threshold is $38.5 million. Most agencies rely on these size standards;  however, RFA also sets forth a procedure that permits agencies to  formulate their own definitions of small entities. Many Rules Were Not  Subject to RFA  Requirements and  Regulators  Concluded Many  Would Not  Significantly Affect  Small Entities Regulators Determined  That Almost 40 Percent of  Recent Rules Were Not  Subject to RFA  Requirements Rules that do not have a proposed rule are not subject to RFA  requirements, such as analyzing the rule’s effects on small entities and  considering alternatives. Financial regulators promulgated 520 rules (483  final and 37 interim final) during calendar years 2010–2016. Of those,  RFA requirements were not applicable in 39 percent (204 rules) because  the regulators did not publish a proposed rule. The regulators published a  proposed rule for the other 316 final rules. This result is consistent with  our prior analysis of rulemaking government wide. In December 2012, we  found that about 35 percent of major rules and about 44 percent of  nonmajor rules published during calendar years 2003–2010 did not have  a proposed rule. The percentage of rules finalized without a proposed  rule and therefore not subject to RFA requirements varied by regulator.  As shown in figure 2, CFPB had the largest percentage (53 percent) of  rules not subject to RFA requirements and CFTC the smallest percentage  (16 percent). In their rulemakings, the regulators gave several reasons for not  publishing a proposed rule. The Administrative Procedure Act (APA),  which outlines the process for informal rulemaking, includes six broad  categorical exceptions to publishing a proposed rule (for example, rules  dealing with agency organization and procedure). Additionally, APA  provides that an agency may forgo a notice of proposed rulemaking when  it finds for “good cause” that such notice is “impractical, unnecessary, or  contrary to the public interest.” We found that the regulators used such  exceptions for a number of the rules we reviewed. For example, in  December 2015, the Office of the Comptroller of the Currency (OCC), the  Board of Governors of the Federal Reserve System (Federal Reserve),  and the Federal Deposit Insurance Corporation (FDIC) used the good- cause exception to publish a joint rule to adjust the asset-size thresholds  for small and intermediate banks and savings associations related to  performance standards under the Community Reinvestment Act without a  proposed rule. According to the Federal Register notice, the agencies  had no discretion on the computation or timing of the changes, which  were based on a regulation that previously had been published for public  comment before being finalized. In another rule published in October  2013, SEC made changes to the filer manual for its Electronic Data  Gathering, Analysis, and Retrieval System based on updates to the  system and did not publish a proposed rule because the rule changes  related solely to agency procedures or practice. According to CFPB  officials, the majority of final CFPB rules issued during this time period  without a proposed rule involved technical—and in many cases non- discretionary—adjustments of statutory or regulatory thresholds to  account for inflation. While RFA requirements do not apply when an agency does not publish a  proposed rule, all the financial regulators (except OCC) occasionally  performed some RFA evaluation in rules without a proposed rule. For  example, each agency, except for OCC, certified that at least one of the  final rules they promulgated without publishing a proposed rule (within our  time frame) would not have a significant economic impact on a substantial  number of small entities. The Federal Reserve most frequently performed  some RFA analyses in these rules, although such analyses were not  required. Of 51 rules without a proposed rule, the Federal Reserve  certified in 7 rules and performed an initial or final regulatory flexibility  analysis in 10 rules. Most Recent Rules  Subject to RFA  Requirements Were  Certified as Not Producing  Significant Impacts on  Small Entities, but There  Were Differences among  Agencies For the 316 rules subject to RFA requirements from 2010 through 2016,  regulators certified that most would not have a significant economic  impact on a substantial number of small entities, although the frequency  with which individual regulators certified varied. Such certifications may  be made at either the proposed rule or final rule stage, and a certification  in a final rule may be preceded by an initial regulatory flexibility analysis in  the proposed rule. When certifying, the regulators most often made such  certifications in both the proposed and final rules (63 percent of analyses  in rules subject to RFA requirements) and did not perform regulatory  flexibility analyses. Certifications of final rules made after performing an  initial regulatory flexibility analysis accounted for another 4 percent. As  shown in figure 3, CFPB, CFTC, FDIC, and OCC certified most-to-nearly- all of their final rules that were subject to RFA requirements, while the  Federal Reserve rarely certified final rules, and SEC certified almost half.  According to Federal Reserve officials, the agency generally performed a  full regulatory flexibility analysis for almost all rulemakings regardless of  the rule’s impact on small entities. This pattern was generally consistent across our time period (see fig. 4).  The Federal Reserve usually performed an initial and final regulatory  flexibility analysis, while the other agencies, except SEC, rarely did.  SEC’s RFA analyses were the most variable over our time period. The  spikes in analyses were generally due to the small number of rules  promulgated each year. For example, in 2013, OCC promulgated three  rules subject to RFA requirements, performing an initial and final  regulatory flexibility analysis in one (33 percent) and certifying in two (67  percent). SEC published seven rules in 2013, completing an initial and  final regulatory flexibility analysis in all of them. While the Federal Reserve usually performed initial and final regulatory  flexibility analyses, it concluded that almost all of its rules would not  significantly affect small entities. In 86 percent of its analyses (54 of 63),  the Federal Reserve concluded that the rule would not have a significant  economic impact on a substantial number of small entities (see fig. 5). In  addition, FDIC concluded that almost all of its rules (5 of 6) in which it  performed a final regulatory flexibility analysis would not significantly  affect small entities, although as previously mentioned, FDIC certified  almost all its final rules subject to RFA requirements. (We discuss the  Federal Reserve’s and FDIC’s RFA analyses in more detail later in this  report.) SEC, CFPB, and CFTC also concluded that at least one of their  rules would not significantly affect small entities after performing a final  regulatory flexibility analysis. For the CFPB rule, the Federal Reserve first  proposed the rule and performed the initial regulatory flexibility analysis  before certain rulemaking authorities were transferred to CFPB for the  final rule. Certifications We  Reviewed Were Not  Always Consistent  with Office of  Advocacy Guidance  and Other Best  Practices We reviewed Federal Register notices and the regulators’ internal  workpapers for all certifications made in the final rule (66 certifications) in  calendar year 2015 and 2016 to determine the basis for the certifications  and the extent to which the analyses were consistent with RFA  requirements and Office of Advocacy’s guidance and other best  practices. As previously discussed, RFA requires that agencies provide  the factual basis for their certifications in the Federal Register. In most  certifications, the agencies provided a factual basis and concluded the  rule would not apply to small entities or have any economic impact. In  others, the agencies found the rule would have some economic impact on  small entities, but concluded that the impact would not be significant for a  substantial number of small entities. In those instances, we found that the  factual basis provided for most certifications across all regulators lacked  key components recommended by the Office of Advocacy for  understanding the analyses regulators used to support their conclusion.  We also found that while most agencies relied on the Small Business  Administration’s definitions of small entities for use in their RFA analyses,  two agencies relied on alternative definitions of small entities, some of  which have not been updated in more than 35 years. Most Certifications in 2015  and 2016 Concluded the  Rule Would Not Apply to  Small Entities or Have Any  Economic Impact In almost half of the certifications (31 of 66) we reviewed, regulators  concluded the rule would apply to no or few small entities (see table 3).  According to the regulators, these rules generally regulated activities in  which small entities do not engage, pertained to the internal processes of  the agency, or applied only to entities that were not small as defined by  the Small Business Administration or the agency. For example, in a rule  on recovery planning, OCC determined that the rule did not have an  impact on small entities because it applied only to banks with $50 billion  or more in assets, which are not small entities based on the Small  Business Administration’s definition. In 12 certifications, the agencies concluded the rules would have no  economic impact regardless of whether small entities were affected and  therefore did not require regulatory flexibility analyses. According to the  regulators, most of these certifications applied to rules that did not create  new regulatory requirements, eliminated duplicative rules, or established  optional specifications. For example, FDIC published a rule in October  2015 that consolidated into a single part Fair Credit Reporting regulations  for all institutions FDIC regulates. According to the Federal Register  notice, the rule eliminated redundant requirements and aligned FDIC’s  definitions with CFPB rules that were substantively similar. Regulators  generally used the current state of regulations as the baseline for these  determinations. For example, when analyzing the economic effects of a  new rule that consolidated duplicative regulations, the regulator compared  the compliance costs of the new rule with the costs small entities already  incurred to comply with the duplicative regulations. Additionally, regulators concluded in 5 of 66 certifications that the rule  would have a beneficial impact on small entities. For these rules,  agencies concluded they reduced regulatory burden, eliminated  regulations, or exempted certain entities. In almost a third (18 of 66) of the certifications, the agencies found that  the rule would have some economic impact on small entities, but  determined that the impact would not be significant for a substantial  number of small entities. For example, in a rule that required specified  entities to become members of an association, CFTC identified as an  economic impact the costs of membership dues and attorney fees related  to completing registration filings and preparing for required audits. But it  determined that the costs were not significant for a substantial number of  the specified small entities. In the seven joint rules we reviewed, we  determined regulators conducted their own certification analysis  independent of other agencies, although they generally reached the same  conclusion to certify (except for the Federal Reserve, which generally  treated RFA analysis differently, as discussed later). Two Agencies Used  Alternative Definitions of  Small Entities That May  Be Outdated As previously noted, the Federal Reserve, FDIC, and OCC rely on the  Small Business Administration’s definition of small banks for RFA  purposes. CFPB also relies on the Small Business Administration’s  definitions of small entities; for example, a business engaged in  automobile financing is considered small if its revenues are $38.5 million  or less. In contrast, CFTC and SEC previously established alternative  definitions of small entities for the purposes of RFA that the agencies  used to conclude that most of their rules (10 of 15 for CFTC and 9 of 12  for SEC) would not apply to small entities. But some of these small entity definitions have not been updated in more  than 35 years. In a 1982 policy statement, CFTC published its first set of  RFA definitions, which covered designated contract markets, futures  commission merchants, and commodity pool operators, among others. In  subsequent years, CFTC modified its definitions of small entities to  exclude several other groups of entities that it regulates, such as eligible  contract participants and major swap participants. SEC originally  established definitions for small entities through a rule published in the  Federal Register in 1982 after consulting with the Office of Advocacy. The  agency subsequently updated some of its definitions in 1986 and 1998,  although others have not been updated at all. In an October 2017 report to the President, the Department of the  Treasury recommended CFTC and SEC review and update their small  entity definitions for RFA purposes to ensure their RFA analyses  appropriately consider small entities. According to CFTC officials, the  agency has been reviewing its small entity definitions since April 2017 as  part of its working group to update the agency’s RFA practices. SEC staff  told us they had no comment on Treasury’s recommendation. Analyses in Some  Certifications Lacked Key  Components  Recommended by Office  of Advocacy For the 18 certifications in which regulators determined rules would have  some economic impact on small entities, they conducted additional  analyses to determine that the impact was not significant for a substantial  number of small entities. We found that the factual basis provided for  many of these certifications lacked key information (discussions of data  sources or methodologies and of broader economic impacts, or  definitions for key criteria) for understanding the analyses regulators used  to support their conclusion. The Office of Advocacy interprets RFA’s factual basis requirement to  mean that a certification should include, at a minimum, why the number of  entities or the size of the economic impact justifies the certification. In its  RFA guide, the Office of Advocacy details the components regulators  should include in their certification discussion to obtain meaningful public  comment and information on the rule’s impact on small entities. These  components include a description and estimate of the economic impact,  criteria for “significant economic impact” and “substantial number,” and a  description of any uncertainties in the analysis, including sensitivity  analysis when appropriate. The Office of Advocacy guidance states that  agencies’ reasoning and assumptions underlying the analyses used to  support their certifications, including data sources, should be explicit in  the Federal Register notices. Additionally, when estimating significant  economic impact, the guidance states agencies should not view impact in  absolute terms, but relative to the size of the business, the size of the  competitor’s business, and the impact on larger competitors. According to  the Office of Advocacy, broader economic impacts (such as a disparity in  impact on small entities that affects their ability to compete) could be  significant. Data sources or methodologies. In most of these certifications (15 of  18), regulators did not describe or did not fully describe their methodology  or data sources for their conclusions. In addition to the Office of  Advocacy’s RFA guide, OMB guidance on regulatory analysis—regulatory  agencies’ evaluation of the likely consequences of rules—states that  agencies should clearly set out the basic assumptions, methods, and data  underlying the analysis and discuss the uncertainties associated with the  estimates. While independent regulatory agencies, including those in  our review, are not required to follow the OMB guidance, it provides a  strong set of analytical practices relevant to agency rulemakings. For  these certifications, regulators generally provided partial sources and  methodology for their conclusions. Examples of incomplete discussions  include the following:  In its rule requiring specified entities to become members of an  association, CFTC detailed its source and methodology for estimating  the hourly labor costs of retaining a lawyer, as mentioned above, but  did not provide the reasoning for its estimate of the number of hours  that a lawyer would spend counseling entities with respect to the  rule’s requirements. In a joint rule related to homeowner flood insurance, OCC provided  the source for the estimated number of affected small entities, but  provided no source or methodology for its estimated economic impact  of $6,000. In a rule amending reporting requirements for the dissemination of  security-based swap information, SEC said that it partially relied on its  “own information” without explanation for declaring that small entities  do not participate in security-based swap markets. In a joint rule implementing the minimum requirements in the  registration and supervision of appraisal management companies, the  Federal Reserve estimated a range of small entities that might be  affected but did not provide the source or methodology for how it  approximated the number. CFPB fully discussed sources and methodology in some of its  certifications but not others. In three of five certifications that required  additional analysis, CFPB provided thorough descriptions of its  methodology and data sources for its conclusions. The agency detailed  its assumptions and uncertainties in these rules and performed a  sensitivity analysis to ensure the rules would not significantly affect small  entities. However, in the other two certifications, CFPB did not discuss all  of the data sources on which it relied. Broader economic impacts. The regulators’ certifications generally did  not address broader economic impacts such as cumulative effects,  competitive disadvantage, or disproportionality of effects and focused  most of the analysis on specific compliance costs. In addition to the Office  of Advocacy’s guidance on analyzing broader economic impacts,  Executive Order 13563 requires agencies to consider the cumulative  economic impacts of regulations during the rulemaking process, which  reinforces the agencies’ obligations under RFA. While this executive  order is not binding on independent regulatory agencies, such as those in  our review, it represents a best practice for rulemaking. Of the 18 certifications that contain additional analysis, agencies  discussed some aspect of broader economic impacts in 3. CFPB  considered future changes in market share for small entities because of  new requirements in one rule and whether the regulation placed small  entities at a competitive disadvantage in another rule. OCC also  examined a rule’s impact on small entities’ competitiveness and  profitability in one certification. None of the regulators discussed  cumulative effects in their certifications. Defining key criteria. Regulators generally did not define the criteria they  used for “substantial number” and “significant economic impact” in their  certifications. RFA does not define these terms. The Office of Advocacy  has left it up to agencies to determine their own criteria, which it  recommends that agencies discuss in their certifications. None of the  regulators defined what would constitute a substantial number of small  entities for the rule in the Federal Register notices. OCC was the one  agency to define its criteria for a significant economic impact in its  rulemaking, although it did not include this definition in all of its  certifications. The other agencies did not define significant economic  impact for the rule in the Federal Register notices. While CFPB did not  disclose its criteria in the Federal Register notices, it defined these criteria  in its internal workpapers for two certifications. Additionally, many of the  analyses (13 of 18) did not discuss the significance of the rule’s costs  relative to the size of the business, such as profits, revenues, or labor  costs. Limited information. In addition, three of the certifications we reviewed  included none of the Office of Advocacy’s suggested components. The  factual basis provided for these certifications did not include a description  of the number of affected entities, the size of the economic impacts, or  the justification for the certification. Two FDIC rules related to revisions of  the treatment of financial assets transferred in connection with a  securitization provided no additional information beyond the declarative  statement that the agency certified that the rule would not have a  significant economic impact on a substantial number of small entities.  Additionally, an OCC certification in a joint rule that formalized the  calculation method for mortgage loans exempted from certain  requirements provided little information, although an internal agency  workpaper detailed the number of small entities affected and the  estimated economic impact that supported the certification. OCC  officials said that the agency will comply with instructions from its  rulemaking procedure guide, which was updated in August 2016.  According to the guide, certifications should include additional information  beyond the certification statement, such as number of affected small  entities, size of the economic impact, and reason for the certification. The regulators’ guidance for complying with RFA generally does not  include policies and procedures for helping to ensure consistent and  complete RFA analyses. (We discuss the regulators’ guidance later in this  report.) Without policies and procedures that would help ensure that key  components were incorporated in certification assessments—including  disclosing the methodology and data sources of economic analyses and  considering potential broad economic impacts—regulators may be limiting  the effectiveness of their reviews. In turn, such reviews hinder the  achievement of RFA’s goal. For example, incomplete disclosure of  methodology and data sources could limit the public and affected entities’  ability to offer informed comments in response to regulators’ certification  assessments in proposed rules. Many RFA-Required  Analyses Had  Weaknesses In many recent regulatory flexibility analyses, the evaluation of key  components—potential economic effects and alternative regulatory  approaches—was limited. Many final rules described changes to limit  burden, and few regulatory flexibility analyses concluded rules would  have a significant impact on small entities. For most rules we reviewed,  regulators were unable to provide documentation supporting their  regulatory flexibility analyses. Regulatory Flexibility  Analyses Often Included  Limited Evaluation of  Costs and Alternatives Our review of recent regulatory flexibility analyses found that in many  cases, the evaluation of key components—potential economic effects and  alternative regulatory approaches—was limited, although the extent  varied by regulator. RFA requires the initial and final analyses to include  information to assist the agency, regulated entities, and the public in  evaluating the potential impact of rules on small entities (see sidebars).  The most important components include the assessment of a rule’s  potential economic effects on small entities—such as compliance costs— and the identification and evaluation of alternative regulatory approaches  that may minimize significant economic effects while achieving statutory  objectives. The Office of Advocacy’s guide on RFA compliance explains  that an agency principally should address these components in an initial  regulatory flexibility analysis. feasible—of the number of small entities  to which the rule will apply. Description of the projected reporting,  recordkeeping, and other compliance  requirements of the rule, including the  type of necessary professional skills.  Identification—to the extent practicable— of all relevant federal rules that may  duplicate, overlap, or conflict with the  proposed rule. goal of RFA. See appendixes V–XII for a summary of findings for each of  the six regulators. We reviewed regulatory flexibility analyses for recent rulemakings to  assess the extent to which they included these and other elements and to  examine the outcome of the analyses. For each regulator, we selected  all final rules published in 2015 and 2016 for which the agency performed  an initial and final regulatory flexibility analysis. For regulators with fewer  than three such rules, we included rules published in prior years (on a full- year basis) until we reached three rules or 2013. See table 4 for the  number of rules selected for each regulator. For each rule, we reviewed  Federal Register notices for the proposed and final rules and supporting  documentation on the initial and final regulatory flexibility analyses. small entities to which the rule will apply  or explanation of why no such estimate is  available.  the significant economic impact on small  entities consistent with statutory  objectives, including the reasons for  selecting the alternative adopted in the  final rule and why each of the other  alternatives was rejected. In meeting the requirements, agencies  may provide either a quantifiable or  numerical description of the rule’s effects  or alternatives or more general descriptive  statements if quantification is not  practicable or reliable. Many of the Federal Reserve’s regulatory flexibility analyses lacked some  required components and contained limited information and analysis. As  previously discussed, the Federal Reserve generally performed  regulatory flexibility analyses for its rulemakings regardless of the rule’s  potential impact on small entities. The majority (11 of 17) of the Federal  Reserve’s analyses stated that the rules either did not apply to small  entities or lacked compliance requirements. Nevertheless, the Federal  Reserve conducted regulatory flexibility analyses in which nearly all of the  initial (14 of 17) and final analyses (15 of 17) concluded that the rule  would not have a significant economic impact on small entities, which  generally is a basis for certification. Examples included rules on capital  and liquidity requirements applicable only to large banking organizations  and rules that amended official regulatory interpretations or repealed  regulations. None of the regulatory flexibility analyses performed by other  regulators indicated that a rule did not apply to small entities or lacked  compliance requirements. For additional information, see appendix V. More specifically, the regulatory flexibility analyses for the 11 rules that  did not apply to small entities or impose compliance requirements  were minimal. The analyses did not describe or estimate compliance  costs, identify alternatives, or include other items. In the case of  alternatives, the analyses either stated that there were no alternatives  that would further minimize economic impact on small entities or  requested comments on any alternatives. The analyses did not include  some other information that could be available and relevant such as the  reasons or need for the rule. Because the purpose of a regulatory flexibility analysis is to evaluate a  rule’s potential effects on small entities, key components of the analysis  may not be relevant or meaningful in such cases. For example, there may  be no compliance costs to estimate, alternatives to consider, necessary  professional skills to describe, or actions that could minimize impact on  small entities. With their focus largely on explaining why the rule would  not affect small entities rather than examining effects of compliance  requirements and potential alternatives to limit such effects, such cases  resemble certifications more than regulatory flexibility analyses. See  appendix V for further information on the Federal Reserve’s regulatory  flexibility analyses. The Federal Reserve’s regulatory flexibility analyses for six rules that  might impose compliance requirements on small entities also had  limitations. Specifically, most of the analyses (both initial and final)  contained limited evaluation of the potential economic impact on small  entities and lacked other components. RFA directs agencies to provide a  quantifiable or numerical description of the effects of a proposed rule and  allows a qualitative description in lieu of a numerical evaluation in  instances when quantification is not practicable or reliable. Most of the analyses for rules that might impose compliance requirements  on small entities did not include a description of potential compliance  costs. Nearly all (five of six) did not quantify compliance costs in either the  initial or final analyses or explain why such assessments were not  possible. For two rules, the Federal Reserve’s assessments of economic  effects and compliance costs generally consisted of descriptive  statements on the rule’s provisions and coverage. For example, the final  analysis for a rule on margin and capital requirements for participants in  financial swap transactions stated that, among other things, all financial  end users would be subject to the variation margin requirements and  documentation requirements of the rule but that the Federal Reserve  believes such treatment is consistent with current market practice and  should not represent a significant burden on small financial end users. Although containing minimal information, analyses in three of the six rules  indicated that the rules would have a largely beneficial impact for small  entities by reducing burden or offering positive economic effects. These  analyses generally lacked clear descriptions of any compliance  requirements that would apply to small entities. For example, the initial  and final analyses for a rule involving the Federal Reserve’s emergency  lending authority stated that participants at a minimum likely would be  required to pay interest on loans extended to them and to keep records,  but that the positive economic impact of receiving a loan likely would  outweigh any economic burden. The initial analysis for another rule  stated that the projected reporting, recordkeeping, and other compliance  requirements were expected to be minimal but did not describe the  requirements or any associated costs. Alternatives. Few of the Federal Reserve’s initial regulatory flexibility  analyses identified alternatives to the proposed rule and some did not  explain why there were no alternatives. Although most of the rules’  analyses (10 of 17) described alternatives, all but 2 stated that there were  no alternatives that would have less economic impact on small entities. Of  the 6 rules that might impose compliance requirements on small entities,  2 included such a statement, 1 had no mention of alternatives, and  another solicited comments on any significant alternatives that would  reduce burden associated with the proposed rule. Analyses for the other  two rules described alternative approaches included in the proposed rule  to limit economic impact on small entities. For example, one of the rules incorporated an applicability threshold for certain compliance  requirements and the other exempted small entities from some of the  rule’s provisions and applied a longer transition period. Other Components. Several of the final regulatory flexibility analyses  also lacked other RFA-required components. In particular, only three of  the six rules described steps taken to minimize economic impact on small  entities and reasons for selecting the alternative adopted in the final rule.  The other three rules did not include either component. The reasons cited  for selecting the approach in the final rule generally reflected the actions  taken by the agency to mitigate the rule’s economic impact on small  entities. Other Regulators’ Regulatory  Flexibility Analyses Generally  Included Most Required  Components but Some  Analyses Had Weaknesses For the other financial regulators (FDIC, CFPB, CFTC, OCC, and SEC),  most of the regulatory flexibility analyses we reviewed included the  components required by RFA, but the extent of the analyses varied  among regulators, with some lacking required information or having other  limitations. For the majority (three of four) of FDIC’s analyses, the agency indicated  that the rules were not subject to RFA but that it voluntarily undertook the  analyses to help solicit public comments on the rules’ effects on small  entities. For these three rules, FDIC’s analyses described and quantified  each of the rule’s compliance costs and concluded that each rule would  not have a significant economic impact on small entities, but other  components were missing. For example, these rules’ analyses focused  on illustrating how the rule would not have an economic impact on small entities and did not include other required components including a  description and assessment of regulatory alternatives. The initial and final  analyses for each of the rules were nearly identical and did not include  statements about alternatives, any issues raised in public comments, or  steps to minimize impact on small entities, among other missing  components. In that regard, FDIC’s analyses for these rules—similar to  many of the Federal Reserve’s analyses—resembled a certification. The  regulatory flexibility analyses for the fourth FDIC rule that we reviewed  included all required components. CFPB’s regulatory flexibility analyses generally included all required  components. However, for three of the seven rules neither the initial nor  final analyses estimated compliance costs for small entities. In some  cases, the analyses stated that costs likely would be minimal or described  difficulties in estimating costs such as a lack of information about the  current practices of subject entities. Of the analyses that included cost  estimates, several did not quantify all identified costs or explain why such  estimates were not available. Unlike other regulators we reviewed, CFPB  is required to seek input from small entities during the rulemaking process  (through Small Business Review Panels) when proposed rules are  expected to have a significant economic impact on a substantial number  of small entities. CFPB’s regulatory flexibility analyses often  incorporated information received from these panels in its assessment of  potential economic effects and regulatory alternatives. For example,  several analyses that estimated compliance costs relied on information  from small entities that participated in the panel process as well as data  from other sources. The description of regulatory alternatives often  reflected comments received from small-entity representatives. Although  each of CFPB’s initial analyses described alternatives, in some cases, it  was not clear whether CFPB had identified alternatives of its own. CFTC performed initial and final analyses for one rule during the period  we reviewed and the analyses had limited evaluation of potential effects  on small entities. The analyses did not estimate the number of affected  entities or compliance costs, but indicated that the rule’s compliance  requirements would be minimal while concluding the rule likely would  have a beneficial impact on small entities. The discussion of compliance  requirements in the final analysis stated only that the rule would relieve  affected entities from certain compliance requirements, although the initial  analysis stated that the proposed rule would impose a new requirement  on certain entities—which could include small entities—to annually  provide CFTC with a notice about certain trading activity. In other sections  of the final rule, CFTC discussed its decision to address concerns raised  in public comments by not adopting the notice requirement. OCC also had one rule with initial and final regulatory flexibility analyses,  and it included nearly all required components. The rule revised capital  requirements for banking organizations and was issued jointly with the  Federal Reserve. The initial analysis described multiple alternative  approaches that it stated were included in the proposed rule to  incorporate flexibility and reduce burden for small entities. However, other  than listing the alternatives and requesting comment, the analysis does  not discuss or evaluate how the options minimize economic impact on  small entities. The regulatory flexibility analysis in the final rule notes that  the Small Business Administration’s Chief Counsel for Advocacy  submitted a comment letter in which it encouraged the agencies to  provide more detailed discussion of the alternatives and the potential  burden reductions associated with them. SEC’s regulatory flexibility analyses also included most components, but  some rules’ assessment of compliance costs and alternatives had  limitations. Specifically, although all of the rules described compliance  requirements, some did not describe (four of nine) or estimate (five of  nine) the costs they might impose on subject entities. For example, in  December 2015, SEC published a proposed rule requiring resource  extraction issuers to disclose certain payments. The proposed rule’s  initial regulatory flexibility analysis described requirements for the  disclosures. However, the regulatory flexibility analysis did not discuss or  evaluate potential compliance costs and concluded with statements on  alternatives and a request for comments. Many of the SEC rules we reviewed focused on reasons why alternatives  were not appropriate and did not discuss specific options for minimizing  economic impact on small entities. As part of describing any significant  alternatives to the proposed rule which accomplish statutory objectives  while minimizing any significant economic impact on small entities, RFA  requires that initial regulatory flexibility analyses discuss alternatives such  as  the establishment of differing compliance or reporting requirements or  timetables that take into account the resources available to small  entities;  the clarification, consolidation, or simplification of compliance and  reporting requirements under the rule for such small entities;  the use of performance rather than design standards; and an exemption from coverage of the rule, or any part thereof, for such  small entities. For five of the nine rules, the initial analysis discussed the general types  of alternatives listed in RFA but did not describe specific options for  implementing them in the proposed rule. For example, the initial  regulatory flexibility analyses did not identify how compliance or reporting  requirements might be altered for small entities or in what ways  requirements could be simplified. One of the rules involved changes to  SEC’s requirements for the reporting and disclosure of information by  registered investment companies. The initial analysis stated that the  agency had considered (1) establishing different reporting requirements  or frequency to account for resources available to small entities, (2) using  performance rather than design standards, and (3) exempting small  entities from all or part of the proposal. However, the analysis lacked  details about what different reporting requirements, frequencies,  performance standards, or partial exemptions it considered for small  entities. In addition, for seven of the rules—including the five rules considering  only the general alternative types—the discussion was limited to  describing the reasons why regulatory alternatives were not appropriate.  The reasons cited typically included that the different regulatory  approaches would not be consistent with the agency’s goals or statutory  objectives. For example, the analysis for SEC’s rule on reporting and  disclosure by registered investment companies concluded that the  agency believed that establishing different reporting requirements or  frequency for small entities would not be consistent with SEC’s goal of  industry oversight and investor protection. However, for this and the other  proposed rules, the analyses generally did not examine the extent to  which the considered alternatives could limit the rule’s economic impact  on small entities. In another case, a rule’s final analysis stated that one public commenter raised concerns that the initial analysis did not identify  significant alternatives, including that it only considered alternatives  related to exempting small business from the proposed rules. Several of  the commenters suggested additional alternatives for reducing burden.  The lack of specific details about potential alternatives may limit the  usefulness of public comments on SEC’s regulatory flexibility analyses  and its ability to identify alternatives that could reduce economic impacts  on small entities while achieving a rule’s objectives. Many Analyses Did Not  Disclose Information Sources  or Methodology Most regulators (five of six) did not disclose the data sources or  methodologies used for estimating the number of subject small entities or  compliance costs for the regulatory flexibility analyses we reviewed. OMB  guidance on regulatory analysis—regulatory agencies’ anticipation and  evaluation of the likely consequences of rules—states that agencies  should clearly set out the basic assumptions, methods, and data  underlying the analysis and discuss the uncertainties associated with the  estimates. While independent regulatory agencies, such as those in our  review, are not required to follow the OMB guidance, it provides a strong  set of analytical practices relevant to agency rulemakings that serves as  best practices for all agencies. Many initial analyses (11 of 23) and final  analyses (11 of 24) that estimated the number of subject small entities did  not describe the data source used for the estimate. Each of the  regulators except for CFPB (which included data sources) and CFTC  (whose only rule did not include an estimate) had at least one rule that did  not disclose the data source for the estimate of subject small entities. Furthermore, many analyses that estimated a rule’s compliance costs (5  of 12 initial and 5 of 14 final) did not describe the information sources  used to calculate the projections. The analyses for several additional  rules included data sources for some but not all cost estimates. Except for  CFPB, each of the regulators that estimated compliance costs had at  least one rule that lacked information on data sources for some  estimates. For example, the regulatory flexibility analyses for a joint OCC  and Federal Reserve rule discussed how the agencies estimated costs of  implementing new capital requirements but did not disclose the data  sources or methodology used to calculate the costs of creditworthiness  measurement activities. A lack of information necessary to understand  how an agency evaluated a rule’s economic impact on small entities may  limit the extent to which the public and other interested parties can  meaningfully comment on the analyses. Few Rules Found to Have  a Significant Impact and  Many Described Changes  to Reduce Burden Although a regulatory flexibility analysis is required only for rules that may  have a significant economic impact on a substantial number of small  entities, few final analyses concluded that the rules would have such an  impact. Specifically, the final analysis for only 4 of 39 rules that we  reviewed stated that the rule likely would have a significant economic  impact. Final analyses for the majority of rules (20 of 39) concluded there  would be no significant impact and the remainder did not have a clear  conclusion. The Federal Reserve accounted for 15 of those 20 analyses.  As discussed previously, nearly all of the Federal Reserve’s regulatory  flexibility analyses concluded a rule would not have a significant impact  on small entities. About half of the regulatory flexibility analyses we reviewed (18 of 39)  described changes to the proposed rule to limit economic impact on small  entities and most were by regulators other than the Federal Reserve.  Several rules (12 of 39) described changes attributable to comments on  the regulatory flexibility analyses. Specifically, for regulators other than  the Federal Reserve, the final analyses for about half of the rules (11 of  22) noted receiving public comments on the initial analysis and nearly all  of those described changes resulting from the comments. A smaller  number of rules described changes related to comments on the initial  analysis received from the Office of Advocacy. Some rules also described other changes to the proposed rule, including  changes in response to general public comments and the adoption of  alternatives. For rules that identified alternatives to a proposed rule in the  initial analysis, about half of the final analyses (10 of 21) described  reasons for rejecting all the alternatives. An additional 2 rules noted  reasons for rejecting some of the alternatives. For further information on  the results of regulators’ regulatory flexibility analyses, see appendix XII. Regulators described taking various steps to minimize impact on small  entities, although they did not all result from changes to the proposed rule  and were not all clearly attributable to the agency’s consideration of  alternatives. For example, some analyses described provisions that had  been included as part of the proposed rule. For rules that disclosed  actions to minimize effects on small entities, most regulators noted  multiple actions that included  reducing compliance requirements such as for reporting and  disclosure, exempting small entities from certain requirements,  increasing applicability or exemption thresholds, providing for flexibility in meeting compliance requirements,  clarifying and simplifying compliance requirements, not adopting certain provisions of the proposed rule, and providing for delayed or gradual implementation of compliance  requirements. Although some actions were specific to small entities, many applied more  broadly, such as to all subject firms. Most Regulators Lacked  Documentation of  Regulatory Flexibility  Analysis and Certifications  for Most Rules For most rules we reviewed, regulators (five of six) were unable to  provide documentation supporting their regulatory flexibility analyses or  certification decisions, although the extent of documentation varied by  regulator (see table 5). We requested supporting documentation for the  39 rules we reviewed for which the agency performed initial and final  regulatory flexibility analyses and the 66 rules for which the agency made  a certification determination. Staff from two regulators—CFPB and OCC—provided documentation for  all or nearly all of the rules we reviewed. Many of these documents were  formal analysis or decision memorandums on assessing a rule’s potential  economic impact on small entities. For CFPB rules that had regulatory  flexibility analyses, documentation included RFA-required reports  summarizing the results of Small Business Review Panels. Staff from  the other regulators produced documentation for fewer or no rules and  the documents they provided were largely limited and informal. For  example, other than for CFPB and OCC, RFA-related documentation  generally consisted of emails between agency staff and data queries and  output files on the number of affected entities and potential economic  effects. OMB guidance on regulatory analysis states that agencies should  prepare documentation of their economic analysis so that a qualified third  party reading the analysis can understand the basic elements and the  way in which the agency developed its estimates. The guidance also  states that agencies are expected to document all the alternatives  considered as part of their regulatory analysis and which alternatives  were selected for emphasis in the main analysis. As previously  discussed, independent regulatory agencies are not required to follow the  OMB guidance, but it provides a strong set of analytical practices relevant  to agency rulemakings. A lack of documentation of the analysis  supporting regulators’ RFA implementation limits transparency and  accountability. Regulatory Guidance  Generally Does Not  Include Policies or  Procedures for  Ensuring Consistent  and Complete RFA  Analyses Most of the Regulators  Have Established General  Guidance for Complying  with RFA Requirements Most regulators (five of six) have established written guidelines that  restate the statutory requirements for certification and for preparing the  regulatory flexibility analyses and provide some additional guidance for  staff conducting the analyses, as shown in table 6. However, they  generally have not developed comprehensive policies and procedures to  assist staff in complying with RFA, which may contribute to the  weaknesses we identified in some certifications and regulatory flexibility  analyses. The guidelines for FDIC, OCC, CFPB, and SEC discuss regulatory  flexibility analyses as part of their general rulemaking guidance for staff.  At a minimum, each of these regulators’ guidance describes the statutory  requirements under RFA for certifications and for preparing the initial and  final analyses, and, for CFPB, agency-specific RFA requirements.  These four agencies also provide some additional information intended to  be useful in complying with RFA requirements, such as excerpts from the  Office of Advocacy’s RFA compliance guide. For example, some of the  incorporated Office of Advocacy guidance covers considerations for  determining whether a rule would have a significant economic impact on  a substantial number of small entities. In addition, some regulators’ RFA  guidelines include organizational information for coordinating with certain  agency departments (such as offices responsible for economic analysis  or legal review) and identifying staff responsible for completing RFA  analyses. Until recently, CFTC and the Federal Reserve had not established any  policies, procedures, or guidance for conducting regulatory flexibility  analyses, except for a policy statement CFTC issued in 1982 that defines  small entities and an informal Federal Reserve document listing RFA  requirements. Since we started our review, CFTC announced a working  group intended to enhance compliance with RFA. According to CFTC  staff, the group began its work in April 2017 with a focus on updating  CFTC’s small-entity definitions. Staff said that the group’s next task would  be to formulate RFA policies and procedures with a goal of adopting them  in spring 2018. Also during the course of our review, the Federal Reserve  finalized a handbook covering guidelines and policies for RFA and small- entity compliance guides that it provided to us in November 2017.  Previously, the Federal Reserve’s RFA guidance consisted of an informal  resource document identifying RFA requirements that it made available to  rulemaking staff. Regulators’ RFA Guidance  Does Not Include Policies  or Procedures for Helping  Ensure Consistent and  Complete RFA Analyses While the financial regulators’ guidance discusses RFA requirements for  regulatory flexibility analyses and includes some information on how to  approach these analyses, it generally does not address how each agency  helps ensure that its rulemakings consistently and completely comply with  RFA requirements. Federal internal control standards state the  importance for agency management to establish through policies and  procedures the actions needed to achieve objectives. In addition,  Executive Order 13272 required agencies to establish policies and  procedures to promote compliance with RFA. While this executive order  is not binding on independent regulatory agencies, it represents a best  practice for rulemaking. We found that the regulators’ guidance lacks specific details on the  procedures by which the agency expects rulemaking staff to implement  RFA requirements. Other than restating RFA requirements and identifying  organizational responsibilities, regulators’ guidance documents largely  are limited to offering suggestions for rulemaking staff to consider while  preparing RFA sections of the rule. For example, in many cases, the  guidance documents include recommendations and excerpts from the  Office of Advocacy’s RFA compliance manual such as factors to consider  about what constitutes a significant economic impact and a substantial  number of small entities. In another case, guidance suggests staff refer  to RFA statements included in previously issued rules to use as  examples. In addition, some guidance documents described agency  policies on certain RFA elements. For example, one regulator’s guidance  states a preference for completing an initial regulatory flexibility analysis,  rather than making a certification determination. Yet, while these types of  guidance may be instructive and allow for necessary flexibility, they do  not represent specific and comprehensive procedures for implementing  RFA requirements. As illustrated in table 7, the extent to which regulators’ guidance includes  policies and procedures varies but generally does not include policies or  procedures for  identifying definitions or criteria for assessing whether a rule will have  a significant economic impact on a substantial number of small  entities; evaluating a rule’s potential economic impact on small entities,  including compliance costs and broad effects such as cumulative  effects, competitive advantage, and disproportionality;  identifying and assessing regulatory alternatives that could minimize  impact on small entities while accomplishing statutory objectives; disclosing analytical methodology and data sources; and  creating and maintaining documentation that supports analytical  findings. Some regulators’ guidance, including CFPB and OCC, includes policies  and procedures for certain elements—such as disclosing methodology  and sources—but not for others, such as defining what constitutes  significant economic impact or a substantial number of small entities.  FDIC’s rule development guide includes guidance for certification  determinations (largely from Office of Advocacy’s compliance guide) but  not for initial and final regulatory flexibility analyses for which the guide  restates RFA requirements. SEC’s handbook describes some policies  and procedures on alternatives but it focuses on having RFA statements  acknowledge consideration of each RFA alternative type even if  unsuitable. It also includes some policies and procedures for assessing  economic impact. However, the handbook was last revised in 1999, so it  does not incorporate recommendations from the Office of Advocacy’s  compliance guide, and two SEC divisions have developed their own  manuals, which generally restate RFA requirements. As previously described, we found inconsistencies and weaknesses in  financial regulators’ certifications and regulatory flexibility analyses that  we reviewed, including for the key elements discussed in this section. The  shortcomings are attributable in part to the regulators’ lack of  comprehensive policies and procedures for RFA requirements. Our prior  work on RFA implementation by federal agencies found that uncertainties  about RFA’s requirements and varying interpretations of those  requirements by federal agencies limited the act’s application and  effectiveness. However, the Office of Advocacy subsequently published  guidance on complying with RFA requirements that includes information  to help agencies interpret and implement RFA requirements. Such  guidance could help regulators develop comprehensive and specific  policies and procedures. Without such policies and procedures,  regulators’ ability to consistently and effectively meet RFA objectives may  be limited. Financial Regulators  Varied in Their  Approach to RFA- Required  Retrospective  Reviews Federal Banking  Regulators Relied on  Other Retrospective  Reviews to Meet RFA  Section 610 Requirements As previously discussed, section 610 of RFA requires agencies to review,  within 10 years of adoption, those rules assessed as having a significant  economic impact on a substantial number of small entities to determine if  they should be continued without change, amended, or rescinded to  minimize any significant economic impact on small entities. During the  last 10 years, the three federal banking regulators (Federal Reserve,  FDIC, and OCC) used other retrospective reviews that they said fulfilled  RFA requirements. Specifically, the banking regulators said that the  retrospective reviews required under the Economic Growth and  Regulatory Paperwork Reduction Act of 1996 (EGRPRA) also satisfied  RFA section 610 requirements. EGRPRA requires the federal banking  regulators to identify outdated or otherwise unnecessary regulatory  requirements imposed on insured depository institutions every 10 years. We compared EGRPRA requirements for retrospective reviews to those  of section 610 and found they do not fully align (see table 8). For  example, the EGRPRA review process relies on public comments to  identify rules that may be outdated, unnecessary, or unduly burdensome.  The comments are solicited through public notices in the Federal Register  and through public outreach meetings held across the country. In  contrast, public comments are only one component of section 610  reviews. Following a public notice and comment period, section 610  requires agencies to evaluate rules found to have a significant economic  impact on a substantial number of small entities to identify opportunities  to reduce unnecessary burden. The section 610 reviews are to consider  five specific factors, such as the degree to which technology and  economic conditions have changed in the area affected by the rule.  Section 610 reviews focus specifically on reducing unnecessary  regulatory burden on small entities; EGRPRA reviews focus more broadly  on reducing regulatory burden on all insured depository institutions. We reviewed the 2007 and 2017 EGRPRA reports, along with their  preceding Federal Register notices, and found that the regulators  solicited comment from the public on the burden of regulations on  community banks and other smaller, insured depository institutions.  However, we found that the final reports primarily focus on the issues  identified through public comments and generally did not include  independent agency consideration of the impact of regulations on small  entities, as required by section 610. The public notice requirements for RFA section 610 and EGRPRA also  differed. RFA requires agencies to publish in the Federal Register a list of  the rules that have a significant economic impact on a substantial number  of small entities and that are to be reviewed pursuant to section 610  during the upcoming year. This list must include a brief description of  each rule and the need for and legal basis of each rule. The notices alert  the public to specific rules that may affect small entities and request  public comment on these rules. EGRPRA public notice requirements do  not require agencies to specifically identify rules that have an impact on  small entities. Rather, agencies must at regular intervals provide notice  and solicit public comment on a particular category or categories of rules  (such as consumer protection, safety and soundness) governing all  insured depository institutions. The notices request commenters to  identify areas of the regulations that are outdated, unnecessary, or unduly  burdensome. Our searches of the Federal Register turned up no notices  of section 610 reviews posted by the regulators in the last 10 years. In its RFA guide, the Small Business Administration’s Office of Advocacy  stated that agencies may satisfy section 610 requirements through other  retrospective reviews if these other reviews meet the criteria of section  610. To obtain credit for a section 610 review through another review  process, the Office of Advocacy recommends that agencies adequately  communicate with stakeholders and the Office of Advocacy. According to  an official from the Office of Advocacy, the office has not yet made a  determination on whether the EGRPRA review process satisfies the  requirements of section 610. Although the agencies stated that they fulfill  RFA requirements through EGRPRA, without confirming this with the  Office of Advocacy, it is possible that they are not meeting the RFA  section 610 requirements and therefore may not be achieving the small- entity burden reduction that the statute seeks to ensure. We found that  the regulators lack policies and procedures for how to conduct section  610 reviews or provide rationale for meeting the section 610 review  requirements through other retrospective review processes. SEC Conducted RFA  Section 610 Reviews, but  the Reviews Were Late  and Not Fully Consistent  with RFA Requirements or  Office of Advocacy  Guidance Our review of SEC’s section 610 reviews found that they were conducted  late and were not fully consistent with RFA requirements or the Office of  Advocacy’s guidance for such reviews. Although SEC staff have a  process for tracking which rules are due for section 610 reviews, SEC  conducted all but one of its reviews 12 years after the rules were  published. According to RFA requirements, rules must be reviewed within  10 years of their publication as final rules. SEC staff told us that SEC  conducted a broader review than required by RFA and recommended by  the Office of Advocacy. Moreover, staff said that SEC conducted section  610 reviews for all rules previously published for notice and comment to  assess the continued utility of the rules. Agency officials stated that  when they prepare the agency’s annual Federal Register notice of rules  to be reviewed during the succeeding 12 months, they consult a  chronological list of final rules adopted by the agency to determine which  rules are due for a section 610 review. However, when we reviewed  documentation of 46 section 610 reviews SEC staff conducted in 2015  and 2016, we found that each of the reviews was conducted for a rule  adopted in 2003 or 2004, with 45 rule reviews being conducted 12 years  after their publication as final rules. By not conducting section 610  reviews within the time frame established by RFA, SEC may delay taking  timely action to minimize significant economic impact of rules on small  entities. In general, SEC did not follow Office of Advocacy’s guidance for  conducting section 610 reviews. The Office of Advocacy recommends  that to evaluate and minimize any significant economic impact of a rule on  a substantial number of small entities, agencies may want to use an  economic analysis similar to the initial regulatory flexibility analysis.  Additionally, OMB guidance on regulatory analysis states that agencies  should provide documentation that analysis is based on the best  reasonably obtainable scientific, technical, and economic information  available. As previously discussed, independent regulatory agencies are  not required to follow the OMB guidance, but it provides a strong set of  analytical practices relevant to agency rulemakings. To facilitate its section 610 reviews, SEC staff used a template that  prompts staff to consider each of the five RFA-required section 610  considerations and to document the conclusion of the review (if the rule  should be continued without change, amended, or rescinded). We  reviewed the templates for all 46 reviews conducted between 2015 and  2016 and found that SEC staff consistently followed this template to  document their conclusions. However, the reviews generally lacked  substantive analysis and no rules were amended as a direct result of their  section 610 review. Overall, of the 46 reviews, 7 identified comments or  complaints from the public, 4 identified changes in technology, economic  conditions, or other factors in the area affected by the rule, and 4  identified instances of overlap, conflict or duplication. The reviews  generally provided no evidence of empirical analysis and no data to  support the conclusions of the reviews, as recommended by the Office of  Advocacy and OMB. Furthermore, in most cases, the reviews lacked a  description of whether, or to what extent, the rule was affecting small  entities. For example, when addressing the first RFA-required  consideration, describing and evaluating the continuing need for a rule,  most SEC section 610 reviews included language from the final rule as a  description and included SEC’s conclusion that the rule continues to be  necessary. The Office of Advocacy also suggests that useful section 610 reviews  should evaluate potential improvements to the rule by going beyond  obvious measures and evaluating factors such as the unintended market  effects and distortions and widespread noncompliance with reporting and  other paperwork requirements. We found no evidence that these factors  were considered. The Office of Advocacy further recommends that  agencies pay particular attention to changes in the cumulative burden  faced by regulated entities. We did not find evidence that SEC considered  the cumulative burden faced by regulated agencies in the reviews we  examined. By not including these best practice elements as part of its  section 610 reviews, SEC may not fully achieve RFA’s purpose of  minimizing significant economic impact of rules on small entities. SEC does not have written policies or procedures for completing rule  reviews pursuant to RFA section 610, potentially contributing to the  weaknesses we identified on the timing of the reviews, and the lack of  data and analysis to support the review findings. As previously  mentioned, federal internal control standards state the importance for  agency management to establish policies and procedures needed to  achieve objectives. In addition, Executive Order 13272 requires  agencies to establish policies and procedures to promote compliance with  RFA. While this executive order is not binding on independent  regulatory agencies, including SEC, it represents a best practice for  rulemaking. SEC also does not publicly disclose the findings or conclusions of its  section 610 reviews. Although RFA does not require that agencies  publish the results of their 610 reviews, the Office of Advocacy  recommends that to enhance transparency, agencies should  communicate with interested entities about the status of ongoing as well  as completed section 610 reviews. Several executive orders also highlight  the importance of public disclosure of retrospective reviews. For example,  Executive Order 13563 recommends that retrospective analyses,  including supporting data, should be released online whenever  possible. Executive Order 13610 reiterated this recommendation,  stating that public disclosure promotes an open exchange of  information. While these executive orders are not binding on  independent regulatory agencies, we consider them a best practice for  rulemaking. OMB guidance on regulatory analysis states that to provide  greater access to regulatory analysis, agencies should post their analysis,  along with supporting documents, on the Internet so the public can review  the findings. Staff from SEC confirmed that they do not publish the results  or summaries of their section 610 reviews, stating that they are not  required to do so by law. Lack of public disclosure limits the transparency  of section 610 reviews, hindering the public’s ability to hold agencies  accountable for the quality and conclusions of their reviews. CFTC and CFPB Plan to  Develop Policies and  Procedures for Future  Retrospective Reviews The other two regulators we reviewed, CFTC and CFPB, plan to put  procedures in place for section 610 reviews. According to CFTC officials,  the agency has not conducted any section 610 reviews in at least the last  10 years. CFTC officials confirmed that the agency currently has no  policies or procedures in place to track which rules require reviews or to  conduct the reviews. Furthermore, agency officials were unable to identify  any final rules published by the agency from 1997 through 2007 that were  found to have a significant economic impact on a substantial number of  small entities and therefore would have required a section 610 review.  According to CFTC officials, an agency working group has a goal to  develop a process and criteria for conducting section 610 reviews.  Additionally, agency officials stated an interest in establishing an  automated system to develop a schedule for tracking which rules require  section 610 reviews. CFPB has not yet been required to conduct any section 610 reviews.  Section 610 reviews are required within 10 years of a rule’s adoption as a  final rule; to date, none of the rules issued by CFPB, which was created in  2010, have met this deadline. CFPB officials confirmed that CFPB has  conducted no section 610 reviews and stated that the agency currently  has no formal plan or procedure in place to begin conducting these  reviews. However, officials further stated that CFPB has had initial  planning discussions about the section 610 review requirements and their  role in a comprehensive regulatory review program. Conclusions RFA aims to have agencies tailor regulatory requirements to the scale of  regulated entities in a manner consistent with the objectives of the rule  and applicable statutes. To achieve this goal, RFA requires agencies to  assess the impact of proposed rules on small entities, solicit and consider  flexible regulatory proposals, and explain the rationale for their actions. While many of the regulators’ certification determinations and regulatory  flexibility analyses incorporated RFA-required components, the  weaknesses and inconsistencies we found—in the analyses and in  documentation—could undermine the act’s goal. Some certification determinations lacked important information  recommended by the Office of Advocacy and OMB, including data  sources and methodologies, definitions, and consideration of broad  economic impacts. Many evaluations of key components—potential economic effects and  alternative regulatory approaches—in the regulatory flexibility  analyses were limited. For most rules we reviewed, regulators were unable to provide  documentation supporting the economic analysis underlying their  regulatory flexibility analyses—including their certification decision. Moreover, regulators generally lacked comprehensive policies and  procedures for RFA implementation, a potential contributing factor for  many of the weaknesses we identified. By developing policies and procedures that provide specific direction to  rulemaking staff, the regulators could better ensure consistent and  complete implementation of RFA requirements and more fully realize the  RFA goal of appropriately considering and minimizing impacts on small  entities during and after agency rulemakings. The issues we identified with section 610 reviews included the use of a  substitute review process as well as gaps or weaknesses in analysis and  documentation. To fulfill section 610 requirements, the Federal Reserve, FDIC, and  OCC used other retrospective reviews required under EGRPRA that  do not fully align with requirements under section 610. SEC’s section 610 reviews are not fully consistent with RFA  requirements and Office of Advocacy and OMB guidance (for  example, not within the 10-year time frame, no evidence of empirical  analysis, and no data to support the conclusions of the reviews). CFTC has not recently completed section 610 reviews and CFPB has  not yet been required to do so. These regulators have begun or will  soon begin developing policies and procedures for conducting the  reviews. By meeting section 610 review requirements and using best practices,  regulators will be in a better position to minimize any significant economic  impact of a rule on small entities that the statute seeks to ensure.  Additionally, for regulators that have not publicly issued their finding or for  those that have yet to undertake the reviews, it will be important to adopt  best practices for transparency and accountability. Recommendations for  Executive Action We are making a total of 10 recommendations among the six financial  regulators we reviewed:  FDIC should develop and implement specific policies and procedures for  how it will consistently comply with RFA requirements and key aspects of  Office of Advocacy and OMB guidance that include the following three  elements: processes for creating and maintaining documentation sufficient to  support analysis of economic impact and alternatives; processes for disclosing the methodology—including criteria for  assessing significant economic impact and substantial number of  small entities—and data sources of economic analysis supporting  certification determinations and regulatory flexibility analyses; and processes for considering to the extent practicable a rule’s potential  economic impacts on small entities, including for evaluating broad  economic impacts of regulations in certification determinations and  assessing alternatives that could minimize impact on small entities.  (Recommendation 1) FDIC should coordinate with the Office of Advocacy to determine whether  the EGRPRA review process satisfies the requirements of section 610  and, if not, what steps should be taken to align the process with section  610 requirements. If additional actions are needed, FDIC should develop and implement specific policies and procedures for  performing section 610 reviews, including processes for determining  which rules require review, posting notices of upcoming reviews in the  Federal Register, and maintaining documentation supporting the  analysis and conclusions of RFA-required considerations; and publicly disclose the reviews, or summaries of the reviews, with the  basis for any conclusions. Such disclosure could include publishing  results as part of the EGRPRA report, in the Federal Register, or on  the agency’s website.  (Recommendation 2) OCC should develop and implement specific policies and procedures for  how it will consistently comply with RFA requirements and key aspects of  Office of Advocacy and OMB guidance that include the following three  elements: processes for creating and maintaining documentation sufficient to  support analysis of alternatives that could minimize impact on small  entities; processes for disclosing the methodology—including criteria for  assessing significant economic impact and a substantial number of  small entities—and data sources of economic analysis supporting  certification determinations and regulatory flexibility analyses; and processes for considering to the extent practicable a rule’s potential  economic impacts on small entities, including for evaluating broad  economic impacts of regulations in certification determinations and  assessing alternatives that could minimize impact on small entities.  (Recommendation 3) OCC should coordinate with the Office of Advocacy to determine whether  the EGRPRA review process satisfies the requirements of section 610  and, if not, what steps should be taken to align the process with section  610 requirements. If additional actions are needed, OCC should develop and implement specific policies and procedures for  performing section 610 reviews, including processes for determining  which rules require review, posting notices of upcoming reviews in the  Federal Register, and maintaining documentation supporting the  analysis and conclusions of RFA-required considerations; and publicly disclose the reviews, or summaries of the reviews, with the  basis for any conclusions. Such disclosure could include publishing  results as part of the EGRPRA report, in the Federal Register, or on  the agency’s website.  (Recommendation 4) The Federal Reserve should develop and implement specific policies and  procedures for how it will consistently comply with RFA requirements and  key aspects of Office of Advocacy and OMB guidance that include the  following three elements: processes for creating and maintaining documentation sufficient to  support analysis of economic impact and alternatives; processes for disclosing the methodology—including criteria for  assessing significant economic impact and a substantial number of  small entities—and data sources of economic analysis supporting  certification determinations and regulatory flexibility analyses; and processes for considering to the extent practicable a rule’s potential  economic impacts on small entities, including for evaluating broad  economic impacts of regulations in certification determinations and  assessing alternatives that could minimize impact on small entities.  (Recommendation 5) The Federal Reserve should coordinate with the Office of Advocacy to  determine whether the EGRPRA review process satisfies the  requirements of section 610 and, if not, what steps should be taken to  align the process with section 610 requirements. If additional actions are  needed, the Federal Reserve should develop and implement specific policies and procedures for  performing section 610 reviews, including processes for determining  which rules require review, posting notices of upcoming reviews in the  Federal Register, and maintaining documentation supporting the  analysis and conclusions of RFA-required considerations; and publicly disclose the reviews, or summaries of the reviews, with the  basis for any conclusions. Such disclosure could include publishing  results as part of the EGRPRA report, in the Federal Register, or on  the agency’s website.  (Recommendation 6) CFPB should develop and implement specific policies and procedures for  how it will consistently comply with RFA requirements and key aspects of  Office of Advocacy and OMB guidance that include the following three  elements: processes for creating and maintaining documentation sufficient to  support analysis of alternatives that could minimize the impact on  small entities; processes for considering to the extent practicable a rule’s potential  economic impacts on small entities, including for evaluating broad  economic impacts of regulations in certification determinations and  assessing alternatives that could minimize impact on small entities;  and  in developing policies and procedures for section 610 reviews, include  processes for determining which rules require review, posting notices  of upcoming reviews in the Federal Register, maintaining  documentation supporting the analysis and conclusions of RFA- required considerations, and establishing procedures for publicly  disclosing the review or summaries (such as in the Federal Register  or on the agency’s website).  (Recommendation 7) CFTC should develop and implement specific policies and procedures for  how it will consistently comply with RFA requirements and key aspects of  Office of Advocacy and OMB guidance that include the following four  elements: processes for creating and maintaining documentation sufficient to  support analysis of economic impact and alternatives; processes for disclosing the methodology—including criteria for  assessing significant economic impact and a substantial number of  small entities—and data sources of economic analysis supporting  certification determinations and regulatory flexibility analyses; processes for considering to the extent practicable a rule’s potential  economic impacts on small entities, including for evaluating broad  economic impacts of regulations in certification determinations and  assessing alternatives that could minimize impact on small entities;  and  in developing policies and procedures for section 610 reviews, include  processes for determining which rules require review, posting notices  of upcoming reviews in the Federal Register, maintaining  documentation supporting the analysis and conclusions of RFA- required considerations, and establishing procedures for publicly  disclosing the review or summaries (such as in the Federal Register  or on the agency’s website).  (Recommendation 8) SEC should develop and implement specific policies and procedures for  how it will consistently comply with RFA requirements and key aspects of  Office of Advocacy and OMB guidance that include the following four  elements: processes for creating and maintaining documentation sufficient to  support analysis of economic impact and alternatives; processes for disclosing the methodology—including criteria for  assessing significant economic impact and a substantial number of  small entities—and data sources of economic analysis supporting  certification determinations and regulatory flexibility analyses; processes for considering to the extent practicable a rule’s potential  economic impacts on small entities, including for evaluating broad  economic impacts of regulations in certification determinations and  assessing alternatives that could minimize the impact on small  entities; and processes for performing section 610 reviews, including determining  which rules require review, posting notices of upcoming reviews in the  Federal Register, and maintaining documentation supporting the  analysis and conclusions of RFA-required considerations.  (Recommendation 9) SEC should publicly disclose its section 610 reviews, or summaries of the  reviews, with the basis for any conclusions. Such disclosure could include  publishing results in the Federal Register or on the agency’s website.  (Recommendation 10) Agency Comments  and Our Evaluation We provided a draft of this report to CFPB, CFTC, the Federal Reserve,  FDIC, OCC, Office of Advocacy, and SEC for review and comment.  CFPB, CFTC, the Federal Reserve, FDIC, and SEC provided written  comments that we have reprinted in appendixes XIII–XVII, respectively.  CFTC, the Federal Reserve, and FDIC also provided technical  comments, which we have incorporated, as appropriate. We received  technical comments from OCC too late to be incorporated in the final  product. Although the comments were not incorporated, they do not  significantly affect the facts or conclusions we presented. In their written comments, CFPB, CFTC, the Federal Reserve, FDIC, and  SEC generally agreed with the report’s recommendations. CFPB  recognized the importance of having specific policies and procedures to  consistently comply with RFA requirements. CFPB noted the existence of  formal guidance instructing staff on conducting and documenting  analyses for substantive rulemakings, including following RFA, and stated  its commitment to updating its policies and procedures—and developing  them for section 610 reviews—to ensure it will consistently comply with  RFA requirements. In written comments provided by CFTC, the agency stated its  commitment to fully complying with RFA and described the formation and  progress of its interdivisional working group for enhancing RFA  implementation. CFTC noted that our recommendations are largely  consistent with the planned efforts of the working group and that the  group will use the recommendations as a guide in completing its work.  CFTC also explained that while not a clear requirement of RFA, it will  carefully consider making the public aware of the results of section 610  reviews in cases in which the review does not lead to proposed changes  to a rule. In its written comments, the Federal Reserve noted that it strives for  consistent and complete compliance with RFA requirements. Regarding  our recommendation to develop and implement specific policies and  procedures for complying with RFA requirements and key aspects of  Office of Advocacy and OMB guidance, the Federal Reserve stated it  plans to review existing policies and procedures to develop and  implement, as appropriate, additional processes with respect to  documentation, disclosing methodology and data sources, and  considering a rule’s potential economic impact on small entities.  Regarding our recommendation to coordinate with the Office of Advocacy  and take steps to align the EGRPRA review process with section 610  requirements, the Federal Reserve stated that it will coordinate with the  Office of Advocacy and noted that it also plans to conduct a broader  review of processes for section 610 reviews to ensure they are  comprehensive and transparent. In its written comments, FDIC stated it will consider our recommendations  as it continues to enhance its policies and procedures for performing  regulatory analyses, in particular compliance with RFA. Regarding our recommendation to develop and implement specific  policies and procedures for complying with RFA requirements and key  aspects of Office of Advocacy and OMB guidance, FDIC noted that  although independent agencies are not required to follow certain  guidance used as criteria in the report, it will continue to incorporate  provisions from Office of Advocacy and OMB guidance where  feasible. FDIC noted that GAO limited its review to analysis specifically  included in the RFA sections of a rule and did not consider  analysis published elsewhere in the preamble, as permitted by  RFA. FDIC stated that it continues to look for ways to make its  regulatory analysis more transparent. However, while RFA allows  agencies to perform regulatory flexibility analyses as part of other  required analysis if such other analysis satisfies RFA  requirements, RFA also calls for initial and final regulatory  flexibility analyses to contain or describe the required  components. Including these components elsewhere in a rule’s  preamble without referencing or describing them in the RFA  section does not help promote transparency for the public or small  entities the rule might affect. As the Office of Advocacy’s guidance  notes, agencies can coordinate preparation of regulatory flexibility  analyses with any other analyses accompanying a rule. But in  doing so, agencies should ensure that such analyses describe  explicitly how RFA requirements were satisfied. Otherwise, it may  be unclear to small entities and others if relevant analysis appears  elsewhere in a rule’s preamble, which could limit transparency and  the ability of small entities to review and respond to relevant  analyses. Regarding documentation supporting regulatory flexibility analyses  and certification determinations, FDIC noted that it will ensure staff  considers our recommendation. Regarding our recommendation to coordinate with the Office of  Advocacy and take steps to align the EGRPRA review process with  section 610 requirements, FDIC stated that it will consider the  recommendation. FDIC noted that before this year, the last section  610 review for FDIC was part of the 2007 EGRPRA review process,  and notices of that review were provided at that time. Since then,  FDIC said that it issued one rule in 2014 that requires a section 610  review, which must be completed by 2024. In written comments, SEC’s chairman stated that he asked staff to identify  additional ways to improve the quality of SEC’s rulemaking analysis and  procedures. SEC noted that as an independent regulatory agency, it is not subject  to the specific requirements for regulatory analysis in Executive  Orders 12866 and 13563 and OMB Circular A-4, but that it will  continue to strive to incorporate the principles and best practices in  those documents into internal practices, where appropriate. SEC also  noted that as part of its rulemaking, it engages in economic analyses  of the likely costs and benefits of proposed and final rules along with  other anticipated effects. SEC further explained that as permitted by RFA, relevant RFA  analyses in SEC rulemaking releases often are found across several  sections of the releases, and that it would therefore consider potential  improvements to better communicate to the public about other  analyses relevant to the RFA analyses. As we previously stated,  although RFA allows agencies to perform regulatory flexibility  analyses as part of other required analysis, it also requires the initial  and final analyses to include or describe the required components.  Including these components in different parts of a rule release without  explicitly referencing or describing them in the RFA section may limit  transparency and the ability of small entities to review and respond to  relevant analyses. We are sending copies of this report to the appropriate congressional  committees and members and financial regulators. This report will also be  available at no charge on our website at http://www.gao.gov. If you or your staff have any questions about this report, please contact  me at (202) 512-8678 or EvansL@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. Key contributors to this report are listed in appendix  XVIII. Appendix I: Objectives, Scope, and  Methodology The objectives of this report were to (1) analyze the trends in financial  regulators’ application of Regulatory Flexibility Act (RFA) requirements in  their recent rulemakings; (2) examine the extent to which financial  regulators performed analyses for rules they certified would not have a  significant economic impact on a substantial number of small entities; (3)  examine the extent to which financial regulators performed regulatory  flexibility analyses and the analyses’ effects on their rulemakings; (4)  examine the extent to which financial regulators established policies,  procedures, and criteria for complying with RFA requirements; and (5)  examine the extent to which financial regulators performed retrospective  reviews required by RFA. For the purposes of this report, financial regulators are the Consumer  Financial Protection Bureau (CFPB), the Board of Governors of the  Federal Reserve System (Federal Reserve), Federal Deposit Insurance  Corporation (FDIC), Office of the Comptroller of the Currency (OCC),  Commodity Futures Trading Commission (CFTC), and the Securities and  Exchange Commission (SEC). To analyze the trends in financial regulators’ application of RFA  requirements in their recent rulemakings, we reviewed all final rules  published in the Federal Register from January 2010 through December  2016. Using the document search on the official Federal Register  website, we downloaded all actions published in the Rules and  Regulations section of the Federal Register for the financial regulators  during our time period. The downloaded file had 744 actions and included  a website link to each notice on the Government Printing Office’s website.  We then reviewed each notice to remove actions that were not final rules,  such as corrections, orders, and statements of policies. We also removed  obvious duplicate rules, using the rule’s Regulation Identifier Number that  we recorded from the notice or the title for rules without such an  identification number. We considered rules to be duplicates if they were  (1) a final rule confirming an interim rule or (2) an extension of the  compliance date that did not make changes to the Code of Federal  Regulations. We removed 181 actions that were not final rules and 43  duplicates, leaving 520 final rules promulgated by the financial regulators  from 2010 through 2016. We then analyzed the Federal Register notices for these final rules, using  a spreadsheet-based data collection instrument, to quantify how many  rules (1) did not include a proposed rule, (2) included an initial regulatory  flexibility analysis, (3) included a final regulatory flexibility analysis, (4)  certified that RFA analyses were not required, and (5) had other  characteristics, such as those rules that performed a final regulatory  flexibility analysis but also certified that it was not required. In cases in  which the RFA analysis performed in the proposed rule was not clear or  present in the final rule, we used the Regulation Identifier Number or  citations listed in the final rule to locate the proposed rule to make the  determination. To examine the extent to which financial regulators performed analyses  for rules they certified would not have a significant economic impact on a  substantial number of small entities, we used the results from the trend  review to select all final rules published in the Federal Register from  January 2015 through December 2016 for which an agency published a  notice of proposed rulemaking and certified in the final rule that the rule  would not have such an economic impact. We identified a total of 66 final  rules that included certifications. More specifically, CFPB had 11 rules  that included certifications, CFTC had 15, FDIC had 18, the Federal  Reserve had 1, OCC had 9, and SEC had 12. For these rules, we  collected and reviewed internal workpapers from the financial regulators  on their decisions to certify that regulatory flexibility analyses were not  required because the rule would not have a significant economic impact  on a substantial number of small entities (certifications). We then assessed the regulators’ certifications in Federal Register  publications to determine the extent to which they reflected RFA  requirements, guidance from the Small Business Administration’s Office  of Advocacy on complying with RFA, and other best practices for  rulemaking, specifically Office of Management and Budget (OMB)  guidance on regulatory analysis and Executive Order 13563. Our  analysis did not include an evaluation of other aspects of agency  rulemaking, including regulatory analyses for purposes other than RFA,  such as analyses for the Paperwork Reduction Act and other economic  analyses in the preamble. We based our evaluation on the RFA sections  of each Federal Register notice for proposed and final rules and did not  review other rule sections unless the RFA section explicitly referenced  them. We also reviewed the workpapers and notices of joint rules for  coordination on the certification analysis or decisions between regulators. To examine the financial regulators’ initial and final regulatory flexibility  analyses and the analyses’ effects on their rulemakings, we used the  results from the trend review to select all final rules published in the  Federal Register from January 2015 through December 2016 for which  the agency performed an initial regulatory flexibility analysis in the  proposed rule and a final regulatory flexibility analysis in the final rule. For  any regulator that had fewer than three rules meeting these criteria, we  selected all rules published in the prior year for which the agency  performed an initial and final regulatory flexibility analysis until we  reached three rules or a publication date of January 2013. For rules  issued jointly by multiple financial regulators in our scope, we included the  rule for each regulator that prepared an initial and final regulatory  flexibility analysis. We included such rules even if they would not  otherwise have been selected using the outlined criteria. This resulted in  the inclusion of one additional rule for the Federal Reserve (a 2013 rule  issued jointly with OCC). We selected a total of 39 final rules for which the  agency performed an initial and final regulatory flexibility analysis. More  specifically, we selected 7 CFPB rules, 1 CFTC rule, 4 FDIC rules, 17  Federal Reserve rules, 1 OCC rule, and 9 SEC rules. For these rules, we  obtained and reviewed internal workpapers from the financial regulators  related to the initial and final regulatory analyses. We assessed the regulators’ regulatory flexibility analyses contained in  the RFA summary in the notices of proposed and final rules published in  the Federal Register to determine the extent to which they reflected RFA  requirements, the Office of Advocacy’s guidance on complying with RFA,  and OMB guidance on regulatory analysis. Our analysis did not include  an evaluation of other aspects of agency rulemaking, including regulatory  analyses for purposes other than RFA. We based our evaluation on the  RFA sections of each rule and did not review other rule sections unless  the RFA section explicitly referenced them. We also analyzed the  workpapers, notices, and interviews to identify the extent to which  regulators revised draft and proposed rules as a result of regulatory  flexibility analyses, the source of the changes, and the types and  characteristics of changes that regulators made to draft and proposed  rules as a result of regulatory flexibility analyses. We also reviewed the  workpapers and notices of joint rules for coordination on the analyses. To examine financial regulators’ policies, procedures, and criteria for  complying with RFA requirements, we obtained and reviewed internal  agency policies, procedures, and guidance for conducting initial and final  regulatory flexibility analyses or certifying that such analyses were not  required. We then assessed the documents received to determine the  extent to which they reflected RFA requirements and Office of Advocacy’s  guidance on complying with RFA. We also assessed the extent to which  the documents included comprehensive policies and procedures to assist  staff in complying with RFA in accordance with best practices outlined in  Executive Order 13272 and federal internal control standards. To examine the extent to which financial regulators performed  retrospective reviews required by RFA, we searched the Federal Register  for notices of upcoming section 610 reviews as well as results of section  610 reviews. We also obtained and reviewed documentation from the  financial regulators of section 610 reviews performed from calendar year  2006 through 2016. We assessed the section 610 reviews we received  against RFA requirements and other best practices for rulemaking,  specifically OMB guidance on regulatory analysis and Executive Orders  13563 and 13610. For agencies that conducted other retrospective  reviews in lieu of section 610 reviews, we compared the other  retrospective review processes to RFA requirements for section 610  reviews to determine the extent to which they aligned. We also  interviewed staff from each of the financial regulators to understand the  process and analysis supporting their certification decisions, regulatory  flexibility analyses, and retrospective reviews. We conducted this performance audit from January 2017 to January 2018  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. Appendix II: Extent of Coordination in  Financial Regulators’ Certifications and  Regulatory Flexibility Analyses In the seven joint rules we reviewed with a certification, financial  regulators conducted their own certification analyses independently of the  other agencies responsible for the rule. The Regulatory Flexibility Act  (RFA) allows agencies to coordinate on their RFA analyses but does not  require it. The Small Business Administration’s Office of Advocacy does  not make any recommendation on coordination in its RFA guide. Because  agencies regulate different small entities that could be affected differently  by a rule, coordination would not necessarily result in efficiencies or other  benefits. In joint rules, the regulators (except for the Board of Governors of the  Federal Reserve System (Federal Reserve), which generally treated  regulatory flexibility analyses differently) reached the same conclusion to  certify, although their analyses sometimes differed. For example, in one  joint rule, the Office of the Comptroller of the Currency (OCC) and the  Federal Deposit Insurance Corporation (FDIC) concluded that the rule  mainly imposes requirements on states and therefore affected no small  entities. The Consumer Financial Protection Bureau agreed that the rule  pertained mainly to states, but performed an analysis to assess the  indirect impact on small entities, concluding that even indirectly the rule  would not have a significant economic impact on a substantial number of  small entities. The Federal Reserve found that some entities would be  federally regulated but that the number was uncertain but not substantial  (less than five). In another joint rule, FDIC concluded that the rule would  not have a significant economic impact on a substantial number of small  entities because banks with less than $1 billion in assets were  exempted. The Small Business Administration defines a small bank as one with assets of $550 million or less; therefore, no small entities would  be affected. However, OCC assumed that every bank subject to the rule  would be required to comply regardless of the exemption and performed  its analysis with that assumption. Under this premise, OCC found that a  substantial number of small entities would be affected by the rule but that  the economic impact would not be significant. Of the seven joint rules that we reviewed with initial and final regulatory  flexibility analyses, the analyses for two rules indicated that regulators  collaborated in preparing the analysis. For one rule, the Federal  Reserve, FDIC, and OCC published a joint initial analysis but FDIC and  OCC made a certification determination in the final rule. For the other  rule, the Federal Reserve and OCC prepared separate initial analyses but  published a joint final analysis that included separate sections evaluating  the potential economic impact of the final rule. The remaining five joint  rules included separate regulatory flexibility analyses for each regulator  and all but the Federal Reserve reached a certification determination.  None of the rules we reviewed with initial and final flexibility analyses that  were issued by individual regulators indicated that the regulator had  coordinated with other agencies. Appendix III: Commodity Futures Trading  Commission Entities That Are Not Small  Entities for Regulatory Flexibility Act  Purposes The following table details the entities regulated by the Commodity  Futures Trading Commission (CFTC) that the agency determined were  not small entities for the purposes of the Regulatory Flexibility Act (RFA).  RFA allows agencies to establish alternative definitions of small entities  when appropriate by publishing the definition in the Federal Register and,  in the case of small businesses, in consultation with the Small Business  Administration’s Office of Advocacy. We reviewed CFTC’s small-entity  definitions to assess the extent to which they met these requirements. We  reviewed the Federal Register notices for the definition of those entities  included in final rules in calendar years 2015 and 2016 where the agency  certified that the rule would not have a significant economic impact on a  substantial number of small entities. Appendix IV: Securities and Exchange  Commission’s Small Entity Definitions for  Regulatory Flexibility Act Purposes The following table compares the Securities and Exchange Commission’s  definitions of small entities for the purposes of the Regulatory Flexibility  Act (RFA) with the Small Business Administration’s size standards that  RFA uses to define small entities. Appendix V: Assessment of Board of  Governors of the Federal Reserve System’s  Regulatory Flexibility Analyses, 2015–2016 The Board of Governors of the Federal Reserve System (Federal  Reserve) generally performed regulatory flexibility analyses for its  rulemakings regardless of the rule’s potential impact on small entities. As  shown in table 11, nearly all of the Federal Reserve’s initial and final  regulatory flexibility analyses concluded that the rule would not have a  significant economic impact on a substantial number of small entities,  which generally is a basis for certification. Furthermore, the majority of the  Federal Reserve’s analyses stated that the rules either did not apply to  small entities or lacked compliance requirements. Table 12 summarizes our findings on the Federal Reserve’s initial and  final regulatory flexibility analyses for the 17 rules we reviewed. Table 13 summarizes our findings for the six rules we reviewed for which  the Federal Reserve’s regulatory flexibility analysis indicated the rule  might impose compliance requirements on small entities. Appendix VI: Assessment of Other Financial  Regulators’ Regulatory Flexibility Analyses,  2013–2016 Appendix VII: Assessment of Federal  Deposit Insurance Corporation’s Regulatory  Flexibility Analyses, 2014–2016 Appendix VIII: Assessment of Consumer  Financial Protection Bureau’s Regulatory  Flexibility Analyses, 2013–2016 Appendix IX: Assessment of Commodity  Futures Trading Commission’s Regulatory  Flexibility Analyses, 2013–2016 Appendix X: Assessment of Office of the  Comptroller of the Currency’s Regulatory  Flexibility Analyses, 2013–2016 Appendix XI: Assessment of Securities and  Exchange Commission’s Regulatory  Flexibility Analyses, 2015–2016 Appendix XII: Outcomes of Financial  Regulators’ Regulatory Flexibility Analyses  on Final Rules, 2013–2016 Appendix XIII: Comments from the  Consumer Financial Protection Bureau Appendix XIV: Comments from the  Commodity Futures Trading Commission Appendix XV: Comments from the Board of  Governors of the Federal Reserve System Appendix XVI: Comments from the Federal  Deposit Insurance Corporation Appendix XVII: Comments from the  Securities and Exchange Commission Appendix XVIII: GAO Contact and Staff  Acknowledgments GAO Contact Lawrance L. Evans, Jr., (202) 512-8678, EvansL@gao.gov. Staff  Acknowledgments In addition to the contact named above, Stefanie Jonkman (Assistant  Director), Kevin Averyt (Analyst in Charge), Bethany Benitez, Katherine  Carter, Andrew Emmons, Marc Molino, Lauren Mosteller, and Barbara  Roesmann made key contributions to this report. Other assistance was  provided by Farrah Graham, Courtney LaFountain, and Tim Bober.
Since the 2007–2009 financial crisis, federal financial regulators have issued hundreds of rules to implement reforms intended to strengthen the financial services industry. Financial regulators must comply with rulemaking requirements such as RFA when drafting and implementing regulations. Congress included a provision in statute for GAO to study these financial services regulations annually. This annual report examines the extent to which and how financial regulators performed required RFA analyses and established policies and procedures for complying with RFA requirements, among other objectives. GAO reviewed the RFA section of financial regulators' Federal Register notices of rulemaking, related internal workpapers, and policies and procedures for conducting RFA analyses. GAO also determined the extent to which regulators' analyses reflected RFA requirements, guidance issued by the Office of Advocacy, and OMB guidance on regulatory analysis. GAO's review covered certifications in 66 final rules and regulatory flexibility analyses in 39 proposed and final rules. To comply with the Regulatory Flexibility Act (RFA), agencies generally must assess the rule's potential impact on small entities and consider alternatives that may minimize any significant economic impact of the rule (regulatory flexibility analyses). Alternatively, agencies may certify that a rule would not have a significant economic impact on a substantial number of small entities. GAO found several weaknesses with the analyses of six financial regulators (Board of Governors of the Federal Reserve System, Office of the Comptroller of the Currency, Federal Deposit Insurance Corporation, Securities and Exchange Commission, Commodity Futures Trading Commission, and Consumer Financial Protection Bureau) that could undermine the goal of RFA and limit transparency and public accountability, as shown in the following examples. Certifications. In certifications for rules that regulators determined may affect small entities, regulators conducted analyses to support their conclusions. GAO found many analyses across all regulators lacked key information the Small Business Administration's Office of Advocacy and the Office of Management and Budget (OMB) recommend. Missing information included discussions of data sources or methodologies, consideration of broader economic impacts of the rulemaking (such as cumulative economic impacts of regulations), and definitions of the criteria regulators used for “substantial number” and “significant economic impact.” Regulatory flexibility analyses. In many of the initial and final regulatory flexibility analyses that GAO reviewed, financial regulators' evaluation of key components required by RFA—potential economic effects and alternative regulatory approaches—was limited. Most regulators (five of six) also did not disclose data sources or methodologies used for their analyses, as OMB recommends. For most rules GAO reviewed, regulators (five of six) were unable to provide documentation supporting their regulatory flexibility analyses, as OMB recommends, including analyses supporting certification decisions. However, the extent of documentation varied by regulator. Federal internal control standards state the importance for agency management to establish policies and procedures to achieve objectives. All but one of the financial regulators have guidelines that restate RFA requirements for certification and for preparing regulatory flexibility analyses and provide some information on how to approach these analyses. However, these regulators generally have not developed specific policies and procedures to assist staff in complying with RFA, which may contribute to the weaknesses GAO identified in the analyses. For example, regulators' guidance generally did not include procedures for evaluating a rule's potential economic impact; identifying and assessing regulatory alternatives that could minimize impact on small entities; disclosing methodology and data sources; and creating and maintaining documentation that supports findings. By not developing and implementing comprehensive policies and procedures for RFA analyses, regulators' ability to consistently and effectively meet RFA objectives may be limited.