EX-99.3 9 dex993.txt WRITTEN AGREEMENT EXHIBIT 99.3 UNITED STATES OF AMERICA BEFORE THE BOARD OF GOVERNORS OF THE FEDERAL RESERVE SYSTEM ------------------------------------------ Written Agreement by and among : : FIFTH THIRD BANCORP : Cincinnati, Ohio : : FIFTH THIRD BANK : Cincinnati, Ohio : : FEDERAL RESERVE BANK : OF CLEVELAND : Cleveland, Ohio : : and : : STATE OF OHIO DEPARTMENT OF : COMMERCE, DIVISION OF : FINANCIAL INSTITUTIONS : Columbus, Ohio : ------------------------------------------ WHEREAS, Fifth Third Bancorp, Cincinnati, Ohio ("Fifth Third"), a registered bank holding company, owns and controls its lead subsidiary bank, Fifth Third Bank, Cincinnati, Ohio (the "Bank"), a state chartered bank that is a member of the Federal Reserve System, and five other subsidiary banks, Fifth Third Bank, Grand Rapids, Michigan; Fifth Third Bank, Indiana, Indianapolis, Indiana; Fifth Third Bank, Kentucky, Inc., Louisville, Kentucky; Fifth Third Bank, Northern Kentucky, Inc., Covington, Kentucky; and Fifth Third Bank, Florida, Naples, Florida (the "Subsidiary Banks"), which are state chartered banks that are members of the Federal Reserve System; WHEREAS, on its own behalf and on behalf of the Bank and the Subsidiary Banks, Fifth Third is addressing deficiencies noted by the Federal Reserve Bank of Cleveland (the "Reserve Bank") and the Ohio Division of Financial Institutions (the "Division") and is taking steps to enhance and improve its risk management, internal controls, financial accounting, audit, and information technology functions, as well as its management and corporate governance policies and procedures; WHEREAS, in recognition of Fifth Third's efforts to work in cooperation with the Reserve Bank and the Division, its progress in implementing corrective actions, and its commitment to assuring the availability of resources necessary to address deficiencies, Fifth Third, the Bank, the Reserve Bank, and the Division have mutually agreed to enter into this Written Agreement (the "Agreement"); and WHEREAS, on March 25, 2003, the boards of directors of Fifth Third and the Bank, at duly constituted meetings, adopted resolutions authorizing and directing George A. Schaefer, Jr., President and Chief Executive Officer of Fifth Third and the Bank, to enter into this Agreement on behalf of Fifth Third and the Bank, respectively, and consenting to compliance by Fifth Third and the Bank and their institution-affiliated parties, as defined in sections 3(u) and 8(b)(3) of the Federal Deposit Insurance Act (the "FDI Act") (12 U.S.C. 1813(u) and 1818(b)(3)), and the Bank's regulated persons, as defined in Ohio Revised Code section 1121.01(A), with each and every applicable provision of this Agreement. NOW, THEREFORE, Fifth Third, the Bank, the Reserve Bank, and the Division agree as follows: Management Review 1. (a) Fifth Third shall complete its engagement of an independent management consultant (the "Corporate Consultant") to conduct a review of the structure, functions, composition, and performance of Fifth Third's and the Bank's management and boards of directors (the "Corporate Review"), and to prepare a written report (the "Corporate Consultant's Report") that includes findings, conclusions, and written descriptions of any management or operational changes recommended as a result of the Corporate Review. The primary goals of the Corporate Review shall be, first, to assist Fifth Third's board of directors in the development of adequate board and management structures that are staffed by qualified and trained personnel suitable to the needs of the Fifth Third consolidated organization and, second, to improve corporate governance practices at the board of directors, committee and management levels. The Corporate Review shall, at a minimum, address, consider, and include: (i) An evaluation of the effectiveness of the boards of directors of Fifth Third and the Bank, as well as their committees, in carrying out their oversight responsibilities, including but not limited to, an evaluation of the adequacy of information provided to the boards of directors and committees, and the frequency of board of directors and committee meetings; (ii) an assessment of the adequacy throughout the consolidated organization of the identification and reporting of deficiencies and weaknesses to senior management and the boards of directors; (iii) an evaluation of the management structures of Fifth Third and the Bank, including recommendations regarding the type and number of senior officer and officer positions needed to manage and properly supervise the affairs of Fifth Third, the Bank, and the Subsidiary Banks; and (iv) an evaluation of each senior officer of Fifth Third and the Bank to determine whether the individual possesses the ability, experience, and other qualifications 2 required to competently perform present and anticipated duties, to adhere to established policies and procedures, and to comply with the requirements of this Agreement. (b) Within 10 days of this Agreement, but prior to the commencement of the Corporate Review, to the extent not already provided, Fifth Third and the Bank shall submit to the Reserve Bank and the Division for approval an engagement letter that delineates: (i) the scope of the Corporate Review; (ii) the date of submission of the Corporate Consultant's Report, not to exceed 90 days after the date of approval of the engagement letter by the Reserve Bank and the Division; and (iii) the proposed Corporate Consultant resources to be dedicated to the Corporate Review. (c) Fifth Third and the Bank shall fully cooperate with the Corporate Consultant and agree that the Corporate Consultant will have complete access to all employees, books, records, documents, and communications necessary to conduct the Corporate Review. A copy of the Corporate Consultant's Report shall be provided to the Reserve Bank and the Division at the same time that it is provided to Fifth Third and the Bank. (d) Within 60 days after Fifth Third's and the Bank's receipt of the Corporate Consultant's Report, Fifth Third and the Bank shall submit an acceptable joint written management plan to the Reserve Bank and the Division describing specific actions that the boards of directors propose to take to fully address the findings and recommendations of the Corporate Consultant's Report. 2. Within 180 days of receipt of the Corporate Consultant's Report, and thereafter not less frequently than semi-annually, Fifth Third's and the Bank's boards of directors shall review management's adherence to written policies and procedures in the areas of risk management, internal controls, financial accounting, audit, information technology, corporate governance, financial and regulatory reporting, and compliance and shall prepare written findings and conclusions of this review along with written descriptions of any management or operational changes that are made as a result of the review. The occurrence of the semi-annual review shall be noted in the minutes of the boards of directors meetings, and the written findings and information reviewed by the boards of directors to conduct this review shall be maintained for subsequent regulatory review. Risk Management 3. Within 90 days of this Agreement, Fifth Third and the Bank shall submit to the Reserve Bank and the Division an acceptable joint written plan designed to strengthen and improve the risk management processes for the consolidated organization that covers its operations, products, and financial activities, including but not limited to, information technology, wire transfer, account reconciliation, and treasury and trust operations. The plan shall, at a minimum, address, consider, and include: (a) An enterprise-wide, independent structure, overseen by an experienced senior executive level risk management officer, designed to ensure the evaluation of all functional risk management processes, identification and monitoring of aggregate risk exposures, 3 and reporting of enterprise-wide risk exposures in all areas to senior management and Fifth Third's board of directors; (b) improvements to the oversight of risk management processes by the boards of directors, including but not limited to, timely response to identified deficiencies and risks; (c) policies and procedures to establish controls, define responsibilities, and set risk tolerance levels for the consolidated organization; (d) policies and procedures to identify and assess all risks associated with new operations, products, and financial activities and to ensure that internal controls to manage those risks are in place; (e) improvements to management information systems and reporting procedures to ensure the accuracy of data provided to management and the board of directors, including but not limited to, the performance of independent validations of market risk models; (f) strengthened internal controls for the consolidated organization that are designed to effectively manage risks; and (g) training for appropriate personnel at Fifth Third, the Bank, and the Subsidiary Banks in all risk management areas. Accounting, Financial, and Internal Controls 4. Within 90 days of this Agreement, Fifth Third and the Bank shall jointly submit to the Reserve Bank and the Division acceptable written accounting policies and procedures for the consolidated organization designed to enhance the accounting control environment; to strengthen procedures for access to books and records, including the general ledger; to strengthen internal account opening processes and charge-off processes and controls; and to provide a sound accounting framework, with appropriate guidance on accounting matters. The accounting policies and procedures shall also specifically address account reconciliation processes and controls and shall, at a minimum, address, consider, and include: (a) Standardized processes to perform accurate and timely account reconciliations, consistent with generally accepted accounting principles ("GAAP"), including use of standard reconciliation formats and procedures; (b) timely and independent review and approval of reconciliations; (c) appropriate segregation of duties with respect to the preparation, review and approval of account reconciliations; (d) appropriate action with respect to identified aged items, including but not limited to, timely and appropriate charge-offs and timely and accurate reports to management; 4 (e) retention and availability of work papers and other records of reconciliations for internal and external audit review and regulatory review; and (f) training of all personnel engaged in the account reconciliation function to ensure that they have sufficient skills and knowledge to perform accurate reconciliations consistent with GAAP. 5. Fifth Third shall continue to work with the independent firm it previously retained with the approval of the Reserve Bank and the Division to complete by March 31, 2003, a full reconciliation of all internal accounts of Fifth Third, the Bank, the Subsidiary Banks, and all nonbank subsidiaries, as of December 31, 2002. By April 11, 2003, Fifth Third shall resolve any remaining unreconciled items in accordance with the applicable charge-off policy. 6. Within 90 days of this Agreement, Fifth Third and the Bank shall submit to the Reserve Bank and the Division acceptable joint written policies and procedures designed to strengthen internal controls throughout the consolidated organization. The policies and procedures shall address internal control criticisms noted in the report of the examination of Fifth Third and the Bank conducted by the Reserve Bank and the Division, commenced on November 12, 2002 (the "Report of Examination"), including but not limited to, criticisms in the areas of account reconciliation and treasury operations, and shall also, at a minimum, address, consider, and include: (a) Management information systems to ensure that appropriate management personnel receive timely and accurate reports necessary to effectively manage business risks and correct weaknesses and deficiencies; and (b) appropriate segregation of duties in all areas, including but not limited to, the funds transfer function, and treasury and trust operations. Financial Statements and Regulatory Reports 7. Fifth Third and the Bank shall take actions designed to ensure that all general ledger accounts are reconciled on at least a monthly basis to ensure accurate regulatory reporting and disclosures required under banking and securities laws. Records of such reconciliations shall be maintained for internal and external audit review and for subsequent regulatory review. 8. Fifth Third and the Bank shall take all actions as are necessary to ensure that each regulatory report, including Forms Y-9C and Reports of Condition and Income, accurately reflects Fifth Third's and the Bank's condition on the date for which it is filed, and that all records indicating how the report was prepared are maintained for subsequent supervisory review. Internal Audit 5 9. (a) Within 10 days of this Agreement, Fifth Third shall engage an independent firm acceptable to the Reserve Bank and the Division to conduct a review of the enterprise-wide internal audit function and to prepare a written report that includes findings, conclusions, and descriptions of any managerial or operational changes recommended as a result of the review. The terms of the engagement letter shall provide that the independent firm will submit its report within 60 days of its engagement and will provide a copy of its report to the Reserve Bank and the Division at the same time that it is provided to Fifth Third. The review and report shall address, consider, and include, at a minimum: (i) The independence of the internal audit function; (ii) the responsibilities and activities of the audit committee; (iii) the adequacy of information provided to the audit committee; (iv) the adequacy of audit staffing; (v) the adequacy of audit planning and risk assessments; (vi) the coverage, frequency and scope of internal audits; (vii) the adequacy of internal audit work programs; and (viii) the adequacy of formal management responses to audit findings. (b) Within 30 days after Fifth Third's receipt of the independent review of the internal audit function, Fifth Third shall submit an acceptable written plan to the Reserve Bank and the Division describing specific actions that Fifth Third's board of directors propose to take to fully address the findings and recommendations of the review. (c) Within 45 days after Fifth Third's receipt of the independent review of the internal audit function, Fifth Third shall review Fifth Third's previously adopted 2003 audit plan in consideration of the findings and recommendations of the internal audit review and shall revise the plan accordingly. The revised 2003 audit plan shall be approved by Fifth Third's board of directors, or an appropriate committee thereof. The revised 2003 audit plan shall require that any deviation from the audit plan be immediately reported, in writing, to the audit committee and the board of directors. 10. Fifth Third's internal audit department shall submit a written audit plan for each year subsequent to the year of this Agreement to Fifth Third's board of directors, or an appropriate committee thereof, no later than November 30th of the preceding year. The written audit plan shall detail the scope, nature, and scheduling of all audit work to be conducted for the consolidated organization in all areas for the year. The plan shall cover all operational areas and shall require that any deviation from the audit plan be immediately reported, in writing, to the audit committee and the board of directors. All plans required by this paragraph shall be 6 approved by Fifth Third's board of directors, or an appropriate committee thereof, and retained and made available for subsequent regulatory review. 7 Strategic Plan and Budget 11. (a) Within 180 days of this Agreement, Fifth Third shall submit to the Reserve Bank and the Division a written enterprise-wide strategic plan and budget concerning Fifth Third's proposed business activities for the three-year period beginning in 2004. The plan and budget shall, at a minimum, provide for or describe: (i) The responsibilities of Fifth Third's board of directors regarding the definition, approval, implementation and monitoring of the strategic plan and budget, and the procedures designed to ensure that the board of directors fulfills such responsibilities; (ii) development and adoption of policies, procedures, controls, and processes required to ensure the safe and sound operation of new activities and products as well as expanded functions; (iii) establishment of protocols designed to ensure that all areas of operations, including back office, are appropriately funded and that the organization's infrastructure keeps up with anticipated growth; and (iv) financial performance objectives, including plans for asset growth, earnings, liquidity, and capital supported by detailed quarterly and annual pro forma financial statements, including projected budgets, balance sheets and income statements. (b) For each year subsequent to the year of this Agreement, Fifth Third shall prepare a written update to the enterprise-wide strategic plan and budget. Such updates shall be included in the minutes of the boards of directors meetings and maintained for subsequent regulatory review. Information Technology 12. Within 90 days of this Agreement, Fifth Third and the Bank shall submit to the Reserve Bank and the Division an acceptable joint written plan designed to improve the information technology function of the consolidated organization. The plan shall, at a minimum, address, consider, and include: (a) Performance of an enterprise-wide information security risk assessment, as required by Appendix D-2 to Part 208 of Regulation H and Appendix F to Part 225 of Regulation Y of the Board of Governors, designed to enable Fifth Third and the Bank to meet all applicable requirements for protecting nonpublic customer information, and to assist Fifth Third and the Bank in making future adjustments to safeguards as appropriate; (b) enhancements to Fifth Third's and the Bank's existing policies, procedures and controls that address physical and logical information security, including but not limited to, physical access to work areas, and user access to business applications; 8 (c) an evaluation of electronic payment platforms to identify and correct any weaknesses in policies and procedures related to physical and logical information security; and (d) implementation of procedures and controls to increase the effectiveness and integrity of the program change processes of the consolidated organization. Funds Transfer Activities 13. (a) Within 10 days of this Agreement, Fifth Third and the Bank shall engage an independent firm acceptable to the Reserve Bank and the Division to conduct a review of funds transfer activities, evaluate improvements in funds transfer activities, and prepare a report with findings and recommendations to improve and strengthen, where needed, funds transfer activities. (b) Within 10 days of this Agreement, but prior to the commencement of the independent firm's review of funds transfer activities, to the extent not already provided, Fifth Third and the Bank shall submit to the Reserve Bank and the Division for approval an engagement letter that delineates: (i) the scope of the review; and (ii) the date of submission of the independent firm's report, not to exceed 90 days after the date of approval of the engagement letter by the Reserve Bank and the Division. A copy of the report shall be provided to the Reserve Bank and the Division at the same time that it is provided to Fifth Third. (c) Within 30 days after Fifth Third's and the Bank's receipt of the independent firm's report, Fifth Third and the Bank shall submit an acceptable joint written plan to the Reserve Bank and the Division that describes the specific actions that the boards of directors propose to take to fully address the findings and recommendations of the report. Treasury and Trust Operations 14. (a) Within 90 days of this Agreement, Fifth Third and the Bank shall complete their revision of the policies, procedures and controls in the treasury operations area. (b) Upon completion of the revision required by paragraph 14(a), Fifth Third and the Bank shall engage an independent firm acceptable to the Reserve Bank and the Division to conduct a review of the treasury operations area and prepare a written report that includes findings, conclusions and recommendations to further strengthen, where needed, the policies, procedures and controls, including but not limited to, management reporting, critical operating processes, separation of duties, and staff training and expertise. The terms of the engagement shall provide that the independent firm will submit its report within 60 days of its engagement and will provide a copy of its report to the Reserve Bank and the Division at the same time that it is provided to Fifth Third and the Bank. (c) Within 30 days after Fifth Third's receipt of the third party report, Fifth Third and the Bank shall submit an acceptable joint written plan to the Reserve Bank and the Division that describes the specific actions that the boards of directors propose to take to fully address the findings and recommendations of the independent firm's report. 9 15. By June 30, 2003, Fifth Third and the Bank shall complete the ongoing project to reconstruct treasury transactions conducted from March 1, 2000 through September 30, 2002 (the "Reconstruction Project"). Thereafter, Fifth Third and the Bank shall take the following steps: (a) Upon completion of the Reconstruction Project, Fifth Third and the Bank shall engage an independent firm acceptable to the Reserve Bank and the Division to review and validate the Reconstruction Project. The terms of the engagement shall provide that the independent firm will prepare a written report that includes findings, conclusions and written descriptions of any deficiencies in the Reconstruction Project and recommendations for corrections. The terms of the engagement shall provide that the independent firm will submit its report within 30 days of its engagement and will provide a copy of its report to the Reserve Bank and the Division at the same time that it is provided to Fifth Third and the Bank. (b) Within 10 days of receipt of the independent third party review and validation of the Reconstruction Project, the boards of directors shall ensure that all charge-offs and recoveries identified by the Reconstruction Project are appropriately reflected in the Bank's Reports of Condition and Income. 16. Within 90 days of this Agreement, Fifth Third and the Bank shall submit to the Reserve Bank and the Division acceptable joint written policies and procedures designed to strengthen management oversight of trust operations and improve the accuracy of the books and records of the trust operations area for the consolidated organization. These procedures shall include, at a minimum, corrective steps to address criticisms noted in the Report of Examination, including but not limited to, those in the areas of settlement accounts, system settlement, system access, and physical security. Compliance Committee 17. Within 15 days of this Agreement, the boards of directors of Fifth Third and the Bank shall establish a joint committee to monitor compliance with the provisions of this Agreement (the "Compliance Committee"). The Compliance Committee shall be comprised of three or more outside directors who are not officers or employees of Fifth Third, the Bank, any of the Subsidiary Banks or any nonbank subsidiary; who do not directly or indirectly own more than ten percent of the outstanding shares of Fifth Third; and who do not serve in the capacity of an executive officer or policy making officer of any entity that owns more than ten percent of Fifth Third. At a minimum, the Compliance Committee shall keep detailed minutes of each meeting and shall report its findings to Fifth Third's and the Bank's boards of directors on a monthly basis. Effect and Terms of Agreement 18. The written plans, policies, procedures, and engagement letters required by paragraphs 1(b), 1(d), 3, 4, 6, 9(b), 12, 13(b), 13(c), 14(c), and 16 of this Agreement shall be submitted to the Reserve Bank and the Division for review and approval. Acceptable plans, 10 policies, and procedures, and acceptable engagement letters shall be submitted within the time periods set forth in this Agreement. Fifth Third and the Bank, as appropriate, shall adopt the approved plans, policies, procedures, and engagement letters within 10 days of approval by the Reserve Bank and the Division and then shall fully comply with them. During the term of this Agreement, the approved plans, policies, procedures, and engagement letters shall not be amended or rescinded without the prior written approval of the Reserve Bank and the Division. 19. Within 30 days after the end of each calendar quarter (June 30, September 30, December 31, March 31) following the date of this Agreement, Fifth Third and the Bank shall furnish a joint written progress report detailing the form and manner of all actions taken to secure compliance with the provision of this Agreement, and the results thereof, to the Reserve Bank and the Division. 20. All communications regarding this Agreement shall be sent to: (a) George A. Schaefer, Jr. President and Chief Executive Officer Fifth Third Bancorp 38 Fountain Square Plaza Cincinnati, OH 45263 (b) Andrew C. Burkle, Jr. Senior Vice President Federal Reserve Bank of Cleveland 1455 East 6/th/ Street Cleveland, OH 44114-2566 (c) F. Scott O'Donnell Superintendent of Financial Institutions State of Ohio Department of Commerce Division of Financial Institutions 77 South High Street - 21/st/ Floor Columbus, Ohio 43215-6120 21. The provisions of this Agreement shall be binding on Fifth Third, the Bank, and each of their institution-affiliated parties in their capacities as such, and their successors and assigns. 22. Each provision of this Agreement shall remain effective and enforceable until stayed, modified, terminated, or suspended by the Reserve Bank and the Division. 23. Notwithstanding any provision of this Agreement, the Reserve Bank and the Division may, in their discretion, grant written extensions of time to Fifth Third and the Bank, as appropriate, to comply with any provision of this Agreement. 11 24. The provisions of this Agreement shall not bar, estop or otherwise prevent the Reserve Bank, the Board of Governors of the Federal Reserve System, the Division, any other federal or state agency or department from taking any other action affecting Fifth Third, the Bank, the Subsidiary Banks, any nonbank subsidiary, or any of their current or former institution-affiliated parties and their successors and assigns. 25. This Agreement is a "written agreement" for the purposes of, and is enforceable by the Board as an order issued under, section 8 of the FDI Act (12 U.S.C. 1818). 26. This Agreement is a "written agreement" under Section 1121.32(A), 1121.33(A)(1)(a)(iv) and 1121.35(A) of the Ohio Revised Code. Violation of a written agreement is grounds for the Division to pursue a cease and desist order, civil money penalties, and/or the removal of any "regulated person" as defined under Section 1121.01(A) of the Ohio Revised Code. IN WITNESS WHEREOF, the parties have caused this Agreement to be executed as of the 26/th/ day of March, 2003. Fifth Third Bancorp Federal Reserve Bank of Cleveland By: /s/ George A. Schaefer, Jr. By: /s/ Andrew C. Burkle, Jr. ----------------------------- -------------------------- George A. Schaefer, Jr. Andrew C. Burkle, Jr. Senior Vice President Fifth Third Bank State of Ohio, Department of Commerce Division of Financial Institutions By: /s/ George A. Schaefer, Jr. By: /s/ F. Scott O'Donnell ----------------------------- ----------------------- George A. Schaefer, Jr. F. Scott O'Donnell Superintendent of Financial Institutions 12