When it comes to CAMELS, ‘M’ should stand for ‘modernization’

The Halting Uncertain Methods and Practices in Supervision, or HUMPS, Act, recently advanced by the House Financial Services Committee, marks a rare moment in bank regulatory reform: It takes aim at an open secret. Namely, that the CAMELS supervisory ratings framework — long a cornerstone of prudential oversight — harbors a vulnerability that distorts outcomes and undermines trust in the supervisory process.

The “M” component of CAMELS, which purports to assess the quality of a bank’s management, has long been acknowledged as the most subjective and opaque element of the supervisory scorecard. Where capital, assets, and earnings can be evaluated through financial statements and stress tests, “management” assessment has remained a kind of regulatory black box.

The HUMPS Act calls time on that ambiguity. It directs the Federal Financial Institutions Examination Council to revise the CAMELS rating system by establishing clear, objective standards for each component, and eliminating or reforming the subjective “management” component, to focus instead on measurable risk governance and internal controls.

In short, the bill demands that supervisory judgment rest on firmer ground, and for that it deserves cautious support. But let’s be clear: Eliminating the “M” altogether would be a mistake.

Perhaps fairly, many argue that the “M” component has been used as a catchall — an index of intangibles spanning everything from “tone at the top” to the thickness of internal audit binders. And it is true, as the Bank Policy Institute has argued, that ratings in this category can act as powerful levers, quietly triggering adverse consequences for access to capital, merger eligibility, deposit insurance premiums and more — all without affording banks meaningful due process.

Yet management quality and governance effectiveness are not ancillary concerns — they are material risk variables that serve as leading indicators of resilience or fragility. To ignore this in the supervisory framework is to blind ourselves to the root causes of the most severe banking sector failures in recent years.

The better path is not erasure, but modernization.

We don’t need to replace a flawed system with no system at all. We need to replace it with a system built for the complexity and stakes of modern finance — one that allows some degree of supervisory judgment regarding management and governance quality will persist, but that calls for it to be grounded in a common evidentiary basis.

That means measurable, data-powered tools that serve to illuminate qualitative dynamics, standardize oversight practices and uphold the due process upon which the legitimacy of supervisory decisions rests.

This is not a theoretical aspiration. HSBC, for example, has demonstrated that — with behavioral science-backed AI tools — it could derive leading indicators of risk management failures. They identified where risk management behaviors were breaking down, where collaboration across control functions was misaligned and where latent structural barriers were impeding effective governance. These were not guesses. They were culture risk governance metrics — empirically grounded, replicable, and capable of informing management and supervisory insight alike.

That kind of progress offers a glimpse of what could come next: supervisory practice anchored not in discretion alone, but in defensible insight — structured, predictive and fair.

The HUMPS Act rightly pushes for reform. But it also risks ushering in a new era of minimalism — one in which qualitative risks are neglected altogether because they cannot be reduced to spreadsheet entries. That would be a dangerous outcome. Culture risk governance is not a soft concern; it’s an unpriced risk with hard consequences. The fate of Credit Suisse made that plain: A loss of confidence in the firm’s management and risk governance preceded its near collapse in 2023, not insufficient capital access.

The answer isn’t to avoid evaluating these qualitative dynamics. It’s to evaluate them better.

Federal Reserve Governor Michelle Bowman put the matter succinctly: Supervisory process must be not only rigorous, but “predictable and fair” — a position few would dispute. And transparency in such practices, “assists in ensuring accountability, in addition to building legitimacy and public trust.”

What we need now is institutional courage. Policymakers must adopt mechanisms that protect both safety and fairness, ensuring that banks are held to account on the basis of consistent and transparent standards — to include standards for qualitative assessments — and that supervisory agencies are themselves subject to the same scrutiny of management reliability that they would impose on others, if accountability, legitimacy and trust in supervision is to be achieved.

Indeed, that is where the HUMPS Act, intentionally or not, opens a wider door. If we are to build objective standards for evaluating management quality within firms, we must also confront how those standards apply to the agencies doing the rating. Qualitative risk governance is not the exclusive burden of the private sector, after all. It is also a challenge for those who oversee it.

With the right tools — those that bring quantitative metrics to qualitative concerns — we move from guessing to governing. The HUMPS Act should drive us in this direction.