NAFCU Compliance Blog

Member Education: Online Authentication; Savings Bonds; Share Insurance

Written by Steve Van Beek

A few recent NCUA Letters to Credit Unions have included information regarding member education.  Below are a few areas where credit unions have been encouraged to educate members - in addition to the required regulatory disclosures already provided.

Member Education for Online Authentication

The recent online authentication guidance included a section on member education.  Pages 7 and 8 of the guidance include information on educating members.  Below are two of the types of communications that are expected:

• An explanation of under what, if any, circumstances and through what means the credit union may contact a member on an unsolicited basis and request the member’s provision of electronic banking credentials; and
• A listing of institutional contacts for members’ discretionary use in the event they notice suspicious account activity or experience member information security-related events.  

The guidance does not mention how often or in what format this information should be provided.  This provides credit unions with some flexibility in communicating with members.  It is quite possibility that credit unions already provide some of this information to members on a regular basis as a fraud prevention tool.  If so, be sure include those efforts in your documentation for the latest FFIEC guidance.  

Savings Bonds - Reminder: No more over-the-counter savings bonds sales after 12/31/2011 

NCUA's Letter to Credit Unions 11-CU-15 on Changes to Savings Bonds included information on educating members.  Here is from the Letter:

"Educate members about the upcoming changes. Let your members know they will no longer be able to buy paper savings bonds at your credit union or by mail order.  You are also encouraged to refer members to www.treasurydirect.gov where they can purchase, manage, and redeem electronic savings bonds online.  Electronic savings bonds are secure and convenient to manage in a TreasuryDirect account, and your members will no longer have to worry about storing, misplacing, or losing paper savings bonds.  In addition, with a TreasuryDirect account, members can purchase electronic savings bonds as gifts and convert paper savings bonds to electronic ones."

In this situation, NCUA is simply indicating credit unions should make members aware of the change and their options going forward.  

Share Insurance Coverage

Going back to 2008, NCUA issued Letter to Credit Unions 08-CU-18 on educating members on share insurance coverage.  The 2008 letter was written during the uncertainty of the financial crisis.  However, the message should not be lost on credit unions - especially with the influx of new members coming over from banks who might not be familiar with the share insurance coverage provided by the National Credit Union Share Insurance Fund.  

Going Forward

As the CFPB begins to regulate, there will most likely be additional pushes toward member education.  Credit unions should continue their efforts to provide education to members through their websites, newsletters and statements to ensure members are informed.  

As your credit union provides education to your members, document your efforts.  The credit union might offer this education anyway, but it can also be useful to document compliance.  For example, if you credit union offers identity theft or fraud prevention workshops - be sure to include this information as part of your compliance efforts to meet the expectations of the latest online authentication guidance.  

***

Programming Update:  NAFCU's offices will be closed on Friday, December 30th and Monday, January 2nd.  We'll be back blogging in 2012!  Have a Happy New Year!  

Risk Assessments & Documentation Keys to FFIEC Guidance

By JiJi Bahhur, Regulatory Compliance Counsel

With the compliance date for the FFIEC’s Internet Banking Authentication right around the corner, several credit unions have expressed their concerns as to the compliance impact their credit union will face if the guidelines for authentication are not fully implemented by January, 2012. 

The core principles of the FFIEC guidance include ongoing risk assessments and strategies, layered security controls, and improved customer awareness of online banking risks.  The Supplement stresses that the risk assessment(s) involved in the institution’s efforts to comply with the guidelines is not a one-time project.  Instead, it’s ongoing:  

“Financial institutions should review and update their existing risk assessments as new information becomes available, prior to implementing new electronic financial services, or at least every twelve months.” 

The risk assessment(s) aids in determining which online transactions are higher risk than others.  And although the guidance applies to all internet banking, it recognizes the fact that financial institutions will have more robust controls as the risk level of the transaction increases.  The guidance uses consumer and business banking as an example.  Although both would require security controls, the Guidance recognizes that the risk level differs:

“Since the frequency and dollar amounts of these [consumer] transactions are generally lower than commercial transactions, they pose a comparatively lower level of risk. Financial institutions should implement layered security, as described herein, consistent with the risk for covered consumer transactions."

The Guidance goes on to state:

“Since the frequency and dollar amounts of these [business] transactions are generally higher than consumer transactions, they pose a comparatively increased level of risk to the institution and its customer. Financial institutions should implement layered security, as described herein, utilizing controls consistent with the increased level of risk for covered business transactions. Additionally, the Agencies recommend that institutions offer multifactor authentication to their business customers.”

NCUA Letter to Credit Unions 11-CU-09 states:

“Federally insured credit unions will be expected to adapt appropriate strategies from the supplement to strengthen and enhance controls by January 2012. Beginning in 2012, at credit unions offering electronic services, NCUA examiners will evaluate these controls under the enhanced expectations outlined in the supplement.”

Documentation is Key.  As credit unions strive towards following the updated guidance, they should be sure to document their progress to show examiners.  Highlight the steps the credit union has taken to implement additional security controls as indicated by the risk assessment.  Show examiners your plan for continued risk assessments and new controls.  If your vendors will be slowly rolling out security enhancements in 2012, document your communications with these vendors so that examiners know you are working on mitigating these risks.

For additional information on the FFIEC Authentication Guidance, check out our June 29^th blog post.

FinCEN Extends Deadline for New CTR and SAR Forms

Written by Bernadette Clair, Regulatory Compliance Counsel

In the spirit of holiday giving, here’s one more present for you…FinCEN has extended its originally proposed deadline for using the new CTR and SAR from June 30, 2012 to March 31, 2013.  The extension is intended to give institutions more time to make the transition to the new reports, and make any necessary internal processing or system changes.

But wait…we’re not out of the woods just yet.  Remember that proposal FinCEN issued to mandate electronic CTR and SAR filing?  That’s still on the table and the proposed deadline remains June 30, 2012.  We blogged about this proposal on September 19th.

Although there will be a short reprieve from mandatory use of the new reports, don’t expect the same for e-filing. Here’s what FinCEN had to say about e-filing in this latest announcement:

“FinCEN expects that the clear benefits associated with the transition to a fully electronic reporting system will support mandating electronic filings of BSA reports as of the proposed date of June 30, 2012. FinCEN will continue to consider the comments received on its proposal, and will follow the normal procedures for concluding the notice process. As reflected in the notice, for those financial institutions unable to meet the proposed electronic filing deadline, FinCEN will consider, based upon certain limited hardship exceptions, specific requests to file the most current paper forms for up to one year past the mandatory electronic filing deadline. Further information on how financial institutions can make such requests will be provided in a future notice.”

Thus, if you’re not yet e-filing your CTRs and SARs, now is the time to start thinking about it.  Also, keep an eye out for more information on the new forms, which FinCEN says it will be making available soon.

More Republishing; Part 707 - Truth in Savings; Wish Granted

Written by Steve Van Beek

A Quick Note:  NAFCU's offices will be closed Friday, December 23rd and Monday, December 26th for the Christmas holiday.  We will be back blogging on Tuesday.  We hope you all have a wonderful holiday weekend!

***

We've tracked the CFPB's republishing in Monday and Tuesday's blog posts.  The CFPB hasn't slowed down.  

• Published in the Federal Register on Wednesday, December 21:
  • Equal Credit Opportunity (Regulation B)
  • Fair Credit Reporting (Regulation V)
  • Interstate Land Sales Registration Program (Regulations J, K, and L)
  • Privacy of Consumer Financial Information (Regulation P)
  • Truth in Savings (Regulation DD)

• Published in the Federal Register on Thursday, December 22:
  • Truth in Lending (Regulation Z)

***

On December 7th, we blogged on the possibility of the CFPB combining consumer regulations when it conducted its republishing.  Now that the CFPB has made progress on their republishing, we know additional information.  

NCUA will retain authority over Part 707 - implementing the Truth in Savings Act for credit unions.  Footnote 2 of the Proposed Rule contains this information:

"2. Dodd-Frank section 1029 generally excludes from this transfer of authority, subject to certain exceptions, any rulemaking authority over a motor vehicle dealer that is predominantly engaged in the sale and servicing of motor vehicles, the leasing and servicing of motor vehicles, or both. Further, Dodd-Frank section 1100B did not grant the Bureau TISA rulemaking authority over credit unions or repeal the NCUA's TISA rulemaking authority over credit unions under 12 U.S.C. 4311."  (emphasis added)

The proposed regulation (12 CFR 1030) mirrors the current Regulation DD (12 CFR 230) and includes this language in Part 1030.1(c):

"(c) Coverage. This part applies to depository institutions except for credit unions. In addition, the advertising rules in § 1030.8 of this part apply to any person who advertises an account offered by a depository institution, including deposit brokers."

What this means is that NCUA will need to follow the CFPB's lead on Truth in Savings issues just as they did in the past following the Federal Reserve.  The U.S. Code section cited by the CFPB - 12 U.S.C. 4311 - still requires NCUA to adopt a "substantially similar" regulation within 90 days.  NCUA's regulation, which will still be located in 12 C.F.R. 707, will continue to reflect the unique nature of credit unions.  

***

This year - my Christmas gift came early.  Two months ago, in fact.       

Michigan's victory over Ohio State wasn't too bad either.  I was able to enjoy The Game with my father-in-law (as he is from Ohio, he didn't enjoy it as much).  Luckily, we were able to get a photo before the game where we both were happy.  

Have a wonderful holiday weekend!

SAFE Act Renewal Period…Going…Going…

Written by JiJi Bahhur, Regulatory Compliance Counsel

Just a friendly reminder that the SAFE Act renewal period is set to expire on December 31, 2011.  Under the SAFE Act, all credit unions and its MLOs must renew their registration between the annual renewal period each year (there is an exception for MLOs registering for the first time less than six months prior to the end of the annual renewal period).  Part 761.102(a) of NCUA’s Rules and Regulations define the annual renewal period as November 1 through December 31 of each year.  If a credit union and its MLOs do not renew their registration, they would be prohibited from originating residential loans.  Here is from 12 CFR 761.103(a)(2): 

Ҥ 761.103 Registration of mortgage loan originators.

.......

(2) Credit union requirement —(i) In general. A credit union that employs one or more individuals who act as a residential mortgage loan originator must require each employee who is a mortgage loan originator to register with the Registry, maintain this registration, and obtain a unique identifier in accordance with the requirements of this part.

(ii) Prohibition. A credit union must not permit an employee of the credit union who is subject to the registration requirements of this part to act as a mortgage loan originator for the credit union unless such employee is registered with the Registry pursuant to this part.”

There is some leniency in the SAFE Act.  First, although all institution accounts must be renewed during each annual renewal period, the same does not always apply to the institution’s MLO(s).  If the MLO completed his/her initial registration less than 6 months prior to the end of the annual renewal period for that year, Part 761.103(b)(3) of the rule allows for an exception to annual renewal for that particular year.  Thus, any MLOs who registered on or after July 1st of 2011 would not be required to renew in 2011.    

Second, if for some reason the institution’s MLO(s) misses the December 31 deadline for annual renewal, it doesn’t mean the MLO is forever banned from originating loans.  What it does mean is that the MLO’s status goes inactive.  During the period of inactivity, the MLO cannot originate loans, but as soon as the MLO renews his/her registration, he/she will go back to active status and may begin originating again.

Below is a Q&A from the November 2011 NAFCU Compliance Monitor explaining the exception for MLOs who registered after July 1, 2011:

Question: We registered all our mortgage loan originator (MLO) personnel at the beginning of the year. I understand that we need to renew the credit union account before December 31, 2011, but I don’t need to renew our MLO registrations until next year, correct?  

Answer: No. If your employees were registered before July 1st then you will need to renew the registrations before December 31st and again annually thereafter as long they are active mortgage loan originators. “The annual registration renewal requirement set forth in paragraph (b)(1) of this section does not apply to a registered mortgage loan originator who has completed his or her registration with the Registry pursuant to paragraph (a)(1) of this section less than 6 months prior to the end of the annual renewal period.” See, 12 C.F.R. §761.103(b). Thus, any registrations that were made active after July 1st are not required to be renewed in that same calendar year but must be renewed in subsequent years. Any registrations prior to July 1st would need to be renewed between November 1 and December 31.     

For additional information on the SAFE Act renewal process, check out our October 18th blog post.

More on the Regulation Transition by the CFPB

Written by Steve Van Beek

Yesterday, we outlined the CFPB's efforts to move the "inherited regulations" from their existing place in the Electronic Code of Federal Regulations to the CFPB's Title X of Chapter 12.  

Will there be Substantive Changes during the Republishing of the Regulations?

According to the CFPB - no.  The CFPB has indicated that any changes will be technical in nature rather than substantive.  Here is from the CFPB's HMDA/Regulation C rule:

"The Bureau is in the process of republishing the regulations implementing those laws with technical and conforming changes to reflect the transfer of authority and certain other changes made by the Dodd-Frank Act. In light of the transfer to the Bureau of the Board of Governors of the Federal Reserve System's (Board's) rulemaking authority for the Home Mortgage Disclosure Act of 1975 (HMDA), as amended, the Bureau is publishing for public comment an interim final rule establishing a new Regulation C (Home Mortgage Disclosure). This interim final rule does not impose any new substantive obligations on persons subject to the existing Regulation C, previously published by the Board."

 Of course, there is always the possibility the CFPB views a change as "technical" while the impact on the financial industry is substantive.  

When will the Links to the New Regulations go live?  

Great question.  My understanding is the CFPB's new sections of the Electronic Code of Federal Regulations (e-CFR) will go live on December 30, 2011 - the effective date of the Interim Final Rules.  This has traditionally been the timeframe used in the past (new rules would be incorporated into the e-CFR when they officially became effective).

Will the Official Staff Commentary be Republished as well?

Yes.  The CFPB is republishing the regulations along with the accompanying Appendices - including the Official Staff Commentary and any model forms.

As of Today, Which Regulations Have Been Republished?

The following regulations have been republished in the Federal Register by the CFPB (not all of these impact credit unions).

• Published in the Federal Register on Friday, December 16
  • Disclosure Requirements for Depository Institutions Lacking Federal Deposit Insurance (Regulation I)
    
  • Fair Debt Collection Practices Act (Regulation F)
  • Mortgage Acts and Practices-Advertising (Regulation N); Mortgage Assistance Relief Services (Regulation O)
• Published in the Federal Register on Monday, December 19
  • Consumer Leasing (Regulation M)
    
  • Home Mortgage Disclosure (Regulation C)
  • S.A.F.E. Mortgage Licensing Act (Regulations G & H)
• Published in the Federal Register on Tuesday, December 20
• Real Estate Settlement Procedures Act (Regulation X)
  

The Great Regulation Transition of 2011-2012 Begins

Written by Steve Van Beek

The CFPB has begun the reorganization of the "inherited regulations."  The CFPB had hinted at this movement earlier in December and we blogged on this on December 5th and December 7th.

What is the CFPB Doing?

The CFPB is republishing the consumer regulations that transitioned to the CFPB on July 21, 2011 according to Dodd-Frank.  In the future, these consumer regulations will be located in the CFPB's section of the Electronic Code of Federal Regulations (Chapter X of Title 12).

Can you Explain that in Plain English?

Sure.  On July 21, 2011, the CFPB took over the regulatory authority for consumer laws and regulations.  These laws and regulations had been historically under the control of other Federal regulators (including NCUA).  Each regulator has its own section of the Code of Federal Regulations (NCUA's regulations are in Chapter VII).

Dodd-Frank transferred authority of these consumer regulations from the Federal regulators to the CFPB.  Thus, the CFPB is now taking the steps to transfer these existing regulations from their current place to the CFPB's section of the Code of Federal Regulations.

For example, Regulation Z, 12 CFR 226, had been under the Federal Reserve's authority until July 21, 2011.  The CFPB will transfer this regulation to its part of the Code of Federal Regulations with the result being the requirements of Regulation Z will be located in 12 CFR 1026 in the future.   

What is the Timeline for the CFPB's Transition?

In footnotes in the CFPB's Interim Final Rules, the CFPB indicated the transition would most likely be completed by the end of the year.  The Interim Final Rules will be effective December 30, 2011.  Here is from Footnote 10 of the HMDA/Regulation C rule:

"10. This interim final rule is one of 14 companion rulemakings that together restate and recodify the implementing regulations under 14 existing consumer financial laws (part III.C, below, lists the 14 laws involved). In the interest of proper coordination of this overall regulatory framework, which includes numerous cross-references among some of the regulations, the Bureau is establishing the same effective date of December 30, 2011 for those rules published on or before that date and making those published thereafter (if any) effective immediately."

Which Regulations Will Be Impacted?

The regulations that will be transferred are those that implement the "enumerated consumer laws" as defined by Dodd-Frank.  Previously, the CFPB had issued a listing of those regulations in the Federal Register.  

Here is from the HMDA/Regulation C rule:

"12. The fourteen laws implemented by this and its companion rulemakings are: the Consumer Leasing Act, the Electronic Fund Transfer Act (except with respect to section 920 of that Act), the Equal Credit Opportunity Act, the Fair Credit Reporting Act (except with respect to sections 615(e) and 628 of that act), the Fair Debt Collection Practices Act, Subsections (b) through (f) of section 43 of the Federal Deposit Insurance Act, sections 502 through 509 of the Gramm-Leach-Bliley Act (except for section 505 as it applies to section 501(b)), the Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, the S.A.F.E. Mortgage Licensing Act, the Truth in Lending Act, the Truth in Savings Act, section 626 of the Omnibus Appropriations Act, 2009, and the Interstate Land Sales Full Disclosure Act."

We'll have additional information on this republishing tomorrow.  Stay tuned.    

NCUA Proposes Changes to Reg Flex Rule; Loan Participations

Written by Steve Van Beek

The NCUA Board had a busy day yesterday with a full agenda.  The results of the Board meeting can be found here.  Additionally, the Board Action Bulletin provides a summary of each item.

The proposed changes to NCUA's Reg Flex rule are summarized in the Board Action Bulletin:

"The proposed rule would eliminate the charitable contributions rule and add relief provisions to rules that apply to eligible obligations, nonmember deposits, fixed assets, and investments. Under the proposed changes, FCUs would no longer have to qualify for a specific “RegFlex” designation. As of June 30, 2011, 60% of FCUs (2,764 of 4,534) were designated as RegFlex FCUs. The proposed changes would extend regulatory relief to the remaining 1,770 FCUs that do not currently have a RegFlex designation.

The RegFlex relief proposed rule has seven components. Specifically, the proposal would allow all FCUs to:

• Make charitable contributions to charities of their choosing;
• Accept non-member deposits, subject to predetermined limits, from local governmental entities or other credit unions;
• Use a six-year time horizon to partially occupy unimproved property they acquire for future expansion;
• Obtain certain exceptions to eligible obligations constraints;
• Enter into borrowing repurchase transactions in which the purchased securities have maturities that exceed the maturity of the borrowing repurchase agreement, provided the investment value does not exceed net worth, and subject to certain mismatch timing constraints;
• Purchase private-label commercial mortgage-related securities, subject to certain net worth constraints and four safety and soundness investment criteria; and
• Invest in zero-coupon securities, subject to certain net worth or investment maturity limits.

The proposal is issued with a 60-day comment period."

The draft version of the proposed rule is here.  It will be published in the Federal Register in the upcoming days.

***

NCUA also proposed a rule on loan participations that would extend the rule to all federally insured credit unions.  Additionally, the proposed rule addresses retention requirements, underwriting and concentration limits.  Here is from the Board Action Bulletin:

"Under the proposed rule, originators would be required to retain 10% of the original loan risk. (FCUs are already subject to this requirement.) Underwriting standards for loan participations must meet or exceed the underwriting standards that each purchasing credit union uses for originating their own loans. Credit unions buying participation interests must establish parameters for reviewing loan documentation, and for performing on-going due diligence on purchased loans.

Buyers would also be protected from acquiring undue concentrations. Loan participations purchased from one originating lender could not exceed 25% of net worth. Participation loans to one borrower could not exceed 15% of net worth. Credit unions could apply to NCUA Regional Directors for waivers of these limits."

***

NAFCU will be producing Regulatory Alerts on both of these proposals.  

Have a great weekend everyone! 

CFPB's Office of Fair Lending & Equal Opportunity; NCUA Report

Written by Steve Van Beek

Yesterday, the CFPB's blog featured a post from their Office of Fair Lending & Equal Opportunity.  Since July 21st, the CFPB has been the regulator in charge of the Equal Credit Opportunity Act (ECOA) which is implemented by Regulation B as well as the Fair Housing Act (updated on 12/15: authority for the Fair Housing Act did not transfer to the CFPB as it is not "an enumerated consumer law" under Dodd-Frank).  The CFPB is also in charge of the Home Mortgage Disclosure Act (HMDA) which is implemented by Regulation C.  

The CFPB's blog post includes a discussion of the CFPB's tools to prevent credit discrimination.  The blog also linked to a general Fair Lending page discussing the protections provided under the ECOA and the Fair Housing Act.

***

The latest issue of the NCUA Report is now available.  These newsletters give NCUA's perspective - from a variety of different NCUA offices - on a number of issues currently facing credit unions.  If you can find the reading time, the report provides a good summary of past issues as well as a general outline of potential issues in the future.    

CFPB's Latest on Closing Disclosures

Written by Steve Van Beek

Yesterday, the CFPB blogged on its latest efforts to combine the RESPA and TILA closing documents.  The CFPB is soliciting additional feedback from consumers and those in the mortgage industry on their latest set of two disclosure options.  

From the blog post:

"We’re giving a close-up to closing costs this month by trying to figure out which of two different designs communicates both the closing costs and transaction details clearly. One is similar to the existing HUD-1 settlement statement that consumers now receive when they close a mortgage loan. The other is based on our prototype for the disclosure you get when you first apply.

****

Now we also want to keep working hard to make things clearer for consumers, so we are testing an entirely new design for disclosing closing cost details. We’re curious to see if something different may work even better. This new design provides the same information as the other prototype, but it uses a format for the closing costs that is based on our application disclosure prototype. It has sections that correspond to the application disclosure and a little more plain language. We’re wondering if this design will make the disclosure even clearer and easier for consumers. Also, what improvements could we make to both designs?"

Similar to past "Know Before You Owe" stages, the CFPB has both forms available for review and comment.  You can provide your feedback by going to CFPB's website and switching to the "Industry Tool."   

***

The two prototypes for this round are available below:

• Settlement Disclosure - Mimosa Bank

• Settlement Disclosure - Sassafras Bank

It looks like this round of testing will be open through Wednesday, December 21st - so provide your comments now.