NAFCU Compliance Blog

Fuzzy Logic - OFAC's Improved SDN Search Tool

Written By JiJi Bahhur, Regulatory Compliance Counsel

OFAC has improved its SDN search tool by employing what it calls “fuzzy logic” on its name search field.  Fuzzy logic uses character, string, and phonetic matching when returning results from an SDN search.  The other fields on the tool use only character matching.

For those of you who don’t know what an SDN search is or what this improved tool would be used for, it is explained in the FAQs accompanied with the release of the improved tool.  Specifically, FAQ #9 reads:

“SDN Search is a free tool provided by OFAC to assist the public in complying with sanctions programs. It is intended to be used by individual users that are looking for potential matches on the SDN list. It should not be utilized by automated systems that are configured to continually run searches through the tool. For a copy of files that can be easily interpreted by automated systems and software programs, please see the list of XML, CSV, PIP, DEL, and FF files on the SDN page.”

The search tool and the FAQs on it can be found here.

If you’ve never used OFAC’s SDN search tool before, try it out.  I did!  And thankfully the whole compliance team here at NAFCU came out match-free!  Phew!   

NAFCU's Regulatory Compliance School Just Got Better - Regulatory Update Day

Written by Steve Van Beek

We've heard you!  For the past couple of years, we've received the following feedback about NAFCU's Regulatory Compliance School (paraphrased, of course):

"School is great and provided a solid foundation for understanding the regulatory requirements credit unions face on a daily basis.  BUT, the rules are changing so fast that it would be great to receive updates on what has just changed and what is changing next."

With this in mind, we've created Regulatory Update Day at NAFCU's 2013 Regulatory Compliance School (March 18-23 in National Harbor, Maryland).  

Regulatory Update Day (Thursday, March 21st) will provide:

• A clear understanding of what changes NCUA has in store for 2013 – including their Exam Focus

• An overview of the scope and applicability of the CFPB’s seven new mortgage regulations*

• A detailed look at the CFPB’s Qualified Mortgage/Ability-to-Repay requirements*

• Answers to Frequently Asked Questions on the mortgage rules from NAFCU’s compliance team*

• Insight from credit union attorneys and practitioners on how best to set up your implementation strategy

You can find more information on Regulatory Update Day here.  The three sessions with the "*" are sessions that are also part of NAFCU's Mortgage Reform Webcast Series.

The other 4 days of Compliance School will remain the same as will the opportunity to take the NAFCU Certified Compliance Officer (NCCO) exams.  Good luck!  

***

And, all attendees at NAFCU's 2013 Regulatory Compliance School will receive NAFCU's 2013 GPS (coming soon!) as well as NAFCU's Scope & Applicability Charts.

Remember:  You do not need to be a NAFCU member credit union to attend NAFCU's conferences or webcasts.  In fact, you don't even need to work at a credit union.  Each School usually features a handful of consultants, vendors and other credit union "peeps" who support credit unions - in one way or another - on a daily basis.      

***

CFPB Releases Semiannual Regulatory Agenda - Spring 2012; Seminar in Seattle

Written by Steve Van Beek

CFPB Regulatory Agenda.  Yesterday, the CFPB posted its Semiannual Regulatory Agenda - for spring 2012.  The previous Semiannual Regulatory Agenda was released in February 2012.  The latest release follows the same format and includes a listing of regulations in the various rulemaking stages: prerule stage, proposed rule stage, final rule stage, long-term actions and completed actions.  

Below is a listing of the various future regulations - organized by rulemaking stage.  Keep in mind the agenda is current as of April 13, 2012 and the CFPB has taken numerous actions since putting this agenda together.    

Prerule Stage:

• Registration of Certain Nonbank Covered Persons
• Supervision of Larger Depository Institutions and Affiliates
• Home Mortgage Disclosure Act (Regulation C)
• Requirements for Prepaid Cards (Regulation E) 

Proposed Stage:

• Amendments to TILA and FIRREA Concerning Appraisals
• Disclosure Rules and Substantive Protection for Certain High Cost Mortgage Loans (Regulation Z)** (proposed on July 9th)
• Mortgage Originator Standards (Regulation Z)
• Mortgage Servicing (Regulation X; Regulation Z)
• TILA/RESPA Mortgage Disclosure Integration (Regulation X; Regulation Z)** (proposed on July 9th)
• Credit Card Pre-Opening Account Fees (Regulation Z)
• Procedural Rule To Establish Supervisory Authority Over Certain Nonbank Covered Persons Based on Risk Determination
• Supervision of Certain Nonbank Covered Persons—Defining Larger Participants in Certain Consumer Financial Product and Service Markets (LP 2) 
• Copies of Appraisals or Other Valuations To Be Furnished by Creditor (Regulation B)

Final Rule Stage:

• Supervision of Certain Nonbank Covered Persons—Defining Larger Participants in Certain Consumer Financial Product and Service Markets (LP 1)** (finalized on July 16th)
• Disclosure of Records and Information
• State Official Notification Rule
• Rules Relating to Investigations
• Rules of Practice for Adjudication Proceedings
• Restatement of Federal Consumer Financial Law Regulations
• Requirements for Escrow Accounts (Regulation Z)
• TILA Ability to Repay (Regulation Z)
• Confidential Treatment of Privileged Information
• Disclosure Rules for Remittance Transactions (Regulation E)

Long-Term Actions:

• Alternative Mortgage Transaction Parity (Regulation D)
• Business Lending Data (Regulation B)
• TILA Mortgage Amendments (Regulation Z) 

Completed Actions: 

• Disclosure Rules for Remittance Transactions (Regulation E)

***

Only 27 potential rulemakings!!  The Regulatory Agenda also includes a short summary of each rulemaking that is useful for providing a quick overview of what will be covered by the rulemaking.  However, as last Monday's proposed rules show - a short summary doesn't do much when the proposals are 1099 pages and 293 pages.  

***

NAFCU's 2012 Regulatory Compliance Seminar.  Luckily, you don't have to read and understand all 27 potential rulemakings on your own.  We'll be covering quite a few of them at our 2012 Regulatory Compliance Seminar in Seattle, Washington - October 23-26.

The program-at-a-glance is available here (and we'll be including additional sessions as the proposals continue to flow).  We already have a session on the TILA/RESPA mortgage disclosures, the upcoming mortgage servicing proposal (including the periodic statement requirement) as well as a session on the remittances final rule.  Detailed session descriptions can be found here.

Remember - you do not need to be a NAFCU member to attend.  And, Save $100 if you Register by August 31st!

ATM Fee Update; Deadline for NCUA Grants; NAFCU Member Call-In; CU Podcast

Written by Steve Van Beek

Below are a couple of quick items for your Thursday.

ATM Fee Update.  Yesterday, the ATM Fee disclosure bill, H.R. 4367, passed the House Financial Services Committee and will now move on to the full House.  NAFCU is also urging the Senate to act on a similar bill, S. 3204.  

NCUA Grants.  Low-income credit unions have until tomorrow - June 29th - to apply for technical assistance grants and reduced-rate loans.  Remember, the grants can be used for staff, official and director training.  If you are a low-income credit union, be sure to review the application process soon.  

Archive of June 14 Call-In.  The archived version of NAFCU's mid-year Member Call-In is available online.  The live version was conducted on June 14th.  If you need to get caught up on the multitude of issues impacting credit unions, this is a good way to do so.   

Current Issues in Credit Unions.  I had the pleasure of being a guest on Episode 72 of the Current Issues in Credit Unions podcast.  We talked about the CFPB; CUSOs; OFAC; Twitter and a few other items that might be interest.

Additionally, NAFCU will be hosting a live taping of Current Issues in Credit Unions podcast from our Regulatory Compliance Seminar (October 23-26 in Seattle).  We hosted the first live podcast last year in Orlando (Episode 64) and we are very glad that Rob Rutkowski and Katherine Weber will be back live for the podcast in Seattle.     

Treasury OFAC Settlement with ING Bank; OFAC Compliance Programs

Written by Michael Coleman, Regulatory Compliance Counsel

Yesterday, June 12^th, 2012, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced a settlement with ING Bank N.V. (ING Bank) for potential violations of U.S. sanctions in the amount of $619 million, the largest OFAC settlement of any kind to date. The settlement resolves OFAC’s investigation into ING Bank’s intentional and systemic violation of U.S. sanctions. In light of this monumental settlement, I thought it might be useful to highlight some guidance on OFAC compliance programs.

OFAC’s Frequently Asked Questions directory contains a large number of useful Q&A’s concerning OFAC requirements.  If you have not visited the site before it is worth taking a look. Here is a Q&A from the directory concerning financial institutions’ OFAC compliance programs:

“25. Does OFAC itself require that banks set up a certain type of compliance program?

No. There is no single compliance program suitable for every financial institution. OFAC is not itself a bank regulator; its basic requirement is that financial institutions not violate the laws that it administers. Financial institutions should check with their regulators regarding the suitability of specific programs to their unique situations. [09-10-02]”

As the OFAC Q&A points out, there are no specific regulations requiring compliance with OFAC requirements. Rather, financial institutions, including credit unions, should look to their regulators for their OFAC compliance expectations. NCUA’s expectations regarding a credit union’s OFAC compliance program can be found in the Federal Financial Institutions Examination Council (FFIEC), BSA/AML Examination Manual. The FFIEC BSA/AML Examination Manual contains an OFAC Overview section which talks about OFAC compliance programs, it reads:

“OFAC Compliance Program

While not required by specific regulation, but as a matter of sound banking practice and in order to ensure compliance, banks should establish and maintain an effective, written OFAC compliance program commensurate with their OFAC risk profile (based on products, services, customers, and geographic locations). The program should identify higher-risk areas, provide for appropriate internal controls for screening and reporting, establish independent testing for compliance, designate a bank employee or employees as responsible for OFAC compliance, and create training programs for appropriate personnel in all relevant areas of the bank. A bank’s OFAC compliance program should be commensurate with its respective OFAC risk profile.” (emphasis added).

As the guidance indicates, a credit union’s OFAC compliance program is a risk based program in nature. The OFAC overview also contains a section on Internal Controls, and states that an effective OFAC compliance program should include the following internal control elements:

• Identifying and reviewing suspect transactions
• Updating OFAC lists
• Screening Automated Clearing House (ACH) transactions
• Reporting
• Maintaining license information

The FFIEC BSA/AML Examination Manual OFAC Overview provides a very good summary of NCUA’s expectations concerning OFAC compliance, I would suggest taking a look through it if you have not already. OFAC compliance is sure to continue to be a hot topic with NCUA in examinations, and as this U.S. Treasury settlement with ING Bank shows, non-compliance can be costly.  

***

NAFCU's BSA Webcast.  Now is the perfect time to get your annual BSA training.  Check our NAFCU's June 27th webcast: BSA for Compliance Experts.  Sign up by June 20 to Save $100!

Member Complaints; NAFCU's 2012 Regulatory Compliance Seminar

Written by Steve Van Beek

Consumer and member complaints are at the forefront of quite a few conversations right now (including quite a few news articles).  The CFPB's promotion of their complaint process is one reason for this uptick in discussion as is the centralized complaint process for financial products.  

The CFPB issued their 2011 Annual Report on Consumer Complaints and it is full of useful information to review.  Here is a snapshot of the results:

"Between July 21 and December 31, 2011 the CFPB received 13,210 consumer complaints, including 9,307 credit card complaints and 2,326 mortgage complaints.

Forty-four percent of all complaints were submitted through the CFPB's website and 14.7 percent via telephone calls.  Referrals from other regulators accounted for 34.9 percent of all complaints received.  The rest were submitted by mail, email, and fax."

Future reports will include even more details - including complaints in new areas such as private student loans, auto loans and checking accounts.  Be sure to review the full report or pass it along to the appropriate person at your credit union.   

NCUA.  The March 2012 edition of the NCUA Report also included an article on Trends in Member Complaints and Consumer Inquiries.  Of note, the article indicates that of the complaints received in 2011 less than 1 percent involved a consumer compliance violation.  Of that 1 percent, half of those were related to timing issues related to the error resolution process under Regulation E.  

***

NAFCU Regulatory Compliance Seminar.  October seems like a long way off but it will be here before you know it.  We are in the process of putting together the content and agenda - so please feel free to send in any comments, ideas or suggestions.  We love your input and this conference is really about you all so let us know what you need.

Here is what we are tentatively looking at so far (topics are subject to change, of course):

• TILA/RESPA Mortgage Disclosures
• Upcoming Mortgage Servicing Requirements
• The Latest on Overdraft Protection
• Remittance Transfers under Regulation E
• CUSOs
• Loan Participations
• Bank Secrecy Act Changes
• Social Media
• NCUA Update
• CFPB Update

I think that is a pretty good start - but let us know what you are looking for and how we can make NAFCU's 2012 Regulatory Compliance Seminar even better than the past.  

Recertification for NCCOs.  Remember, attending Regulatory Compliance Seminar is the best way to recertify your NAFCU Certified Compliance Officer (NCCO) designation.  Seminar offers 24 CEUs which is enough to fully recertify for two years.

Seattle, Washington.  Did I mention Seminar was in Seattle?  Right Downtown?  Well, now I have.  Hope to see you October 23-26, 2012!    

OFAC Search Tool; NCUA OSCUI Training; NAFCU Member Call-In

 Written by Sarah Zimmermann

• OFAC has announced the release of SDN Search. This is an online search tool that allows the user to search the SDN list. Of course OFAC maintains in the fine print that searches are conducted at the risk of the user and use of the tool does not constitute an official confirmation on its part of the existence (or nonexistence) of a match.

 

• NCUA's Office of Small Credit Union Initiatives (OSCUI) has announced its first free training video. OSCUI is planning a series of training videos, and this is the first in the series. This video is a bit of an overview of the role of the office within NCUA, and various programs that are available to small credit unions. The announcement details how credit unions may access the video, online or via DVD.

 

• NAFCU held its year-end member call-in yesterday. The call-in is free for members and is a great way to catch up on what NAFCU is up to. If you weren't able to tune in yesterday it will be available on the website in a few days. The call provided legislative, regulatory and economic updates, including a look ahead to what to expect in 2012. Topics included tax reform, Richard Cordray's CFPB nomination blocked by the Senate, MBL and data security legislation; the status and activities of NCUA and the CFPB; and Steve discussed a few hot compliance topics including member online authentication guidelines, ADA and ATMs, and NCUA's advertising rule.

 

• NAFCU members, our December Compliance Monitor is now available, and includes an article on free checking analysis.

 

CFPB; OFAC

Posted by Anthony Demangone

Does the CFPB even need a director?  Last week, I would have said that the answer to that question was quite clear. Today, I'm not so sure.

When U.S. Congressmen voted on the Dodd-Frank legislation regarding the CFPB, it was understood that the new agency would be run by a director that had to pass through the Senate confirmation process.  That was a very important concept, because those Congressmen who were on the fence about whether the new CFPB would have too much power could calm their fears knowing that the Director was subject to confirmation.  If a possible director had some flaw or had ideas that made too many Senators uncomfortable, that person would not be confirmed, or more likely - would not even be put forward into the confirmation process.

The naming of Elizabeth Warren as a Special Advisor to the President did ruffle some feathers, as that move seemed to run counter to the Dodd-Frank confirmation process. This trend has been exacerbated by recent news that the officials from Treasury Department  are confident that the CFPB can run just fine without a confirmed Director - even after the official transfer date has come and gone. Read more about this development here. (Bank Lawyer's Blog.) 

This development is a bit troubling.  Having a Senate-confirmed director is a well-designed example of "checks and balances."  Anyone who sat in Civics 101 can tell you that the fewer checks and balances you have, you'll see a greater likelihood for shenanigans.  Checks and balances: good.  Shenanigans: bad.  I know that a Director will eventually be named, but the longer the CFPB is allowed to function without one…well…shenanigans.  That’s all I can say.

***

OFAC.  OFAC has issued guidance on "Weak AKAs"  or "weak aliases."  If you look at the SDN list, you'll see that many entries have AKAs or "known aliases" included with the entry.  OFAC notes that many of these are "weak," as they'll trigger a few false positives.  OFAC is now noting which AKAs are weak. For example, in the .pdf version of the SDN list, weak AKAs are inside double quotations.   Here are some FAQs about weak AKAs:

Am I required to screen for weak aliases (AKAs)? 
OFAC’s regulations do not explicitly require any specific screening regime.  Financial institutions and others must make screening choices based on their circumstances and compliance approach.  As a general matter, though, OFAC does not expect that persons will screen for weak AKAs, but expects that such AKAs may be used to help determine whether a “hit” arising from other information is accurate. 

Will I be penalized for processing an unauthorized transaction involving a weak alias (AKA)?
A person who processes an unauthorized transaction involving an SDN has violated U.S. law and may be subject to an enforcement action.  Generally speaking, however, if (i) the only sanctions reference in the transaction is a weak AKA, (ii) the person involved in the processing had no other reason to know that the transaction involved an SDN or was otherwise in violation of U.S. law, and (iii) the person maintains a rigorous risk-based compliance program, OFAC will not issue a civil penalty against an individual or entity for processing such a transaction.

 

There's No Substitute for Reading; This and That

Posted by Anthony Demangone

As we look toward 2011, here's another thought. Read.  

A good compliance officer has to devote some time each day for reading.  The reading list might include new regulations, guidance documents, blog postings, newsletters, and the like.  Background reading is a must.  If you ignore it long enough, you'll eventually say things such as..."When did NCUA issue that?"  Hopefully not last year. 

Here are some thoughts along those lines:

• Turn off the phone, and shut your door.  Give yourself the right reading environment, or the time you spend reading may end up being time wasted.
• Perhaps one day a week, come in early.  I've found that I can accomplish more between the hours of 6 and 9 a.m. than I can the rest of the day. 
• If something is interesting, but not time sensitive, add it to a reading list or pile.  When time presents itself, which may be in 2014, pick up the pile and start digging through it. 

I don't think you'll ever have enough hours in the day to read everything that you want, but the more time and effort you can devote to this task, the better off you'll be. 

***

Here are some other items of interest:

OFAC.  They recently issued civil money penalties against two financial institutions. 

Regulation Z.  Last week the Fed issued an interim final rule to clarify a few issues regarding another recent interim final rule regarding MDIA requirements. 

Interchange.  Hey NAFCU members, we've created an overview of the Fed's recent proposal concerning debit card interchange fees.  

Things I Think that I Think

Posted by Anthony Demangone

Here are seven things that I think that I think.  But I'm not completely sure yet...

1. I think the days of lazy summers for compliance officers are over, if they ever existed.  People like to hold on to myths, and I think this is one of them.  
2. I think we should all be nice to anyone responsible for mortgage compliance issues. 
3. I think we should impose a page limitation on proposed regulations. If you can't get it done in 200 pages, perhaps the document is a wee bit complicated for general consumption.
4. I think that regulators expect a lot when they issue five rule-makings in one day.  It is hard to comply with things when there isn't enough time in the day to read proposals, let alone analyze them. 
5. Now that I think about it, I think there should be an issue limit on top of the "page limit" for regulators.  It is impossible for organizations to comply with scores of new laws, regulations and guidance documents when they are issued on top of each other.  I wonder what our world would be like if each regulator was only allowed to issue five major rule-makings or guidance documents each year? 
6. I think regulators should point to existing guidance documents first whenever possible, rather than creating new documents.  If existing guidance is adequate, enforce it. 
7. I think that's enough thinking for today.

***

Here are a few items of interest.

Regulation and the cost of credit.  We warned folks that added layers of consumer protection and regulatory restrictions would drive up the cost of credit.  It looks like we may be right.  Your honor, I'd like to enter into evidence Exhibits One (CNN.com) and Two (WSJ.com).

OFAC.  A bank has paid roughly $92,000 to settle claims of OFAC violations. The original fine was more than $200,000, but the bank self-reported the violation.  I'm seeing an up-tick of OFAC violations.  It is hard to know whether this is a general trend or whether the issues were specific to the affected financial institutions.  In any event, it is something to track.

Reg Z.  The Fed issued Consumer Affairs letter CA 10-10 to announce bank examiner procedures for the August 22, 2010 Reg Z changes.