NAFCU Compliance Blog

The NAFCU Compliance Blog Has Moved!

NAFCU's Compliance Blog has moved!  

We still write about credit union compliance issues three days a week, but you can find the new blog location here.

• The blog is still public. If you've found the blog useful, consider sharing the blog with your friends and colleagues. It is free, and we make it available to everyone. 

• You can still subscribe to the blog. Consider registering to have the blog emailed directly to you. Be sure to respond to the verification email. Once you’ve been verified, the compliance blog should hit your inbox starting with the next new post.  

• Use the blog as a research tool. You can search the blog at its new location here. You can search past blogs on this website for the time being using the search function in the upper-left corner. NAFCU members can find additional info here on hot topics like HMDA, MLA, Mortgage Rules and more.

You'll find old blog posts below, but the content did migrate to our new website where you'll also find new posts to help you stay compliant!

    

Our Blog Has Moved!

As part of our website upgrade, NAFCU's Compliance Blog will no longer be posted via Typepad. Here's the new blog location:

https://www.nafcu.org/compliance-blog

You can find both old and new blogs on our website. 

Thanks for reading!

 

Deconstructing the QM Safe Harbor in Construction to Permanent Loans; CFPB Mortgage Servicing Guide Updates

By: Reginald Watson, Regulatory Compliance Counsel

Greetings Compliance Friends!

It has been a few years since the CFPB's implementation of the ability to repay requirements and qualified mortgage safe harbor, yet many credit unions still find the points and fees calculations confusing, particularly the scale of the exemption for construction loans in the context of a hybrid construction to permanent loan.  As a reminder, Regulation Z now requires credit unions to consider a consumer's ability to repay a residential mortgage loan and these requirements are set out in section 1026.43(c).

Loans that meet the standard of a qualified mortgage under sections 1026.43(e) or (f) are given a presumption that the borrower has the ability to repay. The calculation of all applicable points and fees are an aspect of determining whether a transaction is a qualified mortgage and therefore, whether the transaction is presumed to meet the “ability-to-repay” requirements of section 1026.43(c). The procedures for counting points and fees are the same as those provided in the high cost mortgage rule found in section 1026.32(b)(1). The credit union is required to establish a member's ability to repay for only those residential mortgage loans which are covered by the scope of section 1026.43(a), which contains a specific exemption for "a construction phase of 12 months or less of a construction-to-permanent loan." 12 C.F.R. §1026.43(a)(3)(iii). If a loan is outside the scope of section 1026.43(a), then there is no regulatory requirement to establish a consumer's ability to repay under section 1026.43 or calculate the points and fees.

So, how do we account for the points and fees calculation when the credit union is financing the permanent loan in addition to the construction phase? 

The commentary to Regulation Z seems to give us two options: for purposes of the qualified mortgage rule, the credit union may treat the construction phase and the permanent phase as one single transaction, or as two separate transactions.  Either way, the credit union would be required to follow the procedures under section 1026.32(b)(1) to calculate the points and fees for all applicable charges for both the construction phase and the life of the loan. However, it is not entirely clear how to allocate fees between the construction and permanent phase of a loan – but the preamble to the ATR/QM rule indicates that the ability to treat these kinds of loans as either one or two transactions draws upon section 1026.17(c)(6)(ii)-5. The preamble also referred back to section 1026.17(c)(6)(ii) in other areas, so while not entirely clear, it seems this rule may be helpful guidance generally.  The staff commentary to section 1026.17(c)(6)(ii)-5 seems to suggest that when separating the transactions, the points and fees may be allocated as the credit union sees fit:

5. Allocation of costs.When a creditor uses the special rule in §1026.17(c)(6) to disclose credit extensions as multiple transactions, fees and charges must be allocated for purposes of calculating disclosures. In the case of a construction-permanent loan that a creditor chooses to disclose as multiple transactions, the creditor must allocate to the construction transaction finance charges under §1026.4 and points and fees under §1026.32(b)(1) that would not be imposed but for the construction financing. For example, inspection and handling fees for the staged disbursement of construction loan proceeds must be included in the disclosures for the construction phase and may not be included in the disclosures for the permanent phase. If a creditor charges separate amounts for finance charges under §1026.4 and points and fees under §1026.32(b)(1) for the construction phase and the permanent phase, such amounts must be allocated to the phase for which they are charged. If a creditor charges an origination fee for construction financing only but charges a greater origination fee for construction-permanent financing, the difference between the two fees must be allocated to the permanent phase. All other finance charges under §1026.4 and points and fees under §1026.32(b)(1) must be allocated to the permanent financing. Fees and charges that are not used to compute the finance charge under §1026.4 or points and fees under §1026.32(b)(1) may be allocated between the transactions in any manner the creditor chooses. For example, a reasonable appraisal fee paid to an independent, third-party appraiser may be allocated in any manner the creditor chooses because it would be excluded from the finance charge pursuant to §1026.4(c)(7) and excluded from points and fees pursuant to §1026.32(b)(1)(iii).

Thus, it seems that the credit union may make a risk-based business decision when allocating points and fees for purposes of the qualified mortgage safe harbor for the permanent financing phase of the loan. Appendix D to Reg Z provides specific guidance on how to make the actual calculations when these loans are treated as separate transactions in Part I or as a single transaction in Part II.

***

CFPB Issues Update to Small Entity Compliance Guide

On March 29, 2018, CFPB updated the Mortgage Servicing Small Entity Compliance Guide (version 3.1) to incorporate recent amendments to the 2016 Mortgage Servicing Rules. As you may recall, we discussed these amendments in a previous NAFCU blogpost. Check out this link for our other blogs on the 2016 Mortgage Servicing Rules. CFPB also recently created a mortgage servicing coverage chart that credit unions may find helpful.

NCUA Legal Opinions: Still Good?; New in March

Written by Pamela Yu, Special Counsel for Compliance and Research

NAFCU's Compliance Team is often asked if a particular NCUA legal opinion is still valid guidance or how to determine if an opinion has been superseded.  NCUA's website, on its Rules and Regulations page, describes the parameters and limitations of the staff opinions and interpretive letters:

As a public service, and in an effort to help credit unions, lawyers, and others having an interest in the law applicable to federally insured credit unions better understand the statutes and regulations administered by the National Credit Union Administration, the NCUA publishes certain of staff's legal opinions and interpretive letters issued since 1991. The NCUA has not attempted to identify or publish all, or even most, letters on a particular subject prior to that year, and there may be other letters that have not been selected for publication. Similarly, the NCUA generally does not review opinions or letters once they have been published for the purpose of flagging or removing those that may have become outdated, superseded or discredited, or that may have been revised, modified, revoked or suspended.  Further, the letters' conclusions may be limited to specific facts stated in the letters and do not necessarily apply to circumstances involving different or additional facts.  The NCUA's Office of General Counsel is available to assist the public in determining whether a particular interpretation or opinion remains correct.  You can contact the Office of General Counsel at [email protected] or 703-518-6540.​ 

Compliance professionals may want to note that the interpretations selected by the agency as published opinions are just a limited collection of the agency's interpretations on the statutes and regulations within its jurisdiction; there are internal agency interpretive letters and memoranda that are not made available to the public.  Also, public opinions available online go back only as far as 1991.  The interpretations are also fact-specific so a credit union should be careful in extending a letter's conclusion to its own facts and circumstances.  If in doubt about an opinion's applicability, credit unions should contact NCUA's Office of General Counsel (OGC) for assistance in determining whether it may rely on a particular opinion.

NCUA issued two new legal opinions in the month of March.  The new opinions are summarized below.

 NCUA Opinion 17-1219: Field of Membership (FOM)

 On March 9, 2018, NCUA issued an opinion on associational common bonds.  In response to a question about whether a federal credit union chartered to serve Anabaptists and Mennonites could also serve "individuals who share a core doctrinal belief and set of practices with those communities," NCUA's OGC concluded that those sharing the same core doctrinal belief "have a significant and meaningful affinity with other members of the Anabaptist tradition," and could thus also be served by the credit union.  The opinion noted that such an FOM is a valid associational common.

In 2015, NCUA finalized a final rule that permits federal credit unions seeking to add associations to their fields of membership to apply for streamlined automatic NCUA approval of 12 categories of associations, such as religious organizations, including churches or groups of related churches.  Under the rule, which became effective July 5, 2015, NCUA provides automatic approval of such associations, allowing for the federal credit union to receive an immediate electronic confirmation of the approved application. 

NCUA Opinion 17-1219 interpreted this rule to conclude that those individuals who share a core doctrinal belief of Anabaptism to "live simply, practice mutual aid with the church, uphold economic justice, and give generously and cheerfully" share a valid associational common bond under NCUA's chartering and field of membership rules.

NCUA Opinion 18-0133: Loan Participations

 In another opinion, dated March 22, 2018, NCUA opined that certain requirements of its loan participation rule, 12 C.F.R. §701.22, apply "throughout the life of the loan."  NCUA Opinion 18-0133 clarifies several aspects of the loan participation rule, including:

• Each participated loan must be identified and treated independently. For example, a loan participation agreement must identify each participated loan, enumerate servicing responsibilities for that loan, and include disclosure requirements regarding the ongoing financial condition of that loan, the borrower, and the servicer.
• Where a participation agreement involves multiple loans, the documentation for identifying each participated loan can be consist of an addendum or schedule for identifying each loan and each participant’s interest in that loan.
• A loan participation represents an interest in a single loan, throughout the life of a participated loan. This includes servicing.  Thus, a servicer cannot deduct a servicing fee related to a nonperforming loan participation from the principal and interest received from a performing loan participation, even when many loan participations are sold to the same purchasing credit union.
• Credit unions are not precluded from engaging in servicing practices for administering multiple loan participations efficiently. For example, netting payments across multiple performing loans would be permissible, assuming proper accounting of each loan’s individual status and the netting is consistent with the loan participation agreement.

***

Monthly Research Survey: Help Us Help You!

NAFCU's Economic and Research Team conducts monthly surveys of NAFCU member credit unions in order to compile meaningful data reports that you can use to benchmark against your geographic and asset level peers. These survey results are also critical to NAFCU's advocacy efforts on your behalf to federal agencies, such as NCUA, CFPB and the Federal Reserve. Your participation helps us help you!

Tomorrow is the last day to share your voice on the topic of ADA Website Litigation. We rely on your survey responses for our industry analysis and legislative advocacy efforts on behalf of all credit unions.

NAFCU members can participate in this month's Economic and CU Monitor survey with one of the options below:

• Online survey
• PDF file (please return by email to [email protected])

Submission Deadline: April 3, 2018

BSA/AML Violations Can Cost You!

Written by Shari R. Pogach, Regulatory Paralegal

Recently the Financial Crimes Enforcement Network (FinCEN) made its annual inflation adjustment to its civil monetary penalty amounts.  News headlines are full of the large institutional fines but you must remember under various statutes, credit unions and individuals are subject to criminal and civil liability for violating anti-money laundering and terrorist financing laws. And, these penalties can be severe.  The Federal Financial Institutions Examination Council (FFIEC) Bank Secrecy Act/Anti-Money Laundering (BSA/AML) Examination Manual outlines potential penalties:

"A person convicted of money laundering can face up to 20 years in prison and a fine of up to $500,000. Any property involved in a transaction or traceable to the proceeds of the criminal activity, including property such as loan collateral, personal property, and, under certain conditions, entire bank accounts (even if some of the money in the account is legitimate), may be subject to forfeiture. ... the U.S. Department of Justice may bring criminal actions for money laundering that may include criminal fines, imprisonment, and forfeiture actions. In addition, banks risk losing their charters, and bank employees risk being removed and barred from banking."

Criminal penalties can be assessed for willful BSA regulation violations.  Any individual, including a credit union employee, found guilty of this is subject to criminal fines of up to $250,000 or five years in prison, or both.  If the individual commits a willful BSA violation while breaking another law or committing other criminal activity, he or she is subject to a fine of up to $500,000 or ten years in prison, or both. Violations of certain BSA provisions or special measures can make an institution subject to a criminal money penalty up to the greater of $1million or twice the value of the transaction.

The federal banking agencies and FinCEN have the authority to bring civil money penalty actions for BSA violations. In addition to criminal and civil money penalty actions, individuals can be removed from banking for violation of anti-money laundering laws "as long as the violation was not inadvertent or unintentional.

Here is a chart of the updated penalty amounts:

Although it hasn't been updated with the new amounts as yet, this IRS webpage has a nice breakdown of BSA penalties with charts indicating the types of violations and who or what is subject to the penalty. 

Three trends can be found in BSA enforcement: 1) an increase in the frequency and size of penalties; 2) an emphasis on the acceptance of responsibility by institutions; and 3) the increased risk of individual liability.  Remember FinCEN's $1 million civil money penalty against Thomas Haider?  Haider was the former chief compliance officer of MoneyGram International.  FinCEN found Haider guilty of willful violations of BSA program requirements and not filing suspicious activity reports.  FinCEN's enforcement action was brought before the courts over the application of the BSA to individuals.  The court found in favor of FinCEN and that Haider could be held liable for violations of the BSA's AML program requirements.  As a result, some regulators are now pursuing other BSA enforcement actions against individual compliance officers.

***

We need your help.  Can you take a moment to answer two short questions? NAFCU is polling credit unions on what week of the month they typically hold their board meetings. Click here to answer! 

NCUA's Official Advertising Statement: The Exceptions

Written by Jennifer Aguilar, Regulatory Compliance Counsel

In our compliance inbox, we often get asked about advertising requirements. The questions can range from whether a particular message is considered an advertisement to the specific content requirements for advertisements. If any of you have ever asked us an advertising question, you probably got some version of this somewhere in the response: "'Advertisement' is defined very broadly in [insert applicable regulation here] to cover any commercial message that promotes your [insert product or service here]." So, the basic point is that if your credit union puts out any message about a product or service, it's probably going to be an advertisement.

In addition to the rules in the applicable regulation, NCUA also has some general advertising rules. The basic point of these rules is that your ad must be accurate. But there is one unique thing about NCUA's advertising rules. The other regulations that govern advertisements, such as Truth in Savings and Regulation Z, do not require credit unions to always have a particular disclosure in an advertisement. The rules instead work around "trigger terms" – if a credit union states a particular terms in the advertisement, certain additional disclosures are required. The unique thing about NCUA's advertising rule is that it actually requires a disclosure to appear in all advertisements – the official advertising statement.

Section 740.5(a) states that "each insured credit union must include the official advertising statement . . . in all of its advertisements." In the long version, the official advertising statement reads: "This credit union is federally insured by the National Credit Union Administration." In the short version, the statement reads: "Federally insured by NCUA." Credit unions can also use a reproduction of the official sign as the advertising statement.  Here's where I'd normally put the spiel about how pretty much everything is an advertisement so you need to include the official statement on pretty much everything, but no need to bore you with that again. So, I'll just say that even when a message is considered an "advertisement," you may not actually need to include the official advertising statement thanks to some exceptions. Section 740.5(c) provides a rather long list of advertisements that do not have to include the official advertising statement.  Here are some of these exceptions:

• Credit union supplies such as envelopes, deposit slips or signature cards;
• Listings in directories;
• Advertisements that do not state the name of the insured credit union;
• Group advertisements of credit union services where names of insured and noninsured credit unions are listed; and
• Radio and television advertisements that are less than 15 seconds.

These can all come in handy from time to time, but, the most important exception, in my humble opinion, appears last on the list: advertisements that do not relate to member accounts. When you think about it, this is a very comprehensive exception. The rule provides a couple of examples of the types of advertisements this exception covers: advertisements for loans, safety deposit boxes, traveler's checks and credit disability insurance. Since these examples are not exhaustive, a number of other products and services can be covered under this exception.

As first glance, this seems a bit counterintuitive to NCUA's advertising rules. The whole point of defining "advertisement" broadly is to ensure all messages about all products and services are covered. Then, the rule goes and exempts this huge category of advertisements from the official advertising statement requirements. However, upon further review, this does actually make sense. See, the advertising statement is all about how your credit union is insured but only your accounts are insured. So, a member who is interested in a loan does not really care about your insured status since the loan is not insured. Likewise, safety deposit boxes aren't insured either, so there's no need to highlight in the advertisement that your credit union is insured. While, of course, credit unions may include the official advertising statement on advertisements that do not relate to member accounts (except for noninsured investment products), it is one thing you can take off your checklist for these types of advertisements.

A Deep Dive into E-Signatures for Online Accounts

By Reginald Watson, Regulatory Compliance Counsel

Electronic documents and signatures are almost a mainstay in the financial industry, allowing credit unions to dramatically improve efficiency by reducing costs, saving paper, and expediting the application process. Additionally, consumers have come to enjoy the benefits of being able to easily edit and correct errors, or cut and paste pre-filled information. Before we take that dive, here's picture of a lovely dolphin that reminds me of my last boat trip in my hometown of sunny Tampa!

Now on to electronic signatures! Congress enacted the Electronic Signatures in Global and National Commerce Act (ESIGN) to accommodate the global transition to electronic transactions, records, and signatures, allowing electronic documents to carry the same legal weight as paper documents. The law went into effect on October 1, 2000 and states that the enforceability of a contract, electronic record, or signature for a transaction cannot be challenged solely because it is electronic. ESIGN also authorizes signatures to be retained in an electronic format so long as it is an accurate reflection of the information in the original document, remains accessible to all persons entitled to access, and is capable of being accurately reproduced.

This Blog will take a deep dive into the application process and discuss the ESIGN implications of electronically signed online account applications. As a threshold matter, ESIGN only applies to information that is legally required to be in writing. Thus, we should first ascertain which applications are legally required to have a signature.

Online Membership Applications

With regard to obtaining signatures on membership applications, the FCU model bylaws (Appendix A to Part 701, Art. II, Sec. 2) indicate that applications for membership must be signed by the applicant. The credit union's bylaws will likely have a similar requirement; however, there is no specific requirement for a wet signature. NCUA affirmed this position in NCUA Opinion Letter 2004-0543, explaining that "the credit union may rely on the electronic signature and need not require an applicant to print the form and sign it in handwriting," so long as the credit union ensures "that its audit and verification procedures are sufficient where the member's signature is captured electronically."

An “electronic signature” can be any type of notification that the member and the credit union both understand will formalize an agreement. While not required, using an electronic signature-verification service (e.g. DocuSign) provides that additional level of confirmation that both parties understand the e-signature is intended to bind the parties to the agreement. 

Online Credit Applications

Remember, ESIGN consent is only required for information that is legally required to be in writing. There is no federal regulatory requirement that a credit union obtain a signature on a mortgage loan application (but be on the lookout for state law requirements). However, some institutions require a signature as a means of further identifying the member to prevent identity theft. In the commentary to section 1002.4(c) of Regulation B, the bureau indicates that for credit decisions, the credit union "may complete an application on behalf of an applicant and need not require the applicant to sign the application."

With respect to pulling credit, the Fair Credit Reporting Act (FCRA) allows the credit union to pull credit if it has a permissible purpose – such as when a member requests a loan – but does not require that the credit union obtain a signature (except for employment purposes which require a signature). Nevertheless, some states and investors may have specific authorization requirements before a credit union can pull a credit report, in which case, some credit unions may use the applicant's signature for purposes of fulfilling these requirements.

There are a few specific issues related to credit card accounts which may require the credit union to obtain a signature. Regulation Z contains a requirement related to issuing credit cards to consumers under 21, where the credit union is required to have a signed agreement from a cosigner or joint applicant. See, §1026.51(b)). The credit union may also require a signature to maintain a consensual lien on the members’ shares in connection with a credit card account. Regulation Z specifically prohibits offsetting credit card debt with shares on deposit, unless the credit union has obtained a consensual security interest in the funds. See, §1026.12(d)(2). Some credit unions may obtain a signature in connection with establishing the consensual lien.

Other Purposes

The credit union may also choose to obtain a signature even when not required by federal regulation, for example, to substantiate an audit trail, or to fulfill investor or state requirements. Most applications also have a statement that the information provided in the application is true and correct, and having the signature can make a difference in the credit union’s legal recourse in the event of fraud. If a credit union decides as a matter of policy to obtain application signatures for these purposes, the use of an e-signature as opposed to wet signature would be a risk-based decision. When it comes to legality and enforceability, however, either will suffice!

CFPB Finalizes Important Change for Lenders Dealing with Member Borrowers in Bankruptcy

Written by: André B. Cotten, Regulatory Compliance Counsel

Hi, Compliance Friends. We are finishing up another awesome week of our Regulatory Compliance School, and we now have a new cohort of NCCO's!

Earlier this month, the CFPB finalized a technical change that will allow credit unions greater flexibility when dealing with a borrower in bankruptcy or transitioning out of bankruptcy. If you can recall, the 2016 Mortgage Servicing Final Rule addresses Regulation Z's periodic statement and coupon book requirements when a person is a debtor in bankruptcy. The bankruptcy requirements will take effect on April 19, 2018. Today's blog will discuss the change and what it will mean for mortgage servicing.

To provide some overview, as early as 2013, the CFPB issued regulations requiring credit unions who meet certain thresholds to provide monthly periodic statements to member borrowers. In theory, the concept of providing periodic statements seems easy, but in implementation, it has proved to be a bit more complicated. In particular, the obligation to provide periodic statements to members in bankruptcy had become troublesome. The recent CFPB amendments give credit unions greater flexibility in complying with the periodic statement requirement for members involved in bankruptcy.

Due to the highly technical nature of the changes, I have extracted two examples from the final rule to demonstrate the CFPB's most recent amendments. Both examples assume that a mortgage loan has a monthly billing cycle, each payment due date is on the first day of the month following its respective billing cycle, and each payment due date has a 15-day courtesy period.

The CFPB's amendment made the following change as demonstrated here:

"i. explains that, if an event listed in § 1026.41€(5)(iv)(A) occurs on October 6, before the end of the 15-day courtesy period provided for the October 1 payment due date, and the servicer has not yet provided a periodic statement or coupon book for the billing cycle with a November 1 payment due date, the servicer is exempt from providing a periodic statement or coupon book for that billing cycle. The servicer is required thereafter to resume providing periodic statements or coupon books that comply with the requirements of § 1026.41 by providing a modified or unmodified periodic statement or coupon book for the billing cycle with a December 1 payment due date within a reasonably prompt time after November 1 payment due date."

Here is another example from the CFPB's recent amendment:

"ii. Provides an example for when a servicer already timely provided a periodic statement or coupon book for a billing cycle in which an event listed in § 1026.41(e)(5)(iv)(A) occurs. It provides that, if an event listed in § 1026.41(e)(5)(iv)(A) occurs on October 20, after the end of the 15-day courtesy period provided for the October 1 payment due date, and the servicer timely provided a periodic statement or coupon book for the billing cycle with a November 1 payment due date, the servicer is not required to correct the periodic statement or coupon book already provided and is exempt from providing the next periodic statement or coupon book, which is the owner that would otherwise be required for the billing cycle with a December 1 payment due date. The servicer is required thereafter to resume providing periodic statements or coupon books that comply with the requirements of § 1026.41 by providing a modified or unmodified periodic statement or coupon book for the billing cycle with a January 1 payment due date within a reasonably prompt time after December 1 or the end of the 15-day courtesy period provided for the December 1 payment due date."

The CFPB stated that it believes these amendments will provide a clearer and more straightforward standard than the timing requirement finalized in the 2016 Mortgage Servicing Final Rule. The Bureau also anticipates that the amendments will offer greater certainty for implementation and compliance, without unnecessarily disadvantaging members.

The Wait is Over! D.C. Circuit Vacates Parts of the FCC's 2015 Order

Written by Ann Kossachev, Regulatory Affairs Counsel

Hello again compliance friends! As I'm sure many of you have already heard, last Friday, was a big day in the Telephone Consumer Protection Act (TCPA) world because the U.S. Court of Appeals for the D.C. Circuit FINALLY issued its decision in ACA International v. Federal Communications Commission (FCC). The D.C. Circuit set aside and vacated parts of the FCC's 2015 Omnibus Declaratory Ruling and Order but did uphold one portion of the FCC's interpretation of the TCPA with respect to revocation of consent.

Even though the majority of this opinion restores the status quo before the 2015 Order (and to the original TCPA definition for "autodialer") and provides some relief for credit unions, the FCC must now decide how it intends to proceed with interpreting these critical aspects of the TCPA.

Clear guidelines and standards as to what is and is not permissible under the TCPA are essential for credit unions to be able to contact their members without fear of liability. Although NAFCU remains optimistic that under Chairman Pai, the FCC's interpretations will move in a more positive direction for the financial services industry, our communications with the FCC will not quit. For now though, you can rest easier knowing the 2015 Order has lost most of its bite.

Keeping that in mind, let's take a deep dive into the D.C. Circuit's analysis and some interesting questions it raised but did not decide. Ready?! Let's go!

The court evaluated and decided four challenges raised by the petitioners: (1) which sorts of automated dialing equipment ("automatic telephone dialing system" or "autodialer") are subject to the TCPA's restrictions on unconsented calls; (2) when a caller obtains a party's consent, does a call still violate the TCPA if, unbeknownst to the caller, the consenting party's wireless number has been reassigned to a different person who has not given consent; (3) how may a consenting party revoke her consent; and (4) did the FCC too narrowly fashion an exemption from the TCPA's consent requirement for certain healthcare-related calls. We will not discuss this last point because it is not relevant to credit unions. I will address the other three points in turn.

The first portion of the D.C. Circuit opinion focuses on the FCC's definition of an autodialer and how that definition affects consumers. The court held that the FCC's approach to defining what qualifies as an autodialer, based in part on prior FCC guidance from 2003 and 2008, is "utterly unreasonable" and fails the Administrative Procedure Act's (APA) arbitrary and capricious standard of review. Citing a 2015 D.C. Circuit decision, the court explained that under the APA, administrative action is arbitrary and capricious if it does not clearly articulate a comprehensible standard for assessing the applicability of a statutory category. Therefore, if a standard offers no meaningful guidance, it fails to constitute reasoned decision-making and consequently fails the APA's arbitrary and capricious review. In its analysis, the court wrestled with various examples of what it means to have the "capacity" to dial numbers randomly and sequentially, as required by the FCC's 2015 Order to meet the standard of autodialer, including whether a smartphone, the Firefox browser, or even a rotary phone can gain such autodialer functionality. The court concluded that the FCC's 2015 Order cannot be understood to exclude smartphones from the autodialer definition and that interpretation of the TCPA is unreasonably and impermissibly expansive.

Another point related to the definition of an autodialer that the court noted but did not decide is the FCC's interpretation of the meaning of the phrase "make any call using" an autodialer. The question here is whether this prohibition only applies to calls made using the equipment's autodialer functionality or to all calls made with a device that has that "capacity," even if the calls are made without any use of the equipment's autodialer capabilities. The FCC's 2015 Order, of course, adopted the latter, more broad reading of that phrase, but the court cited Commissioner O'Rielly's dissent to the 2015 Order in which he read that phrase to mean that the equipment must be used as an autodialer to make the calls before a TCPA violation can be found. Commissioner O'Rielly's reading means smartphones would not be swept into the definition of autodialer. The petitioners did not actually challenge the FCC's understanding of this phrase in their brief though, so the court declined to address or resolve the issue.

In the second portion of its opinion, the court held that the FCC's one-call safe harbor for calls made to reassigned numbers is arbitrary and capricious. The court went even further to completely set aside the FCC's treatment of reassigned numbers generally so that callers are not strictly liable for all calls made to a reassigned number. Unfortunately, the court agreed with the FCC's understanding of the term "called party" in the TCPA as the person actually reached (the present-day subscriber of the wireless number after assignment) instead of the petitioner's position that "called party" should refer to the person the caller expected to reach (whose consent has previously been obtained) because it determined that was a permissible and reasonable interpretation. Despite this, the court evaluated the FCC's use of a "reasonable reliance" approach when interpreting the TCPA's approval of calls based on "prior express consent" as justification for the one-call safe harbor for calls made to reassigned numbers. The court agreed that just a single communication may not inform the caller as to whether the number has been reassigned (the FCC even conceded this point!). Thus, the court concluded that the FCC gave no explanation of why this approach supports limiting the safe harbor to just one call or text message: "no cognizable conception of 'reasonable reliance' supports the Commission's blanket, one-call-only allowance."

Finally, on the issue of revocation of consent, the court upheld the FCC's interpretation of the TCPA in its 2015 Order. The court characterized the petitioner's concerns about the uncertainty of the FCC's standard for revocation by "any reasonable means" as overstated. The court explained that this standard actually removes "undue burden" from the caller because there is no requirement to train employees on the finer points of revocation and the caller can simply make use of clearly-defined, user-friendly opt-out methods. Furthermore, the court noted that the 2015 Order does not preclude parties from contracting for revocation procedures.

Whew! That was a lot. Now with a resolution in this lawsuit, NAFCU will continue to advocate for the fairest interpretation of the TCPA so that credit unions have clear guidance as to how it affects the way they communicate with their members about important financial matters.

Catching Up With the ACET

Written by Andrew Morris, Regulatory Affairs Counsel

This year large credit unions will come face-to-face with the latest version of NCUA's Automated Cybersecurity Examination Tool (ACET). For those unfamiliar with the ACET, the tool is nearly identical to the FFIEC's Cybersecurity Assessment Tool (CAT), which we have blogged about in the past. Today's blog will cover significant information we've learned about the 2018 version of the ACET.

As we've previously reported, NCUA's Supervisory Priorities for 2018 revealed the agency's plan to use the ACET this year at what the agency considers to be the largest and most complex credit unions – those with over $1 billion in total assets – and calibrate baseline cybersecurity expectations using results gathered from the tool's inaugural deployment. Accordingly, the information in this blog reflects a version of the ACET that is subject to change. To help credit unions better understand how the ACET works, NAFCU invited Tim Segerson, deputy director at NCUA's Office of Examination and Insurance, to conduct a webcast covering important aspects of the new tool. You can access the webcast for free here.

At this stage, credit unions should be aware of three important takeaways: 1) the ACET is not yet finalized and will continue to change; 2) NCUA plans to formally deploy the tool in 2019; and 3) NCUA is contemplating ACET reviews every two or three years. When the ACET is used, it will replace the Gramm-Leach-Bliley Act/Part 748 Privacy review and the Electronic Banking questionnaire. NCUA does not expect the current iteration of the ACET will prove overwhelming for credit unions using it for the first time.

Examiners will be permitted to conduct the ACET review in advance of an exam, during an exam or after. Of course, examiners are also being advised to engage in lead planning ahead of time to ensure a smooth transition. In addition, NCUA was able to share information about its planned ACET workflow for 2018 on the webcast. This information reflected instructions to examiners and revealed important aspects of the review process:

1. Declarative statements (used to assess cybersecurity maturity) may be answered affirmatively with reference to compensating controls.
2. Credit unions must complete all statements in the baseline maturity level, and may terminate the review above the baseline level based on judgment.
3. Examiners are not required to validate all declarative statements by reviewing every piece of collected information; however, examiner judgment will prevail.
4. When the majority of declarative statements do not satisfy a given maturity level, the examiner will not review above that level.
5. Examiners are advised to limit exam discussions (overview, executive summary, etc.) to the fact that an ACET review was performed, it was reviewed with management and final results were left for further review and consideration.

For smaller credit unions, NCUA has expressed a commitment to streamline the ACET as much as possible; however, the agency has not indicated how it will be used in connection with reviews of small and medium-sized credit unions. What we do know is more testing and refinement of the tool will occur in 2018 to see how the ACET "fits" credit unions that are under $1 billion in total assets. For example, based on feedback received last year when the ACET was still in its pilot stage, NCUA reduced the number of document requests it makes in connection with ACET-based examinations.

Finally, it's worth mentioning that the ACET does a good job of enhancing its source material – the FFIEC's CAT – with more descriptive information. The enhanced guide includes commentary, descriptions of the validation approach for declarative statements, and mapping of individual statements to the FFIEC's IT Booklets and the NIST Framework for Improving Critical Infrastructure Cybersecurity.

Looking forward, NCUA has expressed an intention to develop the tool with a commitment to transparency, collaboration and scalability. The agency will continue to improve the ACET with additional cross-references to major cybersecurity standards while ensuring it is harmonized with other segments of the financial services industry. Meanwhile, credit unions interested in obtaining a current version of the ACET can make a request to [email protected].

 

Government Agencies and Maturity Limits – Where Do GSEs Fall?

Written by Brandy Bruyere, Vice President of Regulatory Compliance

Lately, NAFCU has received questions from credit unions, sometimes stemming from examinations coming out of Region 5, about maturity limits for non-owner occupied homes. We blogged about some maturity limit exceptions a while ago, but unless an exception applies, the maturity limit for loans made by federal credit unions is 15 years. There are 20 year maturities and up to 40 year maturities available for some owner occupied loans, which may be the exceptions utilized most often by federal credit unions.

One exception that keeps coming up lately relates to loans that are "secured" by the "insurance or guarantee of, or with an advance commitment" to be purchased by a Federal or State government or "agency of either," here's the relevant excerpt from section 701.21(e):

(e) Insured, Guaranteed and Advance Commitment Loans. A loan secured, in full or in part, by the insurance or guarantee of, or with an advance commitment to purchase the loan, in full or in part, by the Federal Government, a State government or any agency of either, may be made for the maturity and under the terms and conditions, including rate of interest, specified in the law, regulations or program under which the insurance, guarantee or commitment is provided.

For example, some FCUs make loans under various Small Business Administration programs, which may fall into this exception. But what about government sponsored enterprises (GSEs) like Fannie Mae and Freddie Mac?

While Fannie and Freddie are under the conservatorship of the Federal Housing Finance Agency (FHFA), NCUA has taken the position that GSEs are not "government agencies." Here is an excerpt from legal opinion letter 05-0514:

You have asked if a business purpose loan is exempt from the MBL definition under 12 C.F.R. §723.1(b)(4) if either [Freddie Mac] or [Fannie Mae] has made an advance commitment to purchase the loan in full. No, a business loan with an advance commitment from Freddie Mac or Fannie Mae is not exempt from the MBL definition because neither entity is a government agency.

[…]

Fannie Mae and Freddie Mac are government-sponsored enterprises (GSEs), not federal or state agencies or political subdivisions. “Fannie Mae and Freddie Mac are Congressionally-chartered, publicly-owned corporations whose shares are listed on the New York Stock Exchange. Under terms of their GSE charters, they are exempt from state and local taxation and from registration requirements of the Securities and Exchange Commission. Each firm has a back-up credit line with the U.S. Treasury…Business loans made with an advance commitment to purchase from Fannie Mae and Freddie Mac, which are not otherwise exempt, are subject to Part 723.

While this opinion letter was issued under a prior version of NCUA's rules relating to business lending, the agency took the position that Fannie and Freddie are not "government agencies," which indicates that loans made to GSEs would not be subject to the GSE's guidelines for maturity limits. Rather, unless another exception in NCUA's lending rule applied, it seems the 15 year maturity limit would apply to the loan. While the opinion letter was issued prior to FHFA conservatorship over Fannie Mae and Freddie Mac, even though the relationship between the federal government and these particular GSEs has shifted since the financial crisis, NCUA has not changed its position in more recent years.

What Made Consumers Complain to the FTC in 2017?; ICYMI – Amended 1098 Forms Due Tomorrow

Written by Shari R. Pogach, Regulatory Paralegal

Earlier this month, the Federal Trade Commission (FTC) published the 2017 Consumer Sentinel Network Data Book, a database compilation of the nearly 2.7 million reports it received by the Consumer Sentinel Network from consumers on problems experienced in the marketplace.   Although the number of consumer complaints decreased from 2.98 million in 2016 to 2.68 million in 2017, reported losses to fraud were $905 million in 2017, $63 million more than in 2016.  The top three categories reported were: 1) debt collection at 23 percent; 2) identity theft at 14 percent; and 3) imposter scams at 13 percent.

Credit card and tax fraud were the most common type of identity theft reported.  As to imposter scam complaints, consumers reported losing $328 million.  Nearly one in five people lost money at a $500 median loss.  Examples of imposter scams involved someone pretending to be a government official, a technical support expert, a relative in distress or a well-known business to get the consumers to give up their money. Wire transfer continues to be the most widely used form of payment with 70 percent of consumers reporting the scammers contacted them by phone.

New this year, the FTC's data book provides details on fraud losses by age groups.  Interestingly enough, more people in their twenties than those over age 70 reported losing money to fraud.  Those aged 20-29 reported money fraud losses in 40 percent of reports versus people aged 70 and older in 18 percent of their complaints.  However, when older adults lost money the median dollar amount lost was higher than any other age group.  For example, the median reported loss for people age 80 and older was $1,092 compared to $400 for those aged 20-29.

The median dollar loss from all reported types of fraud in 2017 was $429.  The highest losses were in these fraud categories:  travel, vacations and timeshare plans at $1,710; mortgage foreclosure relief and debt management at $1,200; and business and job opportunities at $1,063.  Military consumers reported losing the most money to imposter scams costing them nearly $26 million.  Identity theft was the largest category reported by military consumers and their median fraud loss of $619 was more than 44 percent higher than the general population.

The FTC data book provides national statistics, a state-by-state listing of the top report categories in each state and a listing of the metropolitan areas that generated the most complaints per individual.  Florida, Georgia and Nevada were the top states reporting fraud in 2017.  Michigan, Florida and California had the most identity theft reports per individual.  The FTC has also developed a mini site to make the information in the data book more accessible for the public, for example there is a webpage provided for each state. 

Take a look at what folks in your area were complaining about in 2017.  The more you know, the better you are able to help them hang on to their hard earned money.

***

ICYMI – Amended 1098 Forms Due Tomorrow. Back in January, we blogged on a few tax items including that a bill was pending that might extend certain income tax deductions that had expired for 2017 such as the private mortgage insurance (PMI) deduction. As we blogged a few weeks ago, on February 22, 2018, the IRS issued guidance clarifying that lenders are required to amend their Form 1098 and send amended forms by March 15, 2018. Specifically, Form 1098 must now reflect PMI paid in 2017:

https://www.irs.gov/forms-pubs/reporting-mortgage-insurance-premiums-mip-treated-as-qualified-residence-interest-through-december-31-2017

The Instructions for Form 1098 and General Instructions provide guidance on amending Form 1098. 

FinCEN's CDD Rule: Are Subaccounts Considered New Accounts?

Written by Stephanie Lyon, Regulatory Compliance Counsel

Credit unions generally permit existing members to have more than one share savings and checking account — these are often referred to as subaccounts. Whether opening a new subaccount is considered to be opening a new account is a question the NAFCU Compliance team has received several times since the Customer Due Diligence (CDD) rule was finalized in 2016. This question is relevant because starting May 11th, 2018, any time a legal entity member opens a new account, the credit union will be required to identify and verify the identity of the beneficial owners. See, Final 31 C.F.R. § 1010.230(b)(1).

Unfortunately, FinCEN's CDD rule did not explicitly discuss subaccounts anywhere in the proposed or final rule. However, there are several pieces of information located throughout the preambles to the proposed and final rule as well as guidance documents that seem to indicate opening a subaccount is likely considered to be a new account that will trigger the beneficial ownership identification and verification requirements. 

Definitions of Account and New Account

The CDD rule defines a "new account" as "each account opened at a [credit union] by a legal entity customer on or after the applicability date." Final 31 C.F.R. § 1010.230(g). The rule also defines "account" by cross referencing section 1020.100(a) which implements the Customer Identification Program (CIP) requirements, among other things. Under CIP, an "account" means "a formal banking relationship established to provide or engage in services, dealings, or other financial transactions including a deposit account, a transaction or asset account, a credit account, or other extension of credit." FinCEN and other regulators provided an interpretation of the definition of account that is helpful to determine whether a subaccount could be a new account.

In the Interagency Interpretative Guidance on Customer Identification Program Requirements, FinCEN made it clear that CIP does not have to be performed when an existing "customer" renews a loan or rolls over a share certificate as long as the credit union has a reasonable belief that it knows the true identity of the member. See, 31 C.F.R. § 103.121(a)(3)(ii)(C) – Person with an existing account, Q1. However, that same guidance stated that "[f]or the purposes of CIP, each time a loan is renewed or a [share certificate] is rolled over, the [credit union] establishes another formal banking relationship and a new account is established."

From the guidance and the definitions of account and new account, it does appear that opening a subaccount will be considered forming a new formal banking relationship and require the identification and verification of beneficial owners. But while this guidance is significant in explaining how FinCEN views an existing account and a new account for CIP purposes, it is not fully indicative of whether a subaccount is considered to be a new account for CDD purposes so we have to turn to the actual rule.

Preamble to Proposed and Final CDD Rule

In the proposed rule, there is a footnote that talks about the types of new accounts the rule would affect. The footnote seems to indicate FinCEN did not want to create a blanket exemption from the requirement to collect beneficial ownership information for subaccounts opened by a legal entity member after the compliance deadline. The discussion of this footnote was further explained in the preamble to the final rule in which FinCEN seems to strike a balance between requiring beneficial owner information for subaccounts opened after the compliance deadline and not retroactively requiring the collection of this information for accounts opened before the compliance deadline. Here is a relevant excerpt:

Several commenters sought clarification as to whether a financial institution must identify and verify a legal entity customer's beneficial owners each time it opens a new account at the institution after the rule's compliance deadline, or whether the requirement applies only the first time it opens a new account at such institution. FinCEN has concluded that, while it is not requiring periodic updating of the beneficial ownership information of all legal entity customers at specified intervals, the opening of a new account is a relatively convenient and otherwise appropriate occasion to obtain current information regarding a customer's beneficial owners…

81 Fed. Reg. 29406. Both the footnote and several other areas of the preamble make it apparent FinCEN expects credit unions to collect beneficial ownership information whenever an existing legal entity member does something that modifies the account relationship or triggers a review of the account. Additionally, as there is no guidance indicating that subaccounts are exempt from the definition of a new account, it seems FinCEN considers these to be "new accounts" if opened after the compliance deadline.

Finally, remember that other aspects of the CDD rule require credit unions to monitor members and update member information. This applies to currently opened accounts and accounts opened after the compliance deadline. I wrote a blog on triggering events that may be helpful when reviewing legal entity members.

What Else is New With Marijuana Banking?; Another Credit Union ADA Victory; Help Us Help You!

Written by Pamela Yu, Special Counsel for Compliance and Research

A couple of weeks ago, I blogged about what's new with marijuana banking.  Among other things, I provided an update on one credit union's ongoing efforts to become the first credit union chartered to support the marijuana industry and with a field of membership focused on cannabis groups.

In response to my post, several credit union industry players reached out to ask how many cannabis-friendly credit unions are currently handling marijuana-related accounts. 

Who's Holding All That Cannabis Money? 

Recent reports indicate that legal marijuana sales reached $9.7 billion across the seven states where recreational marijuana was legal and Canada in 2017. That number does not include California, which is projected to hit $3.7 billion in legal cannabis sales by the end of 2018, and $5.1 billion in 2019. Overall, despite continued federal prohibition here in the U.S., North American legal cannabis sales are expected to hit $24.5 billion by 2021.

Because the substance continues to be illegal under the federal Controlled Substances Act, marijuana businesses have remained challenged in obtaining traditional financial services but information from the Treasury Department indicates that more institutions are taking on these accounts.

According to FinCEN's Marijuana Banking Update, based on Suspicious Activity Report (SAR) filings, around 400 depository institutions were actively banking marijuana businesses in the U.S. as of September 30, 2017.  Less than 100 of those were credit unions, while the rest were banks.  FinCEN's data shows that the agency received a total of 39,025 SARs using key phrases associated with marijuana-related businesses by the end September 2017. 

Source: FinCEN Marijuana Banking Update (September 2017)

While the number of institutions serving marijuana businesses has more than tripled since 2014, federal data shows that only a small percentage of the 5,573 federally-insured credit unions across the country are reporting service to marijuana businesses.  The growing industry will likely continue to be underbanked as long as cannabis continues to be federally illegal.

***

Third ADA Win for Credit Unions

On March 5, in another win for the credit union industry, a federal district court in Virginia granted a credit union's motion to dismiss an Americans with Disabilities Act (ADA) website accessibility suit.  See, Carroll v. ABNB Federal Credit Union, No. 2:17-cv-521 slip. op. (E.D. Va. Mar. 5, 2018).  NAFCU filed an amicus brief in this case; we have filed five briefs so far in support of our member credit unions.

As discussed in the latest issue of NAFCU's Compliance Monitor, for the past year credit unions have faced a growing litigation threat due to unclear website accessibility standards under the ADA.  To date, NAFCU is aware that credit unions in at least 24 states have been impacted by ADA website accessibility claims. 

In the latest case to be thrown out, the court found that "because [the plaintiff] has not shown that he (1) is a member of [the credit union], (2) that he is within [the credit union's] membership field, or (3) that he could become a member of [the credit union]," the plaintiff had not alleged a "sufficiently concrete injury in fact" necessary to show legal standing. See, Carroll v. ABNB Federal Credit Union, No. 2:17-cv-521 slip. op. at 8 (E.D. Va. Mar. 5, 2018). 

The court's reasoning regarding the plaintiff's standing was consistent with two other recent decisions in virtually identical suits alleging website violations of the ADA by other credit unions. See, Griffin v. Department of Labor Federal Credit Union, 1:17-CV-1419, slip op. (E.D. Va. Feb. 21, 2018); Carroll v. Northwest Federal Credit Union, l:17-cv- 01205, slip op. (E.D. Va. Jan 26, 2018).

In addition, cases against two Texas credit unions (involving the same plaintiff) were dismissed on March 2. NAFCU also filed an amicus brief in support of one of those credit unions.

Please visit NAFCU's ADA webpage to learn more about this issue, and to keep apprised about what NAFCU is doing to fight for credit unions.

***

Monthly Research Survey: Help Us Help You!

NAFCU's Economic and Research Team conducts monthly surveys of NAFCU member credit unions in order to compile meaningful data reports that you can use to benchmark against your geographic and asset level peers. These survey results are also critical to NAFCU's advocacy efforts on your behalf to federal agencies, such as NCUA, CFPB and the Federal Reserve. Your participation helps us help you!

Today is the last day to share your voice on the topic of Financial Literacy & Community Outreach. We rely on your survey responses for our industry analysis and legislative advocacy efforts on behalf of all credit unions.

NAFCU members can participate in this month's Economic and CU Monitor survey with one of the options below:

• Online survey
• PDF file (please return by email to [email protected])

Deadline for Economic & CU Monitor survey: March 9, 2018

 

Navigating the Regulation Z Maze: Notice Requirements for Terminating Discounted Rates on Credit Cards; 2018 Rural and Underserved Counties List

Written by Jennifer Aguilar, Regulatory Compliance Counsel

Last month, I blogged on the timeframes for running promotions on your credit cards. A question then came up regarding whether credit unions have to provide notice when the promotional rate ends and how to handle situations where a member no longer qualifies for a discounted rate, such as an employee preferential rate or a special rate for autopay. This blog addresses the change in terms notice requirements for promotions and discounts that are agreed to after a credit card account is opened and are not provided for in the original card agreement.

In true regulator fashion, getting the answer to this seemingly simple question is not so easy. Once you have figured out where to start, you'll wander through obscure parts of the rule and commentary only to find yourself in a completely different section of the rule. As it can be quite easy to get lost in the maze of cross-references and confusing language, it's helpful to take it one step at a time. So, I'll guide you slowly through the maze and hopefully you won't get lost along the way.

As a starting point, the issue with credit cards is that section 1026.55 generally prohibits credit unions from increasing the rate on a credit card account unless a particular exception applies. When the promotional or discounted rate is first applied to the account, there is no need to worry about this general prohibition since the rate is actually decreasing. However, the commentary explains that this general prohibition also applies to a promotional or discounted rate. Therefore, once the rate has been discounted, credit unions cannot increase that discounted rate back to the original rate unless an exception applies.

For promotional rates, this is pretty straightforward as section 1026.55(b)(1) provides an exception for temporary rates in effect for at least six months. However, it gets a bit more complicated when a member no longer qualifies for a discounted rate. Section 1026.55(b)(3) allows credit unions to increase the rate if it provides advance notice, but there are a couple of twists to this exception. First, it creates a protected balance. This means that all transactions made during the time the rate discount was in place and those transactions made within 14 days of the advance notice must continue to receive that lower rate until the protected balance is paid off. Second, this exception cannot be used during the first year the account is opened. For example, if a member receives a discounted rate for using autopay and then cancels autopay within the first year, the rule prohibits a credit union from increasing the rate until after the first year ends.

Now that we have worked our way through the first part of the maze, let's keep going. Section 1026.55(b)(3) points you to section 1026.9(c) to determine the applicable timeframe and content requirements for the notice. Section 1026.9(c)(2) generally requires a credit union to provide 45-day advance notice when it changes the APR on an account. However, section 1026.9(c)(2)(v) provides a number of exceptions to the general 45-day advance notice requirement. The commentary to this section explains that if the rate is temporarily discounted, a change in terms notice is not required when the rate increases back to the original rate as long as the credit union previously disclosed certain terms. The commentary sends you to a different section of the rule to determine the disclosure requirements – section 1026.9(c)(2)(v)(B).

Section 1026.9(c)(2)(v)(B) requires credit unions to disclose the following: when the reduced APR will apply and the APR that will apply when the reduced APR ceases to apply. If these disclosures are made in advance (e.g. when the credit union offers the discounted rate), advance notice is not required when the member no longer qualifies for the discounted rate. If the disclosures are not made in advance, then the rule requires the credit union to provide notice 45 days before the original rate is imposed. That 45-day advance notice must comply with the content requirements in section 1026.9(c)(2)(iv)(A).

Whew, that was confusing. Congratulations on sticking with me through the end. I know it can be exhausting wandering through the rules and all that commentary. Hopefully, this blog will serve as your shortcut when dealing with these types of discounted rates. That way, you can be just like Groundskeeper Willie and reach the end of the maze in a fraction of the time:

As always, the NAFCU compliance team is here to help you find all your regulatory shortcuts.

* * *

Yesterday, the CFPB released its updated lists of rural and underserved counties - 2018 List of Rural or Underserved Counties and 2018 List of Rural Counties. The CFPB has also updated its Rural or Underserved Areas Tool. Credit unions can use these lists and the tool to determine whether a particular property is located in a rural or underserved area. The lists and tool can be found here.

Second MLA Interpretative Rule – Indirect Lending; SCRA Foreclosure Provision Extended

Written by Brandy Bruyere, Vice President of Regulatory Compliance

On December 14, 2017, the Department of Defense amended the August 2016 MLA interpretative rule and since then, credit unions have sent us many questions relating to auto loans. We blogged about this shortly after the 2016 rule was published, but the new guidance is causing concern relating to indirect auto lending programs. As a starting point, according to the Minneapolis Federal Reserve, indirect lending transactions are often structured one of two ways. Some loans are originated by the dealer and then purchased by a credit union, and for other loans, the dealer forwards the loan application to the credit union who then originates the loan.

Many credit unions are concerned about how the DoD's interpretation of when a vehicle purchase loan may be a covered loan under the MLA impacts their auto lending including indirect loans. As brief background, the MLA excludes loans that are "expressly intended" to finance the purchase of a motor vehicle or personal property. The August 2016 interpretative rule included "question 2" addressing when a personal property purchase loan with a "cash out" component might be a covered loan for MLA purposes. While this was not specific to vehicle loans, this left some credit unions concerned about whether some vehicle purchase loans could be covered by the MLA since these exclusions are written nearly identically. However, it also seemed reasonable to conclude the August 2016 guidance was limited to the exception for personal property purchase loans given how specifically the guidance was written.

The DoD amended the "question 2" guidance so that vehicle purchase loans are MLA covered loans if the loan includes financing for a "credit-related product or service" such as Guaranteed Auto Protection (GAP) insurance or credit insurance premiums. If a vehicle loan is an MLA covered loan, this can be problematic for many auto loans originated through indirect lending programs, particularly where the dealer originates the loan, because the MLA prohibits most lenders from taking a security interest in a motor vehicle:

232.8 Limitations.

Title 10 U.S.C. 987 makes it unlawful for any creditor to extend consumer credit to a covered borrower with respect to which:

[…]

(f) The creditor uses the title of a vehicle as security for the obligation involving the consumer credit, provided however, that for the purposes of this paragraph, the term “creditor” does not include a person that is chartered or licensed under Federal or State law as a bank, savings association, or credit union.

Creditors like federally and state chartered credit unions can take a vehicle title as security for an MLA covered loan, but other lenders cannot. This may make it difficult for some indirect lending programs where the dealer originates the loan to provide services like GAP insurance to MLA covered borrowers. If a dealer originates a loan to a MLA covered borrower that finances a credit related product, it seems that loan would be unsecured. We heard that some states (e.g., LA, NY) have requirements relating to GAP insurance or waiver products, so credit unions may want to check for state laws that may address the issue.

Further complicating things, while the effective date of the second interpretative rule is December 14, 2017, the DoD's position is that that this rule simply states "preexisting interpretations of an existing regulation." This may be because interpretative rules are not subject to the notice and comment period that is required for other types of rulemakings. Without framing amendments to the guidance as a preexisting interpretation, the DoD would have been required to seek public comments on the issue – although that may have prevented some of these consequences that are making it harder to serve MLA covered borrowers.

NAFCU has shared several concerns about this second interpretative rule with the DoD and other regulators as well as on Capitol Hill. In a joint letter with the Defense Credit Union Council, NAFCU also formally asked the DoD to rescind the "question 2" guidance altogether. We will keep credit unions posted of any changes that may result from these efforts. In the meantime, some credit unions have worked with indirect lending partners on how to address situations where a vehicle purchase loan is an MLA covered loan.

For more information, NAFCU members can look forward to the March edition of the  Compliance Monitor coming out later this week, and can access a redline of the MLA interpretative guidance here.

***

ICYMI – SCRA Foreclosure Provision Extended. We had a few credit unions asking about the provision in the Servicemembers Civil Relief Act that prohibits the sale, foreclosure, or seizure of a servicemember's home for a year following his or her return from active duty. The time period will remain one year after return from active duty through January 1, 2020.

***

To Our Readers at State Chartered Credit Unions – Speaking of NAFCU members, did you know state chartered credit unions can join NAFCU? One of our core member benefits is our compliance assistance program, where our members can reach out to our team with federal compliance questions and receive a detailed, thorough, and specific response no later than the same time the following business day. We also have a monthly newsletter, a quarterly BSA newsletter, and have also helped state chartered members with other issues like filing an amicus brief in a recent ADA lawsuit. You can find more information here, and in the meantime check out some of our resources that are available to nonmember credit unions on our website:

• The Americans with Disabilities Act – Potential Risks for Credit Union Websites (March 2017, predating recent changes in the litigation risk landscape)

• The Cannabis Conundrum: Banking the Unbankable
• Exam Fairness Guide

Overdraft Opt-In Notices: What about Checks?

Written by: André B. Cotten, Regulatory Compliance Counsel

Hi, Compliance Friends! It's already March, so we are busy preparing for our semi-annual Regulatory Compliance School. Every year NCUA publishes its annual supervisory priorities. Amongst this year's priorities, the NCUA has identified Overdraft Services as an area of interest. This blog presents an analysis for when opt-in notices are required, especially for checks that have been returned for insufficient funds.

One-time Debit Card and ATMs

Pursuant to section 1005.17(b)(1), Regulation E's opt-in requirement only applies to  ATM and one-time debit card transactions. From a plain-reading of the regulatory text, there is no regulatory requirement for an opt-out with regard to overdrafts for paper checks. However, interagency guidance has indicated that offering an election or opt-out of services is a best practice, both from a safety and soundness perspective and to avoid potential UDAAP issues with regard to overdrafts.

To begin this analysis, we are going to want to look at section 1005.17(b)(1):

(b) Opt-in requirement—

(1) General. Except as provided under paragraph (c) of this section, a financial institution holding a consumer's account shall not assess a fee or charge on a consumer's account for paying an ATM or one-time debit card transaction pursuant to the institution's overdraft service, unless the institution:

(i) Provides the consumer with a notice in writing, or if the consumer agrees, electronically, segregated from all other information, describing the institution's overdraft service;

(ii) Provides a reasonable opportunity for the consumer to affirmatively consent, or opt in, to the service for ATM and one-time debit card transactions;

(iii) Obtains the consumer's affirmative consent, or opt-in, to the institution's payment of ATM or one-time debit card transactions; and

(iv) Provides the consumer with confirmation of the consumer's consent in writing, or if the consumer agrees, electronically, which includes a statement informing the consumer of the right to revoke such consent.

(emphasis added). As the excerpt notes above, the prohibition is specific to a credit union's ability to charge a fee for the overdraft payment, not to the credit union's payment of the overdraft. The commentary to section 1005.17(b) states that a credit union "may pay overdrafts for ATM and one-time debit card transactions even if a consumer has not affirmatively consented or opted in to the institution's overdraft service. If the credit union pays such an overdraft without the member's affirmative consent, however, it may not impose a fee or a charge for doing so." Note, Regulation E does not prohibit the credit union from debiting the member's account for the overdrawn amount.

Checks

From reviewing the quoted text from the commentary above, Regulation E uses the term "overdraft service." Taking this a step further, it seems this requirement applies for any courtesy pay, bounce protection or overdraft program that meets the definition of an "overdraft service" in Regulation E, regardless of how the program is titled by a credit union. Let's review the definition of overdraft service below from section 1005.17(a):

(a) Definition. For purposes of this section, the term “overdraft service” means a service under which a financial institution assesses a fee or charge on a consumer's account held by the institution for paying a transaction (including a check or other item) when the consumer has insufficient or unavailable funds in the account…

(emphasis added). Thus, an opt-in is not required for overdraft service generally, only to assess a fee in connection with one-time debit card and ATM transactions.

However, in NCUA Letter to Credit Unions 2005-03 and the Interagency Guidance on Overdraft Protection Programs, NCUA stated that best practices for overdraft programs include providing election or opt-out services:

"Program Features and Operation

• Provide election or opt-out of service. Obtain affirmative consent of consumers to receive overdraft protection. Alternatively, where overdraft protection is automatically provided, permit consumers to "opt out" of the overdraft program and provide a clear consumer disclosure of this option." NCUA Letter to Credit Unions 2005-03, pp. 19.

In general, additional scrutiny from examiners is mostly rooted in giving members insufficient information and control regarding overdraft services. Consequentially, offering additional information and control can be a key step in compliance risk mitigation. Below is additional generalized language from the guidance:

"Best Practices

Clear disclosures and explanations to consumers of the operation, costs, and limitations of an overdraft protection program and appropriate management oversight of the program are fundamental to enabling responsible use of overdraft protection. Such disclosures and oversight can also minimize potential consumer confusion and complaints, foster good customer relations, and reduce credit, legal, and other potential risks to the institution. Institutions that establish overdraft protection programs should, as applicable, take in to consideration the following best practices, many of which have been recommended or implemented by financial institutions and others, as well as practices that may otherwise be required by applicable law. While the Agencies are concerned about promoted overdraft protection programs, the best practices may also be useful for other methods of covering overdrafts. These best practices currently observed in or recommended by the industry include: […]"

Providing these additional opt-outs can help the credit union avoid allegations of unfair, deceptive or abusive practices. From a reputation risk perspective, it clearly establishes the rules and expectations of account ownership with the credit, thus mitigating possible unrest amongst the membership.

Below are several resources from the NCUA and CFPB to assist credit unions in reviewing their overdraft programs in advance of examination:

• Regulation E's requirements for overdraft services found at 12 C.F.R. § 1005.17, its commentary, and Model Form A-9 illustrating these requirements.
• NCUA guidance:

• NCUA AIRES Exam Questionnaires, Overdraft (Bounce) worksheet;
• Risk Alert 10-RA-12, "Member Notice Requirements for Overdraft Services";
• Letter to Credit Unions 05-CU-03, "Overdraft Protection (Bounce Protection) Programs";
• Interagency Overdraft Services Consumer Compliance Discussion Outlook Live Webinar.

• CFPB's Supervisory Highlightsreports:
  • Summer 2017, section 2.4.4;
  • Winter 2015, section 2.3;

Obtaining A Consensual Security Interest For Credit Cards

Written by Stephanie Lyon, Regulatory Compliance Counsel

Last week, I had the pleasure of going through the CFPB's credit card agreement database to find my creditor's credit card agreement. This research project was not just for fun… I was specifically looking for similarities in the language financial institutions use to obtain a consensual security interest in their members' or customers' deposit accounts. Seeing just how different credit card agreements can be made me wonder what drive some of the disclosure language and format in this area. So let's review the regulatory requirements to obtain a consensual security agreement for credit cards.

To begin, Regulation Z has a general blanket prohibition against offsetting a member's deposit funds to cover the member's delinquent credit card. See, 12 C.F.R. § 1026.12(d)(1). This means that financial institutions cannot automatically take funds from their customer's deposit account if the customer is delinquent on their credit card.

However, the rule has an exception that permits creditors to obtain a consensual security interest. To ensure the consensual security is not a functional equivalent of a right of offset, the regulation requires the following things: (1) member must affirmatively agree to the security interest (i.e., the consensual requirement); (2) creditor must disclose security interest in account-opening disclosures; and (3) creditor must be able to evidence the member is aware and intended to provide the security interest. The regulation also suggests three ways of meeting the last requirement. Basically, the credit union can ensure its members are aware and intend to provide a security interest by doing something substantially similar to one or more of the following:

1. Obtain a separate signature or initials on the agreement indicating that a security interest is being given;
2. Place the security agreement on a separate page, or otherwise separate the security interest provisions from other contract and disclosure provisions; or
3. Make reference to a specific amount of deposited funds or to a specific deposit account number.

12 C.F.R. § 1026, Supp I, 1026.12(d)(2)—1. While the regulation provides examples of how to demonstrate awareness and intent, the appropriateness of the format a credit union chooses will be a question of fact. For example, in reviewing publicly available credit card agreements, it seems that many financial institutions are emphasizing the security lien provision by placing a text box or by highlighting/bolding the security lien provisions. While this is not a manner explicitly stated by Regulation Z, this could be one way to ensure the member is aware and consents to giving the credit union a security lien. As there has been litigation on the sufficiency of these methods, credit unions may want to consult their legal counsel or document providers to ensure the method selected will satisfy the security interest requirements of Regulation Z. For more information on the litigation side of things, see this article published in the 2016 January-February Edition of the NAFCU Journal.  

Another thing to note is that unlike the right of offset, credit unions that properly disclose the security interest as outlined above may have a security interest in after-acquired property. See, 12 C.F.R. § 1026, Supp I, 1026.12(d)(2)—2. Meaning, funds deposited after the credit card account is opened are not excluded from the credit union's security interest and these funds could be used to pay for a delinquent credit card.

Finally, credit unions wishing to obtain a security interest in currently opened credit cards may want to look at section 1026.9(c)(2)(i)(A) which requires a change in terms notice at least 45 days prior to the effective date of a significant change in account terms for credit cards. A “significant change in account terms” means “a change to a term required to be disclosed under [sections] 1026.6(b)(1) and (b)(2), an increase in the required minimum periodic payment, a change to a term required to be disclosed under [section] 1026.6(b)(4), or the acquisition of a security interest.” 12 C.F.R. § 1026.9(c)(2)(ii) (emphasis added).

Mind if I ask a favor, my credit-worthy friend? / New IRS Guidance

Written by Reginald Watson, Regulatory Compliance Counsel

Greetings! A little while ago, Stephanie blogged about the perils of being a non-member and the limited rights of nonmember joint-account owners. But do these rights extend to nonmembers in the case of co-applicants on a loan? In this day and age of hyper-connectivity and transient travel, credit unions can stand to lose some business if potential borrowers were not permitted to solicit help from a slightly more credit-worthy friend with the unfortunate reality of falling outside of the credit union's field of membership. This blogpost will address the permissible roles nonmembers can play in the loan application process. 

The Federal Credit Union Act provides credit unions with the power to make loans to its members, to other credit unions, and to other credit union organizations. Similarly, the FCU Bylaws require that federal credit unions may only extend loans to members. In response to questions about where exactly nonmembers fit in, the NCUA states in Legal Opinion Letter 2000-0605 that "nonmembers may participate in loans as long as their involvement does not distort the direct lending relationship between the FCU and the member." The NCUA General Counsel has also previously discussed similar issues in legal opinion letters 95-0616 and 94-0424, presenting a laundry list of synonymous sounding terms (such as joint-applicant, co-borrower, co-maker, co-signer, endorser, guarantor, etc.) that can become a bit head-scratching to navigate. The NCUA Examiner's Guide may help sort things out:

"The terms co-maker, co-borrower, co-signer, guarantor, and joint applicant sometimes create a degree of confusion. In general, these terms refer to one of two possible parties, either a co-maker or a co-signer.

A co-maker shares equal responsibility with the borrower for payment of the loan and receives an equal benefit in the loan proceeds, or access to future advances in an open-end loan. Regulation B (202.7(d)(1)) identifies a co-maker as a joint applicant and the resulting loan as joint credit.

A co-signer takes on liability for the obligation of another person without receiving goods, services, or money in return or, in an open-end credit obligation, without receiving the contractual right to obtain extensions of credit under the obligation. Credit unions request a cosigner’s signature as a condition for granting a member credit or as a condition for forbearance on collection of a member’s obligation in default.

(…)

The co-maker shares in the loan proceeds and bears joint liability for repayment. Thus, a credit union cannot make a loan to a nonmember co-maker. However, a credit union may permit a nonmember to sign a loan, provided the nonmember does so in the capacity of a guarantor (cosigner), rather than a loan recipient (co-maker.)"

NCUA Examiner's Guide, Chp. 10 at page 39.

So there you have it. It appears that co-makers are required to be members, whereas nonmember friends can be co-signers. After all, that's what friends are for!

***

IRS Issues Guidance on Mortgage Insurance Premiums and Home Equity Loan Deductions

Despite fears to the contrary, the deductions for interest paid on home equity loans and for private mortgage insurance were mostly preserved in the recent Tax Cuts and Jobs Act (TCJA) and corresponding tax extenders bill. The IRS issued new guidance earlier this week on the deduction for home equity loans as well as the deduction for mortgage insurance premiums. The Instructions for Form 1098 and General Instructions provide guidance on amending Form 1098. For additional information, we recently blogged about some of the major components of TCJA that affect credit union operations. Until next time compliance friends!

What's New With Marijuana Banking?

Written by Pamela Yu, Special Counsel for Compliance and Research

The complex legal and political landscape with respect to marijuana banking continues to shift.  At last count, 29 states and the District of Columbia (DC) have legalized medical marijuana.  Nine states and DC have also sanctioned adult-use recreational marijuana, with California becoming the latest and largest state to begin legal sales of recreational marijuana in January.  Massachusetts and Maine will soon follow suit later this year.  However, since marijuana remains federally illegal under the Controlled Substances Act, federal criminal statutes continue to be implicated for credit unions handling marijuana-related funds.

Here's what's new with marijuana banking—

Effect of policy shift remains unclear

 On January 4, the attorney general issued a memorandum to direct federal prosecutors to return to "previously established prosecutorial principles," in marijuana enforcement, thus eliminating the Obama-era directives (See, 2013 and 2014 Cole Memos) that provided some degree of guidance for credit unions in navigating the conflict between federal illegality and state legality of marijuana. 

While it was immediately clear that the policy shift would further complicate matters with respect to marijuana banking, it was—and continues to be—unclear whether the roll-back of marijuana guidance will mean a federal crackdown on marijuana enforcement by federal prosecutors.  Some states have quickly signaled that they will not adjust their enforcement priorities:  Colorado's Attorney General encouraged people "not to freak out," and the state's top prosecutor said his office will not be changing its approach to marijuana enforcement as a result of the policy withdrawal.  On the other hand, other states—like Massachusetts—appeared to signal that legal marijuana sellers in the state may not be "immune from federal prosecution" in light of the shift in federal policy.

BSA guidance stays intact (for now)

Meanwhile, the Financial Crimes Enforcement Network's (FinCEN) 2014 BSA guidance, which clarifies "how financial institutions can provide services to marijuana-related businesses consistent with their BSA obligations," is still in place—at least for the time being.  See, FIN-2014-G001.  Despite the fact that FinCEN's guidance relied on the enforcement posture of the now-rescinded Cole Memos, the Treasury Department has signaled that it may support banking for marijuana-related businesses.

In recent testimony before the House Financial Services Committee, Treasury Secretary Mnuchin acknowledged lawmakers' public safety concerns relative to unbanked pot businesses, saying, "I assure you that we don't want bags of cash," and adding that "We want to make sure that we can collect our necessary taxes and other things" from marijuana businesses.

Earlier, in response to a letter from a bipartisan group of 31 House members that asked FinCEN to retain the marijuana banking guidance, a Treasury official indicated that the department was "reviewing the [marijuana banking] guidance in light of the Attorney General's announcement and [was] consulting with law enforcement" about the BSA guidelines.  And last month, Treasury's deputy secretary testified at a Senate hearing that the FinCEN guidance remains in effect while the administration weighs whether to revoke it.

Fourth Corner continues legal bid to become first cannabis credit union

After a federal appellate court last year ruled in favor of The Fourth Corner Credit Union (Fourth Corner) in its lawsuit against the Federal Reserve Bank of Kansas City (Fed Bank), the beleaguered credit union has finally obtained its master account. Fourth Corner, a state-chartered credit union formed to serve Colorado's legalized marijuana industry and its supporters, was chartered under a quirky legal provision in 2014 and has been fighting to open for business ever since. 

On February 7, the Fed Bank granted Fourth Corner conditional approval of its master account application, but the credit union cannot serve marijuana-related businesses directly until serving those businesses is federally legal.  Instead, the credit union will focus on individuals and ancillary groups that support legalized marijuana, including those who partner with vendors, such as accountants and landlords, as well as security, packaging, technology and consulting companies that service marijuana businesses. The conditional approval is consistent with the 10^th Circuit opinion, which found that the Fed Bank was required to indiscriminately make Federal Reserve services available to "all depository institutions," but also concluded that "servicing marijuana-related businesses is illegal."

While this is good news for the credit union, remember that the conundrum has always been the ability to serve marijuana businesses that are legal under state law but illegal under federal law.  Fourth Corner may finally get the chance to open its doors, but it will not be serving marijuana dispensaries and other pot businesses.  Thus, marijuana-related business in Colorado will remain unbanked, despite the credit union's legal victories. 

Meanwhile, Fourth Corner's lawsuit against NCUA over share insurance is still pending.  Now that the credit union has been granted Fed system access, the only thing it needs to get up and running is share insurance.  Fourth Corner sued NCUA in 2015 after the agency denied its share insurance application but in light of the Fed Bank's approval, Fourth Corner has asked a federal court to help deliver a faster resolution in the dispute.  According to the credit union's February 15 motion to compel, NCUA asked Fourth Corner to voluntarily dismiss the case and reapply for insurance but did not give the credit union any assurances that the agency will timely act on a new application (or approve it) if they reapply. Thus, instead of dropping the suit, Fourth Corner is seeking resolution through mediation. Fourth Corner has asked that the court order mediation to take place within 30 days. The court would stay the proceedings during the dispute resolution process.

Alternative dispute resolution could be a positive step toward resolving the credit union's legal tussle with the agency and, perhaps, obtaining federal share insurance.  However, this morning, NCUA filed a Motion for Judgment on the Pleadings, arguing that the court should dismiss the case "as the controversy that gave rise to [the] lawsuit is now moot." In other words, because Fourth Corner has now made a "massive change" to its business plan and field of membership and resolved its dispute with the Fed Bank, the circumstances and key facts underlying the credit union's complaint have materially changed.  Thus, the agency asserts there is no longer a "live controversy" before the court.   In short, NCUA wants the case thrown out and Fourth Corner to file a new insurance application. 

It is now up to the court to decide whether to grant Fourth Corner's request to compel mediation or to dismiss the case based on NCUA's new motion. The outcome of Fourth Corner's legal dispute with NCUA will determine if we are likely to see our first cannabis-friendly credit union operating soon.

NCUA Determines NYS Lease Security Accounts Qualify For Pass-Through Share Insurance

Written by Stephanie Lyon, Regulatory Compliance Counsel

The first NCUA Legal Opinion Letter of 2018 answers the question whether New York State Lease Security Accounts (NYS Lease Accounts) qualify as "other similar escrow accounts" for the purpose of receiving pass-through share insurance. The background for this legal opinion dates back to 2015 when NCUA amended its share insurance regulation implementing the Credit Union Share Insurance Fund Parity Act, making it possible for credit unions to offer IOLTA and other similar escrow accounts by making these types of accounts eligible for share insurance coverage. Prior to this rule amendment, credit unions were not able to offer these types of fiduciary accounts as credit unions can only offer membership shares that are eligible for insurance coverage. See, 12 C.F.R. § 741.9.

Currently, the share insurance rule defines "other similar escrow account" as "an account where a licensed professional or other individual serving in a fiduciary capacity holds funds for the benefit of a client or principal as part of a transaction or business relationship. Examples of such accounts include, but are not limited to, real estate escrow accounts and prepaid funeral accounts." 12 C.F.R. § 745.14(c)(1)(ii). Because of the relatively large scope of the definition of "other similar escrow accounts", many credit unions have been asking whether certain accounts, such as the NYS Lease Account that allows a landlord to deposit a tenant’s security deposit on rental property, are similar enough to qualify for pass-through share insurance coverage.

Factors For "Other Similar Escrow Accounts"

Just recently, NCUA decided to weigh in on this debate with Legal Opinion Letter 17-0424 to give an example of another "similar escrow account" that would qualify for share insurance coverage. Note that this legal opinion letter is not determinative for other accounts even if they are similar as the letter takes into account specific state laws and factual representations made by the credit union that submitted the question. Nonetheless the letter is helpful to better understand the concept of “other similar escrow accounts” and identify the factors that make an account eligible for pass-through share insurance coverage.

Among the items to consider when determining if an account qualifies as a similar escrow account are: (1) membership eligibility; (2) existence of fiduciary relationship; and (3) funds are held for the benefit of a client or principal as part of a transaction or business relationship. Item 1 is easy to determine as the only factor that matters is whether the attorney administering the IOLTA or the agent/individual administering the other similar escrow account is a member of the federally insured credit union in which the funds are held. This is different from other account types such as irrevocable trusts in which the ability of the credit union to open the account relies on the membership of the settlor or the beneficiary of the funds instead of the membership status of the trustee. Items 2 and 3 are slightly more complicated as they may require the credit union review its state law as this may impact whether a fiduciary relationship exists and whether the funds are held as part of a business transaction.

The legal opinion letter in question reviewed the three items above and determined that the landlord was subject to membership with the credit union. The letter also discusses that under NYS law a landlord holds the security deposit in trust for a tenant, the actual owner of the funds, in a fiduciary capacity as part of their real estate related business relationship. Hence, NYS Lease Accounts are considered to be "similar escrow accounts".

Keep In Mind…

NCUA did note that even if the NYS Lease Account qualifies as a similar escrow account, there are other requirements under the rule that must be met to ensure the funds are insured. For example, the rule has recordkeeping requirements and dictates the manner in which an IOLTA or other similar escrow account must be titled. See, 12 C.F.R. § 745.14(a)(2).

For those reasons, credit unions considering offering these types of fiduciary accounts may want to review their state law and closely follow the requirements of Part 745 to ensure members are aware of the requirements to retain adequate documentation evidencing the fiduciary relationship between the attorney/agent administering the account and the clients/principals.

Finally, for research purposes, this letter is currently housed in NCUA's webpage under Legal Opinion Letters from 2017, even though it was released February 1^st, 2018.

Curbing the CFPB Watchdog

Written by Shari R. Pogach, Regulatory Paralegal

The Consumer Financial Protection Bureau (CFPB) has gone through some significant changes since the resignation of former Director Richard Cordray last November.  Moving from continuously issuing regulations and enforcement actions, under its current leadership, the bureau appears to be heading to a kinder and gentler mode.  Acting Director Mick Mulvaney has made it clear in both a memo to CFPB staff and the bureau's recently released five-year strategic plan that going forward, the CFPB will go no further than furthering its statutory responsibilities outlined under Dodd-Frank.  According to its mission, the bureau will "regulate the offering and provision of consumer financial products or services under the Federal consumer financial laws" and "educate and empower consumers to make better informed financial decisions."

The CFPB has three goals under the current strategic plan:

1. Ensure that all consumers have access to markets for consumer financial products and services.
2. Implement and enforce the law consistently to ensure that markets for consumer financial products and services are fair, transparent, and competitive.
3. Foster operational excellence through efficient and effective processes, governance and security of resources and information.

The plan outlines the objectives and strategies to enable the bureau to achieve these goals.  One significant objective is to "regularly identify and address outdated, unnecessary, or unduly burdensome regulations in order to reduce unwarranted regulatory burdens."  This will be done by getting input and feedback on existing regulations, looking at alternative approaches and alternatives to regulation.  Rules and regulations will be assessed and reviewed to evaluate their effectiveness and for opportunities to clarify, modernize and streamline when feasible. 

In addition to the new direction set by Acting Director Mulvaney, President Donald Trump’s budget proposal called for cutting the CFPB's funding and limiting its enforcement powers.  Since its inception, the bureau has been criticized as having too much power with too little oversight from Congress. Under this strategic plan, Acting Director Mulvaney seeks to rein in the bureau's "unparalleled powers."

***

Programming Note.  NAFCU will close at noon today and be closed on Monday for President's Day weekend. We will be back to blogging on Wednesday. Enjoy your weekend!

SALE! BOGO! DOORBUSTER!: Running Promotions on Your Credit Cards

Written by Jennifer Aguilar, Regulatory Compliance Counsel

In my opinion, the first Sunday after the Super Bowl is the most depressing day of the year. After months of having every Sunday filled with excitement and record-breaking moments, you suddenly have a day with nothing to do. And that's just depressing. So, I filled my day with a trip to the mall. Pause – I'll give you all a moment to recover from the shock that there's still someone out there who doesn't shop online. . . I always prefer the mall because most of the stores are so desperate to get people in the door that they give you really great discounts that you often can't get online. They all have these colorful signs in the windows advertising discounts on your entire purchase or free gifts with your purchase.

Like any other business, credit unions also use these kinds of flashy offers to attract customers. However, unlike the stores at the mall, credit unions have to comply with a number of different requirements for their offers. From advertising to account opening and beyond, the rules are complex and can be hard to follow. Today's post will focus on the rules for how long credit unions must honor a promotional rate on a credit card. The rules below apply for both new accounts and promotions on existing accounts.

Generally speaking, the credit card rules in Regulation Z prohibit credit unions from increasing the rate on a credit card unless a specific exception applies. One of those exceptions – contained in section 1026.55(b)(1) – allows credit unions to increase the rate after the expiration of a promotional period.  The promotional period must be at least six months. Well, that's pretty easy, right? Not so fast. The commentary actually provides two different methods for calculating the promotional period depending on the types of transactions subject to the promotional rate – multiple transactions or one-time transactions.

Multiple Transactions. The first method covers promotional rates that apply to multiple transactions. For example, all purchases made between February and September. Credit unions may limit the types of transactions that qualify for the promotional rate to particular categories – such as all purchases or a balance transfer over $1,000 – or a particular time period – such as all purchase made in December.  If the promotional rate applies to multiple transactions, it does not matter how many transactions the member actually makes – as long as multiple transactions qualify for the promotional rate than the first method applies.

So, what is the calculation method? Well, the promotional period begins on the date the credit union provides the 55(b)(1) disclosures – that is, the disclosures that explain the length of the promotional period and the APR that will apply after the end of the promotional period. However, if the date the account can first be used is later than the date the credit union provided the disclosures, then the promotional period begins on that date instead. The promotional period must end at least six months from that beginning date. Here is an example from the commentary that illustrates how this works:

On November 1, 2017 the card issuer offers the consumer a 0% rate for six months on purchases made during the months of November and December and states that a 17% rate will apply after the promotion. The following purchases are made: November 15 for $500; December 15 for $300; and January 15 for $150. The card issuer may begin charging the 17% rate on the $500 purchase and the $300 purchase starting on May 1, 2018 as this is six months from November 1. However, the issuer may charge the 17% rate on the $150 purchase beginning on January 15 since it was made after the specified time period.

One-time transactions. The second method covers promotional rates that will apply to only one transaction. For example, a balance transfer. Again, credit unions can put limitations on the transaction that will qualify for the promotional rate – such as a purchase over $5,000 or a balance transfer made in January. When the promotional rate applies only to one-time transactions, then the promotional period begins on the date of that transaction. The promotional period must end at least six months from that transaction date. Here are a couple examples from the commentary that illustrate how this works:

Example 1: On June 1, 2017, a card issuer offers a 0% APR for six months on the purchase of an appliance and an 18% rate will apply after that. On September 1, 2017 a $5,000 appliance is purchased.  The card issuer may begin charging the 18% rate on March 1, 2018 as this is six months from September 1.

Example 2: On June 1, 2017, a card issuer offers the consumer a 5% rate for six months on a balance transfer of at least $1,000 and states that a 15% rate will apply after that. On June 15, a $3,000 balance is transferred to the account. On July 15, a $200 purchase is charged to the account. The card issuer may begin charging the 15% rate on the $3,000 transferred balance on December 15 as this is six months from June 15. However, the card issuer may charge the 15% rate on the $200 purchase beginning on July 15 because this purchase did not qualify for the promotional rate.

When dealing with promotional rates, credit unions will need to first determine whether the promotional rate will apply to multiple transactions or only to one particular transaction. Once the credit union has made this determination, it can determine when the promotional period starts. Determining when the promotional period starts is essential for compliance as the period must run for at least six months.

Rumor Has It…Exams Include Website Reviews

Written by Brandy Bruyere, Vice President of Regulatory Compliance

NAFCU has been hearing from members that examiners are conducting website reviews as part of recent examinations. A credit union's website can contain advertising content as well as impact other areas of compliance. Here are some things to consider if conducting a review is on your radar.

Advertising Content

Keep in mind that federal regulations define advertisement quite broadly. For example, under Regulation Z, an ad is "a commercial message in any medium that promotes, directly or indirectly, a credit transaction." NCUA's Truth in Savings rule is similarly broad, as is NCUA's general advertising rule. As a result, much of a credit union's website could include content that federal regulation considers to be an advertisement. Below are several regulatory provisions that may impact a credit union's website due to its advertising content:

• Use of the Official NCUA Sign and Advertising Statement – Section 740.4(a) requires credit unions to display the official sign "on its Internet page, if any, where it accepts deposits or opens accounts." Section 707.5 requires a credit union's website to state "federally insured by NCUA," but this can be accomplished using the official sign. However, if a particular credit union page has information about investment-type products that are not insured, such as those offered through a CUSO, it could be problematic to include this information if it insinuates that uninsured products are insured.
• Accuracy of Advertising – Section 740.2 generally prohibits insured credit unions from any advertisement that is "inaccurate or deceptive in any particular, or which in any way misrepresents its services, contracts, or financial condition." There is no staff commentary and not much guidance as to what might be deceptive or a misrepresentation, but these kinds of considerations often involve judgement calls made from a consumer's perspective.
• Deposit Accounts and the TIS Advertising Rule – If website content promotes share accounts, section 707.8 prohibits such advertisements from being misleading or inaccurate. This includes limits on when an account can be described as "free" and a requirement to state the "annual percentage yield" if the ad states a rate of return (APY may be used after the unabbreviated term is used at least once). Where the APY is stated, additional disclosures are also triggered as applicable including:
  • A statement that the rate may change, if a variable rate account;
  • The period of time the APY will be offered for interest and dividend bearing term share accounts;
  • The minimum balance required to earn the advertised APY;
  • The minimum deposit required to open the account to hear the APY, if greater than the minimum balance;
  • A statement about fees; and
  • If a share term account, disclosures regarding the term of the account, early withdrawal penalties, and specific disclosures for noncompounding term share accounts with a stated maturity of over a year.

There are also specific disclosures triggered if a bonus is stated in an advertisement for an account and requirements if overdraft features are promoted. However, the staff commentary to the rule allows for some flexibility here to provide some disclosures a click away:

"9. Electronic advertising. If an electronic advertisement, such as an advertisement appearing on an internet Web site, displays a triggering term, such as a bonus or annual percentage yield, the advertisement must clearly refer the member to the location where the additional required information begins. For example, an advertisement that includes a bonus or annual percentage yield may be accompanied by a link that directly takes the member to the additional information.” (Emphasis added.) See, 12 C.F.R. Part 707, App. C, comment 707.8(a)-9.

• Regulation Z – Content that promotes a credit product will have Reg Z implications. Section 1026.16 applies to open-end credit products and section 1026.24 applies to closed-end credit products. Both of these rules contain "trigger terms" that, if used, require additional disclosures. Of course, these terms are not the same for open-end versus closed-end credit, or home-secured versus non-home-secured loans. For example, the rate or APR when used for open-end credit products NAFCU has articles for members on open-end credit ads and home secured ads which may help. But like the TIS rule, Reg Z does contain commentary about providing some disclosures a click away in an electronic format, here is an excerpt:

“Paragraph 16(c)(1)

[…]

2. Electronic advertisement. If an electronic advertisement (such as an advertisement appearing on an Internet Web site) contains the table or schedule permitted under §1026.16(c)(1), any statement of terms set forth in §1026.6 appearing anywhere else in the advertisement must clearly direct the consumer to the location where the table or schedule begins. For example, a term triggering additional disclosures may be accompanied by a link that directly takes the consumer to the additional information.” (Emphasis added.) See, 12 C.F.R. Part 1026, Supp. I, comments 1026.16(c)(1)-1 and -2.

For closed-end credit, there are more specific provisions in section 1026.24(e) and its commentary.

• Other Lending Implications - Section 701.31(d) requires the "equal housing lender" logo on real estate related advertising, or "any other method reasonably calculated to satisfy the notice requirement," although there is no guidance as to what this alternative may be. As a result, the logo is generally used. Also if the credit union accepts loan applications online, keep in mind that the same fair lending type considerations would be in play on web based applications as well.

Electronic Funds Transfers and Other Account Considerations – Credit unions that offer EFTs or open accounts online may want to consider that Regulation E requires certain disclosures to be made "at the time a consumer contracts for an electronic fund transfer service or before the first [EFT] is made involving an account." Where accounts are offered or opened online, Regulation CC requirements regarding the credit union's funds availability policy and another possible disclosure requirement.

Weblinking – If the credit union links to third-party websites, keep in mind NCUA's guidance on weblinking, such as "speed bumps":

• NCUA Letter to Credit Unions 02-FCU-04
• NCUA Letter to Credit Unions 03-CU-08

COPPA – Websites can have implications under the Children's Online Privacy Protection Act (COPPA) rules. Making determinations as to the applicability of COPPA generally requires an analysis of the specific facts and circumstances of the credit union's situation against the requirements of the rule. COPPA can apply to any internet services you provide, such as online banking.  The credit union may be accessing information through things like cookies or similar internet devices that often collect nonpublic personal information. The FTC’s rule implementing COPPA is located in 16 CFR 312. If a credit union is “collecting” information from minors under the age of 13 you will need to comply with the COPPA requirements.

Overall, considering the credit union's website content from the perspective of how it would be reviewed if it were in print (e.g., an ad, an application, etc.) can be helpful in reviewing for compliance. Also, while not specific to exams, many credit unions are also considering the Americans with Disabilities Act as well when reviewing their websites.

ICYMI: An Overview of the CFPB's Payday Lending Rule

Written by: André B. Cotten, Regulatory Compliance Counsel

Happy Friday, Compliance Friends! Last fall, one of my colleagues posted a blog about the PAL exemption under the CFPB's Payday Lending Rule. To refresh your memory, the CFPB issued a final rule in early October 2017. This rule is intended to put a stop to what the Bureau coined as,  "payday debt traps", but as written does, impact some credit unions' products. Today's blog will provide a high level overview of what's included in the CFPB's Payday Lending Rule.

Scope of the Rule

Payday loans are typically for small-dollar amounts and are due in full by the borrower's next paycheck, usually two or four weeks. From some providers, they are expensive, with annual percentage rates of over 300 percent or even higher. As a condition on the loan, sometimes the borrower writes a post-dated check for the full balance, including fees, or allows the lender to electronically debit funds from their checking account.

With that being said, the Payday Lending Rule applies to two types of loans. First, it applies to short-term loans that have terms of 45 days or less, including typical 14-day and 30-day payday loans, as well as short-term vehicle title loans that are usually made for 30-day terms, and longer-term balloon-payment loans. The rule also has underwriting requirements for these loans.

Second, certain parts of the rule apply to longer-term loans with terms of more than 45 days that have (a) a cost of credit that exceeds 36 percent per annum; and (b) a form of "leveraged payment mechanism" that gives the credit union a right to withdraw payments from the member's account. The payments part of the rule applies to both categories of loans. Note, at this time, the CFPB is not finalizing the ability-to-repay portions of the rule as to covered longer-term loans other than those with balloon payments.

The rule excludes or exempts several types of member credit, including: (1) loans extended solely to finance the purchase of a car or other member good in which the good secures the loan; (2) home mortgages and other loans secured by real property or a dwelling if recorded or perfected; (3) credit cards; (4) student loans; (5) non-recourse pawn loans; (6) overdraft services and lines of credit; (7) wage advance programs; (8) no-cost advances; (9) alternative loans (i.e. meet the requirements of NCUA's PAL program); and accommodation loans.

Ability-to-Repay Requirements and Alternative Requirements for Covered Short-Term Loans

The CFPB has indicated that it is concerned about payday loans being heavily marketed to financially vulnerable members. Faced with other challenging financial circumstances, these borrowers sometimes end up in a revolving cycle of debt.

Thus, the CFPB included ability to repay requirements in the Payday Lending Rule. The rule will require credit unions to determine that a member will have the ability to repay the loans according to the terms of the covered short-term or longer-term balloon-payment loans.

The first set of requirements addresses the underwriting of these loans. A credit union, before making a covered short-term or longer-term balloon-payment loan, must make a reasonable determination that the member would be able to make the payments on the loan and be able to meet the member's basic living expenses and other major financial obligations without needing to re-borrow over the following 30 days. The rule specifically lists the following requirements:

• Verify the member's net monthly income using a reliable record of income payment;
• Verify the member's monthly debt obligations using a national consumer report;
• Verify the member's monthly housing costs using a national consumer report if possible, or otherwise rely on the member's written statement of monthly housing expenses;
• Forecast a reasonable amount of basic living expenses, other than debt obligations an housing costs; and
• Determine the member's ability to repay the loan based on the credit union's projections of the member's residual income or debt-to-income ratio.

Furthermore, a credit union is prohibited from making a covered short-term loan to a member who has already taken out three covered short-term or longer-term balloon-payment loans within 30 days of each other, for 30 days after the third loan is no longer outstanding.

Second, and in the alternative, credit unions are allowed to make a covered short-term loan without meeting all the specific underwriting criteria set out above, as long as the loan satisfies certain prescribed terms, the member meets specified borrowing history conditions, and the required disclosures are provided to the member. Among other conditions, under this alternative approach, credit unions are allowed to make up to three covered short-term loans in short succession, provided that the first loan has a principal amount no larger than $500, the second loan has a principal amount at least one-third smaller than the principal amount on the first loan, i.e. below $350, and the third loan has a principal amount at least two-thirds smaller than the principal amount on the first loan, i.e. below $167.

In addition, the rule does not permit a credit union to make a covered short-term loan under the alternative requirements if it would result in the member having more than six covered short-term loans during a consecutive 12-month period or being in debt for more than 90 days on covered short-term loans during a consecutive 12-month period. The rule also does not permit credit unions to take vehicle security in connection with loans that are made according to this alternative approach.

Payment Practice Rules

The cycle of taking on new debt to pay back old debt can turn a single, unaffordable loan into a long-term revolving debt cycle. The consequences of this ongoing debt can be severe. For example, a credit union's repeated attempts to debit payments can add significant penalties, as overdue members get hit with insufficient funds fees and may even have their checking account closed.

As a result, the Payday Lending Rule is also intended to prevent credit unions from making multiple attempts to withdraw payment from member's accounts in connection with a short-term, longer-term balloon-payment, or high-cost longer-term loan. The rule prohibits additional attempts after the credit union's second consecutive attempt to withdraw payments from the accounts from which the prior attempts were made have failed due to a lack of sufficient funds, unless the credit union obtains the members' new and specific authorization to make further withdrawals from the accounts.

This prohibition on further withdrawal attempts applies whether the two failed attempts are initiated through a single payment channel or different channels, such as the automated clearinghouse system and the check network. The rule requires that credit unions must provide notice to members when the prohibition has been triggered and follow certain procedures in obtaining new authorizations.

In addition to the requirements related to the prohibition on further payment withdrawal attempts, a credit union is required to provide a written notice, depending on means of delivery, a certain number of days before its first attempt to withdraw payment or before an attempt to withdraw a nonconforming payment. The notice must contain key information about the upcoming payment attempt, and if applicable, alert the member to unusual payment attempts. A credit union is permitted to provide electronic notices as long as the member consents to electronic communications requirements.

Update on the Payday Lending Rule

Recently, the CFPB issued a press release that stated the Bureau intends to engage in a rulemaking process so that the CFPB may reconsider the Payday Rule. The Bureau also indicated that it may waive the April 16, 2018 deadline for preliminary approval to become a registered information system ("RIS") under the Payday Rule. NAFCU will continue to closely monitor the CFPB as its new leadership sets its pace and agenda.

The Final Prepaid Rule: Version 3.0; Refresher on the EU's GDPR

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

Since 1982, no less than seven different cuts of Ridley Scott's science fiction masterpiece Blade Runner have been shown to theater audiences. The initial workprint version didn't test well, so the studio re-cut it, adding a rightfully maligned voice-over and a preposterous "happy ending." Both the director and generations of film snobs-to-come found it insufferable. A version with extended, more violent fight scenes was released for international audiences, and a version with toned down violence and nudity was produced for television broadcast. In the early 90's, positive responses to an unauthorized release of the original workprint prompted the 1992 release of a director's cut version, but Ridley Scott still didn't feel he had sufficient time or control to finish it the way he wanted. In 2007, Scott was able to make the version he wanted -- the "Final Cut" -- which was released with the 25th Anniversary Edition blu-ray. Blade Runner is one of my favorite movies, and it proves that, sometimes to get something right you need a quarter of a century and at least seven iterations.

Which is to say, the CFPB is still working on the Prepaids Rule.

The initial proposed rule was released on December 23, 2014, with following corrections to the proposal being released February 5, 2015. The rule went final for the first time on November 22, 2016, with an effective date of October 1, 2017. Less than 4 months later, on March 15, 2017 the Bureau issued another proposal, recognizing some issues with implementation of the final rule, seeking more time for additional adjustments and suggesting the effective date be delayed six months. That proposal went final on April 25, 2017, with a new effective date of April 1, 2018. However, the Bureau did believe further adjustments were necessary, and on June 29, 2017, another proposal was issued, delaying the implementation date further and proposing changes to the regulation. While it has not yet been published in the Federal Register, the Bureau has released the third Final Rule on prepaids, and the new effective date is April 1, 2019.

With all this rule writing and rewriting, one of the more painful parts of this process has been identifying the regulatory language that would be current on the effective date. On that front, the CFPB has done us a solid: they finally released an unofficial, informal redline of the rule, allowing compliance personnel to read the rules as a whole. The redline is even bookmarked!

The FINAL Final Rule

The most recent final rule makes several changes to the rule, most significant of which is the April 1, 2019 effective date. Other changes include:

• Revising the error resolution and limited liability provisions so that they only apply to prepaid accounts that are registered with the credit union and for which the identity of the account holder has been verified;
• Creating limited exceptions to the credit-related provisions to address situations where a credit card is liked to a digital wallet;
• Expanding situations where an account issuer can run a negative balance, if certain conditions are met;
• Making clarifications and minor adjustments to several provisions in Regulation E, including the definition of a prepaid account, unsolicited issuance of access devices, pre-acquisition disclosure requirements and submission of prepaid account agreements; and
• Technical corrections!

Refresher on the European Union's GDPR

 The NAFCU Compliance Team has seen an uptick in questions about the scope of the European Union's General Data Protection Regulation (GDPR). Apparently some vendors are raising the red flag for their clients. NAFCU recently hosted a webcast (for purchase) on the GDPR which credit unions may find helpful. We also blogged about the GDPR in May of last year, and that might be worth revisiting: Privacy Laws from Across the Pond: Scoping Out the GDPR.

The GDPR's scope is drawn very broadly. It does not require the credit union to have a location in the EU or for the website user to be an EU citizen or resident for the rule to apply. Here is a section from that prior blog post:

"Scope

The Directive applied mostly to organizations that had an establishment or "means of processing" physically located within the EU. The GDPR, however, expands the application of EU privacy law to organizations not located in the EU, but doing certain business in the EU.

For entities that do not have an establishment in the EU, the GDPR applies to any organization that processes the personal data of natural persons in the EU under two circumstances: 1) when offering them goods or services, even if it's not in return for payment, or 2) in monitoring their behavior which takes place within the EU. See, EU Regulation 2016/679, Ch. 1, Art. 3(2)."

The full post contains more detail, including the definitions that are necessary to really understand this scope. However, even if the credit union falls within the scope, there is still a question as to whether and when compliance with the rule may be appropriate for individual credit unions. It is not clear how the European Union would enforce the law against organizations without a presence in the EU. Neither the CFPB nor NCUA have indicated an appetite to examine for it. Credit unions seeking a realistic assessment of the risk that GDPR noncompliance would pose to the credit union should speak with an attorney experienced in international law. A proper assessment of this risk should help the credit union assess whether GDPR compliance is appropriate and necessary at this time.

Home is Where You Make It: RV Loan Disclosure Rules; New HMDA Tool

Written By: Reginald Watson, Regulatory Compliance Counsel

Happy Monday! The perils of winter often lead my mind to drift back to last summer when I spent time exploring some of the beautiful American landscape with my brother and his bandmates aboard a funky-looking RV. Being more settled into my role as a compliance practitioner, I sometimes find myself wondering about the nuances in the rules and how the financing disclosures cover similar yet slightly different secured transactions. I recently embarked upon a journey to fully investigate the disclosure rules with regard to recreational vehicles and found that the more I read, the more tripped up I became. Upon returning from this expedition, I've decided to share what I learned with you, my compliance friends. This blog will discuss the disclosure rules for recreational vehicles, boats and trailers.

The confusion when it comes to recreational vehicles arises from the fact that their characterization as either personal property versus real property is state specific, with most states taking the personal property approach. This tends to get even hazier when a borrower decides to make the RV their primary dwelling. Thus, it can be difficult to figure out which regulations apply since every situation does not neatly fit into either category, which is something the TILA-RESPA integrated disclosure (TRID) rules don't seem to want anything to do with. It seems the Bureau only intended for TRID to apply to loans secured by land (and cooperatives starting October 2018). The TRID preamble explains that applying the integrated disclosure rules to loans secured by personal property, including "chattel-dwelling" loans, "could reduce the intended consumer benefit of the disclosures because of those loans' unique characteristics. Excluding them from coverage of these integrated disclosures, however, would not excuse them from [TILA/Regulation Z's general] disclosure requirements."

Although an RV would not be considered a dwelling for TRID as well as most RESPA rules, it could be considered a dwelling for other purposes under sections 1026.17 and 1026.18 of Reg Z. These rules apply to all closed-end consumer credit transactions, including those that are secured by personal property that is not a dwelling and those that are secured by personal property that is a dwelling, but is not also real property. These disclosure would include things like the itemization of the amount financed, the finance charge, the annual percentage rate, the interest rate, the payment schedule, the number of payments, and any applicable late and prepayment fees among other requirements. See, 12 C.F.R. §1026.18 and related commentary.

Parts of Regulation Z have specific scope provisions, so there are rules that discuss applicability to a “dwelling” or a “principal dwelling” depending on the rule. Meanwhile, the staff commentary to the definition of "dwelling" clarifies that this can include RVs. Here's an excerpt from the commentary for reference:

1026.2(a)(19) Dwelling

1. Scope. A dwelling need not be the consumer's principal residence to fit the definition, and thus a vacation or second home could be a dwelling. However, for purposes of the definition of residential mortgage transaction and the right to rescind, a dwelling must be the principal residence of the consumer. (See the commentary to §§1026.2(a)(24), 1026.15, and 1026.23.)
2. Use as a residence. Mobile homes, boats, and trailers are dwellings if they are in fact used as residences, just as are condominium and cooperative units. Recreational vehicles, campers, and the like not used as residences are not dwellings. (Emphasis added).

Determining that an RV is used as a residence, or a principal residence, will impact when a loan on an RV or boat would be subject to a particular rule(i.e. the right to rescind only attaches if the dwelling is the borrower's principal residence).As another example, the requirement to provide periodic statements for residential mortgages applies for closed-end loans secured by a dwelling. The higher-priced mortgage loan escrow rule applies to certain loans secured by a first position lien on a principal dwelling. Generally, the regulations permit a consumer to have only one "principal dwelling," which is discussed in further detail in the CFPB’s staff commentary.

What about rules besides Reg Z and RESPA? Looking at both Regulation B's appraisal disclosure rules and HMDA's reporting rules, these have exclusions for recreational vehicles and boats. See, 12 C.F.R. 1002.14(b)(2), and Interp 1 to 12 C.F.R. §1003.2(f)-Comment 3. I hope you enjoy this photo of the RV from last summer's tour, somewhere in West Virginia I presume:

****

HMDA LAR Formatting Tool

CFPB has launched a new formatting tool intended to help credit unions, typically those with small volumes of covered loans and applications, create an electronic file that can be submitted to the HMDA Platform. The 2018 LAR Formatting Tool should be used for data collected in 2018 and reported in 2019. The 2018 LAR Formatting Tool and the updated 2018 Filing Instructions Guide can be accessed from the Bureau's HMDA resources website.

ADA Litigation Update: One Down, More to Go

Written by Pamela Yu, Special Counsel for Compliance and Research

Last Friday, a federal judge in Virginia granted a credit union's motion to dismiss in a lawsuit alleging the credit union's website was not compliant with the Americans with Disabilities Act (ADA).  The ruling represents a big initial victory for credit unions facing growing litigation threats over unclear website accessibility requirements under the ADA.

The Shakedown

Credit unions nationwide have faced a tide of lawsuits and demand letters over the past year relative to the ADA.  Currently, the ADA and the Department of Justice's (DOJ) implementing regulations are silent on website accessibility standards, and the DOJ recently removed an earlier initiative from its rulemaking agenda and withdrew two advanced notices of proposed rulemaking on the subject.  See, 82 Fed. Reg. 60932 (Dec. 26, 2017).  Ambiguities in the law have spawned a new cottage industry for opportunistic plaintiffs' attorneys looking to make a quick dollar off the backs of credit unions and other well-intentioned entities.  Generally the shakedown goes something like this:  lawyers send multiple, identical demand letters alleging ADA website violations to credit unions, banks, and other entities throughout a targeted state on behalf of one unnamed, repeat complainant, then settle for several thousand dollars per case. If the case doesn't settle, the lawyers file suit. 

Some credit unions are making the business decision to settle, but others have decided to fight the charges in federal court. 

Carroll v. Northwest Federal Credit Union

In the first of these cases involving a credit union to be decided by the court, the plaintiff generally alleged that he is a visually-impaired individual who visited the credit union's website but was unable to navigate the website due to accessibility barriers and, as a result, was denied the full use and enjoyment of the facilities and services of the credit union.  However, the plaintiff did not allege he was a member of the credit union or even clearly within the credit union's limited field of membership (multiple-common bond).  See, Carroll v. Northwest Federal Credit Union, No. 1:17-cv-01205, slip. op. at 5 (E.D. Va. Jan. 26, 2018).

NAFCU filed a brief as amicus curiae (i.e., "friend of the court") in support of the defendant credit union's motion to dismiss on the grounds that, among other things, a website is not a place of public accommodation under Title III of the ADA and the plaintiff lacked standing to sue because he was not a member of the credit union.  

A Credit Union Win

The court's January 26th decision granted the credit union's motion to dismiss, ruling that the plaintiff did not have standing to sue the credit union because he was not a member or eligible for membership and would not likely use the credit union's services.  The court therefore determined the plaintiff did not sufficiently establish an injury-in-fact:

"Here, the defendant, Northwest Federal Credit Union ("Northwest FCU"), is a credit union chartered by the Federal government which only includes a specific membership field. . . . Plaintiff is not included in this membership field, nor has he alleged any facts in his Complaint to suggest he is [a member] or otherwise eligible to become a member of Northwest FCU.  As a result, Plaintiff is unable to deposit money in, or obtain a loan or other services from Defendant. 

Plaintiff is unable to show that he has suffered an injury in fact or that there is certain impending future harm.  [Plaintiff] cannot make this showing because he has not established that he is entitled, or would ever be entitled, to utilize any services provided by Northwest FCU." Carroll v. Northwest Federal Credit Union, No. 1:17-cv-01205, slip. op. at 5 (E.D. Va. Jan. 26, 2018).

In addition, the court found that a website is not a place of public accommodation subject to Title III ADA protections:

"Plaintiff's claim also fails because the website is not a place of public accommodation.  Title III of the ADA prohibits discrimination in public accommodations based on disability.  The statute provides for a list of entities that are considered public accommodations.  Notably absent from the list is the term "website".  Not only is "website" not found on the list, but the statute does not list anything that is not a brick and mortar "place".  Over the years Congress has extensively amended the ADA; however, at no point did Congress choose to add websites as a public accommodation."  Id. (citations omitted).

The War Rages On

The decision is a huge first win for credit unions in the battle against these unwarranted ADA legal actions.  But the war is not over.  The lower court's decision is not considered binding under common law principles: “A single district court decision . . . has little precedential effect[, and i]t is not binding on . . . other district judges in the same district.” See, U.S. v. Articles of Drug Consisting of 203 Paper Bags, 818 F.2d 569, 572 (7th Cir. 1987).

Other judges in the same district and in various other federal jurisdictions will likely consider similar credit union ADA cases soon. While the decision in Carroll is persuasive authority—especially as it is the first case to rule on whether credit union membership is necessary to establish standing—the decision is not binding precedent on other courts or federal jurisdictions. 

NAFCU has filed three additional amicus briefs to support credit unions in several similar cases, and on January 5th NAFCU stood with one of those credit unions while the judge heard oral arguments on their motion to dismiss.  We will continue to fight for our members against these unfair suits.  Meanwhile, the plaintiff in Carroll has filed an amended complaint.  Because the court dismissed the case "without prejudice," the plaintiff was free to amend his complaint and refile a new suit.  Notably, however, the plaintiff is still not a member of the credit union.  Stay tuned. 

For more information about ADA website litigation and NAFCU's ongoing efforts to stand up for credit unions on this issue, please visit our dedicated ADA webpage here.

Considering Medical Information under the FCRA; Housing & Alternative Credit Scores Research

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

Good morning, Credit Union Compliance World!

In a short space of time, your NAFCU Regulatory Compliance Team got pinged with a couple different versions of the same question – when can credit unions consider medical information in making credit decisions? It's an area where most credit unions don't have a lot of traffic.

Credit union compliance officers clearly have an instinct is that this is an Equal Credit Opportunity Act (ECOA) issue. This makes sense because it speaks to our sense of fairness, but neither ECOA nor Regulation B address the question. However, it is dealt with fairly directly by the FACTA amendments to the FCRA.

Section 604(g)(2) of the FCRA (codified at 15 U.SC. § 1681b(g)(2)) generally prohibits credit unions from obtaining or using medical information in connection with any determination for credit. This applies to any creditor and "medical information" is defined to include any information relating to physical, mental or behavioral health of an individual.

The medical information does not need to come from a credit report for this prohibition to be implicated. It is important to understand that the prohibition against using medical information applies regardless of how the credit union obtained the medical information. The information could be received from the member directly, or from their friends or family.

Subpart D of Regulation V implements the medical information provisions of the FCRA. Section 1022.30 contains the general prohibition against obtaining or using medical information in credit decisions, unless an exception is met.

While the rule prohibits obtaining medical information, it also addresses that this information is often provided to credit unions completely unsolicited. Section 1022.30(c) states that if unsolicited medical information is shared with the credit union, the credit union has not violated the prohibition. However, to use that information, the credit union would need to meet an exception under the rule.

Section 1022.30 contains several exceptions to this general prohibition which may apply, including a financial exception, an exception for special credit-related assistance programs for those with medical conditions, an exception for forbearance programs triggered by medical conditions or events, an exception for following the member's documented request to accommodate a particular circumstance, and more. Below is more detail on the financial exception.

Financial Exception

The financial exception allows a creditor to obtain and use medical information as long as the information is the "type of information routinely used in making credit edibility determination, such as information relating to debts, expenses, income, benefits, assets, collateral, or the purpose of the loan, including the use of proceeds." The information can only be used in a manner and to an extent that it is no less favorable that comparable non-medical information. To illustrate, the credit union could consider that an applicant owes medical bills related to oncology to the same extent that it would consider similar bills not related to a medical issue. The bills can be considered as a liability affecting their income and assets, but the applicant's implicit need for oncology treatment should not be considered. The credit union cannot consider the applicant's physical, mental or behavioral health, condition or history, type of treatment, or prognosis into account. 12 C.F.R. § 1022.30(d)(1).

So, if an applicant makes a disclosure of medical information during a loan application process or asks for loss mitigation assistance in connection with a medical crisis, the credit union might review section 1022.30 closely to ensure it is in compliance when requesting or considering any medical information in connection with a loan. Another thing to consider is whether state laws in your jurisdiction regarding fair lending or disability protections have prohibitions against considering medical information or the member's medical condition in a credit decision.

Housing & Alternative Credit Scores Research

NAFCU is conducting research to help us in our advocacy efforts on your behalf. We want to hear about your credit union's health, mortgage lending and views on alternative credit scores. If you have a moment, please take the time to complete this survey. The survey will be open through this Friday.

RDC Patent Infringement Letters; Court Issues Motion to Dismiss in ADA Case

Written by Brandy Bruyere, VP of Regulatory Compliance

In recent weeks, NAFCU has heard from multiple credit unions who have received letters from a firm alleging that the credit union's remote deposit capture function infringes on USAA's patents in this area. As widely reported in many news outlets, USAA started developing RDC technology in 2005 and now holds about 50 RDC-related patents. In 2012, USAA was involved in a dispute with another RDC provider, where the parties claimed each side infringed on the other's patents. The case ultimately ended in a settlement in 2014. Then, in 2017, noting that USAA wanted to "work toward recovering the investment" the institution made in RDC technology, USAA began sending letters to financial institutions via a law firm called Epicenter Law. In more recent months, credit unions have also started to receive similar correspondence.

Specifically, the letters "invite" the credit union to pay a licensing fee (unspecified in amount) to patent USAA's rights that are allegedly infringed by the credit union's RDC program. While the letters stress that the attorneys "are not litigation counsel" but rather focus on negotiating "patent licensing deals," the issue is still raising questions from credit unions.

If you receive a letter or have questions on this topic, a good place to reach out is to the credit union's RDC vendor(s). The credit union's agreement with the particular vendors may address indemnification in these kinds of claims. Our understanding is that at least some vendors have taken the position that their technology is not infringing on USAA's patents, and some vendors have even taken the position that they are not aware of any patent infringement by the vendor's technology – but that position may vary from vendor to vendor. NAFCU continues to monitor this issue and will keep members posted of any activity that develops.

ADA Motion to Dismiss. A federal judge in Virginia issued an order granting a credit union's motion to dismiss in a case claiming the credit union's website was not compliant with the ADA. NAFCU filed an amicus brief in this case supporting the credit union's arguments and continues to fight for credit unions on this issue. Credit unions can find more information on ADA website litigation here.

Lawyer Dog. Sometimes I wonder how much English my dog actually understands. I spend a large portion of my evenings policing Lemmy so he will not steal Nolan's food. Last week, I sternly told Lemmy to go to bed because he came pretty close to taking a PB&J from Nolan. Lemmy interpreted my order and went to bed but this is the barest of compliance, in my opinion.

OFAC Blacklists the "Thieves-in-Law" Crime Syndicate; January 2018 BSA Blast

Written by Shari R. Pogach, Regulatory Paralegal

Thieves-in-Law, another organized criminal network to be on the lookout for.  And, no, this is not a joke..................

Late last month, the U.S. Department of the Treasury's (Treasury) Office of Foreign Assets Control (OFAC) announced it was targeting one of Russia's oldest and most notorious organized criminal gangs – "Vory v Zakone" or "Thieves-in-Law" (Thieves).  The announcement indicated the criminal network was being targeted for "its involvement in serious transnational criminal activities" across the globe. Ever heard of them?  I hadn't.

As a group, the Thieves-in-Law originated in the former Soviet Union's Stalinist prison camps and gulags.  This Wikipedia entry provides some history along with the rules of conduct for its members.  Members are required to have served several jail sentences, not allowed to get married and take an oath to uphold the group's code that includes living only off their criminal profits and supporting other Thieves members.

Now, apparently, its members are the heads of a vast underworld network that has spread throughout the former Soviet Union, Europe and the United States to the great financial centers.  As a criminal organization, it has engaged in money laundering, extortion, bribery, robbery, identity theft and trafficking.

Individual Thieves engaging in criminal activity in the United States have been targeted by U.S. law enforcement before, but Treasury's designation of the whole network as a "Transnational Criminal Organization" is the first action to treat them as a single group. As OFAC Director John E. Smith stated, “Treasury is designating the Thieves-in-Law as part of a broader strategy to disrupt the financial infrastructure of transnational criminal organizations that pose a threat to the United States and our allies.”      

The Treasury action also targeted 10 individuals and two entities linked to the Thieves-in-Law organization.  This action generally prohibits U.S. persons from conducting financial or other transactions with these individuals and entities, and freezes any assets they may have under U.S. jurisdiction.

***

BSA Blast.  It's 2018 and the first quarter January issue of the BSA Blast is now available. (NAFCU login required).  The articles in this issue cover: 1) a Texas community bank's civil money penalty lesson on the importance of "Knowing Your Customer"; and 2) Citibank's banking regulator fines it $70 million for not correcting its BSA/AML compliance issues.  The BSA training quiz included in this issue focuses on Currency Transaction Reports (CTRs).

314(b): Beware of Oversharing

Written by Jennifer Aguilar, Regulatory Compliance Counsel

Under section 314(b) of the Patriot Act, credit unions, and other financial institutions, are permitted to share information with one another regarding individuals they suspect may be involved in terrorist or money laundering activities. Those institutions who elect to share information under 314(b) are provided with a safe harbor from liability if they notify FinCEN of their intent to share, verify that the institution with whom it will share information with has also notified FinCEN of its intent to share, use the shared information only for the permissible purposes and have procedures in place to protect the shared information. See, 31 C.F.R. § 1010.540(b).

One question that often comes up for 314(b) sharing is what type of information can be shared under the safe harbor. Of course, any information directly related to possible terrorist and money laundering activities may be shared, but what about other types of suspected criminal activities, such as fraud? Information about these types of activities can be shared under the 314(b) safe harbor, but only in certain circumstances. FinCEN guidance in this area can be a bit confusing so it's helpful to break it down into a few steps to determine when credit unions are permitted to share information about these types of activities:

1. Whether the credit union suspects a specified unlawful activity has occurred;
2. Whether a transaction involving the proceeds from that activity has taken place; and
3. Whether that transaction is part of a terrorist or money laundering scheme.

First, what types of activities are considered "specified unlawful activities" (SUAs)? FinCEN guidance points to the Patriot Act to determine which activities are SUAs. The Act defines a "specified unlawful activity" rather broadly to include financial transactions resulting from the distribution of controlled substances or extortion, fraud, bribery, trafficking and counterfeiting, as well as many other federal criminal offenses. See, 18 U.S.C. § 1956(c)(7). So, the first step in determining whether information can be shared under 314(b)'s safe harbor is to review the activity involved and establish that a SUA has occurred or that the credit union suspects a SUA has occurred.

Second, has a transaction involving the proceeds from a SUA taken place? FinCEN 2009-G002 explains that a credit union may share information if it "suspects that the transaction may involve the proceeds of one or more SUAs." This phrasing is important because it establishes the fact that the credit union must first suspect that a SUA has occurred. Additionally, FinCEN 2012-R006 explains that a credit union may not share information solely to determine whether a SUA has occurred. This means that sharing in order establish a suspicion that a SUA has occurred is not permissible; sharing is only permitted once the credit union has already established that it suspects a specified unlawful activity has occurred.

For example, suppose John Doe is a pusher for Jane Doe's international drug operation. John sells the drugs then deposits the proceeds at ABC credit union. Under FinCEN guidance, ABC may not share information in order to determine whether the proceeds came from drug sales. However, ABC may share information once it suspects that the proceeds are from drug sales.

Finally, is the transaction part of a terrorist or money laundering scheme? FinCEN 2009-G002 explains that the purpose of 314(b) sharing is "to identify and report activities that the financial institution 'suspects may involve possible terrorist financing or money laundering.'" Even if the credit union suspects that a transaction involved the proceeds from an SUA, it may only share information if it also suspects that the SUA relates to terrorist or money laundering activities. In the fraud context, this means that even if the credit union suspects a fraud has occurred and there is a transaction involving the proceeds from that fraud, the credit union may only share information about that fraud if the credit union also suspects the fraud is part of a terrorist or money laundering scheme.

When it comes to sharing information about SUAs, a credit union would need to review all the facts involved and ensure that all three elements have been satisfied: the credit union knows or suspects a SUA has occurred, a transaction involving the proceeds from that SUA has occurred and that transaction is part of terrorist or money laundering activities. It is important that all three of these elements are present in order to stay within the 314(b) safe harbor. Sharing information about fraud may be important to help prevent further harm, but, if the fraud does not relate to terrorist or money laundering activities, a credit union may lose its safe harbor protection by oversharing. This of course does not mean that the credit union cannot do anything – state law may allow the credit union to report the fraud to the local police and, depending on the circumstances, a SAR may be appropriate.

Some Things Never Change: HMDA Commercial Loan Reporting; So, I heard something juicy...a Note from Carrie Hunt

Written By Reginald Watson, Regulatory Compliance Counsel

HMDA has switched from a purpose-based standard to a dwelling-secured rule in terms of scope for loans where the credit union has taken "final action" on or after January 1, 2018; however, there is an exception for business purpose loans that has been tripping up some of our members as they adjust to the new normal. Fear not, some things just don't change. This blog will discuss how to address business loans in this new landscape and the particular issues that arise with loans for mixed-use (residential and commercial) purposes.

Under the old Regulation C, closed-end, business or commercial purpose loans made to purchase, refinance or improve a dwelling were reportable under HMDA. While the CFPB shifts transaction coverage away from the purpose-based scope for consumer loans in new Regulation C, it does not do so for commercial or business purpose loans. Instead, it retains the same purpose-based scope of reportable business or commercial purpose transactions by excluding all other business or commercial loans or lines of credit not made for the three specific purposes of home purchase, refinancing, or home improvement. Thus, a closed-end mortgage loan or an open-end line of credit that is, or will be, made primarily for a business or commercial purpose is excluded from the new definition of a covered loan, unless the loan or line of credit is a home purchase loan, a home improvement loan or a refinancing as defined in the new section 1003.2.

To figure out whether to use the dwelling-based approach versus the purpose-based approach, the credit union in each case may look to whether a closed-end mortgage loan or an open-end line of credit is for a business or commercial purpose. This analysis might be simple in many cases, but gets a little trickier in "mixed-use" situations where a property is used for both residential and commercial purposes, for example, a loan to improve the heating system in a building containing apartment units and retail space.

The new HMDA rule clarifies that a property used for both residential and commercial purposes is a dwelling if the property's primary use is residential. The rule also grants credit unions the discretion to use any reasonable standard to determine the primary use of the property on a case-by-case basis. Here is the commentary for reference:

4. Mixed-use properties. A property used for both residential and commercial purposes, such as a building containing apartment units and retail space, is a dwelling if the property's primary use is residential. An institution may use any reasonable standard to determine the primary use of the property, such as by square footage or by the income generated. An institution may select the standard to apply on a case-by-case basis.

There is some discussion in the preamble to the rule as well but not much on what might be a "reasonable standard." However, the rule contains a similar provision for determining whether a loan is for agricultural purposes, so while not directly on point, that preamble discussion may be somewhat informative.

Sometimes credit unions also ask about loan purpose. That's a bit of a different issue, but the commentary to new section 1003.3(c)(10) indicates that section 1026.3(a) of Regulation Z and its commentary inform whether the loan is for business or commercial purposes.

***

So, I heard something juicy…A note from Carrie Hunt, NAFCU EVP of Government Affairs and General Counsel

At NAFCU we hear a lot of rumors- some true and some just pulp fiction.  Part of what we do is to figure out fact from falsehood.  One of our latest pieces of intel came from the Sunshine State.  We were hearing there was some new law or rule in Florida that was restricting credit union expansions to 5% of a county's population.  So, upon slicing in, we discovered that there is no formal rule/statute limiting a field of membership expansion to 5 percent of a county’s population.  HOWEVER, the Florida Office of Financial Regulation (OFR) may limit expansion on a case-by-case basis.  It seems that their concern is that a credit union with a field of membership of only 5,000, trying to expand to a field of membership of 100,000, would be too extreme of a move. As a result, the Florida OFR sometimes set limits based on the population size depending on how many members the credit union currently serves. 

Hmm.  I would prefer the fruit to ripen on the tree before being picked.

The Circle of Life: Federal Considerations for Member Decedents

Written by: André B. Cotten, Regulatory Compliance Counsel

Hello Compliance Friends! Over the holidays, I had a chance to relax, travel and check out some old and new films. One of my favorite movies will forever be Disney's The Lion King. The death of Mufasa will forever pull at my six-year old heart strings.  Today's blog will talk about what to do when Mufasa Member finds himself in a wildebeest stampede and the circle of life suddenly closes.

As compliance practitioners, I am sure that you are aware a lot of these issues would need to be discussed with your local counsel because they directly involve state law issues. However, I have highlighted some NCUA specific and federal law issues that may serve as helpful reminders. I have segmented this post according to subject areas for your convenience.

Accounts

The FCU Model Bylaws contain the following provision with regard to keeping a deceased member’s account open. You may want to review your credit union’s bylaws for a similar provision.

“(d) The share account of a deceased member (other than one held in joint tenancy with another member) may be continued until the close of the dividend period in which the administration of the deceased's estate is completed.” 12 CFR 701, App. A.

(emphasis added)

The bylaws do not address closing an account and re-opening a new one. On the other hand, an account held in joint tenancy can remain open. If it is determined that the joint tenant is not a member in his/her own right but within the credit union's field of membership, then the person would need to become a member so that the credit union would not impermissibly be offering services to a nonmember.Note, insurance may end six months after death of a member unless the account is restructured

Moreover, after a member dies, the credit union still has the responsibility to protect member funds and information. To begin, under many states' laws, absent a named beneficiary, the funds of the account are a part of the deceased member’s estate. Therefore, a credit union may need to avoid releasing the funds until the qualified representative of the estate has been named by a court or according to the applicable state’s probate laws. 

Account information is considered non-public personal information and therefore cannot be disclosed without providing an opt-out notice, unless the disclosure falls under one of the exceptions. Note, non-public personal information may be disclosed to a person holding a legal or beneficial interest relating to the member, and to persons acting in a fiduciary or representative capacity on behalf of the member.

Lastly, before closing a member account, the credit union may want to proceed with caution. Depending on its respective policy, the credit union may want to flag on the account that the owner has died, and then allow a period of time for any surviving owners or the member's estate to take ownership of the matter. The documents needed to close an account will depend on state law, the account agreement and the credit union's internal policies and procedures.

Tax Issues

To begin, one concern from a federal perspective is that having continued tax reporting of a member's social security number after the person's death can cause tax complications. Although, this may not always be possible if Mufasa Member dies later in the tax year. IRS Publication 559 contains an overview of issues involving deceased persons, and while aimed at executors of estates, has some helpful information about Form 1099.

In addition, the credit union should note that a discharge of indebtedness under a settlement agreement between a credit union and a debtor or a debtor's estate is an "identifiable event" that triggers the obligation to file Form 1099-C.  The instructions for Form 1099-C may be accessed here.

Loans

With regard to credit, the credit union's options would be determined by state law, the loan agreement, and the specific situation. Often, if the decedent was the only borrower, the credit union could be looking at making a claim against the estate.  Even though someone may be making loan payments, unless they are contractually obligated to make those payments, the credit union may want to see if an estate has been established (or if there’s some other claim that should be made, for example, if the member had life and disability insurance under which a claim could be made).  Absent a will, state law will determine the disposition of the decedent’s assets to heirs, including vehicles and real property. Often, heirs have to decide if they want to keep an asset (and likely refinance the loan), or if they want to sell the asset to pay off the credit union’s loan, etc.

In regards to mortgage loans, a lot of mortgages include due-on-sale clauses which allow the lender to call the loan upon the death of the borrower; however, there are situations in which a due-on-sale clause cannot be exercised – for example, if the property is transferred under joint tenancy.

This is the section of NCUA’s rules and regulations that references due-on-sales clauses.  Note the general prohibition on exercising a due-on-sales clause where property is transferred on the death of a joint tenant or tenant in the entirety, or transferred to a spouse or children, as discussed in 12 CFR 701.21(g)(6). Overall, this is a fact specific analysis that the credit union may want to review with local counsel.

Special Issues

There is a rule that Social Security benefits are not paid for the month that Mufasa Member dies. Here is the Social Security Regulation:

Ҥ404.311 When does my entitlement to old-age benefits begin and end?

[…]

(b) We will find your entitlement to old-age benefits ends with the month before the month you die.”

This seems unfair and actually legislation has been introduced in the past on this topic but the way the rule is written, even if a member dies on the last day of a month, the member is not entitled to Social Security benefits for that entire month. Here is an excerpt from a Social Security guide:

“If the deceased was receiving Social Security benefits, you must return the benefit received for the month of death or any later months. For example, if the person dies in July, you must return the benefit paid in August. If benefits were paid by direct deposit, contact the bank or other financial institution. Request that any funds received for the month of death or later be returned to Social Security. If the benefits were paid by check, do not cash any checks received for the month in which the person dies or later. Return the checks to Social Security as soon as possible. However, eligible family members may be able to receive death benefits for the month in which the beneficiary died.”

There is guidance with regards to check reclamations specifically. The Social Security Program Operations Manual has a section on electronic funds transfer reclamations and a section on check reclamations.

The Department of Treasury’s Green Book  also addresses check reclamations more specifically including how to reply to a "Notice of Reclamation" and when there may be a right to protest.

***

As I previously mentioned, when the circle of life closes on a member, there are numerous state law issues that are implicated, and a credit union will need to consult with local counsel to determine how best to draft and modify its policies. However, there are some NCUA and federal law issues that are implicated when a member dies, and credit unions will need to maintain policies that strike a balance between state law, federal regulations, and the business needs of the credit union.

Editor's Note: As helpful insight from a blog reader, I added information about NCUA's 6-month grace period for decedent accounts. I modified this post on Friday, January 19, 2018 to provide a more through legal analysis and to be a more complete resource for NAFCU's members.

Upcoming ACH Rules And Resources

Written By Stephanie Lyon, Regulatory Compliance Counsel

NACHA has been fairly busy these past few years finalizing and updating rules, issuing bulletins and seeking industry comments for new rules to make ACH transactions faster. A couple of ACH rule deadlines are looming, so it is a good time to review these rules, highlight resources and give you a heads up on things you may have missed from last year.

Same Day ACH Phase 3

Most credit unions that originate ACHs are well aware of the Same Day ACH rule that was passed a couple of years ago to expedite the sending and receiving of ACHs. As of today, the deadlines for Phase 1 and Phase 2 are long gone, paving the way for the effective date of March 16, 2018 for Same Day ACH Phase 3. Folks, this is only 58 days away!

Here is a table that details the different requirements of each implementation phase, highlighting Phase 3 requirements:

As noted on the table, the current NACHA requirement under Phase 2 is that credit unions give credit for same day ACHs by the end of the credit union's processing day. You can review Phase II requirements in more detail in this previous blog. Phase 3 establishes a more streamline funds availability timeline that requires Receiving Depositary Financial Institutions (RDFIs) to make same day ACHs credits available for withdrawal by 5:00pm RDFI's local time. While becoming an ACH originator is still optional, credits unions that receive ACHs are all bound by this requirement.

To make the process of complying with Phase 3 easier, NACHA published several resources available in its Resource Center, including its revised Guidance for RDFIs on Meeting Phase 3 Requirements. The guidance is especially helpful in determining the credit union's local time in cases where the RDFI's geographic footprint is not limited to one time zone.

Third-Party Sender Customer Due Diligence

Another ACH compliance deadline that is also around the corner is the registration of Third-Party Sender members by March 1^st, 2018. This requirement became effective in September 2017 to promote consistent customer due diligence among all Originating Financial Institutions (ODFIs). The rule generally requires that all ODFIs register their Third-Party Sender members or, in the alternative, confirm that the ODFI does not have any Third-Party Sender members. See, revised NACHA Op. Rules, Art. II, 2.15.1.

NACHA rules define a Third-Party Sender as "an organization that is not an Originator that authorized an ODFI or a Third-Party Service Provider to transmit, for its account or the account of another Third-Party Sender a credit entry, debit entry, or non-monetary entry to the Receiver’s account at the RDFI." As part of the rule, NACHA expects that credit unions will have effective procedures to determine if a corporate/business member is a Third-Party Sender. If the credit union is unsure whether a member is considered a Third-Party Sender, it may want to use NACHA's Third-Party Sender Identification Tool for assistance with this determination and/or contact their counsel.

The registration process for Third-Party Sender members can be found here. Some of the information required to be disclosed will be:

• The ODFI’s name and contact information;
• the name and principal business location of the Third-Party Sender;
• the ODFI’s routing number used in ACH transactions originated for the Third-Party Sender member; and
• the company identification(s) of the Third-Party Sender. 

Note that if for some reason the credit union later discovers an unregistered Third-Party Sender member, the credit union will have 10 days from the date it discovers the member to register them in the database.

Aside from the initial registration, the NACHA rules will also require supplemental registration for Third-Party Sender members if the credit union receives a request from NACHA for additional information. See, revised NACHA Op. Rules, App. 8, Pt. 8.4. The rule only gives the credit union 10 banking days to respond to supplemental information request so the credit union may want to obtain this information for all Third-Party Sender members ahead of time to avoid having to chase down this information later on.

Among the supplemental information that can be requested by NACHA is:

• Any doing-business-as names, taxpayer identification number(s), and street and website address(es) of the Third-Party Sender;
• the name and contact information for the Third-Party Sender’s contact person;
• names and titles of the Third-Party Sender’s principals;
• the approximate number of Originators for which the Third-Party Sender transmits entries; and
• a statement as to whether the Third-Party Sender transmits debit entries, credit entries or both. 

Additional information on Third-Party Sender registration requirements can be found here and in ACH Operations Bulletin #2-2014: ACH Transactions Involving Third-Party Senders and Other Payments Intermediaries.

Recent ACH Operations Bulletins

Towards the end of the year, NACHA release a couple of Operations Bulletins that may have flown under the radar. The first one is ACH Operations Bulletin #3-2017, released September 2017. Unlike most NACHA Operations Bulletins, this was not made public because it details fraud mitigation strategies for social media schemes. Each NACHA member should have received this bulletin, but if for some reason you cannot find it, you may want to contact NACHA to get a copy.

The second Operations Bulleting was #4-2017, issued November 2017. The bulletin provides risk mitigation strategies for consumer-to-other-consumer (C2C) debits for financial institutions and their service providers. Something to note from this bulletin is that "NACHA strongly discourages ODFIs from facilitating these payments unless the ODFI is certain of its full compliance with all rules that apply to the origination of all ACH debits, regardless of the nature of the Originator." So if your credit union is considering offering C2C debits, this is a good bulletin to keep in mind when establishing internal controls.

Finally, NAFCU recently hosted a webcast on ACH Operating Rules in 2018 that is available on-demand and goes over all these rule changes as well as NACHA rule proposals and available resources.

Tax Reform Questions; Programming Note

Written by Brandy Bruyere, Vice President of Regulatory Compliance

On December 15, 2017, Congress passed the Tax Cuts and Jobs Act (TCJA). NAFCU advocated for credit unions' interests all year while tax reform was high on Congress' agenda, and the credit union tax exemption remained intact, even with the substantial reforms to the tax code. However, the TCJA did make some changes impacting credit unions. NAFCU put together a summary of these changes that may help folks in various areas of your credit union, but here's a few questions the NAFCU compliance team has been receiving from members.

What happened to the home equity interest deduction?

One of the changes in the TCJA that has caused confusion relates to the extent that interest paid on "home equity" loans is deductible. Some news outlets reported rather generally that home equity interest is no longer deductible under the TCJA, but it seems to be more complicated than that. The tax code distinguishes between "acquisition indebtedness" and other "home equity indebtedness." Of note, loans that a borrower takes out to "substantially improve" a property fall into the "acquisition" category, so it seems this home loan interest will remain deductible. However, a loan that accesses home equity for other purposes, such as to finance the purchase of a vehicle, would not be deductible through 2025.

Do we have to pay excise tax on certain compensation?

Another change is that credit unions will be subject to an excise tax on compensation in excess of $1 million. This will apply to an organization's top 5 highest paid employees – although that group can, over time, actually include more than five employees because that "club," so to speak, has permanent membership. If an employee is in the top five paid staff in 2018, but falls out of the top five in 2019, that person is still categorized as "top five" under the code. The rate for this excise tax is the corporate tax rate, which is 21% under the TCJA.

"Compensation" means pay that is reportable in box 1 of an employee's W-2 and for which there is not a "substantial risk of forfeiture" of that income. From talking to credit unions, it seems that some deferred compensation from 457(f) plans vests in one single year, which is where some credit unions may have staff that reach this $1 million threshold. Others have a different vesting dates which can help manage to what extent compensation may exceed that $1 million threshold, since the year the deferred compensation vests is the year it is counted as compensation for purposes of these rules. Also of note, distributions from 457(b) plans and 401(k) plans are excluded from this threshold.

The TCJA also removes an exemption from excise taxes for non-profit institutions relating to certain excess parachute payments to any employee that is "highly compensated" under the IRS definitions for qualified plans, which is a salary of $120,000 or more in 2018. Apparently these payments are those made when an employee leaves the organization, and equal or exceed three times the employee's annual salary.

NAFCU is reaching out to the IRS to discuss the need for guidance and clarification with the implementation of these provisions.

Related Note – Private Mortgage Insurance

The deduction for private mortgage insurance expired on December 31, 2016. Many credit unions are in the process of providing the data needed to produce 1098 forms for members by the end of the month in order to comply with IRS reporting requirements. The TCJA did not extend the PMI deduction, but a bill was introduced in Congress to extend some deductions, including the PMI deduction. If passed, PMI paid in 2017 could become deductible. While NAFCU's Legislative Affairs Team sees support for this bill on Capitol Hill, Congress is tackling some issues that are very politically charged, such as immigration and border security. The bill could pass, but perhaps not in time for credit unions to meet the January 31 deadline for 1098 reporting.

NAFCU called the IRS helpline for 1098 reporting and confirmed that so long as the law does not allow the deduction of PMI, this box should not be completed on the 1098. However, if Congress were to pass a bill making PMI deductible for 2017 at a later date, the IRS may issue guidance on how to proceed but helpline staff stated that one likely outcome is that 1098 reporters may need to file amended 1098 forms to reflect PMI paid in 2017. The IRS will update www.irs.gov/Form1098 as the situation develops.

Programming Note - Martin Luther King Jr. Day

NAFCU's offices will be closing at noon on Friday and all day on Monday in recognition of Martin Luther King Jr. Day on January 15th. We will be back to  blogging on Wednesday, January 17th.

Marijuana Banking Just Got More Complicated

Written by Pamela Yu, Special Counsel for Compliance and Research

Well, we can't say we didn't see this coming...we blogged back in March, 2017 on what the change in administration might mean for marijuana banking, and the federal government announced a change in its policy towards marijuana enforcement late last week.

U.S. Attorney General Jeff Sessions changes DOJ's position on marijuana.

In a move long forecasted by many legal and policy observers, last Thursday the attorney general issued a memorandum to rescind Obama-era guidance on federal enforcement of marijuana. Released just days after California became the latest (and largest) state to begin sales of recreational marijuana, the memo directs "all U.S. Attorneys to use previously established prosecutorial principles," in marijuana enforcement, thus eliminating the already-limited guidance that provided some measure of direction in navigating the conflict between federal illegality and state legality of marijuana. This policy shift will significantly heighten risks for credit unions serving state-authorized marijuana-related businesses or operating in states with legalized cannabis.

Sessions' memo rescinds a 2013 directive, written by then-Deputy Attorney General James M. Cole, which instructed federal prosecutors to focus its marijuana enforcement efforts on eight priorities, including keeping marijuana out of the hands of minors and black market criminals and cartels.  It also rolls back a 2014 Cole memo that directed U.S. Attorneys to apply the same eight enforcement priorities in prosecuting financial crimes based on transactions involving marijuana proceeds.  The so-called Cole memo guidance had cleared up some of the uncertainty about how federal prosecutors would address the conflict of laws as states began allowing sales of marijuana for medical and recreational use. 

Today, 29 states and the District of Columbia (DC) permit medical marijuana and, of those, eight states and DC also allow adult-use recreational marijuana. A recent Gallup poll shows that public support for the legalization of marijuana is at an all-time high, with 64 percent of Americans favoring legalization, including for the first time a majority of Republicans (51 percent now support legalizing marijuana).  Nevertheless, marijuana remains a schedule 1 substance under the federal Controlled Substances Act. Thus, a litany of federal criminal statutes may be implicated for credit unions handling marijuana-related funds.

So what does this mean for credit unions?  In short, providing financial services in states where marijuana is legal under state law just got a lot more complicated. 

Marijuana Banking

At this point, is unclear whether the rescission of the Cole memo guidance will mean a federal crackdown on state-sanctioned marijuana.  The roll-back of formal guidance with respect to marijuana enforcement has created a policy void (note that the memo eliminates prior directives but does not replace them with new guidance) but it is too soon to tell if enforcement will significantly increase.  In effect, the Sessions memo empowers the country's 93 U.S. Attorneys to exercise prosecutorial discretion in their respective jurisdictions. We don't know how prosecutors will use this discretion—some jurisdictions may take a more aggressive enforcement posture while others may not—but the door is now open for federal officials to carry out enforcement against marijuana activities in states that have legalized cannabis.  This creates significant legal uncertainty for credit unions that have been serving marijuana-related businesses under the auspices of the Cole memo guidance. 

There are some existing barriers to marijuana enforcement that remain in place.  For example, the Rohrabacher-Blumenauer (also known as Rohrabacher-Farr) appropriations bill provision that has been in place since December 2014 prohibits the Department of Justice (DOJ) from using federal funds to prevent states "from implementing their own state laws that authorize the use, distribution, possession or cultivation of medical marijuana."  However, the provision must be renewed each fiscal year in order to remain in effect and its protections apply only to medical marijuana, leaving particularly vulnerable those credit unions operating in recreational states.

 BSA Compliance

 In 2014, as a supplement to the Cole memo on marijuana-related financial crimes, the Financial Crimes Enforcement Network (FinCEN) issued guidance to clarify "how financial institutions can provide services to marijuana-related businesses consistent with their BSA obligations." See, FIN-2014-G001.   Despite limited protections, together the Cole memos and FinCEN guidance created a framework for credit unions to serve marijuana-related businesses consistent with their legal and compliance obligations. 

However, as we previously cautioned, FinCEN's guidance depends heavily on the enforcement posture articulated in the Cole memos. Now that those memos have been reversed, credit unions can no longer rely on the FinCEN guidance for serving marijuana-businesses, significantly heightening BSA compliance risks. To add fuel to the fire, some credit unions may now be questioning whether their compliance with FinCEN's 2014 instruction to file either a "Marijuana Limited," a "Marijuana Priority," or a "Marijuana Termination" suspicious activity report (SAR) for each transaction involving marijuana-related funds has created a damning paper trail for federal prosecutors.  FinCEN and the DOJ have yet to offer any assurance that SARs issued under FIN-2014-G001 will not be used to prosecute financial crimes, even against those who relied on the guidance in good faith.  While it is perhaps unlikely that marijuana SARs will be used as evidence for the widespread prosecution of financial institutions, it is not outside the realm of possibility that federal authorities could make an example out of a bank or credit union to send the message that federal marijuana enforcement priorities have changed. Regardless, the increased liability and compliance risk will certainly have a chilling effect on the ability for credit unions to provide services to marijuana-related businesses. It is likely FinCEN will release additional guidance or information soon in light of these changes.

Momentum for Change

On a more optimistic note, Thursday's rescission may create momentum for congressional action on marijuana.  Marijuana banking advocates on the Hill have been challenged in mobilizing change.  The uncertainties created by Sessions' action could actually galvanize support in Congress to find a legislative solution to the conflict between federal and state drug laws. With support for marijuana protections in both parties the attorney general's tougher stance on marijuana could—ironically—become the impetus for a statutory solution for marijuana banking.

Breaking Down the TRID Fix: Rate Lock Revised LEs Are One and Done

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

How's 2018 treating you so far, credit union compliance world?

My year started out right. Last week, I contacted the CFPB through their Regulatory Inquiry website and got a call back same day. That's a response time that the NAFCU Regulatory Compliance Team can appreciate. And the informal answer from the Bureau: you don't have to do any extra work unless you want to. So I'm batting a thousand so far.

The Question: Rate Lock Revisions and the 2013 Preamble

Subsection 1026.19(e)(3)(iv) describes when a revised Loan Estimate can be used to reset tolerances. The subsection contains five paragraphs describing five sets of circumstances where a revised Loan Estimate can be issued and used to reset tolerance for good faith purposes. Four of these circumstances are permissive, meaning that a revised Loan Estimate can, but is not required to be, issued. In other words, if the credit union decides that reissuing the Loan Estimate is not worth the cost, it can chose not to, though it won't be able to reset tolerances due to the event.

One of the circumstances is not voluntary, it's required. That's paragraph 19(e)(3)(iv)(D). If the rate was not locked when the initial Loan Estimate was provided, and the applicant locks in the rate, a revised Loan Estimate is mandatory. The language of this paragraph is quite specific:

"(D) Interest rate dependent charges. The points or lender credits change because the interest rate was not locked when the disclosures required under paragraph (e)(1)(i) of this section were provided. No later than three business days after the date the interest rate is locked, the creditor shall provide a revised version of the disclosures required under paragraph (e)(1)(i) of this section to the consumer with the revised interest rate, the points disclosed pursuant to §1026.37(f)(1), lender credits, and any other interest rate dependent charges and terms.” 12 C.F.R. § 1026.419(e)(3)(iv)(D) (Emphasis added).

Nothing in the regulation or the commentary directly addresses what happens when a rate lock agreement is entered into, the rate is locked, and then the lock expires. The 2013 preamble to original TRID referenced rate lock expiration, but only very briefly:

"Upon a review of the proposed rule text and commentary, the Bureau acknowledges that the  requires redisclosure where a rate lock agreement does not exist. But the Bureau intended that § 1026.19(e)(3)(iv)(D) only applies in situation where a rate lock agreement has been entered into between the creditor and borrower, or where such agreement has expired." 79 Fed. Reg. 79833 (Emphasis added).

But as you can see, paragraph 19(e)(3)(iv)(D) is pretty narrowly drawn. Reading a requirement into that paragraph to redisclose at the time a locked rate expires would be difficult to do.

The Answer: TRID Fix and Informal Guidance from the Bureau

In the TRID Fix amendments, the Bureau sought to clarify that the requirement to issue a revised disclosure under paragraph 19(e)(3)(iv)(D) would not apply repeatedly. In the preamble, the Bureau stated:

"When a revised Loan Estimate is provided as required by § 1026.19(e)(3)(iv)(D), the rate lock information disclosed pursuant to § 1026.37(a)(13)(i) must be updated to reflect the expiration date of the interest rate disclosed, regardless of any changes to the disclosed interest rate or interest rate-related charges. Once the interest rate is subject to a rate lock agreement, § 1026.19(e)(3)(iv)(D) does not subsequently require the disclosure of a revised Loan Estimate." 82 Fed. Reg. 37682 (Emphasis added).

So, no revised Loan Estimate is triggered under paragraph 19(e)(3)(iv)(D) when the rate lock expires. A change in circumstances may exist allowing a revised Loan Estimate to be issued and used to reset tolerances under another paragraph in subsection 1026.19(e)(3)(iv), but that would be at the credit union's option.

However, we still wanted to check on another variable. What if a second rate lock agreement is entered into with the borrower regarding the same application? Would each rate lock agreement create a new obligation to issue a revised Loan Estimate each time the rate was locked?

The Bureau's informal guidance indicated that the answer was no. The Bureau stated that paragraph 19(e)(3)(iv)(D) would apply only once. If the rate is locked again or the rate expires again, the credit union may wish to issue a revised Loan Estimate for the borrower's information and to ensure clarity; or it may wish to issue a revised Loan Estimate under another paragraph in subsection 1026.19(e)(3)(iv) to reset tolerances; but it is not required to do so by the regulation.

Good to know!

 

FinCEN SAR Stats; Sessions Releases Marijuana Memo; Request for BSAAG Nominees

Written by Shari R. Pogach, Regulatory Paralegal

Have you ever wondered what happened to the Financial Crimes Enforcement Network's (FinCEN) Suspicious Activity Report Statistics (SAR Stats)?  Well the data is still available; it's just gone totally interactive.

If you go to FinCEN's website www.fincen.gov, you can find a link for "SAR Statistics."

This link goes to the interactive report generator page:

 


The drop down boxes allow for filtering of the statistical data according to:  industry type; year & month; suspicious activity category/type; states/territories; county/metro & micro area; instrument type(s)/payment mechanism(s); product type; relationship; and regulator.  Each drop down allows for all, one, or multiple filter categories.  Once you have determined your filters, you can then generate a report and export it to a CSV file or to a PDF for further study.

FinCEN's FAQ/Glossary page cautions the statistics are:

"Statistical data for SARs are updated as information is processed and refreshed data is periodically made available for this tool. For this reason, there may be discrepancies between the statistical figures returned from queries performed at different times. In addition, slight differences in query criteria may return different statistical results. Also note that the statistics generated by this tool do not include SAR fields that contain unknown or blank data. To the extent statistics including blank or unknown data are tabulated outside of this tool for other purposes, there may be discrepancies between statistics generated by this tool and those generated through other means. FinCEN makes no claims, promises or guarantees about the accuracy or completeness of the statistical figures provided from this tool and expressly disclaims liability for errors, omissions, or discrepancies in the statistical figures."

Still, the generated reports can indicate trends in your area, state or region of your part of the country and can be a useful additional resource for BSA compliance personnel.  The website indicates the data has been updated as of November 30, 2017.

***

Sessions Releases Marijuana Memo.  Attorney General Jeff Sessions released a memorandum on federal marijuana enforcement policy.  Basically the Department of Justice has rescinded the Obama administration policy of non-interference with marijuana-friendly state laws.  Look for more on this in a blog next week.

***

BSAAG.  FinCEN is asking for nominees for membership on the Bank Secrecy Act Advisory Group (BSSAG).  New members will be selected for three-year membership terms.  If you would like more information or are interested in having NAFCU submit you as a candidate, please email Senior Regulatory Affairs Counsel Michael Emancipator at [email protected] by January 15 as potential nominees must be submitted to FinCEN by January 26, 2018.

New Year, New Priorities: NCUA's 2018 Supervisory Priorities; New HMDA Tools Available

Written by Jennifer Aguilar, Regulatory Compliance Counsel

Welcome to 2018!

I hope everyone had a wonderful and safe holiday season. As we recover from our holiday hangovers, its time to start thinking about all the things we want to accomplish this year. Whether it’s a personal goal like finally taking that vacation you've been planning for the past five years, or a professional one like sharpening your skills by attending Regulatory Compliance Seminar, we all have our priorities for the year. NCUA is no different.

In the last letter to credit unions of 2017, NCUA outlined its examination priorities for 2018. While many of their priorities remain the same as last year, they added a few that are discussed below. As a starting point, here are the ones that haven't changed: internal controls and fraud prevention, interest rate and liquidity risk, commercial lending and the Military Lending Act. The new priorities are addressed below.

Cybersecurity Assessment. While this was an NCUA priority in 2017, NCUA announced that it will be implementing its Automated Cybersecurity Examination Tool (ACET) in 2018. This tool will allow examiners to assess a credit union's cyber preparedness and will be used in examinations for credit unions with more than $1 billion in assets. As the ACET is based off the FFIEC's Cybersecurity Assessment Tool (CAT), NCUA encourages credit unions to continue to use the CAT to self-assess their cybersecurity risks. NAFCU's Cybersecurity Compliance webpage provides a number of useful resources for credit unions, including our editable, self-tallying CAT Workbook (member login required) that was updated last month.

Bank Secrecy Act Compliance. BSA compliance was also a priority in 2017; however, NCUA has changed the focus of its examinations from money service businesses to the new customer due diligence regulations. These new requirements become mandatory May 11, 2018, so examiners will be assessing compliance beginning in the second half of 2018. NCUA recommends credit unions review its BSA webpage for additional information and resources. To assist credit unions with these new rules, NAFCU has blogged on the new rule, triggering events for account review and the technical amendments and has published an article on the new rule (member login required). FinCEN has also published a few FAQs on the new rule. We expect additional FinCEN guidance in the coming months.

Automobile Lending. Examiners will look more closely at those credit unions with higher risk auto lending programs. Higher risk programs are those with maturities over seven years, high loan-to-value ratios, near-prime or subprime loans or indirect lending programs. NCUA recommends credit unions review its supervisory letter on concentration risk for more information. For indirect lending programs, credit unions may also want to review NCUA's report on What to Look out for When Managing an Indirect Lending Program and Letter to Credit Unions 10-CU-05.

HMDA. As part of its 2018 priorities, NCUA announced that it will look for "good faith efforts to comply" with the new HMDA rules. While credit unions subject to HMDA are still required to collect and report data following the new rules, NCUA indicated that examiners will simply review LARs and help credit unions determine their compliance weaknesses in both data collection and reporting. As long as credit unions are making good faith efforts to comply with all the new requirements, examiners will credit those efforts. NCUA also announced that it will not cite violations nor require data resubmissions unless the errors are material. More information on NCUA's 2018 HMDA examinations can be found in last week's blog. Credit unions may find it helpful to review the CFPB's HMDA implementation and Resources for HMDA Filers webpages and NAFCU's HMDA Compliance webpage which includes a number of charts, articles and blogs on the new rules.

Overdrafts. Examiners will review credit unions' compliance with Regulation E's overdraft rules. Section 1005.17 provides a number of requirements for overdraft programs, including requiring members to opt-in before certain fees can be assessed. Model Form A-9 provides a sample opt-in form. While the 2018 priorities refer only to Regulation E, credit unions may also want to review the overdraft rules contained in the Truth in Savings rule. Section 707.4 requires overdraft fees to be disclosed in a credit union's account opening disclosures and section 707.11 requires overdraft fees be disclosed on periodic statements and provides rules for advertising an overdraft program. Credit unions may also find it helpful to review Letter to Credit Unions 05-CU-03 which includes NCUA's Interagency Guidance on Overdraft Protection Programs and NAFCU's blogs on overdraft programs.

* * *

New HMDA Tools Available. Last week, the CFPB announced that its check digit tool and its rate spread calculator are now available. The check digit tool provides the last two digits of the ULI and verifies the check digit is calculated correctly. More information on the check digit can be found in this prior NAFCU blog. The rate spread calculator provides the rate spread for a loan with a final action date of January 1, 2018 or later.

CFPB Issues HMDA Compliance Statement, Will Revisit Rule; Year End Tax Changes

Written by Brandy Bruyere, Vice President of Regulatory Compliance

I hope everyone had a safe and enjoyable holiday. As many credit unions are finalizing implementation of HMDA changes ahead of the January 1, 2018 deadline, some had hoped for a broader delay of HMDA given new leadership at the CFPB. Instead on December 21, just in time for the holidays, the CFPB expanded on its previous (and buried) supervisory guidance. Here is an excerpt from the press release:

The Bureau recognizes the significant systems and operational challenges needed to meet the impending requirements under the rule. Accordingly, for HMDA data collected in 2018 and reported in 2019, the Bureau does not intend to require financial institutions to resubmit data unless data errors are material, or to pay penalties with respect to data errors. Accordingly, collection and submission of the 2018 HMDA data will provide financial institutions an opportunity to focus on identifying any gaps in their implementation of the additional requirements and making improvements in their HMDA compliance management systems for future years. The Bureau expects that any supervisory examinations of 2018 HMDA data will be diagnostic, to help institutions identify compliance weaknesses, and will credit good-faith compliance efforts. (Emphasis added.)

Note that the focus for examining compliance with 2018 data collection will be "diagnostic" for "identifying any gaps" in implementation. Most credit unions are not examined by the CFPB, but NCUA indicated a very similar stance in its 2018 supervisory priorities, also issued on Thursday:

Beginning in the second quarter, examiners will perform limited reviews of quarterly Loan/Application Registers (LAR), when applicable, to evaluate federal credit unions’ good faith efforts to comply with…amendments to Regulation C…The NCUA’s review of 2018 HMDA data will be diagnostic in nature, designed to help credit unions identify compliance weaknesses in collecting 2018 data for submission in 2019, and will credit good faith compliance efforts.

Recognizing the impending January 1, 2018 effective date of the Bureau’s amendments to Regulation C and the significant systems and operational challenges needed to adjust to the revised regulation, for HMDA data collected in 2018 and reported in 2019, the NCUA does not intend to cite violations for data errors found in the quarterly LARs, nor require data resubmission unless data errors are material. Furthermore, the NCUA does not intend to assess penalties with respect to errors in data collected in 2018 and reported in 2019. However, credit unions subject to HMDA reporting must still collect the data, establish a quarterly LAR, and submit 2018 data by the March 1, 2019 deadline.

Collection and submission of the 2018 HMDA data will provide credit unions an opportunity to identify any gaps in their implementation of amended Regulation C and make improvements in their HMDA compliance management systems for future years… (Emphasis added.)

In addition, the CFPB indicated its intent to initiate rulemaking to "reconsider various aspects" of the HMDA rule including the scope of reportable transactions, institutions that must report, and the number of discretionary data points:

"More specifically, the rulemaking may re-examine lending-activity criteria that determine whether institutions are required to report mortgage data. The rulemaking may also look at adjusting the new requirements to report certain types of transactions. Finally, the rulemaking may re-assess the additional information that the rule requires beyond the new data points specified under the Dodd-Frank Act."

We'll keep members posted as this develops and in the meantime, we're here if anyone has any last minute HMDA questions.

***

Tax Bill Impacts Executive Compensation. The recent tax reform bill made certain executive compensation taxable which may impact some credit unions. The year is ending soon though, so credit unions using non-qualified deferred compensation plans may want to reach out to their plan providers before the end of the year to discuss possible changes to make prior to January 1, 2018.

***

Programming Note. In observance of the New Year, NAFCU will be closed on Friday, December 29 and Monday, January 1. We'll be back to blogging next Wednesday, January 3. We wish you all a safe and happy New Year!

***

Sled Ride. We took Nolan on a pre-holiday trip to Ohio, where he got to experience his first sled ride. He had a blast. 

 

"Consumer Compliance Outlook—Fintech, Alternate Data, and Fair Lending Risks"

Written by André B. Cotten, Regulatory  Compliance Counsel

Consumer Compliance Outlook. The Second 2017 Issue of the Philadelphia Federal Reserve's Consumer Compliance Outlook is now available. This issue continued to expound on the rise of financial innovation and provided an overview of key federal regulations for servicemember financial protection.

My colleagues and I have previously written about the growing role of fintech and the data sharing consumer protection principles. Today's blog post will explore potential fair lending risks with the use of big data and the rise of fintech.

The article discussed how fintech has already produced real benefits to consumers, including increased speed, convenience, and new product offerings that make it easier for consumers to manage their financial lives. Fintech also offers the possibility of bringing banking and financial products to underserved communities and the underbanked.

With that being said, many firms are exploring ways to leverage new data and analytic techniques to extend credit to more consumers. The CFPB has noted that approximately 26 million Americans are credit invisible, which means that they do not have a credit record and another 19.4 million do not have sufficient recent credit data to generate a credit score.

The Federal Reserve's Article is intended to offer some general guideposts for evaluating UDAAP and fair lending risks related to fintech, with a focus on alternative data. Note, fair lending and UDAAP are broad areas of the law where sound legal analysis depends on the specific facts and circumstances.

Background

The Equal Credit Opportunity Act (ECOA) and the Fair Housing Act (FHA) are the two key federal fair lending laws. These fair lending laws broadly prohibit two kinds of discrimination: disparate treatment and disparate impact. In some instances, both theories may apply. Disparate treatment occurs when a lender treats a consumer different because of a protected characteristic (i.e. race, color, religion, national origin, sex, marital status, age).

Disparate impact occurs when a lender's policy or practice has a disproportionately negative impact on a prohibited basis, even though the lender may have no intent to discriminate and the practice appears neutral. A policy or practice that has a disparate impact may violate the law, unless the policy or practice meets a legitimate business necessity that cannot reasonably be achieved by a means that has less impact on protected classes.  

Moreover, Section 5 of the Federal Trade Commission Act prohibits unfair or deceptive acts or practice. The Dodd-Frank Act prohibits unfair, deceptive, or abusive acts or practices. Many states also have town on UDAAP laws. Deception in the financial services industry often involves misrepresenting the terms or costs of financial services products.

Questions to Consider When Thinking about Fintech and Alternative Data

The Consumer Compliance Outlook considers that many firms and financial institutions are exploring new data sources and analytical techniques. The Federal Reserve warns financial institutions to conduct a thorough analysis to ensure compliance with consumer protection laws prior to implementing new data and modeling methods. The article provides a series of questions to help financial institutions determine whether they are appropriately using alternative data. The questions are grouped into two broad categories: basis for considering the data; how the data is being used.

What is the Basis for Considering the Data?

Question #1: Is there a nexus to creditworthiness?

Generally, the more speculative the nexus with creditworthiness, the higher the fair lending risk. In addition to accuracy and reliability, it is important to consider whether the data is representative of all consumers or only a subset.

Question #2: Will the predictive relationship be ephemeral or stable over time?

Financial institutions may want to consider whether the predictive potential of the data is likely to be stable over time or ephemeral. For example, if a model uses online data from social media sites, such as Yelp or Facebook, what happens to the reliability of that data as consumers' online habits evolve?

How are You Using the Data?

Question #3: Are you using the data for the purpose which they have been validated?

The Federal Reserve advises that it is important to ask if the data has been validated and tested for the specific uses. For example, if a financial institution validates a data field for marketing, it does not mean this same data is appropriate to use for underwriting or pricing.

Question #4: Do consumers know how you are using the data?

Consumers generally understand how their financial behavior affects their traditional credit scores. However,  alternative credit scoring methods could raise questions of fairness and transparency.

The ECOA and the FCRA require financial institutions who deny credit to provide consumers with adverse action notices specifying the top factors used to make that decision. The FCRA also requires that consumers receive risk-based pricing notices, if they are provided credit on worse terms than others.

With that being said, it is important that fintech firms, and any banks with which they partner, ensure that the information conveyed in adverse action notices and risk-based pricing notices complies with the legal requirements for these notices.

Certain behavioral data may raise particular concerns about fairness and transparency. UDAAP issues could also arise if a firm misrepresents how consumer data will be used.

Question #5: Are you using data about consumers to determine what content they are shown?

Technology can make it easier to use data to target marketing and advertising to consumers most likely to be interested in specific products, but doing so may amplify redlining and steering risks.

The Federal Reserve stated that the core concern is that, rather than increasing access to credit, these sophisticated marketing efforts could exacerbate existing inequities in access to financial services. Thus, these efforts should be carefully reviewed.

Question #5: Which consumers are evaluated with the data?

Are algorithms using nontraditional data applied to all consumers or only those who lack conventional credit histories? Applying alternative algorithms only to those consumers who would otherwise be denied based on traditional criteria could help ensure that the algorithms expand access to credit.

In closing, the Consumer Compliance Outlook states that fintech can bring great benefits to consumers by enhancing speed, convenience and access to credit. However, fintech is not immune to the consumer protection risks that exist in brick-and-mortar financial institutions. The Federal Reserve encourages financial institutions to ensure that fintech trends and products promote a fair and transparent financial marketplace and that the potential fintech benefits are realized and shared by as many consumers as possible.

***

Programming Note. NAFCU's offices will be closed Friday, December 22^nd and Monday, December 25^th in observance of the Christmas holiday. We wish you all a safe and wonderful holiday. We'll be open on Tuesday, December 26th and back to blogging on Wednesday, December 27^th.  Happy Holidays!

Second MLA Interpretive Rule Part II – Security Interests and Timing Edition

Written by: Reginald Watson, Regulatory Compliance Counsel

Greetings regulatory compliance world! The U.S. Department of Defense (the Department) has issued it's second MLA interpretive rule which further develops the first interpretive Q&A guidance by adding clarifying language to three questions and creating an additional question and answer. Last week, Stephanie blogged about the amendments to question 2 in the Simultaneous Loan Edition and this post will discuss the remaining amendments to questions 17 and 18 referring to security interests and statutory rights as well as the newly created question 20 which explains the timing requirements of the optional safe harbor.

Security Interests and the Statutory Lien

In the past, we have blogged about the Military Lending Act Rule (MLA Rule) and some of the problematic language in section 232.8(e) which under some interpretations could have limited the covered borrower's right to grant a security interest to credit unions, or a credit union's right to enforce the statutory lien. Questions 16, 17, and 18 of the first MLA interpretive rule clarified that the prohibition in Section 232.8(e) neither prohibits share secured loans or credit unions from exercising statutory lien rights. Instead, it is intended to prevent creditors from creating remotely created checks or remotely created payment orders in order to collect payments from a covered borrower.

The recent amendments to question 17 and 18 do not change this interpretation, but rather clarify any issues that may arise when the MLA conflicts with other federal or state laws. For each question, the Department simplified the language permitting share secured loans and the statutory lien, and added a note explaining that "the MLA does not preempt any State or Federal law, rule or regulation to the extent that such law, rule or regulation provides greater protection to covered borrowers than the protections provided by the MLA." Thus, although the MLA permits borrowers to convey a security interest for all types of consumer credit, the transaction will still be governed by all other relevant federal or state laws, rules and regulations. Similarly, in situations where the credit union seeks to enforce the statutory lien, the credit union may exercise this right "provided the creditor’s actions are not prohibited by other State or Federal law, rule or regulation."

Optional Safe Harbor

The newly created Question 20 addresses the timing requirements for verifying a consumer's covered status under the optional safe harbor found in 32 C.F.R. §232.5(b). Section 232.5 creates an optional safe harbor which allows a credit union to conclusively determine that a consumer is "covered" by verifying their military affiliation via the Department's database or a consumer report "solely at the time a consumer applies to establish the account or 30 days prior to that time…" Question 20 clarifies how credit unions can qualify for the safe harbor by verifying that the borrower is covered at any time during the 30 days preceding the time at which a consumer either initiates the transaction or applies to establish an account:

        20. To qualify for the optional safe harbor under 32 CFR 232.5(b)(3), must the creditor determine the consumer’s covered borrower status         simultaneously with the consumer’s submission of an application for consumer credit or exactly 30 days prior?

        Answer: No. Section 232.5(b)(3)(i) and (ii) permit the creditor to qualify for the safe harbor when it makes a timely determination         regarding the status of a consumer at the time the consumer either initiates the transaction or submits an application to establish an account,         or anytime during a 30-day period of time prior to such action. Therefore, a creditor qualifies for the safe harbor under § 232.5(b)         when the qualified covered borrower check that the creditor relies on is conducted at the time a consumer initiates a credit         transaction or applies to establish an account, or up to 30 days prior to the action taken by the consumer. Similarly, the timing         provisions in § 232.5(b)(3)(i) and (ii) permit a creditor to qualify for the safe harbor when it conducts a qualified covered borrower check         simultaneously with the initiation of the transaction or submission of an application by the consumer or during the course of the creditor’s         processing of that application for consumer credit.

(emphasis added)

Accordingly, credit unions may verify the military affiliation of a prospective customer at any time starting 30 days before the consumer initiates a transaction or applies for an account.  Furthermore, the interpretive guidance extends this time period throughout the course of the creditor's processing of an application for consumer credit in order to qualify for the optional safe harbor.

NAFCU's Regulatory Compliance Team is continuing to review the guidance to understand its full impact on credit unions and will make necessary updates to our Military Lending Act Compliance Guide in the coming weeks. NAFCU members can download our currently available MLA-related resources here.

Second MLA Interpretative Rule– Simultaneous Loan Edition

Written By Stephanie Lyon, Regulatory Compliance Counsel

After months of anticipation, it is finally here… the second set of the MLA Interpretative Rules has arrived. To better understand how this second attempt at interpreting the rule affects the first, it is important to review the first interpretative rule that was released in August of 2016. The first interpretative rule provided substantial guidance but also left many more questions unanswered as we pointed out in our previous MLA blogs. The second set builds upon the first by amending prior guidance on 3 questions and providing an additional question and answer. This blog will focus on one of the most contentious questions raised by credit unions regarding simultaneous purchase and cash-out loans (aka infamous question #2), but look out for Monday's blog that will discuss the rest of the guidance.

As you may remember, question #2 of the 2016 interpretative guidance focused on an exemption for loans that are "expressly intended" to finance the purchase of personal property. The guidance indicated that the MLA rule applies to "hybrid purchase money loans" for personal property – meaning a loan that provides credit in an amount greater than the purchase price is covered by the MLA. To summarize the guidance, any credit transaction that provides purchase money secured financing of personal property along with additional “cash-out” financing is not eligible for the exception. See,  81 Fed. Reg. 58841.

Because the exceptions for the purchase of personal property and motor vehicles had nearly the same wording, this left many credit unions wondering whether motor vehicle purchase loans that exceed the purchase price of the vehicle could be MLA covered loans. Examples of these kinds of situations could include the financing of negative equity, title, insurance or other add-ons. Guidance published on Thursday provides some clarification, although not all positive.

Negative Equity

Negative equity occurs when a member owes more on their loans than the value of the vehicle. Under the MLA rule, if the credit union makes a vehicle loan secured by that vehicle, the loan would be excluded from the MLA rule. The rule clarifies that in cases when the member has a negative equity vehicle loan and wants to roll over the negative equity into a new vehicle loan secured by the vehicle, the loan would still be excluded from the MLA rule even if the credit union lent the member the money needed to pay off the other vehicle loan. Here is a relevant excerpt from the interpretative guidance:

"[I]f a covered borrower trades in a motor vehicle with negative equity as part of the purchase of another motor vehicle, and the credit transaction to purchase the second vehicle includes financing to repay the credit on the trade-in vehicle, the entire credit transaction is eligible for the exception under § 232.3(f)(2)(ii) because the trade-in of the first motor vehicle is expressly related to the purchase of the second motor vehicle."

For example, let's say a member's car is worth $12,500 but they owe $15,000 on the car loan. The member wants to finance the purchase of a new car worth $20,000 and also wants to pay off the $2,500 negative equity of the current loan. The dealership offers to purchases their existing vehicle for $12,500 and connects them with Helpful Credit Union who qualifies the member for a $22,500 loan to pay off the negative equity and cover the cost of the new car. In this situation, it was not clear whether the additional funds lent to cover negative equity would now make the transaction a covered loan as funds were advanced for more than just the purchase of the new vehicle; now we know that this is an excluded transaction not covered by the MLA.

Add-On Products

Another ambiguity with MLA rule was whether extending credit for a personal or vehicle loan that also financed add-on products (i.e., warranties, upgrades, insurance, etc.) would subject the otherwise exempt loan to MLA protections. The answer to this question gets a bit tricky as it depends on what add-on products the credit union is financing.

The interpretive rule states that "[g]enerally, financing costs related to the object securing the credit will not disqualify the transaction from the exceptions, but financing credit-related costs will disqualify the transaction from the exceptions." See, 82 Fed. Reg. 58740. This means that financing costs related to the vehicle or the personal property does not disqualify the loan from the exception, but financing credit-related products or services does.

The interpretative guidance also provides a couple of examples of add-ons which are and are not considered to be "intended to finance the purchase of a vehicle or personal property secured by the vehicle or property being purchased":

Items that can be financed without losing the MLA exception:

• A credit transaction that finances the purchase of a motor vehicle (and is secured by that vehicle), and also finances optional leather seats within that vehicle and an extended warranty for service of that vehicle is eligible for the exception under section 232.3(f)(2)(ii).
• A credit transaction that finances the purchase of an appliance (and is secured by that appliance), and also finances the delivery and installation of that appliance.

Items that will not qualify for the MLA exception when financed:

• A credit transaction that includes financing for Guaranteed Auto Protection (GAP) insurance or a credit insurance premium.
• Any credit transaction that provides purchase money secured financing of a motor vehicle or personal property along with additional “cash out” financing.

This could make it difficult for some MLA covered borrowers to purchase GAP insurance directly from auto dealers as these fees are likely "credit related ancillary products" that are included in the MAPR calculation. These premiums could quickly lead to an MAPR above 36%.

NAFCU previously blogged on credit related ancillary products and insurance issue here that may help you understand which products are "okay" and which products are not for the purposes of retaining the exception. Don't forget that NAFCU members can download our MLA Compliance Guide and related resources here.

Should We Block That Marijuana Transaction?

Written by Pamela Yu, Special Counsel for Compliance and Research

Earlier this year, I blogged about some of the legal and compliance uncertainties and operational challenges facing credit unions that are providing, or interested in providing, financial services to marijuana-related businesses that are legal under state law but remain illegal under the federal Controlled Substances Act (CSA).  I've also blogged about one credit union's efforts to become the first cannabis credit union and the difficulties in banking these unbankable businesses.

Not much has changed in 2017 with respect to resolving the conflict of laws impacting marijuana banking.  But in April West Virginia became the 29^th state to legalize medical marijuana and the November elections saw gains for legalized marijuana advocates.  In the meantime, the attorney general continues to see marijuana as a "life-wrecking" substance that is "only slightly less awful" than heroin.  In short, the debate over state-sanctioned pot is ongoing and the law in this area is far from settled.

Meanwhile credit unions are increasingly being forced to contend with the cannabis conundrum, whether they have chosen to take on marijuana-business accounts or not. Recently, some of our members have contacted NAFCU's Compliance Team for assistance with how to handle marijuana-related transactions. Namely—should a credit union affirmatively block marijuana-related transactions?

Liability Under Federal Law

 Marijuana remains a schedule I controlled substance under the CSA, which makes it illegal under federal law.  See, 12 U.S.C. §812(b)(1).  Thus, federal criminal statutes may be implicated when handling marijuana-related funds.  For example, it is a federal criminal offense to engage in certain financial and monetary transactions with the proceeds of a “specified unlawful activity,” including marijuana-related funds.  See, 18 U.S.C. §§ 1956 and 1957.  It is also a federal criminal offense to transact funds “derived from” marijuana-related activity by or through a money transmitting business. See, 18 U.S.C. § 1960.  Financial institutions that conduct transactions with funds derived by marijuana-related activity may also be subject to criminal liability for failing to identify or report financial transactions involving marijuana proceeds.  See, 31 U.S.C. §5318(g).  In light of these liability concerns, some credit unions are wondering if they have an obligation or affirmative duty to prevent marijuana-related payments or transactions of funds associated with marijuana-related activity.

Blocking Merchant Codes

Ultimately it is a risk-based decision for the credit union, but keep in mind that credit unions are under no legal obligation to supervise their members' behavior nor to enforce federal drug laws.  There is no federal regulatory requirement to affirmatively prevent member transactions to state-sanctioned marijuana-related businesses.  Yet, the liability risk remains.  So what should a credit union do?

Some credit unions have considered taking such action as blocking marijuana-related transactions based on merchant codes.  There is some precedent for this: the Unlawful Internet Gambling Enforcement Act (UIGEA), for example, prohibits gambling businesses from knowingly accepting payments in connection with the participation of another person in a bet or wager that involves the use of the Internet and that is unlawful under any federal or state law (“restricted transactions”). See, 31 U.S.C. §§ 5361-5367.  Under the UIGEA, Treasury and the Federal Reserve Board promulgated regulations requiring certain participants in payment systems that could be used for unlawful Internet gambling to have policies and procedures reasonably designed to identify and block or otherwise prevent or prohibit the processing of restricted transactions. See, Unlawful Internet Gambling Enforcement Act of 2006 Overview.

However, blocking marijuana-related transactions would be an administrative burden—and there are ways to circumvent code-blocking. For example, critics have suggested that the UIGEA has had debatable success in effectively blocking illegal gambling transactions.  One reason that code-blocking has not worked well, according to some reports, is because of a circumvention technique called "factoring."  In factoring, a merchant engaged in illegal gambling submits its card transactions through another merchant's terminal using that merchant's identification number and merchant category code and then pays the other merchant a percentage of the submitted transactions.  While this violates card associations' rules, this type of circumvention illustrates the difficulty in trying to police member behavior.  It is also worth bearing in mind that restrictions on internet gambling transactions are specifically governed by federal law, the UIGEA.  There is no similar statute requiring marijuana-related transactions to be blocked by financial institutions.

Also, there is the risk of over-blocking.  Some merchants may sell both legal and (federally) illegal products—the marijuana merchant for example could sell marijuana as well as tobacco products, e-cigarettes, magazines, T-shirts, hats, etc. So, a customer could shop at a marijuana merchant but only purchase legal products and still be blocked. 

Reputation Risk

Another consideration is reputation risk. Although illegal on the federal level, marijuana is legal at the state level in 29 states.  More and more states are legalizing cannabis, both medically and recreationally, and there is majority and growing public support for legalized marijuana.  Particularly with respect to medical marijuana—where members with legitimate medical conditions may rely on medical marijuana to treat or alleviate serious illnesses including cancer and epilepsy—there could be risks to the credit union's reputation if members become upset that their transactions for medical marijuana are blocked by the credit union, particular if there is no regulatory obligation to do so.

On the other hand, there might be reputation risk to allowing marijuana-related transactions or in not taking some affirmative action to prevent payments to marijuana-related businesses.  For example, a credit union with a field of membership that includes law enforcement agencies could suffer reputational harm in allowing marijuana-related transactions despite continued federal prohibitions against marijuana.

BSA Compliance

If the credit union determines to allow marijuana-related transactions, reporting requirements under the Bank Secrecy Act and anti-money laundering (BSA/AML) rules certainly come into play.  If a transaction appears to be associated with marijuana, FinCEN guidance issued in 2014 is instructive. See, FIN-2014-G001. The FinCEN guidance "clarifies how financial institutions can provide services to marijuana-related businesses consistent with their BSA obligations." See, FIN-2014-G001, p.2.  For example, the credit union may need to file a marijuana-related suspicious activity report (SAR) for member transactions that involve marijuana-related funds. 

The FinCEN guidance discusses three specific marijuana-related SARs: (1) marijuana limited; (2) marijuana priority; and (3) marijuana termination.  BSA obligations are heightened for transactions involving marijuana, even if the transaction is related to a marijuana-related business that is legal under state law.  For instance, all transactions with a marijuana-related business require a SAR, simply by virtue of the fact that the subject is engaged in a marijuana-related business. 

FinCEN's discussion of the "marijuana limited" SAR filing states:

A financial institution providing financial services to a marijuana-related business that it reasonably believes, based on its customer due diligence, does not implicate one of the Cole Memo priorities or violate state law should file a “Marijuana Limited” SAR. The content of this SAR should be limited to the following information: (i) identifying information of the subject and related parties; (ii) addresses of the subject and related parties; (iii) the fact that the filing institution is filing the SAR solely because the subject is engaged in a marijuana-related business; and (iv) the fact that no additional suspicious activity has been identified. Financial institutions should use the term “MARIJUANA LIMITED” in the narrative section.

See, FIN-2014-G001, pp.3-4.  Thus, at a minimum, a "marijuana limited" SAR should be filed for all transactions involving a marijuana-related business or marijuana-related funds.

In the end, this is a complex and still uncertain issue and a lot remains unclear about how credit unions should address state-sanctioned marijuana activities.

TRID Amendments – Tolerances, Expiration of Loan Estimates and Updated Forms Guide; Zoolights!

Written by Brandy Bruyere, Vice President of Regulatory Compliance

Once in a while, our blog schedule is updated and I blog twice in a row. We ended last week with HMDA, and we'll start the week off with TRID.

Tolerances

TRID requires credit unions to provide a Loan Estimate in good faith and based on the best information reasonably available, with certain costs being subject to zero tolerance, 10 percent tolerance or no tolerance. Some of the 2017 amendments incorporate past guidance or imperfect attempts to fix errors in the rules relating to tolerances. For example, in February 2016, the CFPB amended the preamble to TRID to correct a mistake regarding which fees are subject to no tolerance, and now the 2017 rule formally incorporate this change. This clarifies that property taxes, homeowner's association dues, condominium fees and cooperative fees are subject to no tolerance when the figures on the Loan Estimate are based on the best information reasonably available. This chart summarizes the tolerance categories as tweaked by the TRID amendments:

	TRID Tolerances for Settlement Costs
Zero tolerance	·   All other fees which are not either 10% tolerance or subject to no tolerance. Examples include: -   Fees paid to the credit union, mortgage broker, or an affiliate of either -   Any fees paid to any party if the member was not permitted to shop -   Transfer taxes
10% tolerance	·   Recording fees ·   Fees paid to unaffiliated 3rd-party  when the member is permitted to shop (examples could include settlement agent fees, notary fees)
No tolerance limitation	·   The following IF the estimate was “consistent with the best information reasonably available”* to the credit union at the time of disclosure -   Prepaid interest -   Property taxes -   Property insurance premiums -   Homeowner's association fees -   Condominium fees -   Cooperative fees -   Amounts placed into an escrow or similar account -   Charges paid to 3rd-party service providers selected by the member that are NOT on a list provided by the credit union -   Charges paid for 3rd-party services NOT required by the credit union, including charges to affiliates *Note, estimates cannot be unreasonably low in order to meet this standard

The CFPB also added commentary to clarify that the 10 percent tolerance applies in the aggregate as opposed to a specific charge. For example, if a fee subject to 10 percent tolerance was left out of the Loan Estimate, it could be on the Closing Disclosure (and charged to the borrower) so long as the aggregate amount of fees does not exceed ten percent of the amount shown on the Loan Estimate. The CFPB provided an example in comment 19(e)(3)(ii)-2:

1. Assume that, [in the Loan Estimate], the creditor includes a $300 estimated fee for a settlement agent, the settlement agent fee is included in the category of charges subject to [10 percent tolerance], and the sum of all charges subject to [10 percent tolerance] (including the settlement agent fee) equals $1,000. In this case, the creditor does not violate [tolerance limitations] if the actual settlement agent fee exceeds the estimated settlement agent fee by more than 10 percent (i.e., the fee exceeds $330), provided that the sum of all such actual charges does not exceed the sum of all such estimated charges by more than 10 percent (i.e., the sum of all such charges does not exceed $1,100).

Expiration of the Loan Estimates.

Section 1026.19(e)(3)(iv)(E) allows credit unions to revise charges originally disclosed on the Loan Estimate if the consumer indicates an intent to proceed with the loan more than ten business days after receiving the Loan Estimate. There was uncertainty under TRID as to whether the credit union could voluntarily extend this ten business day window. The amended rule clarifies that credit unions may do this. However, the consumer must be permitted to rely on the Loan Estimate and to indicate their intent to proceed within the specified window of time. For example, if a credit union decides to extend the expiration date for a total of 14 business days, then the member must be allowed to indicate their intent to proceed under the terms in the Loan Estimate such as the disclosed rate.

Updated Forms Guide.

Finally, last week the CFPB updated its TRID Guide to Forms to incorporate the 2017 changes to TRID. Updates include:

• The Loan Estimate in the General Requirements, General Information, Loan Terms, Projected Payments table, Costs at Closing, Loan Costs and Other Costs, Calculating Cash to Close table, Alternative Calculating Cash to Close table, Comparisons, and Confirm Receipt.
• The Closing Disclosure in the General Requirements, General Information, Costs at Closing table, Other Costs, Calculating Cash to Close table, Summaries of Transactions, Borrower’s Transaction, Seller’s Transaction, Escrow Account, Loan Calculations, and Confirm Receipt.  
• Coverage of closed-end credit transactions secured by a cooperative unit in various sections of the guide.

Palate Cleanser. Since I started the week off with TRID, I thought I'd share a photo of Nolan at Zoolights. He was a big fan of the train!

A Tale of Two Signs? HMDA Lobby Notices

Written by Brandy Bruyere, Vice President of Regulatory Compliance

Recently, we received a great question from a NAFCU member on HMDA implementation. While the new HMDA rules change the lobby notice disclosures, what about the current rule's requirement? Specifically, the rule requires credit unions that are subject to HMDA reporting make modified data available to the public to 3 years and post a disclosure statement for 5 years. Here are some key excerpts from section 1003.5:

(d) Availability of data. A financial institution shall make its modified register available to the public for a period of three years and its disclosure statement available for a period of five years. An institution shall make the data available for inspection and copying during the hours the office is normally open to the public for business. It may impose a reasonable fee for any cost incurred in providing or reproducing the data.

(e) Notice of availability. A financial institution shall post a general notice about the availability of its HMDA data in the lobby of its home office and of each branch office located in an MSA and Metropolitan Division. An institution shall provide promptly upon request the location of the institution's offices where the statement is available for inspection and copying, or it may include the location in the lobby notice. (Emphasis added.)

Currently the Federal Financial Institutions Examination Council (FFIEC) prepares the disclosure statements and Regulation C requires credit unions to make this statement available to the public within 3 business days after receiving the disclosure from the FFIEC. Section 1003.5(b) also requires the credit union to either:

• Making available to the public in the credit union's home office and at least one branch office in each Metropolitan Statistical Area (MSA) and Metropolitan District (MD) where the credit union has offices the disclosure statement within 10 business days of receiving the statement; or

• Post the address for sending written requests in the lobby of each branch office and provide a copy of the disclosure statement within 15 calendar days of receipt for the MSA or MD for which the request was made.

Beginning January 1, 2018, the CFPB's suggested text for the lobby notice required under paragraph 1003.5(e) will point consumers to the CFPB's website. However, access to prior years' disclosure statements and modified LARs will not be available via the Bureau's website. It seems the amended HMDA rule did not clearly contemplate that there would be a few years where prior years' data would still need to be available as the suggested language for the lobby notices only seem to look forward based on data collected in 2017 and beyond.  However, there are a couple of blurbs in the preamble to the 2015 HMDA rule (links below) clarifying that current Regulation C will apply to requests for HMDA data collected prior to 2017:

"The Bureau notes that § 1003.5(b) is effective January 1, 2018 and thus applies to the disclosure of 2017 HMDA data. Current Regulation C applies to requests received by financial institutions for HMDA data for calendar years prior to 2017.

[…]

Financial institutions will make available to the public their 2017 HMDA data pursuant to § 1003.5(b) through (e) of this final rule. Financial institutions make available to the public their HMDA data for calendar years prior to 2017 pursuant to current Regulation C."

It will be important to keep in mind that current HMDA requires making a modified LAR available to the public for three years and the disclosure statement for 5 years. As a result, the CFPB's suggested text for the lobby notice only tells half the story.

After hearing others had received information from the CFPB on this, NAFCU reached out to the CFPB using its regulatory inquiries system and received non-binding, informal guidance on whether lobby notices will continue to be required for both versions of HMDA.  In speaking to CFPB staff, based on the language in the preamble referencing the current rule, it seems credit can have both notices available – one for the timeframe required by current Regulation C and one for amended Regulation C. Alternatively, credit unions may be able to develop a combined statement. Here is the "suggested text" under the current rule:

"5(e) Notice of availability.                                                       

1. Poster—suggested text.An institution may use any text that meets the requirements of the regulation. Some of the Federal agencies that receive HMDA data provide HMDA posters that an institution can use to inform the public of the availability of its HMDA data, or the institution may create its own posters. If an institution prints its own, the following language is suggested but is not required:

Home Mortgage Disclosure Act Notice

The HMDA data about our residential mortgage lending are available for review. The data show geographic distribution of loans and applications; ethnicity, race, sex, and income of applicants and borrowers; and information about loan approvals and denials. Inquire at this office regarding the locations where HMDA data may be inspected.

2. Additional language for institutions making the disclosure statement available on request.An institution that posts a notice informing the public of the address to which a request should be sent could include the following sentence, for example, in its general notice: “To receive a copy of these data send a written request to [address].”

Here is the suggested text from the amended rule:

"5(b) Disclosure Statement

[…]

2. Format of notice.A financial institution may make the written notice required under §1003.5(b)(2) available in paper or electronic form.
3. Notice—suggested text.A financial institution may use any text that meets the requirements of §1003.5(b)(2). The following language is suggested but is not required:

Home Mortgage Disclosure Act Notice

The HMDA data about our residential mortgage lending are available online for review. The data show geographic distribution of loans and applications; ethnicity, race, sex, age, and income of applicants and borrowers; and information about loan approvals and denials. These data are available online at the Consumer Financial Protection Bureau's Web site (www.consumerfinance.gov/hmda). HMDA data for many other financial institutions are also available at this Web site.

4. Combined notice.A financial institution may use the same notice to satisfy the requirements of both §1003.5(b)(2) and §1003.5(c)."

Credit unions could consider indicating which years' data particular statements would apply to when determining whether to have two separate notices or combine notice statements. Either way, it will be important to be mindful of properly handling requests for HMDA data for years prior to 2017 given the length of time the rule requires financial institutions to make this information available.

Palate Cleanser.

If I'm going to blog about HMDA on a Friday, the least I can do is share a cute Lemmy picture. He decided to perch on the refurbished toy storage bench to peek outside, maybe to look at our holiday lights or maybe to stare down a package delivery person. Either way, he swears this is a comfortable fit!

FinCEN Launches Information Sharing Exchange Program

Written by Shari R. Pogach, Regulatory Paralegal

The Financial Crimes Enforcement Network (FinCEN) wants to strengthen information sharing with financial institutions.  To help achieve this, it announced it has launched its FinCEN Exchange program to enhance public-private information sharing.  Working closely with law enforcement, FinCEN plans to convene regular briefings with financial institutions to exchange information on important potential illegal finance threats.   The program is intended to help financial institutions better identify risks and better focus on higher priority issues.  This will in turn help FinCEN and law enforcement get critical information to continue the fight against money laundering and other financial crimes.

Participation in the FinCEN Exchange is strictly voluntary with no new regulatory requirements.  It also doesn't replace or affect any existing channels by which law enforcement interacts directly with the financial industry. FinCEN indicates operational briefings under this new program will start in the coming weeks.

Historically, FinCEN has convened over a dozen special briefings in five cities with over 40 financial institutions and multiple law enforcement agencies since 2015.  According to FinCEN, the information given by financial institutions through suspicious activity reports (SARs) after these briefings has helped the public sector map out and target weapons proliferators, sophisticated global money laundering operations, human trafficking and smuggling rings, and corruption and trade-based money laundering networks.  The briefings also helped financial institutions to focus on specific priorities and better identify risks.

The FinCEN Exchange will convene more regularly scheduled and as-needed operational briefings across the nation with law enforcement, FinCEN and financial institutions to exchange information on priority illegal finance and national security threats.  In consultation with law enforcement, FinCEN plans to invite financial institutions to participate based on a variety of factors, including whether an institution may have information that is relevant to a particular topic. 

FinCEN states the form of each briefing may vary but the sharing of information is intended to equip financial institutions to provide more responsive information into SARs. Financial institutions are also highly encouraged, as appropriate, to voluntarily share information with other FinCEN Exchange participants as well as other financial institutions or associations of financial institutions pursuant to Section 314(b) of the USA PATRIOT Act.

Flag on the Play: Imposing Penalty Rates

Written by Jennifer Aguilar, Regulatory Compliance Counsel

It's December. Football weather has settled in and the playoff race is heating up. If you're anything like me, you spent the entire day yesterday glued to the RedZone or, for those lucky few, you actually got to watch your team on the local broadcast. As every sports fan knows, sometimes no matter how hard the players play, sometimes it's up to the referees to decide the outcome (eyeroll and audible groan as you remember that terrible completely wrong call the refs made that cost your team the game). Most of time, the referees are on the same page and impose the right call, like these guys:

But, sometimes, no one can agree on what right call should be, like these guys:

So, what to do then? Well, go back to the rulebook. Every once in a while, credit unions find themselves in a similar position – your member hasn't paid her bill on time or has exceeded her credit limit and now you need to be the ref and enforce the rules and impose a penalty rate. But before you do so, you may find it helpful to review the rulebook first to ensure that you're making the right call. As penalty rates are most common with open-end credit products, the rules discussed below apply to open-end not home-secured credit.

The first rulebook to review is the credit agreement. This agreement lays out the obligations between you and your member but it also lays out your rights when the member fails to live up to her obligations. Before you can impose a penalty rate for such failures, you have to have the authority to do so. The agreement will usually tell you whether or not you have such authority. The agreement will also explain the circumstances under which a penalty rate may be imposed. In the event your agreement is silent on this issue, your state law may explain whether the credit union has the authority to impose a penalty rate. While the credit agreement is an important place to start, don’t forget that there is another rulebook to review too – Regulation Z.

Penalty rates are generally permissible under Regulation Z. So, as long as you have the contractual authority to do so and one of the circumstances laid out in the credit agreement has occurred, you may impose the penalty rate. Regulation Z does, however, have a couple rules that must be followed. Section 1026.9(g) requires advance notice before you can impose the penalty rate. The notice must be provided after the event that triggered the penalty rate and at least 45 days before the effective date of the increased rate. The notice must include the following:

• Statement that the penalty rate has been triggered;
• Date the penalty rate will apply;
• Circumstances under which the penalty rate will no longer apply or a statement that the penalty rate may apply indefinitely;
• Statement of which balances the penalty rate will apply to and which balances the regular rate will continue to apply to, if any;
• If the account is a credit card, a statement of the principal reasons for the rate increase; and
• If the rate increase is the result of a failure to make a minimum periodic payment within 60 days of the due date, a statement that the increased rate will no longer apply to transactions occurring before or within 14 days of the notice if the member makes the next six consecutive minimum payments on time.

If the open-end credit plan is a credit card and the penalty rate was imposed because the member failed to make a minimum payment within 60 days of the due date, section 1026.59(e) requires credit unions to review the account periodically to determine whether the penalty rate is still applicable. The first review is required within six months of the sixth payment due date following the effective date of the penalty rate. After that, the review is required once every six months. In conducting the account review, the rule requires credit unions to review the factors that led to the application of the penalty rate. If the credit union determines that the penalty rate should no longer apply based on the review, the rule requires the credit union to reduce the rate back to the rate that previously applied within 45 days of completing the review. No review is required if the member makes the next six consecutive payments on time and, as a result, the credit union returns the rate to the rate that applied prior to imposing the penalty rate.

Reg E Error Resolution for POS Disputes and Unjust Enrichment; Blockchain Resources

By Stephanie Lyon, Regulatory Compliance Counsel

Talk about Black Friday, the perfect opportunity for fraudsters to go holiday shopping with your member's debit cards, online or in store. The holiday season truly is a fantastic time to review key provisions of the error resolution process of Regulation E. So let's dig in!

The basic concept of the error resolution process is that members will notify their credit union when they notice an unauthorized EFT from their account. See, 12 C.F.R. § 1005.11(b). The credit union will receive the information needed to investigate the claim and resolve the issue within a specified time period. While the credit union investigates the error, the member will be provided with provisional funds to minimize disruptions to the member's life.  See, 12 C.F.R. § 1005.11(c)(2)(i). Finally, the credit union will notify the member of the resolution and make the provisional credit final or revoke the credit if no error occurred. Sounds simple enough, right?

Wrong. Regulation E is deceptively simple, but it is full of compliance pitfalls and stumbling blocks. We have already addressed a couple of these issues in prior blogs here and here. Today's blog focuses on point-of-sale (POS) dispute timelines and what to do if you finalized the provisional credit and new information shows the member was already refunded by the merchant or the transaction was not unauthorized.

The normal timeline to resolve a Reg E error is within 10 business days of when the member notifies the credit union of an unauthorized transfer from their account. See, 12 C.F.R. § 1005.11(c)(1). Some credit unions pride themselves in providing extreme member service and correcting most errors within this timeline and to save themselves the hassle of providing provisional credit. While admirable and very member-friendly, this also means the credit union will have to mad-rush to investigate the dispute, contact merchants, compare signatures, pull video from the security cameras (if any) and come to a conclusion. Whew! I am exhausted just thinking about the process. In POS dispute cases, 10 days is simply not enough to even get a return call from merchants, let alone any documentation of the transaction.

To remedy this, the regulation permits the investigation period to be extended up to 90 days for point-of-sale (POS) debit card transactions such as swiping your debit card at any store in the mall. See, 12 C.F.R. § 1005.11(c)(3)(ii). To take advantage of the extended timeline, the credit union must: (1) provisionally credit members for the amount of the alleged error as long as the member notifies the credit union in writing; (2) notify the member within 2 business days of the amount and date the provisional credit was given; and (3) give the member full use of the provisional credit while the investigation is pending.

Taking the time to investigate a POS dispute is essential as lately, credit unions are noticing that merchants are refunding members after the credit union has already resolved the error and finalized provisional credit. Basically, the member is getting back their money twice. As awesome as it is to get a windfall, it is simply not right. So credit unions want to know whether they can remove funds from a member's account if the member had been made whole by the merchant or if the credit union uncovers convincing evidence that the transaction was not unauthorized.

The answer to this question is not found in the regulation—of course. That would make it way too easy on the NAFCU compliance team that takes these questions as a white elephant gift from the regulators. Regulation E explicitly states that credit unions can reverse provisional credit if there was no error or a different error occurred. See, 12 C.F.R. § 1005.11(d). Nothing in the regulation states that credit unions can take back final credit if it later discovers that no error or a different error occurred. If this seems inherently unfair, you are not alone. There is an entire contract law concept called unjust enrichment that has been around long before any of us or our predecessors were thinking about compliance. The just of this notion is that someone received a benefit they were not entitled to at the expense of someone else. Unfortunately, to pursue an unjust enrichment claim, the credit union would have to file a civil suit against the member who received the windfall. A less expensive option may be to politely ask the member to reimburse the credit union if the merchant credited the member or if the member later admits to having made the transaction. But an even better option is probably to take the full 90 days to investigate the dispute and ensure the credit union is monitoring the member's account during that time.

Regardless of the option, this is an area where the regulation is not entirely clear on when or whether a credit union has the ability to revoke final credit if the member is unjustly enriched. Interestingly enough, the remittance transfer rule that makes up sections 1005.30 to 1005.36 of Regulation E, has a provision regarding these types of unjust enrichment cases that should be added to the EFT error resolution part of the regulation. Here is a relevant excerpt from the official interpretation to section 1005.33(f):

…In addition, nothing in this section prevents an account-holding institution or creditor from reversing amounts it has previously credited to correct an error if a sender receives more than one credit to correct the same error. For example, assume that a sender concurrently asserts an error with his or her account-holding institution and remittance transfer provider for the same error, and the sender receives credit from the account-holding institution for the error within 45 days of the notice of error. If the remittance transfer provider subsequently provides a credit of the same amount to the sender for the same error, the account-holding institution may reverse the amounts it had previously credited to the consumer's account, even after the 45-day error resolution period under §1005.11.

12 C.F.R. § 1005, Supp I, 1005.33(f)—1 (emphasis added). I am just going to put it out there, adding this to the official interpretation of section 1005.11(d) would be a pretty fantastic present for all compliance officers.

***

Blockchain Resources

NAFCU Regulatory Affairs Counsel Andrew Morris recently wrote an article for our Cyber Café edition of the Compliance Monitor (log-in required). To continue to assist credit unions interested in staying ahead of the curve he teamed up with NAFCU Special Counsel Pamela Yu, to produce a webpage that describes how blockchain technology impacts credit union regulations from BSA to Mortgage Servicing. This resource is available to all and can be accessed here.

We Listened So You Don't Have To: Interagency Fair Lending Hot Topics Webinar

Written by: André B. Cotten, Regulatory Compliance Counsel

On November 16^th, 2017, the CFPB, NCUA and several other representatives from federal agencies presented a webinar on lending topics ranging from the HMDA changes to Regulation B special purpose credit programs, compliance management for consumer loans and fair lending considerations. You can listen to the webinar here and download the presentation slides here. Here is a quick summary of the main topics discussed:

HMDA Changes and Fair Lending

A CFPB representative quickly went over the new HMDA rules that will be in effect for HMDA data collected in 2018 and reported in 2019. According to the speaker, the FFIEC released its HMDA Examiner Transaction Testing Guidelines that will be used by all federal regulators in assessing the accuracy of the HMDA data that financial institutions record and report. This guide has important information regarding testing procedures and tolerance calculations for errors in different sample sizes.

As far as examinations, the CFPB highlighted that it will be updating its HMDA Examination Procedures and Getting It Right Guide to make complying with the rules easier. And as we previously reported, the CFPB's approach in initial examinations will be consistent with the approach taken for other regulations, which means "good faith efforts" to comply will be taken into account.

Special Purpose Credit Programs

A NCUA representative reviewed Regulation B Special Purpose Credit Programs. A special purpose credit program is characterized as a credit incentive. For instance, a credit union offers a one-time rate reduction for designated loan products to one or more of its membership groups. In other words, this incentive program would not be offered to the credit union's entire field of membership.

NCUA discussed credit risks associated with offering these type of special purpose credit programs. According to the official interpretations to Regulation B, the credit union makes the determination if the program benefits an "economically disadvantaged class of persons". The requirements for special purpose credit programs are detailed in section 1002.8. Note, the credit union's program cannot be established to evade ECOA's nondiscrimination requirements. To comply with Regulation B, the credit union may request common characteristic information to determine eligibility. If financial need is one of the criteria for the special purpose credit program, the credit union may also request information need to determine financial need.

Compliance Management for Consumer Loans

A representative from the Federal Reserve Board presented on compliance management for consumer loans. Although most credit unions are not supervised by the Federal Reserve, a credit union would still find the presenters remarks helpful.

The discussion focused on fair lending risks and compliance management for the pricing of consumer loans. However, the same principles would apply to developing an effective fair lending risk management program for consumer loan underwriting, and for mortgage and indirect auto pricing and underwriting.

Many credit unions offer consumer loans that serve a critical need for members. The Federal Reserve identified common scenarios the fair lending risk for pricing arises, which include the following:

• The credit union grants the loan originators broad discretion to set the interest rate and fees
• The credit union does not use rate sheets or other pricing guidelines
• The credit union does not require the loan originators to clearly and consistently document pricing decisions, including exceptions
• The credit union does not monitor for potential pricing disparities on a prohibited basis.

The Federal Reserve Board's representative also identified the elements of an effective compliance management system: Board of Directors and Senior Management Oversight; Policies and Procedures; Risk Monitoring and Management Information Systems (MIS); Internal Controls.

The Federal Reserve expects the financial institution's board and senior management to ensure they understand the level of risk in the credit union's products, services, and business lines, including the fair lending risk in consumer loan pricing. Board and Senior Managers are also expected to administer compliance management program that is consistent with the size, complexity, and risk profile of the financial institution's products, services, and business lines.

In regards to policies and procedures, the Federal Reserve encourages financial institutions to develop policies and procedures (such as rate sheets, checklists, job aids, etc.) designed to ensure consistent outcomes and prevent discrimination on a prohibited basis. Financial institutions are also encouraged to provide training on the fair lending risk in consumer loan pricing, and the financial institution's policies should appropriately control that risk.

The Federal Reserve also provided some best practices. Financial institutions may want to use rate sheets or loan origination software that use clear pricing criteria, and, if applicable, clear pricing exception criteria. The financial institution may also want to require loan originators to clearly and consistently document pricing decisions, including exceptions.

Then, in regards to risk monitoring and management information systems, the financial institution may want to develop risk monitoring systems commensurate with the level of discretion permitted. The Federal Reserve also provided several fact scenarios and commentary to better explain various fair lending risk scenarios. The credit union may also want to provide the board of directors and senior management with the information needed to identify and evaluate fair lending risk for consumer loan pricing.

When developing and modifying internal controls, the Federal Reserve advises that financial institutions may want to develop periodic fair lending self-assessment processes. These processes can include compliance reviews and audits that are appropriate for the size, complexity, and risk profile of the credit union's products, services, and business lines.

Other Related Fair Lending Topics

There were numerous other presenters during the webinar. The FDIC representative provided additional guidance concerning Fair Lending Monitoring Programs. The FDIC's Compliance Manual defines "monitoring" as a proactive approach by an institution to identify procedural or training weaknesses in an effort to preclude regulatory violations. It also includes transactional testing. The FDIC discussed performing periodic analyses of data for fair lending risks. These reviews should be conducted on a portfolio-wide basis.

Moreover, a representative from HUD discussed recent common issues in consumer complaints at HUD. Some common complaints include the following: the treatment of disability income; the treatment of parental leave income; collateral policies; reasonable accommodations; and targeting tools for marketing through social media.

Lastly, an attorney from the Department of Justice discussed denial investigations and cases. The DOJ representative used a recent case to explain instances of mistreatment based on prohibited criteria. The complaint alleges that the bank required employees to deny loans from minority applicants more quickly than similarly-qualified white applicants. The bank also instructed its employees not to provide credit assistance to applicants whose applications were marginally qualified.

***

Live Webcast on Tuesday, December 5 - Must a Credit Union Website be ADA Compliant? Protecting Your Credit Union from Potentially Frivolous Claims 

Over the past few months, credit unions have been hit with scores of lawsuits (and perhaps hundreds of “attorney demand letters”) challenging the accessibility of credit union websites to visually-impaired individuals.  Under the Americans with Disabilities Act of 1990, “public accommodations” are charged with being accessible to those with impairments.  These cases and claims allege that credit union websites are places of “public accommodation;” that they are not fully-accessible to visually-impaired individuals; and that the visually-impaired claimant stands ready to resolve the matter “confidentially” for a cash settlement. 

This 90-minute webcast will feature speakers with current experience in the legal and procedural issues involved, and will cover background information, current cases specific to credit unions, and what your credit union can do now to minimize its risk. Register here.