NAFCU Compliance Blog

November 2007 NAFCU Regulatory Compliance Newsletter Available

NAFCU members can access it here. (Member log-in.) This month's article addresses NCUA's new rule that governs member inspection of credit union books, records, and minutes.  Of course, there will be the usual assortment of questions and answers.  Such as...

Question: Our members have the option of sending a text message to our credit union to initiate a transfer between their checking and share accounts. Would this count toward the six transaction limit of Regulation D?

Answer: Yes. Under Regulation D, "telephonic" transfers from a share account (non-transaction account) generally count towards the six-transfer limitation. The regulation indicates that telephonic transfers include those involving "data transmission." 12 C.F.R. § 204.2(d)(2). Even though not contemplated when the regulation was adopted, a text message would most likely qualify as a “data transmission.” A 1992 letter from the Federal Reserve indicates that "…telephone, fax, and computer transactions to transfer funds to another account at the same institution" are subject to the six-transaction limit. See Federal Reserve Staff Opinion of July 13, 1992, Federal Reserve Regulatory Service (FR RS) 2-342.22, question 4.

WaMu Hit with BSA Cease and Desist

The Office of Thrift Supervision recently hit Washington Mutual Bank (WaMu) with a cease and desist order.  Sure, this is a C&D issued by another regulatory agency.  The Compliance Guy finds these useful however.  BSA is BSA, or so they say.  One can easily take lessons from other agencies.  The C&D does not go into details about what WaMu did wrong.  Rather, it lists numerous items that WaMu must do to come into compliance.  Here are a few:

1. Strengthening internal controls, which includes adequate staffing and training.
2. Enhancing of independent testing.
3. Providing adequate resources and authority for its BSA compliance officer.

You can read the rest for yourself through the link provided above.  Why did I underline item 3?  I think it is often overlooked.  The best policies, procedures and reports are not worth a doodle if a BSA compliance officer does not have the time, training, resources or authority to make things happen. 

Reading enforcement actions is a good way to see compliance from a different angle.  These orders generally provide detailed instructions to financial organizations on how to improve their compliance performance.  That makes them good reads.

Here's a link to NCUA's enforcement actions.
Here's a link to OTS' enforcement actions.
Here's a link to OCC's enforcement actions.
Here's a link to FinCEN's enforcement actions.

FinCEN Publishes SAR Activity Review; Credit Union Cooperatives Under the Spotlight

On Friday, FinCEN released the most recent issue of its SAR Activity Review - Trends, Tips and Issues.   The publication is always a good read for BSA junkies.  But this issue really caught the eye of the Compliance Guy.  This issue devotes an entire article that analyzes SARs filed by or relating to credit union cooperatives.  From the article, it seems to be focusing on shared branches.  Of note...

• FinCEN studied SARs referencing credit union cooperatives from June 2004 through March 2007.  This amounted to 121 SARs.  (Only 23 were actually filed by credit union cooperatives.)
• More than 65 percent of the SARs filed by cooperatives contained "data quality problems."  More than 30 percent had blank narratives.  Other mistakes included wrong addresses, lack of federal employer identification numbers, and wrong total dollar amounts.
• Structuring/Money Laundering was the most common reason for filing a SAR by the cooperatives, followed by check fraud and misuse of position.

While this article only studied a small number of SARs issued by or related to credit union cooperatives, FinCEN certainly spent a good deal of time discussing quality concerns.  To me, this is a clear red flag.  If your credit union is involved with a credit union cooperative as outlined in the article, you may want bring this article to their attention to make sure that SAR filings are done correctly.

***

In the same issue, FinCEN did a wonderful thing.  Starting on page 34, FinCEN gives detailed explanations and examples for each category of suspicious activity appearing in Item 35 of the SAR form, and what federal statute such activity might violate.  For example, credit unions should check off "bribery/gratuity" on a SAR to report "anyone who, in connection with bank business, corruptly gives, offers or promises anything of value to a bank official with the intent to influence or reward that official."  This would be be a potential violation of 18 U.S.C. Section 215 (Bank Bribery Act).  FinCEN does this for every category.  This section would be useful to train staff about the different types of activity that may trigger a SAR filing.

NCUA Board Meeting

NCUA issued three final rules during its  meeting yesterday.

1. Incorporation of NCUA's Bylaws into NCUA regulations;
2. The FACT Act's Identity Theft Red Flags and Address Discrepancies Final Rule; and
3. The FACT Act's Affiliate Marketing Rule

Here's a nice, short synopsis of the Board's actions.  NAFCU is working on Regulatory Finals for these rules.  We'll have those available for our members in a few weeks.  (Note, we generally wait for final rules to be published in the Federal Register before issuing alerts, and we expect publication in the Federal Register in a week to 10 days.)

***

With all of these final rules, the Compliance Guy thought that he'd talk about the beauty of the "preamble."  When an agency issues a proposed or final regulation, they do more than just issue the new regulatory text.  They give a summary, background information, and lengthy discussions about their proposal or final rule.  While it may be tempting to skip to the end of a final rule to read the new regulatory language, there are countless gems to be found in the text of the stuff I mentioned above.  (Which I call the preamble.)  Happy reading!

***

Have a great weekend.  If he can get his chores done, the Compliance Guy will be watching this and this.  Be safe.

California Wildfires; Reg E and "Reasonable Period"

NCUA has activated its "Disaster Assistance" in response to the California wildfires.  In short, NCUA (when necessary):

• Encourages CUs to make loans with special terms and reduced documentation to affected members
• Will reschedule routine examinations of affected credit unions if necessary
• Guarantee lines of credit for credit unions through the National Credit Union Share Insurance Fund
• Make loans to meet the liquidity needs of member credit unions through the Central Liquidity Facility

You can access the guidance here.  Worth noting: you do not need to be a California credit union to have members who are affected by the wildfires.

***

All credit unions are aware of Regulation E and how it governs member responsibility for unauthorized electronic funds transfers (EFTs).  The rationale behind the system is simple; members only have so long to bring evidence of unauthorized transfers to the attention of a credit union.  (Two, four, and sixty days, depending on the situation.) If the member misses the deadline, then the member is responsible for the loss.  Regulation E, however, builds in a safety net.  If a member's delay in notification was due to "extenuating circumstances," then a credit union must extend the deadlines to a "reasonable period." 12 C.F.R. 205.6(b)(4).  If you read the Official Staff Interpretation to Regulation E, the Fed indicates that extended travel and hospitalization are examples of "extenuating circumstances."  Is there an example of "reasonable period?"  Of course not.  So, here's my question to you: at your credit union, what constitutes a "reasonable period."  In other words, if a member is away on extended travel or hospitalization, how long would you extend Regulation E's normal deadlines.  The Compliance Guy looks forward to reading your comments.

A Little ODP, from the BOA

NAFCU has a wonderful service for members.  It is our Book of Answers. (NAFCU Log-in needed.) We took the questions and answers from our monthly Compliance Newsletter and BSA Blast, and we organized them by subject matter.  We have quite a few questions and answers. Fifty-two pages worth, to be exact. The Compliance Guy can't give this stuff away, as it is a NAFCU member benefit.  And their dues help pay my salary, which pretty much all goes for popcorn at Nationals games. But for you non-NAFCU folks, here's a snippet of what the Book of Answers, a.k.a.  BOA.

Question: Does my credit union’s board of directors need to approve our credit union’s overdraft protection (bounce protection) program?

Answer: According to NCUA’s Automated Integrated Regulatory Examination Software (AIRES), yes. NCUA’s regulations permit credit unions to establish bounce protection programs. 12 C.F.R. § 701.21(c)(3). While this regulation does not indicate whether a credit union’s board of directors must approve such programs, NCUA clarified its expectations in this area when it issued Letter to Credit Unions 05-CU-21. The guidance introduced the new AIRES Payment of Overdrafts (Bounce Protection Questionnaire. Cell A-14 directs NCUA examiners to ask the following question: “Has the board of directors established a written policy addressing the payment of overdrafts through bounce protection?” You can access 05-CU-21 at: http://www.ncua.gov/letters/letters.html.
(February 2007.)

Savings Bonds, Among Other Things

A member called the Compliance Guy today with a recordkeeping question on savings bonds.    I poked here.  I poked around there.  And I came across a gem.  The Savings Bonds Resource Guide.  Published electronically by the U.S. Treasury, this guide is a wonderful resource for any credit union that offers Savings Bond-related products and services.  It is also wonderfully large.  The electronic file is more than 24.1 MBs.  You've been warned.

What was the question, you may ask?  Well, our member wanted to know how long they must retain redeemed savings bonds.  The answer, my friend, is not blowing in the wind.  It is found on page 6-5 of the guide. 

"You are authorized to microfilm or use similar copy imaging to duplicate the face and back of each bond you redeem. You are required to retain such records for at least one year."

***

NAFCU has published the following documents which you may find useful:

• 07-EF-12: NCUA: Member Inspection of Records.  (NAFCU log-in needed.) This NAFCU Regulatory Final provides a wonderful overview of the new NCUA requirements concerning member access to credit union records.
• 07-EA-24: Treasury: Regulatory Structure for Financial Institutions. (NAFCU log-in needed.)  This NAFCU Regulatory Alert provides a general overview of Treasury's request for comment on how financial institutions are regulated.  Treasury wants to know, for example, whether your credit union thinks the current regulatory structure of separate functional regulators (NCUA, OTS, OCC, etc.) has led to inefficiencies.  NAFCU members: please get your comments to NAFCU by November 1 so that we can include them in our comment letter.

From A to Z (well, from 5300 to Your Insured Funds to be exact)

The Compliance Guy is amazed at how many folks do not use NCUA's site map.  This web page lists all of NCUA's major internet pages alphabetically.  A stroll through the "A" section will give you the Accounting Manual, Accounting Bulletins and the AIRES Exam Software.   The "B" section gives you a link to NCUA's Bylaws page.  I could go on and on.  The site map is a great place to go when you are looking for something, but just do not know where to find it on NCUA's website.  And a quick scroll through its content may alert you to unknown gems - low-hanging compliance fruit just waiting to be picked.   For example, did you know that NCUA has a "Consumer Privacy " web page?  Probably not.  Well, go to the site map, scroll down to the "C" section, and click on "Consumer Privacy."  You'll find a wealth of information about NCUA's Privacy Rule.  The Compliance Guy uses the site map almost daily.

NCUA Board Meeting Agenda Set; FACT Act Rules on Tap

As expected, NCUA looks ready to pass two new FACT Act final rules.  Here's the agenda for the 10/25/2007 NCUA Board meeting.  NCUA also will be looking at a final rule that would incorporate NCUA's Bylaws into its regulations.  The Compliance Guy tip of the day?  Draft items for the Board's review are available after 9 a.m. on the day of Board meetings here. (The items currently on this page remain from last month's meeting.)

***

NAFCU's Regulatory Compliance Seminar is wrapping up today.  Around 170 compliance professionals took part, enjoying Austin, Texas, eating some Tex-Mex and expanding their knowledge.  The Compliance Guy learned a bunch and invites all of you to think about attending next year's seminar in San Francisco, California.  Have a great weekend, everyone.

Risk-Based Compliance

Yesterday, the Compliance Guy alerted everyone to the newest FACT Act regulations.  It probably came to no one's surprise that we're all in for another risk assessment.  Deskdude issued an interesting and thought-provoking comment.  He noted:

It appears the forthcoming FACT Act regulations will utilize the increasingly common "flexible risk-based approach" whereby your compliance implementation depends upon "the size and complexity...and the nature and scope of [your institution's] activities". This is an interesting (if controversial) trend worth discussing. Risk-based regulation represents an important acknowledgment that one size does not fit all. It's interesting though that among those who commented on the regulation, "small financial institutions" were highlighted as being likely to desire more clearly prescriptive guidance.

Trend?  You bet.  We now use risk-based compliance programs to tackle security issues (Part 748, Appendix A), Bank Secrecy Act compliance, multi-factor authentication, and OFAC.  And now the trend has spread to identity theft. 

On one hand, risk-based programs allow institutions to design compliance programs that fit their make-up.   Bank A is not like Credit Union B, and risk-based compliance takes this into account.  On the other hand, compliance officers may face burn out if they must continuously design custom-made compliance programs to deal with complex problems.  On one hand, no one likes specific guidance that just doesn't fit.  On the other, we sometimes crave the simplicity and safety of "safe harbor" model disclosures and clear-cut regulatory mandates.

Question of the day: Is the trend of risk-based programs good or bad?  Or is that question too simplistic?  Comment away, friends.

For credit union professionals looking for a good overview of risk and risk management, a good place to start is chapter one of NCUA's Examiner's Guide.  The chapter explores "risk-focused programs."  Readers will gain a good understanding of how NCUA views risk and risk management.

***

Plenty of folks have asked the Compliance Guy how to set up and receive the "feed" from this blog. (If you look to the left, below the "About" link, you'll see feed subscription link.)  How does this work?  The Compliance Guy is not all that sure.  But you can find some good instructions here, which should be useful.

FACT Act Final Rules Issued

Leave it to the FDIC to break big news for credit unions!  Yesterday, the FDIC approved two final rules that implement portions of the FACT Act - Affiliate Marketing and the "Red Flag" Guidelines and Change of Address Rules.  The rules are not available from NCUA yet, but the FDIC draft federal register notices both include NCUA's name.  Therefore, it is expected that the other financial regulators will follow suit in the near future.

Here's a link to the FDIC web page that includes links to the final rules.  (Scroll down to the Discussion Agenda section.)  The Affiliate Marketing Rule carries a mandatory compliance date of October 1, 2008.  The  Red Flags Guidelines and  Change of Address Rules?  November 1, 2008.  NAFCU is working on Regulatory Finals that will provide a detailed overview of the final rules.   Stay tuned.

***

Yesterday, NCUA issued prohibition orders against four individuals that prohibit them from participating in the affairs of any federally-insured financial institutions.  In other words, they shouldn't get hired by your credit union.  In other words, you may want to pass this link along to your HR department. 

***

Yesterday, the Compliance Guy kicked back and absorbed a bunch of ACH-related compliance information at NAFCU's Track II  Compliance Program.  Experts from NACHA and SWACHA spent the day drilling useful information into eager minds.  Of note:

• NCUA examiners have been alerted to the requirement regarding the RDFI's responsibility to perform an annual audit.  They very well may ask to see a copy.
• One of the more common mistakes by RFDIs involves failing to use the proper code to contest a dishonored return.   Should staff treat a dishonored return as just another ACH entry, vital rights may be lost.  While dishonored returns can be contested, failure to use the right codes can be costly.

Welcome! (And Some Love for Google)

NAFCU is proud to present its latest offering to the credit union community - the NAFCU Compliance Blog.  NAFCU will use this blog to provide useful information to a very specific audience: the credit union compliance officer.  We're very excited to get started, and we hope you check back often.

***

OK, so the Compliance Guy promised some useful information.  Since this is the first post, I guess I should deliver something.  What about Google U.S. Government search?  Regular Google searches through a lot of rubbish.  Google U.S. Government search, however, limits its searches to federal, state and local government websites.  Very useful.  In the words of Google:

Google U.S. Government Search offers a single location for searching across the U.S. government information, and for keeping up to date on government news.  You can choose to search for content located on either U.S. federal, state and local government websites or the entire Web -- from the same search box.  Below the search box, the homepage includes government-specific news content from both government agencies and press outlets.  You can personalize the page by adding content feeds on government or other topics that you're interested in.

Thank you, Uncle Google.

***

On a related Google note, NCUA's search engine is now powered by Google.  In a word: better.  In two words: much better.