NAFCU Compliance Blog

Risk-Based Capital: Risk Weights; Shameless Plug

Written by PJ Hoffman, Regulatory Affairs Counsel

Welcome back to the second installment of our recurring series of posts where NAFCU’s Compliance Blog will break down different portions of NCUA’s proposed rule regarding risk-based capital and give a more detailed analysis and explanation. Today’s topic is Risk Weights.

For some background, on January 23, 2014, the NCUA Board issued a proposed rule regarding risk-based capital for credit unions. We at NAFCU have created some helpful resources for our members to use including NAFCU Regulatory Alert 14-EA-03, NAFCU Compliance Blog Posts here and here, and the Capital Reform Issue Page. We know that this is an important issue and NAFCU has and will continue to advocate on behalf of our members regarding this rule, but your feedback is needed. Please send us your comments here regarding the rule so that we can incorporate them into our advocacy and comment letter.

Now back to those pesky risk weights. The proposed rule revises the risk-weights for many of NCUA’s current asset classifications and requires higher minimum levels of capital for credit unions with more risky portfolios. See the chart on page 15 of our Regulatory Alert 14-EA-03. As you will see, the NCUA designed their proposed risk weights to take into consideration concentration risk and interest rate risk.

As you look at the assets and their associate risk weights, you’ll see that some assets are weighted differently depending on the percentage of the type of asset that is in a credit union’s portfolio. This is done to compensate for concentration risk and can be seen with real estate loans, member business loans, and higher levels of delinquent loans. For example, non-delinquent 1^st mortgage real estate loans start at 50 percent risk weight for those less than 25% of a credit union’s assets then jump to 75 percent from 25-35% of assets and finally go all the way to 100 percent for those that comprise more than 35% of the assets of the credit union’s portfolio.

The proposed rule also uses the risk weights to compensate for interest rate risk with the investment risk weights. An example of this is the difference in proposed risk weights for investments based on the maturity levels of those investments. For investments with a maturity of 0-1 years the proposed risk weight is 20 percent. For those with 1-3 year maturities the proposed risk weight is 50 percent. It jumps again to 75 percent for those with 3-5 year maturities and up to 150 percent for investments with maturities from 5-10 years. If your credit union is has an investment with an investment with a maturity over 10 years, under the proposed rule, it will have a 200 percent risk weight!

These risk weights were not chosen at random. There was thought behind many of them. Unfortunately, NCUA did not include much of their analysis in the text of the proposed rule. As NAFCU has stated in a recent letter to Chairman Matz, we question whether the risk weighting proposed actually matches real risk in the system. The proposed rule assigns rigid risk-weights to many investments that when properly examined represent much less risk than the assigned risk-weights. Capital requirements should not be substitute for proper credit union management or appropriate examinations.

Tell us what you think. Which risk-weights did NCUA get right and which ones do they need to change?

***

Shameless Plug

NAFCU has some great webcasts still available in the month of March that you won’t want to miss. 

Webcast: What Credit Unions Need to Know Now About NCUA’s New CUSO Rule

If you’ve made or plan to make an investment in a CUSO, new NCUA regulations will affect you in June. Get ready now. Understand the new CUSO direct reporting requirements and their implications. Register by Mar. 19 to save $100.

Webcast: The Target Data Breach: Next Steps for Protecting Your Members

Learn more about the breach, the claims filed against the retailer, and the issues surrounding what you should do next after a breach.  You’ll also receive insights from other major data breach cases to help your credit union decide whether or not to join the claim against Target. Register by Mar. 20 to save $100.

NCUA Launches Cyber Security Resources Webpage; Free Kick; Fair Lending Webcast

Written by Ricardo Piñeres, Regulatory Compliance Counsel

NAFCU has been beating the drum loudly on data security, and calling for action to ensure that merchants are properly protecting consumer information and actively working to prevent data breaches.  While the most recent and far-reaching problems have occurred at the merchant level, credit unions are not immune from cyber-attacks.  And that is the message that NCUA Chairman Debbie Matz delivered earlier this week.

During a speech in Washington, DC, on Monday, Chairman Matz highlighted the threats posed by cyber-criminals and how credit unions must step up their efforts to ensure that members’ funds and information are protected.  “Attacks, intended to create disruption, can crash networks but can also serve as a diversion for more damaging assaults,” Chairman Matz said.  “Imagine cyber-terrorists stealing passwords from your credit union and using your credit union as an entry point to gain access to every payment system and every vendor with which you have a digital relationship. Think about the damage they could do. The worst-case scenario doesn’t just deny services; it destroys security and dismantles systems.”

Chairman Matz’s speech is just one of the ways that the NCUA is calling attention to the issue of cyber security.  Back in January, the agency released its 2014 Supervisory Focus that prominently highlighted the need for credit unions to ensure that they have cyber security programs capable of dealing with 21^st Century threats to the financial networks.  During examinations, credit unions can expect examiners to focus on the institutions’ ability to assess and mitigate cyber security risks, and respond to possible attacks.  Credit unions are expected to have the appropriate risk mitigation controls in place to better prevent, detect, and recover from cyber-attacks, including:

• Vendor due diligence;
• Strong password processes; and
• Proper patch management and network monitoring.

While Chairman Matz’s speech was a call to action, she also acknowledged that the NCUA must have a role in helping credit unions prepare to deal with cyber threats.  Because of this, she announced that the agency has launched a webpage devoted to helping credit unions prepare to deal with cyber threats.  The NCUA’s Cyber Security Resources page includes helpful information that the agency believes will help credit unions strengthen their cyber security policies and programs.  The webpage includes sections on:

• Relevant NCUA regulations and guidance;
• Relevant federal requirements and guidelines;
• Information sharing forums on cyber threats;
• Best practices;
• Privacy and protecting personally identifiable information; and
• Other additional resources.

Chairman Matz didn’t stop with credit unions and other financial institutions.  She reiterated that in order for the system to be properly protected, merchants must be held to a higher standard.  NAFCU is in absolute agreement with Chairman Matz’s observation that data protection requirements for retailers are inadequate, and appreciates her strong call for tighter data security standards for retailers.

***

Free Kick. Next week brings another round of international friendlies.  Normally, I would be inclined to just brush them off and wait until club action resumes on the weekend, but this is a World Cup year.  Barring major injuries, little of what will happen during these friendlies will give us much new information regarding the globe’s top teams.  That being said, there are some intriguing fixtures on March 5.  Here are five matches that have piqued my interest:

• Colombia v. Tunisia (1:00 pm EST).  Those that have read my previous posts know that I was born in Colombia.  Anytime that Colombia takes the pitch, I am transfixed.  Outside of my usual devotion to the Cafeteros, I am particularly interested in seeing how Colombia begins to plot a strategy for playing without Radamel Falcao Garcia.  While there is still hope that Falcao will play in Brasil, Colombian manager Jose Pekereman will be looking to find attack options to take Falcao’s place should the striker’s knee not heal in time for the World Cup.
• Ukraine v. United States (2:00 pm EST).  The core of the U.S. Men’s National Team is pretty much set, but this match could go a long way in determining the last five or six spots on the roster.  With Jurgen Klinsmann set to use a primarily-European based squad, I’ll be keeping my eye on the battle for the last couple of defensive spots.  It’ll be interesting to see if Tim Ream, John Brooks, or Oguchi Onyewu can make a favorable impression.  Outside of the football, this match will be interesting to watch because of the political unrest that has engulfed the Ukraine (the match has been moved to Cyprus to protect the safety of all the players involved).  How will the Ukrainian players react, and will we see some inspired play from the highest-ranked team not heading to Brasil?
• Belgium v. Ivory Coast (2:45 pm EST).  Neither of these squads is going to catch anybody off-guard in Brasil, as they are extremely talented squads full of players from top European clubs.  Furthermore, both have their squads pretty much set.  What makes this match interesting is the off-the-pitch rivalry that is starting to boil over between Belgium’s top two keepers (Liverpool’s Simon Mignolet and Atletico Madrid’s Thibaut Courtois).  Mignolet has been vocal in his displeasure of being demoted to the back-up role by manager Marc Wilmots.  This has infuriated Courtois, and has led to an ongoing battle being fought in the press by both keepers and other members of the squad.
• Spain v. Italy (4:00 pm EST).  Anytime these European powerhouses face off, it’s a must watch fixture.  Each brings a distinctive style and flair to the pitch, and even in a friendly, it’s a pleasure to watch.
• Mexico v. Nigeria (8:30 pm EST).  El Trí endured their worst qualifying campaign in decades, yet they still find themselves heading to Brasil.  After a rocky 2013 that saw three different managers get sacked, I am intrigued to see if manager Miguel Herrera can put the pieces back together and form a squad that more closely resembles the Mexican national teams that we have been accustomed to seeing.  He has made some progress by getting some of the higher-profile players back into the squad, but there is still a lot of work left to do.

Lastly, with a little over 100 days left until the World Cup kicks off, ESPN has been kind enough to give us ample time to plan out our work and DVR schedules by releasing the television schedule for the entire tournament.

***

Webcast. Fair Lending: The Indispensable Essentials.

Save time on common conundrums; we’ll answer the most frequently asked Fair Lending questions NAFCU receives. Plus explore the fundamentals of Fair Lending and the recent rise of enforcement actions and litigation.  Register by Mar. 11 to save $100.

Guidance on BSA Expectations for Marijuana-Related Businesses...DOA

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

Folks have had quite a bit to say about the guidance FinCEN issued earlier this month (on Valentine’s Day no less), detailing Bank Secrecy Act (BSA) compliance expectations for financial institutions looking to bank marijuana-related businesses. There have been some real gems on this issue on the Bank Lawyer’s Blog, my favorite blog for a daily fix of dark humor and extreme sarcasm, here and here.

Nobody has anything nice to say about this guidance – don’t worry, neither do I – but I may feel slightly sympathetic towards FinCEN and the banking regulators on this issue. They are a convenient target for potshots (pun intended), but they are in a bit of a spot.  After all, it remains illegal under federal law to manufacture, distribute, or dispense marijuana, and no amount of guidance they issue can solve that problem.

Although FinCEN’s guidance purports to “enhance the availability of financial services” for marijuana-related businesses, the BSA compliance headache of maintaining these accounts is not a hassle I’d be willing to take on – not based on FinCEN’s guidance, and certainly not based on concurrent enforcement guidance issued by Deputy Attorney General James Cole.  I say this based on many years of working BSA in a credit union, and knowing just how much time and effort goes into running a BSA compliance program day-in and day-out.  (Shout out to my peeps at the credit union – you know who you are!)

In addition to the due diligence you would expect, like making sure the business is duly licensed, obtaining an understanding of the expected account activity, monitoring for suspicious activity, etc., due diligence also needs to include an assessment of whether the business implicates a “Cole Memo priority.”  Essentially, because enforcement resources are limited, these “priorities” are the current areas of focus for Department of Justice attorneys and law enforcement to consider “with respect to federal money laundering, unlicensed money transmitter, and BSA offenses predicated on marijuana-related violations of the Controlled Substances Act.”  They include:

• Preventing the distribution of marijuana to minors;
•  Preventing revenue from the sale of marijuana from going to criminal enterprises, gangs, and cartels;
• Preventing the diversion of marijuana from states where it is legal under state law in some form to other states;
• Preventing state-authorized marijuana activity from being used as a cover or pretext for the trafficking of other illegal drugs or other illegal activity;
• Preventing violence and the use of firearms in the cultivation and distribution of marijuana;
• Preventing drugged driving and the exacerbation of other adverse public health consequences associated with marijuana use;
• Preventing the growing of marijuana on public lands and the attendant public safety and environmental dangers posed by marijuana production on public lands; and
• Preventing marijuana possession or use on federal property.

Absent some obvious clue, figuring out if a marijuana-related business implicates one of these priorities could require a lot of investigation, and the last time I checked, investigating criminal activity was a law enforcement function.  Haven’t we been told repeatedly that investigating alleged criminal activity reported on Suspicious Activity Reports (SARs) is the job of law enforcement, not the financial institution?

From FinCEN Guidance FIN-2012-G002:

“FinCEN continues to reiterate that institutions are not responsible for investigating the underlying suspected (or alleged) crime; investigations remain the responsibility of law enforcement. Institutions are responsible for reporting the information they know at the time they conclude that suspicious activity is present.”

Yeah, I thought so.

So what’s the real risk here? Well, enforcement priorities can change at the drop of a hat, and marijuana-related activities remain illegal at the federal level.  This excerpt from the February 14, 2014 Cole memo is warning enough for me:

“Additionally, financial institutions that conduct transactions with money generated by marijuana-related conduct could face criminal liability under the BSA for, among other things, failing to identify or report financial transactions that involved the proceeds of marijuana-related violations of the CSA. See, e.g., 31 U.S.C. § 5318(g). Notably for these purposes, prosecution under these offenses based on transactions involving marijuana proceeds does not require an underlying marijuana-related conviction under federal or state law.

[…]

Therefore, in determining whether to charge individuals or institutions with any of these offenses based on marijuana-related violations of the CSA, prosecutors should apply the eight enforcement priorities described in the August 29 guidance and reiterated above. ¹ For example, if a financial institution or individual provides banking services to a marijuana-related business knowing that the business is diverting marijuana from a state where marijuana sales are regulated to ones where such sales are illegal under state law, or is being used by a criminal organization to conduct financial transactions for its criminal goals, such as the concealment of funds derived from other illegal activity or the use of marijuana proceeds to support other illegal activity, prosecution for violations of 18 U.S.C. §§ 1956, 1957, 1960 or the BSA might be appropriate. Similarly, if the financial institution or individual is willfully blind to such activity by, for example, failing to conduct appropriate due diligence of the customers’ activities, such prosecution might be appropriate. Conversely, if a financial institution or individual offers services to a marijuana-related business whose activities do not implicate any of the eight priority factors, prosecution for these offenses may not be appropriate.” (Footnote omitted) (My emphasis added).

I’ve only touched on the due diligence issue here, so definitely give FinCEN’s guidance a read in its entirety. Also note that the burden of filing BSA reports on marijuana-related businesses – Currency Transaction Reports (CTRs) and SARs – is not lessened at all, and is in fact increased.  Marijuana-related businesses are not eligible for exemption from CTR reporting requirements and there are three new SAR filings to deal with – “Marijuana Limited,” “Marijuana Priority,” and “Marijuana Termination.” What more can I say…fun times.

****

On a lighter note, at least one enterprising kid is putting the pot munchies to good use – what better place to sell cookies than outside a medical marijuana dispensary?  All I have to say is …location, location, location!

Risk-Based Capital: Individual Minimum Capital Requirements

Written by PJ Hoffman, Regulatory Affairs Counsel

Risk-Based Capital. As I am sure you have seen by now, on January 23, 2014, the NCUA Board issued a proposed rule regarding risk-based capital for credit unions. Without a doubt, risk-based capital is at the forefront of the mind of every credit union’s board, CEO, senior management, and compliance officers. The potential impact of this proposed rule cannot be understated. NAFCU has and will continue to advocate on behalf of our members regarding this rule.

With that in mind, we are launching a recurring series of posts where NAFCU’s Compliance Blog will break down different portions of NCUA’s proposed rule regarding risk-based capital and give a more detailed analysis and explanation than we have in our Regulatory Alert.  Today’s topic is Individual Minimum Capital Requirements.

The proposed rule includes a provision in proposed § 703.105 where NCUA may require a higher minimum risk-based capital ratio for an individual credit union in any case where the circumstances, such as the level of risk of a particular investment portfolio, the risk management systems, or other information, indicate that a higher minimum risk-based capital requirement is appropriate. This means that NCUA may establish increased individual minimum capital requirements upon its determination that the credit union’s capital is or may become inadequate in light of the credit union’s circumstances regardless of the actual risk-based capital ratio of the credit union.

In other words, an examiner can increase a credit union’s individual risk-based capital requirement by subjective action during an examination or “supervisory assessment” based solely on the determination of the examiner that the credit union needs additional capital based on the credit union’s balance sheet risk. There are a number of problematic elements to this new proposed NCUA power.

First, NAFCU is seriously concerned about the legal authority of NCUA examiners to decide on their own the material risks not accounted for in the statutory floor prescribed by the Federal Credit Union Act (FCU Act). The Credit Union Membership Access Act (CUMAA) amended the FCU Act to require the NCUA to take into account material risks that are not accounted for in the statutory floor. This is part of their rules for complex credit unions and is something that can and should be taken in to account when NCUA rules are written, but not on a case by case basis and certainly not by examiners in the field. This is all the more reason why we need a legislative solution rather than the current proposed rule.

Finally, this regulation undermines the entire purpose of the rule. On one hand, the NCUA is saying that the risk weights are designed specifically to factor in a number of risks including concentration risk, interest rate risk, credit risk, market risk, operational risk, and liquidity risk. On the other hand, if the NCUA decides that their risk-based capital ratios don’t do what they are designed to do, then the NCUA can just change the rules for an individual credit union on the fly. Also, the arbitrary and subjective judgment of the examiner can differ from credit union to credit union and examiner to examiner. How are credit unions supposed to look at their portfolio and adhere to the standards laid out in the rule with a constantly moving set of rules?

Just a reminder to folks who haven’t yet seen it, NAFCU’s Capital Reform Issue Page is up and running with great resources such as NAFCU’s Regulatory Alert on NCUA’s proposed rule regarding risk-based capital. If your credit union hasn’t submitted a comment to NAFCU, I encourage you to do so here. The more we know about how the rule affects your credit union, the better advocates we can be for you.

Thank you and lookout for more in-depth looks at part of NCUA’s proposed rule regarding risk-based capital. 

NIST Releases Cybersecurity Framework; Risk-based Capital Rule; NCUA Board Meeting Agenda

Written by Brandy Bruyere, Regulatory Compliance Counsel

Today we will broadly overview the National Institute of Standards and Technology’s (NIST) “Framework for Improving Critical Infrastructure Cybersecurity” (Framework) which was released last week. This is voluntary guidance, developed under Executive Order 13636, which aims to provide “a set of industry standards and best practices to help organizations manage cybersecurity risks.”  Because risk management is an ongoing process that involves “identifying, assessing, and responding to risk,” the Framework is meant to be flexible and address a broad spectrum of cybersecurity risks. The Framework is divided into three main sections: Framework Core, Framework Profile, and Framework Implementation Tiers.

The Framework Core (Core) describes key cybersecurity activities and informative resources that are current industry standards and practices. The Core includes five “Functions”: Identify, Protect, Detect, Respond, and Recover. These Functions are further broken down into Categories such as “Asset Management,” “Data Security,” and “Detection Processes.” The Categories are further segmented into Subcategories that describe specific outcomes such as “Notifications from detection systems are investigated.” Overall, the Functions are intended to “provide a high-level, strategic view of the lifecycle of an organization’s management of cybersecurity risk.”

The Framework Profile (Profile) addresses the cybersecurity outcomes based on the Categories and Subcategories that the organization selected from the Core Functions. The Profile is designed to help organizations “establish a roadmap for reducing cybersecurity risk.” The Profile allows organizations to align and prioritize their particular cybersecurity risks with the characteristics of their own business requirements, risk tolerances, and resources.

The Framework Implementation Tier provides a method for organizations to contextualize and understand their approach for managing cybersecurity risk. There are four Tiers that represent different degrees of processes in place and levels of integration into overall risk management plans—Tier I (Partial), Tier II (Risk Informed), Tier III (Repeatable), and Tier IV (Adaptive). Organizations should select Tiers based upon factors such as the organization’s goals, the feasibility of implementation, the reduction of cybersecurity risk, and available resources.

The Framework is rather complex but intended to be flexible given the diversity of the different organizations that provide critical infrastructure. While this guidance is voluntary, it may be useful to credit unions in managing cybersecurity risk, particularly as this is a risk area that is part of NCUA’s Supervisory Focus for 2014. For more information on cybersecurity risk, check out this NAFCU blog post.

***

Risk-based Capital—Just a reminder to folks who haven’t yet seen it, NAFCU’s Capital Reform Issue Page is up and running with great resources such as NAFCU’s Regulatory Alert on NCUA’s proposed rule regarding risk-based capital. If your credit union hasn’t submitted a comment to NAFCU, I encourage you to do so here. The more we know about how the rule affects your credit union, the better advocates we can be for you.

 ***

 NCUA Releases Agenda for Tomorrow’s Board Meeting—NCUA will consider a Proposed Rule to amend Part 710, Voluntary Liquidations of Federal Credit Unions as well as the Share Insurance Quarterly Report.

 ***

Webcast: Post Mortem Panel: Qualified Mortgages and Ability-to-Repay

New Ability-to-Repay and Qualified Mortgage requirements took effect January 10. Our panel of compliance gurus will discuss the best examples of implementation so far.  Register by Mar. 4 to save $100 and utilize these best practices in your own compliance efforts.

Palate Cleanser

This photo appears to be of a dog enjoying the snow. However, I can assure you that Lemmy is actually making a desperate escape after realizing he had been duped into standing in fourteen inches of snow.

 

                       

A Regulatory Romantic Friday- NCUA Updates Share Insurance Estimator and Brochures; Chairman Matz holds Townhall Webinar

Written by Alicia Nealon, Regulatory Compliance Counsel

Happy Valentine’s Day Compliance Community! In the Valentine's Day of Hallmark’s fantasies, we’d be showered in roses, candy, cards, and assorted heart-shaped items. But our realities may be decidedly less romantic. Well if Cupid passed you by this Valentine’s Day, don’t worry- NCUA has issued some of its own “love letters” in the last few weeks.

First, in January NCUA announced a redesigned version of the E-Calculator, now called the Share Insurance Estimator, which allows credit union members to calculate share insurance coverage and ask questions. It still serves the same function as the previous Calculator, but now allows credit union members to fill out information while consulting reference materials, among other improvements to navigability and content. 

Second, in early February, the agency released a revised version of its booklet Your Insured Funds, which NCUA says presents the latest share insurance coverage information in a new, easy-to-read format helpful to credit unions as well as their members. The updated booklet, 61 pages long, explains how credit union members’ accounts are covered by the National Credit Union Share Insurance Fund. NCUA also publishes a briefer, six-panel brochure, How Your Accounts are Federally Insured, which gives the highlights of account coverage. Both can be downloaded online or ordered via the mail and telephone. To order these resources, complete the order form available here or call (703) 518-6340.

Finally, on Wednesday, NCUA Chairman Debbie Matz hosted a Townhall webinar with CFPB Director Richard Cordray, during which time she stressed how seriously the agency considers feedback on proposed rules. Specifically addressing the agency’s proposed rule on risk-based capital, Chairman Matz acknowledged the various concerns surrounding the rule, such as its individual minimum-capital requirements. She discussed that NCUA sometimes revises its rules between the proposed stage and the final rule and that the agency will take a hard look at credit unions’ concerns as the capital proposal moves forward. In addition to raising concerns about the proposal, NAFCU has completed a Regulatory Alert on the proposed rule and is currently taking comments from our members.

If all these goodies from NCUA aren’t enough to satisfy the regulatory romantic in all of us this Valentine’s Day, I will close with this thought (that will likely get me laughed out of the office, but alas, if you can’t be corny on Valentine’s Day- when can you be??)

Roses are red,

Violets are Blue,

We here at NAFCU simply LOVE YOU!

***

If you like what you read here, consider signing up for Anthony Demangone’s blog on management and leadership – Musings from the CU Suite. Anthony is an NCCO and used to head up Compliance at NAFCU.  You can visit the blog here, or sign up to have it delivered via email.

***

Programming Note.  NAFCU’s offices will close today at noon for the President’s Day holiday and will reopen on Tuesday, February 18^th.  We will be back to blogging on Wednesday, February 19^th.

FHA Makes Positive E-Signatures Change; Free Kick; ERM Webcast

Written by Ricardo Piñeres, Regulatory Compliance Counsel

With all of the new compliance requirements that have accompanied the start of 2014, it is easy to get trapped in a vortex of negativity.  Credit unions are struggling to keep up with the growing regulatory burdens, and many in our industry have suggested that instead of just adding new regulations, regulators should be looking to modernize some of their more outdated requirements.  Well, for those that have been clamoring for a step in the direction of modernity, I bring good news.  At the end of last month, the FHA announced that it would finally expand the list of documents for which it will accept electronic signatures!

Prior to this announcement, FHA only accepted e-signatures on third-party documents (i.e. sales contracts and other documents not under the lender’s control).  In addition to third-party documents, the new policy states that e-signatures are valid on the following documents:

• Origination;
• Servicing;
• Loss mitigation;
• FHA insurance claims;
• REO sales contracts; and
• Related addenda.

Lenders that choose to accept e-signatures may begin taking advantage of the FHA’s new policy immediately on both single family forward mortgages and reverse mortgages.  For the time being, the FHA will not be accepting e-signatures on the mortgage note, itself.  It is expected that they will begin accepting e-signatures on forward mortgage notes by the end of the year.

In order to take advantage of the FHA’s new policy, all lenders that submit electronically-signed documents must have specific technology and operational capabilities and controls, documented quality control processes, and the ability to adapt the electronic signature to FHA’s existing record retention processes.  Furthermore, any lender that chooses to take advantage of the FHA’s new policy must still comply with all of the requirements of the E-SIGN Act.  For more information on the requirements, credit unions should view FHA’s Mortgagee Letter 2014-03.

While this may not do much to ease the ever-growing regulatory burden on credit unions, it is heartening to see a government entity seeking to improve its processes.  I applaud the FHA for making it easier for lenders to work with them, and hope that they continue to streamline their processes.  Not only will this help lenders, but ultimately, it will help consumers seeking to take advantage of the FHA’s products.

***

Free Kick. I am in the middle of a tense two weeks.  As a die-hard supporter of Arsenal, the schedule has put together a string of fixtures that will either make or break the Gunners’ season.  If Arsene Wegner and Company can survive these two weeks, then maybe I can dream of an end to the trophy drought.

Sadly, things did not get off to a good start over the weekend.  The drubbing at Anfield saw Arsenal play its worst game of the season (excluding the league opener to West Ham).  While Liverpool has been firing on all cylinders, I’m hoping that the embarrassment of this past weekend will fuel Arsenal to seek some revenge and move into the FA Cup Quarterfinals when they host Liverpool on Sunday.

Turning to the Premier League, thankfully, Chelsea dropped two points to West Bromwich in the waning minutes of yesterday’s match.  Therefore, Arsenal can go back to the top of the Premier League with a win later today against Manchester United.  ManU, frankly, has been mediocre to start 2014, so Arsenal need all three points if they are to truly contend down the stretch.

Lastly, the knockout stages of the UEFA Champions League get underway next week.  Arsenal was unable to win their group in the fall, so they have drawn Bayern Munich.  This is a repeat of last year’s Round of 16 matchup.  While Arsenal is a much improved squad this season, I see a similar result in our future with Bayern Munich coming away with a close win over the two-legged contest.

Hopefully, the loss to Liverpool at Anfield was just an aberration, and I can continue to dream of a trophy or two!  Go Gunners!

***

Webcast. Enterprise Risk Management (ERM) – Practical Ways to Implement at Your Credit Union.

Does ERM really differ from normal risk management? Yes! ERM allows you to leverage the risk-return relationship in everything from project management to strategic planning. Register by Feb. 27 to save $100 and learn how to make your credit union more effective.

Consumer Compliance Outlook – Government Monitoring Information Requirements under the HMDA and the ECOA; CFPB to Start Looking at Potential Changes to HMDA Information Reporting; NAFCU Regulatory Compliance School

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

Consumer Compliance Outlook. The Fourth Quarter 2013 issue of the Federal Reserve’s Consumer Compliance Outlook is now available. Articles in this issue include:

• Government Monitoring Information Requirements under the HMDA and the ECOA

• Overview of E-Banking Compliance Considerations

• Dodd-Frank Act Mortgage Regulations

One of the topics we receive a lot of compliance questions on is the collection of government monitoring information (GMI) under HMDA/Regulation C and ECOA/Regulation B.  This area is particularly tricky because the types of mortgage loans subject to each rule, and the information that must be collected under each rule, differ.  Regulation B, section 1002.5, generally prohibits inquiring about the “race, color, religion, national origin, or sex of an applicant or any other person in connection with a credit transaction,” except as specifically permitted by Regulation B, or except as specifically required – e.g., Regulation B, section 1002.13(a), Regulation C, section 1003.4(a)(10), etc.

All this complexity leads to a couple of common compliance violations in this area –not collecting information when you should, or collecting information when you shouldn’t.  The article in this issue of the Consumer Compliance Outlook on Government Monitoring Information Requirements under the HMDA and the ECOA provides an excellent summary of the requirements under HMDA and ECOA, and includes a handy comparison chart of the two.  It’s a great refresher for anyone who wants to brush up on these requirements and a great tool to pass on to your mortgage folks.

***

CFPB to Look at HMDA Information Reporting Requirements. Speaking of HMDA, the CFPB announced that it is beginning to look at potential changes to HMDA reporting requirements and is convening a panel as required under the Small Business Regulatory Enforcement Fairness Act (SBREFA). Some of the additional reporting requirements under consideration are mandated by Dodd-Frank; however, the CFPB is considering additional changes as well – such as requiring institutions to include an explanation of rejected loan applications. From the press release:

“Potential changes under consideration by the Bureau include:

• Improvements required by Dodd-Frank: In the Dodd-Frank Act, Congress directed the Bureau to update HMDA regulations by having lenders report specific new information that could alert regulators to potential problems in the marketplace. This includes: the length of the loan; total points and fees; the length of any teaser or introductory interest rates; and the applicant or borrower’s age and credit score.

 

• New developments in the market: The Bureau is considering additional information that would give regulators a better view of developments in all segments of the housing market. The Bureau is considering asking financial institutions to include more underwriting and pricing information, such as the interest rate, the total origination charges, and the total discount points of the loan. This will help regulators investigate the true trouble spots in the mortgage market.

 

• Monitoring access to credit: The Bureau is considering new requirements that would more accurately capture access to credit in the mortgage market. The Bureau is considering requiring institutions to include an explanation of rejected loan applications. The Bureau is also considering including whether the lender considered the loan to be a “Qualified Mortgage.” Qualified Mortgages are loans that meet certain criteria under the CFPB’s Ability-to-Repay rule and offer extra protections for consumers. Including QM status in HMDA data will help regulators and the public determine how the CFPB’s rules are impacting the mortgage market. Additional information, such as the borrower's debt-to-income ratio, will help regulators see whether financial institutions are making loans that are expensive or unsuitable for borrowers.”

This CFPB factsheet lays out the changes being considered.  The CFPB has made available this outline of proposals and list of questions on which it will seek input from the SBREFA panel.

Finally, the CFPB also announced a new HMDA tool available to the public for tracking public mortgage data.

***

Shameless Plug! Our 2014 Regulatory Compliance School is just one month away, but there’s still time to register! It’s like a comprehensive “boot camp” for compliance staff, with the chance to earn the respected title of NAFCU Certified Compliance Officer (NCCO). The program also includes a “Regulatory Update Day” – a roundup of current compliance topics and issues. If you’ve already registered, make sure to take advantage of the NAFCU discounted hotel room rate by February 14.

CFPB Releases Winter 2013 Edition of Supervisory Highlights; Time-Out

Written by JiJi Bahhur, Director of Regulatory Compliance

Recently, the Consumer Financial Protection Bureau (CFPB) released its winter 2013 edition of Supervisory Highlights, a report highlighting issues it uncovered through its supervision program during a specified period of time.   The winter edition includes supervision work completed between July and October 2013, and highlights problems like unfair and deceptive practices in the mortgage servicing market. 

In this edition of the Supervisory Highlights, the CFPB made it a priority to address mortgage servicing problems so that servicers can make necessary changes and prepare for compliance with the new mortgage servicing rules.  The new rules, which went into effect on January 10, 2014, require servicers to maintain accurate records, give troubled borrowers direct and ongoing access to servicing personnel, promptly credit payments, and correct errors on request.  The rules also provide strong protections for homeowners facing foreclosure. 

The CFPB’s press release summarizes some of the items that mortgage servicers were cited for, specifically relating to the ban on unfair, abusive or deceptive acts and practices.  These include: 

• “Unfair practices with servicing transfers: The rights to manage a loan are frequently bought and sold among servicers. Examiners found that two servicers engaged in unfair practices by failing to honor existing permanent or trial loan modifications after a servicing transfer, which resulted in borrowers being charged the wrong amount or being told to pay the wrong amount.

 

• Waiving consumer rights: CFPB examiners found that two servicers were requiring borrowers to waive any existing claims in order to get a forbearance or loan modification agreement. The examiners found these broad waiver clauses to be unfair as they were done without regard to individual circumstances.

 

• Poor payment processing: Servicers are responsible for processing loan payments and handling tax and insurance payments through escrow accounts. Examiners found that a servicer was marketing bi-weekly payment plans and misrepresenting how the plans worked. As a result, consumers did not save money the way they thought they would. Another servicer told some borrowers they would receive refunds from their escrow accounts, when in fact they would not.

 

• Failing to provide correct information to consumer reporting agencies:  Mortgage servicers generally provide data to consumer reporting agencies.  CFPB examiners found cases where servicers were misreporting short sales as foreclosures, which have a much more negative impact on a consumer’s      ability to get certain types of credit.”

Companies that were cited for the above violations were notified and required to take remedial measures.  In certain instances, the CFPB opened investigations for potential enforcement actions.

Even though the CFPB only supervises credit unions with total assets of more than $10 billion, the Supervisory Highlights can serve as a useful tool for credit unions of all sizes.  Why you ask?  The credit union can check their current practices and make necessary adjustments to potentially avoid scrutiny from their applicable examining agency, at least on those particular issues. 

***

It’s Friday!  And even better, the weekend has arrived.  I like to take this time to try to take a time-out from compliance land.  Speaking of time-outs, my husband and I have attempted to implement “time-out” with our 17-month old son because he loves to pull his twin sister’s hair, steam roll her, use her as a bench, etc.  Last weekend, my son, Kyse, decided he wanted to break the blinds in the living room, which he successfully did.   Before my husband or I could even say anything, Kyse immediately ran to the time-out chair and sat down like it was common procedure.  I’m pretty sure both of our jaws hit the ground; we had to walk away quickly because we both were about to burst out into laughter.

Have a great weekend!

What's the Deal with Derivatives?

Written by Brandy Bruyere, Regulatory Compliance Counsel

After gathering comments in the rulemaking process and a lengthy pilot program, the NCUA Board finalized the derivatives rule in January. This rule allows qualified credit unions to trade in certain derivatives for the purpose of mitigating (i.e. “hedging”) interest rate risk (IRR). The rule is complex, so this blog post will only provide a very broad overview of the rule in terms of what is a derivative, which credit unions can trade in them, and how a credit union can receive approval to trade.

First, what is a derivative? NCUA defines a “derivative” as:

“…a financial contract which derives its value from the value and performance of some other  underlying financial instrument or variable, such as an index or interest rate.”

It is also helpful to remember that “derivative” is a catch-all term used to describe several kinds of contracts such as futures, options, and swaps. For a more detailed discussion of derivatives, check out this NAFCU blog post.

While the derivatives world can include many “exotic” instruments, NCUA limited credit unions to a handful of products:

• Interest rate swaps
• Basis swaps
• Interest rate caps
• Interest rate floors
• U.S. Treasury note futures

NCUA further limited credit unions’ use of derivatives by requiring that these derivatives have particular characteristics. For example, the derivatives must serve the purpose of mitigating IRR. Also, the maximum maturity for most derivatives is fifteen years (ten years for U.S. Treasury note futures). Credit unions also cannot invest in collective investment funds that invest in derivatives that are purely speculative—meaning, the derivatives do not hedge any real-world risk.

Second, which credit unions can trade in derivatives? In order to be eligible to use derivatives, a credit union must have at least $250 million in assets and its most recent CAMEL rating must be 1, 2, or 3, with a management component of 1 or 2. Credit unions who do not meet these two requirements but would like to utilize derivatives may request permission from their field director.

Third, how does a credit union receive permission from NCUA to mitigate IRR with derivatives? The rule sets forth a two-step process:

    1.    The credit union must create an IRR mitigation plan and submit the plan to NCUA. Key components of this plan include:

• An explanation of how derivatives fit into the credit union’s IRR plan, including demonstrating a need for derivatives and a justification and statement of use for each derivative product the credit union plans to use;
• A discussion of the credit union’s capacity to manage derivatives and how it plans to acquire the resources required by the regulations such as experienced staff, proper management and internal controls, a legal review, and the necessary policies and procedures.

    2.    After receiving the IRR mitigation plan, NCUA will evaluate the credit union on its actual readiness to trade in derivatives based on the credit union’s personnel, controls and systems in place. Credit unions that are new to derivatives and approved must operate safely for one year under “limited authority” before NCUA will grant full trading authority.

The rules are rather complex and address ongoing regulatory requirements such as limits on the amount of derivatives contracts a credit union can hold and penalties for rule violations. Also, in a move urged by NAFCU, NCUA removed the “pay to play” provision which appeared in the original rule and would have charged credit unions fees to use derivatives. NAFCU members can expect a Final Regulation from NAFCU sometime soon which will provide further details about this rule.

***

Winter Weather—With snow in the South and the polar vortexes freezing out much of the country, January was a crazy month for weather. This became a problem for our dog and his “morning ritual.” I would open my back door and he would glare at me, offended that I would ask him to go outdoors in a -8 degree wind-chill. This became a battle of wills, because while mastiffs are generally gentle and loveable, they have quite the stubborn streak. So, we compromised with our spoiled dog:

CFPB’s Updated Educational Brochures; NAFCU Webcast-TILA/RESPA Series

Written by Alicia Nealon, Regulatory Compliance Counsel

Well it’s Monday and we all know what that means for compliance professionals- it’s time to sit down and write our “to-do” lists for the week (or for the uber-efficient among us, time to start tackling some of those tasks). If I had to guess, complying with the CFPB’s new mortgage requirements has been a high priority on many of our lists. And while many are still trying to get their ducks in a row so they can check something off their list, even more items keep making their way on to the ever-growing list.  

For those that are delving into their lists today, I wanted to make mention of the CFPB’s recently-released educational brochures in case you missed them. We’ve received some questions or concerns regarding these brochures and thought we’d remove researching these questions from everyone’s “to-do” lists by providing clarity to the concerns that have been brought to our attention.

In January, the CFPB updated the educational brochures that lenders are required to provide consumers at the time of certain loan applications. Specifically,

• Regulation X requires credit unions to give members applying for mortgages a special information booklet entitled “Shopping for Your Home Loan: Settlement Cost Booklet” within 3 business days after receiving the application;
• Regulation Z requires credit unions to provide members applying for an adjustable rate mortgage with the booklet titled “Consumer Handbook on Adjustable-Rate Mortgages (CHARM) Booklet,” or a suitable substitute; and 
• Regulation Z also requires members getting a home equity line of credit receive the home equity brochure entitled “What You Should Know about Home Equity Lines of Credit (HELOC) Brochure” or a suitable substitute.

 There have been some cost-concerns regarding whether these updated brochures mean credit unions cannot use older versions of required educational materials that they have already paid to have printed. Fortunately, there is some good news this Monday morning. When the CFPB published the updated brochures in the Federal Register, it advised that lenders may use earlier versions until existing supplies are exhausted.  Specifically, the CFPB wrote:

“Those who provide these publications may, at their option, immediately begin using the revised HELOC Brochure, CHARM Booklet, or Settlement Cost Booklet, or suitable substitutes to comply with the requirements in Regulations X and Z. The Bureau understands, however, that some may wish to use their existing stock of publications. Therefore, those who provide these publications may use earlier versions of these publications until existing supplies are exhausted.”

However, for those credit unions that have just been printing brochures from the HUD website on an “as needed” basis, the CFPB requires that you start printing from its website instead.

While these updated brochures provide helpful materials, many of us are still left with just one more thing to add to the list – another change to the already voluminous number of regulatory changes that are affecting the industry. With regulators rolling out so many changes in such a short period of time, you really have to ask yourself: when will enough be enough?

***

Webcast:  Looking for help to understanding the new mortgage requirements? Check out our upcoming webcast-  TILA/RESPA Series Part 1 – An Overview. Don’t start preparing at the last second for new regulations requiring you to combine your TILA and RESPA disclosures. Register by Feb. 19 to save $100 and learn the details you need.