NAFCU Compliance Blog

CFPB's Payday Lending Field Hearing Signals More Regulation To Come

Written by Eliott C. Ponte, Law Clerk

Last week the CFPB released a payday lending report while holding a Payday Field Hearing in Nashville, Tennessee.  Richard Cordray personally announced the report, which built on a previous CFPB white paper, and made the case that short-term loans are not short-term. 

After conducting a yearlong study that involved 12 million payday borrowers, the CFPB found that four out of five payday loans are rolled over or renewed within fourteen days.  The report, which can be found here, also noted that three out of five payday loans are made to borrowers whose fee expense exceeded the amount borrowed, three out of five payday borrowers rolled the payday loan over at least seven times, and cooling-off laws (enacted by state legislatures) have little influence over whether a borrower takes out another payday loan.

While Congress charged the CFPB with ensuring financial markets are fair and transparent for consumers, it is clear that the CFPB is trying to show everyone—especially Congress—that payday lending justifies more regulation and more CFPB power.  

The CFPB’s Payday Field Hearing is a signal that the CFPB is also likely preparing to release new regulations aimed at curbing the practices mentioned above.  It is unlikely that any regulations will exempt smaller payday lenders, as the report seems to blame the entire industry rather than a subset of lenders.

Regular NAFCU Compliance Blog readers will note that we have been monitoring and updating our community on the CFPB’s efforts for some time, and we will continue to provide you with updates as this continues to unfold.  

Five “Great Points” from NAFCU’s 2014 Regulatory Compliance School; Congrats, Class of 2014; Shameless Plug

Written by JiJi Bahhur, Director of Regulatory Compliance

From March 10-March 15, 2014, NAFCU held its annual Regulatory Compliance School in National Harbor, Maryland.  In attendance were numerous credit union industry professionals, including compliance officers, CEOs, marketing managers, attorneys, auditors, examiners, vendors and more!

Throughout the week, we had great questions both during and after the sessions.  And in some instances, we caught ourselves having an “uh-huh” moment because the presenter or attendee shared a great point that either clarified something we weren’t so sure about in the past or that put something on our radar.

Today, I’d like to share some of those moments with you:

Great Point #1:  Can the credit union send remittance transfer disclosures – both the prepayment disclosure and the receipt (or combined disclosure) – electronically?  Yes.  If the member requests the remittance transfer electronically, the prepayment disclosure can be sent electronically even where the Electronic Signatures in Global and National Commerce Act (E-SIGN Act) requirements are not met.  However, the receipt (or combined disclosure) may be sent electronically only if the E-SIGN Act requirements are met.

Great Point #2:  A number of our presenters discussed the importance of definitions.  In fact, we heard it a number of times:  “Read the definitions section of the regulation!”  Why?  The definition may be different than what you’re expecting depending on what regulation you’re dealing with.  Unfortunately, definitions are not consistent from regulation to regulation.

Great Point #3:  For open-end (not home-secured) credit, the credit union must provide 45-day advanced notice for changes to any terms required to be disclosed in the account opening disclosures.  On the model form provided by Regulation Z, there is language that states “for more information, see the enclosed booklet.”  If your credit union doesn’t have an enclosed booklet, it’s probably a good idea to remove that language!

Great Point #4:  Under Regulation E, can the credit union require the member to obtain a police report when the member reports a fraudulent transaction(s)?  No.  The credit union can request a police report, but it cannot require a police report.  Also, in a situation where the member provides oral notice of fraud, the credit union can require a member to follow up an oral notice with written notice (CU must inform member of this requirement and provide an address), but the credit union cannot delay its investigation. 

Great Point #5:  With advances in technology, it has become less clear as to where the NCUA advertising logo or official advertising statements are required.  Is it required on ATMs?  How about mobile banking?  Video teller machines?  NCUA has stated that ATMs are exempt from the NCUA logo requirement.  However, it is less clear as to whether the logo or official advertising statement are required for purposes of mobile banking and video teller machines.  It may be time for NCUA to take a look at its advertising rule to address these technological advances. 

***

Congratulations to the Class of 2014 - it was truly a pleasure to spend the week dissecting both the existing and future regulations of the credit union industry with so many of you.  Even better, a number of attendees walked away with their NAFCU Certified Compliance Officer (NCCO) designation.  Again, congratulations!  What an accomplishment!  And, here is the Class of 2014 . . .

***

Shameless Plug.  NAFCU’s 2014 Credit Union Compliance GPS is available for purchase! This comprehensive, electronic resource translates complex regulatory language into plain English. The latest edition includes an expanded section on Reg E and the Remittance Transfer Rule, 7 new sections on the CFPB’s mortgage rules, improved user-friendly search functions, including more hyperlinks and bookmarks and much more. Get yours today!

CFPB Testing Prepaid Card Disclosures; NCUA Listening Sessions, Financial Literacy Webinar

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

Prepaid Cards. Last week, the CFPB blogged about a couple of model prepaid card disclosures (Model Form 1 and Model Form 2) currently being tested with consumers. In its blog post, the CFPB provides examples of some of the current prepaid card disclosures out in the market, and suggests that the different styles and formats could make it difficult to find and compare important disclosure information.

The CFPB has had prepaid cards on its radar for some time.  Back in May 2012 we blogged about a CFPB Advance Notice of Proposed Rulemaking (ANPR) seeking comments and information from the public about general purpose reloadable prepaid cards. The CFPB intends to issue a proposed rule later this spring addressing consumer protections for prepaid cards, including standardized disclosures.

***

NCUA Listening Sessions. Online registration is now open for NCUA listening sessions taking place this summer in Los Angeles, Chicago and Alexandria, Va. NCUA Chairman Debbie Matz and Board Member Rick Metsger will attend the sessions. The sessions provide an opportunity for credit union officials to discuss any topics related to the NCUA and are scheduled to take place before NCUA’s proposed risk-based capital rule is finalized. Registration is free, but space is limited and on a first-come, first-served basis.  Click here to register.

***

Financial Literacy Webinar.  NCUA is also hosting a free webinar on how credit unions can promote financial literacy.  Topics to be covered include: the link between financial literacy and the credit union mission; NCUA financial literacy resources; tips on building a successful financial literacy program based on credit union size and specialized member demographics; information about improving financial literacy efforts through the creation of key local and national financial literacy partnerships; and the Treasury Department’s recent financial literacy pilot research program.

This free webinar will be held on Thursday, April 3, 2014, at 2 p.m. EDT.  Register here. 

Participants may submit questions in advance at [email protected]. The subject line of the email should read “Financial Literacy Webinar.”

D.C. Circuit Decision is a Big Win in the Debit Interchange Battle; Free Kick; Two Helpful Webcasts

Written by Ricardo Piñeres, Regulatory Compliance Counsel

Friday was supposed to be a quiet day for the NAFCU Compliance Department, but the U.S. Court of Appeals for the D.C. Circuit had other plans for us.  The court released its opinion in the debit interchange case (NACS v. Board of Governors of the Federal Reserve System) Friday morning, and lots of us at NAFCU spent Friday reading and analyzing the opinion so that we could give you the most important information.  Judge David Tatel, writing for the three-judge panel that also included Judges Harry Edwards and Stephen Williams, penned a concise 38-page opinion that largely overturned Judge Richard Leon’s District Court ruling from last year that had favored the merchants.

 

Interchange Fee

The bulk of the opinion is spent dissecting whether or not the Federal Reserve properly exercised its power in interpreting the Durbin Amendment and whether or not the costs that the Federal Reserve included in its interchange fee calculation were reasonable to include in the fee, as per the legislative language.  After going through several levels of legal and grammatical analysis, the court held that the Federal Reserve crafted a rule that largely fell within the constructs of the Durbin Amendment.

Judge Tatel spent several pages discussing the modern legal theories regarding legislative construction and the important role that punctuation plays in determining the intent of the legislature.  The outcome of this analysis was the key to the opinion’s decision on interchange fees.  If the panel agreed with the lower court ruling and the merchants’ reading of the Durbin Amendment’s language and grammar, then the Federal Reserve would be deemed to have promulgated a rule that exceeded Congressional intent in allowing for card issuers to recover more than just the variable costs of a debit transaction.

After going through this analysis and quoting from such classics as E.B. White and William Strunk’s The Elements of Style and Lynn Truss’s Eats, Shoots & Leaves, the panel held that the Federal Reserve was within its right to include more than just the variable costs.

Because of this holding, the panel also had to go through an analysis as to whether each one of the individual, “non-variable” costs that were included in the Federal Reserve’s interchange fee calculation.  The panel held that the following costs were appropriately included in the fee calculation: (1) fixed authorization, clearance, and settlement costs; (2) network processing fees; and (3) fraud loss costs.

The panel believed that transaction monitoring costs could reasonably be calculated as part of the fee, but also believed that the Federal Reserve had not adequately explained its reasoning for including the transaction monitoring costs.  Therefore, the panel remanded the issue of the transaction monitoring costs to give the Federal Reserve an opportunity to explain its rationale for including the costs in the interchange fee calculation.

 

Routing & Anti-Exclusivity

Judge Tatel’s opinion for the panel stated early on in its section regarding the routing and anti-exclusivity provisions of the Federal Reserve’s rule that the merchants’ arguments had a “steep hill to climb.”  This is because the panel felt that a plain text reading of the Durbin Amendment seemed to align with the Federal Reserve’s reading of the provisions, thus allowing for the rule’s requirement that issuers activate two unaffiliated networks regardless of the method of authentication (PIN or signature).  After a fairly short analysis, the panel held that the merchants’ argument stating that cards needed to be activated on at least two unaffiliated networks per authentication method did not hold muster.

 

What does it all mean for credit unions

In the short term, credit unions will be able to continue administering their debit card programs in the same manner in which they have been since the Federal Reserve’s rule was promulgated.  Furthermore, the debit interchange fee calculation will remain unchanged while the Federal Reserve decides how to move forward with regards to the inclusion of the transaction monitoring costs.

NAFCU will continue to monitor the debit interchange legal battle, and will provide further updates, as they become available.  For further information on this issue, please visit NAFCU’s webpage devoted to the debit interchange rule.

***

Free Kick.  Being a fervent supporter of a football team has its highs and lows.  This weekend brought one of the lowest lows possible, as my beloved Arsenal were utterly humiliated by Chelsea.  The 6-0 tragedy has me too depressed to write much about football, but I did want to mention two things related to that match.

First, how can a refereeing crew make such an egregious mistake in so clearly sending off the wrong player by handing Kieran Gibbs a red card for a foul committed by Alex Oxlade-Chamberlain?!  The decision made absolutely no impact on the ultimate outcome, but it is a mistake that no refereeing crew should ever make.  Hopefully, the crew is properly disciplined for such a poor performance.

Lastly, I do want to tip my hat to Arsene Wenger.  While Saturday’s outcome undoubtedly left a sour taste in his mouth, he deserves to be congratulated for managing his 1,000^th game at Arsenal.  It’s been a pleasure watching his teams fill Highbury and the Emirates with attractive and fundamentally-sound football for almost 20 years now!

***

Two Helpful Webcasts

Risk-Based Capital Rule: How NCUA’s Proposal Will Impact You

Delve into NCUA’s risk-based capital proposal and learn how it could impact your operations both immediately and long-term. Register by April 3 to save $100.

 

Fair Lending II: How NCUA Guidance and the CFPB’s Focus Affect You

Gain insight into the latest guidance NCUA has issued regarding fair lending, and the best practices for implementing it. You’ll also learn the CFPB’s expectations for fair lending risk management practices. Register by April 16 to save $100.

Relief on the Horizon for Flood Escrow Requirement; NCUA Holds Board Meeting; Shameless Plug

Written by Brandy Bruyere, Regulatory Compliance Counsel

Cautious Optimism Regarding Flood Escrow Requirements. On July 6^th, 2012 President Obama signed the Biggert-Waters Flood Insurance Reform Act into law. Biggert-Waters introduced a host of changes to flood insurance, including mandatory escrowing of flood insurance premiums for a broad range of both existing and new home loans. The law also included a provision that the escrow requirements would become effective on July 6^th, 2014. On October 10^th, 2013 NCUA and several of its fellow regulators issued a joint proposed rulemaking implementing the various requirements of the Biggert-Waters. The escrow proposal applied to nearly all loans secured by real estate in a flood zone. While Biggert-Waters also included an exception for some credit unions, this was very narrow. Only credit unions with less than $1 billion in assets and did not have a consistent, uniform policy of escrowing their real estate loans would be exempt.  Without final regulations, the looming July 6^th deadline has been causing some anxiety in the compliance community for those trying to stay on top of their regulatory obligations.

There is tentatively good news this Friday in regards to escrow accounts for flood insurance. Congress recently passed a bill amending Biggert-Waters, including reforming the escrow provisions. President Obama is expected to sign this bill which would be helpful for those credit unions concerned about the upcoming July deadline.

First, the bill will delay the implementation date for the flood escrow requirement until January 1^st, 2016. This gives NCUA and other regulators time to finalize regulations in accordance to the changes to the law. Additionally, the new law narrows the scope of the escrow requirement by excluding several additional kinds of loans from the law. The excluded loans now include:

• Home equity lines of credit;
• Loans secured by real estate or a mobile home that is used for a business purpose;
• Loans secured by a condominium or similar property where the association provides flood insurance as part of common expenses;
• Junior or subordinate loans where flood insurance is already provided under the superior loan;
• Nonperforming loans; and
• Loans with terms of 12 months or less.

Finally, while Biggert-Waters required credit unions to escrow both outstanding and new loans, the new law relieves some of the regulatory burden by making flood escrows for outstanding loans optional. Outstanding loans are those which still have a remaining balance and would be subject to the flood escrow rule if the loan had been originated, refinanced, increased, extended, or renewed on or after January 1^st, 2016. Instead of mandating flood escrows for these accounts, instead credit unions must offer members the option to escrow their flood premiums for these loans. Overall, this law, if signed as expected, will provide a reprieve by both delaying and narrowing the scope of the Biggert-Waters flood escrow requirement.

***

NCUA Board Holds March Meeting.  The NCUA Board met yesterday with two items on its agenda. First, the Board received an update on the Temporary Corporate Credit Union Stabilization Fund. Second, the Board unanimously approved a joint rulemaking regarding minimum requirements for appraisal management companies. However, Chairman Matz noted that NCUA, while required to participate in this rulemaking by Dodd-Frank, is actually the only financial regulator that is “lacking the regulatory authority to examine vendors for safety and soundness and compliance with laws and regulations.” For more information, the March Board Action Bulletin is available here.

***

The New Compliance GPS Has Landed! The 2014 edition of NAFCU’s Credit Union Compliance GPS is here! This comprehensive, electronic resource translates complex regulatory language into plain English. The latest edition includes an expanded section on Reg E and the Remittance Transfer Rule, 7 new sections on the CFPB’s mortgage rules, improved user-friendly search functions, including more hyperlinks and bookmarks and much more. Get yours today!

Finally, I can’t share good news without adding a happy canine photo to the blog. I thought about discussing March Madness, but I’m not really qualified. Also, I become irrationally angry when bracket-busters do not work in my favor! Anyway, here is what my dog looks like when he’s pretending to be a sports fan watching college basketball:

NCUA Releases Liquidity and Contingency Funding Supervisory Letter; Free Kick

Written by Ricardo Piñeres, Regulatory Compliance Counsel

On Friday, March 14, the NCUA released Supervisory Letter No. 14-03.  This letter provides federally-insured credit unions (FICUs) with helpful information regarding the exam process with respect to the NCUA’s liquidity and contingency funding rules that were released back in October and are located at 12 C.F.R. § 741.12.  The supervisory letter accompanies the release of the portion of the AIRES Questionnaire that has been added to cover the new liquidity and contingency funding rules.  The release of this information is especially helpful because examiners will be required to review the liquidity and contingency funding plans for all FICUs beginning on March 31 of this year.

The liquidity and contingency funding rules were promulgated as a way for the NCUA to ensure that FICUs of all sizes were conducting sound liquidity planning.  Furthermore, it required large FICUs (those with over $250 million in assets) to establish access to at least one federal source of contingent liquidity.

In order to be in compliance, FICUs with less than $50 million in assets must establish and maintain a basic written liquidity policy.  The policy must be approved by a FICU’s board of directors and must, at minimum, contain:

• The purpose and goals of liquidity management;
• Thresholds or limits for liquidity measures and reporting requirements;
• Primary and secondary contingency liquidity sources that the FICU can employ under adverse circumstances;
• Tools for liquidity risk management; and
• A provision for periodic review and revisions, as needed.

In addition to a written liquidity policy, in order to be in compliance, FICUs with assets of $50 million or more must have a contingency funding plan that clearly sets out strategies for addressing liquidity shortfalls in emergencies.  This plan must include policies, procedures, projection reports, and action plans designed to ensure that a FICU’s sources of liquidity are sufficient to fund operating requirements under contingent liquidity events.

Furthermore, FICUs with assets of $250 million or more must establish access to at least one contingent federal liquidity source.  The two federal liquidity sources that the NCUA has deemed allowable for this purpose are the Federal Reserve Discount Window and the Central Liquidity Fund.

In gauging whether or not they are in compliance with the rules, FICUs should consult the supervisory letter, the new AIRES questionnaire additions, and NCUA Letter to Credit Unions No. 13-CU-10 that contained guidance on how to comply with the liquidity and contingency funding rules.

***

Free Kick.  The Premier League is heading into its final stretch of games with teams having 10 or fewer games left in the season (except for Manchester City and Sunderland who each have 11 games left).  While it appears that the Champions League spots are all but determined (it’s almost impossible to see any of the top 4 letting what is at least a 9-point gap back down to 5^th place Tottenham slip away), the championship and relegation battles will be fierce.

At the top end of the table, Chelsea leads by 4 points over both Liverpool and Arsenal, but Chelsea has played an extra game.  Manchester City trails the leaders by 6 points, but has played 3 games less than Chelsea and 2 less than both Liverpool and Arsenal.  As tight as the battle is at the top of the table, the battle to avoid relegation is even crazier with the bottom 8 teams are separated by just 6 points.

I am going to save my predictions for how it will all shake out in the Premier League for another time.  Instead, I’m going to honor March Madness and crown an EPL Madness Champion.  The teams have all been seeded according to the current Premier League standings with one exception – Manchester City has been given the benefit of the doubt in terms of their matches yet to be played and has been named the top seed.  Winners were determined solely by me taking into account recent form and my own personal biases.

Play-In Games: Crystal Palace, Hull City, Swansea, and Sunderland all advance.  West Brom, Fulham, Cardiff, and Norwich battle in a round-robin tournament for the one spot that is saved from relegation.  Cardiff survives and returns to the Premier League for next season.

Sweet 16: Manchester City, Arsenal, Liverpool, Everton, and Chelsea all advance comfortably.  Southampton squeaks by Newcastle 1-0 after a defensive resurgence.  Tim Sherwood’s lack of managerial experience shows again as he puts out an incoherent starting 11 that loses 2-1 to West Ham.  Aston Villa shock Manchester United in penalties and the David Moyes era comes to an end at Old Trafford.

Elite 8: Chalk reigns supreme as the top 4 seeds all move on.  In the only close fixture of the round, Arsenal has a lackluster offensive game, but the centreback combo Mertesacker and Koscielny clamp down to help the Gunners pull out a 1-0 victory.  Joe Hart has a sloppy game, but Man City’s attack is too much for Southampton.

Final 4: Man City’s offensive prowess is too much for Arsenal to handle; Man City eases to a 5-2 victory.  Liverpool continue their torrid run of late with 2 goals from Suarez and 1 from Sturridge to down Chelsea 3-1.

Championship Match: In front of a capacity crowd at Wembley, Man City storms out to a 2-0 halftime lead with goals from David Silva and Samir Nasri.  Liverpool strikes back in the second half to equalize the match with a pair of Luiz Suarez goals.  In the 87^th minute, Steven Gerrard heads home the winner off of a corner kick to give Liverpool the title.

Here is how the bracket shook out.

Number One, Most Common National Consumer Complaint is Identity Theft

Written by Shari R. Pogach, Regulatory Paralegal

Merchant data breaches and data security have made recent headlines so it’s likely no surprise that according to the Federal Trade Commission’s (FTC’s) annual report, identify theft continues to top the list of its top 10 consumer complaints.  The FTC’s Consumer Sentinel Network Data Book for January to December 2013 reports the agency received more than two million complaints overall, of which 290,056 or 14 percent, were identity theft related.  

Thirty percent of the identity theft complaints were related to taxes or wages with twenty percent of the complaints reported by 20-29 year olds.  The FTC’s report details national data, as well as a state-by-state accounting of top complaint categories and a listing of the metropolitan areas that generated the most complaints. Florida is the state with the highest per capita rate of reported identity theft, followed by Georgia and California. 

Complaints to the FTC are entered into a secure online database that is available to more than 2,000 civil and criminal law enforcement agencies across the country. Agencies use this data to research cases, identify victims and track possible targets.  

The director of the FTC’s Bureau of Consumer Protection notes that anyone of any age is vulnerable to identity theft and as it is the Commission’s most common consumer complaint, consumer education is a top priority for the agency.  Some FTC resources include: 

• FTC Identity Theft web page;
• Signs of Identity Theft;
• Immediate Steps to Repair Identity Theft; and
• How to Keep Your Personal Information Secure. 

Helpful information to have handy and be able to give someone who thinks they may be a victim of possible identity theft.

NAFCU’s Risk-Based Net-Worth Ratio Calculator; Shameless Plug for Member Call In

Written by PJ Hoffman, Regulatory Affairs Counsel

Welcome back to the latest installment of our recurring series of posts where NAFCU’s Compliance Blog will break down different portions of NCUA’s proposed rule regarding risk-based capital and provide you with resources to help your credit union understand the impact of the rule. Today’s topic is our newest resource for your credit union, NAFCU's risk-based net-worth calculator.  

To get you up to speed, on January 23, 2014, the NCUA Board issued a proposed rule regarding risk-based capital for credit unions. We at NAFCU are working tirelessly for you and have created some helpful resources for our members to use including NAFCU’s Regulatory Alert 14-EA-03, NAFCU Compliance Blog Posts here, here, here and the Capital Reform Issue Page. We know that this is an important issue and NAFCU has and will continue to advocate on behalf of our members regarding this rule, but your feedback is needed. Please send us your comments here regarding the rule so that we can incorporate them into our advocacy and comment letter.  

In order to help with understanding the impact of NCUA’s proposed rule on your credit union now and in the future, we have put together a customizable risk-based net-worth calculator for your credit union to use. This resource will allow you to substitute what you think the proposed risk weights should be and test the impact on your credit union's risk-based net worth ratio now and after five years. You can also change assumptions about your credit union’s asset growth and ROA and see the effect on your credit union's risk-based net worth ratio. All you need to do is plug in the information from the call report and you have a fully customizable calculator.  

You can use this tool to help your credit union in a number of ways. The calculator can be used to see how small changes to your portfolio can affect your credit union’s risk-based net-worth ratio both now and over the next 5 years.  The calculator is also helpful when your credit union is starting to write your comment letter to the NCUA regarding the proposed rule. Your credit union can use it to better understand the effects that the proposed risk-weights will have based on your portfolio especially when looking at heavily weighted assets such as investments and real estate loans. 

After you see how the proposed rule will affect your credit union, send us your comments here. We are especially interested in how the risk weights for real estate and investments will affect your decision making. Let us know.  

***

Shameless Plug: NAFCU has a member call-in scheduled for Tuesday, March 18 at 4:00 pm Eastern and you should join us. 

NAFCU’s member-only call-in, will address the latest legislative, regulatory, compliance and economic issues affecting credit unions. NAFCU President and CEO Dan Berger and other NAFCU senior staff will discuss top challenges, including the Target breach and data security concerns, NCUA’s risk-based capital proposal and more. 

Participation is free for all members, but you must register to attend.

Credit Unions Face the Crunch to Update ATM Software

Written by Kavitha Subramanian, Regulatory Intern

Although you wouldn’t realize with the never-ending stream of polar vortexes, April is almost upon us! For many it hopefully means warmer weather and sunny days. But for thousands of ATM operators, it means scrambling to keep their machines secure from potential security risks.

Last year, Microsoft announced that starting on April 8, 2014, it will discontinue supporting its Windows XP operating system which currently is the support system for about 95 percent of the 420,000 ATMs in the U.S. according to a Bloomberg report. And, NCUA officials believe that about 75 percent of credit unions rely on Windows XP.

Due to concerns raised by the financial services industry, Microsoft announced that for a fee it will continue to provide updates and security patches for some Windows XP users until July 2015. While these individually negotiated agreements between Microsoft and ATM operators may be a viable medium-term option for the largest banks such as JPMorgan and Wells Fargo, it probably isn’t feasible for most credit unions. According to a survey conducted by the ATM Industry Association, only about a third of ATM operators said that they would be able to change machines over from Windows XP by the April 8 deadline.

What will this all mean for your credit union?

For starters, since Microsoft will no longer provide regular software fixes to prevent malware, any ATM that continues to run on Windows XP is at a much greater risk for a security breach. Microsoft warns that ATM operators must update their operating systems as soon as possible. “Our research shows that the effectiveness of antimalware solutions on out-of-support operating systems is limited,” Microsoft says on its Malware Protection Center blog. NCUA’s Ben Hardaway has also expressed increased concern for the industry since, “The discontinuation of that operating system opens those systems up for viruses, cyber-security concerns, and then there's just simply an operations component that comes with a system that isn't being used anymore.”

In addition to security concerns, a credit union running its machine on an unsupported operating system would make it out of compliance with Payment Card Industry standards. Credit unions that are not in compliance with PCI standards become more liable for any fraud or theft that occurs on the ATM. If the PCI Security Standards Council, made up of payment providers such as MasterCard and Visa, finds that a credit union is not in compliance, the credit union may be fined thousands of dollars per month. A credit union can remain in compliance with PCI standards even it will not meet the April deadline, if it puts in place a compensating control system while it is working toward a Windows 7 upgrade.

Though credit unions and other ATM operators have been working to shift their ATMs to Windows 7 in order to keep up with industry and security standards, the updated software requires more sophisticated machines. For many, it has been an expensive and arduous process that involves replacing some ATMs entirely and updating the components in thousands of others, costing some institutions thousands of dollars per machine.

If you are unsure what the system specifications are for your credit union’s ATM machines, you should reach out to your ATM vendor or service provider as soon as possible. (More information about what this means for your operating systems can be found at Microsoft’s Windows XP end of support page.)

NCUA suggests those credit unions that may be unable to switch their ATMs from Windows XP before April 8 should try to adopt a sound risk-management process that includes:

• Identifying and assessing risks associated with the continued use of XP;
• Working closely with third-party technology service providers to migrate from Windows XP;
• Conducting analysis on applications using Windows XP to safeguard operational processes;
• Isolating XP devices from the network; and
• Reporting to senior management to ensure all risks are addressed.

As credit unions rush to transition their ATM software securely to Windows 7 before warmer spring weather sets in – they continue to deal with what seems like a never ending stream of regulatory “polar vortexes.”

Tumult in the Virtual Currency World, Is Bitcoin Imploding?; Programming Note

Written by Shari R. Pogach, Regulatory Paralegal

Yes, no, maybe?  It depends.  Here’s the latest on Bitcoin world.

Tokyo-based Mt. Gox, the most established and prominent Bitcoin exchange, went dark and disappeared from the Internet early Tuesday, February 25, 2014.  This occurred after a widely circulated document in Bitcoin world indicated the exchange had been hacked and lost 744,000 Bitcoins or about 6 percent of the 12.4 million Bitcoins in circulation.  Apparently the loss went unnoticed for years. At a press conference on February 28, the company’s chief executive stated the exchange had most likely lost 750,000 of its customers’ holdings and more than 100,000 of its own coins to the tune of more than $450 million. Mt. Gox filed for bankruptcy protection that same day.   Mt. Gox once accounted for four-fifths of the world’s Bitcoin trading.

Some industry observers believe the collapse of Mt. Gox occurred at a critical time for the currency as it was beginning to be more readily accepted in the mainstream.  Bitcoin ATMs have begun to pop up across North America and Tesla, OkCupid, Reddit, Overstock.com, two Las Vegas casinos, Virgin Galactic and a Subway sandwich shop in Allentown, PA accept the currency.  It is said that Ebay and the gaming company Zynga are also close to accepting the currency.   Several Bitcoin companies issued a joint statement to reassure the Bitcoin community that Mt. Gox was a one-off and “doesn’t reflect the resilience or value of bitcoin and the digital currency industry.”

A big mystery in the virtual currency world is just who is Satoshi Nakamoto a.k.a. the inventor of Bitcoin.  Last week, Newsweek magazine reported it had identified Satoshi Nakamoto as a 64-year old defense contractor living in Los Angeles, said to have worked on top secret military projects for the defense department and a major model trains enthusiast.  According to the article, Mr. Nakamoto’s second wife suspects that he developed the bitcoin protocol because he was annoyed by the bank fees and exchange rates he had to pay when wiring money overseas to purchase rare model trains.  Since then Mr. Nakamoto denied being Bitcoin’s creator and was literally chased around the city by reporters.

Bitcoin’s ease of use can also lead to easy theft – a revived online black market drug site Silk Road was hacked into and wiped out to the tune of $2.7 million in early February.  Reuters reported that Alberta-based Bitcoin bank Flexcoin closed down on March 4 after it lost bitcoins worth about $600,000 from a hacker attack.  

Here in the States, the currency has brought about the interest of the U.S. Senate, Homeland Security, the Federal Reserve, the IRS, FinCEN, the SEC and the FBI.  When the FBI closed down the original Silk Road black market last October, it seized $3.5 million in Bitcoin.  According to Bitcoin’s chief scientist, the FBI is now one of the world’s largest holders of Bitcoin. 

Although in the past the financial industry has largely been dismissive of Bitcoin that is starting to change. JPMorgan has tried to patent a bitcoin-like system.  And, a number of banks have released less negative research reports.  A Bank of America report noted that virtual currencies could become an important new part of the payment system, allowing money to move more cheaply than with credit cards and money transmitters. An industry observer believes that banks will create some form of not truly anonymous electronic cash that is more efficient than a credit card.  But to get government backing this product would likely be  quite different from bitcoin as it would have to be far less suited for criminal activity. An online marketplace, SecondMarket, plans to create and launch a bitcoin trading platform that will only open once it has several regulated financial institutions signed on as members.  

Bitcoin advocates and investors disagree on the future direction for the digital currency.  There are some that would prefer that it die rather than see it absorbed into the traditional financial system it was invented to circumvent.  But there are those Silicon Valley investors who firmly believe that regulatory oversight is necessary for Bitcoin to go mainstream.

Whatever Bitcoin’s future, it’s certainly quite a story.  William Luther, an economics professor at Kenyon College in Ohio, refers to himself as a Bitcoin skeptic but also says, “Bitcoin has brought the question of alternative currencies back to the table.  Money is a very old concept, and it’s difficult for me to think that there’s not a better way to make transactions.”

***

Programming Note.  It may be Spring break for some but it’s time for school here at NAFCU! The Regulatory Compliance team will be at NAFCU’s 2014 Regulatory Compliance School. Your compliance questions will be answered but we appreciate your patience as the team will be in and out of the office this week.

NCUA Releases Guidance on Derivatives Rule and Exam Expectations; NAFCU Compliance Resources Updated; Programming Notes

Written by JiJi Bahhur, Director of Regulatory Compliance

On Monday, NCUA’s new derivatives rule went into effect.  The rule allows credit unions with $250 million or more in assets that have a CAMEL rating of 1, 2, or 3 and a management component of 1 or 2 to use derivatives to hedge against interest rate risks.  Credit unions meeting this criterion must complete a two-step application process in order to qualify for derivatives authority.  

Coinciding with the effective date of the rule, NCUA issued Letter to CU 14-CU-04 to describe this application process.  NCUA also included Supervisory Letter No. 14-02, which clarifies the agency’s supervisory expectations about those derivatives products used by federal credit unions and federally-insured, state-chartered credit unions.

 The Letter to CU 14-CU-04 advises that “[t]hose credit unions approved for derivatives use will have limited authority to invest in simple interest rate derivatives for balance sheet management and risk reduction, including interest rate swaps, interest rate caps, interest rate floors, basis swaps, and Treasury futures.”   According to the Supervisory Letter, “NCUA will ensure that all federally-insured credit unions have the management, policies, procedures, and tools in place to safely use derivatives.”

While the Supervisory Letter details NCUA regulations and guidelines for credit unions that use derivatives, it notes that “[w]hen used properly, derivatives can help a credit union protect its earnings and capital from interest rate changes by hedging a portion of its interest rate risk (or other risks, for some FISCUs).”  

For more information on the derivatives rule, be sure to check out NAFCU’s Final Regulation, which provides a summary and detailed breakdown of the rule’s requirements. 

***

NAFCU Resources Updated.  I wouldn’t want to toot our horn or anything, but I will on this lovely Friday morning.  NAFCU’s compliance team has updated a number of its compliance resources which are now available to members (NAFCU log-in required). 

• NAFCU’s ten (10) mortgage rule scope and applicability charts have been updated and made available on our mortgage resources webpage.

 

• Also, the mortgage rules consolidated regulatory text was updated and posted to the website.

 

• Last, a new section – TILA/RESPA Integrated Mortgage Disclosures – was added to the mortgage resources page.  This new section will be further developed with more resources on the final rule throughout 2014. 

And don’t worry!  We’ve got something for members and non-members alike.  In February, the compliance team completed an extensive editing project of NAFCU’s Credit Union Compliance GPS.  The electronic manual was edited to include regulatory changes throughout the past year, including the addition of 7 new sections on the CFPB’s mortgage regulations and a more developed subsection on remittances in the Regulation E section.  The GPS overhaul resulted in over 100 new pages in the manual.  The 2014 GPS will be available for purchase in the next week or so. 

***

Programming Notes.  Next week (March 10 – 15), NAFCU’s compliance team and several other NAFCU staff will either be attending or presenting at NAFCU’s 2014 Regulatory Compliance School.  Because the compliance team will be in and out of the office all week, it is possible that we will have a delay on responding to our member questions, but we will get back to you as soon as possible! 

If you’re attending School, please don’t hesitate to come up and say hello!  We love putting faces with names.  And, if you have been following the growth of my twins on this blog - now 18 months old - you just might catch a glimpse of them in the halls of the Gaylord at the end of the week!

February 2014 NCUA Report; Interest Rate Risk; NCUA Economic Update

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

Recently, the NCUA released its February 2014 report. Featured articles include:

Office of Examination and Insurance Report: Riskier Credit Unions will Need More Capital Under Proposed Capital Adequacy Rule

Chairman’s Corner: Exams are a Two-Way Street

Office of Consumer Protection Report: Get Ready. Military and America Saves Week is Feb. 24 – March 1

Board Perspectives:  Teddy, Moses and Buford; It’s Never too Early to Stop Being Late

Board Actions: Final Derivatives Rule Approved; Board Also Approves NCUA Strategic Plan for 2014-2017; Renews Interest Cap

Office of the Chief Economist Report: Long-Term Investments Resulting in Increased Supervisory Actions

Region III Report: Frequently Asked Questions About Mergers

Office of Examination and Insurance Report: Get a Better Understanding of NCUA’s Capital Adequacy Rule with Our Online Calculator

OSCUI Workshop and CEO Bootcamp Schedule

 ***

Interest Rate Risk. Interest rate risk is a top supervisory focus for NCUA in 2014, as noted in Letter to Credit Unions 14-CU-02.  Along these lines, the article in NCUA's February 2014 report from the Office of the Chief Economist, Long-Term Investments Resulting in Increased Supervisory Actions, notes that supervisory action has been necessary in some “outlier” cases, and cautions credit unions in managing their interest rate risk.  From the report:

“For credit unions, investments are primarily meant to be safe places to store excess liquid funds. Once liquidity objectives are satisfied, investments also serve as a source of additional income to augment core earnings. The recent shift toward longer-term investments may indicate a trend away from liquidity management toward yield by taking on more risk.

‘The concern is that credit unions are reaching for yield in order to supplement earnings,’ NCUA Chief Economist John Worth said. ‘It is an understandable response, given the compression of net-interest margins in the low-rate environment. But the nature of the interest-rate environment, along with credit unions reaching for yield, has the potential to create a perfect storm that could have a substantial drag on future earnings, and make some credit unions insolvent.’ The pace of these portfolio changes has Worth and Cole concerned that credit unions are increasingly ignoring the perils of interest-rate risk in order to meet current earnings objectives. In the past year alone, while total investments have remained at 28 percent of assets, investments with maturities of less than three years dropped 11 percent or $20 billion, while investments with maturities of more than three years rose 33 percent or $30 billion.

[…]

The current interest rate environment—with short-term rates near zero and long-term rates at historic lows—is unprecedented. As a regulator, NCUA does not have a specific view on interest rates. Instead, NCUA believes credit unions’ balance sheets should be resilient in a wide variety of rate environments.

However, given the unusually low current interest rates and the recent improvements in the economy, there is much evidence to suggest that a transition to a rising and more volatile interest rate environment is already underway. Therefore, especially in the near term, credit unions should pay particular attention to their exposure to rising rates.

NCUA strongly urges credit unions not to forsake the role of liquidity in investment-portfolio management or to ignore interest rate-risk implications if they invest in higher-risk instruments to maximize current income.”

***

NCUA Economic Update Video.   Last week, NCUA released its latest economic update video. In addition to reiterating interest rate risk concerns, the video discusses the labor market and consumer spending. The video is available on NCUA’s YouTube channel here.

Monday Morning Compliance Round-Up; Useful Resources

Written by Brandy Bruyere, Regulatory Compliance Counsel

Happy March! With any luck, it will start to feel like spring again for those of us who are getting a bit tired of winter. Since it’s the first Monday of the month, we thought we would start this week off with a low-impact post that brings us up to date on a few different compliance-related developments.

CFPB Calls on Credit Card Companies to Provide Credit Scores

Last week, the CFPB released a report and bulletin regarding consumer complaints about credit reporting companies including accuracy in credit reports. As part of the Bureau’s response to this issue, CFPB Director Richard Cordray called on credit card companies to make “credit scores freely available on [consumers’] monthly statement or online.” While there are a few large credit card companies who are already offering this service to their customers, this is not a current regulatory requirement. However, it may be a sign of things to come from the CFPB.

CFPB Cracks Down on Student Lending

Back in December, the CFPB announced it would oversee the largest nonbank student loan servicers. The Bureau wasted little time as Discover Financial Services disclosed in its annual securities filing that the CFPB is investigating the company’s student loan servicing practices. The CFPB also filed suit last week against a for-profit college for predatory lending in relation to its student loan programs. As credit unions increase their involvement with private student lending, they may want to monitor the increased CFPB action in this area.

NCUA Releases Voluntary Liquidation Proposal

At its February 20^th meeting, the NCUA Board issued a proposed amendment to its voluntary liquidation regulation. The proposal includes a few changes that aim to reduce the burden on credit unions that are voluntarily liquidating. For example, the proposed changes would allow such credit unions to publish required creditor notices in electronic media and exempt credit unions with less than $1 million in assets from publication generally. Also, credit unions under $50 million in assets would be exempt from the requirement to make creditor publications in multiple sources.

***

Below are a couple of resources you may find useful for starting off a new month.

NCUA to Hold BSA Webinar. On Wednesday, March 19^th, NCUA will host a free webinar titled “BSA-MSB Training: What You Need to Know.” The webinar will be a panel and cover topics such as the critical elements of a BSA program, Money Service Businesses, common BSA violations, and reporting requirements. Attendees who successfully complete a test at the end of the webinar will receive a certificate of training. Those interested in this program can register here.

Kaufman & Canoles. Attorneys at Kaufman & Canoles released their Credit Union Legal Update—Winter 2014. This update discusses recent court rulings that may impact credit unions.

***

New Toys. Lemmy is not crated during the day while my husband and I go to work. We leave some toys out for him, but never the stuffed ones because sometimes he tears the toy open and gets into the stuffing. As a rescued yard dog, Lemmy still sometimes struggles to identify the difference between food and non-food. So, some toys must be taken away before we leave, resulting in what I call “sad mastiff face.”