NAFCU Compliance Blog

CFPB’s Mid-Year Update on Student Loan Complaints

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

The CFPB Student Loan Ombudsman recently issued a mid-year report on student loan complaints.  The report focuses heavily on complaints received related to co-signer issues – primarily difficulties in removing co-signers from private student loans, and private student loan defaults that are automatically triggered by a co-signer’s death or bankruptcy filing. From the CFPB’s press release:

“Among the issues that consumers face:

• Auto-defaults when a co-signer dies: Many consumers assume that the death of a co-signer, often a parent or grandparent, will result in the release of the co-signer’s obligation to repay. But many private student loan contracts provide the lender with the option to immediately demand the full loan balance upon death of the co-signer. These auto-defaults may be occurring when data from probate and other court record scans are matched with a financial institution’s customer database, without regard to whether the borrower is in good standing. These defaults are also typically reported to credit bureaus and negatively impact the credit profile of a borrower.

 

• Auto-defaults when a co-signer enters bankruptcy: Many private student loan contracts also allow the lender to place a loan in default if the borrower’s co-signer files for bankruptcy. Even if the loan was in good standing prior to and while the co-signer is in bankruptcy, borrowers submit complaints detailing how they face auto-defaults, including consequences such as credit damage and frequent debt collection calls.

 

• Obstacles to releasing co-signers from the loan: Borrowers face bureaucratic barriers when seeking to release their co-signer, even though this benefit was advertised before the loan was taken out and could help avoid auto-default. Consumers continue to complain that the rigid and opaque standards for co-signer release make for a mysterious process. For example, consumers note that required forms are often not available on websites or in an electronic form. In addition, servicers do not seem to be proactively notifying consumers about the specific requirements to process a release.”

Despite the lack of information about the actual prevalence of these issues in the student loan market as a whole (see page 9 of the report), and even noting that acceleration and default clauses triggered by the death or bankruptcy filing of a co-signer “may be rational for a creditor,” the ombudsman states that this practice on an otherwise performing loan “warrants review by investors and management.”  The report also goes so far as to comment that “reasonable observers” might ask why private student loan lenders don’t do more before pushing a borrower into default and acceleration, such as determining if a borrower qualifies for a co-signer release, or honoring the existing payment schedule for a designated time period so that borrowers can identify a new co-signer or refinance the loan.

From the report:

“Inclusion of these clauses may be rational for a creditor. However, the practice of accelerating a loan and immediately demanding the full balance upon the death or bankruptcy of a co-signer on a loan that is otherwise performing warrants review by investors and senior management.⁷

Some industry participants rely on third parties who conduct scans of public records of death and bankruptcy filings, which are then electronically matched to customer records and trigger a default, regardless of individual circumstances. Financial institutions face several risks with this approach.

Reduction of interest income: For a loan where the primary borrower has been making on-time payments for a lengthy period of time, placing the loan in default and demanding the full balance will almost certainly reduce the interest income over the life of the loan.

Reduced recovery of principal: Borrowers that have been making on-time payments for a lengthy period of time may not be able to cover the full amount of the loan immediately after a co-signer’s death or bankruptcy. To the extent that this results in the failure of the servicer or lender to recover the full amount of the loan, or results in higher collection costs per dollar recovered than would have been incurred using the normal payment schedule, automatic defaults may lead to lower recoveries of principal balances.

Poor customer experience: For a borrower who has proven to be a responsible paying customer and is facing the death of a parent or grandparent co-signer, debt collection calls demanding the full balance with limited explanation will probably not be welcomed. This might substantially reduce the willingness of the borrower to pursue other credit products with the financial institution.

Reputation: The deployment of debt collection protocols on an otherwise-performing loan in a time of a family tragedy may give the impression that a private student lender or servicer is inadequately managed or simply unwilling to work constructively with borrowers.

While these acceleration options may have a legitimate business purpose, it seems that private student lenders and servicers may not always be acting in their own self-interest by accelerating balances and placing loans in default. Since lenders and servicers typically have the option to place the loan in default, there are several alternatives worthy of further evaluation that may not only benefit consumers but also lenders and servicers.

•  A private student loan servicer can seek to determine whether the borrower qualifies for cosigner release and maintaining the existing payment schedule would be beneficial for all parties.

 

• The lender or servicer could provide an opportunity for the borrower to obtain another creditworthy co-signer. In many cases, the widowed parent or other elative may be a suitable substitute.

 

• The lender could notify the borrower the existing payment schedule will be honored for a designated period of time before the entire balance is demanded. This would allow the borrower to apply for a new loan (perhaps with a new co-signer such as the widowed parent) or to seek a refinance option with a different lender with new terms.

Reasonable observers might ask why these options are not more commonly employed. We do not know the extent to which lenders and servicers regularly use any of these alternative practices, but acceleration seems to be used by the bulk of industry participants. In addition, pooling and servicing agreements governing the actions of servicers for loans held in securitized trusts may provide additional complexity in these situations.” (My emphasis) (Footnotes omitted).

My take….they don’t know how prevalent these co-signer related problems are in the student loan market, and because they don’t know how often private student lenders try to help out borrowers in these situations, acceleration must be the norm. And apparently it’s not just consumers, but lenders as well, who don’t know how to act in their own self-interests. Laying the groundwork for future rulemaking on private student loan servicing? I’ll let you be the judge of that.

CFPB Announces Launch of eClosing Pilot Program; Free Kick

Written by Ricardo Piñeres, Regulatory Compliance Counsel

Last Wednesday (April 23), Consumer Financial Protection Bureau (CFPB) Director Richard Cordray spoke at a forum about the mortgage process.  During his remarks, Director Cordray focused on the CFPB’s planned eClosings pilot program that is aimed at helping consumers streamline the residential real estate closing process by eliminating the need for many of the forms to be completed by hand and allowing the process to be more electronic, thus giving consumers more time to review and understand the paperwork.

The eClosings pilot program is a part of the CFPB’s Know Before You Owe program and, according to Director Cordray, is just one of the ways that the CFPB is looking to simplify the mortgage process to improve the process for consumers.  The four main concerns that the CFPB is looking to alleviate are:

• Consumers lack enough time to review documents;
• Consumers are faced with too much paperwork;
• Consumers have a hard time understanding mortgage documents and disclosures; and
• Closings are unnecessarily delayed due to minor errors in mortgage documents.

Having identified these concerns, the CFPB has decided to launch the eClosings pilot program as a way to:

• Help explain key terms, the closing process, and important documents;
• Give consumers more time to review closing documents; and
• Help consumers find and fix errors in documents prior to closing.

According to Director Cordray, “There are several ways that eClosings can pave the way for a more efficient process that is also more empowering for consumers.  Electronic documents can make early delivery more convenient and simple – giving the consumer time to read the documents, consult with family members or professionals, and ask the lender questions.”  He further went on to say that “shifting to an electronic process should lead to greater consistency and accuracy, since automated processes can make it easier to detect discrepancies.”

Credit unions that are interested in being a part of the eClosings pilot program should review the CFPB’s eClosing Pilot Guidelines and the CFPB’s solicitation announcement.

***

Free Kick.  Before I jump into today’s World Cup group previews focusing on Groups D and E, I want to share Nike’s newest football ad titled Winner Stays.

Group D: The second of the three Groups of Death, Group D houses three traditional powers, plus Costa Rica.  Between Italy (4), Uruguay (2), and England (1), there are a total of 7 World Cup titles.  The three of them will duke it out for the top two spots in the group, but don’t be surprised if Costa Rica can steal a couple of points to make things interesting for one or two of the heavyweights in the group.  While all Italy, Uruguay, and England are all traditionally players on the world stage, they all come into the tournament with question marks.  Italy has a solid defense, but there are concerns up top, especially if Mario Balotelli is on the wrong side of his mercurial ways.  For Uruguay, the concern lies in their defense.  And, with England, there are just too many question marks to count with Roy Hodgson’s squad needing to gel quickly.

Key Matches: Uruguay v. England, June 19 (3:00 pm EDT); and Italy v. Uruguay, June 24 (12:00 pm EDT).

Projected Finish: (1) Italy; (2) Uruguay; (3) England; and (4) Costa Rica.

Group E: This group has two very clear tiers.  The top tier is France and Switzerland.  I believe that they will easily advance to the knock-out rounds.  Ecuador and Honduras play hard, but they just don’t have the quality to keep up with the top two teams in this group.  Things might have been different had Ecuador not suffered the tragic loss of their top scoring threat, Cristian Benitez.  Benitez passed away in July of last year of cardiac arrest after making his first appearance for the Qatari club El Jaish.  Ecuador will miss his skills and his passion, and who knows, maybe they will draw inspiration from the loss.  That said, this looks like a straight forward group.

Key Match: Switzerland v. France, June 20 (3:00 pm EDT).

Projected Finish: (1) France; (2) Switzerland; (3) Ecuador; and (4) Honduras.

NCUA April Board Meeting Results—Final Rule on Stress Testing and Proposed Rule on Associational Common Bond Charters

Written by Brandy Bruyere, Regulatory Compliance Counsel

Yesterday, the NCUA Board held its April meeting and included action on the following items:

• Share Insurance Quarterly Fund Review;
• Request from CME Federal Credit Union to Expand Its Community Charter
• Proposed Rule, Appendix B of Part 701, Associational Common Bond Requirements
• Final Rule, Part 702, Credit Union Capital Planning and Stress Testing

This blog will provide a brief overview of the last two items—the final rule on capital planning and stress testing, and the proposed rule on associational common bond requirements. For more information about the full agenda, check out NCUA’s Board Action Bulletin.

Capital Planning and Stress Testing

The final rule on capital planning and stress testing applies to “covered credit unions,” meaning credit unions with assets of $10 billion or more as of March 31^st of the current calendar year. To date, this means the rule will impact four credit unions, which will be required to have a capital policy that sets forth a planning and analysis process that is “consistent with the [credit union’s] financial condition, size, complexity, risk profile, scope of operations, and level of capital…”

In addition to a capital policy, covered credit unions must also develop and maintain a rather complex capital plan, which the credit union must then submit to NCUA by February 28^th of each year. The board of directors is tasked with reviewing the capital plan by assessing capital adequacy, addressing and remedying deficiencies in the process, and approving the capital plan. NCUA will either accept or reject the credit union’s capital plan within 90 days of receipt.

The final rule also subjects covered credit unions to annual stress testing requirements. The stress tests will analyze “all relevant exposures and activities of a credit union” in order to “evaluate [the credit union’s] ability to absorb losses” over a nine-quarter horizon. For the first three years, the results of stress tests will not be made public.

While only four credit unions are currently directly affected by the stress testing rule, this rule actually impacts all credit unions due to the costs of the program. NCUA will utilize independent modelers to conduct the stress tests, and pay for the expenses through the National Credit Union Share Insurance Fund. As NCUA estimates that each test will cost $1 million per year the first year and $500,000 each for every year after that, the costs seem to outweigh the benefits. As a result, NAFCU has advocated for lower-cost alternatives and expressed concerns to NCUA regarding the rule’s impact on share insurance funds that protect all credit unions. NAFCU will keep members up to date in coming weeks with a Final Regulation that summarizes the impacts of the rule.

Associational Common Bond Requirements

The Board approved a proposed rule relating to associational common bond requirements. The Board aims to streamline its requirements, including automatic approval of some kinds of groups such as religious organizations, alumni associations, and labor unions. However, the proposal also includes additional regulatory burdens that would negatively impact federal credit unions (FCUs).

First, the proposed rule includes a “threshold requirement” for reviewing applications to include an association in a FCU’s field of membership. This means that rather than focusing on whether or not an association is legitimate, NCUA’s first consideration would be to decide if the only reason the association was formed was “for the purpose of expanding credit union membership.” An application could be rejected for this reason alone without any further inquiry regarding the association.

If NCUA determines the application meets this threshold requirement, NCUA would then apply the totality of the circumstances test. While this seven-factor test is used today, the proposed rule would also add another criterion to the test—whether the association and the credit union operate with “corporate separateness.” NCUA will determine corporate separateness by reviewing several factors:

• The association and FCU’s business transactions, accounts, and records are not intermingled;
• Each observes formalities of separate corporate procedures;
• Each is financed as a separate entity;
• Each is held out to the public as a separate enterprise; and
• The association maintains a separate physical location that is not a P.O. box or premises that is owned or leased by the FCU.

NCUA noted that associational groups may be grandfathered, but that the agency will consider if there are any associations in a credit union’s field of membership that “need to be removed” because they “no longer meet the totality of the circumstances test.”

Interestingly, NCUA “does not believe the proposed requirements pertaining to associational common bond provisions will add a significant administration burden for FCUs.”  As with beauty, I suppose burden is also be in the eye of the beholder. We will keep you updated on this issue as it develops.

Palate Cleanser. After all this happy news, I’ll leave you with a picture I found pretty cute. Our friends visited with their three year old daughter, and she just had to compare her foot to Lemmy’s “foot.”

CFPB Releases Guide to Completing TILA/RESPA Integrated Disclosure Forms; NCUA Board Meeting Agenda; Deadline Alert-Submission of First Quarter 2014 Call Report and Profile Information; Past Due Twin Check-In

Written by JiJi Bahhur, Director of Regulatory Compliance

TILA/RESPA Integrated Disclosure Forms Guide.  Last Thursday, the CFPB released a guide to assist with the completion of the new Truth in Lending Act and Real Estate Settlement Procedures Act (TILA/RESPA) integrated disclosure forms.  The guide provides instructions for completing loan estimate and closing disclosure forms as well as models and samples of these forms. The guide comes as a companion to the recently released Small Entity Compliance Guide which we blogged about here.   

It is important to note that the TILA/RESPA rule does not allow creditors the ability to comply early.  In other words, creditors may not use the new integrated disclosures prior to the rule’s effective date, August 1, 2015.  Between now and then, creditors should follow the current disclosure requirements under Regulations Z and X, and use the existing forms for applications received before the effective date.

NAFCU’s compliance team recently made available a scope and applicability chart and the first of a series of articles on the TILA/RESPA integrated disclosure rule.  NAFCU’s resources on the TILA/RESPA integrated disclosure rule can be found here.  We will continue to update this page with any NAFCU-created resources as they become available.

***

NCUA’s Board Meeting Agenda.  NCUA’s April Board Meeting will take place tomorrow, Thursday, April 24, 2014.  Matters to be considered during the open session include, among other items, the following:

• Proposed Rule, Appendix B of Part 701, Associational Common Bond Requirements.
• Final Rule, Part 702, Credit Union Capital Planning and Stress Testing.

We’ll be sure to blog on the outcome of the meeting once that information is available.

***

Deadline Approaching! Submit First Quarter 2014 Call Report and Profile Info by Friday!  The deadline for submitting first quarter 2014 Call Report and Profile information is Friday, April 25^th (11:59:59 pm, Eastern Daylight Time). 

Credit unions that fail to meet the filing deadline may potentially be subject to civil money penalties.  According to the April 2014 NCUA Report, “each penalty will vary based on the reason for the delay or inaccuracy, ranging from $10 per day to a maximum of $1 million per day or one percent of total assets, whichever is less.” 
 
For more information on this issue, take a look at the related Letter to Credit Unions (14-CU-03) here.

***

Past Due Twin Check-In.  I’ve received some emails that I’m past due for sharing more pictures of the twins.  My sweet buds, Kyse and Ava, turned 20 months old on Easter Sunday.  Here are a few recent photos!

 

Private Companies Want Your Credit Union’s Hummm Daaa Data (HMDA Public Disclosure Regulation)

Written by Eliott C. Ponte, Law Clerk

It is that time of the year! The bees are buzzing, the cherry blossoms are blooming, and people from weird sounding companies are demanding your credit union send them your public Home Mortgage Disclosure Act (HMDA) data. Yea, that third thing only happens to compliance officers! As people who support compliance officers, we here at NAFCU have noticed an uptick in questions relating to disclosing modified HMDA information to private for-profit companies who plan to use this data to make more money. Thus, I thought it would be a good topic to blog about.

Avid readers of this blog and NAFCU certified compliance officers are aware that Regulation C implements the requirements of the HMDA, which requires certain credit unions and credit union service organizations to report data about home purchase and home improvement loans they originate, purchase, or for which they receive applications. Some credit unions are exempt from this reporting requirement, but for brevity, I do not discuss exemptions in this post. For those of you who are not exempt (you and the companies requesting your data know who you are), you may receive one or two letters from various companies demanding that your credit union transmit your 2013 modified HMDA information immediately.

Who are these companies and what do they want with your data?

If you ask an employee from one of these companies to describe what its company does, he/she will say that their company is a privately held corporation that conducts research for, and on behalf of, their interested clients, consumer groups, and the industry. They might also highlight that they produce articles, or “white papers,” from this data that is used by everyone in the industry. I, however, would describe them a little differently: these companies are private research/marketing companies that operate under the guise that they are researchers interested in writing “academic” or “white papers” on the data they collect. Moreover, these companies collect and compile data submitted by your credit union, other credit unions, banks, etc., to resell to third parties. The information is then used by purchasers for various things. For instance, industry analysis’s may use the information for publication, consumer groups use the information to monitor the directions of the market, and large banks or other lenders use the information to see what might be a new source revenue or to target loans to purchase. Either way you look at it, the company is interested in your data because it can make money. But hey, this is America and our capitalistic drive is what makes this country great.

Now to the burning question: Does my credit union have to comply with the request?

The short answer: Yes, you are required to disclose modified HMDA information to the public, but not in the manner these companies describe. According to 12 C.F.R. Part 1003.5(c), modified HMDA information is to be made available to the public, which would include these privately held companies that seek to compile the data to resell to third parties. Moreover, your credit union is required to “make its modified register available following the calendar year for which the data are compiled, by March 31 for a request received on or before March 1, and within thirty calendar days for a request received after March 1^st.” 12 C.F.R. Part 1003.5(c). That is, you have to disclose this information unless the company withdraws its request (I explain more below).

So what kind of data must you prepare to disclose to these companies?  According to the regulation, your credit union must disclose modified HMDA information.” Modified HMDA information is described in the regulation as the information found in its loan/application register “after removing the following information regarding each entry: [1] The application or loan number, [2] the date that the application was received, and [3] the date action was taken.” 12 C.F.R. Part 1003.5(c). How you disclose this data, however, is a business decision to be made by your credit union.  The regulation only requires that the information is made available in your credit union’s office for inspection and copying.  12 C.F.R. Part 1003.5(d),

The companies requesting the data would like you to believe that your credit union must submit the data electronically, perhaps via email or disk. While the regulation does require credit unions to make their information available to the public, it does not state how the data needs to be transmitted. Thus, you could transmit the data by mailing them a paper print out and be in compliance with the regulation. Alternatively, your credit union could require that a representative of the requesting company travel to your credit union’s offices and make copies of the modified HMDA information.  Certainly, the companies requesting the data want your credit union to submit the data electronically because it is simpler and more cost effective for them, and your credit union may find that transmitting the data electronically is cheaper and more efficient; nevertheless, the choice is with your credit union to determine the best way to transmit the data. 

If you think preparing or mailing this information is a cost your credit union should not bear, there is a regulation for that! Specifically, 12 C.F.R. Part 1003.5(d), which states:

(d) Availability of data. A financial institution shall make its modified register available to the public for a period of three years and its disclosure statement available for a period of five years. An institution shall make the data available for inspection and copying during the hours the office is normally open to the public for business. It may impose a reasonable fee for any cost incurred in providing or reproducing the data.

Thus, your credit union can require the company send your credit union payment to cover the reasonable costs in preparing the requested data. Reasonable costs is not defined in the regulation or in the staff commentary, thus the credit union will have to use its best judgment when requesting reasonable costs. 

If your credit union is hesitant to give its modified HMDA information to a private company that may take your data and sell it to third parties, requesting reasonable fees to be paid prior to the transmission might cause the requesting company to withdraw its request. For instance, before your credit union sends the modified HMDA information, your credit union should determine the costs associated (i.e., the postage to ship, the cost to print, etc.) and send a letter that requests the reasonable costs be paid to the credit union. If the requesting company does not respond, your credit union would need to make a business decision as to whether the company’s lack of response is a withdrawal of their request for the modified HMDA information. Of course, your credit union should document your request (save copies of the letter, note the time and date of any phone calls, etc.).

In sum, you credit union is not required to send modified HMDA information to these companies, but is required to disclose this information to the public.  How your credit union discloses this information is a business decision.   In addition, your credit union is neither required to bear the costs of transmitting/coping the information, nor must comply with how the information is sent to the company, if it chooses to send the information to the company.

 

Another UDAAP Hit for Credit Card Add-On Products; Vendor Management; Programming Note

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

Earlier this month, the CFPB ordered Bank of America, N.A. and FIA Card Services, N.A. (collectively, the “Bank”) to pay an estimated $727 million to consumers harmed by deceptive marketing practices and unfair billing practices related to credit card add-on products. The CFPB’s press release is available here.

This enforcement action stems from the CFPB’s investigation of the Bank’s credit card payment protection products as well as an investigation initially initiated by the Office of the Comptroller of the Currency (OCC), and later joined by the CFPB, into unfair billing practices related to identity protection products. In addition to ordering restitution payments to consumers, the CFPB assessed a civil money penalty of $20 million to be paid into the Civil Penalty Fund of the CFPB. The OCC assessed a separate civil money penalty of $25 million to be paid to the U.S. Treasury.

Deceptive Marketing. The CFPB found that the Bank engaged in deceptive marketing of two credit card payment protection products. These types of products generally allow customers who are enrolled in the product to request cancellation of some or all of their credit card balance under certain circumstances – such as unemployment or disability – as specified in the terms and conditions of the product coverage. Some of the marketing practices cited in the order include misleading statements about the cost of coverage during an initial 30-day review period, the enrollment process for credit protection products, and the benefits of coverage.

Unfair Billing Practices. In connection with identity protection credit card add-on products, the CFPB cited unfair billing practices.  These products were supposed to monitor an enrolled consumer’s credit and alert the consumer to potentially fraudulent activity.  However, it appears that in some cases the Bank billed consumers for the product without or before having the necessary authorization from the consumer to pull credit (as required under the Fair Credit Reporting Act), resulting in charges to consumers for services that were not being performed at all, or were only partially performed.  Additional unfair billing practices related to fees and interest charges were also cited.

***

Vendor Management. The orders issued by the CFPB and OCC serve as a reminder about the importance of vendor management. Both orders require the Bank to beef up oversight over any third-party vendors used in connection with providing add-on consumer products and to submit a risk management program for add-on consumer products marketed or sold by the Bank or its vendors.

This is just a taste from the CFPB’s order requiring the Bank to take steps to improve its vendor oversight for add-on consumer products:

“The Action Plan shall include a review, and if necessary, the revision of the Add-On Products related portions of its written Service Provider Management Program to ensure that all Add-On Products which are marketed and sold by the Bank comply with applicable Federal consumer financial law. At a minimum, the Service Provider Management Program shall require:

(a) An analysis to be conducted by the Bank, prior to the Bank entering into a contract with the Service Provider, of the ability of the Service Provider to perform the marketing, sales, delivery, servicing, and fulfillment of services for the Add-On Product(s) in compliance with all applicable Federal consumer financial laws and the Bank's related policies and procedures;

(b) For new and renewed contracts, a written contract between the Bank and the Service Provider, which sets forth the responsibilities of each party, especially:

(i) the Service Provider's specific performance responsibilities and duty to maintain adequate internal controls over the marketing, sales, delivery, servicing, and fulfillment of services for the Add-On Products;

(ii) the Service Provider's responsibilities and duty to provide adequate training on compliance with all applicable Federal consumer financial laws and the Bank's related policies and procedures to all Service Provider employees or agents engaged in the marketing, sales, delivery, servicing, and fulfillment of services for the Add-On Product(s);

(iii) granting the Bank the authority to conduct periodic onsite reviews of the Service Provider's controls, performance, and information systems as they relate to the marketing, sales, delivery, servicing, and fulfillment of services for the Add-On Product(s); and (iv) the Bank's right to terminate the contract if the Service Provider materially fails to comply with the terms specified in the contract, including the terms required by this Paragraph.

(c) Periodic review by the Bank of the Service Provider's controls, performance, and information systems related to Add-On Products.”

Both orders are well worth a read for pitfalls to avoid in offering credit card add-on products. The CFPB’s order is available here and the OCC’s order is available here.

***

Programming Note. NAFCU’s offices will close today at noon for the Easter weekend and will reopen on Monday, April 21st.

Happy Friday everyone!

Real Life Examples Are Relatable and Can Be Useful Training Tools; Shameless Plugs

Written by Shari R. Pogach, Regulatory Paralegal

Last month I blogged that according to its 2013 annual report, the Federal Trade Commission’s (FTC’s) data indicates the number one common consumer complaint continues to be identity theft.  The FTC also reports that a significant percentage of the consumer identity theft complaints are related to tax fraud.  

Often real world examples of criminal activity can be very helpful when it comes to training your front line staff.  Such examples are relatable and can be used to get your staff talking and thinking about what to look for when interacting with members on the front line.  The Internal Revenue Service (IRS)  has a section on its site with write-ups on identity theft scenarios, Examples of Identity Theft Schemes - Fiscal Year 2014, pulled from public record documents on file within the judicial district where the cases were prosecuted.  Here are two cases from the IRS website of identity theft and other fraud specifically involving financial institutions:

“Florida Woman Sentenced for Several Fraud Schemes

On March 26, 2014, in Tampa, Fla., Latasha Callens was sentenced to 149 months in prison, five years of  supervised release and ordered to pay a $223,798 money judgment. Callens pleaded guilty on Dec. 3, 2013 to  bank fraud, access device fraud, mail fraud and aggravated identity theft. According to court documents and  statements made in court, from as early as July 2011 through her arrest in May 2013, Callens defrauded banks  and individuals on at least 58 occasions during a two-year period. In one of her schemes, Callens approached  individuals, usually at ATMs, and told them about her need to cash a check and her inability to deposit the check  into her bank account. She then convinced the individuals to deposit the checks into their own accounts and withdraw the funds for her. She sometimes gave them $100 for their trouble. In each case, the checks were worthless. They were generally drawn on closed accounts, because the checks and checkbooks had been stolen. In another scheme, for the tax years 2010, 2011, and 2012, Callen defrauded the IRS and certain taxpayers by electronically filing false and fraudulent tax returns, using stolen identities and, thereby, obtaining refunds. She sought approximately $800,000 in fraudulent tax returns.

Alabama Bank Employee Sentenced for Tax Refund Fraud

On Feb. 19, 2014 in Montgomery, Ala., LaQuanta Clayton was sentenced to 21 months in prison, three years of supervised release and ordered to pay $185,730 in restitution. Clayton pleaded guilty in July 2013 to theft of government property. According to court documents and statements made in open court, Clayton used her position as a bank teller to open bank accounts in the name of another individual without his knowledge. Tarrish Tellis, the leader of the tax-fraud ring, directed Clayton to open multiple bank accounts in order to receive electronic deposits of fraudulent tax refunds. Tellis pleaded guilty to related crimes in October 2013. Clayton would facilitate the withdrawal of this money and give it to Tellis and other individuals involved in the scheme. Clayton opened at least five bank accounts, which she used to receive fraudulent tax refunds.” (Emphasis mine.)

How do they come up with this stuff?! Speaking of training resources, here come my shameless plugs…

***

BSA Blast and BSA Quiz – The April edition of the BSA Blast is now available for NAFCU members here.  (You will need your member login to access.)  In this issue we discuss the Financial Crimes Enforcement Network’s new practice in enforcement actions against Bank Secrecy Act (BSA) violations.  There is also a challenging new BSA quiz you can use for staff training. 

Webcast - Mortgage Advertising: Keeping Your Promotions Compliant  - HELOCs vs. closed-end mortgages; social media vs. print ads—many variants determine what disclosures you must include in your mortgage advertising. Register for this webcast by May 7 to save $100 and get a clear understanding of what you need to say, when…plus essential tips and best practices for compliance adherence. 

FFIEC Implores Financial Institutions to Stop the Bleeding; Free Kick

Written by Ricardo Piñeres, Regulatory Compliance Counsel

On Thursday, April 10, the Federal Financial Institutions Examination Council (FFIEC) released an alert regarding the “Heartbleed” vulnerability.  The alert is intended to make credit unions, and other financial institutions, aware of the seriousness of the “Heartbleed” vulnerability and how it can create a situation where attackers could access private information that would normally be encrypted.

“Heartbleed” is a vulnerability in the OpenSSL cryptographic library that may put systems that use this encryption method at risk.  OpenSSL is an open-source implementation of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols commonly used to protect data in transit.  OpenSSL, popular for implementing encryption in websites, e-mail servers, and applications, is used in common network services such as web servers, email servers, virtual private networks (VPN), instant messaging, and other applications.  Financial institutions may be using OpenSSL to cryptographically authenticate their servers to customers, and to protect passwords and other sensitive data from eavesdropping.

The vulnerability has existed in OpenSSL versions 1.0.1 through 1.0.11 since December 31, 2011, but it was not discovered until April 7 of this year.  Because of the vulnerability, an attacker may be able to decrypt, spoof, or perform man-in-the-middle attacks on network communications that would otherwise be protected by encryption.  Furthermore, attackers could potentially impersonate bank services or users, steal login credentials, access sensitive email, or gain access to internal networks.

FFIEC’s alert urges financial institutions to:

• Ensure third-party vendors using OpenSSL on their systems are aware of the vulnerability and take appropriate mitigation steps;
• Monitor the status of their vendors’ efforts;
• Identity and upgrade vulnerable internal systems and services; and
• Follow appropriate patch management practices and test to ensure a secure configuration.

FFIEC also suggests replacing private keys and X.509 encryption certificates after applying patches.  Furthermore, the alert says financial institutions should assume current encryption keys for vulnerable servers are no longer viable and that institutions should also strongly consider having users and administrators change passwords after applying the OpenSSL patch.

For more information on the “Heartbleed” vulnerability and how it works, visit Codenomicon’s webpage devoted to the vulnerability.  Three security engineers from Codenomicon, along with an individual from Google Security, were the discoverers of the vulnerability.  There is also a simplistic, yet fun, comic strip that explains the basics of “Heartbleed.”  Lastly, the FDIC put out a useful press release last week that lists several helpful resources for improving financial institutions' cyber security.

***

Free Kick.  With under two months left until the start of the World Cup, I thought that I would start my group previews.  Today, I’ll give a brief preview of Groups A and B, and future posts will preview the rest of the groups.

Group A: As the host country, Brasil was placed in Group A, and they received a pretty favorable draw.  Without a doubt, the host nation is the class of the group and I would be shocked if they don’t win all three of their group games.  Luiz Felipe Scolari’s greatest challenge will be keeping a very talented squad loose and ensuring that the pressure does not derail Neymar and Company.

After a bizarrely sluggish final qualifying phase, Miguel Herrera appears to have Mexico going in the right direction.  Croatia have a strong squad, but I think that the one-match suspension to Mario Mandzukic and the ten-game suspension (currently being appealed) to Josip Simunic may be just a little too much for them to overcome.  Cameroon will struggle in this group because of their lack of quality goal scorers beyond Samuel Eto’o.

Key Match: Mexico v. Croatia, June 23 (4:00 pm EDT).  The final group match for both teams will likely decide which team joins Brasil in the knock-out rounds.

Projected Finish: (1) Brasil; (2) Mexico; (3) Croatia; and (4) Cameroon.

 

Group B: The first of the three “Groups of Death” features both finalists from South Africa (Spain and the Netherlands), Chile, and Australia.  Let’s dispense with the obvious, Australia will struggle to get even a point out of this group.  Even though they are a bit more vulnerable than back in 2010, I still think that Spain is the favorite to top this group.  There is just too much depth and familiarity amongst the players for Spain to not have a positive showing at this tournament.

On paper, the Netherlands has more attacking options and more solid core in the midfield than Chile, but they may have the same problems that plagued them in Euro 2012 – a lack of chemistry amongst their younger players.  As Alexis Sanchez goes, so will Chile.  If he is on, they will be a threat to make a run in this tournament.  While Chile caught fire at the end of qualifying, their occasional defensive lapses may end up costing them against the deadly attacking options possessed by Spain and the Netherlands.

Key Matches: Spain v. the Netherlands, June 13 (3:00 pm EDT); and Chile v. the Netherlands, June 23 (12:00 pm EDT)

Projected Finish: (1) Spain; (2) the Netherlands; (3) Chile; and (4) Australia

CFPB Consumer Response Annual Report, Forum on Mortgage Closing Process, and the Blood Moons

Written by Eliott C. Ponte, Regulatory Law Clerk

CFPB Consumer Response Annual Report

The CFPB recently released its Consumer Response Annual Report.  The report can be found here, which is a summary and highlight of their Consumer Complaint Database for 2013.

The CFPB began to accept complaints on July 21, 2011.  As of March 1st, the CFPB has handled approximately 309, 700 consumer complaints.  Since its inception, consumer complaint volume has steadily increased from about 91,000 complaints in 2013 to 164,000 complaints in 2013. Approximately 54% of all consumer complaints were submitted through the CFPB’s website and 11% via telephone calls. Referrals accounted for 24% of all complaints received. The rest were submitted by mail, email, and fax.  Of the 164,000 complaints, 37% were related to mortgages, 19% were related to debt collection, and 15% were related to credit reporting.

***

Forum on Mortgage Closing Process

On Wednesday, the CFPB announced it would host a forum on mortgage closing process in Washington D.C. on Wednesday, April 23 at 1:30 P.M.  The forum will take place at CFPB HQ.  To RSVP, email [email protected] with your full name and organizational affiliation.  People unable to make the trip to Washington can watch a livestream through the CFPB’s blog. 

***

The Blood Moon Is Upon Us, Will The CFPB Issue Payday Lending Rules?

Seriously, stargazers and lunar fans will witness the first of four blood moons during the evening hours of April 14^th and 15^th.  While this has little to do with the CFPB issuing regulations, I suspect that the CFPB will make an announcement regarding payday lending in the near future.  The CFPB has not officially said that it is working on payday rules, but Director Richard Cordray came close to acknowledging rules were in the works in his remarks that accompanied a report on payday loans on March 25^th of this year. 

“As we look ahead to our next steps, I will frankly say that we are now in the late stages of our considerations about how we can formulate new rules to bring needed reforms to this market. We continue to grapple with all aspects of these issues. We have always acknowledged that the American consumer has shown a clear and steady demand for small-dollar credit products, which can be helpful for the consumers who use them on an occasional basis and can manage to repay them without becoming mired in a prolonged and costly struggle. So we intend to make sure that consumers who can afford to take out small-dollar loans can get the credit they need without jeopardizing or undermining their financial futures. But we also need to recognize that loan products which routinely lead consumers into debt traps should have no place in their lives.”

Perhaps we will have to wait until the last blood moon before learning about the CFPB’s plans!

FFIEC Releases Statements on Cyber-Attacks on ATMs, Card Authorization Systems, and DDoS Attacks

Written by Brandy Bruyere, Regulatory Compliance Counsel

Cybersecurity continues to be a hot issue from both a compliance and risk-management standpoint. Given the variety of cyber-attacks that can impact credit unions, last week FFIEC released two statements relating to some specific issues. The first statement addresses cyber-attacks on ATMs and card authorization systems. The second statement discusses the continued problem of distributed denial of service (DDoS) attacks on websites. FFIEC’s statements detail the steps regulators expect credit unions to take with regards to these cyber-threats.

Cyber-attacks on ATMs and Card Authorization Systems

Recently, hackers have targeted ATMs by installing malware programs on a bank or credit union’s network that will allow for “unlimited” withdrawals or “Unlimited Operations.” This means that the hacker could extract money from an account beyond the available balance. FFIEC notes a case where this kind of attack caused over $40 million in fraud using only twelve stolen debit accounts. In other words, these attacks do not have to be broad in nature to cause serious consequences.

FFIEC warns that these kinds of attacks often stem from phishing emails sent to employees in order to gain access to the credit union’s network and install the malware needed to manipulate the ATM’s controls. To mitigate against the risks of these attacks, FFIEC outlines steps credit unions are expected to take:

• Conduct ongoing information security risk assessments.
• Perform security monitoring, prevention, and risk mitigation.  
• Protect against unauthorized access.
• Implement and test controls around critical systems regularly.
• Conduct information security awareness and training programs.
• Test incident response plans.
• Participate in industry information sharing forums.

These points are discussed in further detail in the FFIEC statement and are worth reviewing, especially as these kinds of cyber-attacks can impact credit unions of all sizes.

DDoS Cyber-Attacks

DDos attacks continue to be a problem and can prevent members from accessing the credit union’s web-based services, disrupt employees’ work, generally slow down a website, and even be accompanied by fraud. This means that these attacks can impact several areas of risk such as reputation risk, operational risk, and capital risk. Credit unions’ security programs should address DDoS cyber-attacks. According to FFIEC, this includes:

• Maintain an ongoing program to assess information security risk that identifies, prioritizes, and assesses the risk to critical systems, including threats to external websites and online accounts;
• Monitor Internet traffic to the institution’s website to detect attacks;
• Activate incident response plans and notify service providers, including Internet service providers (ISPs), as appropriate, if the institution suspects that a DDoS attack is occurring. Response plans should include appropriate communication strategies with customers concerning the safety of their accounts;  
• Ensure sufficient staffing for the duration of the DDoS attack and consider hiring pre-contracted third-party servicers, as appropriate, that can assist in managing the Internet-based traffic flow. Identify how the institution’s ISP can assist in responding to and mitigating an attack;
• Consider sharing information with organizations, such as the Financial Services Information Sharing and Analysis Center and law enforcement because attacks can change rapidly and sharing the information can help institutions to identify and mitigate new threats and tactics; and
• Evaluate any gaps in the institution’s response following attacks and in its ongoing risk assessments, and adjust risk management controls accordingly.

In addition to these FFIEC statements, NCUA has a Cybersecurity Resources webpage to help credit unions navigate these issues. The FFIEC IT Handbook can also be a useful tool when assessing your credit union’s cybersecurity program. Finally, NAFCU members can access a Regulatory Alert summarizing NIST’s Voluntary Cybersecurity Framework which was just released by our Regulatory Affairs team.

NCUA Releases Taxi Medallion Supervisory Letter; NCUA’s “Small Dollar Lending” Webinar; Free Kick; Helpful Webcast

Written by Ricardo Piñeres, Regulatory Compliance Counsel

Last week, the NCUA released Supervisory Letter 14 – 04, Taxi Medallion Lending.  The letter is intended to give NCUA examiners further guidance on how the agency wants them to review taxi medallion loans inside of a credit union’s member business lending portfolio.  Furthermore, the letter also gives credit unions insight into how the agency views the unique risks associated with taxi medallion lending.  The NCUA has released this letter in light of the recent increases to medallion values in several major metropolitan areas, thus leading to increases in medallion lending and the potential risks that go with such lending.

The Supervisory Letter is divided into three main sections: background information on medallions; exam procedures; and additional guidance/resources available to both credit unions and examiners.  The background section is particularly helpful in understanding the NCUA’s view with regards to medallion lending through its discussion of how the medallion business model works and what risks are associated with the medallion’s valuation.  While the bulk of this information is geared towards examiners that may have not encountered much taxi medallion lending during previous examinations, the information is particularly helpful for credit unions to be able to anticipate the questions/concerns from examiners with regards to this unique form of member business lending.

***

Next week, on Wednesday, April 16, the NCUA will be hosting a free webinar titled Small Dollar Lending.  The webinar, hosted by Tom Penna, Jr., Economic Development Specialist with NCUA’s Office of Small Credit Union Initiatives, will cover the benefits and requirements of NCUA’s Alternative Payday Loan.

Penna will be joined by Lucinda Johnson, Program Officer in NCUA’s Office of Examination and Insurance, and representatives from two credit unions active in small-dollar lending.  Together, they will discuss how various credit unions have created short-term lending programs that work for their members and factors to consider before starting such a program, including:

• The benefits short-term, small-dollar loans can bring to a credit union’s portfolio mix;
• Regulatory concerns governing this type of product offering; and
• The costs associated with developing or initiating short-term loans.

The webinar will be held at 2:00 pm EDT.  Interested participants must register online in order to participate in the webinar.

***

Free Kick.  The Premier League has but one month before it closes its 2013-2014 season.  It has been an exciting season so far that has produced a tight race for the championship, and an equally exciting race for survival at the bottom of the table.  Here are my brief thoughts on how this season will close out.

Bottom Three: While there will inevitably be a surprise or two, I think that Cardiff and Norwich are as good as gone from the Premier League.  I think that Fulham will join them in the Championship, as well.

The Fight for Fourth: A few weeks ago, I said that I thought the top-four had been settled.  Well, sadly, Arsenal has fallen apart these last couple of weeks and they are now in a true dogfight for the final Champions League spot.  While the Gunners have been unable to find any quality, Everton is on a true roll and currently control their destiny by being one point back with one game in hand.  That said, I just have a hard time envisioning Everton maintaining such a strong form over their final six games.  Their run in is just too hard for them to snatch fourth from Arsenal.  I see them dropping at least eight points in three of those matches – at home in the games against Man City and Man U, and away to Southampton.  Arsenal’s final five games are at home to West Ham, Newcastle, and West Brom, and away to Hull and Norwich.  I see them, at most, dropping 5 points over that stretch, and hanging on to fourth.

Top Three: With Liverpool and Man City facing off this coming Sunday, I suspect that the championship race will be defined by what plays out at Anfield that day.  There is just something special happening in that Liverpool clubhouse right now, and I have a feeling that they will find a way to get a positive result on Sunday.  That will put them in the driver’s seat for the last few games, but I don’t think it will be enough.  I see this as another Man City title year with Liverpool a hair behind them in second and Chelsea finishing several points behind in third.

All that said, the Premier League has shown its unpredictability over the last few years, so it would not surprise me at all if the season’s final month takes a few more crazy turns that lead to a completely unforeseen outcome.  No matter what happens, I will just sit back and enjoy the football!

***

Webcast.  NCUA & CFPB Updates: What You Need to Know, Now

Get a jump on regulatory preparedness with an update on the most critical upcoming NCUA and CFPB regulations. NAFCU’s Regulatory Affairs team will cover what will be new around capital reform, risk-based capital, interest rate risk, and more.

Talking Points for Risk-Based Capital Proposed Rule Comment Letter; NAFCU Webcast on What Policies Must be Board-Approved

Written by PJ Hoffman, Regulatory Affairs Counsel

Welcome back to the latest installment of our recurring series of posts where NAFCU’s Compliance Blog discusses NCUA’s proposed rule regarding risk-based capital and provides you with resources to help your credit union understand the impact of the rule. Today’s topic is our newest resource for your credit union: NAFCU’s talking points for your comment letters to NCUA.

Some quick background, on January 23, 2014, the NCUA Board issued a proposed rule regarding risk-based capital for credit unions. We at NAFCU are working around the clock for you and have created some helpful resources for our members to use including NAFCU’s Regulatory Alert 14-EA-03, NAFCU Compliance Blog Posts here, here, here, here, NAFCU’s risk-based net-worth calculator, and the Capital Reform Issue Page.

This is a very important issue for the credit union industry and it is important that your credit union weighs in on the rule’s possible effects with the NCUA. Getting your voice heard is simple and here are four things your credit union should do right now. First, send us your comments here regarding the rule so that we can incorporate them into our advocacy and comment letter.  We have extended the deadline from April 1, 2014 to April 15, 2014 so get those comments in.

Secondly, your credit union should write a comment letter to NCUA explaining how the rule will affect your credit union and the industry as a whole. We have put together a very helpful tool for our members to help with putting your comment letters together. NAFCU’s talking points for comment letters are based on NAFCU’s analysis of the proposed rule that your credit union can use when formulating your comment letters to NCUA. The talking points should be colored with the views and opinions of your credit union, but there are a number of helpful arguments available that are broken down by topic. Remember comment letters are due to NCUA by May 28, 2014.

Third, check out our upcoming webcast on April 10, 2014 entitled “Risk-Based Capital Rule: How NCUA’s Proposal Will Impact You.”  It will break down the issues with the rule and its impact on your credit union with special guest speaker Denise Boutross McGlone from Affinity FCU. Be sure to tune in for an overview of the proposed rule as well as the impact it could have on your credit union’s operations now and in the future.

Finally, consider sending someone from your credit union to one of NCUA Chairman Matz’s listening sessions. NCUA has opened registration for its three listening sessions in Los Angeles, Chicago and Alexandria, Va., this summer, before a final capital rule is issued. These are free events but participation in each is limited to the first 150 people registering. Both NCUA Chairman Debbie Matz and Board Member Rick Metsger will attend the sessions and this is a great opportunity to follow up on your comment letters and talk directly with two members of the NCUA Board.

***

Webcast: NCUA Board of Director Policies: Which Ones Truly Require Action?

Lighten your compliance burden! Andy Keeney will discuss how you can significantly reduce the attention you give to 35 of NCUA’s “required” Board of Director policies. You’ll also learn the remaining 15 policies your Board must absolutely act upon.

CFPB Releases Small Entity Compliance Guide for Integrated TILA/RESPA Disclosures; April Compliance Monitor and New TILA/RESPA Scope & Applicability Chart Now Available

Written by Brandy Bruyere, Regulatory Compliance Counsel

On Monday, the CFPB released its newest Small Entity Compliance Guide for the TILA/RESPA integrated disclosures rule. The guide is 89 pages long and intended to provide a plain English explanation of the rules. While this may seem long, the guide is substantially more manageable than the nearly 2,000 page final rule the CFPB issued in November, 2013. The guide is a good starting point for credit unions to use for determining what is necessary to be compliant by the rule’s August 1, 2015 effective date.

The guide is organized similarly to the CFPB’s other compliance guides. There are several main sections including an introduction, an overview, and the scope of the rule followed by the various requirements for the disclosures themselves. Generally, the rule requires two main disclosures—the Loan Estimate and the Closing Disclosure. The CFPB explains the Loan Estimate as follows:

 “For closed-end credit transactions secured by real property (other than reverse mortgages), the creditor is required to provide the consumer with good-faith estimates of credit costs and transaction terms on a new form called the Loan Estimate. This form integrates and replaces the existing RESPA GFE and the initial TIL for these transactions. The creditor is generally required to provide the Loan Estimate within three-business days of the receipt of the consumer’s loan application (see section 6.1 below on the timing requirements of the Loan Estimate). (§ 1026.19(e)(1)).”

 The CFPB gives the following summary of the Closing Disclosure:

“For loans that require a Loan Estimate and that proceed to closing, creditors must provide a new final disclosure reflecting the actual terms of the transaction called the Closing Disclosure. The form integrates and replaces the existing HUD-1 and the final TIL disclosure for these transactions. The creditor is generally required to ensure that the consumer receives the Closing Disclosure no later than three business days before consummation of the loan. (§ 1026.19(f)(1)(ii)).”

The guide goes on to discuss the specific content requirements for the disclosures, the tolerances for estimates, and the rules for revising or correcting the disclosures. There is also an overview of the delivery and timing requirements for providing members with these documents.    

 In terms of the compliance deadline, the guide answers a key question—can credit unions use the integrated disclosures to comply with TILA/RESPA before August 1, 2015. Unfortunately, the answer to this question is no:

 “…For transactions where the application is received prior to August 1, 2015, creditors will still need to follow the current disclosure requirements under Regulations X and Z, and use the existing forms (Truth-in-Lending disclosures, GFE, HUD-1).”

In other words, the effective date of the rule operates like a switch, requiring credit unions to change from one compliance system to another overnight. This will present difficulties, particularly for loans with closing dates that are at or near the compliance deadline.

As compliance professionals tackle these challenges, besides the guide the CFPB created an implementation page on its website for the rule. On this webpage, you will find links to the final rule and several sample Loan Estimates and Closing Disclosures which may be helpful. The CFPB also listed an email address for sending questions or feedback to the bureau: [email protected].

***

April Compliance Monitor and New Scope and Applicability Chart. NAFCU will have ongoing efforts to help members prepare to implement the TILA/RESPA integrated disclosures rule. Our Compliance Monitor will feature an ongoing series of articles discussing the rules, starting with our April issue which we released yesterday. This month’s Compliance Monitor discusses the scope of the rule and the basic requirements for the Loan Estimate and Closing Disclosures. Additionally, NAFCU’s compliance team created a new Scope and Applicability Chart for the rule which is now available in the CFPB mortgage rules resources section of our website.

Giant Treat for a Giant Dog! We aren’t the only ones who spoil our dog. A friend recently attended a pet expo, and couldn’t resist the impulse to buy our dog a two-foot long cow femur. He likes when treats come in his size!