NAFCU Compliance Blog

CFPB Mortgage Rule Tidbits – Final Rule on Points and Fees Cure; Updated Mortgage Readiness Guide; Proposed Changes to TILA/RESPA Final Rule

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

Final Rule on Points and Fees Cure. Recently, the CFPB issued a final rule that, among other things, provides a limited cure mechanism under the ability-to-repay rule that allows lenders to refund points and fees that exceed the 3 percent cap on a loan that otherwise meets the qualified mortgage (QM) requirements at consummation.

Under the rule, a lender can refund excess points and fees, with interest, within 210 days after the loan is made to meet the QM requirements as long as one of the following has not occurred:

(1)   The institution of any action by the consumer in connection with the loan;

(2)   Receipt by the creditor, assignee, or servicer of written notice from the consumer that the transaction’s total points and fees exceed the cap; or

(3)   The consumer becomes 60 days past due on the legal obligation.

In addition, the creditor must maintain and follow policies and procedures for reviewing points and fees and providing refunds to consumers. Note that this provision will expire on January 10, 2021.

***

Updated Mortgage Readiness Guide. The CFPB also recently revised its 2014 CFPB Dodd-Frank Mortgage Rules Readiness Guide to include the TILA-RESPA Integrated Disclosure Rule that takes effect August 1, 2015.  The guide, designed to help institutions come into and maintain compliance with mortgage rule changes, is now current as of final rule changes issued through August 1, 2014.

***

Proposed Changes to TILA/RESPA Final Rule. This CFPB proposed rule would amend the Truth in Lending Act (TILA) /Real Estate Settlement Procedures Act (RESPA) Integrated Disclosures Rule (TILA/RESPA final rule) to allow more time for providing a revised Loan Estimate disclosure when the consumer locks a rate or extends a rate lock after the initial Loan Estimate is provided. Under the TILA/RESPA final rule, a creditor must issue a revised Loan Estimate on the same business day the interest rate is locked. The proposal would relax the redisclosure timeframe, giving creditors until the next business day to provide the revised disclosures. 

The proposal would also permit language related to new construction loans to be included on the Loan Estimate disclosure. Under the TILA/RESPA final rule, a creditor can issue a revised Loan Estimate for a new construction loan where the creditor reasonably expects settlement will occur more than 60 days after providing the initial Loan Estimate if the creditor includes a clear and conspicuous statement on the initial disclosure reserving that right. However, the TILA/RESPA final rule does not allow a creditor to state that it may issue revised disclosures on the Loan Estimate, so this amendment has been proposed to resolve that issue.

The proposal would also amend the 2013 Mortgage Loan Originator Final Rule to provide for the placement of the NMLSR ID on the integrated disclosures.

Have a great weekend everyone and Happy Halloween!

CFPB Releases Compliance Bulletin and Guidance for Mortgage Servicers

Written by Angela Meyster, Senior Regulatory Affairs Counsel

Last week, the Consumer Financial Protection Bureau (CFPB) released a Compliance Bulletin and Policy Guidance(Guidance) for residential mortgage servicers and subservicers to use in evaluating the potential risks to consumers that may occur when transferring residential mortgage servicing rights (MSRs). Of course, for credit unions, such transfers are one way - NCUA prohibits credit unions from purchasing MSRs, but not selling them, in Section 703.16(a).

The Guidance replaces CFPB Bulletin 2013-01, released in February 2013, and serves to inform mortgage servicers that the CFPB intends to review carefully compliance with the revised Regulation X that took effect on January 10, 2014. The revised Regulation X implements the Real Estate Settlement Procedures Act (RESPA) and requires servicers to maintain policies and procedures “reasonably designed to achieve the objectives of facilitating the transfer of information … and of properly evaluating loss mitigation applications.”

The Guidance has four sections. Section A, “General Transfer-Related Policies and Procedures,” gives examples of transfer-related policies and procedures the CFPB may evaluate to determine a servicer’s compliance with revised Regulation X. Section B, “Applicability of the New Servicing Rules to Transfers,” provides answers to frequent questions regarding revised Regulation X and identifies risk areas on which CFPB examiners may focus. Section C, “Protections under Federal Consumer Financial Law,” offers descriptions of the other federal law that may be applicable to transfers of MSRs, as well as the possible consequences of non-compliance. Finally, Part D, “Plans for Handling Servicing Transfers,” alerts entities engaged in frequent MSR transfers that the CFPB may require them to prepare and submit informational plans to ensure that they manage any risks posed to consumers. 

The takeaway here is that this is clearly an area to which the CFPB, and, by a function of that, NCUA, are paying attention. If your credit union transfers its mortgage servicing rights you will need to be on the lookout for these issues and should consider giving the Guidance an in-depth read. The Guidance is effective October 23, 2014 and applicable beginning August 19, 2014.

***

And now for a shameless plug on an upcoming NAFCU Webcast: Annual BSA Training for Boards of Directors. Equip your volunteer officials with an overview of their fiduciary duties while meeting annual BSA training requirements with this special webcast presented by NAFCU’s executive vice president and COO, Anthony Demangone. This short, fast-paced training session will highlight the general structure of America's anti-money laundering system, outline your directors’ responsibilities related to BSA and OFAC requirements, and more. Your entire board can take part for only one special price: $100 for members, $150 for nonmembers. Sign up here. 

Election Day and Lame Duck Congress around the Corner

Written by, Jillian Pevo, Director of Legislative Affairs               

It seems like we are in a perpetual campaign cycle here in Washington, DC, I’m sure many of you have seen enough political commercials, yard signs and shameless self-promotion in the last six months to last a lifetime. The stakes seem to be pretty high for a midterm election with Senate Democrats fighting to keep a razor thin majority and a number of competitive statewide races that could go either way. In the House of Representatives, Republicans are expected to retain their majority but there will still be some personnel changes on key committees. With just over a week to go, national headlines are being dominated by issues of concern to many Americans including the government’s response to the Ebola virus and Islamic State in Iraq and Syria (ISIS). These high-profile issues and others could sway undecided voters as they head to the polls next Tuesday. 

Regardless of election outcomes, the current Congress is scheduled to reconvene one last time after election day for a “lame duck” session.  While much of the session’s agenda will be shaped by what happens on election day and who will control Congress in January, there are a few items that are very likely to see action, including government funding and expiring tax provisions known as tax extenders. At NAFCU, we will continue to push the Senate to take up House-passed regulatory relief measures that will make small but positive changes at our nation’s credit unions. These measures include:

• Exempting financial institutions from sending annual privacy notice disclosures when policies have not changed (House-passed H.R. 749/S. 635 awaits Senate action).  While the CFPB has recently acted on this issue, we believe a legislative solution is the better answer in the long run;
• Providing credit unions parity with FDIC-insured institutions when it comes to deposit insurance coverage on Interest on Lawyers Trust Accounts or IOLTAs (House-passed H.R. 3648/S. 2699 awaiting Senate action); and
• Amending the calculation of points and fees under the CFPB’s qualified mortgage rule (House-passed H.R. 3211/S. 1577 awaiting Senate action).        

While legislative action this Congress is unlikely, NAFCU will also continue to push lawmakers to address the lack of national data security standards at retailers. Countless breaches occurred while Congress was out of session including the massive Home Depot breach. NAFCU has called for the creation of a bipartisan-bicameral Congressional working group to get key lawmakers together to devise a set of legislative policy prescriptions that would put standards into place at retailers and ensure that they are financially liable when a breach occurs on their end. President Obama recently called for national legislation to address ongoing data security breaches and we are hopeful that Congress acts with urgency.

Please don’t hesitate to reach out to NAFCU’s Legislative Affairs division should you have any questions about matters before Congress. And, don’t forget to vote! 

System Changes to Ease Compliance with OFAC Sanctions Regulations; NCUA Board Actions

Written by Shari R. Pogach, Regulatory Paralegal

Earlier this month, the Department of Treasury’s (Treasury) Office of Foreign Assets Control (OFAC) announced the consolidation of all of its non-Specially Designated National (SDN) lists into one set of data files now known as the “ Consolidated Sanctions List.”  The consolidated files comply with all of OFAC’s existing data standards and include all of the following lists:

Non-SDN Palestinian Legislative Council (NS-PLC),

Part 561,

Non-SDN Iran Sanctions Act (NS-ISA),

Foreign Sanctions Evaders, (FSE List), and

Sectoral Sanctions Identifications, (SSI).

The consolidation upgrade was done to reduce the number of list-related files needed to be downloaded so as to maintain an automated sanctions screening program. When appropriate, OFAC also will add any new data associated with any sanctions list created where the required action of a U.S. person does not necessarily entail blocking to the consolidated data files.  OFAC’s changes are meant to ensure that all of the sanctions list records are included in its Sanctions List Search tool.  This tool allows users to search for a name on the SDN lists and the consolidated list.

In approximately six months, OFAC will stop issuing independent files for the FSE, SSI and NS-PLC lists.  During this transition period OFAC will still produce the data both on the individual lists and the consolidated list.  And, OFAC will continue to provide and update .pdf and .txt versions of the FSE, SSI, NS-ISA, NS-PLC and Part 561 lists and their respective archive of changes files.  These file formats will continue to be available even after the transition period.

Additional administrative technical information concerning the non-SDN list data is also available in the Treasury announcement.  And, here are related FAQs for additional information on algorithms, scoring and other technical details regarding Sanctions List Search.​

***

​​​NCUA Board Actions. Yesterday, the NCUA Board issued two proposed rules.  The first would implement 2014 statutory changes to flood insurance measures affected by the Biggert-Waters Flood Insurance Act.  The second updates and technically revises the agency’s rules on corporate credit unions.  In addition, NCUA staff told the NCUA Board there will be no share insurance premium assessment for 2014.  There will soon be a NAFCU blog post breaking down the flood insurance proposal, so stay tuned!

 

CFPB Finalizes the Privacy Notices Rule; Seminar 2014 Wrap and Group Photo; Fall Fun with the Fam

Written by JiJi Bahhur, Director of Regulatory Compliance

On Monday, the CFPB announced that it finalized the privacy notices rule with the intent to promote more effective privacy disclosures from financial institutions to their customers/members.  So now the answer to the burning question that so many credit unions have been asking: Does the credit union still need to send annual privacy notices to its members? 

Short Answer

Yes, the credit union still needs to send annual privacy notices to its members; however, the CFPB’s final rule allows a credit union to post this annual privacy notice online instead of sending it out individually to members IF certain conditions are met.  

Long(er) Answer

Under the CFPB’s privacy notices final rule, credit unions will be able to post annual privacy notices online instead of distributing an annual paper copy to each individual member, if the credit union satisfies the following conditions:

1. The credit union does not share its members’  nonpublic personal information with nonaffiliated third parties in a manner that triggers Gramm-Leach Bliley Act (GLBA) opt-out rights;
2. The credit union does not include on its annual privacy notice information about certain consumer opt-out rights under section 603 of the Fair Credit Reporting Act (FCRA);
3. The credit union’s annual privacy notice is not the only notice provided to satisfy the requirements of section 624 of the FCRA;
4. The information included in the privacy notice has not changed since the member received the previous notice; and
5. The credit union uses the model form provided in GLBA’s implementing Regulation P.

Credit unions that meet the conditions above and that choose to rely on this new method of delivering privacy notices are also required to:

1. Convey at least annually on a regular consumer communication, such as a monthly billing statement, that the credit union’s privacy notice is available on its website and in paper and will be mailed upon request made to the provided toll-free number. This notice or disclosure would have to also include a specific web address that takes the member directly to the privacy notice;
2. Post the credit union’s current privacy notice continuously on a page of its website that contains only the privacy notice, without requiring a login or any conditions to access the page; and
3. Promptly mail (within 10 days) the credit union’s current privacy notice to consumers who request it by telephone.

If the credit union does not meet the conditions above or chooses not to use the new disclosures method, it will need to continue to deliver annual privacy notices to its members using other delivery methods. 

This blog won’t address some of the nitty gritties within each of the conditions above, but I do want to make a few quick mentions:

• While this final rule constitutes an important step to achieving improved annual privacy notice requirements, it is only available to those credit unions that do not share information with nonaffiliated third parties outside of the Regulation P exceptions [Ed. 10/23] .  In other words, credit unions that do share information with nonaffiliated third parties cannot take advantage of this final rule.

• NAFCU has long advocated for the elimination of duplicative and costly annual privacy notices.  In its comment letter, NAFCU noted that CFPB should not require credit unions to continuously post their privacy notices on their websites.  NAFCU argued that this “continuously” verbiage would effectively require that credit unions’ website remain functional at all times.  In the preamble to the final rule, the CFPB discussed NAFCU’s concerns and emphasized that this requirement “assumes that financial institutions will post the privacy notice on their websites so that the notice is available but for occasional or unavoidable interruptions, such as routine maintenance or unexpected malfunctions.”   In other words, the credit union will not violate this requirement if its website temporarily malfunctions.

The final rule is available in its entirety here.  NAFCU’s Regulatory Affairs team is working on a summary of the final rule, which when available, will be located here.  Also, NAFCU’s compliance team intends to address this final rule in more depth in near future publications. 

***

Seminar 2014 Wrap and Group Photo.  Last week, NAFCU held its 2014 Regulatory Compliance Seminar.  The program contained 4 days of the hottest credit union compliance topics, great speakers, and an amazing group of attendees.  Below, I’ve shared a group photo taken during the event.

If you’re interested in attending Seminar next year, check out some of the details here.

***

Fall Fun with the Fam.  I had to sneak this in.  It’s not often that I can get the entire family to look at the camera at the same time!

According to the CFPB, Free Checking Means Free, No Catches… None!; Nuptial Pictures

By Eliott C. Ponte, Law Clerk

Free Checking Means Free, No Catches… None!

Earlier this month, the Consumer Financial Protection Bureau (CFPB) published a consent order in which M&T Bank consented to pay a $200,000 civil money penalty and return $2.9 million in assessed fees to 59,000 of its customers for alleged UDAAP and Truth in Savings violations.  According to the consent order, M&T Bank advertised free checking accounts to consumers when, in fact, the free checking account was only free if the participating consumer maintained a certain level of account activities.

After reading both the CFPB Press Release and the consent order, it appears that M&T Bank decided it wanted to offer a free checking account product with a catch:  the consumer must maintain a minimum level of account activity for 90 consecutive days.  If a consumer failed to maintain the minimum activity level after 90 days, the consumer was automatically withdrawn from the free checking account and enrolled into a new non-free checking account.  However, the advertisements made by M&T Bank failed to mention the required minimum level of account activity.  Below are some of the advertisements made by M&T Bank as mentioned in the consent order:

• “Have you raised the green flag for free checking from M&T Bank?  There’s no minimum balance requirement and no monthly service charge;”
• “Untangle yourself from monthly service fees.  Get a free checking account at M&T.  No strings attached;”
• “Free yourself from monthly service fees.  Get free checking from M&T Bank;”
• “M&T Totally Free Checking No minimum Balance.  No monthly service charge.”

While the advertisements failed to mention that a consumer had to maintain a minimum level of account activity to remain enrolled in the free checking account, M&T Bank disclosed this requirement to the consumer prior to opening the account.  As stated in the consent order, consumers received written notice of both the requirements to maintain the free checking account and the consequences for failing to meet the minimum requirements when they opened their accounts.  In fact, the complaint acknowledges that M&T Bank gave each consumer a one-page document that disclosed these requirements.  Moreover, the consumers also received an additional one-page document that contained the features of the non-free checking account, which included the disclosure of the monthly maintenance fee for not meeting the required activity requirements of the non-free checking account, in case the consumer failed to meet the minimum activity requirements of the free checking account. 

Nevertheless, from the CFPB’s perspective, these prophylactic measures taken by M&T Bank still violated UDAAP because none of the advertisements mentioned either the minimum activity requirement or the automatic conversion from a free checking account to a non-free checking account.  Moreover, the CFPB claimed this violated Truth in Savings because the regulation prohibits advertising an account as “free or no cost” if a maintenance or activity fee can be imposed on the account. 

While consent orders are not actual interpretations of law or regulation (consent orders are merely settlement agreements between two parties, and, unlike the opinion of a court, cannot be relied on in other enforcement actions), it is important that compliance officers pay attention them because consent orders tells the industry what a regulator thinks is a violation of a law or regulation.  In the case of M&T Bank, the consent order tells us what the CFPB thinks is a violation of UDAAP and Truth in Savings for the purposes of advertising free checking.  If a credit union is thinking of advertising a free checking account product, the credit union should remember this consent order and avoid the mistakes the CFPB claims M&T Bank made.

****

Nuptial Pictures!

Thank you to everyone who sent me emails congratulating me on my nuptial.  The positive remarks were a wonderful thing to read on my first day back at NAFCU.  As promised, I have posted some wedding pictures below.  In the coming blog posts, I will post highlights of my honeymoon trip through Europe and North Africa.  

Here comes the bride (and her father). 

Husband and wife during our first toast.

Below is a collage of pictures from our wedding photographer.

And last but not least, a wedding selfie! 

Obstructing the Finances of Transnational Organized Crime Across the U.S./Mexico Border and the October BSA Blast and BSA Quiz

Written by Shari R. Pogach, Regulatory Paralegal

During a recent speech, Jennifer Shasky Calvery, director of the Financial Crimes Enforcement Network (FinCEN), discussed the agency’s work in conjunction with government entities in Mexico to safeguard each country’s financial systems from criminal financial abuse. Shasky Calvery stated that Mexico and the United States share more than a border, they work together on multiple fronts “to disrupt the finances of transnational organized crime, including those organizations engaged in drug trafficking, human trafficking and smuggling.” The FinCEN director also noted that what happens in Mexico impacts the United States so it’s important that the authorities in both countries “understand what financial institutions on both sides of the border are experiencing.”

In September, Mexico’s president announced the Mexican government will no longer limit the monthly cash deposits of U.S. dollars that corporate clients of border banks can make provided such clients meet certain requirements.  The movement of currency across the U.S. border to Mexico continues to be an issue and this recent action by the Mexican government has elevated money laundering concerns.

NAFCU members can read more on FinCEN’s recent actions to combat criminal financial abuse in the October issue of the BSA Blast.  The issue reviews FinCEN’s guidance on financial activity that could signal red flags for human smuggling and human trafficking as well as the agency’s focus on money laundering activity across the U.S. border to Mexico and other Latin American countries.  The October edition also includes a BSA quiz that focuses on red flags for financial activity in connection with human smuggling and trafficking.  The quiz can be used in training for frontline personnel.

FHFA Proposes Changes to Federal Home Loan Bank Membership Eligibility

Written by Angela Meyster, Senior Regulatory Affairs Counsel

Last month, the Federal Housing Finance Agency released a proposal that would change the eligibility requirements for institutions, including credit unions, to join and maintain membership in Federal Home Loan Bank (FHLBs).  While NAFCU estimates that the current level of credit union involvement with FHLBs is relatively low (around 19% of all federally insured credit unions), the Federal Home Loan Banks do provide an important avenue for liquidity to which an increasing number of credit unions may look to as lending becomes tighter in the future and interest rates rise. The impact of this proposal on your credit union today may be minimal, but as your credit union plans for the future you may want to familiarize yourself with how the FHLB system works now and would work under the proposal.

So how does it work? Federal Home Loan Banks operate a bit like credit unions in that they are cooperative, member-owned institutions. There are twelve of them, organized by region, and they offer low-cost secured borrowing to their members in order to assist with liquidity, housing mortgage markets, and community development. Federal Home Loan Banks represent the largest collective source of home mortgage credit in the U.S. and they have been a source of significant assistance to participating credit unions.

The proposal would change a number of things about FHLB membership.  The three most important for credit union purposes are that it would:

• Require FHLB members and applicants to keep 1% of assets in “home mortgage loans;”
• Require FHLB members to have at least 10% of assets in “residential mortgage loans” on an ongoing basis; and
• Require FHLBs to determine member compliance on an annual basis, and terminate the membership of any credit union that has been noncompliant for two consecutive years.

Currently, there is no 1% requirement to keep assets in “home mortgage loans.”  Under the existing regime, a credit union, upon becoming a member, must be in the business of making “long term home mortgage loans,” but there is no quantitative component of making this determination.  Additionally, the 10% requirement to hold assets in “residential mortgage loans” currently only applies upon application for FHLB membership.  The proposal’s requirement to maintain this threshold asset allocation on an ongoing basis may pose issues for some credit unions that do not concentrate on mortgage lending.

In order to make compliance with the 1% requirement somewhat easier, however, the proposal would expand the definition of

“home mortgage loans” to include “any loan or interest in a loan that is secured by a first lien mortgage or any  mortgage pass-through security that represents an undivided ownership  interest in such loans or in another security that represents an undivided ownership interest in such loans.”

NAFCU has met with the FHFA to discuss aspects of the proposal and requested an extension of the comment deadline. NAFCU requested the extension because of the complexity of the rule, and the significant impact the rule could have on the industry and credit unions ability to establish and maintain membership in FHLBs. The comment period closure, originally slated for November 12, 2014, has been extended until January 12, 2015.  We continue to emphasize that the requirements set out in the proposal are unnecessary and prohibitive, especially for credit unions, which have not participated in the type of activities the proposal targets.  NAFCU has noted that the proposal would make it more difficult for credit unions to provide credit to their members and could prevent many credit unions who have  been long-time FHLB members from being able to continue their membership.

FBI Financial Crime Cases Illustrate BSA Abuses; Two Programming Notes

Written by Shari R. Pogach, Regulatory Paralegal

I’ve previously written that real world examples of criminal activity can be useful training tools for Bank Secrecy Act education.  Real world examples can be used to get your staff thinking about what to look for when interacting with members on the front line.  Under the news section of the Federal Bureau of Investigation’s (FBI’s) website one can find a treasure trove of cases involving financial crimes.  Here are snippets from example cases: 

Embezzlement and Elder Financial Abuse:

Bank Employee Sentenced for Embezzling from Senior Citizens’ Accounts

“Diane Elizabeth Niehaus, 40, of Sugarcreek Township, Ohio, was sentenced in U.S. District Court to serve 60 months in prison, followed by three years of supervised release, for embezzling from the accounts of elderly customers of the bank where she worked as a manager. She was also ordered to pay restitution to the victims of her embezzlement and to the IRS.”

Automated Clearing House (ACH) Fraud:

Kansas City Woman Indicted in $3 Million Fraud Scheme That Forced Employer into Bankruptcy

[…]

“According to the federal indictment, for approximately 10 years (January 2004 until February 2014) Brooner created unauthorized Automated Clearing House (ACH) transactions from Galvmet’s bank account. An ACH is a batch-oriented funds transfer system that includes direct deposits of payroll from companies. Brooner allegedly deposited these funds into her personal bank accounts. Brooner also manipulated ACH transactions to inflate her salary, the indictment says, by increasing her bi-weekly payments without the knowledge or authorization of her employer. She allegedly deposited these funds into her bank accounts.

As a result of Brooner’s fraud scheme, the indictment says, Galvmet lost at least $1,863,914. As a result, Galvmet declared bankruptcy, and was forced to cease operations. To keep the scheme going, Brooner allegedly falsified documents to support Galvmet’s operating loan with Missouri Bank & Trust, causing a loss to the bank of $1.1 million. Brooner allegedly converted the embezzled funds for her personal enrichment. The total loss from Brooner’s alleged fraud scheme was at least $2,963,914.”

Trade-Based Money Laundering Activity: 

Money Laundering Takedown - Operation Targets Sinaloa Drug Cartel

“In a major takedown in Los Angeles on Wednesday, September 10, nearly 1,000 federal, state, and local law enforcement officers seized approximately $100 million in cash, arrested nine subjects, and searched dozen of businesses in the city’s downtown fashion district alleged to have laundered money for Mexican drug cartels.”

You might want to use cases from this website as yet another resource to help with ongoing BSA education and training.

***

Programming Note #1.  NAFCU’s offices will close at noon today for the Columbus Day Holiday and will reopen on Tuesday, October 14.  We will be back to blogging on Wednesday, October 15.

***

Programming Note #2.  It’s seminar time at NAFCU! The Regulatory Compliance team will be at NAFCU’s 2014 Regulatory Compliance Seminar in Baltimore, MD. Your compliance questions will be answered but we appreciate your patience as the team will be in and out of the office this week.

FFIEC “Shellshock” Vulnerability Alert; Cyber Security Awareness; Consumer Compliance Outlook; Outlook Live Webinar on Fair Lending

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

Federal Financial Institutions Examination Council (FFIEC) members recently issued a statement advising financial institutions of a material security vulnerability in the Bourne-again shell (Bash) system software, referred to as “Shellshock.” The statement outlines the agencies’ risk management expectations. From the statement:

“While vendors are working to patch and update their systems, the FFIEC member agencies expect financial institutions to conduct a risk assessment and address the Shellshock vulnerability as part of ongoing information security and incident response plans. Financial institutions should take the following steps, as appropriate:

• Identify all servers, systems, and appliances that use vulnerable versions of Bash and follow appropriate patch management practices, including conducting a vulnerability scan to detect if the patch is installed and testing to ensure a secure and compatable configuration.³
• Apply mechanisms to filter malicious traffic to vulnerable services such as appropriate Web application firewall signatures.
• Monitor systems for malicious or anomalous activity and update signatures for intrusion detection and prevention systems.
• Ensure that all third-party service providers are taking appropriate action to identify and mitigate risk and monitor the status of vendors’ efforts to address the vulnerability.
• Review systems to determine if this vulnerability has been exploited and, if necessary, conduct a forensic examination to determine the potential effects of any breach.” (Footnote omitted)

The statement also includes references for monitoring threats and vulnerabilities and is available in its entirety here.

***

Cyber Security Awareness. October is also cyber security awareness month.  NCUA recently took this opportunity to remind credit unions about its Cyber Security Resources page  and that cyber security remains a priority.

***

Consumer Compliance Outlook. The Third Quarter 2014 issue of the Federal Reserve’s Consumer Compliance Outlook is now available. One of the articles features responses to questions received during an April 10, 2014, webinar held by the Federal Reserve System. Although the article, Consumer Compliance Management Program – Common Concerns and Best Practices Webinar Questions and Answers, is directed at Board supervised institutions, it is a useful read and touches on several topics of interest – the development of compliance management programs, compliance risk assessments, vendor management and regulatory change management. Here’s an excerpt from just one of the Q&A’s:

“Are there examples of a change management process that you can share with us?

Given the changing regulatory landscape with additional responsibilities of banks under new or revised regulations and pressures to follow competitors as new products are introduced in the marketplace, establishing a change management process can be an effective tool not only to manage changes but also to track any steps the institution has taken to mitigate potential harm and risks to consumers and the institution. The methods of developing and implementing a change management process may vary based on the institution’s size, complexity, and resources available.

Change management should be a structured and disciplined process that can be repeated since change can always be expected. The RFS Program describes that an effective change management process:

• requires management and staff from all affected functions — potentially including compliance, accounting, risk, internal audit, and line management — to review and recommend a response or change proposal for senior management or board approval that clearly articulates expected results. The entire life cycle of a product or service affected by the change must be considered, whether it involves the introduction of a new product or service or a change affecting existing bank operations.
• incorporates appropriate approval processes associated with implementation.
• requires that operating policies and procedures are updated to provide clear guidance to staff on how to comply with all legal or regulatory requirements.
• requires that staff be properly trained regarding the change.
• incorporates monitoring of the deployment of the new or revised process, product, or service.
• requires a review after implementing a change to determine whether the actions taken achieved the expected results.^14”  (Footnote omitted)

This Q&A, and the remainder of the article, may be found in its entirety here.

***

Outlook Live Webinar on Fair Lending.  The Federal Reserve System is also hosting a free webinar entitled “2014 Federal Interagency Fair Lending Hot Topics” on Wednesday, October 22, 2014, from 2:00 p.m.–3:30 p.m. Eastern. The webinar will feature representatives from various federal agencies, including NCUA, and will discuss emerging fair lending issues and hot topics. Additional details and registration is available here.

 

NCUA Allows for Second Comment Period for Risk-Based Capital Rule

Written by Angela Meyster, Senior Regulatory Affairs Counsel

A sigh of relief was heard throughout the credit union industry last Monday when NCUA announced that it will propose a revised Risk-Based Capital Rule for a new comment period.  NCUA Board Chairman Matz stated that this second comment period was appropriate as a result of the “significant structural changes being considered” and that she was always considering another comment period in the event that the intended changes to the proposal exceeded the parameters of the Administrative Procedures Act.

Details of what the second proposal will entail are scarce, but NCUA has indicated that the amended proposal will include, among other changes, (1) a longer implementation period and (2) revised risk weights for: mortgages, investments, member business loans, credit union service organizations, and corporate credit unions,.  Additionally, NCUA will seek comment on an “alternative approach for addressing interest rate risk using the supervisory process.”

Only time will tell how significant these proposed structural changes really are, but it does not look like credit unions will have to wait too long—Chairman Matz has noted that she anticipates that the NCUA Board could reissue a revised proposal by the end of 2014!

Now, Chairman Matz is not the only NCUA Board member that has been vocal on this rule. NCUA Board Vice Chairman Rick Metsger praised Chairman Matz’s willingness to consider structural changes in the risk-based capital proposed rule.  Beyond the additional time to comment, Vice Chairman Metsger is in favor of a proposal that would separate interest rate risk and credit risk. He stated:

“As I have often said, I believe interest rate risk is important and must be addressed in the risk-based capital rule, but it should be addressed separately from credit risk. Weighting credit risk and interest rate risk with a single numerical value created conflicts that ultimately made it difficult to accurately weigh the risk of either.

I am pleased we appear to be moving in the direction of separating interest rate risk and credit risk and that structural change alone is sufficient for me to believe an additional comment period would be appropriate.

While an amended proposed rule has not been drafted, I believe that when people do review it, they will conclude that we have both listened to—and heard—the comments that were submitted during the initial comment period. Those who weighed in thoughtfully on the original proposal will see the agency has been responsive to fact-based analysis.”

New NCUA Board Member Mark McWatters has been adamant since joining the NCUA Board that he would not vote for the risk-based capital rule without a second comment period.  Following Chairman Matz’s statement, Board member McWatters stated:

 “I will not consider the rules for adoption unless they are re-proposed with a robust comment period of not less than 60 to 90 days. I articulated this position out of respect for Congress and those members of the credit union community who have  enthusiastically voiced their opposition to the proposed rules.

That said, the previously proposed risk-based capital rules are deeply flawed and merit substantial revision.  The devil is in the details, and I await the details before I can pass judgment on the next draft of the proposed rules.” 

The devil is indeed in the details

I cannot tell you how short-lived the sense of peace from this announcement will be and whether the industry’s original concerns will be reflected in the new proposal. That said, this recent action should be taken as a win for the credit union industry.  Credit unions, large and small and with very diverse fields of membership, banded together and effected change from the regulator and this news is a good indication that the regulator is actually listening to credit union concerns.  NAFCU has consistently advocated for a second comment period and we are pleased NCUA has paid heed to the comments and feedback of credit unions across the country and is planning to make significant changes to the structure of the rule. 

Looking for a refresher on the issue to prepare for the suspense during next three NCUA Board meetings? Visit NAFCU’s Capital Reform page. On it you will find a summary of what has happened to date with regards to the proposed rule, past compliance blogs outlining the issues, a recording of the NCUA’s listening sessions that occurred this past summer, NAFCU’s official comment letter to NCUA and position statement on the rule, recent media outreach, and much more.

On behalf of all of NAFCU, I would like to thank all of you for the work your credit union has done on this important issue.  As for the Regulatory Affairs team, we will continue to do whatever it takes to end up with a fair rule, and we will continue to update you on any and all developments.

CFPB’s Proposed Changes to Regulation C’s Institutional Coverage; Football and Compliance

Written by Alicia Nealon, Regulatory Affairs Counsel

Happy Friday compliance community! It’s certainly been awhile since I’ve been on here, but the Compliance Team graciously decided to let me borrow the blog today.  I suppose it’s my Friday treat :) With it being Friday, I thought I would try to give you all some good news by clearing up some confusion that NAFCU has heard of regarding the Consumer Financial Protection Bureau’s (CFPB) recent Regulation C proposal.

As avid readers of this blog, you may recall that at the end of July, CFPB announced a proposed rule that would make several substantive changes to the reporting requirements under the Home Mortgage Disclosure Act (HMDA).  The proposal would, among other things, expand the data financial institutions are required to collect and report under Regulation C. Some of the expanded data collection and reporting is driven by Dodd-Frank, which amended HMDA to require collection of certain new data points. However, the CFPB also appears to be taking this opportunity to propose the collection of significantly more data than Dodd-Frank expressly requires. In addition to expanded data collection, the proposal includes changes to the scope of Regulation C’s coverage and generally seeks to clarify existing requirements by including more Staff Commentary. 

NAFCU’s Regulatory Affairs team published a Regulatory Alert providing a detailed overview of the proposal and seeking comments from our members. As we’ve been soliciting feedback under our Regulatory Alert Survey, we’ve gotten a few questions about how the proposal would change Regulation C’s institutional coverage.

Generally speaking, whether an institution is covered by Regulation C’s data collection and reporting requirements depends on its asset size, location, and whether it is in the business of residential mortgage lending. For depository financial institutions, such as credit unions, Regulation C currently requires HMDA data reporting if they meet the following criteria:

        (1) On the preceding December 31, it had assets of at least $43 million;

        (2) On the preceding December 31, it had a home or branch office in an Metropolitan Statistical Area (MSA);

        (3) During the previous calendar year, it originated at least one home purchase loan or refinancing of a home         purchase loan secured by a first-lien on a one-to-four unit dwelling; and

        (4) The institution is Federally insured or regulated, or the mortgage loan referred to in item (3) was insured,         guaranteed, or supplemented by a Federal agency or intended for sale to Federal National Mortgage         Association or the Federal Home Loan Mortgage Corporation.

12 CFR 1003.2.

The proposal would not alter any of these criteria.  Instead, it would add another criterion establishing a uniform loan volume threshold – the “25-loan volume test.”  For credit unions, the addition of this new criterion would mean that HMDA reporting would only be required if the credit union meets the current criteria in Section 1003.2 and originated at least 25 covered loans, excluding open-end lines of credit, in the preceding calendar year.  Accordingly, credit unions that do not report HMDA data now because they don’t meet the current criteria in Section 1003.2  will not be required to report HMDA data solely because they originate 25 covered loans.  For example, a credit union that does not originate at least one home purchase loan secured by a first-lien on a one-to-four unit dwelling would not be subject to HMDA reporting requirements even if it originated 25 other closed-end loans.  Similarly, a credit union that has less than $43million in assets would not be required to report HMDA data even if it originated 25 covered loans, excluding open-end lines of credit, in the preceding calendar year.  The moral of the story is that the proposal will not remove any of the current factors that determine institutional coverage.  The proposal only adds another factor that credit unions would need to meet in order to be subject to HMDA reporting requirements. 

For more information on other aspects of the 600-page proposal, be sure to check out NAFCU’s Regulatory Alert and our September 2014 Compliance Monitor, which featured an article breaking down the proposal.  NAFCU is also still accepting feedback from our members for our comment letter through our Regulatory Alert Survey.

****

NAFCU Credit Union Compliance GPS. NAFCU's 2014 Credit Union Compliance GPS is still available. This comprehensive, electronic resource translates complex regulatory language into plain English. The latest edition includes improved user-friendly search functions, including more hyperlinks and bookmarks and much more. You can purchase a copy for your credit union here!

****

Football and Compliance.  As compliance attorneys, we know that you have a lot of headaches.  This being college football season, and it being Friday, many of us are following our alma mater or our favorite team.  Sometimes they give us a headache as well.  While I am not a fan, I can say that it particularly hasn’t been a good week for fans of the Michigan Wolverines.  For those of you who haven’t been following the saga, you can get a timeline here.  Basically their fumbling of a concussion situation with their quarterback, has led to a bigger headache for their coach and their athletic director.  It also probably doesn’t help that they are 2-3 after a series of embarrassing losses.  The moral of the story here that can apply back to compliance is to address problems while they are small and easy to address and not let them spiral out of control.

DOD Proposes to Expand Military Lending Act Rate Cap to More Consumer Credit Products

Written by Shari R. Pogach, Regulatory Paralegal

Last Friday, the Department of Defense (DOD) announced a proposed regulation that would expand the Military Lending Act’s (MLA’s) 36 percent rate cap, among other protections, to additional consumer credit products.  DOD’s proposed changes would apply the MLA protections to all forms of payday loans, vehicle title loans, refund anticipation loans, deposit advance loans, installment loans, unsecured open-end lines of credit and credit cards (with some conditional exclusions).  

Under current implementing rules, MLA protections extend to closed-end payday loans for no more than $2,000 and with a term of 91 days or fewer, closed-end auto title loans with a term of 181 days or fewer and closed-end tax refund anticipation loans. The proposed changes would amend the definition of “consumer credit” to more closely match the definition under the Truth in Lending Act, covering more credit products.  Not all credit products would be affected by the proposed regulation - residential mortgages and purchase-money loans (to buy items like cars) are excluded from the MLA’s definition of “consumer credit.”

Elements of the proposal include:

• Amendments to extend the protections of the MLA implementing regulations to a broader range of credit products. The proposal would define “consumer credit” to be consistent with closed- and open-end credit products that already are regulated under the Truth in Lending Act. The intent is to move away from the product-by-product approach and towards a comprehensive, no-gaps approach.
• Alignment of the MLA with TILA to provide service members with more lasting protections.
• Loan disclosures intended to simplify a lender’s disclosure obligations to covered borrowers under the MLA and would provide for a non-numerical descriptive statement of Military APR that would be consistent across loans offered to service members.
• Allow lenders to assess whether borrowers are covered by the MLA by checking their status in an existing, publicly-available online DoD database. Lenders who used the database would receive a safe harbor from liability under the MLA.

NAFCU will be studying the proposed rule carefully for any unintended consequences from the proposal that would prevent credit unions, particularly those operating on military installations, from providing those safe credit products that servicemembers have come to depend on from their credit unions.  Comments on the proposed rule are due November 28, 2014.  A Regulatory Alert with an analysis of the proposal will soon be available for NAFCU members here (NAFCU member login needed).