NAFCU Compliance Blog

CFPB’s Enforcement Focus: Online Marketplace Lenders

By Kavitha Subramanian, Regulatory Affairs Counsel

Good Morning, Compliance Colleagues! I hope you all had a relaxing Thanksgiving holiday with family and friends! I, for one, am very thankful to have the opportunity to blog for you all on this wonderful Monday morning.

As you may have seen, a few weeks ago, the CFPB issued its Fall 2015 Rulemaking agenda which highlighted its current regulatory focus for the remainder of 2015 into the beginning of 2016. In particular, the CFPB listed the following regulatory issues on its agenda:

• beginning a rulemaking process to address concerns related to the use of arbitration agreements;
• preparing a rule concerning overdraft programs on checking accounts;
• researching a rulemaking on debt-collection activities;
• developing rules to define larger participants in markets for consumer installment loans and vehicle title loans;
• implementing requirements that financial institutions report information about lending to women-owned, minority-owned and small businesses; and
• supporting implementation of the Home Mortgage Disclosure Act and other mortgage rules.

As far as long-term objectives throughout 2016, CFPB noted potential additional rules or amendments to existing rule on consumer credit reporting and student-loan servicing.

One issue notably missing from the CFPB’s agenda is Online Marketplace Lenders. However, based on the Bureau’s recent enforcement actions this issue is still a high on the Bureau’s enforcement agenda entering into 2016.

On November, 17, 2015, the CFPB issued an enforcement action against online lender Integrity Advance LLC for deceiving consumers about the cost of short-term loans. Of note, the CFPB alleges that the online lender violated TILA and the ETF Act, and that Integrity Advance violated the Dodd-Frank Act’s prohibition against unfair, deceptive, or abusive acts or practices (UDAAP).

CFPB alleges that from May 2008 through December 2012, Integrity Advance offered loans with terms that allowed the loan to roll over four times, causing consumers to accrue more costs before the company applied any part of the payments to principal owed. However, CFPB said the costs disclosed by the lender did not address rollovers, just the costs of repaying in full, with the first payment. This practice, according to the CFPB results in the finance charges becoming more than double the amount originally borrowed.

The Online Marketplace industry is still rapidly evolving, and financial regulators are still struggling to define who the actors in this market are. The Treasury Department has referred to it as “the segment of the financial services industry that uses data-driven online platforms and investment capital to lend to consumers and small businesses.” However, many of these lenders are not clearly covered by existing financial regulations. Many of these actors are peer-to-peer lenders that are not traditional financial institutions with regular reporting requirements and regulatory oversight.

While the loan payment practices used by Integrity Advance are clearly not permissible for a bank or credit union making consumer loans, it will be interesting to see how the CFPB will continue to use its broad UDAAP authority to reign in what it views to be abusive practices in the unregulated online lending market. This method of identifying abusive practices through enforcement instead of rulemaking is increasingly a method that we have seen the CFPB use to address concerns in a particular product market where the Bureau’s legal authority for regulatory action are not quite clear.

NAFCU has been actively following this issue and we firmly believe the growth of the online marketplace lenders necessitates regulatory scrutiny. In August, NAFCU wrote the Treasury Department to highlight our concerns that the lack of regulation for online marketplace lenders could result in decreased consumer protections for borrowers who use their services.

NAFCU plans to work with Treasury and the CFPB to aid in their efforts to carefully study and identify the practices that online lenders are engaging in to circumvent consumer protection laws. If your credit union has any experience with or information regarding how online marketplace lenders have impacted lending activity in your communities, please feel free to reach out to me at [email protected] or 703-842-2212.

Smart Tech App Touts Ease of Obtaining Bank Accounts; Programming Note

Written by Shari R. Pogach, Regulatory Paralegal

Recently immigrated to the United Kingdom and don’t have a bank account? Do you have the following? A passport picture? A selfie? A smartphone? Well, you’re in luck, because with this new start-up company’s app, you can open up a bank account in as little as three (3) minutes with just a passport picture, a selfie and your smartphone.

The community website Business Insider has done a series of posts on the London-based start-up Monese. The company is targeted to newly arrived migrants who don’t yet have a financial footprint in their new location. Monese’s website states “you can open a UK banking account on your mobile in minutes, regardless of your citizenship.” As of October 2015, it had a waiting list of 56,000 applicants.

The company does not hold a banking license; rather it works with banks across Europe that hold a customer’s money. Monese has an e-money license that is issued by the United Kingdom’s Financial Conduct Authority and allows the company to digitally hold a customer’s money.

Once a customer applies and the application is approved, Monese sends the customer a Visa debit card. The customer can then link that card to the app and use it like any other debit card.

The Monese identity checking platform circumvents the Customer Identification Program (CIP) and “know your customer” regulatory hoops that U.S. financial institutions must follow. But the company insists: “We are members of a number of anti-fraud, anti-money laundering, and counter terrorist data-sharing networks which helps us to play our part in maintaining public safety effectively. We ensure that none of the customers who apply for Monese accounts are on a designated list or have any black marks for criminal activity against their identity.”

How do they do this? By checking a customer’s social networking footprint, using geo-location to perform additional checks and online video verification through Skype interviews. The company states: “The use of online video verification is also used to provide an additional level of verification if all else fails. The video chat which we conduct with customers over Skype is similar to an in-branch account opening experience with a high-street bank, except customers can do it from the comfort of their own house. All in all opening an account with Monese takes under 3 and in that short time we are able to run all of the checks required to feel comfortable that we know the person that has joined our service very well.”

Really?

***
Programming Note:  NAFCU will be closed for the Thanksgiving holiday this Thursday and Friday but we’ll be back to blogging on Monday, November 30.

Whatever you may be thankful for and however you may celebrate, from all of us here at NAFCU, may you and yours have a:

Debt Collection Practices and Operation Collection Protection

Written by Benjamin M. Litchfield, Regulatory Compliance Counsel

Greetings compliance fans! My name is Ben Litchfield and I recently joined NAFCU as a Regulatory Compliance Counsel. Prior to joining NAFCU, I worked in the Office of General Counsel at NCUA on various issues related to federally-insured credit unions. I look forward to working with you in the future and blogging about topics that are relevant to our members. This blog post covers some recent developments in an important, albeit unfortunate and sometimes overlooked, part of the lending lifecycle – debt collection.

FTC's Operation Collection Protection

On November 4, 2015, the FTC and other law enforcement authorities around the United States announced the first coordinated federal-state enforcement initiative targeting deceptive and abusive debt collection practices. They are calling this initiative “Operation Collection Protection.” (Sounds scary, doesn’t it?). Some of the practices being targeted by the FTC and its federal (including CFPB), state and local partners include:

• Harassing phone calls;

• False threats of litigation, arrest, and wage garnishment;

• Collection of phantom debts;

• Failure to provide consumers legally required disclosures and notices; and

• Failure to follow state and local licensing requirements.

In addition to its involvement in Operation Collection Protection, the CFPB has been very active in this area. In September, the Bureau took an administrative enforcement action against two of the nation’s largest buyers of defaulted loans, credit card accounts, car loans, and other debt. Some of the violations the CFPB alleged included:

• Failure to monitor portfolios of debt for accuracy;

• Calling consumers at unusual or odd hours;

• Calling consumers without prior express consent;

• False threats of litigation;

• Failure to require collections attorneys to provide account level review; and

• Using misleading collection affidavits.

While the Fair Debt Collection Practices Act (FDCPA) provides an exemption for creditors seeking to collect debts on their own behalf, NCUA “recommends” that federal credit unions (FCU) avoid the kinds of practices prohibited under the Act. See, NCUA Consumer Compliance Handbook, p. 98.  Additionally, the Federal Trade Commission (FTC), Consumer Financial Protection Bureau (CFPB), and NCUA have the authority to take enforcement actions to prevent unfair, deceptive, or abusive (UDAAP) debt collection practices committed by entities within their respective jurisdictions. Note though that to date, NCUA has not taken UDAAP enforcement action against an FCU, but many FCUs use third-party debt collectors who may be within the jurisdiction of the FTC or the CFPB.

Also, for state-chartered credit unions, things get a little more complicated because of specific language in the FDCPA and the Federal Trade Commission Act (FTC Act), which grant the FTC enforcement authority over state-chartered credit unions. As a result, the FTC has the ability to utilize its general enforcement authority under the FTC Act for debt-collection UDAAPs even where a party is collecting on its own debt.

The CFPB has signaled in previous guidance that it intends on using its UDAAP authority to prevent such acts or practices against creditors who commit the kinds of abusive acts prohibited by the FDCPA. Keep in mind though that the CFPB has primary enforcement authority over credit unions with assets over $10 billion.  

As a reminder, specific conduct prohibited by the FDCPA includes, but is not limited to:

• The use or threat of violence or other criminal means to harm the physical person, reputation, or property of any person;

• The publication of a list of consumers who allegedly refuse to pay debts, except to a consumer reporting agency;

• Causing a telephone to ring or engaging any person in telephone conversation repeatedly or continuously with intent to annoy, abuse, or harass any person at the called number;

• The use of false, deceptive, or misleading representations or means in connection with the collection of a debt;

• The collection of any amount (including any interest, fee, charge, or expense incidental to the principal obligation) unless such amount is expressly authorized by the agreement creating the debt or permitted by law; or

• Accepting, depositing or threatening to deposit any postdated check or postdated payment instrument unless certain circumstances are met.

The FDCPA lists many other prohibited acts and practices and requires specific disclosures when communicating with a consumer about a delinquent debt. It is important to keep in mind, however, that these lists are not exhaustive. The FTC and CFPB could always identify additional conduct that they feel constitute unfair, deceptive, or abusive debt collection practices.

So Why Does This All Matter?

Operation Collection Protection and recent CFPB enforcement actions signal that federal regulators are likely to remain laser-focused on unfair, deceptive, or abusive debt collection practices. Some of these collection cases have even resulted in criminal charges for individual debt collectors. Given the high volume of consumer complaints involving debt collection, observance of proper debt collection procedures by credit unions and their vendors will likely remain a top priority for compliance officers.

I have included some compliance resources below that may be useful to you as well as some interesting reading material for when you just feel like curling up by the fire with a nice FTC or CFPB Consent Order. I hope this blog has been useful and that you have a great rest of your week.

Federal Laws and Guidance Documents

• Fair Debt Collection Practices Act, 15 U.S.C. § 1692 et seq.

• CFPB Supervision and Examination Manual, pp. 667-676.

• Prohibition of Unfair, Deceptive, or Abusive Acts or Practices in the Collection of Consumer Debts, CFPB Bulletin 2013-07 (July 10, 2013).

• Service Providers, CFPB Bulletin 2012-03 (Apr. 13, 2012).

• Evaluating Third Party Relationships, NCUA Supervisory Letter No. 07-01 (Oct. 2007)

• FFIEC Social Media Guidance

News Articles

• FTC and Federal, State and Local Law Enforcement Partners Announce Nationwide Crackdown Against Abusive Debt Collectors, FTC Press Release (Nov. 4, 2015) (available at https://www.ftc.gov/news-events/press-releases/2015/11/ftc-federal-state-local-law-enforcement-partners-announce)

• CFPB Takes Action Against the Two Largest Debt Buyers for Using Deceptive Tactics to Collect Bad Debts, CFPB Press Release (Sept. 9, 2015) (available at http://www.consumerfinance.gov/newsroom/cfpb-takes-action-against-the-two-largest-debt-buyers-for-using-deceptive-tactics-to-collect-bad-debts/)

Recent Agency Enforcement Actions

• FTC v. BAM Financial, LLC (FTC Complaint for Permanent Injunction)

• FTC v. Kelly Brace, et al. (FTC Complaint for Permanent Injunction)

• FTC v. National Check Registry, LLC (Stipulation to Enter into a Final Order)

• FTC & CFPB v. Green Tree Servicing, LLC (Stipulated Order for Permanent Injunction)

• In re Encore Capital Group, Inc., 2015-CFPB-0022 (Consent Order)

• In re Portfolio Recovery Associates, LLC, 2015-CFPB-0023 (Consent Order)

***

Programming Note:  NAFCU’s offices will be closing at 12:00pm EST on Wednesday, November 25th and remain closed until Monday, November 30th, in celebration of the Thanksgiving Holiday.

NCUA Proposes Significant Changes to Field of Membership Requirements

Written by Brandy Bruyere, Director of Regulatory Compliance

Yesterday, the NCUA Board approved a 160+ page proposal that, if finalized, would be a comprehensive modernization of the agency’s chartering and field of membership rules. Since its Friday, we’ll stick to some high-level points for today, but NAFCU will post future blogs that provide some more details about the proposal.

Community Common Bond

A community-based charter must have clearly defined boundaries and serve a “well-defined local community or rural district.” Chartering and Field of Membership Manual, Part V.A.1 NCUA’s definitions of “well-defined” and “local community” have proven rather restrictive, requiring FCUs to serve either a single political jurisdiction or a “Core Based Statistical Area” (CBSA). However, the Manual limits FCUs to communities with a population of 2.5 million or less. This made it challenging to serve a CBSA whose population exceeded this limit. One positive aspect of the proposal would change this and instead allow a FCU to include only the portion of the CBSA the FCU seeks to serve when determining if the area exceeds the 2.5 million population limit, as opposed to the current practice of considering the whole CBSA population. The proposal would also allow “Combined Statistical Areas” (CSAs) designated by the Office of Management and Budget (OMB) to count as a “well-defined, local community."  However, CSAs would still be subject to the 2.5 million population limit. Here are a few other highlights of the changes to community common bond charters:

• Allow FCUs to include adjacent areas to a community consisting of a Single Political Jurisdiction, CBSA, CSA, or Rural District after showing, based on subjective evidence, that the residents interact or share common interests.
• Recognize congressional districts as a Single Political Jurisdiction.
• Increase the population limit for a Rural District from 250,000 to 1 million persons.
• Amend the definition of Underserved Areas definition to exclude non-depository institutions and non-community credit unions from the concentration of facilities ratio, as well explain that NCUA, when classifying an area as “underserved,” would consider two alternatives to the concentration of facilities ratio: (1) the CFPB’s list of “underserved counties,” or (2) a metric of the credit union’s own choosing based on “data of the Board and the Federal banking agencies.”

Multiple Common Bond Charters

Currently, a “service facility” for multiple common bond FCUs is defined as a “place where shares are accepted for members’ accounts, loan applications are accepted or loans are disbursed.” This can include certain shared branches, credit union owned ATMs and certain electronic facilities. One big change in this proposal is the consideration of what constitutes a “service facility” and therefore “reasonable proximity” to the FCU’s services through Online Access to Services. We’ll blog more about this on Monday. Other proposed changes would:

• Permit the addition of persons who work regularly for an entity that is under contract to the sponsor of the Select Employee Group (SEG) listed in its charter, provided there is a “strong dependency relationship” with that sponsor.
• Allow inclusion of employees of an office/industrial park’s tenants, such as a shopping mall, with certain conditions:
• Each tenant within the group has fewer than 3,000 employees, and
• Only employees who work regularly at the park during their employer’s tenancy are eligible for FCU membership.
• Allow a credit union’s common bond to include honorably discharged veterans of any branch of the United States Armed Forces listed in its charter, thereby continuing their eligibility for credit union membership beyond active duty.

Trade, Industry, or Profession (TIP) Charters

The proposal would expand the definition of TIP to include employees of entities that have a strong dependency relationship on, and whose employees work directly with employees of, other entities within the same industry. A credit union would need to demonstrate that an entity is: (1) “strongly dependent” on the others within a TIP, and (2) shares a narrow commonality.

***

Palate Cleanser. I met some of you at Regulatory Compliance Seminar a couple of weeks ago, thanks for attending! Someone mentioned that it had been a while since I shared a Nolan/Lemmy update, so here are a couple of photos from Halloween a few weeks ago and a photo of Nolan in his "playpen" which he loves to push around the room now. Have a great weekend!

View this photo

 

NCUA’s November Report; Regulatory Compliance Team’s Regulatory Update Webcast

Written by Victoria Daka, Regulatory Compliance Counsel

On Monday, NCUA released the November issue of its monthly Report. This month’s Report features articles on, among other things, the Risk Based Capital Rule, revisions to delegations of authority and NCUA’s new process for handling consumer complaints.

In this blog post, I’ll focus on the article titled, Understanding the New Process for Handling Consumer Complaints. In this article, NCUA indicates that on September 9^th, it launched its new consumer complaint handling process and improved online Consumer Assistance Center (CAC) portal – intended to streamline how it attempts to resolve consumer complaints involving consumer financial protection laws and regulations. As a refresher, the article notes that the new consumer complaint handling process involves two distinct phases. In the first phase, the credit union has 60 calendar days from receipt of the compliant to review and, if possible, resolve the matter in-house. If the credit union is unable to resolve the issue, then the second phase is triggered. In the second phase, CAC formally investigates the matter.

Additionally, the article highlights NCUA’s online CAC portal. NCUA indicates that in addition to consumers, credit unions will also be able to use the new CAC portal to submit complaint response information securely and check the status and number of complaints concerning their institutions. As per the article, CAC also provides new features that allow consumers to find financial protection information and personal finance resources. According to the article, NCUA expects to provide information in the upcoming weeks to credit unions on when and how they can sign-up for the CAC portal.  

The November issue of NCUA’s Report can be viewed in its entirety here.

***

Regulatory Compliance Team’s Regulatory  Update Webcast

Just as a friendly reminder, today at 2:00 pm, NAFCU's Regulatory Compliance team will provide a regulatory compliance update on recent CFPB and NCUA rules, regulations, and guidance. The team will also touch on what's to come next, honing in on other expected regulatory action that will affect your credit union's compliance department. Learn firsthand from NAFCU and get a jump on regulatory preparedness.

FASB CECL Model Effective Date; NCUA’s Upcoming Board Meeting Agenda

Written by Alexander Monterrubio, Regulatory Affairs Counsel

Happy Monday! Now that you’ve had just enough time to read my extra-long blog post from September on the Military Lending Act (MLA) … Brandy graciously agreed to let me commandeer the blog under the strict instruction to be brief.

Last week, the Financial Standards Accounting Board (FASB) held a meeting to vote on an effective date for its long-deliberated Current Expected Credit Loss (CECL) model. Under CECL, the allowance for loan and lease losses (ALLL) would reflect the credit union’s current estimate of the contractual cash flows that it doesn’t expect to collect. This estimate would be based on management’s expectations after considering past events, current conditions, and reasonable and supportable forecasts. In other words...

After weighing a number of alternatives, the FASB voted to adopt a staggered implementation of the CECL model.  For credit unions, the implementation date is December 15, 2019.

The FASB separated entities into three groups: 1) Public Business Entities (PBEs) that are Securities and Exchange Commission (SEC) Filers; 2) PBEs that are not SEC Filers; and 3) Non-Public Business Organizations (including credit unions). Each group was assigned a separate effective date for adopting the CECL model:

• PBEs that are SEC Filers: fiscal years beginning after December 15, 2018, including interim periods within those fiscal years.
• PBEs that are not SEC Filers: fiscal years beginning after December 15, 2019, including interim periods within those fiscal years.
• Non-Public Business Organizations: fiscal years beginning after December 15, 2019, and interim periods within fiscal years beginning after December 15, 2020.

The board also voted to allow early application of the standard for all entities after the first effective date of December 15, 2018.

NAFCU has taken every opportunity to communicate credit union objections to the proposed accounting standard, beginning with its May 2013 official comment letter to the FASB. In this letter, NAFCU insisted that the CECL model would “have a uniquely negative impact on the credit union industry … [and] credit unions should not be subject to this rule.” These concerns were reiterated within NAFCU’s comment letters in response to NCUA’s second Risk-Based Capital proposal and again during NCUA’s 2015 Regulatory Review.

In August, NAFCU organized a conference call between the FASB staff and several credit union representatives in order to press credit union questions, concerns, and recommendations, including the adoption of a delayed effective date for credit unions. It should be noted that a delayed effective date for some entities was ultimately recommended by the FASB staff and subsequently adopted by the Board.

FASB is expected to finalize its credit losses project during the first quarter of 2016.

Stay tuned for more developments!

*** 

NCUA Board Meeting Agenda

In the NCUA’s Board meeting later this week, the Board will consider the following matters: 1) Corporate Stabilization Fund Quarterly Report; 2) 2016/2017 Annual Performance Plan; 3) Proposed Rule, Appendix B of Part 701, Chartering and Fields of Membership; 4) NCUA’s 2016/2017 Operating Budget and 2016/2017 Corporate Stabilization Fund Oversight Budget; 5) 2016 Overhead Transfer Rate; and 7) 2016 Operating Fee Assessment Scale.

NAFCU’s compliance team will be sure to more thoroughly blog about these issues in the near future. NCUA’s agenda can be found here.

Help Us Advocate for Regulatory Relief

Written by Dan O’Brien, Director of Political Affairs

Hello compliance community. Every day you see firsthand the ever growing burden of regulations inflicted on credit unions in the post Dodd-Frank world. Regulatory relief for community based financial institutions has been a hot topic in the 114th Congress (and even in the Republican and Democratic presidential debates). The need for regulatory relief is obvious.  NAFCU continues to be focused on engaging the House, Senate and Administration on various ways to provide regulatory relief for credit unions. This year alone, NAFCU has testified in front of the Senate Banking Committee, the House Financial Services Committee and twice in the House Small Business Committee on the importance and need for regulatory relief.

Several key pieces of legislation have been introduced and are working their way through Congress that would provide meaningful regulatory relief for credit unions. With just 48 days left in 2015 and the Holiday Season being around the corner, Congress is scheduled to be in session for less than 20 days. Negotiations are ongoing with members of Congress to try to see what relief can pass this year.  NAFCU is involved on the Hill and we remain hopeful that regulatory relief legislation that would help credit unions can pass before the end of this year.

Our advocacy efforts are made stronger by the skills and expertise of our members.  We need compliance experts to share their invaluable firsthand knowledge about the unnecessary burdens that over-regulation is placing on credit unions. NAFCU encourages your credit union to contact your members of Congress on the following issues that would provide regulatory relief to credit unions and could possibly see movement this year.

• H.R. 2205 and S. 961, the Data Security Act of 2015, would bring retailers under a national standard akin to that prescribed under the Gramm-Leach-Bliley Act for financial institutions;
• H.R. 1210, the Portfolio Lending and Mortgage Access Act, would amend the Truth in Lending Act to provide a safe harbor from certain requirements related to qualified mortgages for residential mortgage loans held on an originating depository institution's portfolio.
• S. 1484, the Financial Regulatory Improvement Act of 2015, is a comprehensive regulatory relief package introduced by Senate Banking Committee Chairman Richard Shelby (R-AL) and was reported out by the Senate Banking Committee this spring.  Title I of this package contains a number of relief measures important to credit unions.  Among them are: requiring NCUA to hold an annual budget hearing, granting credit unions parity with community banks in FHLB membership requirements, creating a “qualified mortgage” safe harbor for certain loans held in portfolio, raising the CFPB examination threshold to $50B and indexing other Dodd-Frank thresholds for inflation, and creating an independent process to appeal exam results.  It is important to weigh-in with your Senators to let them know that credit unions need comprehensive regulatory relief like what is found in Title I of S. 1484.

For more information please go to NAFCU’s Grassroots Action Center today.  Your credit union can encourage them to support and cosponsor key pieces of legislation like the Data Security Act of 2015 (H.R. 2205 and S. 961), the Portfolio Lending and Mortgage Access Act (H.R. 1210),  and the Financial Regulatory Improvement Act of 2015 (S. 1484). All these bills cover different portions of NAFCU’s Five Point Plan for Regulatory Relief.  Share your stories on the regulatory burdens impacting you credit union with your members of Congress. It will help NAFCU’s lobbyists in their legislative efforts, strengthen our advocacy and show Congress that we are serious about enacting real relief for our nation’s credit unions.

We are happy to help your credit union with your outreach to your members of Congress and to answer any questions you may have about our advocacy efforts. If you have any interest in learning more about NAFCU’s grassroots advocacy efforts, you can email me directly at [email protected]. 

***

Friday the 13^th fact:

The 32nd President of the United States, Franklin Roosevelt, never traveled on a 13th and refused to have a meal with 13 people at the table.

Dept of Education's Student Accounts Rule- What You Need to Know

By Kavitha Subramanian, Regulatory Affairs Counsel

Happy Monday, Compliance Colleagues! For those of you with a bit of the Monday blues, I hope today’s post can help ease your compliance to-do list for the week ahead and provide a little clarity on a new regulation that at first blush appears much scarier than it actually is. A few weeks ago, the Department of Education finalized a new rule related to fees that can be charged to student accounts that receive federal student aid. Before you get concerned that there is yet another federal regulator overseeing credit unions, I want to clarify that this new DOE rule does not regulate all credit unions that have student members.

In simple terms, this rule will only impact credit unions and other financial institutions that (1) have entered a contract with a college or university to directly market their products and services to students on campus, (2) where the school meets the threshold amount of students in receipt of Title IV HEA program funds, and (3) an account opened through this agreement receives Title IV HEA program funds.

Because this rule seeks to prohibit educational institutions from steering students into using financial accounts that the college has an existing contractual relationship with, the regulation categorizes the educational institution’s contractual relationship with certain third party financial providers as either Tier 1 (T1) or Tier 2 (T2).

• T1 arrangement: The school has a contract with a third-party servicer under which the servicer processes direct payments of Title IV HEA funds on behalf of the school and also offers one or more financial accounts to students.
• T2 arrangement: The school has a contract with a financial institution under which financial accounts are offered and marketed directly to students.

In general, according to the DOE, these T1 agreements are typically not with a traditional banking entity such as a credit union or bank. See 80 FR 67145. So, a majority of our focus is on the requirements when there is a T2 marketing agreement. Under a T2 agreement with a credit union, a financial account is “directly marketed to students” in three specific situations: (1) the school communicates information directly to its students about how to open the financial account; (2) the financial account or affiliated card is co-branded with the institution's name, logo, or mascot; or (3) a card that is provided to the student, such as a student ID card, is linked with the financial account.

The regulation creates a de minimus safe harbor for schools in T2 agreements that have a limited number of Title IV fund recipients. In order for the school to be covered by the regulations applicable to T2 agreements, the school must have at least five percent its student body receiving Title IV funds for the three most recently completed award years or an average of 500 students with a Title IV credit balance for the three most recently completed award years.

If a student account receiving Title IV funds is covered by a T2 agreement, there can be no cost associated with opening the account or with receiving any type of debit card, stored-value card, or ATM card. Additionally, the student must be able to make balance inquiries and access funds deposited in the financial accounts through surcharge-free in-network ATMs that are accessible near or around campus. While this type of account can be extended overdraft services, the credit union cannot charge an overdraft fee on an inadvertent overdraft charge.

So to recap, this regulation only applies to student accounts opened pursuant to a direct marketing agreement between the credit union and the university, where the student account receives federal student aid. Additionally, the university must have enough students that receive federal funds to not be covered by the de minimus safe harbor rule. For those covered accounts, the credit union cannot charge a fee for ATM withdrawals, opening the account, or inadvertent overdraft usage. These fee restrictions do not apply once the student graduates, stops receiving aid, or is no longer enrolled in the school.

I hope this helped provide some clarity for the covered credit unions! For a deeper, more substantive look at this new rule, please check out NAFCU’s Final Regulation 15-EF-18, or reach out to me directly at [email protected] or 703-842-2212 with your questions. 

Programming Note:  NAFCU's Offices will be closed on Wednesday November 11, 2015 in honor of Veteran's Day.  We'll be back blogging on Friday.  

RBC-Nuts and Bolts, pt 3

Written by Alicia Nealon, Director of Regulatory Affairs

Happy Friday and welcome back to the third installment of our RBC series where NAFCU’s Compliance Blog will break down different portions of the final rule in order to help our compliance colleagues learn the basic framework of NCUA’s new RBC requirements.  Over the past 22 months, credit unions and NCUA alike have lived what can only be dubbed ‘the RBC Saga.’ While this saga features many actors and subplots, one that I want to highlight today is investments in CUSOs, as this asset class underwent significant character development and emerged as one of the fan favorites in the saga’s conclusion. For today’s post, let’s take a look at how the investment risk weight in CUSOs unfolded.

TAKE 1: In RBC 1, there was a 250 percent risk weight for investments in CUSOs with no allowance made for wholly owned, consolidated CUSOs. Understandably, credit unions were not a fan of this. The stage was set for a great battle.

TAKE 2: In the rule’s second iteration, NCUA clarified there would be no separate applicable CUSO risk weight if the CUSO was consolidated into a credit union’s financial statement under GAAP. However, if GAAP didn’t allow an equity investment in a CUSO to be consolidated, then equity investments in CUSOs were assigned a risk weight of 150 percent. The plot was improving, but credit unions were still not impressed.    

TAKE 3 - THE FINAL CUT: A fan favorite, this installment maintained that investments in CUSOs fall under category 6 and are still assigned a risk-weight of 150 percent. HOWEVER, a credit union could apply a risk weight of 100 percent for investments in CUSOs if its overall equity exposure deemed to be “non-significant.” NCUA estimates 95 percent of credit unions with such investments will receive the lower risk weight. So this begs the question, how do I determine if my credit union’s equity exposure is “non-significant?”

For credit unions that are not required to consolidate their CUSO investments under GAAP, a credit union has non-significant equity exposures if the aggregate amount of its equity exposure does not exceed 10 percent of the sum of the credit union’s capital elements of the risk-based capital numerator. When determining the aggregate amount of its equity exposures, a credit union must include total amounts of the following:

• Equity investments in CUSOs,
• Perpetual contributed capital at corporate credit unions;
• Nonperpetual capital at corporate credit unions, and
• Equity investments subject to a risk weight in excess of 100 percent.

It is important to note two things with this provision:

1. This approach is available for CUSOs not subject to consolidation under GAAP; and
2. This is an ‘all-or-nothing’ approach. If a credit union’s aggregate equity exposure exceeds 10 percent of the sum of the credit union’s capital elements of the risk-based capital numerator, then that credit union must disaggregate each equity exposure listed, and individually weight each exposure based on the appropriate risk weights.

It might be helpful to walkthrough two examples of how this might apply, and how slight variances can have ripple effects throughout the determination. For this example, imagine a credit union has capital in the numerator portion of the RBC ratio totaling $100m. (For a refresher on how to calculate the numerator portion of RBC ratio, see here.)

In scenario 1, this credit union has $1 million invested in a CUSO, as well $4 million each in perpetual contributed capital and nonperpetual capital at corporate credit unions, and $1 million of publically traded equity. These equity investments total $10 million, which does not exceed the 10 percent threshold of numerator portion of the ratio. Therefore, these equity investments can all be treated as non-significant equity investments and weighted at 100 percent.

In scenario 2, the credit union still has $1 million equity each in a CUSO and publically traded instruments, but now, it has $5 million each in perpetual contributed and nonperpetural capital at corporate credit unions. This means that the credit union’s equity investments total $12 million, which exceeds that 10 percent threshold. Now, the credit union must disaggregate and weigh each equity asset according to its standard risk weight (ie., nonperpetual at 100 percent, CUSO investments and perpetual contributed capital at 150 percent, and publically traded equity at 300 percent). Just by increasing its nonperpetual and perpetual capital at corporate credit unions, the credit union can no longer risk weight its CUSO investment at 100 percent.

As always, for more information on the final RBC rule, please be sure to take a look at NAFCU’s Final Regulation 15-EF-15, our Capital Reform Issue Page, or reach out to me directly ([email protected], 703-842-2266) with any RBC questions.  

***

Servicemembers Civil Relief and Military Lending Acts – Are We There Yet?

Live Webcast: Thursday, November 12 | 2:00 p.m. – 3:30 p.m. EST

These military-focused acts are easy to miss; often, credit unions think they’ve done enough when they’ve barely just scratched the surface of compliance. Attend this webcast to explore and understand the potential regulatory concerns of these acts. You’ll receive an overview of the proper policies, procedures, and processes you need to have in place to withstand an SCRA or MLA violation challenge—and to protect the rights of our servicemembers.

FFIEC Joint Statement on Cyber-Attacks Involving Extortion

Written by Eliott C. Ponte, Regulatory Compliance Counsel

FFIEC Joint Statement on Cyber-Attacks Involving Extortion

Yesterday, the Federal Financial Institutions Examination Council (FFIEC) issued a joint statement alerting financial institutions to the increasing frequency and severity of cyber-attacks involving extortion.  According to the FFIEC statement, activists have recently stolen sensitive business and consumer data.  After stealing the data, activists demand that a business “take a particular action or the data would be publicly released.”  FFIEC notes that the release of sensitive business and consumer data could affect an institutions reputation, as well as have other serious consequences.  The statement describes steps financial institutions should take to respond to these attacks and highlights resources institutions can use to mitigate the risks posed by such attacks.  This statement does not contain any new regulatory expectations. 

As consistent with prior statements issued on cybersecurity, FFIEC states that financial institutions should ensure that their risk management processes and business continuity planning address cybersecurity risks.  Specifically, the statement suggests financial institutions should consider the following steps:

• Conduct ongoing information security risk assessments.
• Securely configure systems and services.
• Protect against unauthorized access.
• Perform security monitoring, prevention, and risk mitigation.
• Update information security awareness and training programs, as necessary, to include cyber-attacks involving extortion.
• Implement and regularly test controls around critical systems.
• Review, update, and test incident response and business continuity plans periodically.
• Participate in industry information-sharing forums.

Credit unions looking to mitigate cybersecurity risks should look to the following resources for guidance:

• NCUA: Cybersecurity Resource Page
• FFIEC: Cybersecurity Assessment Tool
  • NCUA: How the Cybersecurity Assessment Tool Works
  • NAFCU: Cybersecurity Self-Assessment Tool
  • NAFCU: FFIEC Releases Cybersecurity Self-Assessment Tool
• FFIEC: Information Technology Examination Handbook, “Business Continuity Planning,” Appendix J.
• NAFCU: Strengthening Cyber Resilience in Business Continuity Plans
• FFIEC: Information Technology Examination Handbook, “Information Security”
• FFIEC: Joint Statement on Destructive Malware
• FFIEC: Joint Statement on Cyber Attacks Compromising Credentials
• FFIEC: Joint Statement on Cybersecurity Threat and Vulnerability Monitoring and Sharing
• FFIEC: Joint Statement on Distributed Denial-of-Service (DDoS) Cyber-Attacks, Risk Mitigation, and Additional Resources
• NAFCU Compliance Blog

 Another good resource is NAFCU’s Compliance Cyber Café Enewsletter.  NAFCU’s Cyber Café is published on an as-needed basis and is designed to provide specific compliance updates on cybersecurity issues.  Our inaugural issue featured articles on business continuity planning and the cybersecurity self-assessment tool.

***

Meet Mimi

In August, I posted pictures of my partially hairless cat, Miles (Devon Rex).  Yes, he is a unique looking cat.  And yes, he has a sister:  Mimi.

She is a Cornish Rex (also partially hairless). 

Mimi is a former therapy cat.  She worked with people suffering from anorexia for several years.  Now retired, she sleeps all day.  She will be 16 years old on January 1^st.

 

Dog Lovers.... Coming Soon

If you prefer dogs to cats, don’t worry, I have you covered.  My wife and I recently expanded our family.  Unfortunately, you will have to wait until my next blog post for more information.  For now, look at the teaser photo below:

 

 

Compliance Roundup

Written by Shereefat Balogun, Regulatory Compliance Counsel

Happy Monday ya’ll… and happy November!   October was a pretty busy month on the regulatory side.  We had TRID implementation in the beginning of the month.  A few weeks later, NCUA’s final RBC requirements and CFPB’s final HMDA rule dropped…on the same day!  It was pretty rough.  So to start off the new month, we’re going to keep it light and just give you some compliance tid-bits for your general consumption. 

October Issue of NCUA Report Now Available.  NCUA’s latest report is now available.  The report covers topics such as expansion of the small credit union threshold, NCUA’s plan to acquire vendor authority, and possible field of membership changes.  Some highlights:

• NCUA Board Expands Small Credit Union Threshold to $100 Million- NCUA recently raised the asset ceiling for a “small” credit union from $50 million to $100 million under the Regulatory Flexibility Act.  The change adds 733 more federally insured credit unions to the classification of “small entity”, and thus makes them eligible for special consideration of regulatory relief in future rulemaking and assistance from the agency’s Office of Small Credit Union Initiatives.  The final rule is effective November 23, 2015.
• NCUA Highlights Push for Vendor Authority- NCUA has stated that acquiring vendor authority is one of the agency’s top legislative priorities.  NCUA wants the ability to examine and regulate third-party service providers.  Opponents of this plan argue that it will be another undue burden for credit unions; or that NCUA’s current policies requiring credit unions to exercise due diligence in their monitoring of third-party service providers is sufficient to quell any concerns. 
• McWatters Suggests Field of membership Changes- Also in this issue, NCUA Board Member, J. Mark McWatters explains that the FCU Act can support more flexibility for credit union as it relates to field of membership.  Moreover, McWatters opines that the agency’s current requirements on field of membership go beyond what the FCU Act authorizes.  McWatters challenges the agency to be bold, and present to credit unions a field of membership proposal that will facilitate growth for credit unions.  While acknowledging that the most significant changes on field of membership can only come from Congress, McWatters urges credit unions to agree upon and decide what changes they want to pursue and develop a plan to of action for Congress to consider.

Delegation of Community Charter Amendments.  Speaking of field of membership- NCUA recently issued a final rule relating to the approval of community charters.  We have been asked about how the new rule impacts a credit union’s request for expansion.  The new rule does not change the process by which a community chartered credit union applies for an expansion of its geographic boundaries; rather it transfers the authority to review and approve such requests that may result in a membership pool of more than 1 million people from the NCUA Board to the Office of Consumer Protection (OCP).  NAFCU has put together a summary of the final rule which can be found here.  Here are the highlights of the new Delegation:

• The NCUA Board delegated to the Office of Consumer Protection (OCP) its authority to review and approve community charter expansion requests involving a potential membership pool of more than one million people.
• Under the approved change, the Director of OCP now has the authority to approve all community charter application, conversion or expansion requests.
• OCP is required to request review and comment by the Office of Examination and Insurance prior to making any determination involving community charters with a potential membership pool of more than one million people.
• After approving a community charter conversion or expansion, OCP will continue to follow up with the federal credit union every year for three years to monitor progress.
• The NCUA Board reserves the right to hear appeals of any charter denials by OCP.

CFPB Releases 2016 List of Rural or Underserved Counties.  The 2016 list of rural or underserved counties is now available. What does that mean for you? Some businesses with volume in rural or underserved counties that outweighs volume in other counties are exempt from certain regulatory requirements in “Ability to Repay” and “Qualified Mortgage” standards, as well as escrow requirements, under TILA.   You can find the list here.

NCUA Proposed Rule: Investment and Deposit Activities- Bank Notes.  The NCUA Board proposes to amend the maturity requirement for bank notes to be permissible investments for federal credit unions by removing the word “original” from the current requirement that bank notes have “original weighted average maturities of less than 5 years.”  If this proposed rule is finalized, federal credit unions will be able to purchase bank notes that were originally issued with maturities greater than 5 years, but have remaining maturities of less than 5 years.  There is a 30-day comment period, rather than the traditional 60-day period.  The comment period ends on November 23, 2015.

 See, not too bad!