NAFCU Compliance Blog

What’s a Prepaid Account?

Written by Brandy Bruyere, Director of Regulatory Compliance

On October 5, 2016 the CFPB finalized its rules for prepaid accounts, with most provisions becoming effective on October 1, 2017.  An initial question for determining how the rule may impact a credit union is whether any of the credit union’s products fall within the scope of the rule by meeting the new definition of “prepaid account” in Regulation E. New section 1005.2(b)(3) includes:

• A “payroll card account,” meaning one directly or indirectly established through an employer where a consumer’s wages, salary or other compensation are sent by electronic funds transfer;
• A “government benefit account,” as defined in revised section 1005.15(b)(2) to mean those established by a government agency for distributing government benefits (although not needs-tested benefits) to a consumer electronically;
• An account that is marketed or labeled as “prepaid” and that is redeemable upon presentation at multiple, unaffiliated merchants for goods or services or usable at ATMs; or
• An account that meets the following conditions:
  • Issued on a prepaid basis in a specified amount, or not issued on a prepaid basis but can be loaded with funds later;
  • Has the primary function of conducting transactions with multiple unaffiliated merchants for goods or services, at ATMs, or to conduct person-to-person (P2P) transfers; and
  • Is not a checking account, share draft account or negotiable order of withdrawal account.

There are some exceptions to the definition. If the account is not a payroll card account or government benefit account, then the following accounts are not “prepaid accounts” under section 1005.2(b)(3)(ii):

• An account loaded only with funds from a health savings account, medical savings account, flexible spending arrangement, dependent care assistance program, or transit/parking reimbursement;
• An account directly or indirectly established through a third party that is loaded only with qualified disaster relief payments;
• The P2P function is established through the US government with the primary function to conduct closed-loop transactions on US military installations or similar government facilities;
• Gift certificates as defined in section 1005.20(a)(1) and (b);
• Store gift cards, as defined in section 1005.20(a)(2) and (b);
• Loyalty, award or promotional gift carts, as defined in section 1005.20(a)(4) and (b); or
• A general use prepaid card as defined in section 1005.20(a)(3) and (b), that is marketed as a gift card or gift certificate; or
• An account established for distributing needs-tested benefits in a program established under state or local law, or administered by a state or local agency.

Certain pass-through services are also excluded from the general definition of a prepaid account. Staff comment 1005.2(b)(3)(i)—6 says the following:

6. Prepaid account acting as a pass-through vehicle for funds. To satisfy § 1005.2(b)(3)(i)(D), a prepaid account must be issued on a prepaid basis or be capable of being loaded with funds. This means that the prepaid account must be capable of holding funds, rather than merely acting as a pass-through vehicle. For example, if a product, such as a digital wallet, is only capable of storing a consumer's payment credentials for other accounts but is incapable of having funds stored on it, such a product is not a prepaid account. However, if a product allows a consumer to transfer funds, which can be stored before the consumer designates a destination for the funds, the product satisfies § 1005.2(b)(3)(i)(D).

In other words, if a service merely operates as a digital wallet that stores payment credentials, the member cannot store funds, and the member cannot access the balance then it would not be a prepaid account. However, further commentary clarifies that to meet the definition of prepaid account, it is not necessary that the account be reloadable by the consumer or a third party. Official Interpretation 1005.2(b)(3)(i)—7.

As with many regulations, including existing Regulation E, the commentary is key here, so this blog is really just a glimpse as some of the intricacies in this 1,689 page rule – and does not even get to what products might be a “hybrid prepaid-credit card” that will be subject to certain provisions in Regulation Z.  For more information, NAFCU members can find our Final Regulation summary of this rule here (log in required).

Seem like a lot? The CFPB must have thought so too, since the Bureau created a six page flowchart to help credit unions determine whether a particular product meets the definition of “prepaid account.” You can find it here and other Bureau resources here.

***

Black Friday. Instead of scrambling against the crowds at stores for discounts, on the day after Thanksgiving my parents and I took Nolan to nearby Great Falls National Park. He kept trying to climb over the railings, but it was a fun trip. Nolan also learned a new word this weekend - pie! 

Stay Vigilant Folks – The Bad Guys Can Be Anywhere…….

Written by Shari R. Pogach, Regulatory Paralegal, NCBSO

A government report on money laundering and terrorist financing threats indicates that more than $300 billion in concealed transactions is moved around the United States.  To help combat this growing money laundering threat, the FBI announced the addition of more resources to its Money Laundering Union in the Criminal Investigative Division.  This specialized unit will focus on the professional middlemen who help hide this flow of cash such as lawyers, accountants and brokers.

The FBI website also offers a list of common fraud scams along with tips to help prevent being victimized by such schemes.  Take a look as your members may be susceptible to some of these very scams. 

Here are a few recent cases concerning money laundering and financial fraud from the FBI’s press releases:

Former Scott Credit Union Commercial Loan Officer Sentenced to Prison on Convictions for Fraud, Misapplication, Money Laundering and False Report

Theodore J. Longust, age 51, formerly from Columbia, Illinois, was sentenced to a total of 121 months in prison as a result of his convictions in a nine-count indictment. Longust was an employee of Scott Credit Union in the commercial loan department from November 7, 2005 through December 8, 2014, as its business relationship manager. He embezzled credit union funds by creating fraudulent loans, paying loans by the misapplication of funds from other loans, increasing credit limits on loans that did not have the requisite board approval, issuing business loans without the required documentation or security and issuing letters of credit without the required documentation and security. Longust also knowingly submitted a false report to the credit unon for the third quarter of 2014 that misstated loan balances and omitted loan amounts and underreported loans of over $12,000,000. There was evidence at sentencing that the overall loss to Scott Credit Union, which included criminal and civil losses, was approximately $25.8 million. Criminal direct losses were determined to be $13,719,947.21. The court ordered Longust to pay restitution of $5,012,362.52 to the credit union and $9,114,560.69 to CUMIS Mutual, its bonding company. The safety and soundness of Scott Credit Union has not been adversely affected by the criminal conduct.  

Former Assistant Vice President of Bank Sentenced To Over Six Years in Prison for Embezzling More Than $1 Million

A Bergen County, New Jersey, woman was sentenced to 81 months in prison for embezzling more than $1 million while she worked at a bank in Fort Lee, New Jersey. Miye Chon, a/k/a/ “Karen Chon,” 36, was employed by BankAsiana, a federally insured financial institution, as an operations officer and later as an assistant vice president and operations officer at the Fort Lee branch until the bank was acquired by Wilshire Bank in October 2013. She had access to customer accounts and the bank’s internal account records, computer system and vault. Over several years, Chon stole more than $1 million from the bank’s customer accounts by regularly making unauthorized transfers from customer certificate of deposit (CD) accounts into BankAsiana’s vault cash account and then physically removing cash from the bank’s vault.

She did this on dozens of occasions, typically taking tens of thousands of dollars at a time. One time, she converted $100,000 from a customer’s CD account. As part of the scheme, Chon also opened up a bank account in an individual’s name and forged checks using that individual’s name without permission.

Bank Loan Officer Who Demanded Kickbacks as Part of Multi-Million Dollar Mortgage Fraud Scheme Sentenced to Federal Prison

Paul Ryan, 49, a former loan officer at Broadway Federal Bank, who took more than $350,000 in kickbacks in exchange for considering mortgage applications submitted by churches in relation to a fraud scheme that resulted in losses of at least $4.2 million, was sentenced to 18 months in federal prison. During the time he worked at the bank, from early 2007 until March 2010, the bank paid rebates to brokers who brought loans applications to the bank. Ryan “demanded from the brokers that all or part of that rebate amount be paid to him...intending to be rewarded and influenced in his processing and approval of these church loans,” according to court documents. He worked with the brokers and provided a template for presenting financial information for the churches that ensured the loan applications would be approved. Based on this false information, the bank issued loans to the churches.

Jury Finds Texas Lawyer and Others Guilty Of International Money Laundering and Fraud Conspiracies

According to court documents, Perry Don Cortese (53, Little River, Texas), Priscilla Ann Ellis (51, Killeen, Texas) and Kenietta Rayshawn Johnson (35, Leavenworth, Kansas) were members of an international criminal organization that defrauded dozens of victims across the United States and then laundered the funds, much of it sent overseas.  Many victims were law firms solicited online to perform legal work, provided counterfeit cashier’s checks for deposit into the firms’ trust accounts, and then directed to wire money to third-party shell businesses controlled by the conspirators.  Others were title companies defrauded in phony real estate transactions.  Other victims were targeted and defrauded by fake suitors on dating websites.  Hackers were also hired to compromise both individual and corporate email accounts, ordering wire transfers from brokerage and business accounts to shell accounts controlled by conspirators.

Victims were instructed to wire money into funnel accounts held by “money mules.” The funds were then quickly moved to other accounts in the U.S. and around the world before victims could discover the fraud.  Bank records presented at trial indicate that, from 2012 to 2015, several millions dollars’ worth of wires were received.  Conspirators in Canada, Nigeria, South Korea, Senegal and elsewhere helped coordinate the fraud and money laundering activity from abroad.

Cortese, a licensed attorney in Texas, worked for the conspirators by laundering victim money through his interest on lawyers trust accounts (IOLTAs).  He also met with individuals in person to retrieve cash withdrawn from receiver accounts. Cortese recruited his paralegal and others to open such accounts to launder funds.  The evidence further showed that Johnson, then a bank employee at Capital One, helped create counterfeit checks and monitor money flows between accounts controlled by conspirators.

These cases serve as a reminder that compliance officers must always be:  semper vigilans!  

Mortgage Servicing Rules – A Drafting Error?

Written by Brandy Bruyere, Director of Regulatory Compliance

As everyone gears up to consume turkey tomorrow (or Tofurkey, or some other option, to each their own!), I wanted to share with everyone an issue with the mortgage servicing rules that a couple of our “eagle eye” members have asked about recently. This gets technical, so hang in there with me.

Most of the 2016 mortgage servicing rules go into effect on October 19, 2017, although provisions relating to successors in interest and borrowers in bankruptcy go into effect on April 19, 2018. Here’s an excerpt from the preamble to the rule:

“…the Bureau is adopting an effective date of one year after publication for all provisions, except for an effective date of 18 months after publication for the bankruptcy periodic statement exemption and modified statements (§ 1026.41(e)(5) and (f)) and for the following regulation text and commentary provisions specifically addressing successors in interest: In Regulation X, § 1024.30(d) and related comments 30(d)-1 through -3; the definitions of successor in interest and confirmed successor in interest in § 1024.31 and related comments 31 (Successor in interest)-1 and -2; § 1024.32(c) and related comments 32(c)(1)-1, 32(c)(2)-1 and -2, and 32(c)(4)-1; § 1024.35(e)(5); § 1024.36(d)(3) and (i) and related comments 36(i)-1 through -3; § 1024.38(b)(1)(vi) and related comments 38(b)(1)(vi)-1 through -5; comment 41(b)-1; comment appendix MS to part 1024-2; and in Regulation Z, § 1026.2(a)(11) and (27) and related comments 2(a)(11)-4 and 2(a)(27)(i)-1 and -2; comment 20(e)(4)-3; § 1026.20(f); comment 36(c)(1)(iii)-2; § 1026.39(f); comment 41(c)-5; and § 1026.41(g). The Bureau considered the comments, including the potential issues that could arise as a result of an inadequate implementation period and industry's focus on other recent mortgage rulemakings, and believes that these effective dates achieve the right balance between affording industry sufficient time for implementation and promptly affording consumers the benefits of the final rule.”

(emphasis added)

Notice, the preamble specifically notes that the commentary relating to successors in interest will take 18 months to become effective, but what about the commentary to the provisions on periodic statements for borrowers in bankruptcy (sections 1026.41(e)(5) and (f))? These provisions of the regulatory text have an 18 month implementation period, but there is no corresponding reference to the commentary to these two provisions being effective in 18 months.

This seems like a possible error in drafting. Commentary that does not reference a rule that is in effect does not have much meaning or weight as guidance. For example, should Regulation Z be updated with commentary to section 1026.41(f) before section 1026.41(f) is formally incorporated into the regulation, it would essentially be commentary to nothing, temporarily orphaned. Additionally, throughout the preamble, the CFPB is consistent in its position that the provisions specific to borrowers in bankruptcy become effective 18 months after the rule published in the Federal Register, or April 19, 2017. Here’s another excerpt relating to the effective dates:

“The Bureau recognizes that the final rule provisions regarding bankruptcy periodic statements and successors in interest may take more time to implement than the other final rule provisions. Specifically, servicers and third-party service providers need sufficient time to coordinate, develop, and test systems required to modify periodic statements for consumers in bankruptcy. They also need sufficient time to train employees regarding the bankruptcy periodic statement requirements. In addition, although the successor in interest provisions generally should not require the same levels of operating systems changes as the bankruptcy periodic statement requirements, the Bureau acknowledges that these proposed provisions generated more comments than any other aspect of the proposal. Many servicers may need to institute new systems to track potential and confirmed successors in interest who are not obligated on the loan, particularly as to those successors in interest who are not already covered under the policies and procedures requirement in existing [rules]. Servicers also need sufficient time to develop policies and procedures relating to the types of documents that they will accept to confirm successor in interest status for common factual scenarios that could arise under the final rule's broader definition of successor in interest. The Bureau also recognizes that servicers may wish to work with third-party service providers to ensure compliance with the successor in interest provisions. Thus, the Bureau believes that an implementation period of 18 months is reasonable for the changes to the bankruptcy periodic statement exemption and modified statements and to the provisions specifically addressing successors in interest.”

So if the commentary looks a little odd and refer to provisions not yet in effect when it is published in the Code of Federal Regulations, it would seem to be an error. The CFPB has issued technical corrections on somewhat similar occurrences but for now, the intention that the effective date of April 19, 2018 apply to these bankruptcy provisions seems clear.

***

Programming Note. NAFCU's offices will close at noon today and also be closed on Thursday and Friday in observance of Thanksgiving. We wish you all a safe and wonderful holiday. We'll be open and back to blogging on Monday. 

CFPB Publishes 2017 Rural and Underserved Counties Lists; 18-Month Exam Cycle is Back

Written by Pamela Yu, Special Counsel for Compliance and Research

Happy Monday!  Last week, CFPB published a list of counties determined to be rural and a list of counties determined to be rural or underserved for use in 2017. 

CFPB has several rules that refer to its “rural or underserved” and “rural” counties lists.  Each year, the Bureau publishes new lists for use the following year.  As a refresher, the rules that refer to these lists are:

• Escrow requirements under TILA/Regulation Z.
• Ability to repay and qualified mortgage standards (ATR/QM) under TILA/Regulation Z.
• High-cost mortgage and homeownership counseling amendments to TILA/Regulation Z and RESPA/Regulation X.
• Appraisals for higher-priced mortgage loans (HPML).

Why does this matter? Well, the lists can significantly impact mortgage originations for certain entities. Credit unions operating predominantly in rural or underserved counties are exempt from certain regulatory requirements.

For example, as we blogged about back in September 2015, the CFPB’s final amendments to its definition of small creditors and rural or underserved areas under Regulation Z provided some credit unions with regulatory relief, specifically with respect to the HPML escrow requirement, which contains an exemption for small creditors; the high-cost mortgage rule, which exempts small creditors from a prohibition against balloon payment features on these kinds of loans; and the ATR/QM rule, which permits small creditors to make certain portfolio and balloon payment QMs.

In amending the rural definition by substituting the word “area” for “counties” within the regulation, the September 2015 final rule moved to a more granular approach than the previous standard, thus providing greater relief to certain credit unions.

CFPB’s rural counties lists are generally defined by using the United States Department of Agriculture Economic Research Service’s urban influence codes, while the underserved counties lists are defined by reference to data collected under the Home Mortgage Disclosure Act (HMDA).  The 2017 lists also include, in their entireties, the following U.S. territories as rural areas: Guam, the Commonwealth of the Northern Mariana Islands, American Samoa, and the U.S. Virgin Islands.

***

NCUA’s 18-Month Exam Cycle is Back—Hooray!

Last Thursday, the NCUA Board approved, as part of the agency’s 2017-2018 budget, ten recommendations from the agency’s Exam Flexibility Initiative  working group, including an extended 18-month exam cycle for well-managed, low-risk federal credit unions with assets of less than $1 billion.  Since NCUA moved to an annual exam cycle at the height of the financial crisis, credit unions have contended with more frequent exams of increased scope and complexity in the post-Dodd-Frank era.  However, as the industry has recovered along with the overall U.S. economy, NAFCU and its member credit unions have called for relief in this area. 

In response, in May 2016, NCUA Chairman Metsger established the Exam Flexibility Initiative to review NCUA’s examination and supervision program and to consider ways to modernize and improve the agency’s examination process.  A working group formed under the initiative solicited input from credit union stakeholders and, as a result of that feedback, issued a report in October 2016 making ten recommendations for approval by the NCUA Board.  Specifically, in addition to an 18-month exam cycle for certain well-run credit unions, the working group recommended the following:

• An 8- to 12- month examination cycle, timed from the prior exam completion date, for federal credit unions not meeting the criteria for an 18-month exam cycle.
• Enhanced examinations of small federal credit unions.
• Enhanced coordination of exams for federally insured, state-chartered credit unions.
• Establishment of an NCUA and state supervisor working group.
• Establishment of provisions for all federally insured credit unions relative to random sampling examinations, measurement of exam cycles, and NCUA’s authority to conduct more frequent examinations.
• Enhanced examination planning and notice procedures.
• An optional post-exam credit union survey.
• Reduction of NCUA’s onsite exam presence.
• Improved consistency of examiner training.

The working group’s full report is available here. 

While the NCUA Board’s approval of these recommendations is mostly welcome news for credit unions, NAFCU continues to call for an extended exam cycle for all well-run, healthy credit unions regardless of asset size, as well as an independent appeals process for disputing exam results.

The extended exam cycle will become effective January 1, 2017. Other improvements, including the post-exam credit union survey, will begin in July of next year.

***

Upcoming NAFCU Webcast: CFPB Mortgage Servicing Rules – 2016 Final Changes

Live Webcast Wednesday, November 30, 2016 | 2:00-3:30 p.m. ET

Although most of the new requirements are not effective until October 19, 2017, our experiences with the CFPB have taught us that it's best to begin implementing reviews and processes early rather than wait to implement changes within tight timeframes. Attend this strategic webcast to explore the details of the new final rule and the potential impact on your credit union's servicing processes and procedures.

Overheard at Regulatory Compliance Seminar: All I Want for Christmas is NCUA’s MBL Guidance

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

NAFCU’s Regulatory Compliance Seminar was held last month in New Orleans, Louisiana. Credit union volunteers, staff and compliance personnel from all over the country attended and it was a pleasure to meet so many of you in person.

One presentation I was especially looking forward to was by Vin Vieten, Senior Credit Specialist for NCUA who presented Principles Based Commercial Loan Risk Management. Following that presentation, NAFCU asked when NCUA expected to release the promised guidance regarding the new MBL rule and updates to the Call Report to accommodate the rule change. The guidance had been expected to be released in September. As of that moment, NCUA did not have an estimated release date for us. However, Mr. Vieten did say he expected it before January. Apparently, NCUA may be saving the guidance as a Christmas present. Mr. Vieten did also say that he didn’t expect that anyone will be shocked or surprised by the guidance, as it will focus on risk management. This echoes previous indications from NCUA that existing guidance on managing loan risk may significantly inform this new guidance.

Elements of Risk Management of Commercial Lending

Mr. Vieten’s presentation outlined 4 elements of commercial loan risk management: people, policies, process, and governance and control.

The “people” risk element includes the Board of Directors who are ultimately accountable for commercial lending by virtue of their approval of the policy and oversight of loans and staff. It also includes senior management, who must have a comprehensive understanding of commercial lending and be able to manage the risk appropriately, and lending staff who must underwrite, process and evaluate commercial loans.

The “policy” element refers to the commercial lending policy, which must address many aspects of the credit union’s commercial lending activities including:

• Types of commercial loans permitted;
• Trade area;
• Portfolio concentration limits;
• Qualification requirements for lending staff;
• Underwriting standards;
• Loan approval processes; and
• Other risk management processes, including periodic review, risk rating and monitoring.

The “process” element describes the risk management process. This includes performing and documenting an initial risk assessment on a commercial loan, monitoring and perhaps reevaluating that risk, and establishing a credit risk rating process.

The “governance and control” element addresses the responsibility of the board for overall supervision, and internal controls, such as the loan review area.

Below is a slide from the presentation containing a summary of the risk management process for commercial lending as a whole:

Newly Announced FFIEC Webinar on the Military Lending Act

On Wednesday, the FFIEC announced a webinar on the Military Lending Act being offered through the FFIEC’s Industry Outreach Program. The webinar will be held December 1, 2016 at 3:00 pm eastern. Credit unions can register for the webinar here.

Thankful for Proposed FOM Rules? Let NCUA Know!

Written by Michael Emancipator, Senior Regulatory Affairs Counsel

I can’t believe it’s almost Thanksgiving – just 8 days away! And although there are many things to be thankful for (ahem - election season finally being over), I’m sure a few die-hard credit union wonks will be giving thanks for NCUA’s decision to finally implement some substantive FOM reform.

In addition to finalizing a FOM rule at last month’s Board meeting, NCUA also proposed a new FOM rule that includes many provisions that NAFCU recommended. In case you haven’t had a chance to read the proposed rule in detail or review NAFCU’s summary, I thought I’d highlight a few provisions of the proposed rule, and encourage you to submit comments in support of the rule by Friday, December 9, 2016. After all, NCUA needs to hear from enough credit unions in favor of the proposal so the agency can finalize it. The proposed rule would do the following:

1. Give applicants for community charter approval, expansion or conversion the option, in lieu of a presumptive community, to submit a narrative to establish common interests or interaction among residents of the area it proposes to serve, thus qualifying the area as a well-defined local community (WDLC);
2. Increase up to 10 million the population limit on a community consisting of a statistical area or a portion thereof; and
3. Permit a credit union to designate a portion of the area as its community without regard to division boundaries when such an area is subdivided into metropolitan divisions.

Although all three provisions are welcome, I want to spend a little time fleshing out the third provision since its implications are slightly nuanced.

By way of background, NCUA’s FOM rules reference three different classifications for purposes of community charter FCUs: Combined Statistical Areas (CSAs), Core-Based Statistical Areas (CBSAs), and Metropolitan Divisions (Metros). Picture 1 is provided below to show how the different classifications relate to each other.

Essentially, a CSA is the largest classification with the widest geographical reach (shown in purple). Often, a CSA is composed of several CBSAs (shown in orange). Sometimes, an individual CBSA itself can be composed of smaller areas, ie., Metros (shown in green). Of note, there are only 11 CBSAs deemed large enough to be subdivided into metropolitan divisions. They are listed here.

Under current rules and the final rule that was just approved, when an FCU seeks to serve a portion of a CSA, that portion is not required to conform to the boundaries of the CBSA components that make-up the CSA. So as demonstrated in Picture 1, a FCU would be permitted to serve the portion of the CSA (as shown by the black circle). This would be a presumptive WDLC, even though it crosses multiple CBSA and Metro boundary lines. 

In contrast, when an FCU seeks to serve a portion of a CBSA as its community, (notwithstanding that a CBSA is far more compact than a CSA) the existing rule nonetheless requires such portion of a CBSA to conform to the boundaries of the Metro divisions within, if any. Therefore, under existing rules, a FCU would not be able to propose an area like the one shown in black in Picture 2 since it crosses Metro divisions, regardless of the fact that the proposed area is much smaller in size than the one proposed in Picture 1.

To address this disparity in treatment of a community consisting of a portion of a CBSA versus a CBA, NCUA is proposing to permit a FCU to designate a portion of a CBSA as its community without regard to Metro division boundaries.

Again, the deadline to submit comments in support of the rule is Friday, December 9, 2016.

We Listened So You Don’t Have To: Interagency Overdraft Services Webinar

Written by Stephanie Lyon, Regulatory Compliance Counsel

On Wednesday, November 10^th, the Consumer Financial Protection Bureau (CFPB), the National Credit Union Administration (NCUA) and other financial services regulators joined to present a webinar on overdraft practices and issues identified through consumer complaints, examinations, and enforcement actions. You can listen to the audio of the webinar here and download the presentation slides here.

Unfair, Deceptive or Abusive Acts and Practices (UDAAP)

The key issues identified by the regulators centered on unfair and deceptive practices such as failing to obtain proper opt-ins, having overdraft practices that differed to those disclosed on the opt-in forms, and misrepresentations from staff regarding the service. The NCUA representative did state that the Agency continues to be impressed with credit unions’ tendency to promote financial literacy such as educating members on the benefits and the fees associated with the use of overdraft services. However, there are a few examples of unfair and deceptive acts and practices that are worth reviewing.

Some of the practices regulators found problematic are:

• Promoting constant use of overdraft service
• Not explaining overdraft alternatives that may be cheaper
• Improperly trained staff that is unable to explain program and alternatives
• Suggesting the overdraft service is free when there is a fee associated with the use
• Transaction re-ordering to increase consumer costs

It is no secret that CFPB and other regulators have their eye set up overdraft services. Credit unions can review CFPB’s supervisory highlights to get an idea of the overdraft practices that are raising potential UDAAP concerns in the industry.

Risk Management

The regulators gave a few options for monitoring overdraft services to mitigate the risk of facing an enforcement action. Among these suggestions a couple can be beneficial for credit unions:

1. Comparing the credit union’s disclosures to its actual policy and procedures to ensure that they accurately describe the credit union’s practices.

For example, if the credit union uses the member’s available balance to decide if there is an overdraft, the disclosures should clearly and conspicuously explain the practice so members are not caught by surprise if they incur an overdraft when there would be no overdraft if the member’s ledger balance was taken into account. Another important instance is when a software change makes the system operate differently than the disclosures anticipate.

2. Monitoring member complaints to identity systemic failures that should be reported to senior management.

A credit union that actively monitors member complaints is better positioned to find trends of potential member confusion or staff misrepresentations regarding overdraft services. For instance, if one teller consistently tells members that the service is free to encourage them to opt-in and the credit union receives 3 complaints from members who were charged an overdraft fee, this can serve as an early warning signal.

3. Monitor and control risks presented by third party vendors.

This risk management strategy is best understood by reviewing a recent CFPB enforcement action against Santander’s Bank. The Bank’s third party service provider was enrolling customers without affirmative opt-in and providing deceptive information to get consumers to opt-in. According to the enforcement action, Santander did not exercise appropriate oversight of its third party overdraft service provider and was ordered to pay a whopping $10 million civil money penalty.  You can read more about this enforcement action here.

In light of the interest overdraft services are receiving from regulators and potential plaintiffs alike, credit unions may want to ensure their program follows Regulation E’s disclosure and opt-in/opt-out requirements as well as review consumer complaints to identify potential unfair, deceptive or abusive practices.

***

Early Thanksgiving

This weekend, my family celebrated thanksgiving early because we will not be able to be together on the actual date. It is the third year I celebrate thanksgiving with my wonderful husband Devon, and as usual, we made enough food to feed a family of 12. I have to admit, I was thrilled to have an excuse to use the wedding china we received for our wedding.

HMDA and HELOCs; Veteran's Day

Written by Brandy Bruyere, Director of Regulatory Compliance

For many credit unions, one of the challenges with implementing HELOCs is that these loans are on a separate loan origination system from closed-end mortgages. As credit unions gear up to implement changes to HMDA/Regulation C, one of our recent FAQs involves the timing of compliance for HELOCs. Spoiler alert – it’s probably sooner than you’d like.

Currently, open-end loans are not subject to mandatory HMDA reporting and the scope of transactions that are reportable is determined using a purpose-based standard. Effective January 1, 2018 HMDA will transition to a dwelling-secured standard, and apply to “covered loans” and applications for covered loans. As a reminder, covered loans include open-end lines of credit secured by a dwelling, unless otherwise excluded by the rule. Here are those key definitions for reference:

(b) Application—

(1) In general. Application means an oral or written request for a covered loan that is made in accordance with procedures used by a financial institution for the type of credit requested.

[…]

(e) Covered loan means a closed-end mortgage loan or an open-end line of credit that is not an excluded transaction under §1003.3(c).

Several credit unions have asked what this means for HELOCs since the effective date of the new definition of covered loan, which brings HELOCs into the scope of the rule, is not until January 1, 2018. We have blogged about this a couple of times, but the key effective date for collecting on the new HMDA data points is based on the credit union taking “final action” on the loan/application on or after January 1, 2018. This is explained on page 10 of the CFPB’s HMDA Small Entity Compliance Guide:

“A financial institution collects, records, and reports the new and modified data points under the 2015 HMDA Rule for applications on which final action is taken on or after January 1, 2018. If a financial institution receives an application in 2017 but takes final action on it in 2018, it is required to collect, record, and report the new and modified data points under the 2015 HMDA Rule. There is a special transition rule that applies to the collection of an applicant’s ethnicity, race, and sex…”

In other words, will HELOC applications accepted in late 2017 but with a final action taken in 2018 be subject to the new HMDA reporting requirements? The short answer is yes, here’s an excerpt from the preamble to the rule:

“This final rule applies to covered loans [defined term including HELOCs] and applications [defined relating back to covered loans] with respect to which final action is taken beginning on January 1, 2018. Data on these covered loans and applications are submitted to the appropriate Federal agency pursuant to § 1003.5(a) beginning on January 1, 2019…if a financial institution…receives an application on December 1, 2017 and does not take final action on that application until January 1, 2018, data about that application would be collected and recorded pursuant to § 1003.4 and submitted to the appropriate Federal agency by March 1, 2019 pursuant to § 1003.5(a).”  (Emphasis added.)

HMDA is triggered by a final action, not by application date. Final action can include origination or purchase of a covered loan, or denial or withdrawal of an application.

NAFCU members can find our various HMDA implementation resources here, and the CFPB’s implementation guides and tools can be found here.

***

Trick or Treat.  Nolan recently turned 2, so he does not really “get” Halloween yet, but he tolerated the Ewok costume we fashioned for him out of a bear suit and t-shirt. He also eventually realized he was supposed to go to doors and hold out his bucket. Meanwhile, we bribed Lemmy to behave with a treat. He has stolen chocolate and visited the emergency vet before, we did not want to repeat the experience.

***

Veteran’s Day. NAFCU will be closed on Friday in observance of Veteran’s Day. Those of us at NAFCU extend our gratitude and appreciation to those who have or are currently serving our country. We will be back to blogging on Monday.

CFPB Issues Supervisory Highlights Expressing Concerns with Automobile Loan Servicing, Debt Collection, Mortgage Origination and Fair Lending

Written by Benjamin M. Litchfield, Regulation Compliance Counsel

Greetings to all of you out there in regulatory compliance land. On October 31, 2016, the CFPB issued its latest voluminous supervisory report sharing multiple observations from recent examinations and other supervisory activities. The report covers issues observed by the Bureau in the areas of automobile loan servicing, debt collection, mortgage origination and fair lending. Other topics, such as student loan servicing, are also addressed. Provided below is a digest of some (but not all) of the Bureau’s many findings.

Automobile Loan Servicing.  In recent examinations of nonbank auto loan servicing companies, CFPB examiners identified unfair practices relating to repossession fees. The supervisory report alleges that certain nonbank servicing companies would often hold personal property seized as part of repossessing an automobile and refuse to return the property until after the borrower paid a fee for storing the property. Supposedly, if the borrower did not pay the fee, the companies would dispose of the property rather than returning it to the borrower.

Regardless of whether these companies had the contractual authority to engage in such practices, Bureau examiners felt these practices were unfair because the tactic was often used to leverage personal situations for collection purposes with extreme examples including retaining tools essential to the consumer’s livelihood and retention of personal possessions of negligible market value but of substantial emotional attachment or practical importance to the consumer. Examiners also found that some agreements, while disclosing that property would be stored, failed to disclose that a fee would be assessed for storage.

[Authors Note: Unlike the Federal Trade Commission, which promulgated a rule prohibiting certain unfair or deceptive credit practices after extensive public hearings, the Bureau continues to define unfair practices through examination and enforcement without providing credit unions with much guidance or prior notice. Even the FTC’s statements on unfairness and deception, which have defined which practices are prohibited under the FTC Act for decades, are mere guidance to the Bureau that it does not feel obliged to follow.]

Debt Collection.  Bureau examiners also identified several violations of the Fair Debt Collection Practices Act (FDCPA), including charging unlawful convenience fees, making several false representations, and unlawfully communicating with third parties in connection with the collection of a debt. [Author’s Note: While credit unions collecting debts on their own behalf are not considered “debt collectors” subject to the FDCPA, the CFPB has signaled its intention to use its UDAAP authority against so-called first-party debt collectors that engage in the types of acts or practices prohibited by the Act. In other words, the CFPB is trying to get all actors to follow a law that, by definition, credit unions are not required to follow.]

In recent examinations, the Bureau identified situations where debt collectors imposed convenience fees to process payments by phone or online that were not explicitly authorized by the loan agreement or permitted by law in violation of Section 808(1) of the FDCPA. Likewise, debt collectors are reported to have stated that all fees were “nonnegotiable,” which examiners felt amounted to a false representation of the types of compensation which may lawfully be received by a debt collector in violation of Section 807(2)(B) of the Act.

The supervisory report also highlights circumstances where debt collectors would use false representations or deceptive means to collect a debt in violation of Section 807(10) of the FDCPA. For example, the report alleges that debt collectors would place calls to consumers purporting to assess the consumer’s creditworthiness, credit scores, or credit reports, or stating that an immediate payment would need to be made in order to prevent any negative impact on the consumer’s credit. In addition, debt collectors are reported to have also impersonated consumers while using the original creditor’s consumer-facing automated telephone system to obtain more information about the consumer’s debt.

Finally, debt collectors are stated to have disclosed both the nature and purpose of collection calls to third parties when attempting to gather more information about the consumer in violation of Sections 804 and 805 of the FDCPA. These communications were often caused by inadequate identity verification during telephone calls. Collectors would also identify their employers to third parties without first being asked for that information by the third party in violation of Section 804 of the Act.

Mortgage Origination.  CFPB examiners also found deficiencies in mortgage origination compliance management systems which allowed for violations of Regulations G, N, X, and Z. One such purported violation was the reported failure of some financial institutions to verify income using reliable third-party records when conducting an ability to repay analysis. The report notes that examiners supposedly found that income disclosed on a mortgage application was not verified but instead was tested for reasonableness using an internet-based tool that estimates income based on zip code, job title, and years at the current occupation. [Author’s Note: Aside from the rather technical Regulation Z issues raised by the Bureau, this practice could also pose some rather obvious fair lending risks if credit eligibility is being determined, in part, by zip code which can be a proxy for race. #LowHangingFruit] Bureau examiners also identified instances where institutions failed to provide Loan Estimates within 3 business days in violation of the TILA-RESPA Integrated Disclosures Rule.

Fair Lending.  Bureau examiners also observed situations in which they felt that a financial institution’s treatment of limited-English-proficiency (LEP) and non-English-speaking consumers posed fair lending risk. One example offered by the report involves an institution that marketed only some of its available credit card products to Spanish-speaking consumers, while marketing several additional credit card products to English-speaking consumers. The institution lacked the appropriate documentation describing the business decisions that were made to market some but not all products to Spanish-speaking consumers which raised fair lending concerns for CFPB examiners. The report noted that some treatment of LEP and non-English-speaking consumers has led to enforcement actions by the Bureau and the Department of Justice in the past.

The supervisory report also notes that redlining will remain a supervisory priority for the Bureau. When assessing redlining risk, the Bureau will look to several factors including the unique attributes of the relevant geographic areas, lending patterns, peer and market comparisons, marketing, mapping, and additional evidence such as whistleblower tips. Rather than identifying instances of redlining, the supervisory report discusses ways in which credit unions can have a strong compliance program and outlines the Bureau’s approach to examining for illegal redlining. [Author’s Note: Even more information on redlining can be found in this interagency webinar that was held on October 4 and available on demand.]

These are just some of the highlights from the CFPB’s report. The full report is available here. As we can see, the Bureau remains laser-focused on third-party debt collection as it prepares for a possible rulemaking in this area and possible fair lending concerns involving the treatment of LEP and non-English-speaking consumers. If that is true, I may need a stronger prescription for my glasses.

FinCEN Advisory on Cyber-Events and Cyber-Enabled Crime Part 2 - What Should Be Reported in a Cyber-Related SAR

Written by Shari R. Pogach, Regulatory Paralegal, NCBSO

As we’ve previously blogged, last week the Financial Crimes Enforcement Network (FinCEN) issued FIN-2016-A005, its guidance to financial institutions on reporting cyber-related events and cyber-enabled crime.  So what kind of information should a credit union include in a suspicious activity report (SAR) when reporting such activity? 

First, FinCEN reminds filers that SARs are to be complete, accurate and incorporate all relevant information regarding suspicious activity, including cyber-related information.  Why?  Since today’s financial transactions increasingly occur through the use of electronic systems and resources, any illicit financial activity will often have a digital footprint leading back to the individuals, their associates, their activity and any related suspicious transactions.  So any SAR (including a voluntary SAR) should include any available cyber-related information reporting any suspicious activity. Examples of cyber-related information include:  IP addresses with time stamps, virtual-wallet information, device identifiers and cyber-event information. FinCEN states that financial institutions should document and give a detailed description of the suspicious activity reported.  SAR narratives should include descriptive cyber-related information as well as any cyber-related identifiers where there is not a pre-designated SAR field.

So when possible a cyber-related event SAR should include:

• Description and magnitude of the event
• Known or suspected time, location, and characteristics or signatures of the event
• Indicators of compromise
• Relevant IP addresses and their timestamps
• Device identifiers
• Methodologies used
• Other information the institution believes is relevant

FinCEN’s advisory includes an attachment of frequently asked questions (FAQs) with specific details and technical specifications on completing SARs concerning cyber-events and cyber-enabled crime.  The agency states these FAQs supersede its 2001 FAQs on computer intrusion as the new document provides new information and additional details. As one example, the new guidance notes that cyber-events and cyber-enabled crime can involve event-specific information.  Still, FinCEN requests that SAR filers be consistent and use common and accepted terminology.  One resource filers can use is the Glossary of Key Information Security Terms (May 2013), a publication issued by the National Institute of Standards and Technology (NIST).  The guidance also clarifies how a financial institution is to report when it experiences numerous cyber-events; what it should do in instances of continuous scanning or probing of an institution’s systems or network; and whether to report when an otherwise reportable cyber-event is unsuccessful.

FinCEN recommends institutions circulate the advisory with: cybersecurity units, network administrators, risk departments, fraud prevention units, BSA/AML management, AML intelligence units and AML analysts/investigators. According to the agency, it is not* creating any new obligation or expectation requirement for financial institutions to collect cyber-related information as a matter of course. (*wink)

CFPB’s Mortgage Servicing Rules - Part 6: Early Intervention

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

As you know, at the end of the summer, the CFPB amended its mortgage servicing requirements with a Final Rule that beats Fyodor Dostoyevsky, Thomas Pynchon and Ayn Rand for page count. The NAFCU Regulatory Compliance Team has already blogged on several topics:

• Successors in Interest;
• Force-Placed Insurance;
• Loss Mitigation;
• Small Servicer Exemption; and
• Periodic Statements.

Also, when we last blogged on this topic, the date of publication had been announced as October 19, 2016. Now we also have the citation: the Final Rule has been published in the Federal Register at 81 Federal Register 72160 (October 19, 2016).

Today, we are going to highlight some changes to the early intervention requirements in section 1024.39 of Regulation X. Early Intervention has two big pieces: establishing live contact with a delinquent borrower and providing written notice. But first, it’s important to highlight a new definition in Regulation X.

New Definition of Delinquency

Currently, there is discussion about when delinquency starts in the commentary of Regulation X. In its amendment, the CFPB added a formal definition to section 1024.31 for use across Regulation X. The definition does not differ from the existing commentary to early intervention:

“Delinquency means a period of time during which a borrower and a borrower’s mortgage loan obligation are delinquent. A borrower and a borrower’s mortgage loan obligation are delinquent beginning on the date a periodic payment sufficient to cover principal, interest, and, if applicable, escrow becomes due and unpaid, until such time as no periodic payment is due and unpaid.” 81 Fed. Reg. 72160, 72371.

Establishing Live Contact

Under amended section 1024.39(a), the requirement for live contact is no longer solely required before “the 36th day of the borrower’s delinquency;” it is required “again no later than 36 days after each payment due date so long as the borrower remains delinquent.” See, 81 Fed. Reg. 72372. So establishing or making an effort to establish live contact is required for each delinquent payment.

However, the new commentary also indicates the Bureau is not necessarily requiring the same efforts on a rolling basis. First, amended comment 39(a)-3 states that good faith efforts to establish live contact are relative to the age of the delinquency and responsiveness of the borrower. The amended commentary states that a phone call may be necessary to establish live contact on a new delinquency, but if an account has 6 or more missed payments, a written statement in the periodic statement or an email may satisfy the requirement. See, 81 Fed. Reg. 72381.

Also, an example in the commentary indicates that one attempt to establish live contact can be used to satisfy the requirement for multiple payments. Amended comment 39(a)-1.i.B. provides an example where a borrower has missed January, February and March payments. Where there is overlap in the 36 day period after payments, a single effort to establish contact can be used for multiple payments. See, 81 Fed. Reg. 72381.

Below is a table illustrating this example:

Providing Written Notice

There is a similar requirement in amended section 1024.39(b)(1) to provide the written notice in conjunction with each delinquent payment, rather than just by the 45^th day of the borrower’s delinquency. However amended section 1024.39(b)(1) only requires written notice to be sent once every 180 days. If, at that expiration of that 180 day period, the account is still more than 45 days delinquent, notice must be provided again. If the account is less than 45 days delinquent, then the credit union must simply provide additional notice no later than the 45 days after the payment due date for which they are delinquent. See, 81 Fed. Reg. 72372.

Written Notice and Bankruptcy. Notice must also be provided within 45 days of any bankruptcy filing, if the member is delinquent at the time of the filling. While the bankruptcy is ongoing, further written notice is not required, regardless of the 180 day rule or further delinquencies. If the member was current with the credit union at the time the bankruptcy was filed, but becomes delinquent during the course of the bankruptcy, the notice must be provided within 45 days of the delinquency, but not again during the bankruptcy. No notice is required if the member is in bankruptcy and has either requested no further contact under the FDCPA, or if there are no loss mitigation options available to that member. See, 81 Fed. Reg. 72372.

Written Notice and the FDCPA. Similarly, if the member has requested to cease contact under the FDCPA and no loss mitigation options are available to the member, the credit union is not obligated to send the written notice, even if no bankruptcy is involved. However, if loss mitigation options are available and no bankruptcy is involved, Regulation X still requires that the notice be sent. Amended section 1024.39(d) contains specific requirements for that notice, including new model clause language in MS-4(D) which will be added to Appendix MS. See, 81 Fed. Reg. 72372.

The amendments are dense, and your NAFCU Regulatory Compliance Team will keep sorting through the changes. NAFCU members should feel free to reach out to us with questions.