NAFCU Compliance Blog

MLA Compliance – Covered Borrower False Positives/Negatives, Historic Lookback Prohibition; The Downside of Compromise

Written by André B. Cotten, Regulatory Compliance Counsel

Greetings Compliance Friends! Let’s talk about the Military Lending Act.

The updated MLA rule expands protections to a broader range of closed-end and open-end credit. Since October 2016, to comply with the safe harbor standards, many credit unions have been using one of the safe harbor methods listed in the final rule. The safe harbor methods include 1) checking the member’s duty status using the Defense Manpower Data Center (DMDC) database, or 2) using a consumer report obtained from a nationwide consumer reporting agency.

Section 232.5(a) allows a credit union to use its own method to determine whether a member is a covered borrower. However, the regulation only provides a safe harbor when a credit union uses either the MLA database or a member’s status that is obtained from a consumer report obtained from a consumer reporting agency (e.g., Experian, Equifax, Transunion). Questions have come up about the historic lookback prohibition, or if the safe harbor seems to have generated a false result?

In order to benefit from the safe harbor, the covered borrower check (DMDC database or consumer report) is required at the time “credit is offered or extended.” Looking directly at the regulatory language, this prohibition specifically prevents a creditor from using the database (directly or indirectly) to ascertain whether a consumer had been a covered borrower at a previous point in time and still meet the safe harbor. This seems to mean that a credit union has one bite at the apple in order to establish a safe harbor – checking with the database after consummation and determining that, in hindsight, the borrower was not covered on the date of consummation does not fall within the safe harbor.

232.5 Optional identification of covered borrower.

(a) No restriction on method for covered-borrower check. A creditor is permitted to apply its own method to assess whether a consumer is a covered borrower.

(b) Safe harbor—

(1) In general. A creditor may conclusively determine whether credit is offered or extended to a covered borrower, and thus may be subject to 10 U.S.C. 987 and the requirements of this part, by assessing the status of a consumer in accordance with this paragraph (b).

(2) Methods to check status of consumer—

(i) Department database—

[…]

(B) Historic lookback prohibited. At any time after a consumer has entered into a transaction or established an account involving an extension of credit, a creditor (including an assignee) may not, directly or indirectly, obtain any information from any database maintained by the Department to ascertain whether a consumer had been a covered borrower as of the date of that transaction or as of the date that account was established.

(ii) Consumer report from a nationwide consumer reporting agency. To determine whether a consumer is a covered borrower, a creditor may verify the status of a consumer by using a statement, code, or similar indicator describing that status, if any, contained in a consumer report obtained from a consumer reporting agency that compiles and maintains files on consumers on a nationwide basis, or a reseller of such a consumer report (as each of those terms is defined in the Fair Credit Reporting Act (15 U.S.C. 1681a) and any implementing regulation (12 CFR part 1022))…

32 CFR 232.5 (emphasis added).

With the prohibition against historic lookback, if a credit union were to use the DMDC to confirm a borrower's status at a later point in time, those transactions would not qualify for the safe harbor provision. Commentary in the preamble to the final rule suggests that the DoD anticipates credit unions will perform a covered borrower check in connection with each extension of credit made to a covered borrower:

“...the Department's longstanding policy regarding this aspect of the scope of 10 U.S.C. 987 is consistent with the provision set forth in § 987(f)(3),^[120] which makes any credit contract that is prohibited under 10 U.S.C. 987 “void from the inception of such contract.” Section § 987(f)(3) would operate unjustly if a consumer, upon obtaining the status of a covered borrower, could sue the creditor to void an existing credit contract on the grounds that the contract—which may have been entirely lawful when originally entered into with the consumer—violates one or more provisions of 10 U.S.C. 987. One practical consequence of the Department's longstanding policy is that a creditor is not required to constantly monitor the status of each consumer who has obtained credit or holds an account for credit to assess whether the consumer is a “covered borrower;” rather, the creditor may conduct that assessment, as the creditor may so elect, only at the outset of the transaction or when establishing the account for consumer credit. The Department proposes to adopt corresponding revisions to the language of certain other provisions of the regulation, notably §§ 232.3(f) and 232.5(b)(2), for the sake of clarity and consistency with this policy.”

79 Fed. Reg. at 58601, 58616 (emphasis added).

Overall, if your credit union does receive a false positive or negative, the rule does not clearly address the issue. Reporting the problem and waiting for the database to be updated and running a report later would be problematic in light of the historic lookback prohibition - the covered borrower check cannot be performed after consummation and provide a safe harbor. Delaying closing in hopes that the database updates also may not work for the borrower. If a person says they are not a covered borrower, but the DMDC database says otherwise, the credit union could treat that person as a covered borrower anyway but that has drawbacks. The credit union could also not treat the person as a covered borrower - but relying on information other than the DMDC database or consumer report does not provide a safe harbor which creates some risk.    

The good news is false positives or negatives should be rather rare. Recently, one of my colleagues attended a MLA forum with representatives from the DoD who indicated that the DMDC received very few reports of inaccurate results – even with over 2.2 billion covered borrower checks processed through the DMDC between October 3, 2016 and December 8, 2016. During this discussion, the DoD advised that when a credit union receives a false positive or false negative, this is a good time to contact the help desk on the website. This information can be found on the DMDC website, on the right side under the heading resources, select "Help with Browser Certificate Error." Also, in the event a credit union experiences an issue with the DMDC system, the DoD is available to help resolve your issue and receive your feedback. To reach the DMDC Support Office, please call 1-800-538-9552.

Keep in mind that a credit union could use another method besides the DMDC or consumer report to verify a borrower’s status, but the transaction in question would not fall under the safe harbor. This would not be a violation of the MLA, as section 232.5(a) specifies that there is no restriction on how covered borrower checks can be performed. It simply means the credit union would not be shielded from liability that might result from a failure to identify a covered borrower. To manage that litigation risk, a credit union may consider working with local counsel to draft policies and procedures which would establish a defense under 10 U.S.C. § 987(f)(5), for example, that the credit unions sufficiently maintains procedures that are reasonably adapted to avoid failing to identify a covered borrower. The decision whether to use the safe harbor or to exercise some other procedure, or both, is a risk-based business decision for a credit union.

NAFCU’s Military Lending Act Guide provides a detailed overview of the rule. Other NAFCU resources can be found here at our MLA Compliance landing page. We continue our advocacy on this issue as well, especially on credit card related issues given the October 3, 2017 compliance deadline.

***

The Downside of Compromise. Did you know that when the legislation that became Dodd-Frank was debated, NAFCU opposed giving the CFPB rulemaking authority over the credit union industry? Check out this CU Journal editorial from NAFCU’s President and CEO, Dan Berger giving background on our position and NAFCU’s continued commitment to pull credit unions from the regulatory authority of the CFPB.

This Week’s NAFCU Webcasts.

Embedding Cybersecurity into Vendor Selection

Live Webcast: Tuesday, February 28 | 2:00-3:30 p.m. ET

Enterprise-Wide BSA Compliance: All for One and One for All

Live Webcast: Thursday, March 9 | 2:00-3:30 p.m. ET

Considering a Member’s Immigration Status in Evaluating Loan Applications + Trivia! + Monitor Survey

Written by Shereefat Balogun, Regulatory Compliance Counsel

Seems like immigration is on many minds these days.  In fact, we’ve received a number of questions concerning an applicant’s immigration status in evaluating loan applications.  The general question often looks like this:

A member came in applying for a VISA credit card. He is not a permanent resident of the U.S. He has a work permit that expires in July 2017. Are we able to deny a credit card to someone who is not a permanent resident of the U.S?

As many of us are aware, the Equal Credit Opportunity Act (ECOA) prohibits discrimination related to any aspect of a credit transaction on the basis of race, color, religion, national origin, sex, marital status, age, and income derived from public assistance.  See, 15 U.S.C. §1691(a); 12 C.F.R. §§ 1002.1(b), 1002.4(a).  That said, a credit union may consider a member’s credit status or status as a permanent resident in determining the member’s creditworthiness and the credit union’s rights and remedies regarding repayment.  Indeed, section 1002.5 of Regulation B, which implements ECOA, provides in relevant part:

§1002.5 Rules concerning requests for information.

…

(e) Permanent residency and immigration status. A creditor may inquire about the permanent residency and immigration status of an applicant or any other person in connection with a credit transaction.

12 CFR 1002.5(e)(emphasis added.)

Moreover, in section 1002.6, the rule states:

§1002.6   Rules concerning evaluation of applications.

(a) General rule concerning use of information. Except as otherwise provided in the Act and this part, a creditor may consider any information obtained, so long as the information is not used to discriminate against an applicant on a prohibited basis. The legislative history of the Act indicates that the Congress intended an “effects test” concept, as outlined in the employment field by the Supreme Court in the cases of Griggs v. Duke Power Co., 401 U.S. 424 (1971), and Albemarle Paper Co. v. Moody, 422 U.S. 405 (1975), to be applicable to a creditor's determination of creditworthiness.

…

(7) Immigration status. A creditor may consider the applicant's immigration status or status as a permanent resident of the United States, and any additional information that may be necessary to ascertain the creditor's rights and remedies regarding repayment.

12 CFR 1002.6(b)(7) (emphasis added.)

The Official Interpretation to 1002.6(b)(7) provides more detail:

Paragraph 6(b)(7) .

1. National origin—immigration status. The applicant's immigration status and ties to the community (such as employment and continued residence in the area) could have a bearing on a creditor's ability to obtain repayment. Accordingly, the creditor may consider immigration status and differentiate, for example, between a noncitizen who is a long-time resident with permanent resident status and a noncitizen who is temporarily in this country on a student visa.

2. National origin—citizenship. A denial of credit on the ground that an applicant is not a United States citizen is not per se discrimination based on national origin. 

12 CFR 1002, Supp. I, comments 1002.6(b)(7) – 1 and 2 (emphasis added.)

While Regulation B generally gives credit unions the ability to consider residency and immigration status in evaluating a loan application, there may be some risks associated with denying a loan based on the member’s citizenship status.  Comment 2 above indicates that a denial of credit based on citizenship status is not per se discrimination based on national origin.  This suggests that the denial in and of itself may not be discriminatory; however an examination of the facts and circumstances may form the basis of a discriminatory claim exposing the credit union to litigation risks.  One issue that may arise concerns claims that the credit union’s policy is not being applied consistently.  For example, if citizens of countries A and B are ok but citizens of C and D are not, then it can be argued that the credit union is discriminating on the basis of national origin, i.e. the place of origin rather than status as a non-citizen.  The credit union may want to make sure applicants are being treated consistently across the board and that any different treatment has a legitimate business purpose.

One thing to consider is that the rule seems to focus on the credit union’s ability to look at immigration status in determining the member’s ability to repay.  See, 12 C.F.R. 1002.6.  Based on this, the credit union may want to focus on the repayment aspect and the particular risks a noncitizen applicant poses.  This is alluded to in the commentary.  See, 12 CFR 1002, Supp. I, comments 1002.6(b)(7) – 1 and 2.  For example, a member who is new to the country, with no employment, and no past credit history may pose more risks to the ability to repay, than a person who has been in the country for 10 years, working as a physician at $450k a year, with satisfactory credit history and owns a home.

Notably, Form C-1 located in Appendix C to Part 1002, is a sample adverse action form and provides a few adverse action options that may apply to these situations.  For example, some reasons listed such as “Temporary or Irregular Employment”, “Length of Employment”, “Length of Residence”, or “Temporary Residence” may be applicable.  Ultimately, though, the rule requires credit unions to look at their underwriting criteria and select the appropriate reasons. 

Also, here are some useful resources which may be helpful:

• NCUA’s Fair Lending Guide
• Letter to Credit Unions No. 174.  This letter includes a white paper that’s geared towards risk-based lending. Starting on page 3, there is a pretty good discussion of consumer compliance and discrimination issues.

As always, if you have any questions concerning ECOA/Regulation B, or any other issue, please feel free to contact the NAFCU Compliance team. We’re here for you!

Trivia: What is ECOA’s record retention period for consumer credit applications?

###

Each month, NAFCU's research division sends out an Economic and CU Monitor survey which is summarized and reported in the Economic and CU Monitor. This month’s survey topic is Housing, and it includes questions on GSEs, HMDA, TRID, and chattel lending. Your responses provide us with the meaningful data we need when we represent you before policy makers. You don’t need to complete the entire survey. Every response is a helpful one!

We Listened So You Don’t Have To – CFPB’s HMDA Identifiers and Data Points; Issues With MLA Database

 By Stephanie Lyon, Regulatory Compliance Counsel

I hope everyone had a nice restful weekend! D.C. is offering unseasonably warm weather so we enjoyed pretending to be tourist in the city while my puppies sun-bathed (see pictures below). Now on to business…

This is the second of a series of HMDA webinars that the bureau will present to help credit unions comply with the upcoming HMDA implementation deadline.  The first webinar gave an overview of the rule while this second webinar focused on identifiers, applications and covered loans; property and loan originators; and data points. This webinar had over 300 slides, so despite the blog’s title, if you are tasked with HMDA implementation, it may still be worth a watch. Similar to the TRID implementation process, these webinars supplement the bureau’s HMDA resource page which is full of helpful materials such as the small entity compliance guide, sample data collection forms, and instructions on when to report “not applicable” in certain fields.

Identifiers

The 2015 HMDA rule requires that all financial institutions (FIs) obtain a Legal Entity Identifier (LEI) as this will be required to create a Universal Loan Identified (ULI) for each application received, covered loan originated, and purchased covered loan. See, revised 12 C.F.R. § 1003.4(a)(1)(i). NAFCU previously blogged about this requirement here. In summary, the bureau suggests that credit unions obtain their LEI number as soon as possible.

Think of the ULI as a routing number in the sense that it is made up of different numbers and it allows the credit union to identify a unique covered loan or application. The three components that make up the ULI are: (1) the credit union’s LEI; (2) 23 characters that identify a covered loan or application and; (3) a check digit. The bureau explained that the 23 characters should not contain information that may identify a covered borrower such as the borrower’s social security number, name or other personal information. The credit union can find more requirements on the ULI in Appendix C of the final rule.

Applications

The final rule requires credit unions to report certain loan preapprovals. See, revised 12 C.F.R.  § 1003.2(b). Certain types of applications and covered loans are always reported as not involving a request for preapproval, even if a preapproval request was made. This includes: (1) purchased covered loans; (2) open-end line of credit; (3) reverse mortgages; (4) denied applications; (5) applications that are closed for incompleteness; (6) withdrawn applications; (7) applications or other covered loans for any purpose other than a home purchase loan; and (8) a covered loan for home purchase secured by a multifamily dwelling or an application for such a loan.

In the webinar, the bureau also clarified that the new rule will not require credit unions to differentiate between when a preapproval was not requested and when a preapproval was not applicable.

Data Points

Collection of Ethnicity, Race and Sex

Section 1003.4(a)(10)(i) and Appendix B of the final rule has detailed instructions and a sample form for the collection of ethnicity, race, and sex. The rule requires credit unions to ask the applicant to report this information whether the application is take in person, by phone, Internet or mail. However, the credit union cannot require the disclosure of this information so the credit union may want to test its online application to ensure this information is not a required field.

An interesting fact the bureau noted in the webinar is that if the member checks a box that states the applicant does not wish to provide information when applying but nonetheless discloses the information on the form, the credit union must report the information provided. For applicants that are not natural persons (i.e. corporation, partnership or trust), the credit union should not report the ethnicity, race or sex of the applicant even if the covered loan or application includes a guarantor.

The bureau created this chart to assist credit unions in the collection of this information.

Collection of Age, Credit Score, Income and Debt-to-income (DTI)

The final rule requires the reporting of age as of the date of the application. There are a couple of instances when the credit union does not have to report age (1) instances where the covered loan was purchased and institution chose not to report age (2) the applicant is not a natural person. See, revised 12 C.F.R. § 1003.4(a)(10)(ii).

Additionally, the credit union must report credit scores, gross annual income, and the DTI “relied on” to make the credit decision. The bureau noted that relied on means the information was used as a factor in the credit decision even if information was not a dispositive factor. For example, if the credit union considers an applicant’s credit score but chooses to deny the loan because of a high DTI, the credit union should still report the credit score as it relied on it to make its credit decision.

I know this is a lot of mechanical information so again, it may be helpful to watch the entire webinar and download the slides when testing your credit union’s HMDA readiness.

***

MLA Database Processing Issue. Last week, the MLA database reported that there was “a problem” processing Multiple Record Requests between February 9, 2017 and February 15, 2017. This prevented 149 requests from processing, so the DoD says if a credit union’s multiple record request “failed to process” the credit union should “submit the file again for processing.” What DoD did not clarify was what impact this would have on a credit union’s ability to still claim a safe harbor – especially with the rule’s prohibition against historic lookbacks. If your credit union was impacted by one of these 149 requests, it may need to consult with counsel to discuss further. Casually, a couple of days before the error occurred, the MLA website was down for system maintenance. While we don’t know if this caused the issue, credit unions that rely on the DoD’s database for its covered borrower check may want to monitor the MLA’s news page for a heads-up on future maintenance to the site.

To make up for all the information above, here is a picture of my two happy fur-children and my amazing husband Devon taken as went sightseeing in D.C. this past weekend:

Federal Advocacy is a Team Sport – Get in the Game Today!

Written by Dan O'Brien, Director of Political Affairs

Last month, the Trump Administration took over the White House and a new Congress was sworn in. With  Republicans controlling the executive branch and both chambers of the legislative branch, there has been a lot of talk about regulatory relief for small financial institutions,  roll back of the disastrous Dodd-Frank Act, and corporate tax reform. All of these initiatives are supposed to be considered within the first 100 days of the new Administration. This is a welcome but ambitious agenda, and should be followed closely, as the political climate is ever changing.

Congress is debating these important issues now and working on a way forward. In the coming weeks, we expect Chairman Jeb Hensarling (R-TX) of the House Financial Services Committee to reintroduce the 2017 version of the Financial CHOICE Act. The legislation is expected to contain some key provisions that are part of NAFCU’s 2017 legislative & regulatory priorities, including the repeal of the failed Durbin Amendment.  The credit union industry must remain united in our message to Congress on the need to provide meaningful regulatory relief.

The demands shouldered by compliance community continue to increase day-by-day as federal regulators, such as the CFPB and NCUA, continue to finalize a plethora of regulations mandated by the Dodd-Frank Act. While this may abate slightly with the Trump Administration, any substantive relief from is going to require Congress passing legislation.  

You can have an impact on  the legislative process by participating in grassroots advocacy,  ensuring the collective voice of the credit union industry is heard.  We need compliance experts to share their invaluable first hand knowledge about the unnecessary burdens over-regulation is placing on credit unions. The testimonials and insight you provide to your members of Congress are critical in helping shape the policy decisions being made on Capitol Hill.

NAFCU wants to be a resource to help your voice be heard, which is why have created the necessary grassroots advocacy resources to make it easier for you to weigh in with your members of Congress. The contacts you make with your legislators will have a real influence this Congress in shaping the policy that will ultimately impact your work and the credit union industry as a whole.

Please go to NAFCU’s Grassroots Action Center to contact your members of Congress today. It will help NAFCU’s lobbyists in their legislative efforts, strengthen our federal advocacy message on Capitol Hill and show Congress that we are serious about enacting real relief for our nation’s credit unions.

There are four key ways to get engaged with your lawmakers:

1. Arrange a personal visit to your credit union. Schedule a time when your Representative or Senators can visit your facility, meet your staff and say hello to your members. Use this meeting as an opportunity to let them know about the unique way in which you serve your members – who are the lawmaker’s constituents.
2. Many members of Congress hold town hall meetings or roundtable discussions to hear directly from their constituents. Participating in these events are great opportunities for you and your credit union members to discuss key legislative issues and to express the need for regulatory relief.
3. Write your members of Congress and urge them to support key legislative efforts. This is something you can do all year long as issues develop. NAFCU’s Grassroots Action Center has made it easier than ever for you to reach your lawmakers at any time.
4. A lot of lawmakers are active on social media and like to virtually engage with their constituents. Follow them on Twitter and “like” them on Facebook. Engage with your lawmakers by tweeting them or by leaving comments on their Facebook page.

All of these are great opportunities for your credit union to build a lasting relationship with your elected officials, providing your knowledge and expertise on the credit union industry and the issues we face.

To learn more about getting involved in NAFCU’s grassroots and political advocacy efforts, you can email me directly at [email protected].  Please remember to come be an advocate in Washington, D.C., at NAFCU’s 2017 Congressional Caucus from September 10-13, 2017, click here to find out more!

***

Programming Note. NAFCU will close at noon today and remain closed on Monday in observance of President's Day. We'll be back to blogging on Wednesday.

***

Save on Online Training.  Use code LOVE by February 28 to save $200 on NAFCU online training. That includes our Online Compliance Training Subscription. Master the most challenging areas of compliance—including HMDA and MLA—with over 40 live and on-demand webcasts. Your whole credit union gets access for less than the cost of sending one person to a conference!

 

Whistleblowing and Fraud Prevention; New HMDA Resources Available from the CFPB

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

The NAFCU Compliance Team has seen an uptick in questions about various internal fraud prevention issues, like whistle blower information, fraud policies and NCUA’s Fraud Hotline. This isn’t necessarily surprising since NCUA indicated that internal controls and fraud prevention are one of their primary areas of supervisory focus in 2017.

Section 1790b of the Federal Credit Union Act has a provision protecting whistleblowing employees against retaliation:

“§1790b.                     §213

Credit union employee protection remedy.—

(a) In general.—

(1) Employees of credit unions. — No insured credit union may discharge or otherwise discriminate against any employee with respect to compensation, terms, conditions, or privileges of employment because the employee (or any person acting pursuant to the request of the employee) provided information to the [NCUA] Board or the Attorney General regarding any possible violation of any law or regulation by the credit union or any director, officer, or employee of the credit union.” FCU Act, section 1790b(a)(1) (Emphasis and clarification added).

Some laws, like the Sarbanes-Oxley Act which applies to publicly traded companies, require a hotline be available for whistleblowing purposes. NCUA does not have a provision explicitly requiring that credit unions make a hotline available for whistleblower employees. NCUA has established a Fraud Hotline for the reporting of suspicious or illegal activity directly to NCUA. Reports are confidential and can be anonymous.

While there may not be federal regulation from NCUA requiring credit unions to make a hotline available or post information about NCUA’s Fraud Hotline, many credit unions’ internal policies and procedures, such as the Fraud Policy, may contain requirements to do so. These policy requirements implement the FCU Act’s provisions and mitigate risk by facilitating or encouraging employees to report illegal acts or internal fraud. Lastly, there may be state law or human resource management requirements that might require a whistleblower policy or the availability of a hotline for reporting insider abuse.

NCUA does require that credit union management develop and implement a fraud policy. Chapter 14 of the NCUA’s Examiner’s Guide states “[t]he board of directors should adopt the policy and require that staff given written acknowledgement of receiving and reviewing that policy.” See, page 14-5. In the AIRES Examination Questionnaire on Red Flags, the failure to have a fraud policy is considered an indication of a material weakness in internal controls. NCUA recommends that credit unions require employees to review and acknowledge the Fraud Policy on an annual basis. See, NCUA’s Help Deter, Detect and Report Insider Fraud website. Further, a Fraud Policy may be required to obtain fidelity bond coverage for the credit union.

For more information on internal controls and fraud prevention, see the below resources:

• NCUA’s IRPS 87-1 regarding the Bank Bribery Act and codes of ethics
• Federal Credit Union Act
• AIRES Examination Questionnaires on “Red Flags” and “Internal Controls – Management”
• NCUA’s Fraud Prevention Center website
• The Supervisory Committee Guide for Federal Credit Unions, Chapter 22
• NCUA Examiner’s Guide
  • Chapter 14, “Fraud and Forgery” and “Internal Control Structure” sections, p. 14-5
  • Chapter 7, “Conflicts of Interest” section, p. 7-24
• NCUA’s Help Deter, Detect and Report Insider Fraud website
• The NCUA Fraud Hotline website
• NCUA’s Fraud Series video series
• NAFCU Compliance Blog Post - Safeguarding Against Insider Fraud
• FFIEC’s BSA/AML Examination Manual, Suspicious Activity Reporting-Overview

New HMDA Resources Available from the CFPB

Earlier this month, the CFPB issued some additional resources on new HMDA, including a webinar discussing data points and a chart illustrating options for collection and reporting. These new resources can be found on the CFPB’s HMDA Rule Implementation webpage. For more information about HMDA compliance under the new rule, see NAFCU’s HMDA Compliance webpage.

Heads Up: Another UDAAP Consent Order

Written by Pamela Yu, Special Counsel for Compliance and Research

Earlier this month, the Consumer Financial Protection Bureau (CFPB) issued another consent order for unfair, deceptive, or abusive acts or practices (UDAAP), this time against UniRush and Mastercard for “failing to conduct adequate testing and preparation” for a planned payment processing platform conversion. The CFPB ordered UniRush and Mastercard to pay an estimated $10 million in restitution to affected consumers, as well as $3 million in civil money penalties to the CFPB. 

This latest UDAAP enforcement action stems from data processing glitches that took place in October 2015 when UniRush, which manages the reloadable prepaid RushCard, transitioned to its new payment processor. RushCard, which was co-founded by famed hip-hop mogul Russell Simmons, experienced service disruptions during the botched processor conversion, which the bureau asserts “left tens of thousands of economically vulnerable RushCard users unable to access their own money to pay for basic necessities.” 

UniRush and Mastercard spent 13 months preparing for the processing platform switch, but the scheduled 2-day conversion did not go as planned.  According to the CFPB:

“In October 2015, a rash of preventable failures by Mastercard and UniRush meant that many customers could not use their RushCard to get their paychecks and other direct deposits, take out cash, make purchases, pay bills, or get accurate balance information. UniRush then failed to provide customer service to many consumers who reached out for help during the service breakdown.”

The bureau indicates that, at the time of the switch, RushCard had approximately 650,000 active users, of which about 270,000 received direct deposits on their prepaid card.  It is worth noting that the bungled direct deposits included government benefits or payroll funds. 

According to the CFPB’s press release, as a result of its “lack of preparation and testing” and “multiple preventable failures,” UniRush and Mastercard violated UDAAP as follows:

• Denied consumers access to their own money: UniRush did not accurately transfer all accounts to Mastercard. As a result, thousands of consumers could not access funds stored on their cards for days, or in some circumstances, weeks. Because of Mastercard’s actions, accounts of about 1,110 consumers were incorrectly suspended. UniRush also delayed crediting cash deposits to consumers’ accounts and shut off access to certain funds that consumers put aside for savings. UniRush did not issue a working replacement card to consumers whose cards were lost or stolen during this period.
• Botched the processing of deposits and payments: UniRush delayed processing direct deposits for more than 45,000 consumers, and did not process or improperly returned deposits of 2,000 others. As a result, consumers could not access their paychecks or government benefits. UniRush also erroneously double posted deposits and did not promptly process electronic debit transactions, which falsely inflated those RushCard holders’ account balances. As a result, thousands of consumers accidentally spent more money than was loaded on their RushCard. With no advance notice to consumers, UniRush used funds consumers subsequently loaded onto their RushCards to offset negative balances caused by its processing errors.

• Gave consumers inaccurate account information: Mastercard did not make sure it was sending accurate information about consumers’ account balances to UniRush when it declined to authorize certain transactions. As a result, some consumers received incorrect information telling them their account balances were zero, when the consumers actually had funds stored on their cards.

• Failed to provide customer service to consumers impacted by the breakdowns: UniRush did not have an adequate plan to step up its customer service response to meet the increased demand caused by service disruptions. Even after hiring additional personnel, UniRush failed to train customer service agents in time to meet the surge in demand. As a result, some consumers who called customer service waited on hold for hours and could not obtain critical information about the status of their funds and accounts.

Several observations about this latest enforcement action: First, it is interesting to note that the CFPB’s big focus here was the alleged lack of, or inadequacy of, the pre-launch testing prior to the scheduled processor conversion. The parties prepared for the conversion for over a year, but the CFPB says they goofed “before, during, and after the payment processor conversion” and adversely impacted consumers as a result (See, p. 6 of the Consent Order). This is significant because the CFPB seems to be expanding its focus beyond cracking down on deceptive or abusive activities to now insisting on robust pre-launch preparations for processor conversions as a matter of fairness.  Essentially, the bureau is sending a clear message that inadequate IT functionality testing is an “unfair” practice in violation of UDAAP. 

Second, much was made of UniRush’s inability to handle the unanticipated surge in customer service demands that resulted from the conversion glitch.  While UniRush prepared for the planned 2-day service disruption, the conversion took longer and the disruption was more widespread and significant than anticipated.  The CFPB says UniRush should have been ready to step up its customer service response, noting that “even after hiring additional personnel, UniRush failed to train customer service agents in time to meet the surge in demand.”  (Emphasis added).

But this seems to beg the question: Is it reasonable to expect the unexpected?  The CFPB seems to be indicating that card issuers must be sufficiently prepared—in advance—for any unexpected contingencies during a processor conversion.  But can we ever really be adequately prepared for the unexpected? Here, UniRush’s response to hire more staff was not enough because new staff could not be trained in time to assist customers during the unexpected service disruption.  The message here?  Beware of Murphy’s Law… Be ready for anything, folks.

OFAC Enforcement: How is an Administrative Action Decided?

Written by Shari R. Pogach, Regulatory Paralegal, NCBSO

The general factors used in determining an administrative action for Office of Foreign Assets Control (OFAC) violations were discussed during its fall symposium held in December 2016, here in Washington, DC. There are 11 general factors that must be analyzed by OFAC.  These factors and the related underlying activity include:

1. Willful or reckless violation of law – willfulness; recklessness; concealment; pattern of conduct; prior notice; management involvement.
2. Awareness of conduct at issue – actual knowledge; reason to know; management involvement.
3. Harm to sanctions program objectives – economic or other benefit to the sanctioned individual, entity or country; implications for U.S. policy; license eligibility; humanitarian activity.
4. Individual characteristics – commercial sophistication; size of operations; financial condition; volume of transactions; sanctions history.
5. Compliance program – risk-based compliance; consultation with regulator.
6. Remedial response – an immediate stop to conduct; determine the cause of conduct and extent of apparent violation; new and more effective internal controls and procedures; prevent a recurrence.
7. Cooperation with OFAC – voluntary self-disclosure; similar transactions; response to requests for information; tolling agreement(s).
8. Timing of apparent violation in relation to imposition of sanctions – date of apparent violations in relation to the adoption of the applicable prohibition(s).
9. Other enforcement action – other federal, state or local agencies’ actions; comprehensive settlements with other agencies.
10. Future compliance/deterrence effect – to promote future compliance; focus on same sector.
11. Other relevant factors – case-by-case basis; totality of circumstances; proportionate response.

Substantial weight is given to factors A, B, C and D in making a determination as to whether an infraction is considered egregious.  There are statutory maximum penalties for OFAC violations but the amount of the base penalty can be adjusted to reflect any of the applicable general factors.   Each of the 11 general factors may also be considered mitigating or aggravating thus resulting in a lower or higher proposed penalty amount.  But the base or proposed penalty amount cannot exceed the statutory maximum amount. This slide presentation from the symposium provides an overview of OFAC enforcement along with a couple of case studies.

During fiscal year 2016, there were three cases involving financial institutions that resulted in OFAC issuing a Finding of Violation.  Earlier this year, OFAC announced its enforcement action against Toronto-Dominion Bank (TD Bank) with a settlement agreement and Finding of Violation for the bank’s violations of the Iranian and Cuban sanctions.  TD Bank is headquartered in Toronto, Canada, but the bank and its subsidiaries processed multiple prohibited transactions through the United States.  The enforcement action highlights the facts and circumstances in OFAC’s determination of its administration action. 

Symposium speakers noted that OFAC is stepping up its enforcement actions.  It was also emphasized that any information provided to OFAC must not be inaccurate, misleading or incomplete.  And, one speaker even said, “Don’t lie to OFAC as we take it personally.”

Audits and Examinations

Written by Brandy Bruyere, Vice President of Regulatory Compliance

Hello everyone! Our usual Wednesday blog was delayed to technical issues, but we promise to blog three times a week so here's a special Thursday edition for you. Here at NAFCU, members often call us to ask about where they can find certain examination guidance or information explaining an examiner request. Many times, even if there is not a specific regulation, we are able to point to a Supervisory Letter, section of the Examiner’s Guide, AIRES Questionnaire, or similar guidance document. Other times, there is not obvious or clear guidance with regard to an examiner’s request. However, the Federal Credit Union Act does provide NCUA with rather broad examination authority, here’s an excerpt from 12 U.S.C. § 1784:

Examination of insured credit unions.—

(a) Examiners and claim agents; powers; report by examiner; jurisdiction of court.—The Board shall appoint examiners who shall have power, on its behalf, to examine any insured credit union, any credit union making application for insurance of its member accounts, or any closed insured credit union whenever in the judgment of the Board an examination is necessary to determine the condition of any such credit union for insurance purposes. Each examiner shall have power to make a thorough examination of all of the affairs of the credit union and shall make a full and detailed report of the condition of the credit union to the Board… (Emphasis added.)

NAFCU has pressed for NCUA to pull back from regulation, but on the flip-slide it can create more uncertainly on the exam side.  It is helpful for us to hear about potential issues- if you are having one then maybe another credit union is too.  Case in point:  recently we heard from a member that examiners were asking for the credit union’s auditor to directly provide the credit union’s audit report to NCUA. This represented a change from the past practice where examiners requested this report straight from the credit union’s management.  We reached out to NCUA for clarification and were informed that requesting the audit be provided by the credit union’s audit firm is a new procedure moving forward, implementing a recommendation made by NCUA’s Office of Inspector General in OIG 13-13 (see p. 18). OIG addressed the issue again as an outstanding recommendation in its Semiannual Report to Congress, April 1 – September 30, 2016, on p. 16:

“Recommendation: OIG-13-13, recommendation #3. Consider requiring examiners to obtain audit reports directly from independent auditors rather than receiving them from credit union management to avoid potential manipulation. NCUA could accomplish this through an e-file system for independent auditors to upload completed audits. Examples of similar systems include the Federal Audit Clearing House maintained by the U.S. Census Bureau and the Integrated Station Information System used by the Corporation for Public Broadcasting.

Status: Open. NCUA’s Office of General Counsel evaluated the agency’s options for obtaining audit reports directly from independent audit firms and concluded that NCUA does not have the power to mandate that these firms provide audit reports directly to the agency because the audit report represents the result of a contract between the credit union and the audit firm. As an official record, credit unions are obligated to share their audit reports with NCUA as a condition of share insurance. However, NCUA has concluded that independent audit firms do not have the same obligation. As a result, independent audit firms must obtain consent from their credit union client prior to sending audit reports directly to NCUA.

NCUA plans a proposed revision to Part 715 of NCUA's Rules and Regulations that will include a requirement that the credit union's engagement letter, signed with an independent third party audit firm, must submit audit reports directly to NCUA. Part 715 is not scheduled to be revisited until 2017.” (Emphasis added.)

As this indicates, sections 715.9(b) and (c) require credit unions to secure an engagement letter when using a “compensated auditor” to perform all or some of the credit union’s financial statement audit or supervisory committee audit. This includes certifying that NCUA staff will have “unconditional access” to working papers:

(b) Engagement letter. The engagement of a compensated auditor to perform all or a portion of the scope of a financial statement audit or supervisory committee audit shall be evidenced by an engagement letter. In all cases, the engagement must be contracted directly with the Supervisory Committee. The engagement letter must be signed by the compensated auditor and acknowledged therein by the Supervisory Committee prior to commencement of the engagement.

(c) Contents of letter. The engagement letter shall:

[…]

(7) Certify that NCUA staff and/or the State credit union supervisor, or designated representatives of each, will be provided unconditional access to the complete set of original working papers, either at the offices of the credit union or at a mutually agreed upon location, for purposes of inspection…(Emphasis added.)

For now, NCUA examiners are requesting credit unions to have auditors provide the information directly. While some audit firms are already making documentation automatically available to NCUA through online portals and similar mechanisms, where an audit firm does not wish to take such steps or otherwise provide information directly to NCUA, then NCUA will work with the credit union’s supervisory committee which could result in physical inspection of audit work papers. However, it appears that NCUA’s new procedure aims to maintain the chain of custody with regard to the audit and is not a reflection on an individual credit union’s management or operations.

Love is . . . Supervisory Guidance: Collateral, new LTV ratios

Written by André B. Cotten, Regulatory Compliance Counsel

February is for lovers, and we are loving the new MBL guidance from NCUA. Previously, my colleague gave an overview of some of the changes to the rule beginning January 1, 2017. Today, I would like to take a closer look at collateral for commercial lending, and also the new suggested  LTV ratios for real estate.

Collateral is essential to commercial lending transactions. The credit union should ensure that the collateral is sufficient to offset inherent risks in the commercial lending transaction. According to the MBL guidance, “a credit union should make credit decisions based on the adequacy and reliability of a borrower’s source of repayment, the net earnings stream generated from a borrower’s business operations.” (See, section 723.5).

In general, commercial loans provide funding for members businesses to purchase an asset or to provide working capital that either fund the member’s inventory or accounts receivable during the business cycle. NCUA suggests that credit unions at least require member businesses to pledge the assets being financed as collateral.  NCUA also warns that additional collateral may be needed if a member’s assets are less marketable or possess a higher degree of risk. The credit union should closely consider a member business’ creditworthiness and the marketability of their inventory or accounts receivable.

As a result, NCUA advises that less marketable, less stable, and less valuable collateral should be monitored more closely than highly marketable, highly stable, and highly valuable collateral. Credit unions should establish policies and procedures to monitor less marketable collateral. These policies and procedures should include systems and process to respond to changes in asset values and the condition of the pledged collateral.

Simply put, the more marketable an asset, the more easily it can be converted to cash. The age and condition of the collateral, as well as possible alternative uses for the collateral, impact its marketability. For instance depreciating assets, such as newer equipment or vehicles, warrant a relatively higher LTV ratio. Alternatively, single-purpose real estate, like a car wash, has limited alternative uses, which warrants a lower LTV ratio.

Moreover, the amortization of a loan should reflect how long the credit union anticipates the collateral will be useful. This is determined by the type and expected use of the collateral being pledged. To mitigate this risk, the credit union should offset the potential volatility of an asset with the LTV. NCUA advises that credit unions use a reasonableness standard and align its policies with prudent lending practices to establish commercial LTV limits.

Real Estate Loan to Value Ratios

Section 723.2 defines the term, loan-to-value ratio, as the aggregate amount of all sums borrowed including outstanding balances plus any unfunded commitment or line of credit from all sources on an item of collateral divided by market value of the collateral used to secure the loan.

Prior to the implementation of the new MBL Rule, section 723.7(a)(1) read:

“The maximum loan-to-value ratio for all liens must not exceed 80% unless the value in excess of 80% is covered through private mortgage insurance or equivalent type of insurance, or insured, guaranteed, or subject to advance commitment to purchase by any agency of the federal government, an agency of a state or any of its political subdivisions, but in no case may the ratio exceed 95%”

(referring to loans for real estate). This version of the rule had a couple exceptions for construction loans or if the Regional Director granted a waiver. Otherwise, real estate loans had a loan-to-value cap.

The new MBL rule does away with the 80% cap for real estate and introduces loan to value ratio limits based on accepted industry and bank regulatory standards. NCUA also notes pursuant to section 723.4(f)(5) that credit unions should establish internal LTV ratio limits, which should be based on an internal risk management analysis and accepted financial institution industry standards.

The new LTV guidelines for real estate include:

• Loan Type (LTV Ratio Guidance)
• Raw Land (65%)        
• Land development or improved lots (75%)
• Construction-Commercial, non-owner occupied multifamily, and other nonresidential (80%)
• Improved property-commercial, non-owner occupied multifamily, and other nonresidential (85%)

NCUA does not require credit unions to strictly follow these guidelines. However, NCUA does view this guidance as a reasonable benchmark. The agency believes this guidance is in line with industry practice and is appropriately tailored to the risk associated with the various types of collateral.

NCUA also notes that when credit unions calculate the LTV ratio for an acquisition transaction, the credit union should establish the collateral value as the lesser of:

• Acquisition cost (purchase price) plus improvements; or
• Appraised value

This method ensures the risk is distributed between the credit union and the member business. NCUA wants to see the member with “skin in the game” or their own capital invested in the success of business.

NCUA warns that if a credit union seeks to approve any loans as an exception to the recommended loan to value policy highlighted above, then the credit union must implement prudent internal limits and set procedures to track and monitor these high risk loans.

As credit unions continue to adjust to the new MBL guidance, the NAFCU compliance team will continue to provide updates in future publications. As always, feel free to email us at [email protected] if you have any specific questions.

Upcoming Training and Webcasts. The Spring session of our Regulatory Compliance School is coming up April 10-14 in Arlington, VA. If you’re thinking about joining us, be sure to register with code SPRINGSAVINGS by Friday, 2/10 to save $200. If you want to challenge yourself to earn the bragging-rights title of NAFCU Certified Compliance Officer (NCCO), this is the place to do it. Already an NCCO? You’ll earn the full 24 CEUs needed to recertify, without having to retake the exams. 

Also, we have two webcasts this week that may be of interest:

Third-Party Vendor Cyber Risks, and Examiner Expectations

Live Webcast: Tuesday, February 7 | 2:00-3:30 p.m. ET

How to Implement a Comprehensive BSA Training Program

Live Webcast: Wednesday, February 8 | 2:00-3:30 p.m. ET

“I’ve Got to Keep on Moving”: CFPB Continues Its Prosecution of RESPA Violations

Written By Shereefat Balogun, Regulatory Compliance Counsel

Any P.Diddy fans out there?! Well, Diddy’s 1997 hit “Can’t Nobody Hold Me Down” rings loud in my head as I read through the latest CFPB Order against a mortgage lender for violating the prohibition on “kickbacks” in Section 8(a) of RESPA.  Now many of you are aware that the CFPB’s order and penalty against PHH Corporation similarly alleging RESPA violations was reversed by a panel of the U.S. Court of Appeals for the D.C. Circuit.  Notwithstanding, the CFPB seems resilient in its efforts.

The Story

A few days ago, the CFPB announced consent orders against Prospect Mortgage, LLC (Prospect), a mortgage lender for paying illegal kickbacks for mortgage business referrals, and some of its partners.  Essentially, the order against Prospect accuses the lender of using a variety of schemes to pay kickbacks for referrals of mortgage business in violation of RESPA.  Here are some of the activities the CFPB found to be in violation of Section 8(a) of RESPA:

• Using Lead Agreements to Pay Brokers for Referrals. According to the order, Prospect entered into agreements whereby it paid real estate brokers for each lead it received.  A lead generally consisted of a prospective buyer’s name, address, email address, and phone number, which Prospect would then use to reach out to the prospective buyer to market its loans products.  Moreover, under these agreements, brokers would also take steps to steer consumers to Prospect, many times under Prospect’s encouragement.  For example, the order states that Prospect paid one broker between $25 to $500 per lead, typically totaling $2k to $3k a month.  The broker, in turn, would hand out $20 bills to their agents, one for each consumer that the agent directed to Prospect’s loan officers.
• Encouraging Brokers and their Agents to Require Buyers to Obtain Preapprovals with Prospect’s Loan Officers. The CFPB found that Prospect violated Section 8(a) by providing that a broker listing a property for sale would require any prospective buyer seeking to submit an offer to first obtain a preapproval from Prospect. For example, one lead agreement required the broker to “educate and train” its agents on the need for consumers to seek Preapproval with Prospect, and that the broker would only earn lead fees for those listings “in which Prospect has been designated as the preferred lender such that the listing agent is required to have all customers who desire to submit an offer on the property receive a Prospect Mortgage pre-qualification.”
• Paying a Mortgage Servicer for Referrals. The CFPB alleges that Prospect had a contract with a mortgage servicer whereby the mortgage servicer would market Prospect’s services to its servicing clients, and tried to persuade them to refinance their existing mortgage with Prospect.  In return, Prospect paid the mortgage servicer a portion of the proceeds received from any resulting refinance and also gave them the mortgage servicing rights on the refinance mortgage.
• Encouraging Brokers to Use Fees and Credits to Pressure Consumers into Using Prospect. The order alleges that in response to pressure from Prospect, brokers at time took steps to economically coerce consumers into using Prospect. For example, one broker made a seller’s credit conditional on using Prospect for the mortgage.  Also, other brokers allegedly imposed per diem fees (a penalty imposed on the buyer for each day beyond the contractual closing date the buyer was unable to close because financing had not been approved) unless the buyer used Prospect.

Remind Me About Section 8(a) Again.

Section 8(a) of RESPA generally prohibits any person from giving or receiving a fee, kickback, or other “thing of value” in exchange for the referral of a settlement service involving federally related mortgage.  See, 12 U.S.C § 2607(a). “Thing of value” is broadly defined, and thus many credit unions tend to be cautious regarding real estate transactions and referrals.  In short, a credit union may not pay another company or its employees for the referral of settlement service business.  

What Are Compliance Folks Saying?

“OK, I understand the general prohibition, but I thought some activities were allowed.  What about Section 8(c)?”  Interestingly, the CFPB did not even mention Section 8(c) in its orders. 

Section 8(c) lists several types of conduct that are permitted, so long as certain conditions are satisfied.   Indeed, Section 8(c), states:

Nothing in this section shall be construed as prohibiting (1) the payment of a fee (A) to attorneys at law for services actually rendered or (B) by a title company to its duly appointed agent for services actually performed in the issuance of a policy of title insurance or (C) by a lender to its duly appointed agent for services actually performed in the making of a loan, (2) the payment to any person of a bona fide salary or compensation or other payment for goods or facilities actually furnished or for services actually performed…

12 U.S.C § 2607(c)(emphasis added).

Regulation X further expressly permits:

• A payment to an attorney at law for services actually rendered;

• A payment by a title company to its duly appointed agent for services actually performed in the issuance of a policy of title insurance;

• A payment by a lender to its duly appointed agent or contractor for services actually performed in the origination, processing, or funding of a loan;

• A payment to any person of a bona fide salary or compensation or other payment for goods or facilities actually furnished or for services actually performed;

• A payment pursuant to cooperative brokerage and referral arrangements or agreements between real estate agents and real estate brokers. (The statutory exemption restated in this paragraph refers only to fee divisions within real estate brokerage arrangements when all parties are acting in a real estate brokerage capacity, and has no applicability to any fee arrangements between real estate brokers and mortgage brokers or between mortgage brokers.);

• Normal promotional and educational activities that are not conditioned on the referral of business and that do not involve the defraying of expenses that otherwise would be incurred by persons in a position to refer settlement services or business incident thereto; or

• An employer's payment to its own employees for any referral activities.

See, 12 C.F.R. §1024.14(g)(iv)(emphasis added.).

Despite acknowledging that referrals are inherent in real estate transactions, the CFPB did not provide much guidance as to how lenders and other industry partners should structure referral arrangements to comply with RESPA.  

If it’s any consolation, the rule does advise that the CFPB “may investigate high prices to see if they are the result of a referral fee or a split of a fee. If the payment of a thing of value bears no reasonable relationship to the market value of the goods or services provided, then the excess is not for services or goods actually performed or provided. These facts may be used as evidence of a violation of section 8 and may serve as a basis for a RESPA investigation.”  12 C.F.R. §1024.14(g)

What Now?

If your credit union is offered some kind of referral or similar arrangement, or is involved in referral programs that may not have previously been vetted, it may be worth calling your lawyer.  In light of RESPA’s already restrictive language, coupled with the recent CFPB interpretations and aggressive prosecution, credit unions involved in the mortgage business are advised to consult with counsel before making referrals.

If you have any questions on this or any other compliance issue, please feel free to reach out to us.  We’re here to help you!

Exceptions to the Prepaid Rule: What's Missing from the Buffet?

Written by Stephanie Lyon, Regulatory Compliance Counsel

The CFPB’s final rule on prepaid accounts, which is the Bureau's version of all you can eat regulation, was issued near the end of 2016. We have previously blogged on the general application of the rule as well as the definition of a prepaid account. Today’s blog focuses on what's missing from the buffet.

Issuers of Prepaid Access

Smaller credit unions have recently asked if the prepaid rule carved out an exception for smaller financial institutions. Unfortunately, the rule does not have an asset size threshold requirement for compliance with the prepaid rule. Hence all credit unions that are issuers of prepaid access will have to comply with the final rule. This requires providing the credit union’s prepaid account agreements to the Bureau for posting on the CFPB’s website on a rolling basis (not quarterly). See, 81 Fed. Reg. 84129.

There is an exception, however, that will not require credit unions with less than 3,000 “open” prepaid accounts to provide their agreements to the Bureau. See, 81 Fed. Reg. 84140.  So what exactly does “open” mean? The rule defines a prepaid account as open if either:

1. There is an outstanding balance in the account;
2. the member can load funds to the account even if the account does not currently hold a balance; or
3. the member can access credit (i.e. overdraft line of credit) from a covered separate credit feature offered in connection with a prepaid account.

See, 81. Fed. Reg. 84133. Nonetheless, credit unions will still be required to post the prepaid account agreements to their own website and to have the agreement readily available upon request. See, final 12 C.F.R. § 1005.19(c).

This is a great time to communicate with vendor providers of prepaid cards and outside packaging to establish who will lead the compliance efforts for the product so that the credit union can continue to issue prepaid cards to its members without fear of the approaching compliance deadline. After all, compliance cannot be outsourced, but credit unions may contractually require vendors to adhere to regulatory requirements to ease its compliance effort.

Sellers of Prepaid Access

According to the most current 5300 call report on the NCUA’s webpage, only about 16% of credit unions issue prepaid cards. Other smaller credit unions however, choose to sell prepaid cards issued by a different financial institution or third-party service provider. Luckily for these credit unions, the CFPB drew a distinction between issuers of prepaid access and other institutions that merely sell prepaid cards.

In order for a credit union to be within the scope of Regulation E, which will implement part of the prepaid rule, it has to either:

1. Directly or indirectly hold prepaid accounts, or
2. issue prepaid accounts and agree to provide electronic funds transfer services.

See, 12 C.F.R. § 1005.2(i). Credit unions that merely sell prepaid cards but do not hold the accounts or agree to provide electronic funds transfers for these prepaid accounts would not meet the definition of a financial institution that issues prepaid accounts or access. Specifically, the prepaid rule states, “… the burden of and liability for complying with this final rule would generally fall on the financial institution that issues the prepaid accounts, not on the banks or credit unions selling those products.” 81 Fed. Reg. 83964.

If your credit union is only selling prepaid access, you may still want to review and familiarize yourself with the lengthy requirements of the rule. While the issuer of the card will be primarily liable for prepaid access compliance, the credit union may take an active approach to compliance and create a checklist of the disclosures and information that should be on and off the prepaid card and package to ensure members receive great service.