NAFCU Compliance Blog

Found in NCUA's Own Backyard: Federal Credit Unions Have the Power to Issue and Sell Securities

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

In 2014, NCUA issued a proposed rule amending its regulations to clarify that a federal credit union is authorized to securitize its assets by issuing and selling securities. The proposal sat on the backburner for a few years until recently.

At this month's NCUA Board Meeting, it was clarified that an amendment is not actually needed. NCUA had determined that federal credit unions already have the requisite authority and incidental power to issue securities.

To that end, on June 21, NCUA issued Legal Opinion Letter 17-0670. In this Legal Opinion Letter, NCUA set out a VERY thorough explanation of how it determines what activities are supported by the FCU Act, and why, under this analysis, the issuing and selling of securities meet all the relevant criteria for an incidental power activity.

Securitization of Assets as an Incidental Power

Section 721.2 of NCUA's regulations sets out a three-part test which NCUA uses to determine whether an activity is an incidental power. An incidental power is authorized if it:

(a) Is convenient or useful in carrying out the mission or business of credit unions consistent with the [FCU Act];

(b) Is the functional equivalent or logical outgrowth of activities that are part of the mission or business of credit unions; and 

(c) Involves risks similar in nature to those already assumed as part of the business of credit unions.

NCUA found that issuing and selling securities offers FCUs an important source of liquidity and reduced dependency on share deposits to fund loan demand. It offers flexibility in responding to competition and market demand, making it both convenient and useful to carrying out the business of credit unions.

NCUA also found that securitizing assets can increase the amount of credit available to members and create a vehicle for mitigating risk, making it a logical outgrowth of an important part of credit unions' mission and business: to provide credit for provident and productive purposes.

Finally, NCUA found that the risks associated with issuing and selling securities were the same risks already assumed by credit unions. Specifically, NCUA identified 5 types of risk attached with securitizing assets: credit risk, liquidity risk, reputation risk, operational risk and strategic risk. In each case, NCUA found that the accompanying risks were similar in nature to those risks already faced by federal credit unions.

Having met all three criteria, NCUA determined that the issuing and selling of securities is, in fact, already permitted by the FCU Act and NCUA's rules and regulations. Having made that determination, the Legal Opinion Letter turned to safety and soundness considerations.

NCUA's Expectations for Starting A Securitization Program

The Legal Opinion Letter also set out some expectations for credit unions engaging in asset securitization activities. Below are some expectations for the creation and implementation of a safe, sound and successful securitization program from the Legal Opinion Letter:

• An FCU should consult with legal counsel and other advisors to understand and give due consideration to all legal requirements, including those from other regulators and jurisdictions.
• Management must consider whether securitization policies are realistic and carefully designed to serve the membership.
• The credit union must have developed proper internal safeguards including management oversight, internal controls and quality control.
• Due diligence must be exercised before entering into third party agreements or devoting credit union resources to securitization activity.
• The risks associated with issuing and selling securities must be properly examined and assessed, and appropriate adjustments must be made in the credit union's risk management processes and insurance coverage to appropriately mitigation that risk.
• Section 721.4 requires an FCU to complete and submit an application to NCUA requesting to engage in securitization activity, as it is not an a preapproved incidental power.

We expect further guidance on the topic to be issued by NCUA in the next 3 to 4 months and will keep you updated.

CFPB Cautions on Deferred Interest Credit Cards; McWatters Named NCUA Chairman

Written by Pamela Yu, Special Counsel for Compliance and Research

The CFPB is sounding the alarm on deferred interest credit cards.  Earlier this month the Bureau issued a letter to retail credit card companies, encouraging them to use more transparent promotional offers.

Citing the results of its 2015 study on deferred interest credit products, the CFPB's letter notes that these promotional products "offer substantial benefits to some consumers, but carry significant costs and risks to others."  As an alternative to deferred interest financing, CFPB is encouraging 0% interest offers, which the Bureau believes is more transparent and carries less risk for consumers.

What's the problem?           

To attract customers and to encourage spending, some private label or store brand credit cards offer deferred interest promotional financing.  These types of credit promotions generally offer "0% interest if paid in full" during a set period of time (usually 6 months to a year).  During this defined promotional window, consumers who repay the full promotional balance can obtain free financing on the purchase of big-ticket items. But consumers who do not fully repay the balance by the close of the promotional window will find themselves hit with “high, retroactive interest charges” that kick in once the promotional period ends.

We've all seen these offers and have perhaps been enticed into opening a store card to buy a big screen TV or a fancy new dishwasher.  So what's the problem?

The CFPB says the issue is primarily a lack of transparency. While deferred interest cards are generally marketed to consumers as "no interest" promotions, in actuality, interest starts accruing from the date of purchase and is retroactively added back on top of the remaining principal if the consumer does not pay the full promotional balance by the end of the defined window.  Keeping in mind that the regular interest rates on these store brand cards tend to run around 25%, consumers may be hit with a substantial lump sum interest charge when the promotion period ends. Because the costs of deferred interest financing are not evident until the end of the promotion, consumers are often surprised to have incurred this unanticipated interest charge. 

The CFPB is concerned that consumers do not fully understand how deferred interest promotions operate and how interest is assessed on these products.  Exhibit A: The CFPB's 2015 study found that a large portion of consumers who failed to repay their full promotional balance before the end of their deferred interest deadline actually paid off the full promotional balance and the lump sum interest charge shortly after the promotion expired.  This certainly seems to support the CFPB's suspicion that consumers are either unable to understand the back-end pricing features that characterize these products, or to effectively manage deferred interest promotions in a way that they may avoid paying interest.

The Bureau's concerns are even more pronounced for subprime borrowers and other at-risk consumers.  According to the CFPB’s 2015 study, subprime or deep subprime consumers fully repay their balances within the promotional period only about 50% of the time.  Meanwhile, consumers with prime or super-prime scores pay off their promotional balances almost 90% of the time.  The CFPB's letter also notes that consumers suffering financial hardship—for example, individuals experiencing job loss or facing an unexpected medical expense—are particularly vulnerable to incurring "an unexpectedly large lump-sum financial cost."

What does this mean?

This is not the first time the CFPB has raised concerns about deferred interest credit cards; the Bureau has been signaling its aversion to these types of products for years. (See, CFPB’s 2015 study; this blog; that enforcement action.)  However, the CFPB's letter is expressly encouraging retail card companies to replace deferred interest promotions with 0% promotions, clearly indicating that it views deferred interest products as "high-risk."  While the letter indicates that programs with "robust compliance management systems and third-party oversight measures," may support the successful implementation of a deferred interest program, the CFPB offers little additional guidance on what a compliant program might look like. 

Time will tell if the Bureau will follow its ongoing pattern of regulating through enforcement, by pursuing greater enforcement action relative to deferred interest cards.

 ***

McWatters Named NCUA Chairman

Good news for credit unions:  President Trump has designated Acting NCUA Board Chairman J. Mark McWatters as the tenth Chairman of the NCUA Board, effective June 23. 

McWatters was nominated to the NCUA Board by then-President Obama on January 7, 2014.  He joined the NCUA Board on August 26, 2014 following his confirmation by the Senate.  He has been serving as Acting Board Chairman since January 23.

Because We Will All Age...... A Primer on the Prevention of Elder Financial Exploitation and Abuse

Written by Shari R. Pogach, Regulatory Paralegal

Did you know that June 15 has been designated World Elder Abuse Awareness Day?  I didn't, that is, not until I attended the third global summit conference held here in Washington, DC, on the 15th.   While it seems as though the "Millennials" get all the attention these days, it's also important to remember that a significant portion of our population is getting older.  Some statistics shared by some of the summit speakers:  one in six of the population in Pennsylvania is over the age of 65; by 2019 there will be more people over the age of 60 than under the age of 18 in North Carolina; and over 80 million of the U.S. population will be over 60 by 2050. 

According to an article in the Federal Reserve System's Consumer Compliance Outlook: First Issue 2017, "roughly one in 10 seniors have suffered financial, emotional, physical, or sexual abuse or neglect in the past year, according to one study, with financial abuse occurring the most."  And as people get older, they may develop cognitive impairments, making them prime targets for financial exploitation.  Banks and credit unions are considered key players in helping to prevent and respond to elder financial abuse due to:

• Knowing their customers and members;
• Personal or face-to-face interaction with older consumers making transactions;
• The ability to detect suspicious account activity;
• Mandated to report suspected elder financial exploitation under many states' laws;
• BSA reporting.

In some cases financial institutions have raised concerns about state and/or privacy laws prohibiting them from disclosing a consumer's financial records to authorities and uncertainty as to the best way to proceed.  The article, Combating Elder Financial Abuse, looks to address these types of issues with a review of federal privacy laws, regulatory guidance and sound practices that can be adopted to help protect elderly customers and members from financial abuse.

Some community banks and credit unions are developing special programs oriented to providing age-friendly or safe banking products and services to their older clientele.  The National Community Reinvestment Coalition (NCRC) has a dedicated section on its website with information and recommendations on providing age-friendly or safe banking to protect older adults.  During the summit, a panel from the North Carolina State Employees' Credit Union (SECU) discussed their credit union's impressive program to protect and educate its senior members.  As it is mandatory in North Carolina to report any witnessed senior exploitation, SECU (North Carolina) has worked to educate its staffers on spotting and reporting potential abuse, as well as developing an estate planning and essentials program to help older members establish an affordable estate plan to help protect their economic future. SECU (North Carolina) is willing to share its expertise with other institutions, simply send an email to: [email protected].

As a reminder, here are some additional resources on developing best practices and responses to elder financial exploitation:

• The Consumer Financial Protection Bureau's Recommendations and Report for Financial Institutions on Preventing and Responding to Elder Financial Exploitation.
• Interagency Guidance on Privacy Laws and Reporting Financial Abuse of Older Adults.
• The Federal Trade Commission's Pass It On website page on scams.
• The National Credit Union Administration's The NCUA Report - NCUA's Resources Can Help Credit Unions Detect, Prevent and Report Elder Financial Abuse.

During the summit, a speaker who was a former New York prosecutor talked about a former case of elder financial exploitation.  The case was never brought to trial and sadly the victim died within a year of the abuse coming to light.  The speaker noted that in most instances older victims are extremely embarrassed about being victimized and although it can't be proven to be a direct cause, in most cases the victims die shortly thereafter. 

And, remember folks, we are all aging as you read this.

Changes in HMDA Notices

Written by Brandy Bruyere, VP of Regulatory Compliance

We've written a good bit about upcoming changes to the Home Mortgage Disclosure Act (HMDA) Regulation C, largely focusing on the expansion of the rule's scope and data collection requirements. However, the rule also changes certain disclosure requirements under section 1003.5. Currently, the rule requires a credit union that is a "financial institution" as defined in section 1003.2 to make certain public disclosures and make data publicly available. The rule's current requirements include:

• Making available to the public in the credit union's home office and at least one branch office in each Metropolitan Statistical Area (MSA) and Metropolitan District (MD) where the credit union has offices the disclosure statement that is prepared by the Federal Financial Institution Examination Council (FFIEC) within 10 business days of receiving the statement;
• Posting the address for sending written requests to obtain the disclosure statement in at least one branch office in each MSA where the credit union has offices and each other MD where the credit union has offices;
• Mailing or delivering a copy of the disclosure statement within 15 calendar days of receiving a written request;
• Making its modified Loan/Application Register (LAR) available for inspection and copying during hours the credit union is open to the public for business, with data for the prior year available by March 31;
• Posting a general notice of the availability of HMDA data in the lobby of the credit union's home office and each branch located in an MSA or MD.

As of January 1, 2018 these requirements will change.  Within 3 business days of receiving notice from the FFIEC that the credit union's disclosure statement is available, revised section 1003.5(b) will require a credit to make a written notice available to the public upon request. The notice must state that the credit union's disclosure statement is available on the CFPB's website and be available for five years.

Additionally, the HMDA rule will require a credit union to provide a written notice regarding the availability of its modified LAR upon request from a member of the public. The notice must be available in the calendar year following the year the credit union collected data and be made available for three years. This requirement is illustrated in the CFPB's Small Entity Compliance Guide for HMDA on page 91:

The notice must be made available in the calendar year following the calendar year for which the Financial Institution collected data. The notice must be made available for three years. 12 CFR 1003.5(d)(1). For example, in calendar year 2021, an institution must make available a notice that its modified LAR is available on the Bureau’s website if it was required to collect data in 2018, 2019, or 2020.

Revised comment 5(c)-3 allows credit unions to use the same notice to meet this requirement as well as the notice that the disclosure statement created by the FFIEC is available (as required by revised section 1003.5(b)). Here is the "suggested" language from the commentary:

Home Mortgage Disclosure Act Notice

The HMDA data about our residential mortgage lending are available online for review. The data show geographic distribution of loans and applications; ethnicity, race, sex, age, and income of applicants and borrowers; and information about loan approvals and denials. These data are available online at the Consumer Financial Protection Bureau's Web site (www.consumerfinance.gov/hmda). HMDA data for many other financial institutions are also available at this Web site.

What about the lobby notice? As of January 1, 2018 revised section 1003.5(e) changes the lobby notice to account for a positive aspect of the revised HMDA rule – a credit union will no longer be required to make its LAR available for inspection at its home office. Rather, the rule will require credit unions to disclose that the LAR can be obtained from the CFPB's website. Specifically, a credit union subject to HMDA will be required to post in the lobby of its home office and each branch located in a MSA or Metropolitan District a general availability notice. The revised staff commentary contains the following suggested language:

Home Mortgage Disclosure Act Notice

The HMDA data about our residential mortgage lending are available online for review. The data show geographic distribution of loans and applications; ethnicity, race, sex, age, and income of applicants and borrowers; and information about loan approvals and denials. HMDA data for many other financial institutions are also available online. For more information, visit the Consumer Financial Protection Bureau's Web site (www.consumerfinance.gov/hmda).

Note that use of the specific notice language from the staff commentary is not mandatory, although using suggested language can often be easier to use for the purposes of complying.

NAFCU members can find our compilation of HMDA resources here.

CFPB Continues to Take Action Against Mortgage Servicers Who Don't Play by the Rules

Written by Jennifer Aguilar, Regulatory Compliance Counsel

Earlier this month, the CFPB issued a consent order against yet another mortgage servicer. The order claims that Fay Servicing, LLC (Fay) failed to inform borrowers of certain foreclosure protections, did not provide required notices informing borrowers of their options to save their homes and moved forward with the foreclosure process in violation of the mortgage servicing regulations. The CFPB ordered Fay to stop their illegal practices, create policies and procedures to ensure compliance with the mortgage servicing regulations and pay $1.15 million to harmed borrowers.

Applicable Laws. Regulation X provides a number of requirements for mortgage loan servicers. Section 1024.38 generally requires servicers to have policies and procedures in place that ensure the servicer complies with the mortgage servicing regulations. Among other things, the rule requires that these policies and procedures be reasonably designed to ensure the servicer provides timely notices and accurate information to borrowers, properly evaluates loss mitigation applications and identifies all loss mitigation options available to a borrower.

Section 1024.41 provides specific requirements regarding all loss mitigation applications. The rules require servicers to provide an acknowledgement notice that informs the borrower that her application has been received and, if the servicer needs additional information, what documents the borrower must submit in order for the servicer to evaluate the application. Once a servicer has evaluated a complete loss mitigation application, the rules require the servicer to provide an evaluation notice that informs the borrower whether she has been approved for a loss mitigation option and, if she has been denied all options, that she has the right to appeal the decision. The loss mitigation rules also prohibit a servicer from taking certain foreclosure actions, including filing for foreclosure or conducting a foreclosure sale, after the servicer has received a complete loss mitigation application.

Fay's Actions. According to the CFPB, Fay repeatedly failed to send the acknowledgement and evaluation notices within the timeframes required by the rules and, in some instances, failed to send the notices altogether. The order explains that these failures stemmed from the fact that Fay did not have proper procedures in place to ensure these notices were sent. At first, Fay's policies did not address either acknowledgment or evaluation notices at all. Fay's policies later addressed both of these notices but only regarding applications where the borrower indicated a preference for retaining her home. Even after implementing these policies, the order explains that Fay still failed to send the required notices. At no point did Fay's policies address notices for those loss mitigation applications where a borrower did not indicate a preference to retain her home.

Even where Fay did send an acknowledgment or evaluation notice, the CFPB found that these notices did not contain all required information. Where Fay needed additional documentation from the borrower, the acknowledgement notice did not adequately inform the borrower of the required documentation. For example, for a self-employed borrower, Fay needed profit and loss statements as documentation of the borrower's income; however, the acknowledgement notice simply stated "Income Documentation (e.g., two most recent paystubs)." Also, Fay's evaluation notices did not adequately inform borrowers of their right to appeal a decision. The rules allow a borrower to appeal the denial of any option as long as the servicer received the loss mitigation application more than 90 days before a foreclosure sale. Fay's evaluation notices instead stated that the borrower could appeal only if "a foreclosure sale was 90 days or more from the date on the Evaluation Notice."

In addition to the notification issues, the CFPB also determined that Fay moved forward in the foreclosure process after receiving a complete loss mitigation application by moving for foreclosure judgments and conducting foreclosure sales. Again, Fay failed to have policies and procedures in place to prevent these violations and, even after implementing such policies, the policies were only for those applications where the borrower indicated a preference to retain her home. According to the CFPB, these policies also failed to properly address when borrowers were entitled to foreclosure protections. For example, when Fay denied a borrower's application for all available options, it lifted all foreclosure holds as soon as it made this determination, rather than waiting until all appeals had been exhausted as required by Regulation X. For borrowers who submitted a loss mitigation application and did not indicate a preference for retaining their home, Fay left it up to its personnel and its Foreclosure Review Committee to determine whether the borrower was entitled to any foreclosure protections. The rule affords foreclosure protections to all borrowers.

CFPB's Judgment. As a result of these violations, the CFPB ordered Fay to comply with a number of requirements. First, Fay was ordered to stop its illegal practices. Depending on where the borrower was in the loss mitigation process, this meant that Fay must stop the foreclosure process (dismissing the complaint, vacating the judgment, etc.), properly evaluate the borrower for all loss mitigation options, or send required notices. Second, Fay was ordered to establish a compliance committee, made up of three members of Fay's board of directors, and develop a compliance plan that would ensure future compliance with the mortgage servicing regulations. Finally, Fay was ordered to pay $1.15 million to harmed borrowers.

* * *

These rules, along with a number of other servicing rules in Regulations X and Z, have been amended recently. These amendments go in effect in October 2017 and April 2018. For more on these amendments, check out NAFCU's mortgage servicing webpage and blogs.

Changes at the Credit Reporting Agencies and What It May Mean for Credit Unions

Written by: André B. Cotten, Regulatory Compliance Counsel

Hello, compliance compadres! As you are well aware, the Fair Credit Reporting Act (FCRA) and its requirements govern the furnishing of information to the credit reporting agencies ("CRAs"). The FCRA subjects data furnishers to various duties, such as, but not limited to the following: the duty to provide accurate information; the duty to provide notice of dispute; the duty to provide notice of delinquency of accounts and the duty to provide notice of negative information to members. See, 15 U.S.C. § 1681s-2(a).

Recently, I have spoken to a few members about pending changes at the big three credit reporting agencies (Transunion, Equifax, and Experian) that are aimed at improving the accuracy of consumer credit reports and better enabling consumers to dispute and correct incorrect credit information. The changes are a result of increased regulatory supervision and a 2015 consumer protection settlement with state attorneys general. Today, I will provide you with some insight into the regulatory and litigation background that and what that may mean for credit unions.

Background

The CFPB has reported that consumers continue to complain about the credit reporting industry in high numbers. The Bureau reports handling approximately 185,700 credit reporting complaints as of February 1, 2017.

Due to the widespread concerns from consumers, the CFPB recently noted in its supervisory highlights that it will be continuing to closely monitor the reporting of consumer information. The CFPB is focusing its supervision at the following issues:

• Fixing data accuracy at consumer reporting companies: Previously, examiners found more than one of the CRAs lacked good quality control to check the accuracy of their consumer records. Consequently, the CRAs have instituted quality control programs to identify whether reports are produced for the wrong consumer and whether reports contain mixed-up files. The CRAs are also taking better corrective actions when mistakes are identified.
• Repairing broken dispute processes at consumer reporting companies: CFPB examiners discovered more than one CRA was not following the federal regulatory requirement that consumers receive notice of dispute results. Examiners also found that the companies were failing to consider documentation provided by consumers on disputed items. As a result, the CRAs have improved processes for investigating disputes and are improving response letters to consumers.
• Cleaning up information from furnishers: Through reviewing information from banks and nonbanks, CFPB examiners also noticed widespread problems with furnishers supplying incorrect information, mishandling disputes, and not completing investigations. As a result, data furnishers are now better handling investigations of disputes, notifying consumers of results, and taking corrective action when inaccurate information has been supplied.

From a litigation perspective, in 2015, the CRAs reached a consumer protection settlement with the New York Attorney General's Office concerning, among other things, the accuracy of consumer credit information maintained by the CRAs; the CRAs’ practices regarding investigation of consumer disputes of alleged inaccuracies in credit reports; and the reporting of medical debt. Thirty-one other states followed suit. As a result of the 2015 settlement, CRAs are required to remove several types of data sets that report to personal credit. These are the pending changes that we are now seeing coming into effect. For example, non-loan related items such as gym memberships in default, library fines, and unpaid traffic tickets will no longer be reported. According to the terms of the settlement made in 2015, Equifax, Transunion and Experian are required to complete these additional changes 3 years and 90 days from the date of the settlement.

Moreover, as a result of the settlement with the state attorneys general, Equifax, Experian and Transunion launched the National Consumer Assistance Plan initiative to make credit reports more accurate and make it easier for consumers to correct any errors on their credit reports. The CRAs have been implementing the plan over a three year period with full implementation set for March 2018. In regards to data accuracy and quality, some of the changes include, but are not limited to the following:

• Medical debts willnot be reported until after 180-day "waiting period" to allow insurance payments to be applied. The CRAs will also remove from credit reports previously reported medical collections that have been or are being paid by insurance.
• Consistent standards will be reinforced by the CRAs to lenders and others that submit data for inclusion in a credit report (data furnishers).
• Data furnishers will be prohibited from reporting authorized users without a date of birth and the CRAs will reject data that does not comply with this requirement.
• Data furnishers will be required to report a delete for accounts that are being paid or were paid in full through medical insurance.
• The CRAs will eliminate the reporting of debts that did not arise from a contract or agreement by the consumer to pay, such as traffic tickets or fines.
• A multi-company working group of the nationwide consumer credit reporting companies has been formed to regularly review and help ensure constancy and uniformity in the data submitted by data furnishers for inclusion in a consumer's credit report.

Moving forward in application

A few members have expressed concern about the potential rise in FICO scores as a result of the forthcoming changes. Credit unions may want to temper their actions until the impact of the changes become more tangible. Since these changes are uniform, credit unions may notice a wide-spread rise in FICO scores, which may lead to natural adjustments in their risk based pricing.

Credit unions may also want to remember that the FICO score is only one of the factors used when determined whether a member qualifies for a product. There are other vital factors that will not be impacted by the CRA changes including, but not limited to the following: annual income; employment history; and debt to income ratio.

Generally, credit unions may want to continue to monitor their credit portfolios as usual for safety and soundness. If the credit union notices negative trends developing, then it should begin to make adjustments.

In the meantime, credit unions may want to revisit their lending policies, consult with their compliance officers, and contact their CRA representative to discuss the pending changes and their potential impact.

Managing the Risk of Paid Ahead Loans

Written by Stephanie Lyon, Regulatory Compliance Counsel

The compliance team is often asked whether there is a federal regulation that limits the number of days a loan can be paid ahead. While there is no federal regulatory limit on how far in advance a loan can be paid, there are a few risk management practices and contractual limitations the credit union may want to consider. 

To begin with, the credit union's loan agreement with the member may govern how payments are applied to the loan. For example, there may be a clause in the agreement regarding how payments in excess of the principal, interest and escrow (if any) will be applied such as advancing the due date or paying down the principal. Generally, ambiguities in a contract are left to state law interpretation so it is important to ensure contract clauses regarding the application of payments are clear. If the credit agreement is silent on the matter, the manner in which the credit union applies excess payments may come down to internal policies or even case law which may not be ideal as courts may interpret things differently yielding various results. If the credit union permits the due date to advance, here are some risk management principles to note.

There are several instances in which NCUA references paid ahead loans as part of a credit union's overall risk management strategy. For instance, transaction risk is defined in NCUA's Examiner's Guide, Chapter 1 as follows:

The risk to earnings or capital arising from fraud or error that results in an inability to deliver products or services, maintain a competitive position, and manage information. This risk (also referred to as operating or fraud risk) is a function of internal controls, information systems, employee integrity, and operating processes. This risk arises on a daily basis in all credit unions as they process transactions.

Paid ahead loans may affect a credit union's transaction risk because some members that obtain a loan may subsequently make large loan payments in excess of the required monthly payment to advance their due dates and skip town—potentially defrauding the credit union. Maintaining some level of contact with these paid ahead members may be necessary to manage transaction risk and ensure the member or the collateral does not do a Houdini disappearance trick. This is not to say that perfectly legitimate reasons why members may pay more to advance their due dates do not exists. For example, a member may be planning to go backpacking through Europe or simply decide to pay more to get ahead of their debts. So a couple of things to note is how far in advance a member seeking to advance their due date and whether the member has a legitimate reason to pay ahead.

NCUA’s Examiner Guide, Chapter 4 and Chapter 10 discuss transaction risk, reviewing paid ahead loans and internal controls in more detail.  Here are a couple of relevant excerpts:

Paid Ahead Loans report - Identifies loans with advanced due dates.

When reviewing this report, the examiner should compare the borrower’s actual payments over time to the note’s required payment schedule. If discrepancies exist, the examiner should review a sample of related loan files, being especially cognizant of paid ahead loans where staff performs frequent file maintenance changes or where the prior activity date is long past (may be a deficiency balance that the credit union failed to charge off). Since a payment is due every month on open-end loans, they should not appear on the paid ahead report. Most IS reports flag open end loans so they do not appear on this report; however, the credit union may not have implemented this feature.

 […]

 Transaction risk. Numerous transaction risks accompany lending. The strength of the credit union’s internal controls will determine the extent of the risk. Management may demonstrate their control of transaction risk through reviewing internal reports such as Paid Ahead Loans, Non-Amortizing Loans, File Maintenance, Supervisory Override, Accrued Interest Greater than Payment, etc. Appendix 4B to the Internal Controls chapter of this Guide discusses other specific loan-related reports.

Finally, NCUA’s Supervisory Committee Guide also talks about paid ahead loans and states that credit unions may want to ascertain the reason a loan is paid ahead more than 60 days. Here is the relevant excerpt from Chapter 7 of the Guide:

What reports should we review as part of the audit if the credit union has an [Electronic Data Processing] EDP system?

7.16 You should review the following reports:

• Negative share reports.

• Unposted item reports for NSF drafts and NSF ATM transactions.

• Computer file maintenance (data change) reports – focusing on loan data changes and address changes.

• Loans by interest rate summary -- look for loans with unusually low interest rates.

• Paid ahead loan report -- review the reason the loan is paid ahead more than 60 days.

• Dormant (inactive) share account reports.

• Any exception reports.

(Emphasis added.) Paid ahead loans can be difficult to manage so it is important the credit union establishes policies and procedures to ensure it is adequately mitigating its transaction risk and protecting itself from potential scams.

***

While some of our colleagues are celebrating NAFCU's 50^th Anniversary at our Annual Conference & Solutions Expo in Hawaii, some of the fort holders in the Government Affairs team attended the Consumer Federation of America awards dinner in Washington, DC. I have to say, it was really fun catching up with local credit union folks during this event and hearing wonderful remarks about the credit union industry from other attendees. Here is a picture of Ann Kossachev, whom you may recognize from several Regulatory Alerts and previous blogs, and me.

The Fed Amends Reg CC Part II: The Expeditious Return

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

On May 31, 2017, the Federal Reserve Board issued a final rule amending Regulation CC. Previously, we discussed how this new Regulation CC addresses electronic checks and RDC warranties and indemnifications. Now, we're going to have a look at another big change in the final rule: the expeditious return of checks.

But before we dive in, let's a take a moment to acknowledge that Regulation CC can be technical and boring. Your NAFCU Regulatory Compliance Team does the best we can to make it interesting... but there's only so much you can do. In that spirit, here's a photo of a cheetah and a puppy engaged in an unlikely animal friendship:

 Adorable Photo Credit: Cincinnati Zoo

Expeditious Returns Under Current Regulation CC

Currently, under sections 229.30(a) and 229.31(a), a credit union returning a check is required to do so in "an expeditious manner." An expeditious manner is a manner that meets one of two tests: the two-day test or the forward collection test.

The two-day test (a/k/a the two-day/four-day test) requires that the check must be received by the depositary bank no later than 4:00pm its local time on the second business day from when the check was presented for payment.

The forward collection test compares a credit union's swiftness in its handling of a check for return to its handling of a check for collection. It requires the return to be made in the same manner that a similarly situation bank (or credit union) would normally process a check of the same amount if it had theoretically been deposited by noon on the day after it was actually presented for payment, and was being sent for collection, rather than return.

Under section 229.33, if a check is in the amount of $2,500 or more, a credit union returning the check must also provide a notice of nonpayment. That notice must be provided in a manner that meets the two-day test. The return of the check itself may serve as the required notice of nonpayment, assuming the returned check includes all the content requirements for the notice.

Expeditious Returns Under the Final Rule

Part of the Fed's goals in issuing a new rule is to encourage electronic processing of checks. The Fed stated that an electronic clearing process "offers lower costs, faster returns, and fewer errors, which substantially reduces risk to the check system compared to the previous largely paper-based environment." In an effort to incentivize the implementation of electronic check returns, the Fed is implementing stricter requirements for what constitutes an expeditious return.

As we discussed in the previous blog post, under the final rule, Subpart C of Regulation CC (which contains the provisions regarding the collection of checks) will apply to "electronic checks." It will also apply to "electronic returned checks." These are electronic images of, and electronic information derived from, a paper check (or a paper returned check) that is sent to a receiving bank pursuant to an agreement and conforms with the applicable ASC X9 standards.

Under the final rule, all checks, paper and electronic, must be returned in a manner that meets a modified version of the two-day test. The forward collection test will no longer be used. Under the new two-day test, the return must be received by the depositary bank no later than 2:00pm its local time on the second business day after the check was presented for payment. Not 4:00pm local time.

The final rule also doubles the $2,500 threshold for issuing a notice of nonpayment. Once the final rule goes into effect, the notice is required if the amount of the check is $5,000 or more. That notice is also due to the depositary bank by 2:00pm (according to the depositary bank's local time), mirroring the new two-day collection test.

Lastly, the Fed added a new condition for depositary banks who might want to assert a claim when another financial institution fails to return the check in an expeditious manner. Previously, there was no such condition. Under the final rule, new section 229.33(a), the depositary bank must have arrangements in place that would allow a check return to be made electronically, directly or indirectly, by commercially reasonable means. The burden of proving that these arrangements exist is on the depository bank asserting a claim. So, under this new rule, if a credit union does not have arrangements in place to receive returned checks electronically, even indirectly, it may forfeit its right to bring a claim against another financial institution for its failure to return the check to the credit union in an expeditious manner.

The new Regulation CC goes into effect on July 1, 2018. We're continuing to dig through the rule -- so more to come.

Calling All Commercial Lenders: NCUA's 3Q17 Call Report Instructions Are Now Available

Written by Pamela Yu, Special Counsel for Compliance and Research

Attention all credit union commercial lenders: NCUA has released its September 2017 Call Report Information, including the 3Q17 5300 Form and 5300 Form Instructions.  The new 5300 Form and Instructions, effective September 30, 2017, include revisions to reflect the amendments to NCUA's commercial lending and member business loan (MBL) rule that became fully effective on January 1, 2017. 

Hopefully, credit unions engaging in commercial lending activities are already implementing the new changes and are prepared to identify and start reporting on MBLs and commercial loans this fall.  However, if you are still orienting yourself to the new changes, the 3Q17 5300 Call Report Instructions provide additional guidance that may help to clarify what qualifies as a commercial loan under the new rule.

By way of brief background, a key aspect of the new principles-based rule is its expanded scope to apply to commercial loans as newly defined by the rule.  In the past, Part 723 did not distinguish between commercial loans and MBLs—which are expressly defined in the FCU Act. As a result, the safety and soundness risk management requirements contained in the former MBL rule were not consistently applied to commercial loans that did not qualify as MBLs. See, 80 Fed. Reg. 37898.  Thus, the amended rule has two separate and distinct objectives.  First, the rule establishes safety and soundness requirements for credit unions that engage in commercial lending to their members.  Second, the rule incorporates the statutory cap on the aggregate amount of MBLs that a federally-insured credit union may make.  In furtherance of these two objectives, the rule relies upon two separate definitions: "commercial loans" and "member business loans."  The MBL definition is narrowly limited to its statutory definition and for the specific purpose of applying the statutory MBL cap. See, 12 C.F.R. §723.8.

While the new commercial loan definition is fundamental to the scope and application of the risk management provisions of the revised rule, it is somewhat confusing to apply.  The 3Q17 Instructions to Schedule A – Specialized Lending (NCUA Form 5300 - Page 16) provides a helpful table to illustrate the distinction between MBLs and commercial loans for purposes of Part 723:

Type of Loan	MBL	Commercial Loan
Loan fully secured by a 1 to 4 family residential property (member’s primary residence)	No	No
Business loan fully secured by a 1- to 4-unit family residential property (not a member’s primary residence)	Yes, if the aggregate net member business loan balance is equal to or greater than $50,000	No
Business loan secured by a vehicle manufactured for household use	Yes, if the aggregate net member business loan balance is equal to or greater than $50,000	No
Business loan secured by a vehicle used in a fleet or to carry fare-paying passengers	Yes, if the aggregate net member business loan balance is equal to or greater than $50,000	Yes, if the aggregate outstanding balances plus unfunded commitments less any portion secured by shares in the credit union is equal to or greater than $50,000
Business loan with aggregate net member business loan balance less than $50,000	No	No
Business loan fully secured by shares in the credit union making the extension of credit or deposits in other financial institutions	No	No
Business loan in which a federal or state agency (or its political subdivision) fully insures repayment, fully guarantees repayment, or provides an advance commitment to purchase the loan in full	No	Yes, if the aggregate outstanding balances plus unfunded commitments less any portion secured by shares in the credit union is equal to or greater than $50,000
Non-member business loan or non-member participation interest in a commercial loan made by another lender	No	Yes, if the aggregate outstanding balances plus unfunded commitments less any portion secured by shares in the credit union is equal to or greater than $50,000

Still confused?  The 3Q17 Instructions also provide some examples to illustrate the commercial loan definition:

"A member has $35,000 in commercial purpose loans and the credit union grants this member an additional $40,000 in a commercial purpose line of credit, the credit union should report both loans as commercial loans as of the date of the second loan is granted regardless of whether the line is drawn on.

In this example, the same member subsequently paid down the $35,000 commercial purpose loan to $15,000 and has a $34,000 balance on the business line of credit, making the total outstanding balance $49,000.The aggregate outstanding balance plus unfunded commitments less any portion secured by shares in the credit union or other financial institutions is still $55,000. The credit union is required to list both of these loans as commercial loans.

If, in the case above, the member subsequently pays down the $35,000 commercial purpose loan to $15,000 and the credit union reduces the line of credit to $34,000. The aggregate outstanding balance plus unfunded commitments less any portion secured by shares in the credit union or other financial institutions is $49,000. The credit union will not list either of these loans as commercial loans.

If, in the case above, the member subsequently pays down the $35,000 commercial purpose loan to $15,000 and makes no change to the $40,000 business line of credit, but adds $6,000 to a secured share account at the credit union. The aggregate outstanding balance plus unfunded commitments less any portion secured by shares in the credit union or other financial institutions is $49,000. The credit union will not list either of these loans as commercial loans."

Additionally, the 3Q17 Instructions give some examples of how MBLs should be reported:

"If a member has $35,000 in business purpose loans and the credit union grants this member an additional $40,000 in business purpose loans, the credit union should report the additional $40,000 as a Member Business Loan.

If, in the case above, the member subsequently pays down the $35,000 business purpose loan to $15,000 and the $40,000 business loan to $34,000, making the aggregate total business purpose loans $49,000, the credit union is not required to list any of these loans as Member Business Loans since the new aggregate loan total is $49,000 and is now below the $50,000 threshold in §723.8(c) of NCUA’s Rules and Regulations."

It is worth noting that the commercial loan and MBL reporting examples in the 3Q17 Instructions are generally consistent with previous agency guidance addressing a credit union's MBL reporting requirements once the aggregate of the total business purpose loans to a member are paid down below $50,000, as well as a 2016 NCUA legal opinion indicating that when a single closed-end MBL falls below the $50,000 threshold, the loan is no longer classified as an MBL for purposes of the MBL cap.  See, NCUA Legal Opinion Letter 16-0604.  The 3Q17 Instructions clarify that a similar analysis applies in the reporting of commercial loans that are paid down below the regulatory dollar threshold.

Updated FFIEC Cybersecurity Assessment Tool; What Are Your Credit Union's Online Compliance Training Needs?

Written by Shari R. Pogach, Regulatory Paralegal

The Federal Financial Institutions Examination Council (FFIEC) has updated the Cybersecurity Assessment Tool to reflect changes to the FFIEC IT Examination Handbook.   The assessment updates reflect changes to the FFIEC's Information Security and Management booklets.  Additional response options included in the assessment now allow a credit union's management to include supplementary or complementary behaviors, practices and processes that represent current practices of the credit union in supporting its cybersecurity activity assessment.

One item to note is the addition of a new third response option for answering cybersecurity maturity declarative statements.  Where previously there was only the ability to answer yes and no, now there is a yes response with a "compensating controls" option.  The User's Guide defines "compensating controls" as:  "A management, operational, and/or technical control (e.g., safeguard or countermeasure) employed by an organization in lieu of a recommended security control in the low, moderate, or high baselines that provides (sic) equivalent or comparable protection for an information system."  This option is intended to allow an institution the ability to meet the requirements of the declarative statement indirectly with other security measures controls and a level of flexibility not previously allowed.

There is also a revised mapping to the updated booklets in Appendix A. The mapping within the appendix is by domain, then by assessment factor and category with each statement sourced to its origin in an appropriate FFIEC IT Examination Handbook.  The last page within the appendix contains the source reference key.

In addition, the FFIEC website reflects updates as of May 2017 to the following sections within the assessment tool:

• User's Guide,
• Inherent Risk Profile, and
• Cybersecurity Maturity.

The FFIEC assessment tool is intended to assist with determining an institution's risk profile, inherent risks and cybersecurity preparedness.  It provides a repeatable and measurable process to assist management in measuring cybersecurity preparedness over time.

NAFCU has also developed an interactive cybersecurity assessment tool workbook for NAFCU members, in an editable, self-tallying file that allows a credit union to self-test cyber risk and readiness in a shareable format with visual results.  The Regulatory Compliance team will be analyzing the FFIEC updates with an eye to any necessary adjustments to the NAFCU interactive workbook. 

***

Online Credit Union Compliance Training:  Find the right online compliance training for your credit Union!  Answer a few quick questions and instantly get a customized plan and price on the industry's best online training. 

Appraiser Shortage?: NCUA Reminds Credit Unions of Their Options

Written by Jennifer Aguilar, Regulatory Compliance Counsel

Last week, NCUA joined an Interagency Advisory on the Availability of Appraisers. While the Advisory does not provide any additional guidance, it does seek to alert credit unions to existing potential solutions to problems with appraiser availability.

Title XI of the Financial Institutions Reform, Recovery, and Enforcement Act (FIRREA) requires NCUA to establish appraisal standards for all federally related transactions. Part 722 of NCUA's regulations provides these standards. Generally, the rules require the appraisal to be performed by a state-certified or state-licensed appraiser. Whether the appraiser needs to be certified or licensed depends on the type of transaction involved. The Interagency Appraisal and Evaluation Guidelines provide an overview of the applicable rules and guidance on developing an appraisal program, choosing an appraiser, and obtaining and reviewing appraisals.

As part of the Economic Growth and Regulatory Paperwork Reduction Act review, commenters raised concerns with the timeliness of obtaining an appraisal. The commenters attributed the issue to problems with the availability of state-certified and state-licensed appraisers. This seemed to be of particular concern in rural areas. The recent Advisory explains a credit union's options in the event a certified or licensed appraiser is not available. In certain situations, the FIRREA permits credit unions to use appraisers who have obtained a temporary practice permit or a temporary waiver instead of a state certificate or license. The Advisory explains both the permit and the waiver.

Temporary Practice Permits

Temporary practice permits can allow an appraiser who is certified or licensed in State A to practice in State B without having to become certified or licensed in State B. Under 12 U.S.C. § 3351, each state appraiser certifying or licensing agency must temporarily recognize the certificate or license of another state in certain circumstances. The rule states that an agency in State B must temporarily recognize the certificate or license of State A if the property involved is part of a federally related transaction, the appraiser's activity in State B is temporary, and the appraiser registers with State B's certifying or licensing agency. Generally, appraisers are able to apply for a temporary practice permit through State B's agency. Each state's agency will determine the requirements for obtaining a temporary practice permit and any fees associated with doing so, but the rule prohibits the agency from imposing "excessive fees or burdensome requirements."

The rule also requires each state certifying or licensing agency to have a reciprocity policy in place. Under this policy, State B's agency will issue a certificate or license to an appraiser from State A if the licensing and certification program of State A complies with the rules of the FFIEC Appraisal Subcommittee, State A's certifying or licensing requirements meet or exceed the requirements of State B, and the appraiser holds a valid certification from State A.

Temporary Waivers

Under 12 U.S.C. 3348(b), the Appraisal Subcommittee (ASC) may waive any certification or licensing requirement if a written determination is made that appraisals are being significantly delayed because of a shortage of state certified or licensed appraisers. The Advisory explains that a temporary waiver request can be made by a state appraiser certifying or licensing agency, a regulated credit union, or any other persons with a demonstrable interest in appraiser regulation. The FFIEC's regulations govern the process for requesting and obtaining a temporary waiver.

Section 1102.2 provides the following requirements for a temporary waiver request:

• The written determination described under 12 U.S.C. 3348(b) or a request that the ASC provide such a determination;
• The requirements of state law the ASC should waive;
• A description of all significant problems currently being encountered;
• Documentation of the nature of the scarcity of certified or licensed appraisers and the extent of the delays anticipated or experienced;
• The reasons why the requester believes that the requirements are causing the scarcity and delays; and
• If the requester is a state agency, a specific plan for expeditiously alleviating the scarcity and delays.

The request can be to waive the requirements across the entire state or for a geographical political subdivision. The ASC will review the request and make a determination within forty-five days. The FFIEC must approve any determination to grant the waiver. If the waiver is granted, it will apply to all federally related transactions within the state or subdivision. The waiver will be effective only for the period specified by the ASC, however, the regulations permit the ASC to extend the period if needed. The ASC may also terminate the waiver before the end of the period if the delays cease to exist or the terms and conditions of the waiver are not being met.

***

Your whole CU can master the most challenging areas of compliance for less than the cost of sending one person to a conference with NAFCU's Online Compliance Training Subscription. For just one price your entire credit union can access over 40 hot-topic compliance webcasts per year on challenges like BSA, data security, HMDA, risk management, loss prevention, and more. Answer a few quick questions and instantly get a customized plan and price!

The Fed Amends Reg CC – Warranties, Indemnities, and Remote Deposit Capture

Written by Brandy Bruyere, Vice President of Regulatory Compliance

Some of you may recall that in February 2014 the Federal Reserve Board issued a notice of proposed rulemaking to amend Regulation CC. Over three years later, on May 31, 2017 the Federal Reserve issued a final rule amending Regulation CC while simultaneously issuing another proposal on other issues. The finalized amendments will be effective on July 1, 2018. Other than some amendments and additions to the scope and definitions section, the changes largely impact Subpart C of the rule which addresses the collection of checks. The final rule is over 230 pages and we will address some more specifics in future blogs, but here's a high-level overview of some of the provisions.

Currently, Subpart C only applies to paper checks even though "by the beginning of 2017 the Federal Reserve Banks received over 99.99 percent of checks electronically." As a result, the scope of this subpart will be expanded to include electronic checks, here's the amended version of the scope of Reg CC:

229.1 Authority and purpose; organization

[…]

(b)

[…]

(3) Subpart C of this part contains rules to expedite the collection and return of checks and electronic checks by banks. These rules cover the direct return of checks and electronic checks, the manner in which the paying bank and returning banks must return checks and electronic checks to the depositary bank, notification of nonpayment by the paying bank, indorsement and presentment of checks and electronic checks, same-day settlement for certain checks, the liability of banks for failure to comply with subpart C of this part, and other matters.

One implication of this shift is that the amended section 229.34 of the rule will apply to "electronic checks" and "electronic returned checks" – as compared to the current rule. Now, not only will the rule apply to electronic items, but the rule will contain "indemnities" in addition to "warranties" and address remote deposit capture. Amended section 229.34 is very technical as shown in this redline. comparing the current and final rule. However, one item worth highlighting is the section relating to remote deposit capture that will be added to the rule:

(f) Remote deposit capture indemnity.

(1) The indemnity described in paragraph (f)(2) of this section is provided by a depositary bank that—

(i) Is a truncating bank under § 229.2(eee)(2) because it accepts deposit of an electronic image or other electronic information related to an original check;

(ii) Does not receive the original check;

(iii) Receives settlement or other consideration for an electronic check or substitute check related to the original check; and (iv) Does not receive a return of the check unpaid.

(2) A bank described in paragraph (f)(1) of this section shall indemnify, as set forth in § 229.34(i) [setting forth specific indemnity amounts], a depositary bank that accepts the original check for deposit for losses incurred by that depositary bank if the loss is due to the check having already been paid.

(3) A depositary bank may not make an indemnity claim under paragraph (f)(2) of this section if the original check it accepted for deposit bore a restrictive indorsement inconsistent with the means of deposit.

Reg CC is so technical, you might be thinking "what does that mean" – that was my first reaction. Here are some excerpts from the preamble to the rule which may help clarify this provision:

Finally, the Board proposed to add a new indemnity for remote deposit capture that would indemnify a depositary bank that received a deposit of an original paper check that was returned unpaid because the check was previously deposited using a remote deposit capture service and paid. Commenters expressed concern that as proposed, the indemnity would deter financial institutions from offering remote deposit capture service, thereby inhibiting its growth. Many of these commenters believed that the indemnity should not apply to checks bearing a restrictive indorsement.

[…]

The Board finds that basing the indemnity on whether the depositary bank that accepts the original check also offers remote deposit capture would not be an appropriate approach. The Board believes that the bank that accepts the original check should receive the indemnity, irrespective of whether that bank also offers remote deposit capture. As noted by many commenters, the bank that accepts a check via remote deposit capture is in the best position to address the actions of its own customer and to guard against the subsequent deposit of the paper check. The Board believes that this indemnity provides an appropriate incentive for the bank providing remote deposit capture services to take steps to minimize potential fraudulent deposits. The Board also believes that § 229.38(g) provides sufficient clarity that actions under this section must be brought within one year after the date of the occurrence of the violation involved.

Based on comments received, however, the Board has added an exception to the indemnity, and associated commentary, which would prevent a bank from making an indemnity claim if it accepted the original check containing a restrictive indorsement inconsistent with the means of deposit, such as “for mobile deposit only.” The Board believes that providing this exception may reduce accidental double deposits and may provide incentives for banks that receive remote deposit capture deposits to take steps to minimize intentionally fraudulent deposits.

NAFCU is still evaluating the rule and accompanying proposal for its impact on credit unions and will issue a Final Regulation and Regulatory Alert for members in coming weeks. In the meantime, for more information on the current state of play with Reg CC and RDC, check out this prior NAFCU blog post.

ICYMI: NCUA Second Quarter News Letter; New Procedures for External Audit Reports

Written By: André B. Cotten, Regulatory Compliance Counsel

Here in DC we have been experiencing an extended chilly, rainy spring, but I hope the weather is better wherever you are. In the month of May, NCUA issued its second quarter newsletter that detailed numerous topics, including but not limited to: consumer compliance risk indicators; share insurance; indirect lending; information security; the new MBL rule; and the fifth BSA compliance "pillar".

In today's blog, I've highlighted a few topics from the second quarter 2017 newsletter. I've also included a note about a recent NCUA Credit Union Express regarding new procedures for delivery and review of external audit reports.

Managing an Indirect Lending Program

Credit unions have increased their lending for both new and used automobiles over the last several years. A key aspect of this growth has been indirect auto lending. To be clear, an indirect lending relationship exists when members within the credit union's field-of-membership apply for credit directly through a car dealer.

Although this indirect lending relationship can be a convenient way of diversifying the credit union's loan portfolios, an indirect lending program does come with potential risks. According to the NCUA Report, a credit union may want to "establish clear expectations and have regular contact with participating dealers to ensure the program is being administered in accordance with the board of director's expectations for risk management."

Credit unions can make strategic decisions when managing an indirect lending program, such as:

• Establishing appropriate growth goals and concentration limits, along with minimum standards for creditworthiness;
• Monitoring the performance and risk-levels of the portfolio;
• Setting loan rates to ensure adequate profitability; and
  
• Taking early action to revise the program when adverse performance trends occur.

The NCUA Report contains a more detailed discussion about preventative management practices.

Credit unions may want to seek to understand the unique risks associated with indirect lending and have the expertise and processes in place to offer this service safely. The credit union will definitely want to monitor trends in the auto lending market, which is currently showing signs of increased credit risk, and regulator evaluating the effectiveness of a credit union's risk-management practices.

FinCEN Adds Fifth BSA Compliance "Pillar"

In 2016, FinCEN issued a final rule that imposed new requirements for identifying and verifying beneficial owners of legal-entity customers. This new rule, which amended the Bank Secrecy Act, became effective in July 2016, and all federally insured credit unions must comply fully by May 11, 2018.

This final rule added a fifth core element to the original four core elements of an effective BSA and anti-money laundering compliance program. Under the new rule, a credit union's program must now include this fifth core element:

• Risk-based procedures for conducting ongoing customer due diligence, to include, but not be limited to:
  • Understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile; and
  • Conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain the update customer information.

Credit unions will need to develop and maintain compliance procedures to identify and verify the beneficial owners of legal-entity members. In preparation for the May 2018 implementation date, credit unions may want to review their "policies, processes, record-retention practices, information technology systems, employee training and other aspects of their BSA/AML compliance programs".

Please see these additional resources for more information:

“Customer Due Diligence Requirements for Financial Institutions,”

“Frequently Asked Questions Regarding Customer Due Diligence Requirements for Financial Institutions.”

Do You Need to Report an Information Security Incident?

Threats to information security range from unintentional human error to cyberattacks. Since members' sensitive information is constantly at risk, it is important that credit unions understand their reporting requirements when an information security incident occurs.

Regulatory Context

From a federal regulatory perspective, the Gramm-Leach-Bliley Act requires the NCUA Board to establish appropriate standards for federally insured credit unions relating to administrative, technical and physical safeguards for member records and information. Part 748 of NCUA's rules and regulations direct federally insured credit unions to establish a security program that incorporates Gramm-Leach-Bliley requirements and to detail response procedures to unauthorized access to member information.

Appendix B of Part 748 of NCUA's rules and regulations also directs a credit union's response program to contain procedures for notifying the appropriate NCUA regional director. According to the NCUA Report, the credit union may want to plan for the notification to occur as soon as possible after the credit union becomes aware of an incident involving unauthorized access to or use of sensitive member information. In addition, a federal insured, state-chartered credit union may also want to have procedures to notify its state supervisory authority.

Specifically, the preamble to the Federal Register notice for Part 748, Appendix B, states:

"The NUCA Board has concluded that the standard for notification to regulators should provide an early warning to allow [the] NCUA or applicable state supervisory agency to assess the effectiveness of a credit union's response plan, and, where appropriate, to direct that notice be given to members if the credit union has not already done so."

Note, "member information" is a defined term in Appendix A to Part 748, and the term "sensitive member information" is defined in Appendix B to Part 748.

In regards to Appendix B, NCUA Legal Opinion 06-0332 clarifies that "where an incident, even one involving sensitive member information, involves little or no likelihood of harm to the member, a credit union need not notify the NCUA." Consequently, the credit union's risk assessment of the incident is a critical component of your response program, and a material factor in your decision to notify the regional director.

Practical Application

According to the NCUA Report, credit unions may want to consider including details in their response programs concerning their notification procedures for members, regulators and other concerned parties.

To determine whether the regional director notification is warranted, the credit union may want to assess the inherent risk of the incident based on the information available. Then, if applicable, the credit union may want to consider any immediate mitigating actions it took to reduce the risk to the member. If the incident involves sensitive member information and presents the potential for harm (more than little-or no-likelihood of harm) to the member, the credit union may be prompted to notify the NCUA regional director. Federally insured, state-chartered credit unions may also notify their state supervisory authority.

Even if the credit union decided not to notify the NCUA regional director, the credit union may want to retain documentation of its risk assessment to demonstrate compliance with Part 748's reporting expectations.

The NCUA Report also details a best practice for the content of notifications to the NCUA regional director:

• The incident;
• The risk to the member or members;
• The corrective actions taken already;
• Any additional corrective or mitigation actions planned;
• Your coordination with law enforcement; and
• Any other relevant factors.

Note, state supervisory authorities may have their own notification requirements.

Lastly, the credit union may need to notify other parties, such as its insurance or bond company. Notifying your NCUA regional director does not replace other reporting requirements such as: filing a suspicious activity report, notifying the FBI or involving local law enforcement.

For more information, please visit the NCUA's Cybersecurity Resources Webpage.

***

New Procedures for External Audit Reports

Last month, NCUA issued a Credit Union Express that provided an overview of the new procedures for delivery and audit reports. NCUA has recently updated its policies governing how and when examiners will receive external audit reports. This updated procedure is meant to maintain better custody of audit reports. As the NCUA Credit Union Express mentions, "this new policy was created partly in response to a recommendation made by NCUA 's Office of Inspector General during a material loss review. The report recommended examiners obtain audit reports directly from the auditors rather than receiving them from credit union management to avoid any potential manipulation."

As an additional reference, please refer to the recently updated National Supervision Policy Manual (p.52/p.66 with PDF pagination): https://www.ncua.gov/Legal/GuidesEtc/GuidesManuals/SupervisionManual.pdf