NAFCU Compliance Blog

CFPB Supervisory Highlights; More HMDA Guidance

Written by: André B. Cotten, Regulatory Compliance Counsel

Hello, Compliance Friends. We are counting down the days to San Diego. The NAFCU Compliance Team will be hosting our Regulatory Compliance School and Regulatory Compliance Seminar the week of October 9^th.

 On September 12, 2017, the CFPB issued its latest supervisory report sharing a plethora of observations from recent examinations and other supervisory activities. The report covers issues observed by the Bureau in the areas of automobile loan servicing, credit card account management, debt collection, deposits, and fair lending. Other topics, such as small-dollar lending, collection, mortgage origination, and mortgage servicing were also addressed. Today's blog will provide some of the highlights of the Bureau's findings.

Automobile Loan Servicing. In recent examinations, CFPB examiners reviewed how servicers are overseeing repossession agents and how repossessions are conducted. The Bureau's report alleges that some servicers are repossessing vehicles after the repossession was cancelled due to a formal extension agreement or the borrower has made a payment.

In these instances, the servicers wrongfully coded the account as remaining delinquent, customer service representatives did not timely cancel the repossession order after borrowers made sufficient payments or entered agreement with the servicer to avoid repossession, or repossession agents had not checked the documentation before repossessing and thus did not learn that repossession had been cancelled.

As a result of the examiner's findings, the servicers implemented a system that requires repossession agents to verify that the repossession order is still active immediately prior to repossessing the vehicle, for example, through a specially designed mobile application for that purpose.

Credit Card Account Management. The Bureau examiners noted that generally their supervised entities are complying with Federal consumer financial laws.

However, CFPB examiners observed that one or more credit card issuers violated Regulation Z by failing to provide the requisite tabular disclosures with the account opening materials provided to numerous cardholders. The entities in question acknowledged the violations with examiners and initiated a review to ensure that the errors were limited, the root causes were identified, and corrective actions were developed.

CFPB Supervision also reviewed the calls between customer service representatives and consumers. The review revealed customer service representatives routinely veering from or abandoning their scripts, which resulted in misrepresentation and higher fees for consumers. To mitigate the deceptive practice, entities established more effective controls over communications to consumers, ensured representatives informed consumers of free payment options prior to authorization of an expedited phone payment and reimbursed fees to consumers impacted by the deceptive representations about the costs and availability of pay-by-phone options.

Debt Collection. The CFPB examiners noted that some entities made false representations to consumers about the effect on their credit score of paying a debt in full rather than settling the debt for less than the full amount. As the CFPB explained in a 2013 bulletin, representations about the impact of paying a debt on a consumer's credit score may be deceptive. The bulletin states that "in light of numerous factors that influence an individual consumer's credit score, such payments may not improve the credit score of the consumer to whom the representation is being made. Consequently, debt owners or third-party debt collectors may well deceive consumers if they make representations that paying debts in collection will improve a consumer's credit score." As a result of these findings, the entities in violation amended training materials to reflect this Bureau's guidance.

Deposits. The CFPB continues to examine financial institutions for compliance with Regulation E as well as review for any unfair, deceptive, or abusive acts or practices (UDAAPs) in connection with deposit accounts.

The CFPB examiners noted that several institutions are engaged in unfair acts or practices by placing hard holds on customer accounts to stop all activity when the institutions observed suspicious activity. These holds resulted in the consumers' accounts being locked, resulting in payments not being honored, deposits being rejected, and the consumer lacking access to his or her funds for as long as two weeks. The examination also found that some institutions also failed to clearly, consistently, and promptly communicate the nature and status of these holds.

As a result, the CFPB directed the institutions to cease unnecessarily placing hard holds on consumer deposit accounts and to develop and implement policies and procedures to clearly, consistently, and promptly communicate with consumers with respect to hard holds place on their accounts.

In addition, the CFPB's Supervisory Highlights also addressed deceptive statements about overdraft protection products. Examiners identified institutions engaged in a deceptive act or practice by misrepresenting their opt-in deposit overdraft protection products when answering inbound telephone calls from consumers, including that:

• The overdraft protection product applied to check, automated clearing house (ACH), and recurring bill payment transactions;
• The overdraft protection product allowed a consumer to withdraw more money than the daily ATM cash withdrawal limit and be subjected to only one overdraft fee; and
• The overdraft protection product would take effect on the same day as enrollment.

Supervision directed the depository institutions in violation to cease misrepresenting features of their overdraft protections products.

Fair Lending. In general, the CFPB examiners found deficiencies in oversight by board and senior management, monitoring and corrective action processes, compliance audits, and oversight of third-party service providers.

The Bureau's review also revealed data quality issues, which were related to a lack of complete and accurate loan servicing records, made certain fair lending analyses difficult or impossible to perform. The examiners attributed these data quality issues to significant weaknesses in compliance management system related policies, procedures, and service provider oversight.

These are just some of the highlights from the CFPB's report. The full report is available here.

More HMDA Guidance

On September 28^th, the CFPB released HMDA implementation materials to support the recently issued 2017 HMDA rule. The Bureau has updated the 2018 Institutional Coverage Chart, the 2018 Transactional Coverage Chart and the Key Dates Timeline.

You can find the materials here on the CFPB's HMDA implementation webpage.

OFAC Requirements for Blocked Property

Written by Stephanie Lyon, Regulatory Compliance Counsel

Last Friday, the Office of Foreign Assets Control (OFAC) released a notice reminding credit unions and other financial institutions that the annual report of blocked property is due by September 30th. As the annual filing is only one of the multiple OFAC requirements for blocked property, we thought it would be helpful to break down the other steps a credit union must take to meet its regulatory requirements.

In general, OFAC regulations require that credit unions block accounts and other property as well as reject unlicensed trade and financial transactions of certain countries, entities, and individuals. See, FFIEC BSA/AML Examination Manual, pp. 147. Aside from that, you may remember that NAFCU blogged earlier this year and noted that OFAC takes a risk-based approach to compliance so credit unions will have the flexibility of determining when and how to run transaction names through OFAC lists. So what happens once the credit union identifies property subject to a blocking program?

Place Funds in Interest-Bearing Accounts

Once the credit union has determined that funds need to be blocked, the blocked property must be placed into an interest-bearing account from which only OFAC-authorized debits may be made. See, 31 C.F.R. § 515.205(a). OFAC defines an interest bearing account as "a blocked account earning interest at no less than the maximum rate payable on the shortest time deposit in the domestic bank where the account is held: Provided however, That such an account may include six-month Treasury bills or insured certificates, with a maturity not exceeding six-months, appropriate to the amounts involved." 31 C.F.R. § 515.205(g).

If the phrase "interest-bearing account" raises a red flag for federal credit unions, it is because NCUA’s Truth in Savings rule prohibits federal credit unions from offering interest-bearing deposit (as defined in in the rule) and may instead offer dividend-bearing deposit accounts. See, 12 C.F.R. § 707, Supp. I, cmt. 707.2(i)-1. 

OFAC and other Treasury regulations are written in a bank-centric manner, so sometimes the language in these regulations have inadvertent construction issues. As there is no carve-out exception for federal credit unions in the section of the regulation that requires placing blocked funds in interest-bearing accounts, many credit unions have interpreted this requirement to mean a dividend-bearing account. To clarify this requirement, NAFCU contacted OFAC's compliance helpline and they agreed with the interpretation that depositing blocked property into dividend-bearing accounts would meet the requirement. However, it would be great to see this glitch clarified by NCUA or OFAC in actual guidance documents such as the NCUA AIRES Exam Questionnaire, OFAC FAQs, or the FFIEC BSA/AML Examination Manual so that federal credit unions could feel more comfortable relying on this interpretation.

As for whether the credit union has to create individual blocked property accounts or one account for all blocked property, OFAC does not have a preference as long as the credit union maintains an audit trail that allows it to determine specific ownership interest of blocked property. See, OFAC FAQs: Sanctions Compliance, Q.32.

Initial Report

Credit unions are also required to file a report of blocked property within 10 business days from the date that property becomes blocked. The report should detail the blocked property and also include information pertaining to payments or transfers that are rejected by the credit union because of a blocked program. See, 31 C.F.R. § 501.603(b)(1)(ii). In the initial report, the credit union must also certify that the blocked funds have been deposited into a blocked account. See, 12 C.F.R. § 501.603(b)(1)(ii).

To ensure all pertinent and required information is included in the initial report, credit unions can use the form provided by OFAC and electronically transmit it to: [email protected] or mail it to: Office of Foreign Assets Control, Compliance Programs Division, U.S. Treasury Department, 1500 Pennsylvania Avenue NW.—Annex, Washington, DC 20220. Credit unions should be aware that there is a separate form for rejected transactions that follows the requirements of section 501.604.

Annual Report

Finally, OFAC requires that credit unions provide a comprehensive list of all blocked property held as of June 30 of the current year by September 30. See, 31 C.F.R. § 501.603. The term blocked property only applies to property that is blocked pursuant to OFAC regulations and does not include property that has been unblocked by general or specific license even if it has not yet been returned to the owner. This means that if the credit union unblocked property on June 29th and returned this property by July 1st, it should not include information on the unblocked property in its annual report. However, note that the regulation also establishes record keeping requirements for all blocked transactions for a period of 5 years after the date of the transaction. See, 12 C.F.R. § 501.601.

The annual reports must be filed using Form TD F 90-22.50, Annual Report of Blocked Property and the form should be sent to [email protected]. In case of additional questions, OFAC recently updated its guidance on filling out the annual blocked property report. The guidance is especially helpful for credit unions with 20 or more blocked accounts as it allows for a spreadsheet instead of a PDF or word document to complete part B of the form.

There you have it— next time you get an OFAC hit subject to a blocking order, you hopefully won't have to go through the entire bank-centric regulation to figure out OFAC's requirements.

2018 Adjusted Threshold Levels for Truth in Lending Regulations (Regulation Z)

Written by Reginald Watson, Regulatory Compliance Counsel

Greetings compliance friends! My name is Reggie Watson, and I recently joined NAFCU as a Regulatory Compliance Counsel. Prior to NAFCU, I spent 3 years investigating financial fraud matters for DOJ's civil division. I am excited to join the Regulatory Compliance family here at NAFCU and look forward to working with all of you soon!

Just recently, the Consumer Financial Protection Bureau (CFPB) issued its annual inflation-based adjustments of certain threshold dollar amounts for transactions covered under Regulation Z (which implements the Truth in Lending Act). The changes include regulations under the Credit Card Accountability Responsibility and Disclosure Act of 2009 (CARD ACT), the Home Ownership and Equity Protection Act of 1994 (HOEPA), and the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act). The Bureau is required to adjust a variety of thresholds annually for inflation. These changes are based on the annual percentage change reflected in the Consumer Price Index in effect on June 1, 2017 and will become effective on January 1, 2018.

Credit Cards

Regulation Z prohibits a card issuer from imposing a fee for violating the terms or other requirements of a credit card account under an open-end (not home-secured) plan unless the fee “represents a reasonable proportion of the total costs” incurred for the violation, or is within the safe harbor provision of 12 C.F.R. section 1026.52(b). If a credit card issuer charges anything up to the safe harbor amount for certain violations, it is considered to be in compliance with Regulation Z. The threshold that triggers requirements to disclose minimum interest charges will remain at $1.00 in 2018.

The safe harbor amounts will also remain the same as in 2017:

• $27 for a first late payment; and
• $38 for each subsequent late payment over six months.

Ability-to-Repay/Qualified Mortgage

For dollar amounts related to determining a borrower’s ability to repay a transaction secured by a dwelling, the threshold for qualified mortgages in 2018 will require that total points and fees not to exceed:

• 3 percent of the total loan amount for a loan greater or equal to $105,158;
• $3,155 for a loan amount greater or equal to $63,095 but less than $105,158;
• 5 percent of the total loan amount for a loan greater or equal to $21,032 but less than $63,095;
• $1,052 for a loan amount greater or equal to $13,145 but less than $21,032; and
• 8 percent of the total loan amount for a loan less than $13,145.

Home Ownership and Equity Protection Act (HOEPA) Loans

Regulation Z sets additional requirements for high-cost mortgages. To be considered a high-cost mortgage, the transaction must be secured by the consumer’s principal dwelling and the APR and loan amount have to be over a certain threshold. For 2018, the total loan amount threshold will be increased to $21,032 and the adjusted points and fees must exceed 5% of the total loan amount. See, 12 C.F.R. § 1026.32(a)(ii). Loans below $21,032 will also be considered a high-cost transaction if the points and fees exceed the lesser of 8% of the total loan amount or $1,052.

For more information on Regulation Z's 2018 adjusted thresholds, see the CFPB's proposed rule in the Federal Register or their press release.

***

Free Webcast!

Equifax Data Breach: Your Vital Next Steps

Thursday, September 28 | 2:00 p.m. – 3:30 p.m. ET

Join NAFCU staff and Reed & Jolly attorney David Reed for this week's free webcast. You'll receive the essential information you need to prepare your credit union for the data breach aftermath.

Key Takeaways:

• Learn the steps to take to ensure your credit union isn't a victim of fraud
• Discover what programs to put in place to assist your members
• Understand how to do your due diligence when using Equifax in the future
• Know what you’re liable for, and how to ensure you have the appropriate coverage for any fraud claims
  

Treasury Addresses Housing Finance Reform at NAFCU's Congressional Caucus

Written by Ann Kossachev, Regulatory Affairs Counsel

Hi everybody! It's been a while, but I am glad to be back on the NAFCU Compliance Blog. I'm also eagerly awaiting my upcoming vacation because it has been busy here the past couple of weeks. As you all know, last week was NAFCU's Congressional Caucus. It was a huge success! Today, I want to discuss something one of the speakers talked about – the future of the government-sponsored enterprises (GSEs), Fannie Mae and Freddie Mac, and housing finance reform. Craig Phillips, Counselor to Treasury Secretary Steven Mnuchin, updated Caucus attendees on the Trump Administration's position and said that the goal is to work with Congress to craft legislation for comprehensive housing finance reform.

Most importantly, Mr. Phillips endorsed NAFCU's interest in and advocacy on housing finance reform. Mr. Phillips said the administration supports a level playing field on pricing and terms regardless of an institution's size and geographic location. This has always been one of NAFCU's primary positions and goals for housing finance reform. NAFCU is very pleased to have the support and endorsement of Mr. Phillips on this important principle and is optimistic that the current administration is on the side of credit unions in this debate.

As he outlined the administration's focus, Mr. Phillips acknowledged the important work credit unions do in their communities. Credit unions have a track record of serving their members by providing high quality mortgage products and services at fair prices. An essential component of credit unions' continued ability to provide such products and services is a steady and reliable source of liquidity through the secondary market, especially through products such as the 30-year, fixed rate mortgage. That's where the GSEs come in. Mr. Phillips said that the administration is committed to achieving long-term, sustainable housing finance reform, which includes:

(1) Removing the GSEs from conservatorship;

(2) Rationalizing the roles of all federal mortgage insurance and guarantee programs (FHA, VA, and USDA) and the mortgage-backed securities (MBS) programs of Fannie Mae, Freddie Mac, and Ginnie Mae; and

(3) Encouraging a vibrant role in the private sector, in part through more tailored regulations which allow bank and non-bank lenders to increase their share of originations.

The GSEs have been in conservatorship for nine years now and have consistently been profitable. All of those profits, however, have been sent to the Treasury Department on a quarterly basis as part of the terms of the government's bailout of the GSEs, based on the rationale of protecting taxpayers. Since the Treasury's initial advance of $187.5 billion to the two companies, both Fannie and Freddie have paid back that money and then some – an additional $83.4 billion to be exact. If another financial crisis strikes and the GSEs still do not have capital reserves, the GSEs could be forced to draw on their Treasury line of credit, at taxpayers' expense. These are the reasons why NAFCU supports allowing the GSEs to begin recapitalizing.

Although Secretary Mnuchin has publicly said that he expects the GSEs to continue to make their dividend payments to the Treasury, FHFA Director Mel Watt has indicated that he is very concerned by the GSEs' lack of capital and the risk it poses to the economy. Allowing the GSEs to rebuild their capital buffers would ensure a more safe and sound economic system, increase investor confidence, and prevent market disruption. This would, in turn, likely mean increased liquidity in the housing finance system. That means more opportunities for credit unions and greater access to the secondary market. NAFCU hopes that Mr. Phillips' endorsement of NAFCU's advocacy on housing finance means that the administration is considering the option of GSE recapitalization.

During his speech, Mr. Phillips also said that Treasury supports the GSEs' release from conservatorship as part of comprehensive housing reform legislation. This is another position NAFCU supports; although NAFCU further believes that any privatization efforts should be gradual to ensure credit unions have uninterrupted access to the secondary mortgage market. Mr. Phillips acknowledged that minimizing the transition is critically important to maintaining a stable market.

In addition, Mr. Phillips said that protecting the interest of taxpayers is critical. He pointed out that part of this mission includes considering an explicit government guarantee for federally-sponsored MBS and adequate protections to make such a guarantee feasible. Yet another position NAFCU supports. An explicit government guarantee on the payment of principal and interest on MBS injects certainty into the market, particularly for investors, and allows for the more consistent movement of liquidity through the mortgage market.

Credit unions provide high quality mortgage products to help their members achieve their dreams of homeownership but cannot continue to do so without guaranteed access to the secondary market. This requires a safe and stable housing finance system. NAFCU is encouraged by Treasury's approach to housing finance reform, as outlined in Mr. Phillips' speech. NAFCU is thankful for Mr. Phillips' support of our interest in reforming the system and is looking forward to collaborating with the administration and Congress to find a solution for our nation's housing finance system. If you are interested in finding out more about NAFCU's position on housing finance reform, please review NAFCU's Housing Finance Reform Principles.

I Am the Very Model of a Modern Arbitration Clause

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

Happy Wednesday, Credit Union Compliance World. As you know, on July 10^th, the CFPB finalized its rule on arbitration agreements. We blogged about the basics of the rule and the epic hero's journey that is trying to identify its scope. On Monday, thankfully, the CFPB released its Small Entity Compliance Guide regarding the final arbitration rule. While the amount of footnotes involved in discussing the scope should be a clue to the Bureau that the rule is painfully technical, it is nice to have a version written in Standard American English.

Thanks to the Equifax breach and the breathtaking cascade of bungled responses in its aftermath, arbitration provisions are back in the limelight. If your credit union is seeking to help assist members affected by the breach, visit NAFCU's Equifax Data Breach Resources webpage. If you're angry, know that your feelings are valid and shared. We've written to Congress, the CFPB, the FTC and NCUA to ask them to take action to protect credit unions and their members. In the meantime, perhaps this is a good time to take a deeper look at the arbitration rule's language requirements.

From Agreements to Delegates, In Order Categorical

NAFCU has gotten a few questions about when it is appropriate to use the nine different model clauses included in the rule. Below is a breakdown of the various clauses in the rule and when and how they can be used.

Firstly, all Pre-Dispute Arbitration Agreements entered into on or after March 19, 2018 must include one of two alternative clauses for the agreement:

Citation	Language	When Required
§ 1040.4(a)(2)(i)	“We agree that neither we nor anyone else will rely on this agreement to stop you from being part of a class action case in court. You may file a class action in court or you may be a member of a class action filed by someone else.”	Generally, unless other language is applicable.
§ 1040.4(a)(2)(ii)	“We are providing you with more than one product or service, only some of which are covered by the Arbitration Agreements Rule issued by the Consumer Financial Protection Bureau. The following provision applies only to class action claims concerning the products or services covered by that Rule: We agree that neither we nor anyone else will rely on this agreement to stop you from being part of a class action case in court. You may file a class action in court or you may be a member of a class action filed by someone else.”	Can be used at the credit union's option as an alternative to the generally required language when the agreement applies to multiple products or services, only some of which are covered under Part 1040.

In addition to the required clauses discussed above, the Bureau has also identified several optional, add-on clauses:

Citation	Language	When Required
§ 1040.4(a)(2)(iv)(A)(1)	“This provision does not apply to parties that entered into this agreement before March 19, 2018.”	Optional add-on to the above agreement clauses
§ 1040.4(a)(2)(iv)(A)(2)	“This provision does not apply to products or services first provided to you before March 19, 2018 that are subject to an arbitration agreement entered into before that date.”	Optional add-on to the above agreement clauses
§ 1040.4(a)(2)(iv)(B)	“This provision does not apply to persons that are excluded from the Consumer Financial Protection Bureau's Arbitration Agreements Rule.”	Optional add-on to the above agreement clauses

Finally, there are two add-on clauses for specific issues:

Citation	Language	When Required
§ 1040.4(a)(2)(iv)(B)	“This provision also applies to the delegation provision.”	For agreements that contain a delegation provision, the required clause must be included in each delegation provision. Alternatively, credit unions can add this language to the generally required clause to meet that requirement.
§ 1040.4(a)(2)(vi)	“However, the defendants in the class action may claim they cannot be sued due to their sovereign immunity. This provision does not create or waive any such immunity.”	Add-on language applicable for an entity that believes it has sovereign immunity from suit.

However, suppose a loan is originated by another lender after March 19, 2018, and the loan agreement includes a Pre-Dispute Arbitration Agreement, but it does not include either of the above required clauses. Perhaps the originating lender was exempt.

Imagine that then, a credit union purchases the loan and steps into the shoes of the original lender with regard to the agreement. When the credit union becomes a party to the agreement established on or after March 19, 2018, and the agreement does not contain either of the required clauses, the Bureau requires the credit union to either amend the agreement to add the above clause or to provide the consumer with a written notice within 60 days. If a credit union opts to send the written notice, it must contain the below model language:

Citation	Language	When Required
§ 1040.4(a)(2)(iii)	“We agree not to rely on any pre-dispute arbitration agreement to stop you from being part of a class action case in court. You may file a class action in court or you may be a member of a class action filed by someone else.”	Written notice language applicable when the agreement only applies to covered products and services.
§ 1040.4(a)(2)(iii)	“This notice applies only to class action claims concerning the products or services covered by the Arbitration Agreements Rule issued by the Consumer Financial Protection Bureau.”	Written notice language applicable when the agreement applies to some products, only some of which are covered under Part 1040.

The final rule and the commentary allow for few other changes; it discusses replacing pronouns and putting it into the same language as the rest of the agreement.

Hope springs eternal that Congress might take action to lift the regulatory burden of this rule with legislation. However, for those of you who are former scouts, you know it's wise to always be prepared. NAFCU members who have questions as they absorb this rule's implications can feel free to reach out to your NAFCU Regulatory Compliance Team.

CFPB Issues First No-Action Letter Under Project Catalyst

Written by Pamela Yu, Special Counsel for Compliance and Research

Last week, the CFPB announced the issuance of a no-action letter to Upstart Network, Inc., its first under the Bureau's Project Catalyst initiative.  The initiative, which launched in 2012, is intended to encourage consumer-friendly innovation in the financial marketplace. To do this, Project Catalyst is tasked with engaging with the innovator community, participating in initiatives that inform its policy work, and monitoring emerging trends in order to remain forward-looking. 

CFPB's Policy Statement on No-Action Letters

Under the Project Catalyst initiative, the CFPB in 2016 finalized a policy statement on no-action letters to reduce potential regulatory uncertainty and enhance compliance in specific circumstances where "a product holds the promise for significant consumer benefit and where there may be uncertainty around how the product fits within an existing regulatory scheme."  For example, the CFPB said the formal no-action policy could be appropriate for new products being developed by innovators in financial technology (fintech) or other startups that involve ground-breaking technology that did not exist, and thus wasn't contemplated, when existing regulations were first adopted.

The Bureau issued the policy statement on no-action letters under its authority in §1021 of the Dodd-Frank Act, which empowers the CFPB to exercise its authorities for the purpose of ensuring that markets for consumer financial products and services operate transparently and efficiently to facilitate access and innovation.  See, 12 U.S.C. 5512(b)(1). 

The no-action policy was designed to foster innovation by enhancing compliance with existing federal consumer financial law and regulation.  Essentially, the policy allows a fintech or other financial startup to seek a statement, or a "no-action letter," from the CFPB advising it that the Bureau has no present intention to recommend an enforcement or supervisory action against the entity for its new product or innovation.  Thus, fintechs concerned about running afoul of federal regulation can have the reassurance of knowing that they can bring a new product or service to market without worrying about whether the CFPB will be coming after them for a regulatory violation. 

Critics of the policy pointed out that a no-action letter would, in practice, offer little reassurance to innovators.  This is because the CFPB's no-action letters are merely a public declaration that the Bureau does not, at present, intend to pursue an enforcement action against a specific financial product or new innovation.  But, no-action letters are fact-specific, revocable at any time, and do not foreclose private enforcement or enforcement by any other regulator (such as NCUA).  In short, no-action letters are non-binding, non-enforceable, non-transferrable, and offer only limited protection to financial innovators.  The policy's clear shortcomings led some members of Congress to declare the no-action policy, and Project Catalyst as a whole, a "flop" (even after the CFPB released its optimistic Project Catalyst Innovation Highlights Report in October 2016).

Yet lo and behold, more than a year and a half after the CFPB announced its no-action policy, the Bureau has finally issued its first no-action letter under the Project Catalyst initiative.

Upstart Network, Inc. No-Action Letter

According to the CFPB's press release, Upstart Network, Inc. is a California-based online lending platform that evaluates consumer applications for personal loans like student loans, credit card refinancing, and debt consolidation, using traditional underwriting factors (e.g., credit score and income), as well as non-traditional information or alternative data (e.g., education and employment history). 

The brief no-action letter simply indicates that CFPB staff has "no present intent to recommend initiation of supervisory or enforcement action against Upstart with respect to the Equal Credit Opportunity Act" for Upstart's model for underwriting and pricing applicants.  Importantly, the letter clearly states that it is fact-specific and does not serve as a general endorsement of the use of any particular underwriting variables or modeling.  Also, the no-action letter is only temporary; it must be renewed after three years.  Keep in mind that the CFPB will likely be under different leadership by that time, which means there is the potential that, in just a few short years, Upstart could very well find itself in regulatory hot water after investing in technology and developing a platform that has been in the market only three years.  Very little reassurance, indeed…

As a condition to the no-action letter, Upstart has agreed to share information with the CFPB; the Bureau is hoping to learn more about alternative data sources to help "credit invisible" consumers, or those with a lack of credit history, gain greater access to credit.

I will be curious to see if, after a slow start, more financial innovators will participate in the CFPB's Project Catalyst initiative, and whether the CFPB will be issuing more no-action letters in the near-term.  The new administration has been vocal in its support for market innovation and economic growth and it will be interesting to see whether the issuance of its first no-action letter signals a shift in how the Bureau is doing things under this administration.  Stay tuned.

After the Equifax Epic Data Breach Fail - What Next?

Written by Shari R. Pogach, Regulatory Paralegal

One would have to have been hiding under a rock not to have heard about the massive Equifax data breach.  The credit reporting agency announced last week that a web application flaw exposed 143 million consumer records to hackers including credit card numbers for 209,000 U.S. consumers and what it described as "dispute documents" containing personal information for 182,000 U.S. consumers.   Equifax stated it discovered the intrusion on July 29.  On top of that, three senior executives sold shares worth almost $1.8 million in the days after the discovery on August 1 and August 2, although Equifax indicated the executives "had no knowledge that an intrusion had occurred at the time they sold their shares."  Equifax's response in responding to the situation fell short of expectations.

 

So what can a credit union do?  

There is no technical federal regulatory requirement for a credit union to notify its members or NCUA of a third party data breach.  A credit union is only required to notify members and NCUA when there has been a direct data breach of the credit union's system maintained by it or its third-party service provider.  That being said, member notification, in any data breach context, may help to mitigate against the risk of fraudulent or unauthorized transactions.  A credit union might also review any contractual agreements with Equifax to see whether and how this situation (arguably, this eventuality) was addressed and whether there are any contractual obligations for either party.

A credit union with a relationship with Equifax could conduct a vendor review if it believes it is appropriate, and question the security surrounding sharing and connections with outside parties. NCUA's Letter to Credit Unions 07-CU-13 and the enclosed Supervisory Letter No. 07-01 might be helpful, as would the Oversight of Third-Party Service Providers section of the Information Security booklet of the Federal Financial Institutions Examination Council's IT Examination Handbook.

What about helping credit union members?

How an individual credit union chooses to serve its members within this context is a business decision.   But a credit union can always provide members with resources such as:

• Equifax's  notification of the breach webpage, including identity theft prevention tips and regulatory contact information;
• Equifax's check for potential impact webpage;
• Equifax's enrollment for credit protection webpage – (note Equifax has backtracked its conditioning of credit protection services on arbitration agreements.);
• Equifax's FAQs on the breach;
• FTC's The Equifax Data Breach: What to Do webpage;
• Krebs on Security – The Equifax Breach: What You Should Know;
• IdentityTheft.gov provides consumer-facing guidance specific to the Equifax breach and specific to the information lost;
• CFPB blog post Identity theft protection following the Equifax data breach;
• MoneyWatch – Equifax data breach: How to protect your credit rating; and
• Members can be reminded of their ability to access their credit reports at AnnualCreditReport.com.

The scale of this breach means that every Social Security Number in the U.S. in conjunction with the associated name must be presumed to be public knowledge.  As a result, security experts are saying a Social Security Number should no longer be used to validate anyone's identity.  In addition it was reported yesterday, Visa and MasterCard are sending confidential alerts to financial institutions across the U.S. this week, warning that more than 200,000 credit cards were stolen from Equifax.  The data was downloaded in "one fell swoop" in mid-May 2017 and the “window of exposure” for the stolen cards was between November 10, 2016, and July 6, 2017.  The breach also impacted an undisclosed number of people in Canada and the United Kingdom but the official list of victim countries may not yet be complete.

The Equifax data breach has already led to the filing of more than 30 lawsuits seeking class-action status. One suit, filed in Portland, Oregon, is demanding up to $70 billion in damages.  Equifax executives can also expect to appear before Congress as a result of the breach.

***

Upcoming NAFCU webcasts:

Regulatory Orders: Getting Out and Staying Out

Tuesday, September 19 | 2:00 p.m. – 3:30 p.m. ET

Achieving Excellence in Consumer Reporting Compliance

Tuesday, September 26 | 2:00 p.m. – 3:30 p.m. ET

How to Detect and Prevent Employee Fraud

Tuesday, October 24 | 2:00 p.m. – 3:30 p.m. ET

CFPB Cracks Down on FCRA Violations

Written by Jennifer Aguilar, Regulatory Compliance Counsel

Last month, the CFPB fined JPMorgan Chase (JPMorgan) $4.6 million for various alleged violations of the FCRA. According to the consent order, the CFPB found that JPMorgan failed to have reasonable policies and procedures in place to ensure it provided accurate information to consumer reporting agencies, failed to inform consumers of the results of dispute investigations and failed to identify the consumer reporting agency on adverse action notices.

Policies and Procedures. The FCRA does not require financial institutions to provide information to consumer reporting agencies. However, if a financial institution elects to do so, the FCRA requires it to provide accurate information. Regulation V requires these financial institutions to have reasonable policies and procedures in place to ensure that information provided to consumer reporting agencies is accurate. The procedures should be designed based on the institution's complexity and scope of activities and updated periodically. The rule also requires institutions to consider the interagency guidelines in developing their policies.

While JP Morgan had policies in place, the CFPB found that these policies were insufficient to ensure it provided accurate information to consumer reporting agencies. The policies did not contain procedures for providing information to consumer reporting agencies and did not address quality assurance, systems testing or training. The policies were also not materially altered or revised anytime between 2005 and 2014. In addition to these specific deficiencies, the CFPB determined that the policies were not appropriate given the size and complexity of JPMorgan's operations. The consent order requires JPMorgan to implement and maintain reasonable policies and procedures that fully comply with the FCRA's requirements and adequately incorporate Regulation V's guidance.

The policies at issue related to the information JPMorgan provided to consumer reporting agencies about its deposit accounts. While the consent order does not attempt to determine whether JPMorgan was providing information to a party it believed was not a consumer reporting agency under the FCRA, it may be helpful to pause for a moment and review exactly who is a consumer reporting agency. The FCRA defines "consumer reporting agency" rather broadly:

"(f) The term “consumer reporting agency” means any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports."

While this certainly covers the big three credit reporting agencies – Transunion, Equifax and Experian – it is important to keep in mind that this also covers a variety of other agencies that may be collecting information other than credit information. Consumer reporting agencies also include "specialty" agencies that collection information regarding medical records or payments, residential history, check writing history, employment history and insurance claims. When reviewing or drafting your policies and procedures on providing information to consumer reporting agencies, remember they may need to cover more than just credit information.

Dispute Investigations. Both the FCRA and Regulation V have specific procedures financial institutions must follow when they receive a direct dispute from consumers regarding the accuracy of information contained in a consumer report. The rules require institutions to conduct a reasonable investigation within 30 days of receiving the dispute, inform the consumer of the results of the investigation and provide each consumer reporting agency with corrected information, if necessary. The CFPB determined that JPMorgan had received thousands of direct disputes between 2010 and 2014 and that JPMorgan failed to provide any notice to these consumers regarding the results of the investigation. Going forward, the consent order requires JPMorgan to inform consumers about the results of all dispute investigations.

Adverse Action Notices. If a financial institution bases any adverse action on information obtained in a credit report, the FCRA requires the institution to provide an adverse action notice. The notice must include the adverse action taken; the credit score disclosure; the name, address and telephone number of the consumer reporting agency that provided the consumer report; a statement that the consumer reporting agency did not make the adverse action decision and inform the consumer of his or her right to obtain a copy of the consumer report. The CFPB found that JPMorgan failed to include the name, address and telephone number of the consumer reporting agency on approximately 17,500 adverse action notices. The notices were later corrected, however, the consent order requires JPMorgan to provide this information on all future adverse action notices.

MLA and Prescreened Offers of Credit; Caucus Kickoff

Written by Brandy Bruyere, VP of Regulatory Compliance

Many credit unions use prescreened offers of credit and similar promotions to market products, especially credit cards. With the upcoming Military Lending Act compliance deadline for credit card products, credit unions have asked how the MLA impacts these kinds of offers, particularly for obtaining a safe harbor for covered borrower status.  The MLA addresses the issue, providing a longer timeframe for "firm offers of credit" such as those provided as part of prescreening programs. Specifically, 32 CFR 232.5(b)(3)(iii) indicates that a covered borrower check performed as part of a prescreened offer of credit would be within the safe harbor if the “consumer responds to that offer not later than 60 days after the time that the creditor had provided that offer to the consumer”.  Note that this 60 day timeframe is from when the offer is provided to the member rather than when the credit union performed the “covered borrower check," here's the relevant provision:

(3) Determination and recordkeeping; one-time determination permitted. A creditor who makes a determination regarding the status of a consumer by using one or both of the methods set forth in paragraph (b)(2) of this section shall be deemed to be conclusive with respect to that transaction or account involving consumer credit between the creditor and that consumer, so long as that creditor timely creates and thereafter maintains a record of the information so obtained. A creditor may make the determination described in this paragraph (b), and keep the record of that information obtained at that time, solely at the time—

[…]

(iii) The creditor develops or processes, with respect to a consumer, a firm offer of credit that (among the criteria used by the creditor for the offer) includes the status of the consumer as a covered borrower, so long as the consumer responds to that offer not later than 60 days after the time that the creditor had provided that offer to the consumer. If the consumer responds to the creditor's offer later than 60 days after the time that the creditor had provided that offer to the consumer, then the creditor may not rely upon its initial determination in developing or processing that offer, and, instead, may act on the consumer's response as if the consumer is initiating the transaction or applying to establish the account (as described in paragraph (b)(3)(i) or (ii) of this section). (Emphasis added.)

The preamble to the final rule contains a further discussion of the prescreened timing:

The Department has designed § 232.5(b)(3) in order to enable a creditor to conduct only one covered-borrower check within the permitted safe harbor at an early stage of the transaction or the relationship with the consumer, including at the time that the creditor develops a firm offer of credit to be provided to the consumer. However, in the scenario which describes what is commonly referred to as a “prescreened” offer of credit (set forth in § 232.5(b)(3)(iii)), the Department has placed a limitation on the amount of time that may lapse between the creditor's delivery of the prescreened offer and the creditor's reliance on its covered-borrower check that formed part of the basis of the offer. The Department believes that there will be many cases when a consumer who is not a covered borrower at the time that a creditor delivers its prescreened offer (which offer is predicated, in part, on that criterion) later responds to that offer, including after becoming a covered borrower…Accordingly, § 232.5(b)(3)(iii) provides that creditor may rely on its initial covered-borrower check so long as the consumer responds to that offer not later than 60 days after the date that the creditor had provided that offer to the consumer. If the consumer responds to the creditor's offer later than 60 days after the date that the creditor had provided that offer to the consumer, then the creditor may not rely upon its initial determination in developing that offer; instead, the creditor may (but still is not required to) act on the consumer's response as if the consumer is initiating the transaction or applying to establish the account... (Emphasis added.)

http://www.federalregister.gov/a/2015-17480/p-428

But what does it mean to "provide" the offer to the member? Is it the day the credit union places the offer in the mail? Or the day the member receives the offer? The MLA is not clear on this point, so some credit unions opt to take a conservative approach and calculate the 60 day window from when the offer is mailed.

Credit unions have also asked about preapproval or prequalification promotions. Note that the carve out is specifically for "firm offers of credit" – and the MLA does not define this term. Of course, "firm offer of credit" is a defined term under the Fair Credit Reporting Act, but this is not cross-applied by the MLA. However, the MLA preamble does reference "prescreened" offers, so the FCRA meaning may at least help when determining the scope of the MLA safe harbor in these cases. Also, the way the provision is written hints at the FCRA prescreen rules, describing offers that are "developed" using certain "criteria." Credit unions will need to determine which promotions are "firm offers of credit" where the covered borrower check would provide a safe harbor for up to 60 days after providing the offer.

***

Caucus Kickoff. NAFCU's Congressional Caucus starts today. Hundreds of credit union representatives will attend meetings with members of Congress and their staff to advocate on key issues, including regulatory relief. NAFCU also continues to advocate on important issues like the MLA in our constant efforts to create a better environment for credit unions. You can also participate by joining our Thunderclap campaign now to make "protect credit unions" a message that thunders across social media on September 12. By calling on Congress to help protect credit unions, you're ultimately calling on Congress to help America. For information on how your credit union can participate in these kinds of advocacy efforts, check out our Grassroots Action Center.

ADA Compliance: What's the deal with websites?

Written by: André B. Cotten, Regulatory Compliance Counsel

Hello, compliance friends! The NAFCU Compliance Team has recently noticed an increase in questions related to potential Americans with Disabilities Act (ADA) website requirements. Credit unions are always eager to help their members, and we've had many credit unions asking about the status of ADA regulations, especially for websites. Today's blog post is meant to provide a very high-level overview of the statutory framework, rulemaking and enforcement activity, and potential for litigation with regard to ADA website compliance.

How the ADA Applies to Credit Unions

Generally, the ADA is intended "to provide a clear and comprehensive national mandate for the elimination of discrimination against individuals with disabilities" and "to provide clear, strong, consistent enforceable standards" addressing such discrimination. See, 42 U.S.C. § 12101(b). The ADA is a complex, fact-specific area of law, and some states have their own statutes addressing similar issues, so consulting with counsel may be necessary to fully assess ADA legal issues and risks. One way the ADA applies to credit unions is through Title III of the Act, which sets standards for certain "public accommodations." Public accommodations include banks and other "service establishments," so these provisions have been interpreted to apply to credit unions. As a result, the ADA requires credit unions to meet standards for "newly constructed or altered places" and has wide-ranging implications that impact how to communicate with persons with disabilities, which ultimately impacts the issue of website accessibility.

ADA discrimination is broadly defined by five categories. The one most applicable to websites is a provision that prohibits excluding, denying services or treating members with disabilities differently because of a lack of "auxiliary aids and services." This generally involves accommodations for persons with vision and hearing related disabilities, providing aids and services like closed-captions, interpreters, Braille materials and similar tools.

There are exceptions such as if the credit union can show that offering services with auxiliary aids and services would fundamentally change the nature of the services, or providing an auxiliary aid would cause an "undue burden." However, these exceptions are generally interpreted narrowly. Overall, the definition of discrimination is highly technical and includes several legal terms of art that are somewhat clarified in the Department of Justice ADA regulations.  

Possible Litigation Risk

ADA website accessibility can present some litigation risk for businesses that are public accommodations, including credit unions. One way a credit union can run afoul of the ADA is by not taking the steps in regulations that address when "auxiliary aids and services" may be necessary to meet objectives like effective communication with individuals with disabilities.

An important question in assessing the risk involved in these issues is what are the possible penalties and damages for ADA violations that may stem from litigation. The ADA permits the DOJ to assess civil penalties, which are currently up to $75,000 for the first ADA violation, and up to $150,000 for additional violations. The ADA and its regulations do not authorize statutory penalties for plaintiffs. However, a court can force a business to meet accessibility standards as part of a private lawsuit and award plaintiffs their attorney's fees, costs and expenses in a suit. Additionally, litigation risk can stem from state statutes. Overall, the rise in litigation is a continuing trend that is in part influenced by the DOJ's previous rulemaking and enforcement activity.

Rulemaking Efforts and Enforcement

In 2010, the DOJ issued an advanced notice of proposed rulemaking (ANPR) aimed at starting the process for adopting formal standards for website accessibility. While acknowledging that neither the Act nor existing regulations "specifically address access to websites," the DOJ indicated its position that the ADA is broad enough to apply to websites.

After collecting information in 2010, the DOJ did not take further rulemaking action that would impose a clear standard for credit unions to follow with regard to website accessibility for persons with disabilities.

In regards to enforcement actions, during the Obama Administration, the DOJ intervened in private lawsuits on the issue of website accessibility, taking the same position set forth in the 2010 ANPR, which is the ADA is broad enough to apply to the websites of public accommodations like credit unions.

For example, on May 31, 2011, the DOJ entered into a settlement agreement with Wells Fargo, indicating that discrimination includes the failure to "provid[e] a website that is accessible to individuals with disabilities, including blind individuals who use screen readers to access web content that is visual and providing captions for deaf individuals . . ." While Wells Fargo committed to making its website more accessible as part of the settlement, the DOJ did not require specific standards to be followed.

In later cases, such as a consent decree with H&R Block in 2014, the DOJ went a bit further than in the Wells Fargo case and actually required H&R Block to commit to following a specific standard in making its website accessible that is known as the Web Content Accessibility Guidelines 2.0 Level A and AA. These are voluntary standards with a dozen separate components. The DOJ also required H&R Block to make not only its website accessible, but its mobile applications as well. Despite not adopting a formal website accessibility standard, the DOJ continued to require this standard in its enforcement actions.

Currently, the Title III rulemaking has been listed as "inactive" on the DOJ's most recent rulemaking agenda. It also appears that formalizing this rule is not a priority for the Trump administration, and it is unclear how the current administration will address these issues from an enforcement perspective. However, the risk for credit unions from private litigations remains active.

Conclusion

Moving forward, a credit union may need to consult with its local counsel to discuss the trends in jurisdictions where it operates relating to potential demand letters and lawsuit activities. Some credit unions may also consider adopting accessibility measures based on the potential litigation and reputation risks. There are also consultants that work to make websites accessible for persons with disabilities and perform ongoing work for changes in content over time which comes with various upfront and continuing expenses.

For further information, please see the March 2017 Monitor Compliance Article written by the VP of Regulatory Compliance, Brandy Bruyere.

 

Regulation E Lesser Known ODP and Compulsory Use Provisions

Written by Stephanie Lyon, Regulatory Compliance Counsel

The compliance team has seen a recent upsurge in Regulation E questions regarding same account terms and conditions for non-overdraft program users and automatic loan repayment requirements so we thought it would be useful to round them up in this blog.

Overdraft Program- Different Terms

We have written many blogs on the requirements of overdraft programs (ODP)—a quick recap is that credit unions must provide appropriate disclosures and obtain a member's opt-in before charging a fee for paying overdrafts for one-time debit card and ATM transactions. A question we often get regarding overdraft programs is whether the credit union can refuse to provide a debit card if a member chooses not to opt in to the overdraft program for one-time debit card and ATM transactions. This is a popular question as transactions made while the system is offline or those that place a hold will be processed regardless of whether the member's account will be overdrawn. So members that have not opted in to the credit union's ODP will benefit from having their overdrafts paid without incurring a fee, while the credit union will be on the hook for collecting the overdraft funds or eat the loss. Unfortunately this may be another one of those 'cost of doing business' issues Regulation E's consumer protections have created.

Section 1005.17(b)(3) of the regulation states that credit unions must provide the same account terms, conditions and features for members who opt in to the credit union's ODP as those who do not. This means that regardless of whether or not Member A opts in, they should have access to the same type of account as Member B who did opt in to ODP. So if the only reason the credit union does not want to offer ATM/debit cards to Member A is because of their opt-out status, the credit union could be running afoul of Regulation E as it may be considered to be offering different account terms on the basis of ODP opt-in/out status. The official interpretations to this section of the regulation gives more insight into what other things the credit union may not do, such as imposing different minimum balance requirements or account fees or offering account services such as bill pay only to those that have opted in.

A variation of this question is whether the credit union can take away a member's debit/ATM card because the member overdrafted their account and refused to opt in to the credit union's ODP. While this is not one of the examples used in the commentary of the rule as a prohibited practice, it still seems to fit within the above analysis in that taking away a member's card for not opting in could be considered offering different account services. See, 12 C.F.R. § 1005.17(b)(3).

Something to consider for excessive overdraft users is that credit unions are not obligated to pay any transactions that would overdraw a member's accounts, regardless of whether the member has opted in or not. So the credit union may want to look at declining one-time debit card and ATM transactions when possible, instead of allowing transactions that overdraw accounts for those members that have not opted-in.

Also, for members that have caused the credit union a loss, the credit union may be able to remove the member's debit card or share checking account privileges through a limitation or suspension of services policy. For more details of limitation or suspension of services, see this blog or this member-only article. However, it is important to understand that taking away debit card/share checking account privileges would not be because the member did not opt-in to the credit union's ODP, but because the member has abused their account through excessive overdrafts or created a loss to the credit union. Credit unions considering this option may want to set up a procedure that addresses members who constantly overdraft their accounts, have cause the credit union a loss or stay overdrawn for a longer time than acceptable to the credit union;  it is also important to apply the consequences uniformly to all members. Otherwise, the credit union may fall under the prohibition of giving members different account terms, conditions and features because of overdraft opt-in choices.

Automatic Loan Repayment- Compulsory Use

To make it easier for members, some credit unions offer to set up a member's account to automatically make biweekly, monthly or other payments to meet a borrower's loan repayment obligations. However, credit unions that offer these automatic repayment services should be aware that Regulation E, section 1005.10(e)(1) generally restricts offering extensions of credit conditioned on automatic repayments of the loan, specifically automatic payments that are preauthorized electronic funds transfers—this is what is referred to as compulsory use.

Regulation E does permit credit unions to offer incentives to members, such as a lower APR, if the member chooses to set-up automatic, recurring payments. The official interpretation to this section provides further clarification regarding this prohibition and permissible incentives. Here is a relevant excerpt:

Loan payments. Creditors may not require repayment of loans by electronic means on a preauthorized, recurring basis. A creditor may offer a program with a reduced annual percentage rate or other cost-related incentive for an automatic repayment feature, provided the program with the automatic payment feature is not the only loan program offered by the creditor for the type of credit involved.

12 C.F.R. § 1005, Supp. I, cmt. 1005.10(e)(1)-1.  So while voluntary agreements to make reoccurring automatic payments are permissible, mandatory ones are not.

***

Don't Miss Our Upcoming Webcasts:

BSA/AML Risk Assessment: Building a Program to Evaluate Risk and Ensure Compliance
Tuesday, September 12 | 2:00 p.m. – 3:30 p.m. ET 

Vendor Management Training
Wednesday, September 13 | 2:00 p.m. – 3:30 p.m. ET

Regulatory Orders: Getting Out and Staying Out

Tuesday, September 19 | 2:00 p.m. – 3:30 p.m. ET

Resources for Credit Unions Affected by Hurricane Harvey; Programming Note

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

The destruction caused by Hurricane Harvey in Texas, Louisiana and other places in the southeast is heart-breaking. The rain may have stopped over Houston, but the flooding continues to pose a real and active threat to the lives and livelihoods of those in and around the city. Our thoughts and prayers are with those in the hurricane's path and suffering in its aftermath. If you would like an opportunity to help communities affected by Hurricane Harvey by helping the credit unions that serve those communities, join me in donating to CUAid.coop.

Resources for Credit Unions Affected by the Hurricane

Disaster Assistance

The President has issued a disaster declaration, so disaster assistance is available for credit unions. NCUA issued a press release describing some available resources for affected credit unions including guaranteeing lines of credit for credit unions through the NCUSIF, making liquidity loans through the CLF, and rescheduling examinations to affected credit unions. Credit unions in Texas wanting to access these resources can contact the Region IV office in Austin at (512) 342-5600 (open Monday-Friday, 7am-5pm Central). Credit unions in Louisiana can contact the Region III office in Atlanta at (678) 443-3000 (open Monday-Friday, 7am-5pm Eastern).

NCUA’s Office of Small Credit Union Initiatives can provide urgent need grants of up to $7,500 to low-income credit unions that experience sudden costs to restore operations interrupted by the storm.

Grants from the National Credit Union Foundation's CUAid relief system are also available. Credit unions can apply for a Disaster Emergency Relief Grant through the Cornerstone Credit Union League here.

Credit unions that offer small business loans through the SBA may be interested in the Administration's Disaster Loan Program. The SBA's Hurricane Harvey Recovery website includes information about the SBA disaster assistance program and available 12-month payment deferments for borrowers in hurricane affected areas.

Reporting Closures and Damage

Section 748.1(b) of NCUA's rules and regulations does require all federally-insured credit unions to notify their regional director within 5 business days of any disaster which results in the physical destruction or damage to the credit union causing an interruption in vital member services, if the interruption is projected to last more than two consecutive business days.

Within a reasonable time afterwards, section 748.1(b) requires that credit unions make a report of the incident, filed in its main office, that records the office/s where the disaster occurred, when it took place, the amount of damage or loss, any operational or mechanical deficiencies that might have contributed to the loss or damage and what has been done or is being done to correct those deficiencies.

State-chartered credit unions may need to report closures and damage to their state-chartering authorities as well. Notices of temporary closings, reports of physical damage, and requests for resources can be made to the Texas Credit Union Department by phone at (512) 837-9236, by fax at (512) 832-0278, or by email at [email protected]. The Department has released a Hurricane Harvey Advisory for Texas Credit Unions.

Notifications of closures can be made to the Louisiana Office of Financial Institutions by fax at (255) 925-4548 or (255) 925-4524 or by email at [email protected]. The office has issued guidance to Louisiana-chartered financial institutions and an Emergency Preparedness Guide & Event Script as well.

Resources for Members

Credit unions may receive calls from affected members regarding flood insurance. FEMA has a host of resources for those affected by Hurricane Harvey, including information on the National Flood Insurance Program and forms and instructions for filing claims.

Closed credit unions who participate in Co-Op Shared Branching can refer their members to the locator website to find open credit unions and ATMs to access their funds.

Credit union members with questions about their Share Insurance coverage may contact the NCUA’s Consumer Assistance Center at (800) 755-1030 Monday through Friday between 8 a.m. and 5 p.m. Eastern.

NAFCU is here to serve credit unions while they serve their communities. Credit unions can access additional resources on our webpage. Please let us know how we can help.

Programming Note

NAFCU's office will close at noon today and will also be closed on Monday for Labor Day. We will be back to blogging on Wednesday. Everyone have a safe Labor Day weekend.