NAFCU Compliance Blog

We Listened So You Don't Have To: Interagency Fair Lending Hot Topics Webinar

Written by: André B. Cotten, Regulatory Compliance Counsel

On November 16^th, 2017, the CFPB, NCUA and several other representatives from federal agencies presented a webinar on lending topics ranging from the HMDA changes to Regulation B special purpose credit programs, compliance management for consumer loans and fair lending considerations. You can listen to the webinar here and download the presentation slides here. Here is a quick summary of the main topics discussed:

HMDA Changes and Fair Lending

A CFPB representative quickly went over the new HMDA rules that will be in effect for HMDA data collected in 2018 and reported in 2019. According to the speaker, the FFIEC released its HMDA Examiner Transaction Testing Guidelines that will be used by all federal regulators in assessing the accuracy of the HMDA data that financial institutions record and report. This guide has important information regarding testing procedures and tolerance calculations for errors in different sample sizes.

As far as examinations, the CFPB highlighted that it will be updating its HMDA Examination Procedures and Getting It Right Guide to make complying with the rules easier. And as we previously reported, the CFPB's approach in initial examinations will be consistent with the approach taken for other regulations, which means "good faith efforts" to comply will be taken into account.

Special Purpose Credit Programs

A NCUA representative reviewed Regulation B Special Purpose Credit Programs. A special purpose credit program is characterized as a credit incentive. For instance, a credit union offers a one-time rate reduction for designated loan products to one or more of its membership groups. In other words, this incentive program would not be offered to the credit union's entire field of membership.

NCUA discussed credit risks associated with offering these type of special purpose credit programs. According to the official interpretations to Regulation B, the credit union makes the determination if the program benefits an "economically disadvantaged class of persons". The requirements for special purpose credit programs are detailed in section 1002.8. Note, the credit union's program cannot be established to evade ECOA's nondiscrimination requirements. To comply with Regulation B, the credit union may request common characteristic information to determine eligibility. If financial need is one of the criteria for the special purpose credit program, the credit union may also request information need to determine financial need.

Compliance Management for Consumer Loans

A representative from the Federal Reserve Board presented on compliance management for consumer loans. Although most credit unions are not supervised by the Federal Reserve, a credit union would still find the presenters remarks helpful.

The discussion focused on fair lending risks and compliance management for the pricing of consumer loans. However, the same principles would apply to developing an effective fair lending risk management program for consumer loan underwriting, and for mortgage and indirect auto pricing and underwriting.

Many credit unions offer consumer loans that serve a critical need for members. The Federal Reserve identified common scenarios the fair lending risk for pricing arises, which include the following:

• The credit union grants the loan originators broad discretion to set the interest rate and fees
• The credit union does not use rate sheets or other pricing guidelines
• The credit union does not require the loan originators to clearly and consistently document pricing decisions, including exceptions
• The credit union does not monitor for potential pricing disparities on a prohibited basis.

The Federal Reserve Board's representative also identified the elements of an effective compliance management system: Board of Directors and Senior Management Oversight; Policies and Procedures; Risk Monitoring and Management Information Systems (MIS); Internal Controls.

The Federal Reserve expects the financial institution's board and senior management to ensure they understand the level of risk in the credit union's products, services, and business lines, including the fair lending risk in consumer loan pricing. Board and Senior Managers are also expected to administer compliance management program that is consistent with the size, complexity, and risk profile of the financial institution's products, services, and business lines.

In regards to policies and procedures, the Federal Reserve encourages financial institutions to develop policies and procedures (such as rate sheets, checklists, job aids, etc.) designed to ensure consistent outcomes and prevent discrimination on a prohibited basis. Financial institutions are also encouraged to provide training on the fair lending risk in consumer loan pricing, and the financial institution's policies should appropriately control that risk.

The Federal Reserve also provided some best practices. Financial institutions may want to use rate sheets or loan origination software that use clear pricing criteria, and, if applicable, clear pricing exception criteria. The financial institution may also want to require loan originators to clearly and consistently document pricing decisions, including exceptions.

Then, in regards to risk monitoring and management information systems, the financial institution may want to develop risk monitoring systems commensurate with the level of discretion permitted. The Federal Reserve also provided several fact scenarios and commentary to better explain various fair lending risk scenarios. The credit union may also want to provide the board of directors and senior management with the information needed to identify and evaluate fair lending risk for consumer loan pricing.

When developing and modifying internal controls, the Federal Reserve advises that financial institutions may want to develop periodic fair lending self-assessment processes. These processes can include compliance reviews and audits that are appropriate for the size, complexity, and risk profile of the credit union's products, services, and business lines.

Other Related Fair Lending Topics

There were numerous other presenters during the webinar. The FDIC representative provided additional guidance concerning Fair Lending Monitoring Programs. The FDIC's Compliance Manual defines "monitoring" as a proactive approach by an institution to identify procedural or training weaknesses in an effort to preclude regulatory violations. It also includes transactional testing. The FDIC discussed performing periodic analyses of data for fair lending risks. These reviews should be conducted on a portfolio-wide basis.

Moreover, a representative from HUD discussed recent common issues in consumer complaints at HUD. Some common complaints include the following: the treatment of disability income; the treatment of parental leave income; collateral policies; reasonable accommodations; and targeting tools for marketing through social media.

Lastly, an attorney from the Department of Justice discussed denial investigations and cases. The DOJ representative used a recent case to explain instances of mistreatment based on prohibited criteria. The complaint alleges that the bank required employees to deny loans from minority applicants more quickly than similarly-qualified white applicants. The bank also instructed its employees not to provide credit assistance to applicants whose applications were marginally qualified.

***

Live Webcast on Tuesday, December 5 - Must a Credit Union Website be ADA Compliant? Protecting Your Credit Union from Potentially Frivolous Claims 

Over the past few months, credit unions have been hit with scores of lawsuits (and perhaps hundreds of “attorney demand letters”) challenging the accessibility of credit union websites to visually-impaired individuals.  Under the Americans with Disabilities Act of 1990, “public accommodations” are charged with being accessible to those with impairments.  These cases and claims allege that credit union websites are places of “public accommodation;” that they are not fully-accessible to visually-impaired individuals; and that the visually-impaired claimant stands ready to resolve the matter “confidentially” for a cash settlement. 

This 90-minute webcast will feature speakers with current experience in the legal and procedural issues involved, and will cover background information, current cases specific to credit unions, and what your credit union can do now to minimize its risk. Register here.

NCUA Issues Temporary Exemption on Appraisals for Disaster Zones

By Reginald Watson, Regulatory Compliance Counsel

Greetings compliance friends! In the wake of excessive flooding brought about by the many recent tragic hurricanes, NCUA together with several other agencies have granted temporary exceptions to the current appraisal requirements in major disaster zones. Since we've received quite a few questions on this, I figured it would be a good opportunity to review the NCUA appraisal requirements and un-package this temporary exemption.

NCUA's appraisal requirements depend on the loan value and its terms. NCUA’s Rules and Regulations do not require a formal appraisal if the transaction is 250k or less. Generally, any loan with a transactional value of $25,500 or less requires only a “written valuation” that meets FIRREA requirements. A loan with a transactional value between $25,501 and $250,000 only requires a formal appraisal if it is a "higher-priced" mortgage loan; and all loans of $250,001 or more require an appraisal.

For transactions requiring an appraisal, the central requirement is that the appraisal must be "performed by a state certified or licensed appraiser." For transactions requiring a written valuation, it must "be performed by an individual having no direct or indirect interest in the property, and qualified and experienced to perform such estimates of value for the type and amount of credit being considered."  12 C.F.R. §722.3(d). The minimum requirements for written estimates of market value are addressed in Appendix B of the Interagency Appraisal and Evaluation Guidelines.

In addition to the transaction threshold issue, §722.3 outlines the other exceptions to the general requirement to seek an appraisal, including situations in which:

• A lien has been taken out on the property as collateral only through an abundance of caution, and the transaction terms are no more favorable than they would have been in the absence of a lien;
• A lien has been taken out on the property for purposes other than the real estate's value;
• A lease of real estate is entered into, unless the lease is the economic equivalent of a purchase or sale of the leased real estate;
• The transaction involves an existing extension of credit at the lending credit union provided that there is no advancement of new monies and no obvious or material changes to market conditions;
• The transaction involves the purchase, sale, investment in, exchange of, or extension of credit secured by, a loan or interest in a loan, pooled loans, or interests in real property, including mortgage-backed securities;
• The transaction is wholly or partially insured or guaranteed by a United States government agency or United States government sponsored agency;
• The transaction either: 
  • Qualifies for sale to a United States government agency or United States government sponsored agency; or
  • Involves a residential real estate transaction in which the appraisal conforms to the Federal National Mortgage Association or Federal Home Loan Mortgage Corporation appraisal standards applicable to that category of real estate; or
• The regional director has granted a waiver from the appraisal requirement for a category of loans meeting the definition of a member business loan.

Appendix A to the Interagency Appraisal and Evaluation Guidelines, provides additional guidance on these exemptions and describes how institutions can comply with Title XI of the Financial Institutions Reform, Recovery, and Enforcement Act of 1989 (FIRREA).The guidance was joined by NCUA, and was attached to Letter to Credit Unions 2010-23.

Higher Priced Mortgages

As referenced in §722.3(f), if a loan is a second mortgage that is closed-end consumer credit secured by the consumer’s principal dwelling and qualifies as a higher-priced mortgage loan (HPML), it may require an appraisal under Regulation Z. §1026.35(c). An HPML is a closed-end secured residential loan "with an annual percentage rate that exceeds the average prime offer rate for a comparable transaction by a certain number of percentage points. §1026.35(c)(2) also provides an appraisal threshold exemption which is currently $25,500, along with additional exemptions to the appraisal rule for HPMLs. The threshold is set to increase to $26,000 on January 1, 2018. The CFPB official commentary discusses all these exemptions in further detail and emphasizes that although these types of transactions may be exempt from the CFPB's appraisal rule, the requirements under FIRREA and §722.3 still apply. Thus, an appraisal would be required for HPMLs between $25,500 and $250,000, and a written valuation conforming to the Interagency Appraisal and Evaluation Guidelines would be required for loans that do not require an appraisal under NCUA. An additional written appraisal for HPMLs may be required for recently acquired properties subject to certain conditions found in §1026.35(c)(4).

In summary, it appears any loan with a transactional value of $25,500 or less requires only a written valuation that conforms to Appendix B of the interagency guidance. A loan with a transactional value between $25,500 and $250,000 only requires a formal appraisal if it is a HPML. All loans carrying a value of $250,001 or more require an appraisal.

Loans in Disaster Areas

On October 16, 2017, NCUA, together with several other agencies, released a Letter to Credit Unions (17-CU-06) granting a temporary exemption to the FIRREA appraisal requirements in major disaster areas, as defined by the President. The exemption provides flexibility to credit unions with loans secured by real estate and located in the affected areas, including parts of Florida, Georgia, Puerto Rico, Texas, and the U.S. Virgin Islands. The exemptions will remain in effect for a three-year period from the date of the declaration.

The order specifically requires that the property involved was located within the major disaster area, there is a binding commitment to fund the transaction, the value of the real property supports the institution's decision to enter into the transaction, and the transaction must continue to be subject to review by management in the course of examinations of the institution.

This waiver is an attempt to ensure that any shortage of appraisers would not further delay the recovery process for these regions. We at NAFCU have been saddened to see the extent of the damage and loss of life and have compiled a list of resources to help credit unions in these disaster areas. Our thoughts and prayers go out to all those who have been affected.

NCUA Reverses Position on "Individual Policy" Requirements for Fidelity Bonds

Written by Pamela Yu, Special Counsel for Compliance and Research

NCUA's Office of General Counsel (OGC) recently issued its third formal legal opinion of 2017.  Dated September 26, 2017, the opinion letter concludes that the "individual policy" requirement in NCUA's fidelity bond rule does not prohibit a credit union from purchasing a fidelity bond that covers both the credit union and its credit union service organization (CUSO), provided the credit union owns at least 50 percent of the CUSO or the CUSO qualifies as a "nominee," as defined in the letter.  See, NCUA Legal Opinion 17-0959. 

Notably, the opinion represents a reversal from OGC's previous interpretations of the rule.  Opinion 17-0959 supersedes two previous legal opinions on this topic issued in 2004 and 2014, respectively. See, NCUA Legal Opinions 04-0744 and 14-0311.

Background

The Federal Credit Union Act (FCU Act) directs NCUA to require fidelity bond coverage for credit union employees who handle funds or collateral.  See, 12 U.S.C. §1766(h).  Part 713 of NCUA's regulations, which implements that provision, describes the fidelity bond and insurance coverage required for federal credit unions (the provision is also applicable to federally insured state-chartered credit unions by §741.221). 

The fidelity bond rule requires, among other things, that a bond (at a minimum) must be purchased in "an individual policy."  See, 12 C.F.R. §713.3(a).  According to NCUA, the "individual policy" requirement was added to the rule in 1999 to address specific concerns raised during the public comment period about jointly purchased fidelity bonds:

"[One] commenter was concerned that in [joint fidelity bond policies] a loss suffered by one or two of the joint policy holders could reduce the amount of coverage available for the other joint policy holders below the required minimum amount, i.e. two losses equal to the single loss limit of liability would exhaust the coverage available for all credit unions to zero even though some of these credit unions would not have suffered a loss. This commenter also noted a concern with the joint purchase of fidelity bond policies even when the policy purchased does not have an aggregate limit of liability. While it is true that a loss suffered by one credit union would not reduce the amount of coverage available to the other credit unions purchasing the policy, this commenter suggested that, when several credit unions purchase a policy in a group, they may not give adequate attention to providing for the specific risks faced by individual credit unions. Compromises might be made in coverage amounts that would not be made if the policy were purchased individually.  In addition, this commenter argued that the joint policy holders might not adjust coverages in a timely manner because of the difficulty of doing so in a group purchasing scenario." See, 64 Fed. Reg. 28718, 28719 (May 27, 1999).   

Based on these and other concerns, the NCUA Board clarified the rule to provide that a fidelity bond must be individually purchased by each credit union, but it did not define "individual policy."

Previous Opinions

In 2004, OGC was asked if a CUSO that provided management services for several credit unions could purchase a single fidelity bond with all its credit unions named as insureds. In opinion 04-0744, the office found that the joint bond was not permissible under §713.3(a), noting that "the principal reason for not permitting a credit union’s bond to cover additional insureds is to ensure that the coverage of the other insureds does not conflict with or in any way dilute the individual credit union’s required coverage."

In 2014, the office was asked to consider whether a credit union could include one or more CUSOs as additional insureds under its fidelity bond.  Again, OGC opined that a federally insured credit union is required to obtain fidelity bond coverage under an individual policy, and could not include one or more CUSOs or other parties as additional insureds under its fidelity bond.  See, NCUA Legal Opinion 14-0311. Citing the 2004 opinion and its rationale, OGC further noted that the requirement "prevents a claim against one insured from depleting coverage limits for the credit union."

Reversal

In a departure from its position since 1999, OGC has now changed its opinion of the permissibility of certain joint coverage fidelity bond provisions.  The reversal was precipitated by the office's recent review of bond forms approved by NCUA pursuant to §713.3(b), and the realization that several already-approved bond forms included joint coverage provisions.  For example, some of the approved forms, which NCUA approved before the 1999 rule change, included nominee provisions, joint insureds provisions, and definitions of "insured" that include subsidiaries that are more than 50 percent owned by the insured.  Given the "inconsistency between NCUA's approvals and [OGC's] legal opinions," the office now says that the "individual policy" requirement does not prohibit a credit union from covering its majority owned CUSO under its fidelity bond.   A CUSO may also be covered if it otherwise qualifies as a nominee.  However, joint coverage of non-majority-owned CUSOs or other entities continues to be impermissible.  See, NCUA Legal Opinion 17-0959. 

This change in position may lead to formal amendments or other revisions to the fidelity bond rule.  The opinion notes that NCUA recently published a proposed regulatory reform agenda, which includes a recommendation to consider revisions to Part 713.  See, 82 Fed. Reg. 39702, 39707 (Aug. 21, 2017).

***

Programming Note. NAFCU's offices will close at noon today and also be closed on Thursday and Friday in observance of Thanksgiving. We wish you all a safe and wonderful holiday. We'll be open and back to blogging on Monday.  Happy Thanksgiving!

NCUA Streamlines, Improves Appeals Process

Written by Shari R. Pogach, Regulatory Paralegal

During its October meeting, a new final rule was adopted by the National Credit Union Administration (NCUA) Board to streamline and establish uniform procedures in cases in which a decision by a regional director or other program office director is appealed to the NCUA Board.  Effective January 1, 2018, the new procedures will apply to agency regulations with currently embedded appeals provisions. 

Most authorized appeals to the NCUA Board will be governed by the new 12 CFR part 746, Subpart B. The regulations under which a credit union can appeal initial agency determinations include:

• 701 – Organization and Operation of Federal Credit Unions,
• 703 – Investment and Deposit Activities,
• 705 – Community Development Revolving Loan Fund Access for Credit Unions,
• 708a – Bank Conversions and Mergers,
• 709 – Involuntary Liquidation of Federal Credit Unions and Adjudication of Creditor Claims Involving Federally Insured Credit Unions in Liquidation,
• 741 – Requirements for Insurance,
• 745, Subpart B – Share Insurance and Appendix,
• 747 – Administrative Actions, Adjudicative Hearings, Rules of Practice and Procedure, and Investigations,
• 750 – Golden Parachutes, and
• FCU Act – Chartering and Field of Membership Determinations.

There are, however, five areas that are excluded from the scope of this new rule:  Enforcement Actions; Creditor claims in liquidation that are litigated or reviewed by the Board under formal agency adjudication procedures; Material Supervisory Determinations; Prompt Corrective Action; and Other Exclusions including appeals of adverse determinations under Freedom of Information Act (FOIA), requests made under NCUA's Touhy regulation, appeals of initial determinations made under the Privacy Act and consumer complaints to the agency.  NAFCU members can get more details on the exclusions and procedures outlined in the final rule in Final Regulation 17-EF-12 (your member login is needed).

NCUA's stated intent with this new rule is to provide "credit unions, and other persons or entities that are affected by agency decisions, with an opportunity to obtain meaningful review of those decisions. The Board believes this final rule strikes an appropriate balance that will afford a petitioner fair consideration of the issues while avoiding procedures that are overly burdensome, time consuming, and expensive."

Did you know that NAFCU has an Exam Fairness Guide that's available to members and to nonmembers on our website?  We are all aware that examinations can have a significant impact on a credit union.  This guide takes you through exam basics such as the goals of an NCUA exam, risk-focused versus defined-scope exams, frequency of exams and extended exam cycles. It also has helpful tips for navigating exam challenges, the appeals process and achieving fair exam outcomes.  The current guide reflects the appeals process as it stands today but will be updated in 2018 to reflect the new appeals process procedures.

"Friday Fun: Regulatory Requirements for Online Account Openings"

Written by: Andre' B. Cotten, Regulatory Compliance Counsel

Greetings, Compliance Friends! Opening accounts online is a major convenience for members. However, for compliance officers, the online account opening process is riddled with potential pitfalls. For example, when and how does the credit union provide the account opening disclosures. Today's blog is meant to be a high-level review of some of the relevant requirements credit unions may want to consider when establishing online account opening policies and procedures.

Bank Secrecy Act

From a BSA standpoint, opening accounts online can represent risks related to a credit union's Customer Identification Program (CIP) and Know Your Customer requirements. Generally, a credit union's CIP program is based on its own risk assessment and not prescriptive requirements. Although, from a CIP perspective, members opening accounts online is generally considered higher risk. From NAFCU's understanding, many financial institutions utilize complex vendor software in order to ensure the CIP requirements are met when individuals seek to open accounts online.

The FFIEC BSA/AML exam manual discusses "non documentary" methods of verifying identity that may also be helpful to the credit union. Note, the BSA requires that the credit union know the member's identity with reasonable certainty and have the member's name, address, date of birth and identification number so that guides what needs to be verified.

NCUA

However, a consumer must fall within the field of membership before they can be admitted as a member in the credit union. This determination will depend on the credit union's statement of its field of membership, the clause of the statement relied on by the potential member, and the credit union's policies and procedures.

Note, Article II, Section 2 of NCUA's FCU Bylaws requires a member to sign an application for membership. The credit union might verify this language in its own bylaws, and if it does appear, consider electronic signatures under the E-SIGN Act or whether it will require a member to come in and provide a wet signature for the signature card and to establish insurance under Part 745.

As an additional reference, NCUA Opinion Letter 2004-0543 discusses electronic signatures in the membership context.

E-SIGN

The E-Sign Act requires credit unions to receive the member's affirmative consent to receive electronic records. See, 15 U.S.C. § 7001(c). . As an industry standard, it seems many credit unions require members to comply with the E-SIGN consent and procedures when registered for online banking to give legal effect to the disclosures transmitted to the members  through the online banking platform.

For more information, NCUA issued a Risk Alert soon after the E-SIGN Act became effective in March 2001. Here is an additional link for your reference: Consumer Compliance Outlook 4Q Article on ESIGN .

Regulation E

The determination whether a credit union is required to provide additional disclosures when a member establishes an account online depends on what other types of products or services the member is requesting. For example, if the member requests a debit card to execute electronic fund transfers, then the credit union would need to comply with Regulation E.

Regulation E requires initial disclosures be provided "at the time a consumer contracts for an electronic fund transfer service or before the electronic fund transfer is made involving the consumer's account." Below are some Regulation E links of interest:

• Section 1005.4 contains general disclosure requirements and references providing disclosures electronically (E-SIGN)
• Section 1005.7 contains requirements for initial account disclosures
• Supplement I to Part 1005 contains commentary to both sections that clarify requirements
• Appendix A contains Model Forms for Regulation E – Model Form A-2 applies to initial account disclosures

Truth in Savings

NCUA's Truth in Savings Rule has a similar requirement that specifies that credit union must provide account opening disclosures before the account is opened or a service is provide din connection with the account. See, 12 C.F.R. § 707.4(a)(1)(ii).

Here are some Truth in Savings links of interest:

• Section 707.4 contains the requirements for delivery or initial account disclosures
• Section 707.3 describes how disclosures can be provided electronically (i.e., following E-SIGN) and the relationship to Regulation E
• Appendix C contains commentary to both sections that clarify requirements
• Appendix B contains Model Forms for TIS – Model Form B-1 applies to initial account disclosures

Privacy

Under the GLBA, Initial Privacy Notices and Opt-Out Notices can be provided electronically. The notieces can be delivered pursuant to the E-SIGN Act, or  in certain circumstances, the notices can be delivered when the consumer is conducting transactions electronically. Under section 1016.9(b)(1)(iii), it is considered valid delivery to post the privacy notice on a website and require the consumer to acknowledge receipt of the notice as a necessary step to obtaining a particular financial product or service.

Another privacy consideration for online banking is the Children’s Online Privacy Protection Act (COPPA). COPPA imposes certain requirements on operators of websites or online services directed to children. Credit unions are subject to COPPA if they operate a website or online service directed to children, or have actual knowledge that they are collecting or maintaining personal information from a child online. Making COPPA determinations generally requires an analysis of the specific facts and circumstances surrounding a credit union’s online activities against the requirements of COPPA. Thus, a credit union may want to work with local counsel to see if COPPA applies. The FTC’s website has an excellent overview of COPPA.

State Law

Lastly, there may be state law considerations. An online banking agreement establishes contractual obligations between the credit union and the member. The credit union may consider consulting with local counsel to develop a comprehensive agreement that includes, but is not limited to: balance and transaction information; password creation and maintenance; access authorization; and technical assistance.

Additional Resources

Below are a few resources on authentication, cybersecurity, and other issues related to online banking:

• NCUA Official Sign is required on a webpage where a credit union accepts deposits or opens accounts under section 740.4(a). Downloadable graphics of the sign are available here.
• Regulation CC requires the credit union to provide disclosures relating to funds availability “before opening a new account,” under section 229.17.
• NCUA Letter to Credit Unions 2011-CU-09 discusses Online Member Authentication Guidance
• FFIEC IT Booklets provides guidance on cybersecurity considerations.

CFPB Issues Supervisory Guidance for HMDA; MLA FAQ – MAPR on Periodic Statements

Written by Brandy Bruyere, Vice President of Regulatory Compliance

In the past, when leading up to a substantial compliance deadline, the CFPB has issued guidance indicating that in the early stages of implementation, the Bureau will look for "good faith efforts" to comply. We saw this with TRID in 2015 and with the Dodd-Frank mortgage servicing rules in 2014. We received questions from credit unions regarding whether a similar approach might be taken for HMDA. It turns out, the CFPB has stated this will be its exam approach for HMDA, but the information is buried in a recent edition of the Bureau's Supervisory Highlights. Here is an excerpt from page 41:

As noted above, the 2015 Final [HMDA] Rule’s new data requirements will apply to data collected beginning on January 1, 2018. Given the recent updates to the rule, the Bureau’s current principal focus is on providing regulatory implementation support to financial institutions, to assist them in operationally implementing the recent changes to the HMDA requirements. After the rule takes effect, consistent with our approach to the implementation of other Bureau rules requiring significant systems and operational changes, our approach will generally be diagnostic and corrective, not punitive. In our initial examinations for compliance with the rule, we intend to consider whether companies have made good faith efforts to come into compliance with the rule in a timely manner. Specifically, we will be evaluating a company’s overall efforts to come into compliance, including assessing the compliance management system and conducting transaction testing. If errors are identified, we will work with the institution to determine the root cause of the issue and determine what corrective actions, if any, are necessary. (Emphasis added.)

What about NCUA? In the past, the agency has adopted a similar approach to examinations as the CFPB, such as this Supervisory Letter issued to examiners on the Dodd-Frank mortgage rules back in January 2014. Last week, NAFCU asked NCUA to once again take a similar position as the CFPB and look for credit unions' good faith efforts to comply with the new HMDA provisions in the early phases of implementation. We will keep credit unions posted on the issue.

Meanwhile, as we mentioned last week, the beta version of the CFPB's HMDA Platform is now available for testing. Those responsible for the credit union's HMDA data may want to start testing the platform as the beta version will be removed when the 2017 HMDA filing period opens on January 1, 2018. Issues with the beta version can be reported directly to the CFPB at [email protected] (although the Bureau reminds users not to include personal information in these inquiries).

***

MLA FAQ – MAPR on Periodic Statements

Many credit unions have asked us whether it is required to indicate a covered borrower's Military Annual Percentage Rate (MAPR) on disclosures including periodic statements. The MLA does not require numeric disclosure of the MAPR and in fact, in the preamble to the rule, the Department of Defense indicated that providing both the Regulation Z APR and the MLA MAPR may be confusing to borrowers:

The Department believes that, in light of section 987(i)(4) (“ ‘annual percentage rate’ has the same meaning as in section 107 of [TILA], as implemented by the [Bureau]”), section 987(c)(1)(A) of the MLA (“A statement of the annual percentage rate of interest”) should be interpreted so as not to require a creditor to calculate and disclose to a covered borrower a definitive figure for the “annual percentage rate” of interest applicable to the consumer credit that could include additional charges that must be counted as “interest,” and thereby would be materially different from the figure the creditor is required (under section 987(c)(1)(B) of the MLA) to compute and disclose under TILA. Instead, the Department believes that the appropriate approach to interpret the tension between sections 987(i)(4), 987(c)(1)(A), and 987(c)(1)(B) is to subject a creditor to one set of requirements for calculating and disclosing the costs of the extension of credit, namely, the requirements under TILA. One clear and beneficial consequence of interpreting these ambiguous provisions of the MLA under this approach is that a creditor is not required to provide to a covered borrower two different numerical disclosures, which inevitably would lead to confusion. (Emphasis added.)

While the MLA does require a boilerplate disclosure explaining the MAPR, the rule does not require a numeric disclosure of the MAPR.

***

Palate Cleanser - Trick or Treat

This year, Nolan was a dragon for Halloween which was a far cry from his first Halloween, where he was 3 weeks old so we put silver fabric over his swaddle and stuck a famous burrito company's logo on his chest. Lemmy's not big on costumes, although he really wanted to steal candy. Alas, he was unsuccessful.

CFPB Issues Consumer Protection Principles on Data Sharing

Written by Jennifer Aguilar, Regulatory Compliance Counsel

In the wake of the Equifax breach, data security has been on everyone's mind. Various stakeholders have come together to see that the industry is held responsible – everything from punishing the guilty to establishing nationwide data security standards is being suggested. With most of the conversation focused on what industry can do to improve the situation, the CFPB has come forward with a consumer-focused approach to data security and sharing. Last month, the CFPB issued its Consumer Protection Principles: Consumer-Authorized Financial Data Sharing and Aggregation.

The CFPB recognizes the importance of financial institutions and the vital role third party financial service providers have in the market. Those companies that use financial data to provide consumers with financial management tools, account verification, fraud prevention and other servicers need access to information in order to provide these services. The CFPB stresses that companies need to keep their consumers in mind when designing their information sharing policies. "Consumer interests must be the priority" and "a common understanding of consumer interests is essential so that effective consumer protections can be integrated consistently into [the] market." The Principles are intended to provide that common understanding and provide a frameworks for protecting consumer interests as data is shared between market participants.

The nine principles are:

1. Access: Consumers should have access to information about how they are using financial services and products. Financial institutions, or other service providers, should provide the information requested in a timely manner. Account agreements, or other user terms, should promote access to information.
2. Data Scope and Usability: Information that consumers have access to should include transaction data or other usage data; account terms, such as fee schedules; costs, such as interest paid; and benefits, such as interest earned. Information should be provided in a readily usable format.
3. Control and Informed Consent: Consumers should control their information. Financial institutions, or other service providers, should fully disclose, in an understandable manner, account terms relating to the access, use, storage, and disposal of information. Consumers must give prior consent before third parties may access their information and consent may be revoked at any time. Revocations should be implemented in a timely manner and include deleting information when the consumer makes such a request.
4. Authorizing Payments: Authorization to access information is not authorization to initiate payments. Financial institutions, or other service providers, should obtain separate authorizations for these two activities.
5. Security: All information should be accessed, used, stored, and distributed in a secure manner that mitigates the risk of data breaches, transmission errors, unauthorized use and fraud. Security procedures should be updated frequently.
6. Access Transparency: Consumers should be informed of each third party that has access to their information, what information that party has access to, and how that information is used.
7. Accuracy: All information should be accurate and consumers should always have a means to dispute and resolve inaccurate information.
8. Ability to Dispute and Resolve Unauthorized Access: Dispute resolution procedures should cover instances of unauthorized access, sharing or payment as well as failures to comply with the terms of a consumer's authorization. These procedures should be reasonable and practical and should not require consumers to identify the parties at fault. Parties at fault should be held accountable.
9. Efficient and Effective Accountability Mechanisms: All parties involved – those that use, share, store, or dispose of information – should have similar goals and work together to enable secure transmission of information and deter misuse. Each party should be held accountable for failure to do so.

While these Principles provide a framework for financial institutions and third party service providers to follow, it is important to keep in mind that they are not binding. The Principles are also not meant to replace or interpret any current regulations on data security. Rather, these Principles may assist credit unions in making decisions on how to use and share information. These Principles can also assist credit unions in determining a course of action in dealing with its members or other financial institutions in the event the regulations do not directly address their situation.

The FTC has also put together a few resources on data security that credit unions may find helpful: Start with Security: A Guide for Business and Protecting Personal Information: A Guide for Business. Again, these are not binding, but they do provide some key principles that credit unions may want to consider when assessing their data security programs.

Closed for the Holidays!

HomeClosed for the Holidays!

Written by Reginald Watson, Regulatory Compliance Counsel

Season's Greetings compliance friends! With the upcoming holiday season around the corner, I thought it would be a good idea to review Reg CC's funds availability rules when credit unions close their offices in observance of federal holidays.

Reg CC governs the availability of members' funds that are deposited into transaction accounts. The rule generally requires that cash and certain check deposits be made "available for withdrawal not later than the business day after the banking day on which the funds are deposited." 12 C.F.R. §229.10(a, c). For local check deposits, §229.12(b) requires that funds be made "available for withdrawal not later than the second business day following the banking day on which funds are deposited." Now, it is important to keep in mind the difference between a business day and a banking day. A business day is considered to be any calendar weekday that is not a federal holiday. A banking day on the other hand is any business day on which a credit union is open and able to carry on substantially all of its banking functions. See, 12 C.F.R. §229.2(f). This seems simple enough to understand during the regular course of business, but what happens when a federal holiday falls on a weekend, or the credit union decides to close the Friday after Thanksgiving? How can the credit union be required to make funds available for onsite ATM or overnight lockbox deposits when closed for the holidays?

To start, this only impacts a handful of holidays. Some federal holidays are always on a Monday, such as Labor Day or Memorial Day, and Thanksgiving is always on a Thursday. But for federal holidays with specific dates, such as Veteran's Day, Christmas Day, New Year’s Day, and Independence Day, some years the holiday will fall on a weekend and be officially observed on either the previous Friday, or the following Monday. The federal government seems to recognize Sunday holidays on the following Monday and Saturday holidays on the previous Friday. For example, this month's Veteran's Day (November 11, 2017) will be recognized on Friday, November 10, 2017, granting us an extra day to take advantage of the sales!

Now, ATM and overnight deposits present some challenges when customers expect their deposited funds to be available for withdrawal on days that are not usually considered holidays. The first step to navigating Reg CC's funds availability rules is figuring out when funds are considered deposited. In §229.19(a), the Federal Reserve has determined that funds deposited at a staffed facility or on-site ATM are considered deposited on the day the deposit is given or placed in the ATM. Funds deposited at an overnight depository, lockbox or an off-site ATM are considered deposited on the day the funds are removed and made available for processing by the bank. 12 C.F.R. §229.19(a)(1-4). Regarding federal holidays and other bank closures, the regulation goes on to state that:

"(5) Funds may be considered deposited on the next banking day, in the case of funds that are deposited—

(i) On a day that is not a banking day for the depositary bank; or

(ii) After a cut-off hour set by the depositary bank for the receipt of deposits of 2:00 p.m. or later, or, for the receipt of deposits at ATMs, contractual branches, or off-premise facilities, of 12:00 noon or later. Different cut-off hours later than these times may be established for the receipt of different types of deposits, or receipt of deposits at different locations." See, 12 C.F.R. §229.19(a)

Accordingly, the fact that the credit union is substantially closed for business pushes the calendar forward on when the credit union will be required to make funds available for withdrawal by one banking day. Funds deposited on a day that is not a banking day (i.e. Federal holidays and other days in which the credit union is not carrying on substantially all of its banking functions), would be considered deposited on the following banking day.

Let's consider, for example, a credit union that is essentially closed on the Friday before Veterans Day or the Thursday and Friday of Thanksgiving week. For this credit union, all deposits made at an ATM or overnight lockbox during this time would be considered deposited on the following Monday.  From there, the credit union would follow the general funds availability guidelines. By Tuesday, funds must be available for deposits of cash, electronic payments, U.S. Treasury checks, U.S. Postal Service money orders, Federal Reserve Bank checks, State and local government checks, Cashier's checks, certified checks, and on-us checks. By Wednesday, funds from local checks should be made available for withdrawal. For additional information, the Federal Reserve provides A Guide for Financial Institutions: Compliance with Regulation CC. Happy Shopping!

Veteran’s Day: NAFCU will be closed on Friday in observance of Veteran’s Day. We at NAFCU extend our gratitude and appreciation to current and former members of the military who have bravely served our country. We will return to carrying on substantially all of our blogging functions on Monday, November 13, 2017. Have a nice weekend.

CDD Rule: Beware of Events that May Trigger Beneficial Ownership Reviews; CFPB Releases Beta HMDA Platform

Written by Stephanie Lyon, Regulatory Compliance Counsel

I have exciting news to share; on Friday I became a Certified Anti-Money Laundering Specialist through ACAMS. This is a great milestone for me and nothing could commemorate this accomplishment better than a BSA blog.  Enjoy!

As the Customer Due Diligence (CDD) rule's implementation date gets closer, we have seen an increase in questions regarding the types of events that may lead a credit union to review the beneficial ownership information of an existing account. So we thought it would be helpful to go over the rule's requirements and give examples of potential triggering events. Before we dig in, remember that the definition of a beneficial owner includes two prongs—ownership and control—so when talking about updating information on beneficial owners, we are referring to both prongs.

The 5th pillar of BSA compliance established by the final rule requires that credit unions include in their anti-money laundering (AML) programs, CDD procedures for the purpose of developing a member risk profile and conducting ongoing monitoring of these relationships. See, 81 Fed. Reg. 29449. Before you sound the alarm at your credit union, it is important to know that the final CDD rule does not impose a categorical requirement to regularly update the beneficial ownership information on an existing account. See, 81 Fed. Reg. 29421. However, as part of the on-going monitoring, credit unions may encounter some events that could lead the credit union to believe that there has been a fundamental change to the ownership of the account and hence trigger a review of beneficial owners. See, 81 Fed. Reg. 29399.

What Triggers A Review?

The rule states that beneficial ownership information should be updated when, in the normal course of business, the credit union detects a relevant change to the account that may alert the credit union to a change in the beneficial ownership structure. Here is an excerpt to the preamble of the CDD rule in which FinCEN explains this concept:

"…our requirement is consistent with current practice, and we expect monitoring-triggered updating of beneficial ownership information (as with other customer information) only to occur on a risk basis when material information about a change in beneficial ownership is uncovered during the course of a bank's normal monitoring (whether of the customer relationship or of transactions)... However, there is no expectation that a financial institution obtain updated beneficial ownership information from its customers on a regular basis, whether by using the Certification Form in Appendix A or by any other means." 81 Fed. Reg. 29421.

Unfortunately, the CDD rule does not have a prescriptive list of events that will trigger the review of beneficial ownership information for existing business accounts. Rather the rule follows the same risk-based review format of other Bank Secrecy Act (BSA) requirements. These risk-based provisions allow credit unions the flexibility to determine its own triggering events and implement appropriate review procedures. The rule does provide a few examples of events that could lead to a review of an account's beneficial ownership structure such as:

• "a situation where an unexpected transfer of all of the funds in a legal entity's account to a previously unknown individual would trigger an investigation in which the bank learns that the funds transfer was directly related to a change in the beneficial ownership of the legal entity…;
• when a financial institution detects information (including a change in beneficial ownership information) about the customer in the course of its normal monitoring….; [and/or]
• a significant and unexplained change in the customer's activity, such as executing cross-border wire transfers for no apparent reason or a significant change in the volume of activity without explanation." 81 Fed. Reg. 29421, 29399.

So if the credit union uncovers a potential change to the beneficial ownership information during a high risk review of an account, during the investigation of an AML alert or a SAR filing, the rule would require the credit union to seek updated information for the account at that time. Other triggering events that may require updated beneficial ownership information, depending on specific facts and circumstances, include:

• A notable increase in CTR filings for the legal entity or any of the beneficial owners
• The filing of a SAR (depending on the nature and type of suspicious activity)
• Changes regarding the authorized users or signatories for the account
• Changes regarding the beneficial owners, ownership structure, nature of the business or customer base
• Opening a new subaccount for the business
• A request to close an active subaccount without providing a legitimate reason
• A 314(a) match
• Information obtained/provided from or to other FIs through 314(b) information sharing
• Results from a high-risk review of the account
• Law enforcement subpoenas or search warrants
• Transaction monitoring alerts for unexpected activity

Before the rule becomes final, credit unions may want to review their current due diligence process and create additional risk-based procedures that specify which triggering events should lead to a more thorough review of legal entity accounts—including obtaining updated beneficial ownership information.

***

CFPB Releases Beta Version of HMDA Platform. Credit unions will finally be able to test their HMDA data collected in 2017 for reporting to the CFPB in 2018  through the long awaited beta version of the HMDA portal. The portal allows credit unions to establish test log-in credentials, upload sample files, validate the data, receive edit reports, confirm test data submissions and complete test filing processes.

Equifax Breach Update - What NAFCU Is Doing

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

In the past few weeks, NAFCU has been focused on defending credit unions from the fallout of the Equifax breach specifically, and the cybersecurity risks posed by third parties generally. At this moment, the door is open to cybersecurity legislation that could have real positive impact for the credit union industry, and NAFCU is moving to seize on that opportunity. As legislation may be the best hope to protect credit unions from another breach like the one at Equifax, I'd encourage your credit union to engage with your Members of Congress to ensure they understand that credit unions must be protected in the future. Please visit our Grassroots Action Center for more information.

Equifax Botched It

Equifax was warned of the vulnerability which lead to the breach in December, 2016. This March, Equifax ignored a notification from the Department of Homeland Security, CERT to fix that vulnerability. In August, following the breach, Equifax established an insecure domain for its breach response site which was spoofed. In early October, Equifax's credit protection website was discovered to be hosting malware. The hits keep coming for Equifax, and whatever credibility Equifax might have still had after the breach, it is now completely gone. Equifax is trying to leave consumers, credit unions and other financial institutions to foot the bill for its mess. NAFCU is engaging on all fronts to make sure that doesn't happen.

The Regulators Are Quiet

NAFCU has been in touch with NCUA, but the agency lacks any real authority to take action on the Equifax breach or other third party cybersecurity issues. NAFCU has also reached out to the CFPB, and the Bureau continues to take the position that it would have needed additional authority over the credit reporting bureaus to have prevented the breach from occurring. The Bureau is currently investigating Equifax's use of a mandatory arbitration clause in connection with its breach response website.

The FTC is conducting its investigation into the Equifax breach and the response. NAFCU has encouraged the FTC to keep credit unions apprised of their findings, but we expect that investigation to continue for several years. No matter what that investigation finds, the FTC will not be able to prevent another breach like this from happening again unless Congress steps in.

The Hill Has Questions

The Equifax breach has Congress angry and looking for answers. On October 3, Equifax's former CEO, Rick Smith, testified before the House Energy and Commerce Committee, providing details for the first time about the internal failures at Equifax that lead to the breach, and accounting for the behavior of Equifax leadership in the days that followed. A few days later, the Senate Banking Committee and then the House Financial Services Committee both heard further testimony from Mr. Smith regarding the variety of failures in Equifax's response to and communication about the breach.

While both parties are actively engaged on this issue, it is worth noting the differing approaches of Republican and Democratic Members of Congress. Republican Members of Congress appear to be actively seeking the ways in which regulatory oversight failed with Equifax, and how these gaps can be fixed. Democratic Members of Congress have zeroed-in on how the Equifax breach will affect consumers, and what Equifax and Congress can do to try and make them whole.

While Equifax's current leadership has failed to show up for hearings so far, the credit union industry has come when called. On Wednesday, Debra Schwartz, NAFCU Board treasurer and President and CEO of Mission Federal Credit Union testified on behalf of NAFCU before the House Financial Services Committee about data security and what credit unions need from Congress. Ms. Schwartz explained the sufficiency of the Gramm-Leach-Bliley's existing Safeguard Rule pertaining to financial institutions, and pointed out that the Equifax breach was the failure of examination and oversight of the credit reporting bureaus, rather than a failure of the law itself. She emphasized that if there are not standards throughout the entire payments infrastructure, criminals will go to the weakest link, which is the merchants. She championed the industry and provided important, factual testimony that will aid Congress in drafting a bill that works and can pass. NAFCU will continue to work to ensure that credit unions' voices are heard in these Congressional hearings.

Legislation Is In the Works

There is a strong appetite on both sides of the aisle to pass legislation in response to the Equifax breach. So far, legislative proposals generally fall into one of three buckets: consumer protection proposals in response to the breach, proposals to correct or increase regulatory oversight over the credit reporting bureaus, and broader proposals regarding national standards for cybersecurity.

The PROTECT Act, recently introduced by Representative Patrick McHenry (R-N.C.), has garnered significant attention. This Act would have the FFIEC appoint a supervisory agency and examine the credit reporting bureaus for compliance with the GLBA's Safeguards Rule, correcting the "examination gap" that currently exists with the bureaus. This proposal also contains national requirements regarding the operation of credit freezes, something that is currently handled at the state law level. Of concern is a provision in the Act that seeks to phase social security numbers out of use by the bureaus as a personal identifier. Obviously this raises red flags as social security numbers are critical to properly identifying members, and NAFCU is currently raising these concerns to lawmakers.

While Congress's attention is focused on cybersecurity, NAFCU is pushing to ensure that credit unions can get the protection they need against third party breaches. There is real energy behind getting general data security legislation passed, and NAFCU is seeking to take advantage of that. As always, we are keeping a careful eye to ensuring that organizations subject to the Gramm-Leach-Bliley Act, like credit unions, do not end up being subject to stricter standards. But this may be our moment to get credit unions the protections they need from third party cybersecurity risk, and NAFCU is working to make sure we take as much advantage of the moment as we can.

Litigation Is on the Table

To date, multiple class action lawsuits have been filed against Equifax by financial institutions across the country. It is highly likely that all financial institution class actions suits will eventually be joined together. Filing or joining a lawsuit continues to be an available option which NAFCU closely considering. Only if NAFCU determines that litigation is viable and a worthwhile avenue for recovery for credit unions will we pursue that option.

NAFCU is continuing to engage everywhere we can to protect credit unions from the breach's continuing fall-out, and to demand Congress act so that this cannot happen again.

Please Stop Calling Me...Unless You're My Credit Union

Written by: Ann Kossachev, Regulatory Affairs Counsel

T-C-P-A. This four letter acronym invokes a lot of fear in credit unions across the country. Most of that fear is based on the very real risk of facing a lawsuit for alleged violations of the Telephone Consumer Protection Act (TCPA). There are individuals known as "TCPA trolls" who have made a lot of money filing TCPA lawsuits against those institutions that have intentionally or unintentionally placed calls (including text messages) to their numbers. Plaintiffs' attorneys were quick to notice this trend and have profited greatly from the skyrocketing number of TCPA cases in recent years.

Source: U.S. Chamber of Commerce Institute for Legal Reform

For starters, Congress enacted the TCPA in 1991. That's right, 26 years ago. Considering all of the technological advancements since the '90s, it is no surprise that the Act is in serious need of modernization. The Federal Communications Commission (FCC) has issued several orders since then attempting to clarify the TCPA's vague language, including in 2003, 2012, and (this one is a doozy) 2015. Shortly after the FCC's 2015 Declaratory Ruling and Order (2015 Order), NAFCU detailed the background and details of the FCC's proclamation on this blog. Since then, NAFCU has been very vocal about its concerns with the following aspects of the 2015 Order and the FCC's TCPA regulations generally: (1) the restrictive free-to-end-user exemption; (2) the overly-expansive definition of "automatic telephone dialing system" (autodialers); (3) antiquated distinctions between mobile and residential phones; (4) the very vague standard for revoking previous consent; and (5) a lack of flexibility with regard to reassigned numbers.

The bottom line is that credit unions are not abusing telephone technology to cause a nuisance to and invade the privacy of their members. Nonetheless, credit unions are swept in with intrusive telemarketers and scam robocallers and subject to some pretty hefty restrictions on consumer communications. In 2015, ACA International sued the FCC in the United States Court of Appeals for the District of Columbia Circuit to resolve questions with the 2015 Order and the case was consolidated with similar lawsuits. Shortly thereafter, NAFCU filed a motion to intervene on behalf of the petitioners and the motion was granted. Oral arguments were heard on October 19, 2016 and the three-judge panel appeared to be sympathetic to the petitioners' arguments and questioned the FCC's interpretation of the TCPA. The D.C. Circuit has yet to issue a decision in the case, but it could happen any day now.

Meanwhile, there have been some changes at the FCC. Earlier this year, former Commissioner Ajit Pai was elevated to Chairman and then Brendan Carr and Jessica Rosenworcel were nominated and confirmed as commissioners, filling the remaining two seats and providing the FCC with a majority Republican leadership. Commissioner Michael O'Rielly and Chairman Pai have been outspoken about their disapproval of the 2015 Order. Chairman Pai actually dissented to the order and said "Rather than focus on the illegal telemarketing calls that consumers really care about, the Order twists the law's words even further to target useful communications between legitimate businesses and their customers." Chairman Pai said the 2015 Order would make abuse of the TCPA much easier and primarily benefit trial lawyers, not the American public. NAFCU concurs and is optimistic that under his leadership, Chairman Pai will make serious efforts to clarify the TCPA and undo some of the FCC's harmful regulations, including the 2015 Order.

Unfortunately, until we see a decision in the ACA International case, the FCC is unlikely to make any significant changes to its TCPA regulations.  Despite pleas for relief to the FCC, NAFCU does not anticipate the FCC to modify any of its TCPA rules or exceptions until the D.C. Circuit has spoken. While we wait patiently though, the FCC has taken steps to target unlawful scam robocalls and malicious spoofing and started looking into creating a centralized database for reassigned numbers, which will help ease some of the difficulties related to the TCPA. But these steps still do not solve the primary concerns with the 2015 Order, mainly the definition of autodialer and the exceptions for free-to-end-user calls.

Credit unions deserve better. Credit unions should receive tailored regulations that recognize their unique relationship with members and, in terms of the TCPA, that they typically only contact consumers with useful information regarding their existing accounts. NAFCU has been asking the FCC to make changes to its regulations and to reevaluate the 2015 Order for years now, but again, the FCC appears to have put the issue on hold. For now, NAFCU is working on developing a landing page to keep you updated on the latest TCPA developments and doing everything possible to make sure every commissioner at the FCC knows that credit unions are struggling with TCPA compliance. There is also currently a credit union-specific petition pending before the FCC, which requests an "established business relationship" exception for credit union informational calls to wireless numbers. It is open for comment until November 6, 2017. NAFCU is commenting in support of the petition and encourages you to do the same. You can submit comments here. Other than that, until the D.C. Circuit's decision is released, credit unions and other financial institutions are on the hook. Ring riiiiiing!