NAFCU Compliance Blog

Considering Medical Information under the FCRA; Housing & Alternative Credit Scores Research

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

Good morning, Credit Union Compliance World!

In a short space of time, your NAFCU Regulatory Compliance Team got pinged with a couple different versions of the same question – when can credit unions consider medical information in making credit decisions? It's an area where most credit unions don't have a lot of traffic.

Credit union compliance officers clearly have an instinct is that this is an Equal Credit Opportunity Act (ECOA) issue. This makes sense because it speaks to our sense of fairness, but neither ECOA nor Regulation B address the question. However, it is dealt with fairly directly by the FACTA amendments to the FCRA.

Section 604(g)(2) of the FCRA (codified at 15 U.SC. § 1681b(g)(2)) generally prohibits credit unions from obtaining or using medical information in connection with any determination for credit. This applies to any creditor and "medical information" is defined to include any information relating to physical, mental or behavioral health of an individual.

The medical information does not need to come from a credit report for this prohibition to be implicated. It is important to understand that the prohibition against using medical information applies regardless of how the credit union obtained the medical information. The information could be received from the member directly, or from their friends or family.

Subpart D of Regulation V implements the medical information provisions of the FCRA. Section 1022.30 contains the general prohibition against obtaining or using medical information in credit decisions, unless an exception is met.

While the rule prohibits obtaining medical information, it also addresses that this information is often provided to credit unions completely unsolicited. Section 1022.30(c) states that if unsolicited medical information is shared with the credit union, the credit union has not violated the prohibition. However, to use that information, the credit union would need to meet an exception under the rule.

Section 1022.30 contains several exceptions to this general prohibition which may apply, including a financial exception, an exception for special credit-related assistance programs for those with medical conditions, an exception for forbearance programs triggered by medical conditions or events, an exception for following the member's documented request to accommodate a particular circumstance, and more. Below is more detail on the financial exception.

Financial Exception

The financial exception allows a creditor to obtain and use medical information as long as the information is the "type of information routinely used in making credit edibility determination, such as information relating to debts, expenses, income, benefits, assets, collateral, or the purpose of the loan, including the use of proceeds." The information can only be used in a manner and to an extent that it is no less favorable that comparable non-medical information. To illustrate, the credit union could consider that an applicant owes medical bills related to oncology to the same extent that it would consider similar bills not related to a medical issue. The bills can be considered as a liability affecting their income and assets, but the applicant's implicit need for oncology treatment should not be considered. The credit union cannot consider the applicant's physical, mental or behavioral health, condition or history, type of treatment, or prognosis into account. 12 C.F.R. § 1022.30(d)(1).

So, if an applicant makes a disclosure of medical information during a loan application process or asks for loss mitigation assistance in connection with a medical crisis, the credit union might review section 1022.30 closely to ensure it is in compliance when requesting or considering any medical information in connection with a loan. Another thing to consider is whether state laws in your jurisdiction regarding fair lending or disability protections have prohibitions against considering medical information or the member's medical condition in a credit decision.

Housing & Alternative Credit Scores Research

NAFCU is conducting research to help us in our advocacy efforts on your behalf. We want to hear about your credit union's health, mortgage lending and views on alternative credit scores. If you have a moment, please take the time to complete this survey. The survey will be open through this Friday.

RDC Patent Infringement Letters; Court Issues Motion to Dismiss in ADA Case

Written by Brandy Bruyere, VP of Regulatory Compliance

In recent weeks, NAFCU has heard from multiple credit unions who have received letters from a firm alleging that the credit union's remote deposit capture function infringes on USAA's patents in this area. As widely reported in many news outlets, USAA started developing RDC technology in 2005 and now holds about 50 RDC-related patents. In 2012, USAA was involved in a dispute with another RDC provider, where the parties claimed each side infringed on the other's patents. The case ultimately ended in a settlement in 2014. Then, in 2017, noting that USAA wanted to "work toward recovering the investment" the institution made in RDC technology, USAA began sending letters to financial institutions via a law firm called Epicenter Law. In more recent months, credit unions have also started to receive similar correspondence.

Specifically, the letters "invite" the credit union to pay a licensing fee (unspecified in amount) to patent USAA's rights that are allegedly infringed by the credit union's RDC program. While the letters stress that the attorneys "are not litigation counsel" but rather focus on negotiating "patent licensing deals," the issue is still raising questions from credit unions.

If you receive a letter or have questions on this topic, a good place to reach out is to the credit union's RDC vendor(s). The credit union's agreement with the particular vendors may address indemnification in these kinds of claims. Our understanding is that at least some vendors have taken the position that their technology is not infringing on USAA's patents, and some vendors have even taken the position that they are not aware of any patent infringement by the vendor's technology – but that position may vary from vendor to vendor. NAFCU continues to monitor this issue and will keep members posted of any activity that develops.

ADA Motion to Dismiss. A federal judge in Virginia issued an order granting a credit union's motion to dismiss in a case claiming the credit union's website was not compliant with the ADA. NAFCU filed an amicus brief in this case supporting the credit union's arguments and continues to fight for credit unions on this issue. Credit unions can find more information on ADA website litigation here.

Lawyer Dog. Sometimes I wonder how much English my dog actually understands. I spend a large portion of my evenings policing Lemmy so he will not steal Nolan's food. Last week, I sternly told Lemmy to go to bed because he came pretty close to taking a PB&J from Nolan. Lemmy interpreted my order and went to bed but this is the barest of compliance, in my opinion.

OFAC Blacklists the "Thieves-in-Law" Crime Syndicate; January 2018 BSA Blast

Written by Shari R. Pogach, Regulatory Paralegal

Thieves-in-Law, another organized criminal network to be on the lookout for.  And, no, this is not a joke..................

Late last month, the U.S. Department of the Treasury's (Treasury) Office of Foreign Assets Control (OFAC) announced it was targeting one of Russia's oldest and most notorious organized criminal gangs – "Vory v Zakone" or "Thieves-in-Law" (Thieves).  The announcement indicated the criminal network was being targeted for "its involvement in serious transnational criminal activities" across the globe. Ever heard of them?  I hadn't.

As a group, the Thieves-in-Law originated in the former Soviet Union's Stalinist prison camps and gulags.  This Wikipedia entry provides some history along with the rules of conduct for its members.  Members are required to have served several jail sentences, not allowed to get married and take an oath to uphold the group's code that includes living only off their criminal profits and supporting other Thieves members.

Now, apparently, its members are the heads of a vast underworld network that has spread throughout the former Soviet Union, Europe and the United States to the great financial centers.  As a criminal organization, it has engaged in money laundering, extortion, bribery, robbery, identity theft and trafficking.

Individual Thieves engaging in criminal activity in the United States have been targeted by U.S. law enforcement before, but Treasury's designation of the whole network as a "Transnational Criminal Organization" is the first action to treat them as a single group. As OFAC Director John E. Smith stated, “Treasury is designating the Thieves-in-Law as part of a broader strategy to disrupt the financial infrastructure of transnational criminal organizations that pose a threat to the United States and our allies.”      

The Treasury action also targeted 10 individuals and two entities linked to the Thieves-in-Law organization.  This action generally prohibits U.S. persons from conducting financial or other transactions with these individuals and entities, and freezes any assets they may have under U.S. jurisdiction.

***

BSA Blast.  It's 2018 and the first quarter January issue of the BSA Blast is now available. (NAFCU login required).  The articles in this issue cover: 1) a Texas community bank's civil money penalty lesson on the importance of "Knowing Your Customer"; and 2) Citibank's banking regulator fines it $70 million for not correcting its BSA/AML compliance issues.  The BSA training quiz included in this issue focuses on Currency Transaction Reports (CTRs).

314(b): Beware of Oversharing

Written by Jennifer Aguilar, Regulatory Compliance Counsel

Under section 314(b) of the Patriot Act, credit unions, and other financial institutions, are permitted to share information with one another regarding individuals they suspect may be involved in terrorist or money laundering activities. Those institutions who elect to share information under 314(b) are provided with a safe harbor from liability if they notify FinCEN of their intent to share, verify that the institution with whom it will share information with has also notified FinCEN of its intent to share, use the shared information only for the permissible purposes and have procedures in place to protect the shared information. See, 31 C.F.R. § 1010.540(b).

One question that often comes up for 314(b) sharing is what type of information can be shared under the safe harbor. Of course, any information directly related to possible terrorist and money laundering activities may be shared, but what about other types of suspected criminal activities, such as fraud? Information about these types of activities can be shared under the 314(b) safe harbor, but only in certain circumstances. FinCEN guidance in this area can be a bit confusing so it's helpful to break it down into a few steps to determine when credit unions are permitted to share information about these types of activities:

1. Whether the credit union suspects a specified unlawful activity has occurred;
2. Whether a transaction involving the proceeds from that activity has taken place; and
3. Whether that transaction is part of a terrorist or money laundering scheme.

First, what types of activities are considered "specified unlawful activities" (SUAs)? FinCEN guidance points to the Patriot Act to determine which activities are SUAs. The Act defines a "specified unlawful activity" rather broadly to include financial transactions resulting from the distribution of controlled substances or extortion, fraud, bribery, trafficking and counterfeiting, as well as many other federal criminal offenses. See, 18 U.S.C. § 1956(c)(7). So, the first step in determining whether information can be shared under 314(b)'s safe harbor is to review the activity involved and establish that a SUA has occurred or that the credit union suspects a SUA has occurred.

Second, has a transaction involving the proceeds from a SUA taken place? FinCEN 2009-G002 explains that a credit union may share information if it "suspects that the transaction may involve the proceeds of one or more SUAs." This phrasing is important because it establishes the fact that the credit union must first suspect that a SUA has occurred. Additionally, FinCEN 2012-R006 explains that a credit union may not share information solely to determine whether a SUA has occurred. This means that sharing in order establish a suspicion that a SUA has occurred is not permissible; sharing is only permitted once the credit union has already established that it suspects a specified unlawful activity has occurred.

For example, suppose John Doe is a pusher for Jane Doe's international drug operation. John sells the drugs then deposits the proceeds at ABC credit union. Under FinCEN guidance, ABC may not share information in order to determine whether the proceeds came from drug sales. However, ABC may share information once it suspects that the proceeds are from drug sales.

Finally, is the transaction part of a terrorist or money laundering scheme? FinCEN 2009-G002 explains that the purpose of 314(b) sharing is "to identify and report activities that the financial institution 'suspects may involve possible terrorist financing or money laundering.'" Even if the credit union suspects that a transaction involved the proceeds from an SUA, it may only share information if it also suspects that the SUA relates to terrorist or money laundering activities. In the fraud context, this means that even if the credit union suspects a fraud has occurred and there is a transaction involving the proceeds from that fraud, the credit union may only share information about that fraud if the credit union also suspects the fraud is part of a terrorist or money laundering scheme.

When it comes to sharing information about SUAs, a credit union would need to review all the facts involved and ensure that all three elements have been satisfied: the credit union knows or suspects a SUA has occurred, a transaction involving the proceeds from that SUA has occurred and that transaction is part of terrorist or money laundering activities. It is important that all three of these elements are present in order to stay within the 314(b) safe harbor. Sharing information about fraud may be important to help prevent further harm, but, if the fraud does not relate to terrorist or money laundering activities, a credit union may lose its safe harbor protection by oversharing. This of course does not mean that the credit union cannot do anything – state law may allow the credit union to report the fraud to the local police and, depending on the circumstances, a SAR may be appropriate.

Some Things Never Change: HMDA Commercial Loan Reporting; So, I heard something juicy...a Note from Carrie Hunt

Written By Reginald Watson, Regulatory Compliance Counsel

HMDA has switched from a purpose-based standard to a dwelling-secured rule in terms of scope for loans where the credit union has taken "final action" on or after January 1, 2018; however, there is an exception for business purpose loans that has been tripping up some of our members as they adjust to the new normal. Fear not, some things just don't change. This blog will discuss how to address business loans in this new landscape and the particular issues that arise with loans for mixed-use (residential and commercial) purposes.

Under the old Regulation C, closed-end, business or commercial purpose loans made to purchase, refinance or improve a dwelling were reportable under HMDA. While the CFPB shifts transaction coverage away from the purpose-based scope for consumer loans in new Regulation C, it does not do so for commercial or business purpose loans. Instead, it retains the same purpose-based scope of reportable business or commercial purpose transactions by excluding all other business or commercial loans or lines of credit not made for the three specific purposes of home purchase, refinancing, or home improvement. Thus, a closed-end mortgage loan or an open-end line of credit that is, or will be, made primarily for a business or commercial purpose is excluded from the new definition of a covered loan, unless the loan or line of credit is a home purchase loan, a home improvement loan or a refinancing as defined in the new section 1003.2.

To figure out whether to use the dwelling-based approach versus the purpose-based approach, the credit union in each case may look to whether a closed-end mortgage loan or an open-end line of credit is for a business or commercial purpose. This analysis might be simple in many cases, but gets a little trickier in "mixed-use" situations where a property is used for both residential and commercial purposes, for example, a loan to improve the heating system in a building containing apartment units and retail space.

The new HMDA rule clarifies that a property used for both residential and commercial purposes is a dwelling if the property's primary use is residential. The rule also grants credit unions the discretion to use any reasonable standard to determine the primary use of the property on a case-by-case basis. Here is the commentary for reference:

4. Mixed-use properties. A property used for both residential and commercial purposes, such as a building containing apartment units and retail space, is a dwelling if the property's primary use is residential. An institution may use any reasonable standard to determine the primary use of the property, such as by square footage or by the income generated. An institution may select the standard to apply on a case-by-case basis.

There is some discussion in the preamble to the rule as well but not much on what might be a "reasonable standard." However, the rule contains a similar provision for determining whether a loan is for agricultural purposes, so while not directly on point, that preamble discussion may be somewhat informative.

Sometimes credit unions also ask about loan purpose. That's a bit of a different issue, but the commentary to new section 1003.3(c)(10) indicates that section 1026.3(a) of Regulation Z and its commentary inform whether the loan is for business or commercial purposes.

***

So, I heard something juicy…A note from Carrie Hunt, NAFCU EVP of Government Affairs and General Counsel

At NAFCU we hear a lot of rumors- some true and some just pulp fiction.  Part of what we do is to figure out fact from falsehood.  One of our latest pieces of intel came from the Sunshine State.  We were hearing there was some new law or rule in Florida that was restricting credit union expansions to 5% of a county's population.  So, upon slicing in, we discovered that there is no formal rule/statute limiting a field of membership expansion to 5 percent of a county’s population.  HOWEVER, the Florida Office of Financial Regulation (OFR) may limit expansion on a case-by-case basis.  It seems that their concern is that a credit union with a field of membership of only 5,000, trying to expand to a field of membership of 100,000, would be too extreme of a move. As a result, the Florida OFR sometimes set limits based on the population size depending on how many members the credit union currently serves. 

Hmm.  I would prefer the fruit to ripen on the tree before being picked.

The Circle of Life: Federal Considerations for Member Decedents

Written by: André B. Cotten, Regulatory Compliance Counsel

Hello Compliance Friends! Over the holidays, I had a chance to relax, travel and check out some old and new films. One of my favorite movies will forever be Disney's The Lion King. The death of Mufasa will forever pull at my six-year old heart strings.  Today's blog will talk about what to do when Mufasa Member finds himself in a wildebeest stampede and the circle of life suddenly closes.

As compliance practitioners, I am sure that you are aware a lot of these issues would need to be discussed with your local counsel because they directly involve state law issues. However, I have highlighted some NCUA specific and federal law issues that may serve as helpful reminders. I have segmented this post according to subject areas for your convenience.

Accounts

The FCU Model Bylaws contain the following provision with regard to keeping a deceased member’s account open. You may want to review your credit union’s bylaws for a similar provision.

“(d) The share account of a deceased member (other than one held in joint tenancy with another member) may be continued until the close of the dividend period in which the administration of the deceased's estate is completed.” 12 CFR 701, App. A.

(emphasis added)

The bylaws do not address closing an account and re-opening a new one. On the other hand, an account held in joint tenancy can remain open. If it is determined that the joint tenant is not a member in his/her own right but within the credit union's field of membership, then the person would need to become a member so that the credit union would not impermissibly be offering services to a nonmember.Note, insurance may end six months after death of a member unless the account is restructured

Moreover, after a member dies, the credit union still has the responsibility to protect member funds and information. To begin, under many states' laws, absent a named beneficiary, the funds of the account are a part of the deceased member’s estate. Therefore, a credit union may need to avoid releasing the funds until the qualified representative of the estate has been named by a court or according to the applicable state’s probate laws. 

Account information is considered non-public personal information and therefore cannot be disclosed without providing an opt-out notice, unless the disclosure falls under one of the exceptions. Note, non-public personal information may be disclosed to a person holding a legal or beneficial interest relating to the member, and to persons acting in a fiduciary or representative capacity on behalf of the member.

Lastly, before closing a member account, the credit union may want to proceed with caution. Depending on its respective policy, the credit union may want to flag on the account that the owner has died, and then allow a period of time for any surviving owners or the member's estate to take ownership of the matter. The documents needed to close an account will depend on state law, the account agreement and the credit union's internal policies and procedures.

Tax Issues

To begin, one concern from a federal perspective is that having continued tax reporting of a member's social security number after the person's death can cause tax complications. Although, this may not always be possible if Mufasa Member dies later in the tax year. IRS Publication 559 contains an overview of issues involving deceased persons, and while aimed at executors of estates, has some helpful information about Form 1099.

In addition, the credit union should note that a discharge of indebtedness under a settlement agreement between a credit union and a debtor or a debtor's estate is an "identifiable event" that triggers the obligation to file Form 1099-C.  The instructions for Form 1099-C may be accessed here.

Loans

With regard to credit, the credit union's options would be determined by state law, the loan agreement, and the specific situation. Often, if the decedent was the only borrower, the credit union could be looking at making a claim against the estate.  Even though someone may be making loan payments, unless they are contractually obligated to make those payments, the credit union may want to see if an estate has been established (or if there’s some other claim that should be made, for example, if the member had life and disability insurance under which a claim could be made).  Absent a will, state law will determine the disposition of the decedent’s assets to heirs, including vehicles and real property. Often, heirs have to decide if they want to keep an asset (and likely refinance the loan), or if they want to sell the asset to pay off the credit union’s loan, etc.

In regards to mortgage loans, a lot of mortgages include due-on-sale clauses which allow the lender to call the loan upon the death of the borrower; however, there are situations in which a due-on-sale clause cannot be exercised – for example, if the property is transferred under joint tenancy.

This is the section of NCUA’s rules and regulations that references due-on-sales clauses.  Note the general prohibition on exercising a due-on-sales clause where property is transferred on the death of a joint tenant or tenant in the entirety, or transferred to a spouse or children, as discussed in 12 CFR 701.21(g)(6). Overall, this is a fact specific analysis that the credit union may want to review with local counsel.

Special Issues

There is a rule that Social Security benefits are not paid for the month that Mufasa Member dies. Here is the Social Security Regulation:

Ҥ404.311 When does my entitlement to old-age benefits begin and end?

[…]

(b) We will find your entitlement to old-age benefits ends with the month before the month you die.”

This seems unfair and actually legislation has been introduced in the past on this topic but the way the rule is written, even if a member dies on the last day of a month, the member is not entitled to Social Security benefits for that entire month. Here is an excerpt from a Social Security guide:

“If the deceased was receiving Social Security benefits, you must return the benefit received for the month of death or any later months. For example, if the person dies in July, you must return the benefit paid in August. If benefits were paid by direct deposit, contact the bank or other financial institution. Request that any funds received for the month of death or later be returned to Social Security. If the benefits were paid by check, do not cash any checks received for the month in which the person dies or later. Return the checks to Social Security as soon as possible. However, eligible family members may be able to receive death benefits for the month in which the beneficiary died.”

There is guidance with regards to check reclamations specifically. The Social Security Program Operations Manual has a section on electronic funds transfer reclamations and a section on check reclamations.

The Department of Treasury’s Green Book  also addresses check reclamations more specifically including how to reply to a "Notice of Reclamation" and when there may be a right to protest.

***

As I previously mentioned, when the circle of life closes on a member, there are numerous state law issues that are implicated, and a credit union will need to consult with local counsel to determine how best to draft and modify its policies. However, there are some NCUA and federal law issues that are implicated when a member dies, and credit unions will need to maintain policies that strike a balance between state law, federal regulations, and the business needs of the credit union.

Editor's Note: As helpful insight from a blog reader, I added information about NCUA's 6-month grace period for decedent accounts. I modified this post on Friday, January 19, 2018 to provide a more through legal analysis and to be a more complete resource for NAFCU's members.

Upcoming ACH Rules And Resources

Written By Stephanie Lyon, Regulatory Compliance Counsel

NACHA has been fairly busy these past few years finalizing and updating rules, issuing bulletins and seeking industry comments for new rules to make ACH transactions faster. A couple of ACH rule deadlines are looming, so it is a good time to review these rules, highlight resources and give you a heads up on things you may have missed from last year.

Same Day ACH Phase 3

Most credit unions that originate ACHs are well aware of the Same Day ACH rule that was passed a couple of years ago to expedite the sending and receiving of ACHs. As of today, the deadlines for Phase 1 and Phase 2 are long gone, paving the way for the effective date of March 16, 2018 for Same Day ACH Phase 3. Folks, this is only 58 days away!

Here is a table that details the different requirements of each implementation phase, highlighting Phase 3 requirements:

As noted on the table, the current NACHA requirement under Phase 2 is that credit unions give credit for same day ACHs by the end of the credit union's processing day. You can review Phase II requirements in more detail in this previous blog. Phase 3 establishes a more streamline funds availability timeline that requires Receiving Depositary Financial Institutions (RDFIs) to make same day ACHs credits available for withdrawal by 5:00pm RDFI's local time. While becoming an ACH originator is still optional, credits unions that receive ACHs are all bound by this requirement.

To make the process of complying with Phase 3 easier, NACHA published several resources available in its Resource Center, including its revised Guidance for RDFIs on Meeting Phase 3 Requirements. The guidance is especially helpful in determining the credit union's local time in cases where the RDFI's geographic footprint is not limited to one time zone.

Third-Party Sender Customer Due Diligence

Another ACH compliance deadline that is also around the corner is the registration of Third-Party Sender members by March 1^st, 2018. This requirement became effective in September 2017 to promote consistent customer due diligence among all Originating Financial Institutions (ODFIs). The rule generally requires that all ODFIs register their Third-Party Sender members or, in the alternative, confirm that the ODFI does not have any Third-Party Sender members. See, revised NACHA Op. Rules, Art. II, 2.15.1.

NACHA rules define a Third-Party Sender as "an organization that is not an Originator that authorized an ODFI or a Third-Party Service Provider to transmit, for its account or the account of another Third-Party Sender a credit entry, debit entry, or non-monetary entry to the Receiver’s account at the RDFI." As part of the rule, NACHA expects that credit unions will have effective procedures to determine if a corporate/business member is a Third-Party Sender. If the credit union is unsure whether a member is considered a Third-Party Sender, it may want to use NACHA's Third-Party Sender Identification Tool for assistance with this determination and/or contact their counsel.

The registration process for Third-Party Sender members can be found here. Some of the information required to be disclosed will be:

• The ODFI’s name and contact information;
• the name and principal business location of the Third-Party Sender;
• the ODFI’s routing number used in ACH transactions originated for the Third-Party Sender member; and
• the company identification(s) of the Third-Party Sender. 

Note that if for some reason the credit union later discovers an unregistered Third-Party Sender member, the credit union will have 10 days from the date it discovers the member to register them in the database.

Aside from the initial registration, the NACHA rules will also require supplemental registration for Third-Party Sender members if the credit union receives a request from NACHA for additional information. See, revised NACHA Op. Rules, App. 8, Pt. 8.4. The rule only gives the credit union 10 banking days to respond to supplemental information request so the credit union may want to obtain this information for all Third-Party Sender members ahead of time to avoid having to chase down this information later on.

Among the supplemental information that can be requested by NACHA is:

• Any doing-business-as names, taxpayer identification number(s), and street and website address(es) of the Third-Party Sender;
• the name and contact information for the Third-Party Sender’s contact person;
• names and titles of the Third-Party Sender’s principals;
• the approximate number of Originators for which the Third-Party Sender transmits entries; and
• a statement as to whether the Third-Party Sender transmits debit entries, credit entries or both. 

Additional information on Third-Party Sender registration requirements can be found here and in ACH Operations Bulletin #2-2014: ACH Transactions Involving Third-Party Senders and Other Payments Intermediaries.

Recent ACH Operations Bulletins

Towards the end of the year, NACHA release a couple of Operations Bulletins that may have flown under the radar. The first one is ACH Operations Bulletin #3-2017, released September 2017. Unlike most NACHA Operations Bulletins, this was not made public because it details fraud mitigation strategies for social media schemes. Each NACHA member should have received this bulletin, but if for some reason you cannot find it, you may want to contact NACHA to get a copy.

The second Operations Bulleting was #4-2017, issued November 2017. The bulletin provides risk mitigation strategies for consumer-to-other-consumer (C2C) debits for financial institutions and their service providers. Something to note from this bulletin is that "NACHA strongly discourages ODFIs from facilitating these payments unless the ODFI is certain of its full compliance with all rules that apply to the origination of all ACH debits, regardless of the nature of the Originator." So if your credit union is considering offering C2C debits, this is a good bulletin to keep in mind when establishing internal controls.

Finally, NAFCU recently hosted a webcast on ACH Operating Rules in 2018 that is available on-demand and goes over all these rule changes as well as NACHA rule proposals and available resources.

Tax Reform Questions; Programming Note

Written by Brandy Bruyere, Vice President of Regulatory Compliance

On December 15, 2017, Congress passed the Tax Cuts and Jobs Act (TCJA). NAFCU advocated for credit unions' interests all year while tax reform was high on Congress' agenda, and the credit union tax exemption remained intact, even with the substantial reforms to the tax code. However, the TCJA did make some changes impacting credit unions. NAFCU put together a summary of these changes that may help folks in various areas of your credit union, but here's a few questions the NAFCU compliance team has been receiving from members.

What happened to the home equity interest deduction?

One of the changes in the TCJA that has caused confusion relates to the extent that interest paid on "home equity" loans is deductible. Some news outlets reported rather generally that home equity interest is no longer deductible under the TCJA, but it seems to be more complicated than that. The tax code distinguishes between "acquisition indebtedness" and other "home equity indebtedness." Of note, loans that a borrower takes out to "substantially improve" a property fall into the "acquisition" category, so it seems this home loan interest will remain deductible. However, a loan that accesses home equity for other purposes, such as to finance the purchase of a vehicle, would not be deductible through 2025.

Do we have to pay excise tax on certain compensation?

Another change is that credit unions will be subject to an excise tax on compensation in excess of $1 million. This will apply to an organization's top 5 highest paid employees – although that group can, over time, actually include more than five employees because that "club," so to speak, has permanent membership. If an employee is in the top five paid staff in 2018, but falls out of the top five in 2019, that person is still categorized as "top five" under the code. The rate for this excise tax is the corporate tax rate, which is 21% under the TCJA.

"Compensation" means pay that is reportable in box 1 of an employee's W-2 and for which there is not a "substantial risk of forfeiture" of that income. From talking to credit unions, it seems that some deferred compensation from 457(f) plans vests in one single year, which is where some credit unions may have staff that reach this $1 million threshold. Others have a different vesting dates which can help manage to what extent compensation may exceed that $1 million threshold, since the year the deferred compensation vests is the year it is counted as compensation for purposes of these rules. Also of note, distributions from 457(b) plans and 401(k) plans are excluded from this threshold.

The TCJA also removes an exemption from excise taxes for non-profit institutions relating to certain excess parachute payments to any employee that is "highly compensated" under the IRS definitions for qualified plans, which is a salary of $120,000 or more in 2018. Apparently these payments are those made when an employee leaves the organization, and equal or exceed three times the employee's annual salary.

NAFCU is reaching out to the IRS to discuss the need for guidance and clarification with the implementation of these provisions.

Related Note – Private Mortgage Insurance

The deduction for private mortgage insurance expired on December 31, 2016. Many credit unions are in the process of providing the data needed to produce 1098 forms for members by the end of the month in order to comply with IRS reporting requirements. The TCJA did not extend the PMI deduction, but a bill was introduced in Congress to extend some deductions, including the PMI deduction. If passed, PMI paid in 2017 could become deductible. While NAFCU's Legislative Affairs Team sees support for this bill on Capitol Hill, Congress is tackling some issues that are very politically charged, such as immigration and border security. The bill could pass, but perhaps not in time for credit unions to meet the January 31 deadline for 1098 reporting.

NAFCU called the IRS helpline for 1098 reporting and confirmed that so long as the law does not allow the deduction of PMI, this box should not be completed on the 1098. However, if Congress were to pass a bill making PMI deductible for 2017 at a later date, the IRS may issue guidance on how to proceed but helpline staff stated that one likely outcome is that 1098 reporters may need to file amended 1098 forms to reflect PMI paid in 2017. The IRS will update www.irs.gov/Form1098 as the situation develops.

Programming Note - Martin Luther King Jr. Day

NAFCU's offices will be closing at noon on Friday and all day on Monday in recognition of Martin Luther King Jr. Day on January 15th. We will be back to  blogging on Wednesday, January 17th.

Marijuana Banking Just Got More Complicated

Written by Pamela Yu, Special Counsel for Compliance and Research

Well, we can't say we didn't see this coming...we blogged back in March, 2017 on what the change in administration might mean for marijuana banking, and the federal government announced a change in its policy towards marijuana enforcement late last week.

U.S. Attorney General Jeff Sessions changes DOJ's position on marijuana.

In a move long forecasted by many legal and policy observers, last Thursday the attorney general issued a memorandum to rescind Obama-era guidance on federal enforcement of marijuana. Released just days after California became the latest (and largest) state to begin sales of recreational marijuana, the memo directs "all U.S. Attorneys to use previously established prosecutorial principles," in marijuana enforcement, thus eliminating the already-limited guidance that provided some measure of direction in navigating the conflict between federal illegality and state legality of marijuana. This policy shift will significantly heighten risks for credit unions serving state-authorized marijuana-related businesses or operating in states with legalized cannabis.

Sessions' memo rescinds a 2013 directive, written by then-Deputy Attorney General James M. Cole, which instructed federal prosecutors to focus its marijuana enforcement efforts on eight priorities, including keeping marijuana out of the hands of minors and black market criminals and cartels.  It also rolls back a 2014 Cole memo that directed U.S. Attorneys to apply the same eight enforcement priorities in prosecuting financial crimes based on transactions involving marijuana proceeds.  The so-called Cole memo guidance had cleared up some of the uncertainty about how federal prosecutors would address the conflict of laws as states began allowing sales of marijuana for medical and recreational use. 

Today, 29 states and the District of Columbia (DC) permit medical marijuana and, of those, eight states and DC also allow adult-use recreational marijuana. A recent Gallup poll shows that public support for the legalization of marijuana is at an all-time high, with 64 percent of Americans favoring legalization, including for the first time a majority of Republicans (51 percent now support legalizing marijuana).  Nevertheless, marijuana remains a schedule 1 substance under the federal Controlled Substances Act. Thus, a litany of federal criminal statutes may be implicated for credit unions handling marijuana-related funds.

So what does this mean for credit unions?  In short, providing financial services in states where marijuana is legal under state law just got a lot more complicated. 

Marijuana Banking

At this point, is unclear whether the rescission of the Cole memo guidance will mean a federal crackdown on state-sanctioned marijuana.  The roll-back of formal guidance with respect to marijuana enforcement has created a policy void (note that the memo eliminates prior directives but does not replace them with new guidance) but it is too soon to tell if enforcement will significantly increase.  In effect, the Sessions memo empowers the country's 93 U.S. Attorneys to exercise prosecutorial discretion in their respective jurisdictions. We don't know how prosecutors will use this discretion—some jurisdictions may take a more aggressive enforcement posture while others may not—but the door is now open for federal officials to carry out enforcement against marijuana activities in states that have legalized cannabis.  This creates significant legal uncertainty for credit unions that have been serving marijuana-related businesses under the auspices of the Cole memo guidance. 

There are some existing barriers to marijuana enforcement that remain in place.  For example, the Rohrabacher-Blumenauer (also known as Rohrabacher-Farr) appropriations bill provision that has been in place since December 2014 prohibits the Department of Justice (DOJ) from using federal funds to prevent states "from implementing their own state laws that authorize the use, distribution, possession or cultivation of medical marijuana."  However, the provision must be renewed each fiscal year in order to remain in effect and its protections apply only to medical marijuana, leaving particularly vulnerable those credit unions operating in recreational states.

 BSA Compliance

 In 2014, as a supplement to the Cole memo on marijuana-related financial crimes, the Financial Crimes Enforcement Network (FinCEN) issued guidance to clarify "how financial institutions can provide services to marijuana-related businesses consistent with their BSA obligations." See, FIN-2014-G001.   Despite limited protections, together the Cole memos and FinCEN guidance created a framework for credit unions to serve marijuana-related businesses consistent with their legal and compliance obligations. 

However, as we previously cautioned, FinCEN's guidance depends heavily on the enforcement posture articulated in the Cole memos. Now that those memos have been reversed, credit unions can no longer rely on the FinCEN guidance for serving marijuana-businesses, significantly heightening BSA compliance risks. To add fuel to the fire, some credit unions may now be questioning whether their compliance with FinCEN's 2014 instruction to file either a "Marijuana Limited," a "Marijuana Priority," or a "Marijuana Termination" suspicious activity report (SAR) for each transaction involving marijuana-related funds has created a damning paper trail for federal prosecutors.  FinCEN and the DOJ have yet to offer any assurance that SARs issued under FIN-2014-G001 will not be used to prosecute financial crimes, even against those who relied on the guidance in good faith.  While it is perhaps unlikely that marijuana SARs will be used as evidence for the widespread prosecution of financial institutions, it is not outside the realm of possibility that federal authorities could make an example out of a bank or credit union to send the message that federal marijuana enforcement priorities have changed. Regardless, the increased liability and compliance risk will certainly have a chilling effect on the ability for credit unions to provide services to marijuana-related businesses. It is likely FinCEN will release additional guidance or information soon in light of these changes.

Momentum for Change

On a more optimistic note, Thursday's rescission may create momentum for congressional action on marijuana.  Marijuana banking advocates on the Hill have been challenged in mobilizing change.  The uncertainties created by Sessions' action could actually galvanize support in Congress to find a legislative solution to the conflict between federal and state drug laws. With support for marijuana protections in both parties the attorney general's tougher stance on marijuana could—ironically—become the impetus for a statutory solution for marijuana banking.

Breaking Down the TRID Fix: Rate Lock Revised LEs Are One and Done

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

How's 2018 treating you so far, credit union compliance world?

My year started out right. Last week, I contacted the CFPB through their Regulatory Inquiry website and got a call back same day. That's a response time that the NAFCU Regulatory Compliance Team can appreciate. And the informal answer from the Bureau: you don't have to do any extra work unless you want to. So I'm batting a thousand so far.

The Question: Rate Lock Revisions and the 2013 Preamble

Subsection 1026.19(e)(3)(iv) describes when a revised Loan Estimate can be used to reset tolerances. The subsection contains five paragraphs describing five sets of circumstances where a revised Loan Estimate can be issued and used to reset tolerance for good faith purposes. Four of these circumstances are permissive, meaning that a revised Loan Estimate can, but is not required to be, issued. In other words, if the credit union decides that reissuing the Loan Estimate is not worth the cost, it can chose not to, though it won't be able to reset tolerances due to the event.

One of the circumstances is not voluntary, it's required. That's paragraph 19(e)(3)(iv)(D). If the rate was not locked when the initial Loan Estimate was provided, and the applicant locks in the rate, a revised Loan Estimate is mandatory. The language of this paragraph is quite specific:

"(D) Interest rate dependent charges. The points or lender credits change because the interest rate was not locked when the disclosures required under paragraph (e)(1)(i) of this section were provided. No later than three business days after the date the interest rate is locked, the creditor shall provide a revised version of the disclosures required under paragraph (e)(1)(i) of this section to the consumer with the revised interest rate, the points disclosed pursuant to §1026.37(f)(1), lender credits, and any other interest rate dependent charges and terms.” 12 C.F.R. § 1026.419(e)(3)(iv)(D) (Emphasis added).

Nothing in the regulation or the commentary directly addresses what happens when a rate lock agreement is entered into, the rate is locked, and then the lock expires. The 2013 preamble to original TRID referenced rate lock expiration, but only very briefly:

"Upon a review of the proposed rule text and commentary, the Bureau acknowledges that the  requires redisclosure where a rate lock agreement does not exist. But the Bureau intended that § 1026.19(e)(3)(iv)(D) only applies in situation where a rate lock agreement has been entered into between the creditor and borrower, or where such agreement has expired." 79 Fed. Reg. 79833 (Emphasis added).

But as you can see, paragraph 19(e)(3)(iv)(D) is pretty narrowly drawn. Reading a requirement into that paragraph to redisclose at the time a locked rate expires would be difficult to do.

The Answer: TRID Fix and Informal Guidance from the Bureau

In the TRID Fix amendments, the Bureau sought to clarify that the requirement to issue a revised disclosure under paragraph 19(e)(3)(iv)(D) would not apply repeatedly. In the preamble, the Bureau stated:

"When a revised Loan Estimate is provided as required by § 1026.19(e)(3)(iv)(D), the rate lock information disclosed pursuant to § 1026.37(a)(13)(i) must be updated to reflect the expiration date of the interest rate disclosed, regardless of any changes to the disclosed interest rate or interest rate-related charges. Once the interest rate is subject to a rate lock agreement, § 1026.19(e)(3)(iv)(D) does not subsequently require the disclosure of a revised Loan Estimate." 82 Fed. Reg. 37682 (Emphasis added).

So, no revised Loan Estimate is triggered under paragraph 19(e)(3)(iv)(D) when the rate lock expires. A change in circumstances may exist allowing a revised Loan Estimate to be issued and used to reset tolerances under another paragraph in subsection 1026.19(e)(3)(iv), but that would be at the credit union's option.

However, we still wanted to check on another variable. What if a second rate lock agreement is entered into with the borrower regarding the same application? Would each rate lock agreement create a new obligation to issue a revised Loan Estimate each time the rate was locked?

The Bureau's informal guidance indicated that the answer was no. The Bureau stated that paragraph 19(e)(3)(iv)(D) would apply only once. If the rate is locked again or the rate expires again, the credit union may wish to issue a revised Loan Estimate for the borrower's information and to ensure clarity; or it may wish to issue a revised Loan Estimate under another paragraph in subsection 1026.19(e)(3)(iv) to reset tolerances; but it is not required to do so by the regulation.

Good to know!

 

FinCEN SAR Stats; Sessions Releases Marijuana Memo; Request for BSAAG Nominees

Written by Shari R. Pogach, Regulatory Paralegal

Have you ever wondered what happened to the Financial Crimes Enforcement Network's (FinCEN) Suspicious Activity Report Statistics (SAR Stats)?  Well the data is still available; it's just gone totally interactive.

If you go to FinCEN's website www.fincen.gov, you can find a link for "SAR Statistics."

This link goes to the interactive report generator page:

 


The drop down boxes allow for filtering of the statistical data according to:  industry type; year & month; suspicious activity category/type; states/territories; county/metro & micro area; instrument type(s)/payment mechanism(s); product type; relationship; and regulator.  Each drop down allows for all, one, or multiple filter categories.  Once you have determined your filters, you can then generate a report and export it to a CSV file or to a PDF for further study.

FinCEN's FAQ/Glossary page cautions the statistics are:

"Statistical data for SARs are updated as information is processed and refreshed data is periodically made available for this tool. For this reason, there may be discrepancies between the statistical figures returned from queries performed at different times. In addition, slight differences in query criteria may return different statistical results. Also note that the statistics generated by this tool do not include SAR fields that contain unknown or blank data. To the extent statistics including blank or unknown data are tabulated outside of this tool for other purposes, there may be discrepancies between statistics generated by this tool and those generated through other means. FinCEN makes no claims, promises or guarantees about the accuracy or completeness of the statistical figures provided from this tool and expressly disclaims liability for errors, omissions, or discrepancies in the statistical figures."

Still, the generated reports can indicate trends in your area, state or region of your part of the country and can be a useful additional resource for BSA compliance personnel.  The website indicates the data has been updated as of November 30, 2017.

***

Sessions Releases Marijuana Memo.  Attorney General Jeff Sessions released a memorandum on federal marijuana enforcement policy.  Basically the Department of Justice has rescinded the Obama administration policy of non-interference with marijuana-friendly state laws.  Look for more on this in a blog next week.

***

BSAAG.  FinCEN is asking for nominees for membership on the Bank Secrecy Act Advisory Group (BSSAG).  New members will be selected for three-year membership terms.  If you would like more information or are interested in having NAFCU submit you as a candidate, please email Senior Regulatory Affairs Counsel Michael Emancipator at [email protected] by January 15 as potential nominees must be submitted to FinCEN by January 26, 2018.

New Year, New Priorities: NCUA's 2018 Supervisory Priorities; New HMDA Tools Available

Written by Jennifer Aguilar, Regulatory Compliance Counsel

Welcome to 2018!

I hope everyone had a wonderful and safe holiday season. As we recover from our holiday hangovers, its time to start thinking about all the things we want to accomplish this year. Whether it’s a personal goal like finally taking that vacation you've been planning for the past five years, or a professional one like sharpening your skills by attending Regulatory Compliance Seminar, we all have our priorities for the year. NCUA is no different.

In the last letter to credit unions of 2017, NCUA outlined its examination priorities for 2018. While many of their priorities remain the same as last year, they added a few that are discussed below. As a starting point, here are the ones that haven't changed: internal controls and fraud prevention, interest rate and liquidity risk, commercial lending and the Military Lending Act. The new priorities are addressed below.

Cybersecurity Assessment. While this was an NCUA priority in 2017, NCUA announced that it will be implementing its Automated Cybersecurity Examination Tool (ACET) in 2018. This tool will allow examiners to assess a credit union's cyber preparedness and will be used in examinations for credit unions with more than $1 billion in assets. As the ACET is based off the FFIEC's Cybersecurity Assessment Tool (CAT), NCUA encourages credit unions to continue to use the CAT to self-assess their cybersecurity risks. NAFCU's Cybersecurity Compliance webpage provides a number of useful resources for credit unions, including our editable, self-tallying CAT Workbook (member login required) that was updated last month.

Bank Secrecy Act Compliance. BSA compliance was also a priority in 2017; however, NCUA has changed the focus of its examinations from money service businesses to the new customer due diligence regulations. These new requirements become mandatory May 11, 2018, so examiners will be assessing compliance beginning in the second half of 2018. NCUA recommends credit unions review its BSA webpage for additional information and resources. To assist credit unions with these new rules, NAFCU has blogged on the new rule, triggering events for account review and the technical amendments and has published an article on the new rule (member login required). FinCEN has also published a few FAQs on the new rule. We expect additional FinCEN guidance in the coming months.

Automobile Lending. Examiners will look more closely at those credit unions with higher risk auto lending programs. Higher risk programs are those with maturities over seven years, high loan-to-value ratios, near-prime or subprime loans or indirect lending programs. NCUA recommends credit unions review its supervisory letter on concentration risk for more information. For indirect lending programs, credit unions may also want to review NCUA's report on What to Look out for When Managing an Indirect Lending Program and Letter to Credit Unions 10-CU-05.

HMDA. As part of its 2018 priorities, NCUA announced that it will look for "good faith efforts to comply" with the new HMDA rules. While credit unions subject to HMDA are still required to collect and report data following the new rules, NCUA indicated that examiners will simply review LARs and help credit unions determine their compliance weaknesses in both data collection and reporting. As long as credit unions are making good faith efforts to comply with all the new requirements, examiners will credit those efforts. NCUA also announced that it will not cite violations nor require data resubmissions unless the errors are material. More information on NCUA's 2018 HMDA examinations can be found in last week's blog. Credit unions may find it helpful to review the CFPB's HMDA implementation and Resources for HMDA Filers webpages and NAFCU's HMDA Compliance webpage which includes a number of charts, articles and blogs on the new rules.

Overdrafts. Examiners will review credit unions' compliance with Regulation E's overdraft rules. Section 1005.17 provides a number of requirements for overdraft programs, including requiring members to opt-in before certain fees can be assessed. Model Form A-9 provides a sample opt-in form. While the 2018 priorities refer only to Regulation E, credit unions may also want to review the overdraft rules contained in the Truth in Savings rule. Section 707.4 requires overdraft fees to be disclosed in a credit union's account opening disclosures and section 707.11 requires overdraft fees be disclosed on periodic statements and provides rules for advertising an overdraft program. Credit unions may also find it helpful to review Letter to Credit Unions 05-CU-03 which includes NCUA's Interagency Guidance on Overdraft Protection Programs and NAFCU's blogs on overdraft programs.

* * *

New HMDA Tools Available. Last week, the CFPB announced that its check digit tool and its rate spread calculator are now available. The check digit tool provides the last two digits of the ULI and verifies the check digit is calculated correctly. More information on the check digit can be found in this prior NAFCU blog. The rate spread calculator provides the rate spread for a loan with a final action date of January 1, 2018 or later.