NAFCU Compliance Blog

Credit Union Disaster Recovery Plans

Written by Curt Long, Research Assistant

Each month NAFCU’s research staff publishes our Economic & CU Issues Monitor, which features analysis of macroeconomic and financial trends, as well as member survey data covering critical credit union topics.  This month’s report focused on disaster recovery plans.  Some of the key findings include:

• Most respondents (95.7 percent) test their business continuity plans annually, while the remaining credit unions (4.3 percent) test twice per year. Among those responding to the survey, nearly one-third (32.1 percent) have used their plans.
• Roughly one-third (35.3 percent) of respondents indicated that their credit unions intend to use mobile branching in the event of a disaster. Almost half of the respondents (49.1 percent) have arranged to share resources with other credit unions.
• More than 70 percent have a plan to restock ATMs with cash during a disaster. Furthermore, 14.6 percent of respondents plan to waive ATM fees for non-members.
• The economic recovery is in its third year, but growth will remain sluggish, slipping from its 2010 level of 2.8 percent to 1.6 percent. Among the 14 million currently unemployed workers, 44.6 percent have been out of work for six months or more. A much larger economic expansion is needed to reduce unemployment to a more normal level.

For a copy of the full report, click here (member login required).  To participate in the monthly survey, please e-mail the research staff at [email protected].

Disaster Preparedness

NCUA has a consumer site - mycreditunion.gov - that provides consumers with information about NCUA and credit unions. In an effort to reach spanish-speaking consumers, NCUA has announced the launch of its spanish version of this site.

NCUA also issued a note about its preparations for Irene, and takes this chance to remind credit unions to review their business continuity/disaster preparedness procedures. This is an excellent reminder as we generally don't think about these plans until a threat is imminent. But disaster preparedness plans work best when we test and re-test them and review them in light of lessons learned. In other words, they are ever-changing documents. If you haven't reviewed yours in awhile, NCUA issued some guidance during last year's hurricane season. Letter to Credit Unions 10-CU-10 and its enclosure provides some lessons learned and recommended resources for disaster preparedness plans.

This and That...

Posted by Anthony Demangone

Here are some things of possible interest.

BCP planning.  As you know, NCUA expects credit unions to conduct business continuity planning. (For a good resource, look at the FFIEC's BCP Booklet.)  Part of the BCP process is testing.  You build a plan, and then you try to poke holes in it.  But I think another way of testing is to look back at real-world events and see if you can learn from them and build those lessons into your BCP plan.  As I noted yesterday, DC had some nasty traffic issues recently due to winter weather.   One major part of the problem was that everyone left work in the DC region at the same time.  This created huge log-jams of traffic.  Couple the log-jam with weather, and you had quite a few people getting stuck.  (Try going up an icy hill in your car.  Hit the brakes, and then try to start moving again.  Good luck with that.) So, let's add this up: bad weather, lots of traffic, lots of cars that were stuck. Guess what happened?  People ran out of gas in the middle of the highway and simply abandoned their car.  Or people didn't have the necessary stuff in their car (sand, shovels, etc.) to get their car out of a jam, so they simply walked away.  Many of those folks did not come into work today, I guarantee that. Here's some possible take-away points that could have helped many.

• As soon as bad weather is predicted, fill your car's gas tank.
• If bad weather is predicted, plan a route to your home that doesn't involve hills. Or at least avoids the bad ones.
• If bad weather is predicted, make sure you have what you need in your car, including warm clothes, water, etc. 

This could be accomplished with a simple email to your staff once bad weather is on the horizon.  That won't solve every problem, but it will increase the likelihood that your staff makes it home safely.  Which means they'll be back at work sooner.

Current Issues in Credit Unions.  The latest issue of the podcast is now available.

Foreclosures.  Deutsche Bank made The New York Times for all the wrong reasons.   They foreclosed a mortgage in violation of the SCRA when a serviceman was away at war.  This article is a fantastic reminder of how important it is to understand the SCRA's protections, and the immeasurable reputation risks that can occur when you simply run blind to the SCRA's requirements. 

CFPB.  Treasury has announced the CFPB's legal eagle implementation team.   The group looks very impressive. (And I do detect a good deal of litigation experience.)

Have a great weekend, everyone. 

Internet Rumors; This and That; Das Twins

Posted by Anthony Demangone

A number of members emailed me to ask about a 1% tax on credit union and bank transactions.  There are quite a few emails circulating about the alleged tax, and some credit union members have voiced concerns that it will affect their Social Security checks, deposits, etc.  It certainly is an email that gets your attention.

There's no need to worry. The idea of a 1% tax was put into a bill, but the bill has no cosponsors and is not going anywhere.  Feel free to read more about the issue here, via Snopes.com.  

Let me share with you one of my personal tests.  I call it the "front page" rule.  If you get an email that makes amazing claims about a transaction tax, a tax on emails, or some other shocking thing, ask yourself this question: Have I seen this discussed on the front page of any newspaper?  If the answer is no, then you are likely looking at a hoax.  While email is wonderful, it generally is not the source of breaking news. Especially when forwarded by your Aunt Susie.

***

You Snooze, You Lose.  We have a packed house for the 2010 Regulatory Compliance Seminar in Grapevine, Texas.  Unfortunately, we've had to close registrations for the upcoming conference. 

My Name is Earl.  The hurricane making its way up the East Coast is a good reminder to review NCUA's most recent guidance on hurricanes and disaster preparedness.  It is Letter to Credit Unions 10-CU-10.  If you are in the path of the hurricane, please stay safe.

Share Insurance.  Not all of Dodd-Frank is bad.  The law made the $250,000 share insurance level permanent.  NCUA has issued a final regulation to amend its share insurance and official sign regulations as a result.

Das Twins.  OK, I know many of you only glance at this blog occasionally to look for any new photos of Kate and Briggs.  They are 17 months old now, and they have become experts at:

• Running into any sharp-edged piece of furniture
• Throwing food as far as they can the moment they are done eating
• Knowing when to use a smile to get their way, or a well-timed burst of screaming

Here are some recent shots:



Have a great weekend, everyone.  Even you Youngstown State fans.

Sunburned This and That...

Posted by Anthony Demangone

I'm back from the beach.  I thought I'd share this one story.  During the evening on July 1, I heard explosions.  My family members assumed the noise came from fireworks. (We vacationed in South Carolina, where you can purchase serious, big, boom-boom fireworks on every street corner.)  I countered with another theory, centered on the anarchy caused by all the July 1 compliance deadlines.  

They all looked at me with blank stares.  

I explained to them that for banks and credit union compliance peeps, July 1st had been circled on calendars for quite some time.  No one in my family was aware of our pain and suffering.  They knew something had happened with credit cards, and a few of them did notice an up-tick in communications about something called "overdraft protection."   That was it. 

And perhaps that is as it should be. Sometimes, we can get so caught up in issues, that we can lose sense of what is really important.  Our jobs are serious, as is our work.  But in 30 years, I truly hope that none of us look back on this summer as the defining moment in our lives.  Let's do our work.  Let's do it well.  Let's protect our credit unions.  But let's keep a balance in our lives.  

***

OK, my email inbox is overwhelmed.  Here's a few items of interest.

Threats.  NCUA's security regulation requires us to reasonably protect sensitive member information from threats.  We often view threats as coming from "out there."  Well, they can come from the "in here" as well. This article reminds us that security should protect member information from internal threats. 

Hurricanes.  NCUA issued Letter to Credit Unions 10-CU-10 to urge credit unions to prepare for hurricane season and to periodically refresh pandemic preparedness.  The guidance contains an appendix with a number of resources. Perhaps my favorite resource is the FFIEC Business Continuity Handbook. 

Podcast.  Rob and the gang (sans me) delivered another great "current issues in credit unions" podcast.  Download the podcast and listen to it while on the treadmill, where I should be for the next 2 months based on last week's see-food diet. (Not a typo.)

Gambling.  The FDIC released this financial institution letter regarding Regulation GG. It contains a nice overview, as well as the exam procedures used by examiners to review your compliance.  Granted, this was issued by the FDIC, but the FDIC indicated that NCUA would be using these exam procedures as well.

BSA.  Here's a great blog post from Felix Salmon highlighting how money laundering is still a problem. 

NAFCU...OPEN!!; NCUA Board Agenda; Lessons from the Snow

Posted by Anthony Demangone

NAFCU is open for business today, with a 2 hour delayed start.  As I write this Thursday evening, I'm a bit sad.  I'll have to part ways with my snow beard Friday morning.  

***

NCUA has released its agenda for next week's NCUA Board meeting.  It isn't a crowded agenda.

TIME AND DATE: 10:00 a.m., Thursday, February 18, 2010

PLACE: Board Room, 7th Floor, Room 7047
1775 Duke Street
Alexandria, VA 22314-3428

STATUS: Open

MATTERS TO BE CONSIDERED:

1. Board Briefing. Interim Final Rule – Section 701.34 of NCUA’s Rules and Regulations, Secondary Capital Accounts for Low-Income Credit Unions.
2. Insurance Fund Report.

RECESS:  11:00 a.m.

TIME AND DATE: 11:15 a.m., Thursday, February 18, 2010

PLACE:  Board Room, 7th Floor, Room 7047
1775 Duke Street
Alexandria, VA 22314-3428

STATUS: Closed

MATTERS TO BE CONSIDERED:

1. Consideration of Supervisory Activities. Closed pursuant to Exemptions (8), (9)(A)(ii) and 9(B).

***

More than a few of you asked how we were able to deliver our compliance services as well as we did during the snow event.  While a trade association has a different business model than a credit union, I thought I would share how we went about it.  Perhaps some of this might be useful from a business continuity point of view.

• You need to plan.   When the weather report began to line up last week, I met with the compliance team and others to discuss what would happen if NAFCU was closed on Monday.  We hammered that out, not even remotely considering that we'd be closed four days in a row.  From there, we simply adjusted on the fly.
• You need good people.  Steve and Sarah didn't hesitate to pitch in, even though NAFCU's offices were officially closed.
• You need technology.  Blackberries really go a long way.  We knew our operating status immediately, which allowed us to make necessary adjustments to man the "compliance desk."  Blackberries also allowed us to communicate with each other seamlessly.  In addition, each one of us has a program installed on our home computer that allows us to tap into our work computer to access emails, files, and programs. In addition, our phone system allows us to set up notifications.  When a voice-mail is left on my phone at NAFCU, I get an email notification about the voice-mail on my Blackberry.
• You need to communicate to your "users." Our NAFCU Today news service remained up and running, which notified members about our operating status.  In addition, I updated the Compliance Blog each day to let you know how best to reach us.  That set expectations, and helped route compliance requests the best way.

Again, I know our compliance services are relatively simple when compared with opening a branch or maintaining an on-line banking system during an "event."  But I thought I'd take a moment to share what we did.  Perhaps it might give you some ideas.

Have a great weekend, everyone.  Oh, and I  hear we are supposed to get snow on Monday.  Ugh.

More CARD Act; Can I Have a Witness?

Posted by Anthony Demangone

The OCC issued a very interesting bulletin recently.

The bulletin describes a strange quirk found within the Regulation Z interim final rule, specifically concerning the 45-day change in terms requirements. As we are all aware, we now must give 45-days notice when we increase the APR or change significant terms on a credit card.  And now members have the right to reject those changes.

However, here's what most consumers don't realize: under the rules, the new rates or terms can be applied to any transaction that occurs more than 14 days after the notice is provided – even if the consumer ultimately rejects the changes. The changes to Regulation Z do not require us to tell members about this fact.

Step in the OCC.  Via the bulletin that is linked above, the OCC is directing national banks to include an additional disclosure to notify consumers of this consequence. The OCC hopes that it will minimize confusion.

Here's the relevant language from the bulletin:

To avoid unnecessary consumer confusion, national banks should include the following (or similar) additional information in 45-day advance notices to alert the consumer, if applicable, to the imposition of the new terms on transactions that occur more than 14 days after the notice is provided, regardless of whether the consumer rejects the changes:

NOTE: Even if you reject this change in terms, the new terms will be applied to any transactions on your account that occur on or after [INSERT DATE].

Now, this is an OCC bulletin, so did does not apply to federal credit unions.  Time will tell whether NCUA moves in this direction.  But you may see compliance article drafted about this, and I wanted to bring it to your attention.  Oh, and nothing would prevent you from voluntarily following the OCC guidance.

***

Today, I have the honor of testifying before the House Small Business Committee on the issue of pandemic preparedness.  I will do my best to show how hard the financial services industry, including federal credit unions, has been working on this issue.   With that in mind, here's some good pandemic resources:

• NCUA Letter to Credit Unions 09-CU-13. The letter focuses on hurricanes and the swine flu development.

• NCUA Letter to Credit Unions 08-CU-01. This letter really is the backbone of NCUA's guidance on pandemic issues. 

• NCUA Letter to Credit Unions 06-CU-06.  This was the first piece of pandemic guidance issued from NCUA.
• Part 749, Appendix B.   Don't forget about this new appendix to NCUA's recordkeeping rule.  It touches upon business continuity planning issues.

Credit CARD Act - Sections 105, 107 & 108; NCUA LCU

Posted by Steve Van Beek

Today, we are going to knock out a few smaller sections of the Credit CARD Act.  

Section 105 - Subprime or "Fee Harvester" Cards

First off, can you tell Congress did not like this practice?  "Fee harvester" is not a term used to describe a consumer-friendly product.  Few credit unions dabble in these types of products, so take a quick look at your credit cards to see if they would be covered.

Section 105 adds subsection (n) to Section 127 of TILA.  This section requires that if a new credit card account adds fees that equate to more than 25% of the available credit limit - those fees must be paid for in another payment form (i.e. can not be added to the credit card at issuance).  This section stems from practices by some subprime card issuers who would open a credit card account with a credit limit of $300 that already had $250 in fees on the card - giving the consumer on $50 in available credit and accruing interest on the $250 in fees.  Thus, the term "fee harvester."  

This section is a bit confusing and it seems the Fed would issue regulations to clarify and prevent evasion of this subsection.  For FCUs, do not forget about Section 706.26 of NCUA's regulations covering Unfair or Deceptive Acts or Practices (UDAP) - effective July 1, 2010.  The restrictions are more stringent and detailed.  If you offer a credit card like this for some reason, be sure to check out UDAP (see especially page 129 as well as pages 142-145 of the official staff commentary).

Section 107. Enhanced Penalties

This section strengthens the penalties section of TILA by authorizing fines of twice the amount of any finance charge, with a minimum fine of $500 and a maximum of $5,000, in penalties for individual actions on an open end consumer credit plan.  The section also allows higher penalties if a "pattern or practice" of failures can be established.  

Section 108. Clerical Amendments

This section adds the term "open end consumer credit plan" to the existing definition of "open end credit plan" under Section 103(i) of TILA.  The definition remains substantially the same, but the amendment clarifies that the terms "open end consumer credit plan" and "open end credit plan" are interchangeable. 

***

NCUA recently issued Letter to Credit Unions 09-CU-13 which discusses the upcoming hurricane season and pandemic planning.  The letter encourages credit unions to review and update their disaster preparedness and response plans.  The Letter includes links to various guidance documents on disaster preparedness and business continuity planning. 

Red Flags FAQ; Pandemic

A bunch of regulators, including NCUA, recently issued a frequently asked questions document to provide guidance on the recent Red Flags Identity Theft Prevention rules.  Access it here.  I just love FAQs.  I do.  They are written in English.  They address real-world problems that have surfaced since the rule was released.  I just love, love love them.  Here's a taste of what you'll find inside:

1. Do the Red Flags Rules, Card Issuers’ Rules, or Address Discrepancy Rules contain record retention requirements?

These three Rules do not contain specific record retention requirements. However, financial institutions and creditors must be able to demonstrate that they have complied with the requirements of the Red Flags and Card Issuers’ Rules, and users of consumer reports must be able to demonstrate that they have complied with the requirements of the Address Discrepancy Rules, in addition to any other applicable record retention requirements.

8. Are credit union service organizations (CUSOs) covered by the Red Flags Rules and Guidelines?

CUSOs, according to the Federal Credit Union Act, provide “services which are associated with the routine operations of credit unions” and are “established primarily to serve the needs of its member credit unions, and whose business relates to the daily operations of the credit unions they serve.” 12 U.S.C. §§ 1757(5)(D), (7)(I). A CUSO that is a “creditor” under the FCRA is covered by the Red Flags Rules and Guidelines issued by the FTC.

***

The WHO has officially declared a pandemic.  What does this mean for compliance?  The WHO lists the risk of a pandemic with phases, numbered one through six.  We're now at WHO pandemic phase six.  Some credit unions use the WHO stages to trigger different parts of their pandemic plan.  You may want to check your pandemic plan to see what phase 6 triggers.

Share Insurance; Swine Flu, Second Liens

I know that its hard to keep track of everything these days.  Regarding share insurance, the housing bill being consider on the Hill this week contains a provision that would make the share insurance bump to $250,000 permanent.

***

The World Health Organization has raised its influenza pandemic alert to Phase 5 (out of 6).  According to the WHO:

Based on assessment of all available information and following several expert consultations, Dr Margaret Chan, WHO's Director-General raised the current level of influenza pandemic alert from phase 4 to 5. She stated that all countries should immediately activate their pandemic preparedness plans. At this stage, effective and essential measures include heightened surveillance, early detection and treatment of cases, and infection control in all health facilities.

Visit www.pandemicflu.gov, which is a one-stop locale for U.S. government information on pandemic preparations.

***

Here's some details concerning President Obama's plan to help homeowners with second liens.  Program fact sheets are toward the bottom of the page. 

Swine Flu

Posted by Anthony Demangone.

From recent press reports, it seems clear that swine flu is a serious matter.  Photos show Mexican citizens wearing surgical masks.  Movie theaters, soccer matches, and other public gatherings have been closed. Almost 100 Mexicans have died from the flu so far.  And cases have been reported in Texas and New York.  Here's some information about this:

• The World Health Organization (WHO) has a page devoted to Swine Flu.  You may access it here.
• If your staff has questions, WHO put together this FAQ document.

Why is this a compliance issue?  Because Swine Flu has business continuity planning issues.  While this does not appear to be rising to the level of a pandemic, pandemic-related business continuity plans would be very useful in dealing with this.  With that in mind:

The FFIEC has published guidance on pandemic planning.  Read their press release here.  Read the actual guidance here. 

The guidance indicates that a credit union's business continuity plan should include:

1. A preventive program to reduce the likelihood an institution’s operation will be significantly affected by a pandemic event;
2. A documented strategy that provides for scaling pandemic efforts commensurate with the particular stages of a pandemic outbreak;
3. A comprehensive framework of facilities, systems, or procedures to continue critical operations if large numbers of staff members are unavailable for prolonged periods;
4. A testing program to ensure the institution’s pandemic planning practices and capabilities are effective and will allow critical operations to continue; and
5. An oversight program to ensure ongoing review and updates to the pandemic plan.

The guidance builds upon NCUA Letter to Credit Union 06-CU-06, which you can access here.

I assume your credit union has a pandemic plan in place.  It may not be a bad idea to dust if off and take a look at it.  Also, it is never a bad idea to remind staff about proper hygiene.  Wash those hands.  Cover those coughs and sneezes.

Gustav; Good to Be Back

NCUA has created a page for credit unions that are in the path or have been affected already by Hurricane Gustav.  You can access it here.   

Since Hurricanes Rita and Katrina, there has been a great deal of guidance issued regarding business continuity planning.  Parts 748 and 749 have been amended.   There have been NCUA letters to credit unions.  But I've always liked this resource for BCP issues: the FFIEC Business Continuity Planning Booklet, which is part of the FFIEC IT Handbook.  It is a great resource.

For those affected by the storm, please stay safe.

***

It is good to be back.  Mandy and I really enjoyed our little journey out west.  Here's a few pictures from our travels.  If you are bored, here's a link to all the photos we took.

 

FFIEC Issues BCP Booklet

This week, the FFIEC issued a revised Business Continuity Booklet.  Here is NCUA's press release about....well, the release  The Booklet is part of the FFIEC IT Examination Handbook. Here's a link to the FFIEC website where you can view or download the booklet. 

Remember, NCUA is part of the FFIEC.  I often use this math-like formula to drive the point home: NCUA = FFIEC.  While that's not technically true, it does underscore the point that guidance from the FFIEC is akin to guidance from NCUA itself. For that reason, I'd forward this email to the person in charge of BCP issues at your credit union.  If you are that person, keep reading.

Here's a description of the guidance from NCUA:

The Federal Financial Institutions Examination Council (FFIEC) today issued updated guidance for examiners, financial institutions, and technology service providers to identify business continuity risks and evaluate controls and risk management practices for effective business continuity planning.  The guidance is an update to the “Business Continuity Planning Booklet,” which was issued in March 2003. 

The revised booklet includes enhancements to the business impact analysis and testing discussions, and addresses emerging threats and lessons learned in recent years.  The booklet also stresses the responsibilities of each institution’s board and management to address business continuity planning with an enterprise-wide perspective by considering technology, business operations, communications, and testing strategies for the entire institution. 

Pandemic After Action Report Released

Last week, Treasury, the Financial Services Sector Coordinating Council, and the Financial and Banking Information Infrastructure Committee released an after action report (AAR) that detailed results of the 2007 Pandemic Flu Exercise.  Access it here.

Why should compliance officers care?  Business continuity planning, much like information security, is a fluid process that must incorporate information about emerging threats, technology, and information.  The AAR is new information/lessons learned, and it shows how credit unions and banks responded to a hypothetical pandemic.  For that reason, it would be a good idea to forward the report to the person at your credit union who is responsible for pandemic planning.

For those credit unions that missed the Pandemic Flu Exercise, you can still work through it at your credit union.  Access all the necessary materials here.

Pandemics and Telecommuting; The Diet

NCUA and FFIEC guidance requires credit unions to plan accordingly for the effects of pandemics on their operations.   Many credit unions have indicated that they will utilize telecommuting in some form to help cope with pandemics.  But is the communications network up to the challenge?

Read a NAFCU Today article here that highlights the release of a detailed study on this issue.  From the story, NAFCU members will be able to download the study.   The study provides base assumptions and best practices for IT professionals, telecommuters, and the general public.

For those tasked with pandemic planning, it is a must read.  And if I could write poetry, I would write a poem describing how much I love people who are willing to share best practices.  (Oh, why not.)

Oh, best practices!
How I love thee, you  make
My job easier, by far

***

Current Weigh Loss:  7.4 pounds. 
Needs to Lose: 62.6.
Days until Wedding: 122.
Current Estimated Odds of Success:   1,000 to 1

Dieting is not complicated.  But it is very, very difficult.  Much like dealing with the affiliate marketing rule. 

FFIEC Publishes Pandemic Guidance

Yesterday, the FFIEC published guidance on pandemic planning.  Read their press release here.  Read the actual guidance here. 

The guidance indicates that a credit union's business continuity plan should include:

1. A preventive program to reduce the likelihood an institution’s operation will be significantly affected by a pandemic event;
2. A documented strategy that provides for scaling pandemic efforts commensurate with the particular stages of a pandemic outbreak;
3. A comprehensive framework of facilities, systems, or procedures to continue critical operations if large numbers of staff members are unavailable for prolonged periods;
4. A testing program to ensure the institution’s pandemic planning practices and capabilities are effective and will allow critical operations to continue; and
5. An oversight program to ensure ongoing review and updates to the pandemic plan.

The guidance builds upon NCUA Letter to Credit Union 06-CU-06, which you can access here.

Note that item number 4 addresses the need for testing.  For those who took part in the recent financial services pandemic exercise, be sure to document your efforts.  For those who did not take part, you can download the exercise here and run through it at your credit union. 

The FFIEC guidance has a great listing of pandemic-related resources that should be useful.