NAFCU Compliance Blog

Considering a Member’s Immigration Status in Evaluating Loan Applications + Trivia! + Monitor Survey

Written by Shereefat Balogun, Regulatory Compliance Counsel

Seems like immigration is on many minds these days.  In fact, we’ve received a number of questions concerning an applicant’s immigration status in evaluating loan applications.  The general question often looks like this:

A member came in applying for a VISA credit card. He is not a permanent resident of the U.S. He has a work permit that expires in July 2017. Are we able to deny a credit card to someone who is not a permanent resident of the U.S?

As many of us are aware, the Equal Credit Opportunity Act (ECOA) prohibits discrimination related to any aspect of a credit transaction on the basis of race, color, religion, national origin, sex, marital status, age, and income derived from public assistance.  See, 15 U.S.C. §1691(a); 12 C.F.R. §§ 1002.1(b), 1002.4(a).  That said, a credit union may consider a member’s credit status or status as a permanent resident in determining the member’s creditworthiness and the credit union’s rights and remedies regarding repayment.  Indeed, section 1002.5 of Regulation B, which implements ECOA, provides in relevant part:

§1002.5 Rules concerning requests for information.

…

(e) Permanent residency and immigration status. A creditor may inquire about the permanent residency and immigration status of an applicant or any other person in connection with a credit transaction.

12 CFR 1002.5(e)(emphasis added.)

Moreover, in section 1002.6, the rule states:

§1002.6   Rules concerning evaluation of applications.

(a) General rule concerning use of information. Except as otherwise provided in the Act and this part, a creditor may consider any information obtained, so long as the information is not used to discriminate against an applicant on a prohibited basis. The legislative history of the Act indicates that the Congress intended an “effects test” concept, as outlined in the employment field by the Supreme Court in the cases of Griggs v. Duke Power Co., 401 U.S. 424 (1971), and Albemarle Paper Co. v. Moody, 422 U.S. 405 (1975), to be applicable to a creditor's determination of creditworthiness.

…

(7) Immigration status. A creditor may consider the applicant's immigration status or status as a permanent resident of the United States, and any additional information that may be necessary to ascertain the creditor's rights and remedies regarding repayment.

12 CFR 1002.6(b)(7) (emphasis added.)

The Official Interpretation to 1002.6(b)(7) provides more detail:

Paragraph 6(b)(7) .

1. National origin—immigration status. The applicant's immigration status and ties to the community (such as employment and continued residence in the area) could have a bearing on a creditor's ability to obtain repayment. Accordingly, the creditor may consider immigration status and differentiate, for example, between a noncitizen who is a long-time resident with permanent resident status and a noncitizen who is temporarily in this country on a student visa.

2. National origin—citizenship. A denial of credit on the ground that an applicant is not a United States citizen is not per se discrimination based on national origin. 

12 CFR 1002, Supp. I, comments 1002.6(b)(7) – 1 and 2 (emphasis added.)

While Regulation B generally gives credit unions the ability to consider residency and immigration status in evaluating a loan application, there may be some risks associated with denying a loan based on the member’s citizenship status.  Comment 2 above indicates that a denial of credit based on citizenship status is not per se discrimination based on national origin.  This suggests that the denial in and of itself may not be discriminatory; however an examination of the facts and circumstances may form the basis of a discriminatory claim exposing the credit union to litigation risks.  One issue that may arise concerns claims that the credit union’s policy is not being applied consistently.  For example, if citizens of countries A and B are ok but citizens of C and D are not, then it can be argued that the credit union is discriminating on the basis of national origin, i.e. the place of origin rather than status as a non-citizen.  The credit union may want to make sure applicants are being treated consistently across the board and that any different treatment has a legitimate business purpose.

One thing to consider is that the rule seems to focus on the credit union’s ability to look at immigration status in determining the member’s ability to repay.  See, 12 C.F.R. 1002.6.  Based on this, the credit union may want to focus on the repayment aspect and the particular risks a noncitizen applicant poses.  This is alluded to in the commentary.  See, 12 CFR 1002, Supp. I, comments 1002.6(b)(7) – 1 and 2.  For example, a member who is new to the country, with no employment, and no past credit history may pose more risks to the ability to repay, than a person who has been in the country for 10 years, working as a physician at $450k a year, with satisfactory credit history and owns a home.

Notably, Form C-1 located in Appendix C to Part 1002, is a sample adverse action form and provides a few adverse action options that may apply to these situations.  For example, some reasons listed such as “Temporary or Irregular Employment”, “Length of Employment”, “Length of Residence”, or “Temporary Residence” may be applicable.  Ultimately, though, the rule requires credit unions to look at their underwriting criteria and select the appropriate reasons. 

Also, here are some useful resources which may be helpful:

• NCUA’s Fair Lending Guide
• Letter to Credit Unions No. 174.  This letter includes a white paper that’s geared towards risk-based lending. Starting on page 3, there is a pretty good discussion of consumer compliance and discrimination issues.

As always, if you have any questions concerning ECOA/Regulation B, or any other issue, please feel free to contact the NAFCU Compliance team. We’re here for you!

Trivia: What is ECOA’s record retention period for consumer credit applications?

###

Each month, NAFCU's research division sends out an Economic and CU Monitor survey which is summarized and reported in the Economic and CU Monitor. This month’s survey topic is Housing, and it includes questions on GSEs, HMDA, TRID, and chattel lending. Your responses provide us with the meaningful data we need when we represent you before policy makers. You don’t need to complete the entire survey. Every response is a helpful one!

Should Credit Unions Photocopy Identification Cards?

Written by Shereefat Balogun, Regulatory Compliance Counsel

So last week, I attempted to take some cash out of my credit union’s ATM but the customer in front of me had a bunch of checks she had to deposit and took forever.  I decided to walk into the branch and ask for the cash withdrawal.  The teller asked me for my driver’s license or any similar ID. I told her that I did not have any ID on me (don’t judge me!), but I had my ATM/debit card.  The teller said she would be able to process my request only if the credit union had a copy of my ID on file.  While I understood the benefits of having the copy on file, I could not help but to think about the different compliance issues this raises.  Yes, the copy of the ID is great for verifying your members’ identity or helping to detect fraud.  However, it got me thinking about compliance issues relating to IDs, such as military IDs and fair lending concerns.  Contrary to what we’ve been taught, what’s good for the goose is NOT always good for the gander. 

Bank Secrecy Act and CIP Recordkeeping

The Bank Secrecy Act requires a credit union to know its member (KYC or KYM whichever lingo you prefer) and have a customer identification program (CIP). This includes checking a government identification number, which can be done with documentary evidence like an ID.  So collecting the ID to verify the information is one thing.  But should a credit union keep a copy of the ID in its records?  For recordkeeping purposes, the CIP rule leaves it up to the credit union to determine how it wants to document verification that has been performed.  Generally, the rule requires a credit union to retain a description of the document that was relied on, noting the type of document, any identification number contained in the document, the place and date of issuance, and expiration date.  So, a description is generally sufficient.  Though the credit union may retain a copy of the ID, it certainly is not required.  See, 31 C.F.R. §1020.220(a)(3)(i)(B).  This is also confirmed in FinCEN’s Guidance on Customer Identification Regulations FAQs:

2. Can a bank keep copies of documents provided to verify a customer’s identity, in addition to the description required under 31 C.F.R. § 103.121(b)(3)(i)(B), even if it is not required to do so?

Yes, a bank may keep copies of identifying documents that it uses to verify a customer’s identity. A bank’s verification procedures should be    risk-based and, in certain situations, keeping copies of identifying documents may be warranted. In addition, a bank may have procedures to keep    copies of documents for other purposes, for example, to facilitate investigating potential fraud…

(Emphasis added.)

Keep in mind though, that although there are no federal regulations prohibiting a credit union from photocopying ID, some states prohibit photocopying IDs.  Be sure to check with your individual state law to see if there are any limitations here.

But wait…what about military IDs?  Good question!  While a credit union may use a military ID to collect identifying information for CIP purposes and other purposes, it cannot copy the ID for CIP purposes.  Federal law generally prohibits the copying or scanning of military ID:

Whoever manufactures, sells, or possesses any badge, identification card, or other insignia, of the design prescribed by the head of any department or agency of the United States for use by any officer or employee thereof, or any colorable imitation thereof, or photographs, prints, or in any other manner makes or executes any engraving, photograph, print, or impression in the likeness of any such badge, identification card, or other insignia, or any colorable imitation thereof, except as authorized under regulations made pursuant to law, shall be fined under this title or imprisoned not more than six months, or both.

(Emphasis added.)

As stated above, photocopying military ID can subject a person to fines and imprisonment up to 6 months.  If your BSA/CIP program permits the photocopying of military ID identification, you may want to reassess your CIP requirements. 

To emphasize, the statute prohibits the photocopying the military identification card.  For CIP purposes, it’s our understanding that some credit unions document information found on the military ID since they are unable to make a copy.  This practice is consistent with the CIP recordkeeping requirement discussed above. 

Fair Lending Concerns

So we’ve established that it is customary to collect and retain a copy of a driver’s license for CIP purposes.  However, for purposes of Regulation B and other fair lending laws, credit unions may want to keep that copy out of the member’s loan application file.  For example, Regulation B prohibits financial institutions from considering certain information when evaluating an application and making a credit decision.  Indeed, the FinCEN FAQ highlighted above also warned:

Nonetheless, a bank should be mindful that it must not improperly use any document containing a picture of an individual, such as a driver’s license, in connection with any aspect of a credit transaction.

(Emphasis added.)

Regulation B and Regulation C require a credit union to collect certain information for monitoring purposes.  For instance, Regulation B requires a credit union that receives a credit application to collect certain information, such as ethnicity, sex, and age.  See, 12 C.F.R. §1002.13(a).  Similarly, Regulation C requires a credit union to collect certain data in relation to applications for home purchase loans, home improvement loans, and refinancings.  This information includes information about the ethnicity, race, and sex of the applicant or borrower.  See, 12 C.F.R. §1003.4(a)(10).  When collecting this information, a credit union may list questions regarding the ethnicity, race, and sex of the applicant on the loan application form, or on a separate form that refers to the application.  See, Appendix B to 12 C.F.R. Part 1003.

Although neither rule explicitly instructs credit unions to refrain from maintaining a copy of a driver’s license from a loan file, doing so may increase your fair lending risks, and may lead to examiner scrutiny.

As always, if you have any questions about this blog or any other compliance issue, please feel free to reach out to NAFCU’s Regulatory Compliance Team.  We’re here for you!

“New Year, New Products and Services-Frequently Asked Questions: Advertising”

Written by André B. Cotten, Regulatory Compliance Counsel

Greetings, compliance comrades! As we head towards the start of a new year, we have noticed an uptick in advertising related questions. Before we get into the details of the advertising requirements, it is useful to remember that the type of products or services and the definition of terms have impact on the scope of regulatory requirements.

In regards to the Truth in Savings Act, an advertisement is defined by section 707.2 as a commercial message that appears in any medium and that promotes directly or indirectly the availability of, or a deposit in, a share account. This is a very broad definition. However, the official commentary provides additional guidance.

Similarly, a key to understanding Regulation Z’s advertising rule is determining which rules apply to your proposed advertisement. Regulation Z has different rules depending on whether the product is open-end or closed-end. There are also special regulatory provisions for HELOCs and promotion rate advertisements. In order to know which rules apply you will need to determine what product you are advertising.

This blog covers some of the more frequently asked questions on advertisements.

If a credit union offers deferred interest on credit cards for an introductory period, should it be concerned about advertising requirements under Regulation Z?

Regulation Z contains advertising requirements specific to deferred interest programs. The term deferred interest is defined as “finance charges, accrued on balances or transactions, that a consumer is not obligated to pay or that will be waived or refunded to a consumer if those balances or transactions are paid in full by a specified date.” See, 12 C.F.R. § 1026.16(h)(2). If a deferred interest offer is advertised for a credit card (or other non-home-secured open-end loan), Regulation Z requires the credit union to state the deferred interest period in a clear and conspicuous manner in the advertisement, and include information about the terms that would apply when the transaction is not paid in full within the deferred interest period or if the account is in default before the end of the deferred interest period. These disclosures must be stated in a prominent location closely proximate to the first statement of “no interest,” “no payments,” “deferred interest,” “same as cash” or similar term. The language must be similar to that provided in Sample G-24 in Appendix G to Regulation Z.

Are there different requirements for advertisements that are inside the credit union, versus those that exist outside of a branch?

Truth in Savings has some different requirements for advertisements in these situations, but Regulation Z does not. Truth in Savings carves out advertisement-related exceptions for certain types of advertisements. Specifically, the regulation eases advertising requirements for broadcast or electronic media such as TV or radio (but not credit union websites), outdoor media (such as billboards), telephone response machines, and signs inside the premises of a credit union. See, 12 C.F.R. § 707.8(e).

Regulation Z regulates advertisements for both open and closed-end loans. See, 12 C.F.R. §§ 1026.16, 1026.24. If a credit union plans to advertise its loan products, it must comply with all of Regulation Z’s requirements regardless of whether the advertisement is placed inside or outside of the branch. However, the staff commentary does have alternative disclosure options for radio and television ads set forth in sections 1026.16(e) and 1026.24(g).

Must the credit union obtain its members’ consent under Truth in Savings or Regulation Z before delivering its advertising materials through email?

The advertising requirements of Truth in Savings (TISA) and Truth in Lending Acts (TILA) may be implicated when sending email advertisements, but credit unions do not need member consent to send email advertisements under these statutes/regulations. However, the requirements of the CAN-SPAM Act, which applies to unsolicited commercial emails, may also be triggered. CAN-SPAM generally requires unsolicited commercial ads to be labeled as an advertisement or solicitation and to include opt-out instructions along with the sender’s physical and electronic address. NCUA Regulatory Alert 04-RA-07 provides guidance on complying with CAN-SPAM. The FTC also has a document on CAN-SPAM compliance available on its website

If a “trigger term” is stated in the negative, is the credit union required to provide the additional advertising disclosures?

Under Regulation Z, “trigger terms” do require additional advertising disclosures when stated in the negative, or even when not stated explicitly, but readily implied. See, 12 C.F.R. Part 1026, Supp. I, comments 1026.16(b)(1)-1 and -2. For instance, if a credit union states its credit card had “no annual fee” is a statement of the term, this would trigger the additional disclosures. See, 12 C.F.R. § 1026.16(b)(1). Similarly, if the credit union were to claim “we will not charge you an annual fee” – the additional disclosures are still required as this statement is the same as stating “no annual fee.”

Given the differences between the rules for open-end and closed-end loans, how could a credit union convert an advertisement if a product is converted?

There are separate advertising requirements for open-end and closed-end loans in Regulation Z. The advertising requirements for open-end loans are found in 12 C.F.R. § 1026.16 and the requirements for closed-end loans are found in 12 C.F.R. § 1026.24. Unfortunately, there is no shortcut to converting open-end marketing pieces into compliant closed-end advertisements. A credit union would need to review the closed-end advertising rules and make sure its advertising includes all the necessary disclosures. The staff commentary to section 1026.24 contains additional details on the requirements.

Final Thoughts

Advertising compliance is the result of having a strong compliance management system that includes effective policies, procedures, education and communication about the applicable regulatory requirements. The advertising rules pursuant to the Truth in Savings Act and Regulation Z both generally prohibit commercial messages that are misleading, inaccurate or misrepresent a credit union’s deposit accounts or loan products.

Credit unions that fail to comply with the advertising rules also run the risk of potential UDAAP issues. The following three prongs are used to determine if an act or practice is “deceptive”: 1) it causes or is likely to cause substantial injury to consumers; 2) the injury is not reasonably avoidable by consumers; and 3) the injury is not outweighed by countervailing benefits to consumers or to competition. A “substantial injury” typically takes the form of monetary harm because of an unfair act or practice.

Also keep in mind that NCUA has an overarching advertising rule in Part 740 that prohibits all federally-insured credit unions from using any advertising that is “inaccurate or deceptive in any particular, or which in any way misrepresents its services, contracts, or financial condition…” Overall, clear and conspicuous advertisements and oversight of advertising materials can minimize potential confusion and complaints, fosters good member relations, and help reduce credit, legal, and other risks to the institution.  

Happy Holidays!

***

Programming Note:

NAFCU will be closed Friday, December 23^rd and Monday, December 26^th for the Christmas Holidays.

***

The Regulatory Compliance Team really enjoyed the photo booth last week at NAFCU’s Annual Holiday Party!

Massive Cyberattack on Netflix and others; FFIEC Cybersecurity Assessment Tool FAQs; ANPR on Enhanced Cyber Risk Management Standards

Written by Pamela Yu, Special Counsel for Compliance and Research

If you were trying to spend last Friday evening catching up on your binge watching (Have you seen the throwback-fabulous ‘Stranger Things’ yet?), tweeting, and doing a bit of online shopping, you may have noticed a slowdown due to the two massive cyberattacks that hit Netflix, Amazon, PayPal, Twitter, and others.

Unfortunately, distributed denial of service (DDoS) attacks and other cybercrimes are growing in frequency, size, and sophistication.  Cybersecurity is a major concern for credit unions, who are already increasing their information technology (IT) spending and hiring more personnel to address the heightened risk and vigilance of cyber attackers.  NAFCU’s October Economic and CU Monitor survey shows that the percentage of respondents’ overall operating budget devoted to IT/cybersecurity has nearly doubled over the past five years alone.  Meanwhile, NCUA has made cybersecurity a supervisory priority since 2013, and the agency recently reminded credit unions that “technological innovation, the expansion of social networking and growing interconnectivity are fueling fundamental change in cybersecurity procedures and processes,” and with that change, credit unions are potentially impacted with “higher mitigation costs and lower consumer confidence, as well as greater financial and legal risks.”  Also, yesterday, NCUA warned that credit unions face a dangerous threat to the safety and security of their data and information in the form of ransomware.

To address these growing cybersecurity threats, in June 2015, NCUA and the other members of the Federal Financial Institutions Examination Council (FFIEC) released a voluntary Cybersecurity Assessment Tool (CAT) to enhance financial institutions’ cybersecurity oversight and management capabilities, and to identify any gaps in an institution’s risk-management practices.  According to NAFCU's survey, many credit unions are already using this tool, as well as NAFCU’s user-friendly FFIEC Cybersecurity Assessment Tool Workbook, to enhance their cybersecurity preparedness.

On October 17, the FFIEC released a new frequently asked questions (FAQ) guide related to the FFIEC CAT. Consisting of eighteen questions and answers, the FAQs clarify points in the FFIEC CAT and supporting materials based on questions received by the FFIEC members over the past year.  Among other things, the FAQs clarify expectations with respect to an institution’s Cybersecurity Maturity levels and Inherent Risk levels:

“While there are no expected maturity levels for an institution, Inherent Risk levels should be balanced with maturity. If management determines that the institution’s maturity levels are not appropriate in relation to the Inherent Risk Profile, management should consider reducing inherent risk or developing a strategy to improve their levels of maturity.  

Management may choose to evaluate the institution’s inherent risk overall, as well as inherent risk for specific activities, services, or products. In general, when the inherent risk of an activity, service, or product rises the maturity level of related controls and risk mitigation activities should increase, as well.”

The FAQs also clarify what several terms mean with respect to the FFIEC CAT, including: “trust services,” “merchant acquirer,” “treasury services,” and “asset life-cycle process.”

In other cybersecurity news, the Federal Reserve, FDIC, and OCC last week jointly released an advance notice of proposed rulemaking (ANPR) inviting public comment on potential enhanced cybersecurity risk-management and resilience standards that would apply to large ($50 billion or more in assets) and interconnected entities under the supervision of the three federal banking regulators.  The standards would also apply to third parties providing services to these entities, but would not apply to community banks and credit unions.  The ANPR addresses five categories of cyber standards: cyber risk governance; cyber risk management; internal dependency management; external dependency management; and incident response, cyber resilience, and situational awareness.

Under the proposal being considered, the enhanced standards would be tiered, with more vigorous standards for systems that provide key functionality to the financial sector.  For these sector-critical systems, the Fed, FDIC, and OCC are considering a rule to require banks to mitigate the risk of a disruption or failure due to a cyber event.  Comments on the ANPR are due January 17, 2017.

While credit unions are not covered by the ANPR, in light of Friday’s DDoS attack and NCUA’s continued supervisory focus on cybersecurity, we can expect that credit unions may face increasing pressures to enhance their own standards to mitigate cyber threats.

***

NAFCU’s Compliance Seminar and BSA Conference Continues

NAFCU’s compliance team continues to be onsite in beautiful New Orleans for NAFCU's concurrent Regulatory Compliance and BSA Seminars!  We appreciate your continued patience as the team works to answer your compliance questions between giving presentations.

BSA/AML Compliance Requirements: Frequently Asked Questions This Week; NAFCU’s new BSA Seminar + Certification is Here!

Written by Shereefat Balogun, Regulatory Compliance Counsel

This week NAFCU hosted its annual Regulatory Compliance School, focusing on the most important regulatory compliance issues facing credit unions. Today’s session will cover the Bank Secrecy Act (BSA) and OFAC (Office of Foreign Assets Control) regulatory framework. However, attendees seemed all too anxious and could not wait to ask their BSA/AML related questions- and understandably so. With an increase in enforcement actions for BSA/AML violations, ongoing OFAC sanctions and impending rules on customer due diligence, credit unions, and other financial institutions, are working hard to keep up with their compliance requirements under the BSA/AML regime. Today’s “FAQs” were inspired by the many BSA/AML related questions and concerns raised throughout the week.

Q: Does a credit union have an obligation to reconcile conflicting identification information provided by a member? We have a member who recently filled out a change of address form, and the SSN he put down is completely different from the one he gave to open this account. Is there any responsibility on the credit union’s part to take any action concerning this discrepancy?

A: Yes, the credit union does have an obligation to address any discrepancies as it pertains to identifying information.  Generally, before opening an account for a customer, the credit union must be able to form a reasonable belief that it knows the true identity of the customer based on the information gathered. The conflicting information may have been made in error.  In any event, the CIP procedures must specify how the credit union will resolve the discrepancies.  If the information is indeed conflicting and can’t be reconciled, the credit union may have an obligation to file a SAR.

Each credit union must have a written CIP that allows it to form a reasonable belief that it knows the true identity of each customer.  The CIP must contain procedures for opening an account that specify the identifying information that will be obtained from each customer.  The credit union must obtain, at a minimum, the following four pieces of information from the customer prior to opening an account:

• Name
• DOB for individuals
• Address
• Identification Number

In addition to gathering the four pieces of information outlined above, the credit union is required to verify the identity of the customer using the information gathered.  In verifying the information, the credit union may use documents and/or non-documentary methods, if its CIP procedures allow for that.  If there are discrepancies in the information, this may create a challenge in the credit union’s ability to form a reasonable belief that it  knows the true identity of a member.  The CIP procedures should outline steps the credit union will take to properly, and more accurately, identify an individual.  The conflicting information may have been made in error.  In any event, the CIP procedures must specify how the credit union will resolve discrepancies using documents and/or non-documentary information.   This may include calling the member to address inconsistencies, relying on other sources such as public databases, or checking references with other banks and/or credit unions.  If the information is indeed conflicting and can’t be reconciled, the credit union may have an obligation to file a SAR. Also note that the credit union is well within their right to put the account on hold while it reconciles the information.

 

Q: Can a credit union accept a current passport instead of a taxpayer identification number or social security number at account opening?

A: Generally, credit unions must obtain an identification number before opening an account for a prospective member.  For US persons, this would be a taxpayer identification number.  For non-US persons, a current passport would suffice.  It appears, however, that a credit union may accept other forms of ID if its CIP procedures provide for that, especially where the customer has applied for a taxpayer identification number, but has not yet received one.  Generally, before opening an account for a customer, the credit union must be able to form a reasonable belief that it knows the true identity of the customer based on the information gathered. The relevant rules can be found in 31 CFR 1020.220.

Before opening an account for a customer, a credit union must collect identifying information, including an identification number.  For a U.S. person, this will be a taxpayer identification number.  For a non-U.S. person, one or more of the following will be acceptable: (i) a taxpayer identification number; (ii) passport number and country of issuance; (iii) alien identification card number; or (iv) number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard.

The rule does make an exception for individuals who are applying for a taxpayer identification number.  According to the rule, a credit union’s CIP may include procedures for opening an account for someone who has applied, but not received a taxpayer identification number.  This may include accepting other forms of identification number, including a current passport.  However, the procedures must ensure that the individual obtains the taxpayer identification number within a reasonable period of time after the account is opened.

(B) Exception for persons applying for a taxpayer identification number. Instead of obtaining a taxpayer identification number from a customer prior to opening the account, the CIP may include procedures for opening an account for a customer that has applied for, but has not received, a taxpayer identification number. In this case, the CIP must include procedures to confirm that the application was filed before the customer opens the account and to obtain the taxpayer identification number within a reasonable period of time after the account is opened.  31 CFR 1020.220(a)(2)(i)(B)(emphasis added.).

Also, the rules provide credit unions with the ability to verify identification through non-documentary methods.  The credit union’s CIP must specify the situations where a credit union would use non-documentary methods to verify a customer’s identity and how to handle them, including when a customer doesn’t have all the necessary documents at the time he/she comes in to open the account.

 

Q: Is a credit union required to file a CTR where a member withdraws $9,500 in cash from a rep payee account and $700 from his personal account on the same day? 

A: The answer to your question can be found in Treasury’s BSA/AML regulations, 31 CFR 1010.  Yes, in this situation, the credit union is required to file a CTR because, although there were multiple transactions, the transactions: (i) resulted in a cash withdrawal in excess of $10k; (ii) occurred during the same business day; and (iii) were made by the same person.

31 CFR 1010.311 requires that a credit union report cash transactions in excess of $10,000 during the same business day. Indeed, the rule states:

Each financial institution other than a casino shall file a report of each deposit, withdrawal, exchange of currency or other payment or transfer, by, through, or to such financial institution which involves a transaction in currency of more than $10,000, except as otherwise provided in this section.  31 CFR 1010.311 (emphasis added.).

Moreover, the amount over $10,000 can be either in one transaction or a combination of cash transactions.  The credit union should treat the multiple transactions as a single transaction if the credit union knows that the transactions are by the same person. The rule provides:

(b) Multiple transactions. In the case of financial institutions other than casinos, for purposes of the transactions in currency reporting requirements in this chapter, multiple currency transactions shall be treated as a single transaction if the financial institution has knowledge that they are by or on behalf of any person and result in either cash in or cash out totaling more than $10,000 during any one business day (or in the case of the U.S. Postal Service, any one day). Deposits made at night or over a weekend or holiday shall be treated as if received on the next business day following the deposit.  31 CFR 1010.313 (b)(emphasis added.).

Here, although the first cash withdrawal of $9,500 was made from a rep payee account, and thus was not his own personal account and not his own personal funds, the aggregate amount withdrew on that day was in excess of $10,000 and was made by the same person.  The credit union was asked to give a single person more than $10,000 in cash on a single day. The fact that the transactions involved multiple, or different, accounts is irrelevant.  Accordingly, the credit union should file the CTR with FinCEN.

 

Q: What steps should a credit union take when it gets an “OFAC hit”?

A: OFAC’s (Office of Foreign Assets Control) regulations prohibit all US persons from engaging in transactions with certain specified persons and countries. Specifically, credit unions must: (i) block accounts and other assets of “Specifically Designated Nationals” (SDNs) and “Blocked Persons”; and (ii) block or reject prohibited transactions with SDNs and Blocked Persons.

Generally, if the credit union gets an “OFAC” hit, the credit union needs to confirm that the individual that was flagged is indeed the individual on the SDN list. Treasury has a hotline dedicated to providing assistance with making a determination if the person is the same. If the person or entity is indeed the same included on the SDN list, the credit union cannot open the account; but rather must block the transaction and account, and also report the blocked transaction/account to OFAC.

While not required by specific regulation, NCUA expects that a credit union will establish and maintain an effective, written OFAC compliance program commensurate with its OFAC risk profile. Amongst other things, the policies, procedures and processes should address how the credit union will identify and review transactions and accounts for possible OFAC violations. The policies and procedures should also define the credit union’s criteria for comparing names provided on the OFAC “SDN” list with the names in the credit union’s files or transactions and for identifying transactions or accounts involving sanctioned countries. Furthermore, the policies and procedures should address how the credit union will determine whether an initial OFAC hit is a valid match or a false hit.

 

Q: Where can I go for assistance in developing our BSA/AML risk-based model? The rules don’t say anything. I’ve checked the FFIEC BSA/AML examination manual and it doesn’t say much on how the risk based model program should look like.

A: Honestly, the guide or the rules will not go into that level of detail. Here’s the reason. Generally, governments around the world feel that the risk-based approach is preferable to a more prescriptive approach in the BSA/AML space because it is:

1. Flexible- AML/BSA risks vary across jurisdictions, customers and products; and
2. Effective- Credit unions are better equipped than legislators to effectively assess and mitigate specific BSA/AML risks they face.

Notwithstanding the lack of specific guidance, however, there are four main things a credit union’s risk assessment should consider:

1. Members- Who are you selling your products or offering services to? Individuals or private companies? Foreign public officials? Money Servicing Businesses?
2. Products and Services- What products and services are you offering that may be vulnerable to money laundering? Online banking? Private banking? Correspondent banking? Wire transfers?
3. Geographical Location- In what countries do your members reside and what are their countries of citizenship? Where are your corporate customers headquartered and where do they conduct their business? Are you engaging in transactions involved with countries included on any government lists?

Generally, some member types , products and services, and geographical locations pose higher risks than others, and thus your program wants to properly identify those and tailor its monitoring accordingly.

As indicated above, we received a substantial number of BSA/AML inquiries. Indeed, compliance with the BSA/AML rules remains a top priority for financial institutions. NAFCU is here to assist you as you navigate through the rules and will keep you abreast of emerging challenges, and regulatory developments. In fact, the industry is still awaiting FinCEN’s final rule on Customer Due Diligence and beneficial ownership requirements, which is expected this year. We will keep you posted.

###

NAFCU’s new BSA Seminar + Certification is Here!

We’ve had hundreds of requests from credit unions to provide more BSA training, and I’m excited to announce, it’s here. We’ll be holding our first in-person, BSA Seminar in New Orleans October 24 – 28. If those dates and location sound familiar to you, it’s not déjà vu. We’ll be running this BSA Seminar concurrently to our Regulatory Compliance Seminar. While they are two separate educational events, the networking aspects will be co-mingled, making it an awesome way to build your network of credit union and BSA professionals from around the country.

You can expect a full week of everything you’ve ever wanted to know about BSA, but didn’t have time to ask. It’s designed for just credit union professionals. You’ll find no erroneous “bank” information that doesn’t apply to credit unions. Check out the full agenda and sessions.

There’s an optional, pre-conference workshop to help get you up-to-speed on BSA fundamentals – it’s perfect if you’re new to BSA or just want a refresher. And at the end of the week, you’ll have the opportunity to get certified when you sit and pass the NAFCU Certified Bank Secrecy Officer (NCBSO) exam.

This seminar, and the certification, is an excellent way to demonstrate to NCUA and FinCEN you’re dedicated to compliance and to protecting your credit union against financial crime. It was designed by NAFCU’s Director of Education Devon Lyon, former director of BSA at State Department Federal Credit Union – so the curriculum is extremely relevant at both a strategic and tactical level. You’ll walk away ready to master your AML responsibilities. And of course, it fulfills your yearly BSA training requirement!

We have limited seating – so register early!

FinCEN's CTR FAQs Continued

Written by Michael Coleman, Regulatory Compliance Counsel

Yesterday we blogged about the Financial Crimes Enforcement Network's (FinCEN) recently issued frequently asked questions (FAQs) regarding SARs, and FAQs regarding CTRs. Today we'd like to take a closer look at the CTR  FAQs. Specifically, a couple of the FAQs which address issues that we have received questions about concerning the filing of the new CTR forms.

The CTR FAQs are very detailed and provide valuable insight and examples into the process of filing the new CTR form. Many of the FAQs deal with the technical process of filing the CTR, but there are also many FAQs that concern the substance of the form and provide examples of how to fill out sections of the new form. Here are a couple CTR FAQs that you might find useful: 

"12. What is the timeframe for filing the FinCEN CTR? I have seen both 15 and 25 days referenced.

FinCEN regulations have consistently maintained a regulatory requirement that CTRs be filed within 15 days. The 25-day period was implemented, in connection with receipt of magnetic media files (ended December 2008), to account for physically transporting (shipping) the magnetic media to the processing center in Detroit, Michigan. FinCEN understands that this business practice had continued with respect to batch e-filing, particularly considering previous public guidance referencing the 25-day period.

In light of the comments received and acknowledging that some financial institutions may have needed to change their business processes to become compliant with the rules, FinCEN determined that it would temporarily maintain the 25-day compliance period referenced in its earlier specifications until March 31, 2013, for those filers that needed to update their systems in order to be in compliance with the established regulatory requirements. This temporary extension to the filing requirements was to allow sufficient time for filers to adjust submission schedules to meet established regulatory requirements.

As of April 1, 2013, all FinCEN CTRs must be filed within 15 calendar days of the reported transaction(s)."

 [...]

15. I am filing the FinCEN CTR on an entity; however, the selections in Item 2a-2c all reference a person. What selection would I choose when filing on an entity?

Under the BSA regulations, the definition of “person” found at 31 CFR 1010.100(mm) is “an individual, a corporation, a partnership, a trust or estate, a joint stock company, an association, a syndicate, joint venture, or other unincorporated organization or group, an Indian Tribe (as that term is defined in the Indian Gaming Regulatory Act), and all entities recognizable as legal personalities.” Since an entity cannot physically conduct a transaction, the only selection that would apply is 2c “Person on whose behalf transaction was conducted.” In addition, if filing on an entity, a filer must select the checkbox (Item 4b) for “If entity” in Part I.

If more than one Item 2 option applies to a person involved in the transaction(s), filers should complete only one Part I on that person with only one entry in Item 2 pursuant to the following construct:

When to select Option 2a: In addition to when only Option 2a applies, filers should select Option 2a “Person conducting transaction on own behalf” if 1) Options 2a, 2b, and 2c apply; 2) Options 2a and 2b apply; or 3) Options 2a and 2c apply.

When to select Option 2b: In addition to when only Option 2b applies, filers should select Option 2b “Person conducting transaction for another” if both Options 2b and 2c apply and Option 2a does not apply.

When to select Option 2c: Filers should select Option 2c “Person on whose behalf transaction was conducted” only on the person for whom the transaction is conducted. This person cannot have other roles within the transaction or the options would apply.

When to select Option 2d: In addition to when only Option 2d applies, filers should select “Courier Service (private)” if multiple options that include 2d “Courier service (private)” apply."

 As JiJi mentioned yesterday, these FAQ documents are must read materials if you are responsible for BSA compliance at your credit union. 

The Newest SAR and CTR FAQs from FinCEN

Written By JiJi Bahhur, Regulatory Compliance Counsel

Last Friday, the Financial Crimes Enforcement Network (FinCEN) released two sets of frequently asked questions(FAQs): FAQs Regarding SARSs and FAQs Regarding CTRs.  The purpose of these questions is to assist financial institutions with the use of FinCEN’s new SAR and CTR forms, which, as of April 1, 2013, are the only acceptable forms for reporting suspicious activity and applicable currency transactions – an item we’ve blogged about on numerous occasions. 

The FAQs are very detailed, and if you have any dealings with SARs or CTRs at your credit union, I’d suggest you read through them.  As someone who used to be heavily involved in filling out and filing CTRs and SARs, I can say that even I learned a few new things.  Here’s a taste of information from the FAQs Regarding SARs:

“1. What are the expectations for completing the Items with an asterisk (“critical”) and without an asterisk (“non-critical”) found on the FinCEN SAR or any other FinCEN report?

As explained in FinCEN’s March 2012 guidance (FIN-2012-G002), for both critical and non-critical elements, financial institutions should complete those Items for which they have relevant information, regardless of whether or not the individual Items are deemed critical for technical filing purposes.

For critical Items, financial institutions must either provide the requested information or affirmatively check the “Unknown” (Unk.) box that is provided on the FinCEN SAR and FinCEN Currency Transaction Report (CTR) (or any other FinCEN Report).

For non-critical Items, FinCEN expects financial institutions will provide the most complete filing information available within each report consistent with existing regulatory expectations. Based upon feedback from law enforcement officials, such information is important for query purposes. However, the new FinCEN SAR and FinCEN CTR do not create any new obligations to collect data, either manually or through an enterprise-wide IT management system, where such collection is not already required by current statutes and regulations, especially when such collection would be in conflict with the financial institution’s obligations under any other applicable law. Therefore, a financial institution may leave non-critical fields without an asterisk blank when information is not readily available.

2. How do I meet my underlying obligation to submit a complete and accurate report if my filing software does not allow me to include known information for a field without an asterisk?

FinCEN expects financial institutions to have the capability to submit information for any of the data fields in the FinCEN SAR or CTR (or any other FinCEN report). In general, if your financial institution’s filing software does not permit the institution to include information in a field without an asterisk where information has been collected and is pertinent to the report, the financial institution should instead complete a discrete filing for those transactions until the software is updated. If a filing has been submitted in which such information was not included because of such a limitation in the filing software, an amended filing should be completed using either the discrete filing method or an amended batch filing, once the software is updated. Such software updates should be implemented within a reasonable period of time.

If your institution has questions regarding the applicability of this general guidance, please contact the FinCEN Regulatory Helpline at (800) 949-2732 for further information.”

 

Economic Census Forms; Upcoming Webinars & Webcasts

Written by Steve Van Beek

Economic Census.  Your credit union may have gotten an Economic Census form (the forms were sent between October and December).  The deadline for completion is February 12th.  To help facilitate understanding of this form and the requirement, the Office of Business Liaison at the Department of Commerce has put together information, numerous FAQs and is hosting a webinar on Wednesday, January 24th at 1:00 p.m. EST.  Note: There was a prior webinar on October 11th, 2012.  The slides from that presentation are here (very large PPT file) and a transcript is available here.

There are additional help resources available here.  

The FAQs include specific information for different industries - including credit unions.  The credit union FAQs are here and forms are here.  Remember, the deadline is February 12th, 2013.  

Note:  Not every credit union will receive a form.  But, be sure to check with folks and see if your CU has and make sure it is completed by February 12th. 

***

There are also numerous other webinars and webcasts this week.  

NCUA Webinar on Serving Low-Income Members.  NCUA is hosting a free webinar on Strategic Issues for Servicing Low-Income Members.  This webinar is Wednesday, January 23rd at 2 p.m. EST.  If your credit union recently received your low-income designation, this might be a useful webinar.  Here is from the announcement:

"Staff from [NCUA's] OSCUI and NCUA’s Office of Consumer Protection will discuss ways low-income designated credit unions may improve and increase service to low-income members. In addition, the staff will present sample products and services designed to meet the needs of these members."

You can register here. 

***

NCUA HMDA Webinar.  NCUA will also be offering a free webinar entitled HMDA: Accuracy and Timeliness.

The webinar will be Thursday, January 24th at 2 p.m. EST.  You can register for the webinar here and you can also send any questions to [email protected].  

NCUA also recently issued Regulatory Alert 13-2 which highlights the March 1, 2013 deadline for submitting HMDA data.  Earlier, they had sent Regulatory Alert 13-1 which discusses the $42 million asset threshold for 2013 HMDA reporting.

Does anyone know how these Regulatory Alerts are delivered?  Why don't they go through NCUA Express?  Another one they buried on their website was Regulatory Alert 12-4 on the CFPB's Remittance Rule. 

***

Upcoming NAFCU Webcasts.  NAFCU will be offering a very full slate of webcasts in 2013.  And, you can be assured that quite a few will be focusing on compliance - especially the new mortgage requirements.  Below are our next couple webcasts:

• The CFPB's International Remittance Transfer Disclosure Rules - Thursday, January 24th from 2:00 - 3:30 p.m. EST.  Mary Lou Heighes will walk attendees through the final rule as well as aspects of the proposed rule that you need to know.  Mary-Lou has been very involved in the remittance transfer rule from the start and gave a great presentation at our Compliance Seminar in October.  And, because of the importance of this rule - we are extending the early-bird registration price indefinitely.  You can sign-up for this webcast any time and receive the early-bird price.  

Remember: All of NAFCU's webcasts are available on-demand as well.  If you can't make the live webcast (perhaps because you need to watch the HMDA webinar or the Census webinar live), you can always watch the on-demand webcast at a later date.

• Top HR Compliance Issues Affecting Credit Unions in 2013 - Wednesday, February 6th from 2:00 - 3:30 p.m. EST.  Margaret Fiester from the Society of Human Resource Management (SHRM) will discuss how credit unions will be impacted by various future reforms - including tax reform and health care reform.  Register by January 30th to Save $100.  

NCCOs:  Both of the webcasts above will earn credits toward renewing your NAFCU Certified Compliance Officer (NCCO) designation.  If you see this logo -  - you'll be sure the webcast will be offering NCCO credits.

New NCCO Affidavit Process:  We also have a new, streamlined NCCO affidavit.  You can find the fillable-form located here.  If you are an NCCO and attend a NAFCU webcast with this symbol -   - be sure to use this form.   

Fair Lending FAQs - Future HMDA Changes; NAFCU Member Call-In

Written by Michael Coleman, Regulatory Compliance Counsel

The Federal Reserve’s Consumer Compliance Outlook for the First Quarter 2012 contained a section on the most frequently asked questions from the Federal Reserve Board’s November 2, 2011, webinar entitled “Fair Lending Issues and Hot Topics.” Question #7 focused on how Dodd-Frank changed HMDA requirements and indicated that Section 1094 of Dodd-Frank amended HMDA to require financial institutions to collect and report new data for mortgage loans in the future.  The new data will include:

• Origination channel (retail, broker, or other)
• Applicant's age
• Applicant's credit score
• Property value
• Loan term
• Term (in months) of any introductory interest rate period
• Rate spread for all loans
• Total points and fees payable at origination
• Term (in months) of any prepayment penalty
• Negative amortization
• Loan originator unique identifier, universal loan identifier, and parcel loan number (as the CFPB may determine appropriate)

Dodd-Frank transferred authority over HMDA and Regulation C to the CFPB. The CFPB has not yet issued rules to implement the changes to HMDA and revise Regulation C, nor did it specifically mention the rule revising Regulation C in its "Semi-Annual Regulatory Agenda." However, the CFPB's Agency Rule List indicates that revisions to Regulation C are in the “prerule” stage.

Note: Dodd-Frank did not mandate a deadline for a final rule, but keep this issue on your radar, as we'll see amendments to HMDA at some point in the future.

***

Free Member Call-In.  On Thursday, June 14 at 3:30 p.m. EDT, NAFCU will hold its mid-year Member Call-In.  The call is open to all NAFCU members but registration is required.  The call will feature NAFCU President and CEO Fred Becker and the association's government affairs team discussing latest developments in Washington affecting credit unions, including MBL, overdrafts, interchange, housing finance reform, CFPB, NCUA and more.  As always, you will have the ability to ask questions directly to NAFCU staff during the call.  

Don't miss out - register now for the June 14th NAFCU Member Call-In.  If you can't make the live call, the archived version is usually made available within a short period of time.  

Three-Letter Acronym Day! TIS, ODP, BSA and BOD

Posted by Anthony Demangone

Here are a few three-letter topics for you.

TIS.  (Hat tip to Mr. Van Beek.) A report released by PIRG could draw additional attention to Truth in Savings disclosures.  PIRG's study found that banks are still "hiding" fees. 

Fewer than half (38%) of branches complied easily with the simple researcher request for fee schedules required by the Truth In Savings Act; only after two or more requests did a total of 55% percent of branches provide fee schedules as requested and as required by the Truth In Savings Act.  In a finding virtually identical to recent U.S. Government Accountability Office (GAO) results, nearly one-quarter (23%) of branches surveyed refused to comply at all. Others provided often weighty piles of useless other brochures.

PIRG made recommendations to the CFPB to fix the issue.

• The CFPB should extend the requirements of the Truth In Savings Act to the Internet. It should require that banks post fees in a searchable web format (e.g., xml or similar), to encourage the establishment of local online shopping guides by community groups.
• The CFPB should require that the most important savings and checking disclosures required by the Act be provided prominently in a tabular format, such as the “Schumer Box” required for credit card disclosures.

They even make a recommendation to NCUA.

Credit unions generally have fewer and lower fees than banks, but their account disclosures are even murkier than most bank disclosures. The NCUA should, with advice from the CFPB, issue model guidelines on fee disclosures and require credit unions to explain the basic terms of their accounts in a better way.

How much of this report will find its way into guidance or regulation?  It is hard to say.  But if the CFPB cracks open Regulation DD, this report will surely find its way to the desk of those working on the project.   And with all of the consumer-friendly changes to Regulation Z, it seems it is only a matter of time until changes find their way to the "checking account" side of things.

ODP.  You may remember that the FDIC issued guidance to its regulated entities regarding their ODP programs.  As I wrote earlier, it does seem possible that the guidance could find its way to NCUA.  That has not yet happened.  But for those tracking this issue, the FDIC has issued an FAQ document to provide additional guidance.   For those tracking the FDIC ODP issue, this document is a must-read.

BSA.  There are a few things to mention here.  First, for NAFCU members - the latest issue of the BSA Blast is available.   It has a few nice articles, a BSA and OFAC-centric calendar, as well as a BSA quiz for your staff.  Enjoy.  And just in case folks forgot that BSA is still an important issue - remind them that a Florida bank was just hammered with a $7 million CMP for BSA deficiencies.  Finally, if you have a few minutes, read this article. (The Guardian.)  It outlines how a large U.S. bank allegedly was used to launder billions of dollar of illicit drug money - over the protests of one of the bank's own anti-money laundering specialists. 

BOD. Finally, you may want to forward this nice article (Boardmember.com) to whomever handles your board issues.  In short, the article discusses five things that your board members should be thinking about as they work on your board.   

SAFE Act Registry FAQ Posted

Posted by Anthony Demangone

If you've read our blog over the past few years, you'll know how much we love FAQ guidance documents.  Well, here's another one to add to the list.  A SAFE Act FAQ. 

The NMLS Registry posted the guidance document on Friday.  There's a ton of good stuff here.  Be sure to pass this along to your SAFE Act administrator. Here's a taste:

Q. An MLO’s fingerprints came back as “illegible”.  Do I need to repay the criminal background check fee to schedule a new appointment?

A. No.  The criminal background check fee covers the collection and submission of a second set of fingerprints if the first set is deemed illegible by the FBI.  If the second set of fingerprints is deemed illegible, the MLO does not need to submit a third set of prints.  Rather, the FBI will attempt to locate any pertinent criminal history record information using the MLO’s name and demographic information provided in the MU4R.

FAQs

Posted by Anthony Demangone

Here's an old post, which references a few other posts as well.  All of them touch upon "frequently asked questions" documents.  Regulators issue these guidance documents to answer, well, frequenly asked questions.  These documents can be very useful for a number of reasons.

1. They generally are written in something akin to English. 
2. They can be a quick way to provide an authoritative answer to a colleague.  For example, is a modular home a manufactured home for purposes of Regulation C? Here's what the FFIECsays in a HMDA FAQ.

Modular homes. Is a modular home a manufactured home for purposes of Regulation C?

Answer: For Regulation C reporting, a manufactured home is one that meets the HUD code, 12 CFR 203.2(i). The official staff commentary indicates that modular homes that are ready for occupancy when they leave the factory and meet all of the HUD code standards are included in the definition of "manufactured home".203.2(i)-1. The comment, and a prior FAQ on this site, have raised questions about whether a modular home should be reported as a manufactured home or as a one- to four-family dwelling. Until the Board provides further guidance regarding modular homes, lenders may, at their option, report a modular home as either a one- to four-family dwelling or as a manufactured home.

So, take a look at the blog post below and see if any of the FAQs are useful.  We probably should update the post at some point, as new FAQs are being produced all the time. 

Here is one of my favorites from the FFIEC website on HMDA FAQs - which covers both regulatory and technical questions.  Also, this blog has a category of "FAQs" that you can look through.  Also, this post has numerous FAQ documents organized by topic.  Sometimes the first place to look is if the regulators have specifically addressed your question before.  

Happy hunting, everyone!

________________________________________________________

Check out Sheshunoff's Mortgage Lending Operations and Administration manual. 
Be sure to include the NAFCU11 promo code at checkout to save 10% on the price.  

This and That...

Posted by Anthony Demangone

My inbox still runneth over. Here are some more items of note.

Da Fed.  The Fed just released two rule-makings.  I'll get into more details later in the week, but for now...

• They released this interim final rule (compliance deadline April 1, 2011), to address appraiser independence and compensation. The rule-making was required under Dodd-Frank.
• They released this proposal to close a few loopholes that popped up concerning Reg Z's rules on credit cards. 
• They also released a final rule that finalizes an interim final rule concerning the compliance date for gift cards. 

STS.  I guess that's the new acronym for NCUA's short-term, small amount loan regulation. NCUA recently released NCUA Regulatory Alert 10-RA-13, which is a FAQ document that addresses the recent changes. For example, the following question and answer addresses balloon payments in relation to STS loans. 

Must the loan be amortized, or can the borrower make a balloon payment at the end of the loan term?

The loan must be amortized in such a way that allows the borrower to repay the loan in the given term. FCUs must structure the payments so that the borrower is paying a portion of the principle and interest in equal or near-equal installments on a periodic basis over the course of the loan. While NCUA is not prescribing specific payment schedules (such as monthly or bi-weekly), FCUs should offer payment schedules that allow borrowers to easily repay the loan within the given term.

 FinCEN.  FinCEN was a busy beaver recently.

• FinCEN will reorganize its rules  next year in an effort to make the rules easier to understand.  Rules affecting a particular industry will be grouped together, for example.  Here's an index of the proposed reorganization.  Our rules will be under Part 1020.  Keep in mind that this will not change anything of substance.  But it will take some time to get used to, and all of our existing BSA citations will be dated once the changes go into affect.  Ugh.
• FinCEN published a study  that looked at SARs which reported identify theft.  There is a ton of information in there, and I would forward the study on to your fraud team.  Of note, credit card fraud continues to be the most common type reported on SARs.  And roughly 27 percent of fraud victims know the alleged suspect.  

FTC.  Speaking of identity theft, the FTC announced a bundling of consumer-oriented ID theft resources. You may be able to help consumers by pointing them toward these free resources.  (SHAMELESS PLUG ALERT!) In addition, NAFCU does sell a number of security and ID-related statement stuffers. 

Frequently-Asked-Questions

Posted by Steve Van Beek

Welcome back, we hope everyone had a peaceful, long weekend.

It seems appropriate to ease back into the week with a softer blog posting.  One of the great aspects about this blog is the ability to store research documents online in one place.  Often times, we are able to point NAFCU-members to information that we have already written on the blog.  Regulators do the same with frequently-asked-questions (FAQs) documents.  

Here is one of my favorites from the FFIEC website on HMDA FAQs - which covers both regulatory and technical questions.  Also, this blog has a category of "FAQs" that you can look through.  Also, this post has numerous FAQ documents organized by topic.  Sometimes the first place to look is if the regulators have specifically addressed your question before.  

Red Flags FAQ; Pandemic

A bunch of regulators, including NCUA, recently issued a frequently asked questions document to provide guidance on the recent Red Flags Identity Theft Prevention rules.  Access it here.  I just love FAQs.  I do.  They are written in English.  They address real-world problems that have surfaced since the rule was released.  I just love, love love them.  Here's a taste of what you'll find inside:

1. Do the Red Flags Rules, Card Issuers’ Rules, or Address Discrepancy Rules contain record retention requirements?

These three Rules do not contain specific record retention requirements. However, financial institutions and creditors must be able to demonstrate that they have complied with the requirements of the Red Flags and Card Issuers’ Rules, and users of consumer reports must be able to demonstrate that they have complied with the requirements of the Address Discrepancy Rules, in addition to any other applicable record retention requirements.

8. Are credit union service organizations (CUSOs) covered by the Red Flags Rules and Guidelines?

CUSOs, according to the Federal Credit Union Act, provide “services which are associated with the routine operations of credit unions” and are “established primarily to serve the needs of its member credit unions, and whose business relates to the daily operations of the credit unions they serve.” 12 U.S.C. §§ 1757(5)(D), (7)(I). A CUSO that is a “creditor” under the FCRA is covered by the Red Flags Rules and Guidelines issued by the FTC.

***

The WHO has officially declared a pandemic.  What does this mean for compliance?  The WHO lists the risk of a pandemic with phases, numbered one through six.  We're now at WHO pandemic phase six.  Some credit unions use the WHO stages to trigger different parts of their pandemic plan.  You may want to check your pandemic plan to see what phase 6 triggers.

Corporate Stabilization Program

Here's the latest materials from NCUA's corporate stabilization program.  Yesterday, NCUA released a number of guidance documents designed to explain how the corporate stabilization program will affect natural person credit unions.  Rather than link to all of the documents separately, NCUA created a Corporate Stabilization Program page.  Access it here.

From there, you'll be able to access the following documents:

1. Accounting Bulletin 09-01, which describes the accounting moves credit unions will need to make to account for transactions related to the stabilization program.
2. FAQs regarding the program.  (You know how much I love those FAQs.)
3. And lots of other stuff, including the ANPR.

During yesterday's NAFCU webcast, NCUA officials indicated that they'll add to this page, and to the FAQ when necessary.  Of note: Be on the lookout for a letter to credit unions which will include supervisory guidance given to examiners about this situation.  To paraphrase NCUA officials, they indicated that NCUA examiners are being told to take into account effects of the stabilization program (and its affects on your ROA and net worth) when they examine your credit union.  I'll give you a shout out when that becomes available.

Editor's note.  My post wasn't all that clear on a major point.  My understanding of NCUA's presentation was this: NCUA is instructing examiners not to penalize credit unions for any affects that the stabilization plan would have on a credit union's financials. 

Frequently Asked Questions; delicious

Anthony has mentioned the value of Frequently-Asked-Questions documents in past blog postings here and here.  These documents can help compliance officers weave through convoluted regulations and find answers to common issues.  Here are a few that I've found useful in the past: 

Bank Secrecy Act

Anti-Money Laundering Compliance FAQs

FinCEN Answers to FAQs on BSA

FAQs on Final CIP Rule - February 2004

FAQs on Final CIP Rule - May 2005

FAQs Relating to BSA and Hurricane Katrina

OFAC

OFAC Q&As Prepared by Treasury

Privacy

FAQs on the Privacy Regulation

Share Insurance

FAQs from NCUA's October 7, 2008 Webinar on Share Insurance Changes

NCUA's FAQs on NCUSIF and Share Insurance

HMDA

FAQs on Regulation C (HMDA Reporting)

RESPA

FAQs on RESPA for Industry

Appraisals

FAQs on Appraisal Regulation and Interagency Statement*

*Note:  The Agencies recently announced a proposal to replace this interagency statement.

Third Party Due Diligence

FAQs from NCUA's January 29, 2008 Webinar on Third-Party Relationships

Flood Insurance

2008 Proposal on Interagency Q&As on Flood Insurance (would replace 1997 Q&As)

1997 Interagency Q&As on Flood Insurance

Servicemembers Civil Relief Act (SCRA)

HUD's Q&As for Lenders Regarding SCRA

Judge's Guide to SCRA - including Q&As

Health Savings Accounts

Q&As on Health Savings Accounts - IRS Notice 2004-50

Q&As on Health Savings Accounts - IRS Notice 2008-59

Check 21 Act

Consumers FAQs on Check 21

FAQs for Financial Institutions on Check 21

Check 21 FAQs on Financial Institutions Requirements - from ABA

Accounting for Loan and Lease Losses (ALLL)

Questions and Answers on Accounting for Loan and Lease Losses

Online Banking

FFIEC Guidance on Authentication in an Internet Banking Environment

Savings Bonds

FAQs on Savings Bonds

***

You never know when these FAQ's will come in handy.  That is why I have mine bookmarked on my delicious page.

If you are wondering what delicious is, take a look at the user guide and slides I prepared for a talk on Organizing the Compliance Information Flow at NAFCU's 2008 Regulatory Seminar.

If you know of other valuable FAQ documents, please let us know by adding a comment to this post.