NAFCU Compliance Blog

Considering Medical Information under the FCRA; Housing & Alternative Credit Scores Research

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

Good morning, Credit Union Compliance World!

In a short space of time, your NAFCU Regulatory Compliance Team got pinged with a couple different versions of the same question – when can credit unions consider medical information in making credit decisions? It's an area where most credit unions don't have a lot of traffic.

Credit union compliance officers clearly have an instinct is that this is an Equal Credit Opportunity Act (ECOA) issue. This makes sense because it speaks to our sense of fairness, but neither ECOA nor Regulation B address the question. However, it is dealt with fairly directly by the FACTA amendments to the FCRA.

Section 604(g)(2) of the FCRA (codified at 15 U.SC. § 1681b(g)(2)) generally prohibits credit unions from obtaining or using medical information in connection with any determination for credit. This applies to any creditor and "medical information" is defined to include any information relating to physical, mental or behavioral health of an individual.

The medical information does not need to come from a credit report for this prohibition to be implicated. It is important to understand that the prohibition against using medical information applies regardless of how the credit union obtained the medical information. The information could be received from the member directly, or from their friends or family.

Subpart D of Regulation V implements the medical information provisions of the FCRA. Section 1022.30 contains the general prohibition against obtaining or using medical information in credit decisions, unless an exception is met.

While the rule prohibits obtaining medical information, it also addresses that this information is often provided to credit unions completely unsolicited. Section 1022.30(c) states that if unsolicited medical information is shared with the credit union, the credit union has not violated the prohibition. However, to use that information, the credit union would need to meet an exception under the rule.

Section 1022.30 contains several exceptions to this general prohibition which may apply, including a financial exception, an exception for special credit-related assistance programs for those with medical conditions, an exception for forbearance programs triggered by medical conditions or events, an exception for following the member's documented request to accommodate a particular circumstance, and more. Below is more detail on the financial exception.

Financial Exception

The financial exception allows a creditor to obtain and use medical information as long as the information is the "type of information routinely used in making credit edibility determination, such as information relating to debts, expenses, income, benefits, assets, collateral, or the purpose of the loan, including the use of proceeds." The information can only be used in a manner and to an extent that it is no less favorable that comparable non-medical information. To illustrate, the credit union could consider that an applicant owes medical bills related to oncology to the same extent that it would consider similar bills not related to a medical issue. The bills can be considered as a liability affecting their income and assets, but the applicant's implicit need for oncology treatment should not be considered. The credit union cannot consider the applicant's physical, mental or behavioral health, condition or history, type of treatment, or prognosis into account. 12 C.F.R. § 1022.30(d)(1).

So, if an applicant makes a disclosure of medical information during a loan application process or asks for loss mitigation assistance in connection with a medical crisis, the credit union might review section 1022.30 closely to ensure it is in compliance when requesting or considering any medical information in connection with a loan. Another thing to consider is whether state laws in your jurisdiction regarding fair lending or disability protections have prohibitions against considering medical information or the member's medical condition in a credit decision.

Housing & Alternative Credit Scores Research

NAFCU is conducting research to help us in our advocacy efforts on your behalf. We want to hear about your credit union's health, mortgage lending and views on alternative credit scores. If you have a moment, please take the time to complete this survey. The survey will be open through this Friday.

CFPB Cracks Down on FCRA Violations

Written by Jennifer Aguilar, Regulatory Compliance Counsel

Last month, the CFPB fined JPMorgan Chase (JPMorgan) $4.6 million for various alleged violations of the FCRA. According to the consent order, the CFPB found that JPMorgan failed to have reasonable policies and procedures in place to ensure it provided accurate information to consumer reporting agencies, failed to inform consumers of the results of dispute investigations and failed to identify the consumer reporting agency on adverse action notices.

Policies and Procedures. The FCRA does not require financial institutions to provide information to consumer reporting agencies. However, if a financial institution elects to do so, the FCRA requires it to provide accurate information. Regulation V requires these financial institutions to have reasonable policies and procedures in place to ensure that information provided to consumer reporting agencies is accurate. The procedures should be designed based on the institution's complexity and scope of activities and updated periodically. The rule also requires institutions to consider the interagency guidelines in developing their policies.

While JP Morgan had policies in place, the CFPB found that these policies were insufficient to ensure it provided accurate information to consumer reporting agencies. The policies did not contain procedures for providing information to consumer reporting agencies and did not address quality assurance, systems testing or training. The policies were also not materially altered or revised anytime between 2005 and 2014. In addition to these specific deficiencies, the CFPB determined that the policies were not appropriate given the size and complexity of JPMorgan's operations. The consent order requires JPMorgan to implement and maintain reasonable policies and procedures that fully comply with the FCRA's requirements and adequately incorporate Regulation V's guidance.

The policies at issue related to the information JPMorgan provided to consumer reporting agencies about its deposit accounts. While the consent order does not attempt to determine whether JPMorgan was providing information to a party it believed was not a consumer reporting agency under the FCRA, it may be helpful to pause for a moment and review exactly who is a consumer reporting agency. The FCRA defines "consumer reporting agency" rather broadly:

"(f) The term “consumer reporting agency” means any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports."

While this certainly covers the big three credit reporting agencies – Transunion, Equifax and Experian – it is important to keep in mind that this also covers a variety of other agencies that may be collecting information other than credit information. Consumer reporting agencies also include "specialty" agencies that collection information regarding medical records or payments, residential history, check writing history, employment history and insurance claims. When reviewing or drafting your policies and procedures on providing information to consumer reporting agencies, remember they may need to cover more than just credit information.

Dispute Investigations. Both the FCRA and Regulation V have specific procedures financial institutions must follow when they receive a direct dispute from consumers regarding the accuracy of information contained in a consumer report. The rules require institutions to conduct a reasonable investigation within 30 days of receiving the dispute, inform the consumer of the results of the investigation and provide each consumer reporting agency with corrected information, if necessary. The CFPB determined that JPMorgan had received thousands of direct disputes between 2010 and 2014 and that JPMorgan failed to provide any notice to these consumers regarding the results of the investigation. Going forward, the consent order requires JPMorgan to inform consumers about the results of all dispute investigations.

Adverse Action Notices. If a financial institution bases any adverse action on information obtained in a credit report, the FCRA requires the institution to provide an adverse action notice. The notice must include the adverse action taken; the credit score disclosure; the name, address and telephone number of the consumer reporting agency that provided the consumer report; a statement that the consumer reporting agency did not make the adverse action decision and inform the consumer of his or her right to obtain a copy of the consumer report. The CFPB found that JPMorgan failed to include the name, address and telephone number of the consumer reporting agency on approximately 17,500 adverse action notices. The notices were later corrected, however, the consent order requires JPMorgan to provide this information on all future adverse action notices.

Changes at the Credit Reporting Agencies and What It May Mean for Credit Unions

Written by: André B. Cotten, Regulatory Compliance Counsel

Hello, compliance compadres! As you are well aware, the Fair Credit Reporting Act (FCRA) and its requirements govern the furnishing of information to the credit reporting agencies ("CRAs"). The FCRA subjects data furnishers to various duties, such as, but not limited to the following: the duty to provide accurate information; the duty to provide notice of dispute; the duty to provide notice of delinquency of accounts and the duty to provide notice of negative information to members. See, 15 U.S.C. § 1681s-2(a).

Recently, I have spoken to a few members about pending changes at the big three credit reporting agencies (Transunion, Equifax, and Experian) that are aimed at improving the accuracy of consumer credit reports and better enabling consumers to dispute and correct incorrect credit information. The changes are a result of increased regulatory supervision and a 2015 consumer protection settlement with state attorneys general. Today, I will provide you with some insight into the regulatory and litigation background that and what that may mean for credit unions.

Background

The CFPB has reported that consumers continue to complain about the credit reporting industry in high numbers. The Bureau reports handling approximately 185,700 credit reporting complaints as of February 1, 2017.

Due to the widespread concerns from consumers, the CFPB recently noted in its supervisory highlights that it will be continuing to closely monitor the reporting of consumer information. The CFPB is focusing its supervision at the following issues:

• Fixing data accuracy at consumer reporting companies: Previously, examiners found more than one of the CRAs lacked good quality control to check the accuracy of their consumer records. Consequently, the CRAs have instituted quality control programs to identify whether reports are produced for the wrong consumer and whether reports contain mixed-up files. The CRAs are also taking better corrective actions when mistakes are identified.
• Repairing broken dispute processes at consumer reporting companies: CFPB examiners discovered more than one CRA was not following the federal regulatory requirement that consumers receive notice of dispute results. Examiners also found that the companies were failing to consider documentation provided by consumers on disputed items. As a result, the CRAs have improved processes for investigating disputes and are improving response letters to consumers.
• Cleaning up information from furnishers: Through reviewing information from banks and nonbanks, CFPB examiners also noticed widespread problems with furnishers supplying incorrect information, mishandling disputes, and not completing investigations. As a result, data furnishers are now better handling investigations of disputes, notifying consumers of results, and taking corrective action when inaccurate information has been supplied.

From a litigation perspective, in 2015, the CRAs reached a consumer protection settlement with the New York Attorney General's Office concerning, among other things, the accuracy of consumer credit information maintained by the CRAs; the CRAs’ practices regarding investigation of consumer disputes of alleged inaccuracies in credit reports; and the reporting of medical debt. Thirty-one other states followed suit. As a result of the 2015 settlement, CRAs are required to remove several types of data sets that report to personal credit. These are the pending changes that we are now seeing coming into effect. For example, non-loan related items such as gym memberships in default, library fines, and unpaid traffic tickets will no longer be reported. According to the terms of the settlement made in 2015, Equifax, Transunion and Experian are required to complete these additional changes 3 years and 90 days from the date of the settlement.

Moreover, as a result of the settlement with the state attorneys general, Equifax, Experian and Transunion launched the National Consumer Assistance Plan initiative to make credit reports more accurate and make it easier for consumers to correct any errors on their credit reports. The CRAs have been implementing the plan over a three year period with full implementation set for March 2018. In regards to data accuracy and quality, some of the changes include, but are not limited to the following:

• Medical debts willnot be reported until after 180-day "waiting period" to allow insurance payments to be applied. The CRAs will also remove from credit reports previously reported medical collections that have been or are being paid by insurance.
• Consistent standards will be reinforced by the CRAs to lenders and others that submit data for inclusion in a credit report (data furnishers).
• Data furnishers will be prohibited from reporting authorized users without a date of birth and the CRAs will reject data that does not comply with this requirement.
• Data furnishers will be required to report a delete for accounts that are being paid or were paid in full through medical insurance.
• The CRAs will eliminate the reporting of debts that did not arise from a contract or agreement by the consumer to pay, such as traffic tickets or fines.
• A multi-company working group of the nationwide consumer credit reporting companies has been formed to regularly review and help ensure constancy and uniformity in the data submitted by data furnishers for inclusion in a consumer's credit report.

Moving forward in application

A few members have expressed concern about the potential rise in FICO scores as a result of the forthcoming changes. Credit unions may want to temper their actions until the impact of the changes become more tangible. Since these changes are uniform, credit unions may notice a wide-spread rise in FICO scores, which may lead to natural adjustments in their risk based pricing.

Credit unions may also want to remember that the FICO score is only one of the factors used when determined whether a member qualifies for a product. There are other vital factors that will not be impacted by the CRA changes including, but not limited to the following: annual income; employment history; and debt to income ratio.

Generally, credit unions may want to continue to monitor their credit portfolios as usual for safety and soundness. If the credit union notices negative trends developing, then it should begin to make adjustments.

In the meantime, credit unions may want to revisit their lending policies, consult with their compliance officers, and contact their CRA representative to discuss the pending changes and their potential impact.

Legal, Regulatory and Practical Considerations for Sharing Credit Reports with Credit Applicants

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

Good morning Credit Union Compliance World.

When a member (or potential member) applies for a loan, it is not uncommon for the applicant to request a copy of the credit report that was pulled in connection with the application. From the member's perspective, it's something they've paid for - either literally, or because the credit inquiry will hit their credit report and possibly harm their scores.

Whether the credit union can provide that report is a common question, and you may not be surprised that neither the FCRA nor Regulation V provides clear answers.

What the FCRA says…

With regard to credit reports pulled in connection with credit applications, the FCRA does not explicitly prohibit or permit a credit union to share the credit report with the applicant. Prior to the rulemaking authority for the FCRA being ported to the CFPB, the Federal Trade Commission, release its 40 Years Experience with the Fair Credit Reporting Act guidance, a summary of the FTC's interpretations on the law. This guidance states:

"8. USER MAY DISCLOSE REPORT TO CONSUMER

The FCRA does not prohibit a consumer report user from providing a copy of the report, or otherwise disclosing it or any item or items of information in it (or any score based on the information), to the consumer who is the subject of the report.¹⁰⁶ See also section 607(c)." 40 Years guidance, p. 42 (citing FTC interpretations at 16 C.F.R. Part 600, App., Section 604―General, comment 3 (2005)).

While the FTC interpretations indicated that the FCRA does not prohibit the credit union from providing a copy of the report, it also does not require it. While this guidance is non-binding on the CFPB, in the absence of clarification by the Bureau, it is instructive.

However, this isn't the end of the story. Subsection 607(c) of the FCRA specifies that a credit reporting agency can not prohibit a credit union from disclosing the report with an applicant where an adverse action was taken:

"§ 607. Compliance procedures [15 U.S.C. § 1681e]

[…]

(c) Disclosure of consumer reports by users allowed. A consumer reporting agency may not prohibit a user of a consumer report furnished by the agency on a consumer from disclosing the contents of the report to the consumer, if adverse action against the consumer has been taken by the user based in whole or in part on the report." FCRA, § 607(c).

While a copy of the report must be provided in connection adverse actions regarding employment, that is not true for adverse credit decisions. See, FCRA, § 615(a).

So, a CRA can't prohibit the credit union from disclosing the contents of the report with the applicant where they were denied. But, the FCRA does not state what "disclosing the contents" means or whether the CRAs can prohibit sharing a report with approved applicants. While the FTC's guidance states that credit unions are not prohibited from providing a copy of the report to applicants or disclosing the contents to approved applicants, the FCRA itself seems to leave the door open for the CRAs to set boundaries on these kinds of sharing contractually.

What credit unions might consider…

So we know that the FCRA does not prohibit credit unions from sharing the report and we know that the CRAs cannot prohibit credit unions from disclosing the contents of the report the applicants where an adverse action has been taken. That leaves a lot of grey area. Here are a couple of other considerations for credit unions trying to decide how to respond to these requests by consumers:

Contractual Considerations with Your CRA

There is no limitation in the FCRA on the CRAs' ability to contractually prohibit a credit union from sharing a credit report with approved applicants. Further, as the FCRA did not specify what "disclosing the contents of a report," means, it's possible that a CRA may define how the credit union may disclose the contents in its agreements, such as allowing the consumer to view but not receive a copy of the report. Credit unions considering sharing reports with applicants should consult their agreements with their CRAs to determine whether it is prohibited from sharing reports with approved applicants, and if the method of disclosing the contents of the report is specified by agreement.

Identity Theft and Liability Considerations

The credit union might also consider whether it is sure that the applicant is who they say they are, especially if an application was made over the phone or the internet. Providing a credit report without seeing an applicant in-person creates a risk of releasing a credit report to an applicant who is pretending to be someone else. Without confirming the applicant's identity, the credit union could expose itself to liability concerning the privacy of and harm to the person whose identity is being stolen and misused. What information or procedures are necessary for the credit union to feel comfortable releasing the credit report is a risk-based issue for the credit union to determine.

Further, a credit union might consider any possible liability that arises if the member accepts a copy of the report and then loses it. If the report, with the credit union's subscriber code, is used to steal the identity of the member, a question could arise as to whether it got to the fraudster through the credit union or through the member's own negligence. Some financial institutions have suggested redacting sensitive information like social security numbers and the subscriber code before letting the report leave the building for this reason.

Availability of Free Reports

Sections 609 and 610 of the FCRA explicitly require that the CRAs provide free credit reports to consumers, along with certain disclosures regarding their rights and the proper procedures for disputing information in their credit reports. The disclosures and reports are specifically formatted to be easier for consumers to understand and act on. Many credit unions to try steer members requesting a copy of their report to these free reports as they are intended for consumer use and better accomplish the policy goals of the FCRA.

Prioritizing Your Efforts……. Superhero Style!

Written By Shereefat Balogun, Regulatory Compliance Counsel

 As compliance professionals, it's so hard being the good guy all of the time because there are so many things to focus on.   In the movies, the superhero has to choose between saving their partner, saving themselves, or completing the mission.  And of course, in the movies the superhero ends up somehow successfully doing all three.  Well, despite the common adage that "life isn't always like the movies", we can rise like the superhero by prioritizing our efforts and focus on the issues that our regulators are focusing on, specifically the CFPB and NCUA.

About three weeks ago, the CFPB issued its monthly report on consumer complaints.  Based on the report's findings, consumer debt collection continues to be a clear focus of the CFPB, as well as credit reporting. 

• Debt Collection- For a few years now, debt collection has been the source of most complaints submitted to the Bureau, and this report continues to highlight that. Debt collection was the most complained about product submitted in January 2017. Generally, consumers complain that collectors contacted them for debts that they do not owe; harass them by making multiple calls weekly or daily, or using false, deceptive, or misleading statements in connection with the debt collection; threatened to take illegal actions, such as arrests or seizure of the consumer's property; and impermissibly contacted or shared information with others, such as employers.  For more on the CFPB's efforts on debt collection practices, check out my previous blog on the topic here.

• Credit Reporting- The CFPB notes that the most common issues identified by consumers are problems with incorrect information on credit reports, which accounted for 76% of the complaints. Other issues identified include, the process for blocking and removing information resulting from identity theft.  The report states that consumers report notifying furnishers of information of identity theft with appropriate documentation, only to have accounts verified as accurate.  Notably, just two weeks ago, the Bureau issued its Supervisory Highlights which focuses on consumer reporting and concludes that the Bureau's work in the consumer reporting market is ongoing and remains a high priority.  Amongst its findings, the CFPB observes: 
  • Weaknesses in compliance management systems, such as weak oversight by management and the Board of Directors over furnishing practices; failure to update policies and procedures; weak training of employees who conduct furnishing and dispute handling operations; and weak monitoring and corrective action.
  • Absence of policies and procedures designed to: handle and investigate direct disputes from consumers; facilitate the creation and retention of documentation to substantiate final dispute decision; prevent duplicative or mixed reporting.
  • False representations by financial institutions in order to obtain a consumers' consumer report. For example, making false statements that a consumer had applied for a loan, and thus the institution had a permissible purpose to obtain the report.

These reports can be a useful tool, as they can help credit unions evaluate which products and services are more problematic and thus, should be addressed in order to avoid or mitigate regulatory risks. 

And let's not forget about our beloved…NCUA! The Supervisory Priorities for 2017 may be helpful in prioritizing our efforts.  Indeed, we referenced the 2017 priorities in a previous blog back in January.  Generally, the guidance informs credit unions of NCUA's primary areas of focus for 2017 as an effort to help prepare for this year's examination process.  As a reminder, this year's supervisory focus will be on:

• Cybersecurity- NCUA will continue to evaluate credit unions' cybersecurity risk management practices and encourages credit unions to use the Cybersecurity Assessment Tool (CAT) to bolster their security and risk management processes.  In case you may have missed it, NAFCU members can take advantage of a user-friendly workbook version of CAT here.
• Bank Secrecy Act Compliance- In 2017, NCUA field staff will focus on credit unions' relationship with money services businesses (MSBs) and other accounts that may pose a higher risk for money laundering.  NCUA expects credit unions to conduct appropriate due diligence, analysis, and monitoring when offering services to MSBs.  NCUA Letter to Credit Unions 14-CU-10 provides guidance on how credit unions can identify and mitigate risks associated with MSBs.
• Internal Controls and Fraud Prevention- NCUA field staff will continue to assess the adequacy of internal controls, as well as procedures and processes designed to prevent and control fraud.
• Interest Rate and Liquidity Risk- NCUA has started using a revised interest rate risk supervisory tool and new examination procedures to assess interest rate risk management practices.  For more information about the revised tool and new procedures, see NCUA Letter to Credit Unions 16-CU-08.  Also, examiners will focus on the relationship between interest rate risk and liquid risk.
• Commercial Lending- As you know, NCUA revised its Member Business Loans/Commercial Lending rule, which became effective January 1, 2017.  Field staff will evaluate a credit union's commercial loan policies and procedures and assess the risk management processes associated with managing a commercial loan portfolio.  NCUA warns that credit unions should be prepared to provide documentation to support management's ability to monitor and manage its commercial loan portfolio.  For more information, see NCUA Letter to Credit Unions 16-CU-11.
• Consumer Compliance- NCUA field staff will examine credit unions' compliance with the Military Lending Act (MLA), as well as the Servicemembers' Civil Relief Act (SCRA).  For more information on the MLA, see NCUA Letter to Credit Unions 16-CU-07.  NCUA Letter to Credit Unions 09-CU-12 provides guidance on complying with the SCRA. In particular, this enclosure provides a good overview of the SCRA requirements.

This month's Compliance Monitor, written by my colleague André Cotten, analyzes the NCUA's supervisory priorities for 2017 in more detail and highlights NCUA and NAFCU resources on each issue.  If you haven't checked it out already, please do!

"S..S..S.. on my chest 'cause I'm ready to save 'em."  Mantra of the year, Yes!!!  Be your credit union's superhero by focusing on the regulators' priorities to help save time, lives, and money.

As always, if you have any questions, please feel free to reach out to us.  We are here for you!

Fair Credit Reporting Act: What Credit Unions Should Know When Furnishing and Reporting Information to Consumer Reporting Agencies

Written by Shereefat Balogun, Regulatory Compliance Counsel

The Fair Credit Reporting Act and its requirements relating to reporting to credit reporting agencies seem to be of concern and interest to many of our members.  So, we thought we’d offer a primer to assist with compliance in this area. 

Generally speaking, there is no federal requirement that compels credit unions to provide information to credit reporting agencies (CRAs).  However, credit unions that do furnish information are subjected to various duties under the Fair Credit Reporting Act (FCRA) and it implementing regulation, Regulation V (12 C.F.R. Part 1022), including:

• The Duty to Provide Accurate Information. A credit union that furnishes information to a CRA about a member, must not provide information that it knows or has reasonable cause to believe that the information is inaccurate.  The FCRA defines the phrase knows or has reasonable cause to believe that the information is inaccurate as “having specific knowledge, other than solely allegations by the consumer, that would cause a reasonable person to have substantial doubts about the accuracy of the information.” See, §623(a)(1)(D).  Some violations may include:

• Misstating the balance due
• Listing member as a debtor on an account when he/she is only the authorized user
• Reporting debt as charged off when member settled it or paid it in full

*Safe harbor alert (YES!):  The FCRA provides a safe harbor if the credit union clearly and conspicuously specifies an address where members can send disputes concerning the accuracy of information about them.  See, §623(a)(1)(C).

Additionally, if the credit union determines that the information it has furnished is not complete or accurate, the FCRA requires it to promptly notify the CRA of the determination and provide updated correct information.  See, §623(a)(2).   

• The Duty to Provide Notice of Dispute. If the information that is being furnished to a CRA is being disputed by the member, the credit union may not provide that information to the CRA without a notice that the information is being disputed.  See, §623(a)(3).    

• The Duty to Provide Notice of Delinquency of Accounts. A credit union that furnishes information to a CRA about a delinquent account being placed for collection or charged to profit or loss, is required to notify the CRA of the date of the delinquency no later than 90 days after furnishing the information.  The date of delinquency is the month and year the first payment was missed.  See, §623(a)(5).    

• The Duty to Provide Notice of Negative Information to Member. The FCRA requires that a notice of negative information be provided to a member when a credit union furnishes negative information to a CRA regarding the extension of credit to a member.  See, §623(a)(7).  “Negative information” means information relating to a member’s delinquencies, late payments, insolvency, or any form of default.  See, §623(a)(7)(G)(i).  The FCRA requires the credit union to provide the notice either: (i) before furnishing the negative information to the CRA; or (ii) 30 days after furnishing the information.  The notice may be included on or with other disclosures such as a notice of default, a billing statement, or any other materials provided to the member, and must be clear and conspicuous.  Notwithstanding the general ability to provide the notice with other disclosures, if the credit union opts to provide the notice before it furnishes the information to a CRA, it may not include the notice with the initial disclosures provided under TILA AND Regulation Z. See, §623(a)(7)(B).  Regulation V contains a model notice.

• The Duty to Investigate and Report after Receiving Notice of Dispute from a Member. The FCRA provides that a credit union must take certain actions after receiving a notice of dispute from a member, including the duty to: (i) investigate the disputed information; (ii) review all relevant information provided by the member in the notice of dispute; (iii) timely complete the investigation and report the results to the member; and (iv) if it is determined that the information was inaccurate, promptly notify each CRA the information was furnished to and provide any corrections to make the information accurate.  See, §623(a)(8)(E).  Section 1022.43 of the regulation sets forth the types of disputes that are subject to the duty to investigate, as well as the exceptions. 

• The Duty to Investigate and Report after Receiving Notice of Dispute from a CRA. Sometimes members send a notice of dispute the CRA(s).  If this happens, the FCRA requires the CRA to promptly notify the credit union.  Once the credit union receives the notice of dispute from a CRA, it is required under the FCRA to: (i) investigate the disputed information; (ii) review all relevant information provided by the CRA; (iii) report the results to the CRA; and (iv) if it is determined that the information was inaccurate, report those results to all other CRAs the information was furnished to; and if the disputed information is found to be inaccurate or incomplete, promptly modify the information, delete the information, or block the reporting of that information.  The duty to investigate in this instance is triggered once the notice is received from a CRA.  See, §623(b)(1)(E). 

• Duty to Establish and Implement Reasonable Policies to Ensure the Accuracy and Integrity of the Information Furnished. Under the FCRA and Regulation V, a credit union that reports information to a consumer reporting agency is required to have policies and procedures in place to ensure the accuracy and integrity of the information furnished. See, 12 C.F.R. §1022.42.  The policies and procedures should be designed to promote certain objectives, as spelled out in Appendix E, such as: (i) to furnish information about accounts or other relationships with a member that is accurate; (ii) to conduct investigations of member disputes and take appropriate actions based on the results of the investigations; and (iii) to update the information it furnishes when necessary, to reflect the current status of the member account or other relationship, including a transfer of an account by sale or assignment for collection to a third party.   See, 12 C.F.R. Part 1022, App. E.  

This is not an exhaustive list, please refer to §623 of the FCRA for a comprehensive list of duties imposed on credit unions that decide to furnish information to a CRA.

It makes sense that credit unions want to ensure compliance here.  The CFPB has stated that it “will continue to monitor furnishers’ compliance with the FCRA regarding consumer disputes of information they have furnished to CRAs.  Furnishers should take immediate steps to ensure they are fulfilling their obligations under the law.”  CFPB Bulletin 2014-01. 

If you have any questions relating to this article or any other FCRA issues, please contact NAFCU’s regulatory compliance team.  We’re here for you!

 

Oh... Check out our upcoming NAFCU Webcasts:

UDAAP – We Know It When We See It

Tuesday, September 27 | 2:00 p.m. – 3:30 p.m. ET

Identify and Monitor High-Risk and Money Service Businesses Accounts

Wednesday, September 28 | 2:00 p.m. – 3:30 p.m. ET

What's New and What's Next with NAFCU's Regulatory Affairs Team

Thursday, September 29 | 2:00 p.m. – 3:30 p.m. ET

Fair Credit Reporting Act –Cross-selling Clarifications

Written by Shereefat Balogun, Regulatory Compliance Counsel

Last week I wrote about permissible purposes under the Fair Credit Reporting Act (FCRA), and generally stated that a credit union may not use a consumer report obtained with a permissible purpose to later cross-sell other products or services…absent a separate permissible purpose.   Since then, I have received a lot of feedback and thought it may be necessary to clarify a few points.

• Point #1: Section 604 of the FCRA provides the permissible purposes for which a consumer report may be obtained and used. Cross-selling, by itself, is not listed as a permissible purpose under the FCRA. 

• Point #2:  One key permissible purpose under section 604(a)(2) of the FCRA is where the credit union acts “in accordance with the written instructions of the consumer to whom [the consumer report] relates…” under section 604(a)(2). This allows credit unions that obtain written authorization from the member to use the report which could include cross-selling activities. 

• Point #3: When obtaining a consumer report, the FCRA generally requires credit unions to certify the purposes for which the information is sought, and “certify that the information will be used for no other purpose.”  See, 15 U.S.C. §1681e(a).

• Point #4: While authority to regulate the FCRA has been transferred from the FTC to the CFPB, and previous FTC guidance can be useful, it is important to note that the FTC formally rescinded all of its FCRA guidance. Absent any new guidance from the CFPB, credit unions often continue to refer to FTC advisory letters, including the “Gowen Letter,” and other guidance such as “40 Years of Experience with the Fair Credit Reporting Act.” However it is important to keep in mind that this information, while helpful, is not binding.

Points #1 and #2 generate a lot of discussion. The FCRA generally requires credit unions to have a “permissible purpose” in order to access a consumer report. The definition of permissible purpose in the statute does not include things like cross-selling using a consumer report that the credit union previously obtained for a permissible purpose. 

However, one permissible purpose is having the member’s written instructions, or authorization to access their consumer report. This means that the credit union may be able to obtain the member’s written authorization that grants the ability to cross-sell.  For example, some credit unions obtain a separate written authorization from members specifically for cross-marketing activities.  Other credit unions have built in some form of written authorization in their membership applications or loan applications.  Others use a separate disclosure and authorization form that is maintained in the member’s file. Overall, many credit unions have worked with outside counsel to develop acceptable written authorizations that address cross-selling or other purposes. In any event, past FTC guidance, which again is not binding but informative, indicates that written authorization should be clear and have a certain degree of specificity.  Credit unions considering adding such language to their agreements may need to consult with local counsel regarding the specific verbiage needed to be compliant.

Cross-selling products and services can mutually benefit members and the credit union.  Indeed, credit unions pride themselves in their ability to offer members better terms and rates.   A carefully constructed process for obtaining written authorizations can accomplish these goals while remaining within the parameters established by the FCRA. 

As always, if you have any questions relating to this article or any other FCRA issues, please contact NAFCU’s regulatory compliance team.  We’re here for you!

Fair Credit Reporting Act- Warning: Permissible Purpose Does Not Include Cross-Selling

Written by Shereefat Balogun, Regulatory Compliance Counsel

Lately, we have been receiving a good amount of questions relating to the Fair Credit Reporting Act (FCRA). Specifically, many of our compliance officers want to know whether a credit union may use a credit report, pulled with a permissible purpose, to subsequently cross-sell other products. The answer to this generally is a resounding NO!!!!

As an initial matter, Section 604 of the FCRA provides the permissible purposes for which a consumer report may be obtained and used. Except for prescreen offers, a consumer reporting agency may provide a consumer report under specific circumstances. As it pertains to credit unions and member transactions, these circumstances are limited to:

• When a member provides written instructions giving authority to obtain the report;
• When the information contained in the report will be used in connection with a loan application or to review an existing member’s loan or account; and
• When there is a legitimate business need for the information in connection with a business transaction that is initiated by the consumer; or to review an account to determine if it still meets the terms.

See, 15 U.S.C. §1681b(a).

In all pulls for consumer reports, the credit union must ensure that there is a permissible purpose. Moreover, for all pulls, credit unions must certify the purposes for which the information is sought, and certify that the information will be used for no other purpose.  See, 15 U.S.C. §1681e(a).

So now, the credit union pulled a consumer report with the permissible purpose of using the information in connection with a car loan application. Now, the credit union wants to use the report to market a credit card.  NO!!!! This would be an impermissible use. A credit union may not use a consumer report that it previously obtained for a permissible purpose, to later market a particular product or service.  This question was addressed in the FTC’s “Gowen Letter”. Below is the relevant section of the letter:

“Your questions raise the issue of whether a creditor in a closed end credit transaction may exploit consumer reports obtained for “review” purposes in order to market its products or services. In the circumstances you described, we believe the answer is “no.””

Moreover, this position is reaffirmed throughout the FTC’s comments stated in their “40 Years of Experience with the Fair Credit Reporting Act”.  Below are some relevant excerpts of the FTC’s commentary:

Section 603(m) states that the term “credit or insurance transaction that is not initiated by the consumer” does not include the use of a consumer report by a person with whom the consumer has an account or insurance policy, for purposes of (1) reviewing the account or insurance policy; or (2) collecting the account.

1. GENERAL

Section 604(c) provides that, generally, it is not a permissible purpose to provide a consumer report in connection with “any credit or insurance transaction not initiated by the consumer” unless the consumer consents or the transaction consists of a firm offer of credit or insurance. However, an existing creditor’s use of consumer reports for review or collection of its accounts does not fall within the definition of “credit or insurance transaction that is not initiated by the consumer.” Rather, an existing creditor may obtain consumer reports for review or collection of its accounts under section 604(a)(3)(A), but its use of those reports is limited to that purpose. Accordingly, a CRA may provide reports to creditors to review or collect existing credit accounts, but not to market other products or services.  See comment 604(a)(3)(A)-4A.

(emphasis added).

4. REPORTS FOR “REVIEW OR COLLECTION OF AN ACCOUNT” – PERMISSIBLE PURPOSE DOES NOT EXIST

5. Marketing purposes. This section does not allow a CRA to provide a creditor with consumer reports to “review” accounts in order to market its other products or services. See also comments 603(m)-1 and 604(a)(3)(F)-6.

(emphasis added).

While the Gowen letter, as well as the provisions highlighted above, appear to narrow its discussion and application to the review of accounts, it appears that this analysis has been applied more broadly and the general position is that cross marketing is restricted.  In fact, the commentary makes clear that prescreening is the only circumstance in which consumer report information may be used for marketing purposes.  The commentary states in relevant part:

2. PRESCREENING

“Prescreening” is the common term for the process by which creditors and insurers use consumer report information to identify consumers to receive firm offers. Prescreening is the only circumstance in which consumer report information may be used for marketing purposes, and one of the few circumstances in which consumer report information may be provided in the absence of a consumer-initiated transaction. A CRA either edits a list of consumers developed by the requesting creditor or insurer (or its agents) or independently creates a list of consumers according to the requesting entity’s specifications.

(emphasis added).

The prescreening and firm offers provisions are addressed in section 604(c) of the FCRA.  Section 604(c) allows the credit union to prescreen members for credit transactions not initiated by the member. Generally, the credit union sends its criteria to the credit bureau and the credit bureau then determines which members meet the criteria. Members meeting the criteria are sent the prescreened offer, provided that the member has not opted out of prescreening and the member is not under 21 (unless that member has opted in). See, 15 U.S.C. §1681b(c). Note, that a firm offer of credit must be provided to members meeting the criteria. See, 15 U.S.C. §1681b(c). The prescreen disclosure and opt-out requirements can be found in Regulation V, 12 CFR 1022.54.

So to reiterate- a credit union may not use a consumer report that it previously obtained for a permissible purpose, to cross-sell other products or services.  However, the credit union may be able to obtain the member’s written authorization that specifically grants the ability to cross sell. However, the instructions should expressly state the reason for the use; a general blanket consent will not be sufficient. It may be worthwhile to check with local counsel regarding the specific verbiage in your account agreement.  The commentary on this issue provides:

Section 604(a)(2) allows CRAs to furnish consumer reports in accord “with the written instructions of the consumer to whom it relates.”

2. CONSUMER INSTRUCTION

A consumer’s written consent qualifies as an “instruction” that provides a permissible purpose under this section if it clearly authorizes the issuance of a consumer report on that consumer.  For example, a consumer’s clear and specific written statement that “I authorize you to procure a consumer report on me” provides a permissible purpose under this section. However, the consumer’s signature on a form that includes the statement “I understand that where appropriate, credit bureau reports may be obtained” is not a sufficiently specific instruction from the consumer to authorize a CRA to provide a consumer report. This language is more in the nature of a notification that a consumer report might be procured, as opposed to a grant of permission to obtain the consumer report. 

(emphasis added).

Moreover, the FTC has some advisory letters on the consent issue which credit unions may want to spend some time reviewing.

If you have any questions relating to this article or any other FCRA issues, please contact NAFCU’s regulatory compliance team. We’re here for you!

###

NAFCU has a couple of scheduled webinars this month available for our members:

Upcoming Webcasts

Blockchain Technology: What You Need to Know

FREE Webcast  Live Broadcast: June 21, 2016

 

FLSA – Understanding the New Overtime Regulations

Live Broadcast: June 22, 2016

CFPB Issues Supervisory Highlights - Some Consumer Reporting, Debt Collection, Mortgage Origination, Remittances, Student Loan Servicing and Fair Lending Concerns Remain

Written by Benjamin M. Litchfield, Regulatory Compliance Counsel

Greetings compliance fans! On March 8, 2016, the CFPB issued its latest supervisory report sharing observations from recent examinations and other supervisory activities. The report covers issues observed by the Bureau in the areas of consumer reporting, debt collection, mortgage origination, remittances, student loan servicing, and fair lending.

Consumer Reporting. CFPB examiners found that one or more furnishers of information to consumer reporting agencies failed to have policies and procedures addressing the furnishing of information related to deposit accounts. For example, these furnishers would update their own systems when customers paid charged-off accounts in full but would not provide updated information to the consumer reporting agencies. The CFPB recently issued Compliance Bulletin 2016-01 (Feb. 3, 2016), reminding furnishers of their responsibilities under the Fair Credit Reporting Act (FCRA) and Regulation V regarding specialty consumer reporting agencies such as ChexSystems.

Debt Collection. CFPB examiners also determined that some debt collectors failed to honor written requests to cease communications. While credit unions collecting on their own debts are not considered “debt collectors” under the Fair Debt Collection Practices Act (FDCPA), the CFPB and NCUA have separately signaled that credit unions should still strive to comply with the requirements of the FDCPA to avoid any liability for committing unfair or deceptive acts or practices (UDAAPs). See, CFPB Compliance Bulletin 2013-07 (July 10, 2013) and NCUA Consumer Compliance Handbook, p. 98. Some debt collectors also made false, deceptive or misleading representations regarding garnishment when attempting to collect on student loan debt.

Mortgage Origination. In general, the Bureau noted overall compliance with its Title XIV rules (loan originator compensation, ability-to-repay, appraisals and valuations, high-cost mortgages and escrows for higher-priced mortgage loans). Some exceptions included the absence of written policies and procedures for loan originator activities under the loan originator rule and some deficiencies in compliance management systems. The loan originator rule makes it an independent regulatory requirement that credit unions establish policies and procedures reasonably designed to ensure and monitor the compliance with the prohibited payment, anti-steering, qualification and identification requirements of the rule. See, 12 C.F.R. § 1026.32(j). The CFPB maintains a landing page with resources that credit unions can use to comply with these rules, including compliance guides and quick reference charts, here.

Remittances. As the CFPB noted in its press release touting the Supervisory Highlights report, this is the first report on exams of financial institutions in the remittance market since the CFPB issued its remittance transfer rule. While the Bureau noted overall compliance with the remittance transfer rule, a few trouble spots identified by examiners included providing incomplete or inaccurate disclosures, failing to adhere to regulatory timeframes for refunding cancelled transactions, failure to communicate the results of error investigations, or failure to promptly credit consumer accounts. Like the Title XIV rules, the CFPB maintains a landing page with resources credit unions can use to help comply with the remittance transfer rule here.

Student Loan Servicing. In the report, the CFPB noted that supervising the student loan servicing market has been a priority for its Supervision program. CFPB examiners cited private student lenders for taking advantage of auto-default clauses in student loans where either the borrower or a cosigner declared bankruptcy. The effect of the auto-default clause was to place both the borrower and the cosigner immediately into default and make the loan payable in full immediately. The Bureau found this practice to be a UDAAP. In addition, CFPB examiners “determined that servicers committed unfair practices by failing to disclose a significant adverse consequence of forbearance.” Namely, the inability of some borrowers to take advantage of cosigner release clauses in student loan contracts following the borrower’s use of forbearance.

Fair Lending. The report also provided updates on the Bureau’s administration of its fair lending enforcement settlement agreements with Ally Financial, Inc. and Ally Bank, and with Synchrony Bank, formerly known as GE Capital Retail Bank.

As this report shows, the Bureau has been very aggressive in several key areas – particularly consumer reporting, loan servicing, mortgage origination, and debt collection. The Bureau has repeatedly emphasized these areas as focal points for its supervision and enforcement activities for the next two years.. One thing to keep in mind is that the Bureau repeatedly emphasized the requirement to furnish accurate information to consumer reporting agencies under the FCRA and Regulation V throughout the report and not just as part of the consumer reporting section. This signals that the Bureau is likely to remain laser-focused on the accurate reporting of consumer information likely as part of a larger effort to examine ways to bring financial services to unbanked and underbanked populations.

The full report is available here.

***

Know the Changes: HMDA Reporting Procedures

Live Webcast: Wednesday, March 16 | 2:00 p.m. – 3:30 p.m. EST

Part of the HMDA Webcast Series

Major CFPB rule changes brought new HMDA reporting procedures your credit union must comply with. Join this webcast for a comprehensive overview of the final rule, revision of Regulation C, and data collection requirements. You’ll discover the new data credit unions are required to collect and report, when these requirements will be active, and more.

CFPB’s Policy Priorities Confirm Rulemaking Plans on Overdraft, Debt Collection and Interest in Small Business Lending

Written by Shereefat Balogun, Regulatory Compliance Counsel

On Thursday, February 25, 2016, the CFPB held a Consumer Advisory Board meeting which generally provided an overview of the bureau’s strategic outlook. The CFPB subsequently published a report outlining its two-year supervision and enforcement priorities. Many of the stated priorities are iterations of previous comments made by the bureau, and confirm impending rulemaking. Others provide insight on new areas of interest.  Credit unions under the bureau’s jurisdiction should note the following priorities as they set their compliance goals for the next two years:

• Arbitration: The CFPB indicated that it will continue the rulemaking process to regulate the use of arbitration clauses, especially those that limit a consumer’s right to bring a class action.

• Consumer Reporting: The bureau reported that it will continue to examine and investigate consumer reporting companies and furnishers of information, with a focus on accuracy and dispute resolution processes. The CFPB also stated that it may consider rulemaking around furnisher and consumer accuracy, dispute resolution, and related issues.

• Debt Collection: The CFPB confirmed that it will initiate the rulemaking process and finalize a rule that establishes guidelines to ensure that debt collectors treat consumers with respect, substantiate the debts they collect on, and “provide consumers with appropriate information about their rights and the debt collection process.”

• Mortgages: The CFPB has restated its commitment to ensure that the Home Mortgage Disclosure Act (HMDA) rule is successfully implemented, and that its supervisory and enforcement programs work to provide equal and fair access to mortgage credit. The CFPB also indicated a particular focus on implementing its mortgage servicing rules. Lastly, the bureau stated that it will begin to assess the effectiveness of significant rules that are already in place.

• Overdraft: The bureau makes clear that it fully intends to move forward with the rulemaking process related to overdrafts, with a purported goal of making the overdraft market “fairer and more transparent”.

• Small Business Lending: The CFPB confirmed its growing interest in small business lending, and lists its plan to build a small business lending team and begin “market research and outreach for a rulemaking on business lending data collection.” The bureau also indicated that it will continue to examine small business lenders for compliance with fair lending laws. As a reminder, Dodd-Frank amended the Equal Credit Opportunity Act (ECOA), requiring financial institutions to collect and maintain certain information in connection with credit applications submitted by women-owned, minority-owned or small businesses.

This is a few of the priorities listed in the report. NAFCU previously reported on the full list of priorities. Notably, the CFPB clarifies that, in addition to the stated priority goals, it will continue its ongoing efforts in its fair lending oversight of indirect auto lenders and rulemaking on prepaid cards. The bureau also advises companies to “continue their focus on complying with the law beyond the particular issues described in the goals, whether or not they see their particular industry or product mentioned explicitly among the shared cross-Bureau priorities.”

As a reminder, this will only be applicable to credit unions directly supervised by the CFPB- those with over $10 billion in assets. For those credit unions not subject to CFPB’s supervision, the priorities may nonetheless be a useful tool. The policy priorities can be found here. Credit unions are also advised to review NCUA’s Supervisory Priorities for 2016.

CFPB Issues Compliance Bulletin on FCRA

Written by Brandy Bruyere, Director of Regulatory Compliance

On February 3, the CFPB held a field hearing in Kentucky to discuss consumer access to checking accounts. This is an area of ongoing concern to the bureau, and those following this issue may recall that the CFPB held a previous hearing on this issue back in October, 2014.

As part of last week’s hearing, the CFPB issued Compliance Bulletin 2016-01 regarding the Fair Credit Reporting Act and implementing Regulation V’s provisions regarding the duties of furnishers of information with regard to credit reporting. As a reminder, these provisions apply to “any person that furnishes information to a consumer reporting agency [CRA],” and require credit unions to “establish and implement reasonable written policies and procedures regarding the accuracy and integrity” of the consumer information a credit union may provide to CRAs. While these rules are not highly prescriptive, Appendix E to Regulation V provides some basic guidelines regarding the accuracy and integrity of information provided to CRAs.

The CFPB noted in a recent Supervisory Highlights that some financial institutions under the bureau’s supervisory authority did not implement these requirements with regard to deposit accounts. Here’s an excerpt, starting on page 5:

“Examiners found that one or more entities failed to establish and implement reasonable written policies and procedures regarding the accuracy and integrity of information furnished to CRAs, as required by Regulation V. Examiners found that while one or more entities had policies and procedures addressing accuracy and integrity with respect to their furnishing of information to CRAs on credit accounts, they failed to have policies and procedures addressing accuracy and integrity with respect to their furnishing information on deposit accounts. Regulation V requires that such policies and procedures be appropriate to the nature, size, complexity, and scope of each furnisher’s activities, and requires that furnishers consider Appendix E of Regulation V, the “Interagency Guidelines Concerning the Accuracy and Integrity of Information Furnished to Consumer Reporting Agencies,” and incorporate those guidelines as appropriate. In addition, examiners found that one or more entities failed to periodically review and update their policies and procedures, as required by Regulation V.

Regulation V also requires furnishers to provide consumers with notice of the results of investigations of direct disputes of information furnished to CRAs. Examiners identified one or more entities that failed to provide such notice to consumers and thus violated Regulation V.”

(Emphasis added.)

In other words, Regulation V does not only apply to consumer information that a credit union may provide in relation to lending products, but the kind of information share account information a credit union may provide to CRAs like Chexsystems.  The regulation requires policies and procedures to address this kind of data in order to be sure the information is accurate and has integrity. Keep in mind that “accuracy” and “integrity” are both defined terms under Regulation V.

This bulletin summarizes similar issues, noting that Regulation V “applies to furnishing to all CRAs” and emphasizing that Regulation V requires furnishers to “periodically review and update its policies and procedures to ensure their continued effectiveness.” It may be worth reviewing although Regulation V and Appendix E provide more details.

Advertising Regulations: Truth in Savings (Part of the Advertising Compliance Webcast Series)

Live Webcast: Wednesday, February 10 | 2:00 p.m. – 3:30 p.m. EST

Avoid the risk of being scrutinized by regulators; ensure you successfully comply with advertising requirements as put forth by the Truth in Savings disclosure. Join this webcast to better understand advertising regulations and why they’re important. Explore advertising trigger terms, APY disclosures, NCUA insurance adverting, courtesy pay programs and more essential topics. You’ll also learn to stay clear of compliance violations by receiving advertising compliance best practices.

CFPB Releases Monthly Complaint Report and Notes Debt Collection, Mortgage, and Credit Reporting as Top Complaints; DMDC Extends MLA Database Deadline; Free Webcast - Breaking Down the NCCO Exam

Written by Shereefat Balogun, Regulatory Compliance Counsel

On January 28, 2016, the CFPB released its Monthly Complaint Report for December 2015, which provides a high-level snapshot of trends in consumer complaints. It is important to keep in mind that credit unions under $10 billion are not included in the Consumer Complaint Database, which forms the basis of the monthly reports. Notwithstanding, the reports can be a useful tool, as they can help credit unions evaluate which products and services are more problematic and thus, should be addressed in order to avoid or mitigate regulatory risks.

As of January 1, 2016, the CFPB has handled about 790,000 consumer complaints, including approximately 20,3000 complaints in December 2015. The Report notes that:

• Complaints related to prepaid products rose from 138 complaints between October- December 2014 to 459 complaints between October-December 2015, representing a 233% increase;

• For the 28^th consecutive month, the CFPB handled more complaints about debt collection than any other type of complaint. Debt collection complaints represented about 31% of complaints in December 2015.

• Debt collection, mortgage, and credit reporting complaints continue to be the top three most-complained-about consumer financial products and services, which together represented 68% of all complaints submitted in December 2015.

• Equifax, Transunion, and Experian were the most-complained-about companies for August-October 2015.

As stated previously, credit unions under $10 billion are not included in the Consumer Complaint Database.  Rather, the CFPB will forward any complaints from these credit unions to NCUA, and credit unions will need to follow NCUA's procedures for responding to member complaints.

You can view the CFPB’s Monthly Complaint Report here: http://files.consumerfinance.gov/f/201601_cfpb_monthly-complaint-report-vol-7.pdf

You can view the CFPB’s Consumer Complaint Database here: http://www.consumerfinance.gov/complaintdatabase/

###

MLA Database Update. As NAFCU reported earlier this week, DMDC agreed to extend the deadline to seek direct access to the MLA database until February 15, 2016. Those credit unions who express interest in the direct connect option will receive a questionnaire in a response email. DMDC set a February 19, 2016 deadline for interested credit unions to complete and return this questionnaire. If you have any questions about this deadline or the database, please email Brandy Bruyere, NAFCU’s Director of Regulatory Compliance, [email protected].

###

Free Webcast - Breaking Down the NCCO Exam

Live Webcast: Tuesday, February 9 | 3:00 p.m. – 4:00 p.m. EST

As a serious compliance professional, you either have, or are thinking about earning, your NAFCU Certified Compliance Officer (NCCO) designation. This challenging but comprehensive exam will prove that you have a solid understanding of the major regulations that govern credit union operations. Join this free webcast for an in depth look at how to best prepare for the NCCO exam and utilize the material. NAFCU’s very own Director of Regulatory Compliance and Director of Education will guide you through learning the best approach for earning this prestigious designation.

CFPB August Complaint Report; OIG Complaint Database Audit; Cute Overload

Written by Elizabeth M. Young LaBerge, Regulatory Compliance Counsel

CFPB Monthly Complaint Report for August, 2015            

 Beginning last month, the CFPB is releasing a monthly ‘snapshot’ Complaint Report that will report the volume of complaint data received by the bureau, highlight any identified trends, spotlight data from a certain geographic location, and name the “most-complained-about-companies.”

The Monthly Complaint Report for August indicated that the CFPB handled 26,700 complaints in the month of July, bringing the total number to approximately 677,200 as of August 1, 2015.

The good news is that complaints about bank accounts and services represent the greatest decrease in the report: complaints are down 2% from the previous month and 4% from the previous year. Complaints surrounding debt collection remain the highest in terms of volume, with the CFPB receiving 8,224 in the month of July. The second highest in terms of volume and the highest increase over the previous month was related to credit reporting. Credit reporting complaints increased 56% over the previous month and 45% over the previous year. 97% of these complaints were directed at one of the three major credit reporting agencies.

Company level data is reported on a three-month rolling basis, so the majority of data on any given report is largely repetitive of the data on the previous report. July’s report on complaint volume by company covered data from February – April of 2015, and August’s report covered data from March–May of 2015. Both reports named Equifax and Experian as the first and second most-complained-about-companies, respectively, and TransUnion as the fourth most-complained-about-company.

Between the high increase in complaints about credit reporting and the continued presence of the three major credit reporting agencies in the top four most-complained-about-companies, it is not surprising the CFPB made credit reporting the focus of the monthly report. The report stated that 77% of complaints to the CFPB regarding credit reporting involve incorrect information on reports, including the appearance of paid debts and debt belonging to other persons on consumers’ reports.

If you are the kind of person that reads about credit reporting complaints and immediately becomes nervous about whether your credit union is in compliance with Regulation V, now might be a good time to revisit Subpart E regarding the duties of furnishers of information and Appendix E containing the Interagency Guidelines Concerning the Accuracy and Integrity of Information Furnished to Consumer Reporting Agencies.

Recent and Future OIG Reviews of the Complaint Database

In April, this blog discussed concerns about releasing complaint narrative data without any kind of investigation, which raises safety and soundness concerns and unduly places financial institutions’ reputation at risk. Further, we have previously discussed the concern that disclosing narrative information could lead to the inadvertent release of personal information about consumers. In late July, the Office of the Inspector General evaluated the effectiveness of the information securities controls and techniques related to the Complaint Database and reported several control deficiencies. Recommendations were made to protect consumer information, and the OIG reported that the CFPB’s Chief Information Officer is working to implement those changes. A few weeks ago, the Office of the Inspector General released its ongoing Work Plan which announced its intentions to conduct an audit of the Complaint Database in the third quarter of 2015. The audit’s objective will be to assess the effectiveness of the CFPB’s controls over the accuracy and completeness of the public complaint database.

Cute Overload

On a personal note, in addition to being new at NAFCU, I am new to DC. I only just moved from Portland, Maine to DC this summer with my husband and our two dogs: Boomer and Ollie.

 

Moving isn’t always easy for dogs, but our two boys do pretty well with travel.


Boomer (left) is a 6 year-old bichon frisé rescue from Missouri. Luckily for my husband and me, a good attitude comes with the breed. Ollie (right) is a 4 year-old rescue from Pennsylvania. We are not sure of his breed ― we suspect he is a combo of two adorable breeds but it is hard to say which ones. Ollie is a sweet boy who usually takes Boomer’s lead. I’ll let you all know how they get on in the big city.

NCUA Issues Regulatory Alert: Qualifying Credit Unions Can Post Privacy Notices Online

Victoria Daka, Regulatory Compliance Specialist

The NCUA recently issued a regulatory alert notifying credit unions that qualifying credit unions may now provide annual privacy notices required under the Gramm-Leach-Bliley Act (GLBA) and its implementing regulation, Regulation P, by posting information online. This alert is in response to the CFPB’s recently issued final rule.

The GLBA requires financial institutions to provide their customers with annual notice of their privacy policies. The implementing regulation of GLBA, Regulation P, specifically provides ways in which financial institutions may provide this notice, which includes mail, hand delivery and now online for qualifying credit unions.

In order for credit unions to use the new alternative delivery method, they must satisfy the following conditions:

• Not disclose customer’s nonpublic personal information to nonaffiliated third parties except for purposes in which Regulation P draws out a limited exception from the opt-out requirements;
• Not include an “opt out” under the Fair Credit Report Act (FCRA) on the privacy notice;
• Must have previously satisfied the affiliate marketing provisions of FCRA and its implementing regulation, Regulation V, if applicable, or the annual privacy notice is not the only notice provided to satisfy those requirements;
• The information in the most recent privacy notice must remain consistent with previous notices with the exception of eliminating categories of information shared or parties in which the credit union shares customer information with; and
• Must use the form provided in the appendix to Regulation P for the annual privacy notice.

How the new alternative delivery method works:

The final rule permits credit unions to deliver the annual privacy notice on the credit unions’ website, provided the credit union satisfies the above conditions, and provides notice to the customer that the privacy notice is available on the credit unions’ website, compliant with the rules procedures.

The final rule provides an example of a proper disclosure.

Going forward, credit unions may…

• If the credit union elects to employ the new alternative delivery method, it must notify members through a “clear and conspicuous” notice that its privacy notices are now available on the credit unions’ website. However, the credit union must inform members that members reserve the right to continue with the traditional delivery methods of mailing or hand delivery. Credit unions should make this notification available to the member’s account statement or coupon book.
• If the credit union elects to continue delivery of annual privacy notices to customers by the traditional methods of delivery, mailing or hand delivery, it can disregard the above procedures.

To view the NCUA’s Regulatory Alert in its entirety, see here.

CFPB Finalizes the Privacy Notices Rule; Seminar 2014 Wrap and Group Photo; Fall Fun with the Fam

Written by JiJi Bahhur, Director of Regulatory Compliance

On Monday, the CFPB announced that it finalized the privacy notices rule with the intent to promote more effective privacy disclosures from financial institutions to their customers/members.  So now the answer to the burning question that so many credit unions have been asking: Does the credit union still need to send annual privacy notices to its members? 

Short Answer

Yes, the credit union still needs to send annual privacy notices to its members; however, the CFPB’s final rule allows a credit union to post this annual privacy notice online instead of sending it out individually to members IF certain conditions are met.  

Long(er) Answer

Under the CFPB’s privacy notices final rule, credit unions will be able to post annual privacy notices online instead of distributing an annual paper copy to each individual member, if the credit union satisfies the following conditions:

1. The credit union does not share its members’  nonpublic personal information with nonaffiliated third parties in a manner that triggers Gramm-Leach Bliley Act (GLBA) opt-out rights;
2. The credit union does not include on its annual privacy notice information about certain consumer opt-out rights under section 603 of the Fair Credit Reporting Act (FCRA);
3. The credit union’s annual privacy notice is not the only notice provided to satisfy the requirements of section 624 of the FCRA;
4. The information included in the privacy notice has not changed since the member received the previous notice; and
5. The credit union uses the model form provided in GLBA’s implementing Regulation P.

Credit unions that meet the conditions above and that choose to rely on this new method of delivering privacy notices are also required to:

1. Convey at least annually on a regular consumer communication, such as a monthly billing statement, that the credit union’s privacy notice is available on its website and in paper and will be mailed upon request made to the provided toll-free number. This notice or disclosure would have to also include a specific web address that takes the member directly to the privacy notice;
2. Post the credit union’s current privacy notice continuously on a page of its website that contains only the privacy notice, without requiring a login or any conditions to access the page; and
3. Promptly mail (within 10 days) the credit union’s current privacy notice to consumers who request it by telephone.

If the credit union does not meet the conditions above or chooses not to use the new disclosures method, it will need to continue to deliver annual privacy notices to its members using other delivery methods. 

This blog won’t address some of the nitty gritties within each of the conditions above, but I do want to make a few quick mentions:

• While this final rule constitutes an important step to achieving improved annual privacy notice requirements, it is only available to those credit unions that do not share information with nonaffiliated third parties outside of the Regulation P exceptions [Ed. 10/23] .  In other words, credit unions that do share information with nonaffiliated third parties cannot take advantage of this final rule.

• NAFCU has long advocated for the elimination of duplicative and costly annual privacy notices.  In its comment letter, NAFCU noted that CFPB should not require credit unions to continuously post their privacy notices on their websites.  NAFCU argued that this “continuously” verbiage would effectively require that credit unions’ website remain functional at all times.  In the preamble to the final rule, the CFPB discussed NAFCU’s concerns and emphasized that this requirement “assumes that financial institutions will post the privacy notice on their websites so that the notice is available but for occasional or unavoidable interruptions, such as routine maintenance or unexpected malfunctions.”   In other words, the credit union will not violate this requirement if its website temporarily malfunctions.

The final rule is available in its entirety here.  NAFCU’s Regulatory Affairs team is working on a summary of the final rule, which when available, will be located here.  Also, NAFCU’s compliance team intends to address this final rule in more depth in near future publications. 

***

Seminar 2014 Wrap and Group Photo.  Last week, NAFCU held its 2014 Regulatory Compliance Seminar.  The program contained 4 days of the hottest credit union compliance topics, great speakers, and an amazing group of attendees.  Below, I’ve shared a group photo taken during the event.

If you’re interested in attending Seminar next year, check out some of the details here.

***

Fall Fun with the Fam.  I had to sneak this in.  It’s not often that I can get the entire family to look at the camera at the same time!

NCUA Reveals Regulatory Review Report; NAFCU's 2014 Technology and Security Conference; BSA Blast

Written by Alicia Nealon, Regulatory Compliance Counsel

Last week, NCUA’s Office of General Counsel released  its 2013 Regulatory Review report, concluding its annual review of one-third of  NCUA’s rules and regulations, which this year included CUSOs, appraisals, member business lending and the Central Liquidity Facility. The report confirms that NCUA will be addressing a number of issues that NAFCU continues to fight for to ease regulatory burden on credit unions. Particularly, the Office of General Counsel recommended that the NCUA Board consider eliminating or amending several of the regulations raised in NAFCU’s “Dirty Dozen.” 

For those of you who haven’t had a chance to see it, NAFCU prepared a list of twelve regulations- the “dirty dozen”-  that regulators need to eliminate or amend because they are unnecessary, outdated, or overly burdensome on credit unions. This Regulatory Review report affirms that NCUA is considering a number of recommendations included on the "dirty dozen" list as it reviews possible changes in rules on incidental powers, member business lending and appraisals.

The first of NAFCU’s “Dirty Dozen” is a call to expand credit union investment authority to include permissible investments in derivatives, securitization and mortgage servicing rights. The review notes that the NCUA Board may look into expanding credit unions’ incidental powers in allowing them to securitize their own loans. The agency is also expected to issue a rule on derivatives at the board meeting on Jan. 23.

The report mentions possible updates to the agency’s MBL rule, a change NAFCU pushed for as the fifth of its “Dirty Dozen.” These proposed updates would “reflect the current business climate” and address issues such as calculating market value in construction-related business loans and valuation-related issues. The report also raised the prospect of changes to the MBL rule’s personal guarantee requirement and its two-year direct experience requirement.

Addressing the final recommendation of the “Dirty Dozen,” the report recommends that the Board amend Section 722 to eliminate redundant NCUA requirements on credit unions to provide copies of appraisals upon request. 

Finally, the report acknowledges that the Dodd-Frank Act transferred the Fair Credit Reporting regulation to the CFPB and advises that Section 717 should be transferred to the CFPB. It also gives hope that NCUA may tackle other issues including modernizing advertising rules, and rules on notification of credit unions’ insurance status. 

****

NAFCU's 2014 Technology and Security Conference.  NAFCU’s 2014 Technology and Security Conference, which will be held February 11-13 in Las Vegas, is a great place to discover the latest credit union security and technology trends. Conference topics include fraud trends, core processing issues, big data and credit union crisis management.  Check out more information about the conference and register here.

****

BSA Blast – The January 2014 edition of NAFCU’s BSA Blast is now available (a NAFCU member login is needed).  This issue is all about enforcement – from FinCEN’s enhanced focus on holding financial institutions responsible for Bank Secrecy Act (BSA) violations and its enforcement action against JP Morgan Chase in connection with the Madoff scandal to recent OFAC enforcement actions against three banks. In addition the issue contains a new BSA quiz for use in staff training.

CFPB Bulletin Puts CUs on Notice About Duty to Investigate Consumer Credit Report Disputes; NAFCU’s Online Training Updated; Ballapalooza Fun

Written by JiJi Bahhur, Regulatory Compliance Counsel

CFPB Bulletin 2013-09.  Earlier this month, the CFPB released CFPB Bulletin 2013-09 (Bulletin), putting on notice companies that supply information to consumer reporting companies. The Bulletin stresses that compliance with the Fair Credit Reporting Act (FCRA) requires furnishers of such information to investigate consumer disputes forwarded by the consumer reporting companies, and to review all relevant information provided with the disputes, including documents submitted by consumers.

Subject to its supervisory and enforcement authorities, the CFPB intends to evaluate compliance with the requirements set forth within the Bulletin and expects each furnisher, in summary, to comply with the FCRA by receiving information and investigating disputes, providing investigation results, and correcting inaccurate information.

The Bulletin notes that “[a]ny furnisher not currently maintaining a process that meets these requirements should take immediate steps to comply with the requirements of the law.” 

For more details on what the CFPB expects, view the press release here and the Bulletin here.

***

NAFCU’s Online Training Updated.  Are you looking for essential trainings for your Board and new employees?  NAFCU’s recently updated Online Training program covers important education for board members and new staff, without requiring a travel budget.   New and updated courses include Bank Secrecy Act, member data security, financial literacy and fiduciary duties, how credit unions are regulated and examined and more!  For a full listing of training modules available under NAFCU’s Online Training program, visit here. 

And wait!  It gets even better!  If your credit union is interested in NAFCU’s Unlimited Webcast Subscription and Online Training program, we now offer the Virtual Learning Package, combining both the Webcast Subscription and Online Training at a great savings! Credit unions that buy now will have access through the end of 2014!

***

Ballapalooza Fun.  I was planning on sharing some of the pictures from Kyse and Ava’s first birthday party, but to my dismay, they either came out blurry or they were crying in them (teething)!  On a good note, I have some great pictures of them playing with one of their birthday gifts – the Ballapalooza!

Adverse Action Notices: Requirements under the ECOA and the FCRA

Written by JiJi Bahhur, Regulatory Compliance Counsel

***

Quick Update - The deadline for NCUA's Loan Participation final rule has been extended to September 23, 2013. NAFCU's Compliance Calendar has already been updated to reflect the new date.

*** 

In Wednesday’s blog post, Bernadette mentioned the release of the Second Quarter 2013 issue of the Philadelphia Federal Reserve’s Consumer Compliance Outlook.  Today, I’ll take a closer look at one of the articles – Adverse Action Notice Requirements Under the ECOA and the FCRA.  The article provides astonishing clarity – as to what requirements apply to the ECOA and what requirements apply to the FCRA – by providing numerous tables breaking down these categories:

• Table 1: When Adverse Action Notices are Required
• Table 2: Who Must Receive Adverse Action Notices
• Table 3: Timing Requirements for Adverse Action Notices
• Table 4: Content Requirements for Adverse Action Notices

I’ve provided a screen shot of the first table – When Adverse Action Notices are Required – but if you have a few spare moments, take a look at the rest of them (or pass the article on to the person at your credit union who is responsible for adverse action notices):

Why is this so important? As the article explains, “To ensure compliance, it is important to understand how the requirements of Regulation B [ECOA] and the FCRA relate to and differ from one another.”  And that’s exactly what this article does: it explains that there are two laws that require adverse action notices; it reviews the adverse action requirements of both the ECOA and the FCRA; and it provides tables to further illustrate the requirements. 

***

If your weekend hasn’t already started, have a great one!  I’m not sure what my weekend will consist of yet, but one thing’s for sure: I can’t wait to spend it with these bundles of joy!

Consumer Compliance Outlook; NCUA Economic Videos

Written by Bernadette Clair, Regulatory Compliance Counsel

Consumer Compliance Outlook. The Second Quarter 2013 issue of the Philadelphia Federal Reserve’s Consumer Compliance Outlook is now available.  Articles in this issue include:

• Perspectives on Consumer Protection: A Conversation with Governor Duke
• Fair Lending Webinar: Questions and Answers
• Adverse Action Notice Requirements Under the ECOA and the FCRA

You can also download the full PDF here.

****

NCUA Economic Videos. NCUA recently released a couple of new videos, available on YouTube. The first video, NCUA Economic Update – June 2013 Part I, provides an update on the economy and includes a discussion on the housing market, labor market, consumer confidence statistics, and the recent rise in interest rates and potential challenges to credit unions.

The second video, NCUA Economic Update – June 2013 Part II, focuses on NCUA’s proposed derivatives rule.  This proposed rule would provide qualified credit unions limited authority to engage in derivatives activities for purposes of mitigating interest rate risk, but would also establish a “pay to play” requirement.  See our May 17th blog post for more details on the proposed rule.

Have a great 4th of July!  We'll be back blogging on Friday.

NAFCU's Regulatory Compliance School Just Got Better - Regulatory Update Day

Written by Steve Van Beek

We've heard you!  For the past couple of years, we've received the following feedback about NAFCU's Regulatory Compliance School (paraphrased, of course):

"School is great and provided a solid foundation for understanding the regulatory requirements credit unions face on a daily basis.  BUT, the rules are changing so fast that it would be great to receive updates on what has just changed and what is changing next."

With this in mind, we've created Regulatory Update Day at NAFCU's 2013 Regulatory Compliance School (March 18-23 in National Harbor, Maryland).  

Regulatory Update Day (Thursday, March 21st) will provide:

• A clear understanding of what changes NCUA has in store for 2013 – including their Exam Focus

• An overview of the scope and applicability of the CFPB’s seven new mortgage regulations*

• A detailed look at the CFPB’s Qualified Mortgage/Ability-to-Repay requirements*

• Answers to Frequently Asked Questions on the mortgage rules from NAFCU’s compliance team*

• Insight from credit union attorneys and practitioners on how best to set up your implementation strategy

You can find more information on Regulatory Update Day here.  The three sessions with the "*" are sessions that are also part of NAFCU's Mortgage Reform Webcast Series.

The other 4 days of Compliance School will remain the same as will the opportunity to take the NAFCU Certified Compliance Officer (NCCO) exams.  Good luck!  

***

And, all attendees at NAFCU's 2013 Regulatory Compliance School will receive NAFCU's 2013 GPS (coming soon!) as well as NAFCU's Scope & Applicability Charts.

Remember:  You do not need to be a NAFCU member credit union to attend NAFCU's conferences or webcasts.  In fact, you don't even need to work at a credit union.  Each School usually features a handful of consultants, vendors and other credit union "peeps" who support credit unions - in one way or another - on a daily basis.      

***

More Form Changes - The FCRA: Regulation V; The "Real" Deal, as Promised

Written by JiJi Bahhur, Regulatory Compliance Counsel

The Consumer Financial Protection Bureau (CFPB) issued changes to several FCRA forms – which are implemented in Regulation V.  The following forms were affected by these changes:

• Appendix I – Summary of Consumer Identity Theft Rights
• Appendix K – Summary of Consumer Rights
• Appendix M – Notice of Furnisher Responsibilities
• Appendix N – Notice of User Responsibilities.

Of particular importance to credit unions is the “Summary of Your Rights Under the Fair Credit Reporting Act” form (Summary of Consumer Rights), which can be found in Appendix K of the final rule.  Changes to this form included removing the reference to the Federal Trade Commission and replacing it with CFPB instead; updating the addresses for contacting the Assistant General Counsel for Aviation Enforcement and Proceedings and the Surface Transportation Board; and correction of typographical errors in the Spanish language translation at the top of Appendix K. 

Credit unions that use credit reports as part of the hiring, promoting, or firing process (i.e., for an employment purpose) should be cognizant of these changes, as this form must go to employees, or applicants, after the credit union has acquired a consumer report, but before it has taken adverse action based on that report.  Credit unions that use consumer reports for employment purposes should be aware of the requirements, and should have a detailed policy and procedures to ensure compliance. 

Although the effective date of the form changes was November 14, 2012, it looks like the CFPB is giving some leeway on the timeframe to make the changes.  In the meantime, the old model forms will be construed as being in compliance with the FCRA provisions requiring such forms.  From the rule:

“To mitigate the impact of these changes on users of the model forms in the Bureau’s Appendices I, K, M, and N published December 21, 2011, the Bureau will regard the use of those model forms to constitute compliance with the FCRA provisions requiring such forms and will regard those forms to be substantially similar to the corrected forms published today, until further notice. The Bureau anticipates providing that further, notice along with ample time to allow for the orderly discontinuation of the December 21, 2011 model forms, when it issues a final rule to restate Regulation V in 2013.”

That being said, if your credit union uses these forms, it would be a good idea to start taking steps to update to these new forms.  Additionally, it looks like the CFPB has plans to make additional changes to Regulation V in 2013 – so stay tuned.  

***

It's a miracle!  The professional photographer was able to catch several photos of all four of us looking at the camera at the same time.  So, as promised, here is the family photo we chose...and of course I had to purchase the rights to all of the pics taken because there were some other memorable photos I just had to have (and I've shared one of those with you all as well).

CFPB Defines Larger Participants for Credit Reporting Market; NAFCU's Economic and CU Issues Monitor

Written by Steve Van Beek

Larger Participants.  The CFPB's regulatory and supervision authority extends beyond depository institutions and into nonbanks.  One part of this authority is the CFPB's ability to define "larger participants" in consumer markets that it will then regulate.  The CFPB had issued proposed rules for the consumer reporting market and the debt collection market and had also issued a general request for comment on other consumer markets for future regulation.    

Consumer Reporting Market.  On Monday, the CFPB announced a final rule that defines "larger participant" for the credit reporting market.  As part of the rulemaking, the CFPB also provided additional information including:

• A Fact Sheet on Regulating the Credit Reporting Market
• Blog Post on How Many Consumer Reporting Companies Exist
• A List of Consumer Reporting Agencies
• A Consumer Advisory Encouraging Consumers to Check their Credit Reports
• A Press Release on the CFPB's Actions to Regulate the Consumer Reporting Market   
• Director Cordray's Speech on Credit Reporting
• An Archived Version of the CFPB's July 16th Field Hearing
• The Final Rule

The CFPB indicates in their final rule that they intend to define "larger participants" in other consumer markets in the near future - most likely next with the debt collection market.  

***

Economic Monitor.  The latest issue of NAFCU's Economic and CU Issues Monitor is now available for download.  The Economic and CU Issues Monitor is NAFCU's monthly update on the macroeconomic and financial trends affecting credit unions.  Each month, a "Special Topic" is addressed, concerning various issues of interest to the credit union community.  NAFCU members can download the latest issue here.  Additional resources and information from NAFCU's Research division can be found here.     

CFPB Releases Semiannual Regulatory Agenda - Spring 2012; Seminar in Seattle

Written by Steve Van Beek

CFPB Regulatory Agenda.  Yesterday, the CFPB posted its Semiannual Regulatory Agenda - for spring 2012.  The previous Semiannual Regulatory Agenda was released in February 2012.  The latest release follows the same format and includes a listing of regulations in the various rulemaking stages: prerule stage, proposed rule stage, final rule stage, long-term actions and completed actions.  

Below is a listing of the various future regulations - organized by rulemaking stage.  Keep in mind the agenda is current as of April 13, 2012 and the CFPB has taken numerous actions since putting this agenda together.    

Prerule Stage:

• Registration of Certain Nonbank Covered Persons
• Supervision of Larger Depository Institutions and Affiliates
• Home Mortgage Disclosure Act (Regulation C)
• Requirements for Prepaid Cards (Regulation E) 

Proposed Stage:

• Amendments to TILA and FIRREA Concerning Appraisals
• Disclosure Rules and Substantive Protection for Certain High Cost Mortgage Loans (Regulation Z)** (proposed on July 9th)
• Mortgage Originator Standards (Regulation Z)
• Mortgage Servicing (Regulation X; Regulation Z)
• TILA/RESPA Mortgage Disclosure Integration (Regulation X; Regulation Z)** (proposed on July 9th)
• Credit Card Pre-Opening Account Fees (Regulation Z)
• Procedural Rule To Establish Supervisory Authority Over Certain Nonbank Covered Persons Based on Risk Determination
• Supervision of Certain Nonbank Covered Persons—Defining Larger Participants in Certain Consumer Financial Product and Service Markets (LP 2) 
• Copies of Appraisals or Other Valuations To Be Furnished by Creditor (Regulation B)

Final Rule Stage:

• Supervision of Certain Nonbank Covered Persons—Defining Larger Participants in Certain Consumer Financial Product and Service Markets (LP 1)** (finalized on July 16th)
• Disclosure of Records and Information
• State Official Notification Rule
• Rules Relating to Investigations
• Rules of Practice for Adjudication Proceedings
• Restatement of Federal Consumer Financial Law Regulations
• Requirements for Escrow Accounts (Regulation Z)
• TILA Ability to Repay (Regulation Z)
• Confidential Treatment of Privileged Information
• Disclosure Rules for Remittance Transactions (Regulation E)

Long-Term Actions:

• Alternative Mortgage Transaction Parity (Regulation D)
• Business Lending Data (Regulation B)
• TILA Mortgage Amendments (Regulation Z) 

Completed Actions: 

• Disclosure Rules for Remittance Transactions (Regulation E)

***

Only 27 potential rulemakings!!  The Regulatory Agenda also includes a short summary of each rulemaking that is useful for providing a quick overview of what will be covered by the rulemaking.  However, as last Monday's proposed rules show - a short summary doesn't do much when the proposals are 1099 pages and 293 pages.  

***

NAFCU's 2012 Regulatory Compliance Seminar.  Luckily, you don't have to read and understand all 27 potential rulemakings on your own.  We'll be covering quite a few of them at our 2012 Regulatory Compliance Seminar in Seattle, Washington - October 23-26.

The program-at-a-glance is available here (and we'll be including additional sessions as the proposals continue to flow).  We already have a session on the TILA/RESPA mortgage disclosures, the upcoming mortgage servicing proposal (including the periodic statement requirement) as well as a session on the remittances final rule.  Detailed session descriptions can be found here.

Remember - you do not need to be a NAFCU member to attend.  And, Save $100 if you Register by August 31st!

Keeping a Record of NCUA's Regs; NAFCU's Comment Letter on TILA/RESPA

Written by Steve Van Beek

On Tuesday we blogged about the FTC's rescission of their regulations that transferred to the CFPB.  We also indicated that NCUA was likely to follow soon after and rescind their rules.  We also included this information about making a copy of the current rules:

"Prior to this occurring, it might be a good business practice to make a copy of the soon-to-be rescinded regulations to ensure your credit union has a copy of the regulations in effect in the past in the case of a member complaint, exam issue or lawsuit."

A very helpful comment highlighted that the Government Printing Office (GPO) retains a copy of each year's CFR in PDF or XML format.  Below are the 2011 PDFs of the rules that transferred from the NCUA to the CFPB.   

Main Rules.  These three rules were transferred either completely (Privacy and SAFE Act) or almost completely (Fair Credit Reporting Act).

• Part 716 - Privacy of Consumer Financial Information
• Part 717 - Fair Credit Reporting
• Part 761 - Registration of Residential Mortgage Loan Originators 

There are a few other regulations listed in the CFPB's Federal Register notice on the transferred regulations but they are not major changes and only impact certain situations.  Part 707 - NCUA's Truth in Savings regulation - is also included on the list but rulemaking authority for Part 707 remains with NCUA.

Note:  Prior years of regulations can be found by using this GPO starting page.  Hat tip to Kennyb.      

***

TILA/RESPA Disclosure Combination.  On Monday, NAFCU submitted a comment letter to the CFPB on their plans to combine the TILA and RESPA disclosures.  The comment letter is 7 pages long and highlights areas of concerns as the CFPB continues along their Dodd-Frank mandate.  

Remember:  The CFPB has to have an official proposal out for the TILA/RESPA combined disclosures by July 21, 2012.  Their Know Before You Own project was not an official proposed rule and was not part of the Administrative Procedures Act.   

Consumer Compliance Outlook: Common Compliance Violations

Written by Steve Van Beek

Hope everyone had a great weekend - below is a great resource that might be useful.

Consumer Compliance Outlook.  The Philadelphia Federal Reserve publishes a Quarterly Consumer Compliance Outlook that is usually a valuable resource.  This month's material is especially useful as they walk through common compliance issues seen during examinations.  The PDF of the 1st Quarter 2012 Issue is here and includes: 

• Fair Lending Webinar Questions and Answers
• View from the Field: Commonly Cited Compliance Violations in 2011
• Risk-Based Pricing Notice Requirements: Questions and Answers
• News from Washington: Regulatory Updates
• On the Docket: Recent Federal Court Opinions
• Compliance Alert
• Index of Articles
• Calendar of Events

The Commonly Cited Compliance Violations include:

• Regulation B's requirement for joint intent for joint credit (spousal signatures);
• Regulation B's adverse action notices (lacking content and specificity);
• RESPA's Tolerance Cures;
• Reg C/HMDA Rate Spread, Loan Purpose Definitions and Type of Action Taken; and
• Reg Z Account Opening Disclosures for Open-end Credit. 

We'll look at some of these violations in more detail later this week.  

For now, I'm just glad the Philadelphia Federal Reserve has continued this publication even though authority for the consumer regulations passed to the CFPB.  In the future, I'm hoping the CFPB (and NCUA) realize how useful an informal publication like the Consumer Compliance Outlook can be in highlighting common issues and explaining the requirements to increase compliance among financial institutions.  

More Republishing; Part 707 - Truth in Savings; Wish Granted

Written by Steve Van Beek

A Quick Note:  NAFCU's offices will be closed Friday, December 23rd and Monday, December 26th for the Christmas holiday.  We will be back blogging on Tuesday.  We hope you all have a wonderful holiday weekend!

***

We've tracked the CFPB's republishing in Monday and Tuesday's blog posts.  The CFPB hasn't slowed down.  

• Published in the Federal Register on Wednesday, December 21:
  • Equal Credit Opportunity (Regulation B)
  • Fair Credit Reporting (Regulation V)
  • Interstate Land Sales Registration Program (Regulations J, K, and L)
  • Privacy of Consumer Financial Information (Regulation P)
  • Truth in Savings (Regulation DD)

• Published in the Federal Register on Thursday, December 22:
  • Truth in Lending (Regulation Z)

***

On December 7th, we blogged on the possibility of the CFPB combining consumer regulations when it conducted its republishing.  Now that the CFPB has made progress on their republishing, we know additional information.  

NCUA will retain authority over Part 707 - implementing the Truth in Savings Act for credit unions.  Footnote 2 of the Proposed Rule contains this information:

"2. Dodd-Frank section 1029 generally excludes from this transfer of authority, subject to certain exceptions, any rulemaking authority over a motor vehicle dealer that is predominantly engaged in the sale and servicing of motor vehicles, the leasing and servicing of motor vehicles, or both. Further, Dodd-Frank section 1100B did not grant the Bureau TISA rulemaking authority over credit unions or repeal the NCUA's TISA rulemaking authority over credit unions under 12 U.S.C. 4311."  (emphasis added)

The proposed regulation (12 CFR 1030) mirrors the current Regulation DD (12 CFR 230) and includes this language in Part 1030.1(c):

"(c) Coverage. This part applies to depository institutions except for credit unions. In addition, the advertising rules in § 1030.8 of this part apply to any person who advertises an account offered by a depository institution, including deposit brokers."

What this means is that NCUA will need to follow the CFPB's lead on Truth in Savings issues just as they did in the past following the Federal Reserve.  The U.S. Code section cited by the CFPB - 12 U.S.C. 4311 - still requires NCUA to adopt a "substantially similar" regulation within 90 days.  NCUA's regulation, which will still be located in 12 C.F.R. 707, will continue to reflect the unique nature of credit unions.  

***

This year - my Christmas gift came early.  Two months ago, in fact.       

Michigan's victory over Ohio State wasn't too bad either.  I was able to enjoy The Game with my father-in-law (as he is from Ohio, he didn't enjoy it as much).  Luckily, we were able to get a photo before the game where we both were happy.  

Have a wonderful holiday weekend!

NAFCU's CFPB Page; CFPB Studies; FTC Mortgage Rule

Written by Steve Van Beek

Keeping track of the issues surrounding the CFPB can be quite difficult.  NAFCU's Regulatory Affairs team has created a webpage to help track and monitor the CFPB's actions.  Click here to see the new page.  The page includes links to the CFPB's guidance documents and reports as well as NAFCU comment letters to the CFPB and recent NAFCU Today stories.  

Also, don't forget that the blog itself has categories which allow you to view prior blog posts related to a certain area - such as the CFPB.   

***

The CFPB has released two reports that were required by Dodd-Frank.  

• Credit Scores (differences between the score consumers receive and the score lenders use).  Full report is here.

• Remittances (relating to transparency of pricing and their potential use in credit scores).  Full report is here.  

These reports have the potential to be the groudwork for future rulemakings and guidance - so just keep these issues on your radar.  

***

With only a few days to spare before the CFPB took over rulemaking authority, the FTC finalized a rule on deceptive mortgage advertisements.  The FTC, CFPB and individual states will have the ability to enforce the new rule - which becomes effective August 19, 2011.  The rule applies to state-chartered credit unions as they fall under the FTC's jurisdiction.  Federally-chartered credit unions are not covered by the new rule but are covered by NCUA's requirements regarding accuracy of advertisements.

Upcoming Compliance Dates

Written by Steve Van Beek

Thursday marks the one-year anniversary of the signing of Dodd-Frank Act.  Of course, that day, July 21, 2011, also marks the day that current federal regulators - including NCUA - transfer authority of consumer regulations to the CFPB.

Dodd-Frank also provided credit unions some wonderful anniversary gifts (isn't it supposed to the other way around?)  A number of provisions of Dodd-Frank become effective on July 21, 2011.  Including:

Regulation CC.  A change in Regulation CC from $100 to $200 for next-day availability.  The Federal Reserve has proposed changes to Reg CC that have not been finalized.  This change to $200 becomes effective though the Federal Reserve has not changed the language of Reg CC.  

This change requires credit unions to review their policies and make sure they are updated.  This present from Dodd-Frank also triggers 229.18(e) of Reg CC which requires credit unions to provide notice of the change to their policy.  This notice is required even though the change is beneficial to members.

Reality Check: Why didn't the Fed propose two different rules?  Rather than confuse the entire financial industry, the Fed could have easily issued one rule to implement the Dodd-Frank change and a separate rule to propose its other changes to Reg CC.

Exemptions to Reg Z & Reg M.  Dodd-Frank also increased the exemptions in Regulation Z and Regulation M from $25,000 to $50,000.  These exemptions were also tied to inflation and will increase to $51,800 after January 1, 2012.

Credit Score Information.  Section 1100F of Dodd-Frank - which requires credit score information to be disclosed on adverse action and risk-based pricing notices - becomes effective July 21, 2011.  The Federal Reserve has issued model forms for credit unions to use and obtain a safe harbor.  

If you are looking for a recap of past blog posts on these changes, see our FCRA category.

NAFCU Members:  The Regulatory Finals on both the adverse action and risk-based pricing notices are available here.

***

Outside of the Dodd-Frank requirements, there are other compliance dates impacting credit unions.

Financial Literacy Requirement for Directors.  The financial literacy requirement for credit union directors becomes effective July 27, 2011.  Anthony did a great post  in February which stresses the importance of having a policy in place to document the credit union's efforts.  

Remember that this rule applies to new directors going forward as well.  Within six months of election, directors will need to have the financial skills expected by NCUA.  This means if your election occurs in August - new directors have six months to get up to speed.  Your policy should cover these situations as well as how the CU will address situations where a new director comes aboard between elections.

SAFE Act.  The initial registration for the SAFE Act ends July 29, 2011.  Credit unions need to have their mortgage loan originators registered and ready to go by that date.  Only registered MLOs can originate mortgage loans after July 29, 2011.  NCUA implemented the SAFE Act requirements in Part 761 of NCUA's Regulations.  

Clarifications to the Credit CARD Act.  It has been amazing how many pages of regulations came out of the 33-page Credit CARD Act.  In March, the Federal Reserve issued "clarifications" to its previous three final rules of Regulation Z.  These changes become effective October 1, 2011.  

NAFCU webcast:  Sarah and I will be doing a webcast on August 10, 2011 discussing these new clarifications and potential changes credit unions will need to make prior to October 1.       

Changes to NCUA's Advertising Rules.  In May, NCUA finalized a rule to amend its requirements for the display of the "official advertising logo" on advertisements.  This blog post from May 20 highlights the changes which become effective January 1, 2012.  Importantly, there is no "grandfathering" so existing advertisements are not exempt from these requirements.  Any advertisement used after January 1, 2012 would need to comply with these new requirements.      

Adverse Action & Risk-Based Notices; NCUA Board Agenda; CAN-SPAM

Written by Steve Van Beek

We expect that both the adverse action notices and the risk-based pricing notices will be published in the Federal Register today.  We are not clairvoyant, but there is a process that allows you to see what will be included in the next day's Federal Register pages.  This is the "Public Inspection Desk."    

We will update this blog post when links to the Federal Register become available.  Update (7/15/2011):  

Regulation B (adverse action model forms) here.  

Regulation V (risk-based pricing notices) here.  

Note:  While both the amendments indicate they are effective in 30 days, the underlying requirements of Section 1100F from Dodd-Frank become effective on July 21, 2011.  Credit unions should do their best to get their notices updated and ready for July 21, 2011.

***

NCUA has posted the agenda for its July Board Meeting.  On the rulemaking side, there are three items of interest:

1. Final Rule – Parts 700, 701, 702, and 741 of NCUA’s Rules and Regulations, Net Worth and Equity Ratio Definitions.
2. Interim Final Rule – Section 701.30 of NCUA’s Rules and Regulations, Remittance Transfers.
3. Proposed Rule – Part 712 of NCUA’s Rules and Regulations, Credit Union Service Organizations (CUSOs).

The text of these proposals and final rules will be available on the morning of the Board meeting - a familiar date - July 21, 2011.  

*** 

The Federal Trade Commission announced a new CAN-SPAM education tool for small businesses.  The new video discusses "seven things you need to know to comply with CAN-SPAM."  There is also a useful transcript of the video at the bottom of the page.     

Credit Score Information on Adverse Action Notices

Written by Steve Van Beek

Last Wednesday, the Federal Reserve released final rules on both risk-based pricing notices and adverse action notices.  Both changes were required by Section 1100F of Dodd-Frank.  

Adverse Action Notices

There is a bit of confusion in this area because there are actually two separate adverse action notices.  Regulation B has an adverse action notice.  And, the Fair Credit Reporting Act (FCRA) also has a requirement for an adverse action notice.  Oftentimes, credit unions are required to send both notices and they meet this requirement by sending a combined Reg B/FCRA adverse action notice.  In some other situations, only the Reg B adverse action notice is required (i.e., no credit report is used).

The Dodd-Frank Act changed the FCRA adverse action notice.  Of note, there is not a regulation that implements the FCRA adverse action notice.  Rather, the Federal Reserve provides combined model forms in Regulation B that provide the required language for both the Reg B and the FCRA adverse action notices.

And, that is why the Fed amended Reg B even though Section 1100F of Dodd-Frank made a change to the FCRA adverse action notice.

Adverse Action.  The trigger for the FCRA adverse action notice is when the CU takes adverse action based "in whole or in part" on information from a consumer report.  With the new changes - the FCRA adverse action will need to also include the credit score information if the CU used the credit score in taking adverse action against the member.  

What if the CU did not use a credit score?  From the Fed - Page 6-7:

"Under Section 1100F of the Dodd-Frank Act, a person is not required to disclose a credit score and related information if a credit score is not used in taking the adverse action."

Similar to the risk-based pricing rule, if the CU obtains a credit score it would need to be able to demonstrate that the credit score played no role in the adverse action determination.  Quite a tough hurdle.     

What if there is no credit score?  From Page 7:

"Disclosure that no credit score is available. In some cases, a creditor may try to obtain a credit score for an applicant, but the applicant may have insufficient credit history for the consumer reporting agency to generate a credit score. One commenter asked that the creditor have the option to provide the applicant notice that no credit score was available from a consumer reporting agency in the space available for the credit information disclosure.

Section 1100F only applies when a creditor uses a credit score in taking adverse action. The creditor cannot disclose credit score information if an applicant has no credit score. Nothing in section 1100F of the Dodd-Frank Act prevents a creditor, however, from providing the applicant notice that no credit score was available from a consumer reporting agency, although section 1100F does not require such notice."

Specific Reasons (Reg B) and Key Factors (FCRA).  If the credit union is required to send both adverse action notices, it cannot use the FCRA "key factors" in the credit score information to fulfill the Reg B requirement for specific reasons for the adverse action.  The Fed spelled this out in Page 8:

"As explained in the proposed rule, the Board recognizes that a key factor(s) that adversely affected the consumer’s credit score may be the same as a specific reason(s) for denying credit or taking other adverse action. However, some specific reasons for taking adverse action may be unrelated to a consumer’s credit score, such as reasons related to the consumer’s income, employment, or residency. Therefore, the Board continues to believe the disclosure of both the key factors that adversely affected the consumer’s credit score and the specific reasons for denying credit or taking other adverse action is necessary to fulfill the separate requirements of the ECOA and the FCRA. The Board believes providing separate lists, and thus distinguishing factors that adversely affected the credit score from reasons for the adverse action determination, will be more useful and clearer for consumers."

Credit Score Information on Separate Document?  Unlike the risk-based pricing rule - which allows credit unions to staple the new credit score information to their existing RBPN - the Fed has indicated the credit score information needs to included on the adverse action notice.  A few industry commenters had asked that institutions be able to attach a form from a consumer reporting agency to their existing adverse action notices.  The Fed declined stating that "providing a form with credit score information separately from an adverse action notice does not appear to be consistent with the legislation."  

My Soapbox:  Basically, commonsense was thrown out the window and the Fed was not concerned with regulatory burden or compliance costs.  I'm not sure there is another explanation.  I'm pretty confident that the Fed could have used its regulatory authority to determine the adverse action notice is now a two-page disclosure (with the second page being the credit score information).  Just like they did with the risk-based pricing notice.  Which was written by the same attorneys......  

Timing.  Similar to the risk-based pricing notices, the Fed stated the new requirements of Dodd-Frank become effective July 21, 2011.  Credit unions should do their best to meet the July 21, 2011 deadline.  

More on Risk-Based Pricing Notices; CARD Act Webcast

Written by Steve Van Beek

Welcome to Friday!  The week goes by pretty fast when the Fed is issuing final rules left and right.  

***

Timing.  We had quite a few questions on the timeline for the Reg V and Reg B notices.  The model forms carry a compliance date of 30 days after the rules are published in the Federal Register.  

Does that mean you have extra time to comply?  Let's put it this way.  I wouldn't want to delay working on getting the credit score information included.  I'd want to make sure my forms were ready to go on July 21, 2011.  Why?  The Federal Reserve went out of its way to indicate its hands were tied by Section 1100F's July 21, 2011 effective date.

Then why the 30 days after the Federal Register for the listed compliance date?  This is due to the rulemaking process that federal agencies - including the Federal Reserve - must follow.  Those rules come from the Administrative Procedures Act and govern the "notice and comment" rulemaking procedures.  One of those rules requires agencies to give 30 days after they finalize a rule.  See 5 U.S.C. 553(d).  

So didn't the Federal Reserve hamstring financial institutions by getting the final rule out so late?  Yes.

What if we can't be ready by July 21, 2011?  Document your compliance efforts and the actions the CU has taken to get as close as possible to the July 21, 2011 date.    

***

A thank you to comment letters.  Federal agencies don't always tweak rules when they are finalized.  Sometimes they do, and there is one change in the risk-based pricing final rule that - while optional - could alleviate potential headaches.  I'll just include the section as it describes it best - from Page 18:

"Contact information for the entity that provided the credit score.  An industry commenter asked that the Agencies add language to the model forms directing the consumer to the consumer reporting agency for more information about the credit score. The commenter believed that consumers may otherwise contact creditors with questions about their credit score, but that creditors are not in a position to answer those questions. 

    The Agencies are adding optional language to model forms H-6 and H-7 of the Board‘s rule and B-6 and B-7 of the Commission‘s rule directing the consumer to the entity (which may be a consumer reporting agency or, in the case of a proprietary score that meets the definition of a credit score, the creditor itself) that provided the credit score for any questions about the credit score, along with the entity‘s contact information. Creditors may use or not use the additional language without losing the safe harbor, since the language is optional. The final rules add new instruction 4. to Appendices H and B to make clear that this disclosure of the entity‘s contact information is optional."  

This little tweak allows the CU to put information about the credit reporting agency (CRA) into the credit score disclosure portion of the risk-based pricing notice.  This is useful as it means an issue with the credit score itself is more likely to be asked of the correct party (the CRA and not the CU).  Note:  This optional language is the final section of the H-6 and H-7 notices and is in brackets - which indicates it is optional.  

Attaching the Credit Score Info to Current RBPN.  The Fed did give some flexibility to credit unions in this area.  The full discussion is on Page 20 of the final rule.  While it doesn't change the information that needs to be disclosed, the Fed did allow credit unions to essentially attach the new credit score information to their existing risk-based pricing notices.  Thus, if you used the H-1 notice - you would then need to include the credit score information to this notice (the second part of the H-6 notice).  This allows the CU to obtain the safe harbor.  Here is from the Fed:

"Attaching the credit score information to the current model form.  One industry commenter asked the Agencies to clarify that a creditor may staple or append the credit score information using a supplemental document to a current model form on general risk-based pricing (H-1 and B-1) or an account review notice (H-2 and B-2).....................................................................................................................

.........Thus, the Agencies believe that a creditor will be deemed to have used H-6 or B-6 if it staples or appends to H-1 or B-1 the credit score information contained in the section "Your Credit Score and Understanding Your Credit Score" that is contained on the second page of H-6 and B-6.  Instruction 3. to Appendices H and B sets out the modifications that may be made to the model forms without losing the benefit of the safe harbor."

As I stated above, this does not change the information that needs to be given - but it does allow the CU the flexibility to work on getting the credit score information ready and attaching or stapling it to their existing risk-based pricing notice.  See Page 20.

***

Also, I added a new link to yesterday afternoon's blog that contains the new regulatory text of the "Multiple Consumer" situation - which includes a useful example.

***

Sarah and I will be doing a webcast on the recent clarifications to the Credit CARD Act.  If you are interested, the webcast is on Wednesday, August 10.  

Have a great weekend!     

Credit Score Info on Risk-Based Pricing Notices

Written by Steve Van Beek

This morning's blog post discussed the minimal implementation time given by the Federal Reserve.  This post will get into some of the weeds of the risk-based pricing notice final rule.  We will pick up on other issues tomorrow and the changes to Reg B's model forms next week.  

***

Risk-Based Pricing Notices

Credit Score Exception Notices.  The recent changes will not impact your credit union if you use the credit score disclosure exception notices.  I blogged about this back in late March.  However, consumer groups made a strong push to remove these exception notices completely.  The Fed did not follow - but remember the new Consumer Financial Protection Bureau (CFPB) takes over the consumer laws, including Reg V, and will be a new ear for consumer groups.  The two pages of discussion are here if you want to review the discussion - which provides a good reminder for the role of comment letters.    

Key Factors.  The Fed clarified that credit unions who purchase a credit score from a consumer reporting agency (CRA) can rely on the "key factors" provided by the CRA to disclose the key factors that adversely affected the credit score.

Use of Credit Score.  This new requirement - from Section 1100F of Dodd-Frank - applies when the credit unions uses a credit score in setting or reviewing the APR on the account.  If the credit union uses a credit score in the credit decision, it must include these new disclosures.  

What if you obtain a credit score but do not use it?  The Fed discusses this situation and concludes:

"A creditor that obtains a credit score and engages in risk-based pricing would need to disclose that score, unless the credit score played no role in setting the material terms of credit.  Moreovers, even if the credit score was not a significant factor in setting the material terms of credit but was a factor in setting those terms, the creditor will have used the credit score for purposes of Section 1100F of the Dodd-Frank Act." (emphasis added).  Page 9.

Here is the problem with that:  how do you prove to an examiner that you did not use a credit score that you have in your possession?  That might be a very tough hurdle and strong procedures and documentation might not be able to satisfy an examiner.  A separate question might be:  why is the CU obtaining a credit score when it is not using it in the decision process?    

Guarantors & Co-Signers.  Regulation V does not require the credit union to send a risk-based pricing notice to a guarantor or co-signer on an account because the CU is not granting credit to that person (see 75 Fed. Reg. 2731 for more discussion).  However, the credit union may need to send a risk-based pricing notice to the actual applicant.

So what happens if a CU uses a guarantor's credit score to grant credit to the applicant?  Does it send the credit score information of the guarantor to the applicant?  The Fed answered this on page 11 of the final rule.  The Fed concluded:

"The Agencies continue to believe that the credit score of one consumer, such as a guarantor, co-signer, surety, or endorser, should not be disclosed to a different consumer entitled to receive a risk-based pricing notice."    

Multiple Consumers.  Last month, I blogged on the proposed change for sending risk-based pricing notices when there are multiple applicants.  This change was finalized and will require the credit union to send separate risk-based pricing notices to co-applicants - even if they reside in the same household - if the notice contains credit score information.  In other words, the credit score information is private information and cannot be shared with other co-applicants.  Update (7/7/11):  For the regulatory text, see section 222.75(c)(1) and the example in 222.75(c)(3).  

In regulator-land, the fact that two applicants applied jointly for credit does not mean the "co-applicants necessarily choose, merely by applying for credit together, to share sensitive information with one another, in particular, credit scores."  Taking this to the logical conclusion, it is strange that the Fed does not require financial institutions to send separate credit card statements to joint accounts based on which card was used. [Note: I realize I should not give regulators ideas like this!]  After all, even if I had a joint account with my fiancé that doesn't mean I want her to know where I ate lunch yesterday, right?  Or, that I went golfing when I was supposed to be cat sitting....... 

Note:  All applicants must receive a risk-based pricing notice even if the CU only used one applicant's credit score.  In that situation, the CU would need to send a RBPN with credit score information to the applicant whose credit score was used and a normal risk-based pricing notice to the other co-applicant.  From the Fed:

"A creditor therefore must provide a risk-based pricing notice to all co-applicants, and not only to the applicant whose credit score was used in setting the material terms of credit."  Pages 15-17.    

***

There was also an interesting statement by the Fed in their final rule to Reg V.  The Fed was asked to considering changing the language on the model form so that the form did not state the terms (i.e., the APR) were "set" or "based on" information in the credit report.  The commenters asked that the language be changed to broader language - such as "based in whole or in part on information from a consumer report."  

The Fed said no.  Why?  "The Agencies believe that the current language in the regulation and model forms is more concise and understandable to consumers than the language suggested by the commenters."

Ok, understandable.  It is hard to determine what is meant by "in whole or in part."  Then why in the world is this the test that the Federal Reserve uses in Section 222.72(a) of Regulation V??:

"§ 222.72   General requirements for risk-based pricing notices.

(a) In general. Except as otherwise provided in this subpart, a person must provide to a consumer a notice (“risk-based pricing notice”) in the form and manner required by this subpart if the person both—

(1) Uses a consumer report in connection with an application for, or a grant, extension, or other provision of, credit to that consumer that is primarily for personal, family, or household purposes; and

(2) Based in whole or in part on the consumer report, grants, extends, or otherwise provides credit to that consumer on material terms that are materially less favorable than the most favorable material terms available to a substantial proportion of consumers from or through that person." 

Why do credit unions have to use concise language and regulators do not?  This looks like a perfect area for Ms. Warren and the CFPB to step in and make sure credit unions do not need "an army of lawyers" to understand the legal requirements.  

Fed Finalizes Adverse Action and Risk-Based Pricing Notices

Written by Steve Van Beek

Yesterday, the Federal Reserve finalized rules on model adverse action notices and risk-based pricing notices to implement Section 1100F of Dodd-Frank.  Section 1100F of Dodd-Frank required "credit score information" to be added to both Fair Credit Reporting Act (FCRA) adverse action notices and risk-based pricing notices (required by FCRA and implemented in Reg V).  

The Fed issued two separate final rules to implement Section 1100F:  

1. A final rule amending Regulation B's Model Forms - which include combined Reg B/FCRA adverse action notices.
2. A final rule amending the Federal Reserve's Regulation V - which requires risk-based pricing notices.

Effective Date.  Both rules carry an effective date of 30 days after the rules are published in the Federal Register (which might not be until early next week).  We will post a notice on the blog when the rules are published in the Federal Register.    

Note that the Federal Reserve provided the absolute bare minimum of compliance leadtime (30 days).  Here is how the Fed discussed the implementation date in the Reg V final rule (page 21-22 of the PDF):

"Even if the Agencies did not modify the model forms to incorporate this additional minimum content, creditors would be required to disclose this information pursuant to the statute.      

    Rather than have creditors create their own notices in order to comply with section 1100F of the Dodd-Frank Act, the Agencies are exercising their existing authority to amend the model notices to reflect these changes to avoid consumer confusion, and to ensure timely, consistent, and uniform compliance with the new content provisions.  Section 615(h) gives the Agencies the authority to issue rules implementing the risk-based pricing provisions, including authority to address “the form, content, timing, and manner of delivery” of risk-based pricing notices. The Agencies believe that adding to the requirements for the risk-based pricing notice the content required by section 1100F of the Dodd-Frank Act, and providing revised model notices is appropriate.  These final rules are thus effective and compliance is mandatory beginning 30 days after the date of publication in the Federal Register."

Wow - the Fed almost makes it sound like they are doing credit unions a favor by waiting until 15 days prior to the July 21, 2011 date to finalize the model forms.  The Fed included similar language in the Reg B final rule (pages 17-18).

***

We will have more on these final rules in the near future.  For now, know that the Fed did not provide any wiggle room on the implementation date and credit unions need to make sure their notices are being updated with the new required information.  

Risk-Based Pricing Notice Proposed Changes

Written by Steve Van Beek

Back in late March, I blogged briefly about the proposed changes to the risk-based pricing notices.  The ink was barely dry on the risk-based pricing rules before Dodd-Frank required the notices to be updated.  As the March blog post notes, this change impacts institutions using the traditional risk-based pricing notices.  The "credit score disclosure exception notices" are not impacted because they already contain the credit score information.

The changes to the risk-based pricing notices have not been finalized but they will become effective July 21, 2011 (unless the Fed extends the compliance date when it issues the final rule).  When finalized, credit unions will need to include credit score information on all risk-based pricing notices.  This is required by Section 1100F of Dodd-Frank which amended Section 615(h) to the Fair Credit Reporting Act (which is then implemented by Regulation V).

This requirement for the credit score information dovetails with the requirement for the credit score information which will soon be required for FCRA adverse action notices.  Dodd-Frank required these changes to ensure consumers knew their credit score information and that it was a factor in the credit union's decision.  In the past, the adverse action notice and traditional risk-based pricing notice only required a disclosure about the consumer's right to receive and review their credit report.  Going forward, these notices will need to have the credit score as well.  

The proposed rule - which includes proposed model forms - is located here.

***

The rationale for the Dodd-Frank change makes some sense.  Congress wanted to give consumers a right to their credit score in addition to their ability to obtain their credit report.  However, sometimes I think Congress does not give enough attention to the burden this places on small institutions.  

Allow me one example (for today).  Here is a section of the current language from Regulation V - 12 C.F.R. 222.75(c):

"(c) Multiple consumers —(1) Risk-based pricing notices. In a transaction involving two or more consumers who are granted, extended, or otherwise provided credit, a person must provide a notice to each consumer to satisfy the requirements of §222.72(a) or (c). If the consumers have the same address, a person may satisfy the requirements by providing a single notice addressed to both consumers. If the consumers do not have the same address, a person must provide a notice to each consumer.

(2) Credit score disclosure notices. In a transaction involving two or more consumers who are granted, extended, or otherwise provided credit, a person must provide a separate notice to each consumer to satisfy the exceptions in §222.74(d), (e), or (f). Whether the consumers have the same address or not, the person must provide a separate notice to each consumer. Each separate notice must contain only the credit score(s) of the consumer to whom the notice is provided, and not the credit score(s) of the other consumer."

There was some flexibility built into the Regulation V risk-based pricing notice.  This allowed institutions who were sending the traditional risk-based pricing notices to send one notice in situations where the consumers both had the same address (this was not allowed for credit unions sending the credit score disclosure exception notices).  

This new change will ultimately remove this flexibility.  All risk-based pricing notices will now need credit score information.  This means credit unions that previously sent one notice to members jointly at the same address will need to send two separate notices - even if the members reside at the same address - because of the credit score information.  

Now, you may be thinking - this is not a huge change.  But - I'd argue this small change (sending two notices rather than one) has a large compliance cost.  Remember, the risk-based pricing rule just became effective on January 1, 2011.  This change from Dodd-Frank will become effective July 21, 2011.  That is just over six months.  The cost of this change is not just the additional cost of mailing out an additional notice each time.  Credit unions will also need to update their current procedures and retrain staff.  And that is just on this small mailing change.  Credit unions will also need to spend time and resources reading and digesting the other changes in the final rule which hasn't arrived yet.

NAFCU Members:  Our Reg Alert on the changes to Regulation V (11-EA-07) can be found here.      

Adverse Action Notices; Fiduciary Duties Policy; NCUA Webinar

Posted by Sarah Loats Zimmermann

Adverse Action Forms. Confusion abounds surrounding the proposed adverse action forms under Reg B. The confusion probably stems from the fact that the change required by the Dodd-Frank Act (to include credit scores and other information in an adverse action notice) is a change to the FCRA adverse action notice requirements. Changes are not being made to the ECOA/Reg B adverse action requirements at this time.

However, very often a credit union needs to send both adverse action notices at the same time. Therefore, the Federal Reserve created model forms that combine the Reg B and FCRA adverse action notice requirements. These model forms are housed in Appendix C to Reg B, and because there are changes to the FCRA notice requirements the Federal Reserve needs to change those model forms that purport to satisfy both the Reg B and FCRA adverse action notice requirements.

The proposed model forms were published in the Federal Register in March. The FCRA notice requirements kick-in July 21, 2011 per the Dodd-Frank Act. Final forms have not yet been issued, but keep an eye out for them because July 21 is just around the corner. If you are itching for a more detailed discussion of this issue, please see the Background section of the proposed rule. If that link doesn't work for you, go to the Fed's press release announcement. You can access the proposed rule from there as well.


Fiduciary Duties Policy.  NAFCU members, another very generous member has offered a sample Fiduciary Duties policy for the policy exchange library. If you'd like to review it, you can go to the library and peruse the Miscellaneous section. It is aptly named Fiduciary Duties. And when that generous nature strikes you, please consider offering a sample policy of your own.

 

NCUA Webinar.  NCUA will be holding a free webinar Thursday May 26 (tomorrow) at 4 pm. The topic is the proposed voluntary prepaid Corporate Stabilization Fund assessments program that NCUA announced at its May 19 Board meeting. NCUA's press release about the webinar contains a link to register.

Account Reviews - Risk-Based Pricing Notices

Written by Steve Van Beek

With the creation of the new Consumer Financial Protection Bureau (CFPB), there has been an extra focus on clarity of information.  The CFPB has consistently stated that one of its main missions will be to remove the "tricks and traps" currently used in the financial marketplace.  It is with that background in mind that I want to walk through an example of where regulators have placed complicated and unnecessary roadblocks on the road to compliance.

*** 

The recent risk-based pricing rule in Regulation V contains a requirement for institutions to send a risk-based pricing notice when the credit union has conducted an "account review" and increased the APR on an existing loan.  Note: This post is not going to discuss the Regulation Z issues involved (i.e., change-in-terms process and APR review process if a credit card account).  

Here is from Regulation V - 12 C.F.R. 222.72(d):

"(d) Account review —(1) In general. Except as otherwise provided in this subpart, a person is subject to the requirements of paragraph (a) of this section and must provide a risk-based pricing notice to a consumer in the form and manner required by this subpart if the person—

(i) Uses a consumer report in connection with a review of credit that has been extended to the consumer; and

(ii) Based in whole or in part on the consumer report, increases the annual percentage rate (the annual percentage rate referenced in §222.71(n)(1)(ii) in the case of a credit card).

(2) Example. A credit card issuer periodically obtains consumer reports for the purpose of reviewing the terms of credit it has extended to consumers in connection with credit cards. As a result of this review, the credit card issuer increases the purchase annual percentage rate applicable to a consumer's credit card based in whole or in part on information in a consumer report. The credit card issuer is subject to the requirements of paragraph (a) of this section and must provide a risk-based pricing notice to the consumer."

Regulation V includes a model form for this notice; the H-2 notice.

But, wouldn't this be a situation where an adverse action notice would be required under Reg B and the FCRA?  Here is a discussion of that issue in the preamble to the final rule:

"Industry commenters objected to this requirement, stating that account review is not covered by the statute. They also argued that the provision was not needed because adverse action notices were already provided when annual percentage rates are increased during account review.

            Paragraph (d) of the final rules is adopted as proposed. The legislative history indicates that the statute was meant to apply to account reviews, as well as to new accounts. Moreover, the Agencies acknowledge that there are circumstances where an adverse action notice is provided to the consumer in connection with an account review that results in a rate increase. In these circumstances, the exception for adverse action notices, discussed below, would apply and the creditor would not be required to provide the consumer with a risk-based pricing account review notice. However, if an adverse action notice is not provided to a consumer, a risk-based pricing account review notice must be provided to the consumer." 75 Fed. Reg. 2736.

So, the Fed (and the FTC) are telling institutions they need to send a risk-based pricing notice to members where their APR has been increased.  But, the notice is not required if an adverse action notice has been sent (the exception is located in 12 C.F.R. 222.74(b)).

So, let's go back to the example the Fed (and the FTC) used in 12 C.F.R. 222.72(d)(2) to explain this situation:

"(2) Example. A credit card issuer periodically obtains consumer reports for the purpose of reviewing the terms of credit it has extended to consumers in connection with credit cards. As a result of this review, the credit card issuer increases the purchase annual percentage rate applicable to a consumer's credit card based in whole or in part on information in a consumer report. The credit card issuer is subject to the requirements of paragraph (a) of this section and must provide a risk-based pricing notice to the consumer." (emphasis added).

To me, this is a "trick and trap" conducted by the regulators.  Industry commenters specifically mentioned that an adverse action notice is sent in a majority of these "account review" situations and that a risk-based pricing notice would be redundant.  The Fed (and the FTC) acknowledged this in the preamble but did not change the language of the regulation.  

Thus, now we have a situation where a reading of the regulation implies an "account review" risk-based pricing notice would need to be sent.  But, the adverse action notice exception, in 12 C.F.R. 222.74(b), still applies.  How do we know the adverse action exception applies?  The Fed (and the FTC) acknowledged this in the preamble.  

Have you seen any discussion about important account terms being "tucked away in the fine print"?  To me, this regulation does the exact same thing.  Would it have been so hard to include a reference to the adverse action exception in the example used in 12 C.F.R. 222.74(d)(2)?     

Here is what this section could have looked like if the Fed (and the FTC) incorporated the comments received during the rulemaking process:

"(2) Example. A credit card issuer periodically obtains consumer reports for the purpose of reviewing the terms of credit it has extended to consumers in connection with credit cards. As a result of this review, the credit card issuer increases the purchase annual percentage rate applicable to a consumer's credit card based in whole or in part on information in a consumer report. The credit card issuer is subject to the requirements of paragraph (a) of this section and must provide a risk-based pricing notice to the consumer.

If a credit card issuer has sent an adverse action notice to the consumer, the credit card issuer would not be required to also send a risk-based pricing notice to the consumer.  Refer to 12 C.F.R. 222.74(b) for more details on this exception."

Please Note - the above is a hypothetical regulatory section for informational purposes and is not real.

***

Another common refrain from the CFPB is that they understand how an increasing regulatory burden disproportionately hurts small financial institutions - including credit unions.  To help ease this burden, regulators need to reduce the situations where key issues are "buried in the preamble" rather than reflected in the regulation or in the staff commentary.  

If the goal is increased clarity of information, regulators need to join the party as well.

Thursday's This and That; Baseball Scholarship?

Posted by Anthony Demangone

Here are a few things rattling around in my in-box.  

SAFE Act.  The NMLS Federal Registry has posted a good deal of new information to help institutions prepare for the upcoming MLO registration process. Even though the registry is not open yet, this website should help you get started. 

BSA.  So, just how bad could it be to disclose the existence of a SAR to a member?  Pretty bad, it seems. Although, the bank bribery violations didn't help either.  

Dodd-Frank.  If you visit their web-site, it won't take you long to see what the Republican leadership of the House Financial Services Committee thinks of Dodd Frank. Not much.  Not much at all.

ATMs and Class Action Lawsuits.  My friend and fellow credit union attorney Rob Rutkowski pens a very interesting blog post on how one financial institution avoided a class action lawsuit regarding ATM signage. And he used "skullduggery" and "Byzantine" in the same post.  Well done, Rob. 

Risk-Based Pricing Notices.  Yesterday, I was invited to attend a future (February) Consumer Compliance Outlook webinar on Risk-Based Pricing Notices.  Now, you're invited as well. These guys usually put on a good show. 

The Wrong One is Winning.  My son Briggs is in a "chucking" stage.  If he disagrees with my position on an issue, such as, "Can Briggs Play With the TV Remote," he voices his displeasure by locating small objects, picking them up, and chucking them as far as he can. Luckily, that's about four feet at the moment.  My bright idea was to see if I could enlist Kate to help me out.  So when he chucks, I ask Kate to help me pick up.  And I praise her as she does.  There's only one problem...Briggs is far more efficient at chucking than Kate is at helping.    

Privacy; This and That

Posted by Anthony Demangone

I know that some of you are putting the final touches on your credit union's privacy policy to align it with the new model privacy form.  I'm not going to go into the nuts and bolts of the new model privacy form.  I did this post earlier that covered the "nuts and bolts" issues.  Today, I want to touch on two common questions that we've seen.

1. I don't see a requirement to post our privacy policy on our web site site.  Really? Yes, really.  There's no requirement to post your privacy policy there.  Keep in mind, not every credit union has a web site.  The requirement is to deliver it at account opening, and thereafter on an annual basis per the privacy regulation's requirements.  Again - there's no requirement to post it on your website.  But here's a thought: why wouldn't you post your privacy policy online? 
2. The next question comes in two flavors.  Flavor one: Do we have to use the new form? Flavor two: There is no way we're going to have our form ready by January 1, 2011.  I know the Mayans think the world is ending in 2012, but I fear our demise might come one year earlier based on our progress with this project.  No - there's no requirement to use the new form.  It is a model form, and if you use it according to its requirements beginning on January 1, 2011 - you'll exist in the regulatory Nirvana known as "Safe Harborville." Put another way, regulators and others will not be able to criticize your form if you use it properly.  If you don't have your new form ready on January 1, 2011, will the world end?  I really hope not based on my conversations with a few credit unions.  I'll just say this much...the regulators have given us a model form that provides a safe harbor.  If you don't take advantage of it on January 1, 2011, you will increase your compliance risk.  How much?  I can't speak for the regulators.  But I'll say this: which form would you rather have as your form if an examiner walked into your office on January 1, 2011?  (OK, I understand your credit union is likely closed that day to allow all employees to watch the "can't miss" Outback Bowl, featuring the football powerhouses Penn State and Florida.  But you get my point.)

Here are some other issues that caught my eye.

• Here's yet another wonderful post on overdraft protection from the Bank Lawyer's Blog that provides another view of the recently issued FDIC overdraft protection guidance.  You should read this guy's blog. Every day. And twice on Tuesdays.
• The Fed has issued this notice, WHICH CONTAINS THE INTER-AGENCY EXAM PROCEDURES FOR RISK-BASED PRICING NOTICES. I would have made that text blink if I had a clue about computers and such.  This is a nice little Holiday Gift from the Fed which should give us a better idea of regulator expectations on this issue.  And based on the emails and calls we've been receiving, quite a few of you are still working on this issue.

PS: Apologies for letting Pearl Harbor Day pass without mention yesterday. Shame on me. To any and all veterans out there, many thanks.

RBPNs: Can you tweak the model forms?

Posted by Anthony Demangone

A credit union compliance officer asked me a wonderful question the other day.  His credit union wanted to add information to a model risk-based pricing notice, such as the member's name.  He was concerned, however, that by tweaking the model form, he might lose safe harbor protection.

When you are using a model form, always look to the regulation to see if it allows some variation to the model form for certain, limited situations. The risk-based pricing notice final rule does allow you to add certain pieces of information to the model forms without blowing up the safe harbor protection.  Here's what regulators indicated in the final rule's discussion section:

 The Agencies agree that creditors should have some additional flexibility to modify the content of the model forms, while still retaining the safe harbor. Language has been added to the final rules to clarify that technical modifications to the language of the forms are permitted. More examples also have been added to the list of examples of acceptable changes to the model forms: substitution of the words ‘‘credit’’ and ‘‘creditor’’ or ‘‘finance’’ and ‘‘finance company’’ for the terms ‘‘loan’’ and ‘‘lender’’; including pre-printed lists of the sources of consumer reports or consumer reporting agencies in a ‘‘check-the-box’’ format; and including the name of the consumer, transaction identification numbers, a date, and other information that will assist in identifying the transaction to which the form pertains. The final rules also specifically state that unacceptable changes to the model forms include: providing model forms on register receipts or interspersed with other disclosures and eliminating empty lines and extra spaces between sentences within the same section.

A discussion of acceptable changes is found within Appendix H of the final rule. 

Shameless Plug Monday: NAFCU Compliance School Revamp; Online Training; This and That

Posted by Anthony Demangone

Warning...warning...shameless plug alert.

For those into compliance, you may have heard of NAFCU's Regulatory Compliance School.  It is a week-long, intense educational conference designed to hammer compliance into the minds of its attendees. There is optional testing, all with the goal of obtaining the NAFCU Certified Compliance Officer (NCCO) designation.  

We are revamping the school, from top to bottom.  Check out the new agenda.

Why we are revamping it.  Any product or service must adapt.  For those who attended the School in the past, you may recall that it had entire sessions devoted to the Right to Privacy Act and NCUA's Credit Practices Rule.  But the school didn't address credit union bylaws, share insurance, RegFlex, the right of offset, and many other important topics.  In addition, while the old format shoveled information at attendees, the School never talked about research skills, how to write effectively, or what the role of the compliance officer really is. 

What we did.  You'll see many more topics in the agenda. However, you may see that many of the sessions are shortened.  We simply can't touch on many new things while devoting 2 hours to Regulation Z.  Or an hour to the Right to Financial Privacy Act.  We've tried to create a School manual that provides detailed information about each regulatory area, while also providing research tips and resources.  In addition, we devote an entire day (Wednesday) on "compliance officer skills."  Finally, we're moving to a four-test format.  Many attendees in the past indicated that they were simply burned out by the end of the week.  We decided that cutting a test allowed us to create a day (Wednesday) when attendees could learn how to be a better compliance officer without the stress of a test hanging over their head. 

If I had to sum up why we're changing school and what our goal is, it would be this.

In the current regulatory climate, rote memorization and intense study will only get you so far.  Memories fade, and regulations morph.  The true way to achieve regulatory success is to build skills through which a compliance officer can assimilate and research new changes as they come along, while maintaining a solid understanding of basic regulatory framework. 

That's our goal.  We hope you consider joining us.

***

NCUA's fiduciary duties proposal (we expect the final will likely released in December) has quite a few credit unions looking at training programs for their board of directors.  With that in mind, consider signing up for a free (and fairly short) webinar that highlights NAFCU's Online Training Program for Volunteers and New Employees. It will be held tomorrow at 2 p.m. (EST)

***

Here are a few tid-bits to get us started:

• FinCEN has released a guidance document that provides a number of questions and answers about it Travel Rule requirement. 
• The Fed has released a consumer's guide to credit reports, credit scores and credit report errors.  It might be something for you to consider including on your website to help your members understand how these things affect them.
• There are never enough hours in the day!  With that in mind, NAFCU members should know that our overview of the Regulation Z proposal concerning mortgages, HELOCs and reverse mortgages is available.  (The proposal addresses other things as well.)  These overviews can be a great resource. 

Consumer Compliance Outlook; This and That

Posted by Anthony Demangone

The Fed has released the latest issue of its Consumer Compliance Outlook publication.  I always find the articles to be well-written, and very useful.  Of note in this issue:

• An article on changes to the HUD-1.
• Furnisher requirements under the FACT Act.
• MDIA explanations and examples.
• An index of all of their articles.
• A super useful calendar of upcoming requirements.

Sign up to receive email notifications when new issues are available here. 

***

In other news:

• NCUA charters 2 "bridge" corporate credit unions. 
• NAFCU members: We've issued a "Final Regulation" for NCUA's recent Short Term/Small Amount Loan Regulation.
• The FDIC has issued guidance on the security risks involved with digital images stored on copiers, fax machines, and printers.  You may recall that we wrote about this issue back in August. In short, these machines store digital images of the faxes, copies or items that you print.  When you get rid of the machines, the images go with them unless you have policies and procedures in place to strip the potentially sensitive data.  The security risk increases compliance risks related to Part 748 of NCUA's rules and regulations, not to mention Red Flags. 

 

Federal Reserve Consumer Affairs Letters; San Antonio Reminder

Posted by Anthony Demangone

The Fed does a nice job with its Consumer Affairs Letters.  Consumer Affairs letters address significant policy and procedural matters related to the Federal's consumer compliance supervisory responsibilities. Even though they are not designed for us, they can be very useful.  Case in point:

• The Fed issued this CA letter to address the recent lapse of the National Flood Insurance Plan.  Attached, is a nice guidance document that answers many questions in relation to the Fed's flood insurance regulation.  NCUA has a very, very similar regulation, found in Part 760.  Here's a snippet from the guidance:

Does a lapse in FEMA flood insurance authority mean that loans secured by improved real property located in special flood hazard areas may not be made by lenders?

No, it does not. Lenders are not precluded during a lapse in flood insurance authority from making loans due to a lack of NFIP flood insurance. However, flood insurance is not available under the NFIP during a lapse. During a lapse, a lender may legally make a loan to a borrower secured by improved real property in a SFHA without requiring the borrower to obtain flood insurance coverage. This does not mean, however, that a lender is relieved of other obligations under federal flood insurance law nor does it mean that safety and soundness considerations can be disregarded. Both of these matters are dealt with in more detail below.

As always, read all of the guidance document.  There is a ton of useful information there.

• The Fed also issued this CA letter concerning the submission of consumer credit card agreements, now a requirement (with exceptions) thanks to the Credit CARD Act.
• Finally, there is this CA letter, which addresses interagency exam procedures regarding the FACT Act "Duties of Furnishers of information" requirements.  NCUA issued its own rules, in Part 717 of its rules and regulations.  Attached to the letter is a copy of the exam procedures.  The procedures give background information as well as the questions that examiners will be asking.  Good, good stuff.  

***

Reminder: I want to invite you to attend a free regulatory compliance overview that I’ll be providing during NAFCU’s upcoming Volunteers Conference in San Antonio, Texas.  The session will run from 2:00 p.m. to 4:00 p.m. on Thursday, May 20, 2010 at the Marriott San Antonio Rivercenter.  

I plan to cover a wide range of compliance topics (ramble) during these two hours.  I'm sure I'll hit on overdraft protection, Reg Z, the SAFE Act and more.  I'll probably mention Penn State football and force you to see a few pictures of my kids as well.  Attendees of this session will also obtain 1.75 credit hours for their NCCO designation.

After our compliance session, you are also invited to attend the opening cocktail party at the Volunteers Conference.  The cocktail party is from 4:00 p.m. to 5:00 p.m. at the  Marriott San Antonio Rivercenter and serves as a meet and greet opportunity for folks attending the conference.

There is no registration fee or cost for you to attend this compliance roundup, and it is open to NAFCU members and non-members.   

We do need you to RSVP ASAP so we can make arrangements for meeting space at the hotel.  So please contact NAFCU staffer Olivia Gonzaga, at [email protected] or 703-842-2205, to let us know how many from your credit union will be attending this special compliance roundup.

A Quick Look Toward 2010

Posted by Anthony Demangone

When I was a young lad, I realized that I would graduate from high school in 1990.  1990!  That date seemed like something from a science fiction movie.  Twenty years later, I still get those same feelings each year.  2010?  It can't be.  But it is.  And it will take me about a month to remember to write 2010 on my checks.

With that in mind, here's a quick run-down on things that we should keep in mind this year.

SAFE Act.  If you are a state or federally-chartered credit union, there's still no news here.  NCUA has yet to issue a final rule.  And the deadline for registration is still 180 days after the system starts accepting registrations.

Escrowing.  I'm not even sure if that is a valid verb.  But we'll start doing that for higher-priced mortgage loans this April.  And for manufactured homes, the escrow deadline is in October.

BSA.  The BSA manual will be updated at some point.  I'm not sure when, but it very well may require you to tweak your BSA/AML program. The CARD Act will require Treasury to issue rules to bring stored value cards under the BSA regulatory system.  I expect that rule at some point. 

Reg Z. Ugh.   Where do I begin?  Sure - we have a good grasp on how the open-end changes will wreck our social lives this year.  But don't forget that there the July 1 changes to Reg Z's open end rules that already were to take affect before the CARD Act entered our lives.  Also, there are proposals on HELOCs and closed-end lending that should go final this year.  The private student lending rule takes effect in February.  And the mortgage transfer/sale rule kicks in later this month.  In addition, there are two more Credit CARD Act provisions that will become affective this August.  The Fed will need to issue rules for those this year.

Reg E.  The overdraft rules kick in on July 1, 2010.  We expect additional guidance from the Fed this month on this topic.

FCRA.  Risked-based pricing notice rules kick in on January 1, 2011. But don't forget that another "FACT Act rule" kicks in on July 1, 2010 - the Accuracy and Integrity Guidelines. 

Corporates.  NCUA has a major proposal out there to overhaul the corporate credit union system.  NAFCU members - we urge you to respond to our Regulatory Alert's call for comments on this proposal.

Reg CC.  The Fed has not officially changed the regulation due to the impending death of non-local checks.  But they'll have to do so at some point in 2010.

The Hill.  Reg Reform and overdraft protection issues are addressed in a number of areas. But nothing has passed both houses.  Stay tuned.

So, 2009 was a bear.  I'm not sure what animal 2010 will ultimately be, but it won't be a kitten. 

Compliance Dates Reminder

Posted by Sarah Loats

There's quite a few compliance dates next year and the Federal Reserve sure seems to like July 1, 2010, as there are three fairly major rules effective that day. Let's recap, shall we (the links will take you to NAFCU's Final Regulation summaries):

1. Regulation Z open-end lending rules. Prior to the Credit CARD Act, the Federal Reserve issued final rules to the open-end lending rules. This was a major overhaul of the open-end lending rules, amending the rules for applications and solicitations, initial disclosures, periodic statements, and advertising, among other things.  For the changes that haven't been swallowed up by the Credit CARD Act, the effective date is still July 1, 2010.

2. FACT Act.  By July 1, 2010, credit unions must have in place policies and procedures regarding the accuracy and integrity of information provided to consumer reporting agencies.  This rule also addresses direct disputes from consumers.

3. Regulation E overdraft rules. This rule is probably fresh in your head, but again, the effective date is July 1, 2010.

As if that wasn't enough, we have quite a few more compliance dates coming up next year:

• RESPA - January 1.
• Truth in Savings (disclosures of overdraft fees on periodic statements and disclosure of account balances through automated systems) - January 1.
• Private Student Lending - February 14.  .
• Credit CARD Act - February 22.
• Reg GG - June 1.
• More Credit CARD Act (gift cards, reasonableness and proportionality of fees, reevaluation of credit card rate increases) - August 22.
• HELOC and closed-end mortgages amendments to Reg Z and SAFE Act registration requirements- who knows??? 

Maybe it's time to look into that year-long sabattical...

Compliance Round-up

Posted by Anthony Demangone

It may be shocking to some, but not all compliance issues touch upon the Credit CARD Act!  With that in mind, here are some things that have been kicking around my inbox that I wanted to share.

Red Flags.  The FTC has delayed enforcement of the Identity Theft Red Flags Rule, again.  This time until November 1.  The delay will give state-chartered credit unions additional time to comply.  Federal credit unions?  No such luck.  Our compliance deadline was, and still is, November 1, 2008.

NCUA Prohibition Orders.  NCUA has issued its most recent bunch of prohibition orders.  These orders effectively ban individuals who allegedly did bad things from working in our industry.  They can be useful training tools to remind folks that the danger of embezzlement always is with us.

Another Reg Z change.  On Friday, the Fed published final rules to implement portions of the Higher Education Opportunity Act.  The compliance date will be 6 months after the final rule is published in the Federal Register, which should be shortly.  For those who do not want to page through the 234 page rule, here's a link to a Fed Press Release that gives a very high-level overview. 

Check processing changes.  For those involved with Regulation CC and check holds, you've notice a ton of check processing restructuring at the Fed.  Here's a Fed document that updates recent changes and gives a view to the future. 

Foreclosures and tenants.  The FDIC issued a consumer affairs letter to remind banks of a new law that protects tenants from eviction due to foreclosures.  If your credit union does real estate lending, I'd give this a read. 

Red Flags FAQ; Pandemic

A bunch of regulators, including NCUA, recently issued a frequently asked questions document to provide guidance on the recent Red Flags Identity Theft Prevention rules.  Access it here.  I just love FAQs.  I do.  They are written in English.  They address real-world problems that have surfaced since the rule was released.  I just love, love love them.  Here's a taste of what you'll find inside:

1. Do the Red Flags Rules, Card Issuers’ Rules, or Address Discrepancy Rules contain record retention requirements?

These three Rules do not contain specific record retention requirements. However, financial institutions and creditors must be able to demonstrate that they have complied with the requirements of the Red Flags and Card Issuers’ Rules, and users of consumer reports must be able to demonstrate that they have complied with the requirements of the Address Discrepancy Rules, in addition to any other applicable record retention requirements.

8. Are credit union service organizations (CUSOs) covered by the Red Flags Rules and Guidelines?

CUSOs, according to the Federal Credit Union Act, provide “services which are associated with the routine operations of credit unions” and are “established primarily to serve the needs of its member credit unions, and whose business relates to the daily operations of the credit unions they serve.” 12 U.S.C. §§ 1757(5)(D), (7)(I). A CUSO that is a “creditor” under the FCRA is covered by the Red Flags Rules and Guidelines issued by the FTC.

***

The WHO has officially declared a pandemic.  What does this mean for compliance?  The WHO lists the risk of a pandemic with phases, numbered one through six.  We're now at WHO pandemic phase six.  Some credit unions use the WHO stages to trigger different parts of their pandemic plan.  You may want to check your pandemic plan to see what phase 6 triggers.

Credit Cards Bill and UDAP; Corporates; NCUA Board Meeting; Softball

Posted by Anthony Demangone

Here's one interesting angle of the credit card bill that I overlooked.  While the provisions within the bill are very similar to UDAP, the reach of the bill is effectively larger.  Remember, NCUA's UDAP rule only applies to federal credit unions.  The FTC could write UDAP rules, but their rule-making process is much, much slower than NCUA's or the Federal Reserve's.  The credit card bill, on the other hand,  will apply to all issuers of credit cards once signed.  And NCUA will have enforcement authority for both state and federal credit unions for its requirements.

***

Each corporate credit union is required to provide a summary of its annual audit reports to its members at its annual meeting.  NCUA has loosened that requirement in light of the current situation.  NCUA has indicated that it will not take exception to a corporate credit union not providing that summary if the audit has not been completed before the meeting.  Corporates should indicate the reason for the delay and and inform members that a copy will be provided when available.  Since members of corporates are natural person members - this will affect you.

***

NCUA held its monthly board meeting yesterday. 

• Here's a link to the results, which include the items considered by the board.
• Here's NCUA's presser on the meeting.

In the meeting, NCUA approved one of the remaining FACT Act regulations still in limbo.  (Can you believe that regulators have been issuing regs on these for 5 years now?). 

NCUA Board approved a final rule implementing the accuracy and integrity and the direct dispute provisions of the FACT Act.  The final rule requires furnishers, including credit unions, to establish reasonable policies and procedures for implementing the guidelines found within the new reg.  It also states when a furnisher must reinvestigate disputes about the accuracy of information contained in a consumer report based on a direct request from a consumer (the direct dispute regulations).

The accuracy and integrity regulations also contain definitions of key terms such as “accuracy,” “integrity,” “direct dispute” and “furnisher” and require furnishers to establish and implement reasonable written policies and procedures regarding the accuracy and integrity of consumer information provided to a CRA.   Also included are guidelines concerning the accuracy and integrity of information furnished to CRAs that furnishers must consider in developing their policies and procedures. 

The final direct dispute regulations: 

• set forth the circumstances under which a furnisher must reinvestigate a consumer’s direct disputes
• provide exceptions to those requirements
• detail the direct dispute address and dispute notice content requirements
• specify furnishers’ duties after receiving a direct dispute; and
• establish when a furnisher may deem a direct dispute to be frivolous or irrelevant.

Effective date: July 1, 2010.  NCUA looked at other issues during the meeting, so I'd check out their presser, which is linked above.

***

Updated by Steve Van Beek

Head, shoulders, knees and toes - knees and toes.  No, not the song - those are just the body parts that hurt this morning.  NAFCU softball had another split doubleheader last night.  The NAFCU Nationals won the first game with a score of 7-4 which included a defensive stand to preserve the game.  In the second game, NAFCU got down 11-3 early but clawed its way back to have the tying run on first base before falling in defeat 14-11.  After an 0-2 start to the season, NAFCU has split games the past three weeks putting our record at 3-5.  Stay tuned as we hunt down that .500 mark...

Another great team effort, including the Compliance Guy's first appearance (which include two line drive singles and an amazing play at first base to preserve the lead).  Thanks for letting him play Mandy!  Can you tell Anthony is my boss?

***

Have a great long weekend, everyone.  Until Tuesday, stay compliant.

Affiliate Marketing; NAFCU Softball

Posted by Sarah Loats

The NCUA, along with the federal banking agencies, issued technical amendments to the Affiliate Marketing rule. According to the summary, the technical amendments correct minor errors and omissions but do not change any substantive requirements:

"The technical corrections included in this Federal Register document revise one of the affiliate marketing model forms and the instructions to the model forms to correct inadvertent omissions and conform the model forms and the instructions to the affiliate marketing rules, and correct minor errors in the identity theft red flags and address discrepancy rules and guidelines. The substantive requirements of the affiliate marketing and the identity theft red flags and address discrepancy rules are unchanged."

***

NAFCU softball found itself in familiar territory last night - a split of a doubleheader.  The first game was a 13-2 NAFCU victory spurred on by a nine run 3rd inning.  However, the second game result in a 8-5 defeat despite a late rally from NAFCU.  The current record stands at 2-4. 

Game ball goes to Corey Davis of Member Services - two big hits in the first game to seal the victory. 

A Little Red Flags Help; Attention BSA E-Filers

Posted by Anthony Demangone.

The FTC has created a webpage and host of resources to help entities comply with the Red Flags rule.  My inner voice keeps whispering into my ear the following:

This would have been nice to have last year.

But beggars taxpayers can't be choosers.   So here's a link to the FTC resource.    If you are in charge of your Red Flags program, this resource might be something to scan.  And it is written in a very rare language for regulators: English.

***

BSA E-Filers, lend me your ears.  FinCEN gives you this important reminder.  In short, FinCEN is moving into Phase 2 of its BSA E-Filing Batch Validation process at the end of July.  They intentionally allowed some errors to slip through during Phase I, but starting on July 31, 2009, they will get out their "reject" stamp for certain errors.  If you use the system, I would give the guidance a read. 

FACTA AIRES Questionnaires; Reg Z Reg Alert; 12-month Exam Cycle?

On Friday, NCUA released a letter to credit union (08-CU-24) to notify credit unions of two new AIRES questionnaires regarding FACTA compliance.

• Here's a link to the letter.

• Here's a link to the first attachment, which is an AIRES questionnaire on Red Flags Identity Theft.

• Here's the second attachment, which is an AIRES questionnaire for consumer report address discrepancy procedures and for the proper record disposal procedures.

As FCUs are now complying with these requirements, these questionnaires and the letter are must reads.

***

NCUA issued Regulatory Alert 08-RA-06, which details recent changes to Regulation Z.  If you do mortgage lending, read it.

Amendments to the Home Mortgage Provisions of Regulation Z (Truth in Lending). The Federal Reserve Board recently approved a final rule for home mortgage loans to better protect consumers and facilitate responsible lending. The rule prohibits unfair, abusive or deceptive home mortgage lending practices and restricts certain other mortgage practices. The final rule also establishes advertising standards and requires certain mortgage disclosures be given to consumers earlier in the mortgage lending process. These rules apply to all credit unions providing mortgage loans to their members.

***

Last week, NCUA Chairman Michael Fryzel announced plans to increase NCUA's budget to hire additional examiners and senior executives.  One thing this would accomplish would allow NCUA to transition to a 12-month examination cycle.  Read the Chairman's statement about the initiative here.