NAFCU Compliance Blog

Chexsystems; Red Flags; Shameless Plug

Everyone has their address discrepancy program put in place pursuant to the Red Flags rule.  When you receive a consumer report from a consumer reporting agency and there's an address discrepancy, you take certain steps as outlined in the rule.  But are reports from Chexystems included?

It doesn't appear so.

The address discrepancy procedures outlined in address discrepancy rule apply to national consumer reporting agencies, as they are defined in section 603(p) of the FCRA.  If you review the examiner guidance issued on the address discrepancy rule, it lays this out more clearly than in the final regulation.  Chexystems is a nationwide specialty CRA as defined in section 603(w) of the FCRA.  So they do not fit within the definition of the rule.

The devil, as they say, is in the details.

***

For those of you who need all the Red Flags help you can get, check out this Red Flags treasure trove from Bankers Online. 

***

SHAMELESS PLUG ALERT!  Next Wednesday, NAFCU will host a BSA training program (via webcast) designed for your general staff.  This program is designed for the employee who needs annual refresher training or for someone who needs an introduction to BSA Land.  Yours truly will provide the live training.  It should be fun.  My goal is to work the following words or phrases into the session: Boo-yah, Paterno, Phillies, gorilla, and shuffleboard.  We also have a CD for purchase that is designed for your volunteers who need BSA training.  Read all about it here.

***

Have a great weekend everyone.  (Especially you Texas Tech and Arkansas State fans!)

Red Flags Extension? Nyet; Check 21, via GAO

NCUA has confirmed for us that FCU's will not get a Red Flags compliance extension.  So, why did the FTC grants its extension? According to the Privacy Law Blog, the FTC made the decision to extend due to mass confusion.  Here's a snippet from the post:

The rules apply to financial institutions and creditors.  But, according to the FTC, many companies “indicated that they were not aware that they were engaged in activities that would cause them to fall under the FACT Act’s definition of creditor or financial institution.”  Moreover, the FTC said that companies not traditionally subject to the jurisdiction of the FTC did not follow the FTC’s rulemaking, and consequently did not become aware of their obligations under the Red Flag Rules until very recently.  The FTC also expressed concern that covered entities, to meet the fast approaching November 1 deadline, were not taking the appropriate care necessary to do a proper risk assessment and craft a meaningful red flags program.

Ignorance, once again, is bliss.

***    

The GAO recently released a paper that does a nice job of detailing Check 21 and its progress.  This report indicates that most consumers have accepted the technology and also that financial institutions are marching along toward implementation.

If nothing else, read the executive summary that starts on page 2 for a nice progress report.  If you have a coworker or boss that might like an update, the exec summary may be a nice thing to forward.

FTC Delays Red Flags Enforcement for 6-months; Letter to NCUA

Yesterday, the Federal Trade Commission (FTC) announced it is granting a six (6) month delay of enforcement on Red Flags compliance for its regulated entities.  The FTC's jurisdiction for Red Flags enforcement is quite large.  It covers finance companies, automobile dealers, mortgage brokers, utilities companies, telecommunications companies, and other entities who regularly extend credit to consumers.  The FTC included this language in its explanation for the extension:

"The Commission staff launched outreach efforts last year to explain the Rule to the many different types of entities that are covered by the Rule. The agency published a general alert on what the Rule requires, and, in particular, an explanation of what types of entities are covered by the Rule – http://www.ftc.gov/bcp/edu/pubs/business/alerts/alt050.shtm. During the course of these efforts, Commission staff learned that some industries and entities within the FTC’s jurisdiction were uncertain about their coverage under the Rule. These entities indicated that they were not aware that they were engaged in activities that would cause them to fall under the FACT Act’s definition of creditor or financial institution. Many entities also noted that, because they generally are not required to comply with FTC rules in other contexts, they had not followed or even been aware of the rulemaking, and therefore learned of the Rule’s requirements too late to be able to come into compliance by November 1, 2008. The Commission’s delay of enforcement will enable these entities sufficient time to establish and implement appropriate identity theft prevention programs, in compliance with the Rule."

The FTC's jurisdiction also covers state-chartered credit unions for Red Flags enforcement.  Thus, state-chartered credit unions' deadline for compliance with the Red Flags has been extended to May 1, 2009.  

***

For federally-chartered credit unions, the FTC's extension does not provide relief.  NCUA has Red Flags enforcement authority for federal credit unions.  The compliance deadline is still November 1, 2008.  NAFCU has drafted a letter to NCUA seeking parity with state-chartered credit unions on this issue. 

Also, the FTC's delay does not provide relief to banks and thrifts regulated by the Office of Comptroller of the Currency (OCC) or the Office of Thrift Supervision (OTS).  Unless the OCC and/or OTS extends their compliance deadlines banks would be subject to the November 1, 2008 deadline.  

Editor's note: NCUA reportedly has no plans to extend the deadline for FCUs. (As of 10/24/08).

Red Flag Guidelines Released!; Off to SF

Late Friday, the Fed released the interagency guidelines for the Identity Theft Red Flags and other regulations issued pursuant to the FCRA.  You can access the Fed's Supervisory Letter, which has links to the exam procedures, here.  I would expect NCUA to quickly push this out, but I figure that many of you would want this sooner rather than later.

There is a separate exam guideline for each component (Red Flags, Address Discrepancy, and Change of Address).  The exam guidelines are not all that daunting.  The Red Flags module is five pages long, and the exam procedures take up just two of those pages.  But there is great information in there.  For example...

Do you have to update your Red Flags ID Theft risk assessment each year?  No.  Just update it periodically, as needed.

***

The Compliance Guy is off to San Francisco for our annual Regulatory Compliance Seminar.  During the week, many, if not all, NAFCU compliance attorneys will be at the conference.  If you need to reach us (NAFCU members), your best bet is to email us at [email protected].  But please realize that response times may be a bit delayed.  If you couldn't join us, think about next year, as Seminar will be held in Charleston, South Carolina.

Eligibility Information and Member Lists

Is a credit union’s member list considered eligibility information under the affiliate marketing rule? This question has been asked a few times, and it seems we have an answer.

I recently attended the American Bar Association (ABA) conference in New York and when I wasn’t attending the credit union meetings, I found a couple of CLE programs, one of which I found rather useful. It was entitled Can Privacy and Marketing Coexist? Don’t Ask, Don’t Sell. The program entailed a panel of 4 attorneys – two from law firms, one from the OCC, and one from the FTC – who discussed the privacy-oriented rules, including affiliate marketing, and their interplay with marketing efforts. I’m not going to go through the entire two-hour program here but I thought I’d highlight the eligibility information discussion since the question has been asked of the compliance team a few times.

Here goes the analysis:

The rule defines “eligibility information” as any information the communication of which would be a consumer report if exclusions from the definition of “consumer report” in section 603(d)(2)(A) of the Fair Credit Reporting Act did not apply. So the rule applies to transaction and experience information as well as consumer report information.

However, it should not entail contact information alone. Pure contact information does not contain any consumer report information. Now, if one could glean consumer report information from the contact list, then it would eligibility information. For instance, a list of your members that have account balances over a certain amount would be eligibility information. But, a list of all of your members would not be (although it is non-public personal information under the Privacy rule).

-Sarah Loats
Regulatory Compliance Counsel

Red Flags

On Monday, OTS held a conference call for its thrifts to go over agency expectations regarding Red Flags.  Here is a link to their powerpoint presentations that they used during the conference call.   From the sound of it, the interagency examination procedures are right around the corner.  In fact, the OTS indicated that the conference call was based on those procedures.  So stay tuned.

There was one piece of information that caught my attention.  Everyone focuses on the Red Flags compliance deadline of November 1.  But think about this: compliance for Red Flags involves a board approved policy.  OTS indicated that its examiners will be looking for evidence that its regulated entities approved their Red Flags programs during their October board meetings

Food for thought. 

Red Flags; And the winner is.....

I've been getting a lot of calls about Red Flags lately.  Folks want to know if there are any templates out there or any good guidance.  Well, here're (is that a word?) my thoughts:

1. Beware of templates for your Red Flags policy.  This is a risk based policy that will be driven by your own experiences, products, services, members, policies and procedures. 
2. There is help on the way.  We've heard that regulators (NCUA included) are working on a piece of supervisory guidance that will shed more light on agency expectations. It could be out in a month or so.  But the regulators have more work to do on it before it can be unleashed. 

I'll be sure to alert everyone when the guidance comes out.

***

We've come to a decision regarding the NAFCU Flower Garden Contest.  We have a tie!  Joleen of Forest Kraft FCU and Pat of Seattle take home the honors.  Each will get some sort of tacky NAFCU-related prize.  (I'll have to see what Marketing has in their closet!)  Many thanks to everyone who took part!

Have a great weekend, everyone!

Marketing Opt-Out?; NAFCU Swept

NCUA's privacy regulation and the ever-approaching affiliate marketing rules raise an interesting issue for credit unions.  I call it the consumer opt out confusion issue.  Under both regulatory structures, credit unions might have to offer members the right to opt out of certain information sharing practices. 

Where does the confusion come in?  The opt-outs noted above are very limited in scope.  One limits the ability of a credit union to share information with third parties, and the other limits the ability of credit unions to share/use information with affiliates for marketing purposes.  There are a number of exceptions to these opt-outs; some are large enough to drive a truck through.  For credit unions that do or will offer opt-outs, I wonder whether members understand what they are really opting out from. (Yes, I know that sentence ended in a preposition.  What was I thinking of?)  My guess is that many members do not.  They may view these opt outs as a way to "unsubscribe" from marketing campaigns.  At the very least, members that select an opt-out are raising their hand to let you know how much they value their personal information and privacy. 

With that in mind, I spoke with a credit union today that gives their members the right to a "marketing opt-out."  These members have the right to exclude themselves from all credit union marketing campaigns.  (Interestingly, this credit union currently does not need to offer their members an opt-out under the privacy rules and does not plan on offering an affiliate information opt-out.)  I asked how it worked, and the compliance officer said that it seemed to keep a very specific segment of their membership happy.  "And happy members deposit more," she added.

The affiliate marketing rule contains a model disclosure (in Appendix C) along these lines.  Here's what it says:

C–5—Model Form for Voluntary ‘‘No  Marketing’’ Notice—Your Choice To Stop Marketing
• [Name of Affiliate] is providing this notice.
• You may choose to stop all marketing from us and our affiliates. To stop all marketing, contact us [include
all that apply]:
• By telephone: 1–877–###–####
• On the Web: www.---.com
• By mail: Check the box and complete the form below, and send the form to:
[Company name]
[Company address]
____ Do not market to me.

While there's no requirement to offer such an opt out, I think it is a good way to manage member expectations and manage your reputation risk.  Do any of you offer this marketing opt-out?  How is it working?  (To add a comment if you received this posting via email, you'll need to click on the title above, scroll to the bottom of the posting, and then...well, follow directions.)

***

Last Thursday, NAFCU's softball squad (4-8) was pummelled by the undefeated Llamas.  I'm not even going to share the scores.  Let's put it this way, one at bat by our opponents lasted 45 minutes.  No joke.  If it weren't for the fence, some of their hits would still be rolling.  Now, I'm not saying that the Llamas were using ringers, but 4 of their women hit from the left side and looked like they were employed as college softball hitting coaches.  Not that I'm bitter about it.

OFAC Decision Tree; Risk-Based Pricing Notice; Thank you

When a credit union gets an "OFAC hit," the following question quickly surfaces: Now what??!!

OFAC, in its frequently asked questions section, explains what you should do to determine if you have a valid "OFAC Match."  You can access it here.  The guidance does a good job of methodically laying out what you should do, step-by-step.  Access other OFAC postings here.

News flash: Yesterday the Federal Reserve and the FTC issued the long-awaited proposal concerning risk-based pricing notices.  You can access a press release (which will give you access to the proposal) here.  Once it is published in the Federal Register, we'll have 90 days to comment.   I haven't had a chance to read through it. In fact, as I type this, I'm waiting for She Who Must Be Obeyed to finish packing before we head down to Syria, Virginia for our wedding!

***

Tomorrow is the big day, when I marry the love of my life.  Thanks to all of you who have wished me well and offered kind words of advice and congratulations.  The best part of my job is my interaction with all of you.  Again, thank you.  (And thank you for putting up with all of my wedding-related rants and ravings!)

Have a wonderful weekend, everyone!

The Reasons Why; NCUA Fraud Alert Issued; Affiliate Marketing

Six times a year, NAFCU publishes "The Federal Credit Union."  Each issue contains a compliance-related column.  The most recent installment is "The Reasons Why."  I designed it as a tool for my fellow tellers and members service reps.  (That's where I started in credit union land.) The column supplies regulatory answers to some common member complaints.  NAFCU members can access it here.  NAFCU members: if you'd like a pretty .pdf of the article, please email us at [email protected].

For you non-NAFCUers, Here's a snippet:

The situation: A member writes a check on Jan. 1, 2008 , but dates the check  March 1, 2008. The payee deposits the check right away, and your credit union clears the check against your member’s account. The member is quite upset and demands an explanation.

The explanation. The Uniform Commercial Code allows credit unions and banks to pay postdated checks, as long as a member has not given the credit union notice of the postdating. In addition, the member must give the notice “at such time and in such a manner” that gives a credit union a reasonable opportunity to act on the item. If the member provides such a notice, it is effective for the same amount of time as a stop payment. The rationale is clear. When a member postdates a check, it is an agreement between the member and the payee. As credit unions clear millions of checks each year, it is unreasonable to expect them to look for postdated checks unless the member brings it to their attention beforehand. If the member asks where he can read this, point him to UCC § 4-401(c).

The column addresses seven other situations.  Enjoy.

***

NCUA recently issued a Fraud Alert to warn credit unions about a HELOC-related scam.  The scam involves fraudulent wire transfers involving home equity lines of credit, and it has occurred at several financial institutions, including credit unions.  Read the NAFCU Today article about it here.  A few members indicated that they've had a hard time locating the alert.  Ask and you shall receive.  Access the actual Fraud Alert here.

***

NAFCU has asked the NCUA Board to extend the compliance deadline for the fair-credit affiliate marketing rule until April 1, 2009.  We've spoken with quite a few members who have highlighted the numerous operational challenges involved in complying with the rule.  Read about the extension request here.   We're holding a webcast this Wednesday to address affiliate marketing.  You can read more about the webcast here.

Shameless Plug: NAFCU to offer Webcast on Affiliate Marketing

NAFCU will host a webcast on Wednesday, February 6, 2008 that will address affiliate marketing.  It will take place from 2 to 3:30 p.m., Eastern Time. 

Yours truly will make the presentation.  It will try to address every aspect of the affiliate marketing rule.

• Who is covered?
• What information is covered?
• What marketing actions are prohibited?
• What disclosures do we have to make, and who must make them?
• How does it interact with NCUA's privacy rule?
• Are there any exceptions?

You can go here for more information, and to download a registration form.

January 2008 NAFCU Compliance Newsletter Available Online

NAFCU members: The January 2008 Regulatory Compliance Newsletter is available online.  Members may access it here.  This month's newsletter focuses on the FACT Act Affiliate Marketing final rule.  Several questions and answers focus on the new rule, and we've also prepared a more-detailed article and compliance flow chart to help you.  You can access the additional materials via the link above.

For you non-NAFCU'ers, here's a little taste.

Question: In the Affiliate Marketing final rule, §717.20(b)(4)(ii)(D) allows solicitation for 3 months if a consumer applies for a product or service from a credit union but doesn’t obtain it. Could we interpret this to mean that if someone applies for membership and does not follow through with completing all the necessary paperwork, we could market to them for three months using the information that they have provided?

Answer: Since the credit union received the information directly from the consumer rather than from an affiliate, the use of that information would not be governed by this rule. When deciding whether this rule applies, determine if the information came from an affiliate. If it did not, this rule does not apply.

Happy New Year; Buckle Up

Happy New Year, everyone.  2008?  That seems like a date out of a Buck Rogers comic book. (OK, I may have dated myself.)

Compliance officers, buckle up.  Let's see what we have on tap for this year:

• Red Flags implementation
• Affiliate marketing implementation
• Regulation Z open-end final rule (likely)
• RESPA reform (we expect a proposal in January or February)
• HOEPA final rule (likely)
• Mortgage reform (who knows how this will finally shake out?)

And I'm sure that more will come down the pike.  There's never a dull day in Complianceville, eh?

Good FCRA Tool; New Blog Tools

The FTC recently "updated" its website.  Now the Compliance Guy can't find anything on it!  But I searched for this gem, and after 15 minutes, I located it.

This webpage contains a list of FTC legal opinion letters that interpret the Fair Credit Reporting Act.  The letters are organized by the section of the FCRA that they address.  Good stuff, people.  Good stuff.

***

I've added two new tools to this blog.  First, you can request a compliance blog email update!  On the left, you'll see a link titled "Subscribe to NAFCU Compliance Blog by Email."  Click on that link, and follow its directions.  When I post something, you'll get it emailed to you.  Assuming your spam filter likes me.

Also, you now have the ability to email a particular post to anyone you like.  Or don't like.  I thought that you may have coworkers who could benefit from a particular post.  Just click on the "email this" link at the bottom of any post, and...follow the directions.

The FACT Act Strikes Again; The Diet

NCUA, along with other financial regulators, have issued proposed regulations to "help ensure the accuracy and integrity of information provided to consumer reporting agencies and to allow consumers to directly dispute inaccuracies with financial institutions and other entities that furnish information to consumer reporting agencies."

Read the NAFCU Today article about the proposal here.  Read NCUA's press release here.  Find the proposed regulations here.  The proposal has not appeared in the Federal Register yet.

***

NAFCU members:  NAFCU has posted its Final Regulation on NCUA's Purchase, Sale and Pledge of Eligible Obligations.  NAFCU members can access it here.

***

The Compliance Guy hates dieting.  Especially over Thanksgiving.  And his birthday.  And that's all I'm going to say about that.

Current Weigh Loss:  4 pounds. 
Needs to Lose: 66.
Days until Wedding: 162.
Current Estimated Odds of Success:  99 to 1

Tick, Tock; NAFCU Final Regulations on New FACT Act Rules

Here's a reminder from the Compliance Guy.  Last November, NCUA revised the “official sign” that "promotes" a credit union’s insured status. There were two deadlines found within the final rule. By now, your credit union has placed the new official sign at teller stations and other required locations. (We hope.)  But beware of the second deadline!

Please remember that federally-insured credit unions must replace the old official sign with the revised one by November 23, 2007 on every document that includes the official sign, such as advertisements, promotional materials, and disclosures.  For more details, read NAFCU’s Final Regulation 06-EF-17, which is available here. (NAFCU members only.)  For you non-NAFCUers, you can find the final rule here.  (Scroll down, and look for Part 740.)

***

Thanks to NAFCU's Regulatory Affairs gang who just published "Final Regulations" that provide detailed overviews of the Affiliate Marketing and Identify Theft Red Flags Rules.   NAFCU members can access them here.

Odds and Ends, and Electronic Alphabet Soup

Late last week, the Federal Reserve announced final rules to amend Regs B, E, M, Z and DD.  The amendments address the delivery of electronic disclosures.   Here's the Fed's press release, which includes links to each final rule.  Remember, NCUA has to ensure that our Truth in Savings rule closely mimics their Reg DD, so expect changes in the not too distant future. 

While amendments to all these regs may seem dauting, it really is a good thing.  For example, the changes generally will allow credit unions to give electronic disclosures to members who access applications or advertisements electronically.  Mandatory compliance with this regs will be October 1, 2008.  

***

NAFCU members, the following is for you.

• The November BSA Blast is available here.   (NAFCU member log in needed.)
• NAFCU's Regulatory Affairs Department has updated a very useful tool.  Especially those who lose track of which FACT Act provisions are on the books and which are not.  Access a handy-dandy chart on this page (Scroll to bottom.)

NCUA Board Meeting

NCUA issued three final rules during its  meeting yesterday.

1. Incorporation of NCUA's Bylaws into NCUA regulations;
2. The FACT Act's Identity Theft Red Flags and Address Discrepancies Final Rule; and
3. The FACT Act's Affiliate Marketing Rule

Here's a nice, short synopsis of the Board's actions.  NAFCU is working on Regulatory Finals for these rules.  We'll have those available for our members in a few weeks.  (Note, we generally wait for final rules to be published in the Federal Register before issuing alerts, and we expect publication in the Federal Register in a week to 10 days.)

***

With all of these final rules, the Compliance Guy thought that he'd talk about the beauty of the "preamble."  When an agency issues a proposed or final regulation, they do more than just issue the new regulatory text.  They give a summary, background information, and lengthy discussions about their proposal or final rule.  While it may be tempting to skip to the end of a final rule to read the new regulatory language, there are countless gems to be found in the text of the stuff I mentioned above.  (Which I call the preamble.)  Happy reading!

***

Have a great weekend.  If he can get his chores done, the Compliance Guy will be watching this and this.  Be safe.

NCUA Board Meeting Agenda Set; FACT Act Rules on Tap

As expected, NCUA looks ready to pass two new FACT Act final rules.  Here's the agenda for the 10/25/2007 NCUA Board meeting.  NCUA also will be looking at a final rule that would incorporate NCUA's Bylaws into its regulations.  The Compliance Guy tip of the day?  Draft items for the Board's review are available after 9 a.m. on the day of Board meetings here. (The items currently on this page remain from last month's meeting.)

***

NAFCU's Regulatory Compliance Seminar is wrapping up today.  Around 170 compliance professionals took part, enjoying Austin, Texas, eating some Tex-Mex and expanding their knowledge.  The Compliance Guy learned a bunch and invites all of you to think about attending next year's seminar in San Francisco, California.  Have a great weekend, everyone.

FACT Act Final Rules Issued

Leave it to the FDIC to break big news for credit unions!  Yesterday, the FDIC approved two final rules that implement portions of the FACT Act - Affiliate Marketing and the "Red Flag" Guidelines and Change of Address Rules.  The rules are not available from NCUA yet, but the FDIC draft federal register notices both include NCUA's name.  Therefore, it is expected that the other financial regulators will follow suit in the near future.

Here's a link to the FDIC web page that includes links to the final rules.  (Scroll down to the Discussion Agenda section.)  The Affiliate Marketing Rule carries a mandatory compliance date of October 1, 2008.  The  Red Flags Guidelines and  Change of Address Rules?  November 1, 2008.  NAFCU is working on Regulatory Finals that will provide a detailed overview of the final rules.   Stay tuned.

***

Yesterday, NCUA issued prohibition orders against four individuals that prohibit them from participating in the affairs of any federally-insured financial institutions.  In other words, they shouldn't get hired by your credit union.  In other words, you may want to pass this link along to your HR department. 

***

Yesterday, the Compliance Guy kicked back and absorbed a bunch of ACH-related compliance information at NAFCU's Track II  Compliance Program.  Experts from NACHA and SWACHA spent the day drilling useful information into eager minds.  Of note:

• NCUA examiners have been alerted to the requirement regarding the RDFI's responsibility to perform an annual audit.  They very well may ask to see a copy.
• One of the more common mistakes by RFDIs involves failing to use the proper code to contest a dishonored return.   Should staff treat a dishonored return as just another ACH entry, vital rights may be lost.  While dishonored returns can be contested, failure to use the right codes can be costly.