NAFCU Compliance Blog

"Consumer Compliance Outlook—Fintech, Alternate Data, and Fair Lending Risks"

Written by André B. Cotten, Regulatory  Compliance Counsel

Consumer Compliance Outlook. The Second 2017 Issue of the Philadelphia Federal Reserve's Consumer Compliance Outlook is now available. This issue continued to expound on the rise of financial innovation and provided an overview of key federal regulations for servicemember financial protection.

My colleagues and I have previously written about the growing role of fintech and the data sharing consumer protection principles. Today's blog post will explore potential fair lending risks with the use of big data and the rise of fintech.

The article discussed how fintech has already produced real benefits to consumers, including increased speed, convenience, and new product offerings that make it easier for consumers to manage their financial lives. Fintech also offers the possibility of bringing banking and financial products to underserved communities and the underbanked.

With that being said, many firms are exploring ways to leverage new data and analytic techniques to extend credit to more consumers. The CFPB has noted that approximately 26 million Americans are credit invisible, which means that they do not have a credit record and another 19.4 million do not have sufficient recent credit data to generate a credit score.

The Federal Reserve's Article is intended to offer some general guideposts for evaluating UDAAP and fair lending risks related to fintech, with a focus on alternative data. Note, fair lending and UDAAP are broad areas of the law where sound legal analysis depends on the specific facts and circumstances.

Background

The Equal Credit Opportunity Act (ECOA) and the Fair Housing Act (FHA) are the two key federal fair lending laws. These fair lending laws broadly prohibit two kinds of discrimination: disparate treatment and disparate impact. In some instances, both theories may apply. Disparate treatment occurs when a lender treats a consumer different because of a protected characteristic (i.e. race, color, religion, national origin, sex, marital status, age).

Disparate impact occurs when a lender's policy or practice has a disproportionately negative impact on a prohibited basis, even though the lender may have no intent to discriminate and the practice appears neutral. A policy or practice that has a disparate impact may violate the law, unless the policy or practice meets a legitimate business necessity that cannot reasonably be achieved by a means that has less impact on protected classes.  

Moreover, Section 5 of the Federal Trade Commission Act prohibits unfair or deceptive acts or practice. The Dodd-Frank Act prohibits unfair, deceptive, or abusive acts or practices. Many states also have town on UDAAP laws. Deception in the financial services industry often involves misrepresenting the terms or costs of financial services products.

Questions to Consider When Thinking about Fintech and Alternative Data

The Consumer Compliance Outlook considers that many firms and financial institutions are exploring new data sources and analytical techniques. The Federal Reserve warns financial institutions to conduct a thorough analysis to ensure compliance with consumer protection laws prior to implementing new data and modeling methods. The article provides a series of questions to help financial institutions determine whether they are appropriately using alternative data. The questions are grouped into two broad categories: basis for considering the data; how the data is being used.

What is the Basis for Considering the Data?

Question #1: Is there a nexus to creditworthiness?

Generally, the more speculative the nexus with creditworthiness, the higher the fair lending risk. In addition to accuracy and reliability, it is important to consider whether the data is representative of all consumers or only a subset.

Question #2: Will the predictive relationship be ephemeral or stable over time?

Financial institutions may want to consider whether the predictive potential of the data is likely to be stable over time or ephemeral. For example, if a model uses online data from social media sites, such as Yelp or Facebook, what happens to the reliability of that data as consumers' online habits evolve?

How are You Using the Data?

Question #3: Are you using the data for the purpose which they have been validated?

The Federal Reserve advises that it is important to ask if the data has been validated and tested for the specific uses. For example, if a financial institution validates a data field for marketing, it does not mean this same data is appropriate to use for underwriting or pricing.

Question #4: Do consumers know how you are using the data?

Consumers generally understand how their financial behavior affects their traditional credit scores. However,  alternative credit scoring methods could raise questions of fairness and transparency.

The ECOA and the FCRA require financial institutions who deny credit to provide consumers with adverse action notices specifying the top factors used to make that decision. The FCRA also requires that consumers receive risk-based pricing notices, if they are provided credit on worse terms than others.

With that being said, it is important that fintech firms, and any banks with which they partner, ensure that the information conveyed in adverse action notices and risk-based pricing notices complies with the legal requirements for these notices.

Certain behavioral data may raise particular concerns about fairness and transparency. UDAAP issues could also arise if a firm misrepresents how consumer data will be used.

Question #5: Are you using data about consumers to determine what content they are shown?

Technology can make it easier to use data to target marketing and advertising to consumers most likely to be interested in specific products, but doing so may amplify redlining and steering risks.

The Federal Reserve stated that the core concern is that, rather than increasing access to credit, these sophisticated marketing efforts could exacerbate existing inequities in access to financial services. Thus, these efforts should be carefully reviewed.

Question #5: Which consumers are evaluated with the data?

Are algorithms using nontraditional data applied to all consumers or only those who lack conventional credit histories? Applying alternative algorithms only to those consumers who would otherwise be denied based on traditional criteria could help ensure that the algorithms expand access to credit.

In closing, the Consumer Compliance Outlook states that fintech can bring great benefits to consumers by enhancing speed, convenience and access to credit. However, fintech is not immune to the consumer protection risks that exist in brick-and-mortar financial institutions. The Federal Reserve encourages financial institutions to ensure that fintech trends and products promote a fair and transparent financial marketplace and that the potential fintech benefits are realized and shared by as many consumers as possible.

***

Programming Note. NAFCU's offices will be closed Friday, December 22^nd and Monday, December 25^th in observance of the Christmas holiday. We wish you all a safe and wonderful holiday. We'll be open on Tuesday, December 26th and back to blogging on Wednesday, December 27^th.  Happy Holidays!

Reg E Error Resolution for POS Disputes and Unjust Enrichment; Blockchain Resources

By Stephanie Lyon, Regulatory Compliance Counsel

Talk about Black Friday, the perfect opportunity for fraudsters to go holiday shopping with your member's debit cards, online or in store. The holiday season truly is a fantastic time to review key provisions of the error resolution process of Regulation E. So let's dig in!

The basic concept of the error resolution process is that members will notify their credit union when they notice an unauthorized EFT from their account. See, 12 C.F.R. § 1005.11(b). The credit union will receive the information needed to investigate the claim and resolve the issue within a specified time period. While the credit union investigates the error, the member will be provided with provisional funds to minimize disruptions to the member's life.  See, 12 C.F.R. § 1005.11(c)(2)(i). Finally, the credit union will notify the member of the resolution and make the provisional credit final or revoke the credit if no error occurred. Sounds simple enough, right?

Wrong. Regulation E is deceptively simple, but it is full of compliance pitfalls and stumbling blocks. We have already addressed a couple of these issues in prior blogs here and here. Today's blog focuses on point-of-sale (POS) dispute timelines and what to do if you finalized the provisional credit and new information shows the member was already refunded by the merchant or the transaction was not unauthorized.

The normal timeline to resolve a Reg E error is within 10 business days of when the member notifies the credit union of an unauthorized transfer from their account. See, 12 C.F.R. § 1005.11(c)(1). Some credit unions pride themselves in providing extreme member service and correcting most errors within this timeline and to save themselves the hassle of providing provisional credit. While admirable and very member-friendly, this also means the credit union will have to mad-rush to investigate the dispute, contact merchants, compare signatures, pull video from the security cameras (if any) and come to a conclusion. Whew! I am exhausted just thinking about the process. In POS dispute cases, 10 days is simply not enough to even get a return call from merchants, let alone any documentation of the transaction.

To remedy this, the regulation permits the investigation period to be extended up to 90 days for point-of-sale (POS) debit card transactions such as swiping your debit card at any store in the mall. See, 12 C.F.R. § 1005.11(c)(3)(ii). To take advantage of the extended timeline, the credit union must: (1) provisionally credit members for the amount of the alleged error as long as the member notifies the credit union in writing; (2) notify the member within 2 business days of the amount and date the provisional credit was given; and (3) give the member full use of the provisional credit while the investigation is pending.

Taking the time to investigate a POS dispute is essential as lately, credit unions are noticing that merchants are refunding members after the credit union has already resolved the error and finalized provisional credit. Basically, the member is getting back their money twice. As awesome as it is to get a windfall, it is simply not right. So credit unions want to know whether they can remove funds from a member's account if the member had been made whole by the merchant or if the credit union uncovers convincing evidence that the transaction was not unauthorized.

The answer to this question is not found in the regulation—of course. That would make it way too easy on the NAFCU compliance team that takes these questions as a white elephant gift from the regulators. Regulation E explicitly states that credit unions can reverse provisional credit if there was no error or a different error occurred. See, 12 C.F.R. § 1005.11(d). Nothing in the regulation states that credit unions can take back final credit if it later discovers that no error or a different error occurred. If this seems inherently unfair, you are not alone. There is an entire contract law concept called unjust enrichment that has been around long before any of us or our predecessors were thinking about compliance. The just of this notion is that someone received a benefit they were not entitled to at the expense of someone else. Unfortunately, to pursue an unjust enrichment claim, the credit union would have to file a civil suit against the member who received the windfall. A less expensive option may be to politely ask the member to reimburse the credit union if the merchant credited the member or if the member later admits to having made the transaction. But an even better option is probably to take the full 90 days to investigate the dispute and ensure the credit union is monitoring the member's account during that time.

Regardless of the option, this is an area where the regulation is not entirely clear on when or whether a credit union has the ability to revoke final credit if the member is unjustly enriched. Interestingly enough, the remittance transfer rule that makes up sections 1005.30 to 1005.36 of Regulation E, has a provision regarding these types of unjust enrichment cases that should be added to the EFT error resolution part of the regulation. Here is a relevant excerpt from the official interpretation to section 1005.33(f):

…In addition, nothing in this section prevents an account-holding institution or creditor from reversing amounts it has previously credited to correct an error if a sender receives more than one credit to correct the same error. For example, assume that a sender concurrently asserts an error with his or her account-holding institution and remittance transfer provider for the same error, and the sender receives credit from the account-holding institution for the error within 45 days of the notice of error. If the remittance transfer provider subsequently provides a credit of the same amount to the sender for the same error, the account-holding institution may reverse the amounts it had previously credited to the consumer's account, even after the 45-day error resolution period under §1005.11.

12 C.F.R. § 1005, Supp I, 1005.33(f)—1 (emphasis added). I am just going to put it out there, adding this to the official interpretation of section 1005.11(d) would be a pretty fantastic present for all compliance officers.

***

Blockchain Resources

NAFCU Regulatory Affairs Counsel Andrew Morris recently wrote an article for our Cyber Café edition of the Compliance Monitor (log-in required). To continue to assist credit unions interested in staying ahead of the curve he teamed up with NAFCU Special Counsel Pamela Yu, to produce a webpage that describes how blockchain technology impacts credit union regulations from BSA to Mortgage Servicing. This resource is available to all and can be accessed here.

Consumer Compliance Outlook—Financial Innovation Technology: Fintech; NCUA Issues Supervisory Priorities

Written by André B. Cotten, Regulatory Compliance Counsel

Consumer Compliance Outlook. The Third 2016 Issue of the Philadelphia Federal Reserve’s Consumer Compliance Outlook is now available. This issue’s articles focus on the rise of financial innovation in the financial services industry. This issue’s articles include the following:

• Perspectives on Fintech: A Conversation with Governor Lael Brainard
• Fintech: Balancing the Promise and Risks of Innovation
• Fintech for the Consumer Market: An Overview
• Fintech Resources: Laws, Regulations, and Supervisory Guidance

The article on fintech discussed how consumers, especially Millennials, are accustomed to having a wide range of applications and information immediately accessible to them. The emergence of financial innovation applications has transformed consumer expectations around financial products, services and delivery. As a result, brick and mortar financial institutions, including credit unions, are feeling the increased pressure to update and diversify the way they deliver services and products to remain competitive.

Fintech is composed of a variety of different sectors. The article by Tim Marder on page 4 of this issue provides an overview of four fintech market segments: credit; digital payments; savings, investments and personal financial management; and distributed ledger technology. Note, the aforementioned segments do not encompass the entire fintech ecosystem, but they are more likely to impact current credit union products, services and delivery methods.

However, fintech products and services are not seen solely as market disrupters. Some financial institutions have focused on partnerships, collaboration, and other relationships with financial technology firms. Financial innovation has introduced advanced technology, new uses of data and created changes in customer preferences and expectations.

Although, many segments of fintech are still in the early phases, the article explains that fintech credit providers or alternative lenders have enjoyed a range of collaboration with bank partners. While credit unions have lending limitations banks do not, some examples of this innovative partnership include banks providing funding through loan purchases, credit extensions, and equity investments. Financial institutions also originate loans on behalf of alternative lenders, use technology developed by alternative lenders to originate loans themselves, and direct customers to alternative lenders in exchange for marketing and referral fees. Other banks have provided workspace, seed funding, mentoring, training, and other related support to fintech startups. Some financial institutions have even shown some interest in acquiring alternative lenders.

Another notable change sparked by financial technology innovation is the way people pay merchants and transfer money, digital payments. Smart phones are also equipped with digital wallets that store credit card, debit card, and other financial information, thus further eliminating the need for cash and checks. The growing use of fintech applications has enabled an increasing number of small businesses to accept credit cards as a payment option. Beyond payments, some fintech applications have allowed people to more easily to transfer money to other people by simply using the recipient’s email address or phone number.

The financial regulators are taking a measured approach to assess the impact of supervision on financial innovation. The Federal Reserve notes the two questions the Board is most often asked about fintech. First, “what is meant by the term fintech?” Secondly, “what is the Federal Reserve doing to understand the impact of these new technologies?”  

The Consumer Financial Protection Bureau also created Project Catalyst to facilitate consumer-friendly innovation; it includes a “No-Action Letters” policy, finalized on February 18, 2016, to reduce regulatory uncertainty for a new product or service that offers the potential for significant consumer-friendly innovation.

Last October, the Office of the Comptroller of the Currency released a white paper titled Recommendations and Decisions for Implementing a Responsible Innovation Framework. Last month, Comptroller of the Currency Thomas J. Curry announced during a speech that the OCC is developing special purpose national bank charters for fintech firms.

According to Governor Lael Brainard, generally, regulators should seek to tailor regulatory and supervisory expectations to facilitate financial technology growth that produces benefits to the financial marketplace. At the same time, any contemplated adjustments must also manage corresponding risks. The goal is to ensure financial products are fair and transparent so that consumers can make informed choices.

The Consumer Compliance Outlook also lists certain federal laws and implementing regulations for financial services and products that may be relevant to fintech firms and their depository institution partners. The authors note that this is not an exhaustive list, and the applicability of each law depends on the specific circumstances. State laws and regulations, including usury limits may also apply to fintech services and products.

Given some of the lessons from the financial crisis, the article stressed the importance that financial institutions and fintech firms consider the long-term sustainability of the products and services they offer. Fintech firms can establish sound practices by articulating a clear risk tolerance and managing risk. The Federal Reserve intends to maintain an active dialogue with market participants to continue ensuring the safety and soundness of the nation’s financial system.

In a related note, the Office of the Comptroller of the Currency (OCC) announced that it was considering a possible charter for fintech firms, seeking public comment on the concept. Today, NAFCU will file comments, noting in part that if the OCC does move forward with such charters, regulators should require fintech firms to meet basic consumer protection requirements, such as the Truth in Lending Act and applicable usury laws, just as credit unions must do now

***

Programming Note: The NAFCU office will close early today, Friday, January 13^th at 2:00pm, and the office will be closed on Monday, January 16, 2017 in observance of Martin Luther King, Jr. Day.

***

NCUA Issues Supervisory Priorities Letter. Yesterday afternoon, NCUA issued its annual Supervisory Priorities in Letter to Credit Unions 17-CU-01. As no surprise to anyone, cybersecurity and BSA compliance remain on NCUA’s radar. Other priorities include internal controls for fraud, commercial lending, interest rate and liquidity risk, and compliance with the Military Lending Act and Servicemembers Civil Relief Act.