NAFCU Compliance Blog

NCUA Issues Temporary Exemption on Appraisals for Disaster Zones

By Reginald Watson, Regulatory Compliance Counsel

Greetings compliance friends! In the wake of excessive flooding brought about by the many recent tragic hurricanes, NCUA together with several other agencies have granted temporary exceptions to the current appraisal requirements in major disaster zones. Since we've received quite a few questions on this, I figured it would be a good opportunity to review the NCUA appraisal requirements and un-package this temporary exemption.

NCUA's appraisal requirements depend on the loan value and its terms. NCUA’s Rules and Regulations do not require a formal appraisal if the transaction is 250k or less. Generally, any loan with a transactional value of $25,500 or less requires only a “written valuation” that meets FIRREA requirements. A loan with a transactional value between $25,501 and $250,000 only requires a formal appraisal if it is a "higher-priced" mortgage loan; and all loans of $250,001 or more require an appraisal.

For transactions requiring an appraisal, the central requirement is that the appraisal must be "performed by a state certified or licensed appraiser." For transactions requiring a written valuation, it must "be performed by an individual having no direct or indirect interest in the property, and qualified and experienced to perform such estimates of value for the type and amount of credit being considered."  12 C.F.R. §722.3(d). The minimum requirements for written estimates of market value are addressed in Appendix B of the Interagency Appraisal and Evaluation Guidelines.

In addition to the transaction threshold issue, §722.3 outlines the other exceptions to the general requirement to seek an appraisal, including situations in which:

• A lien has been taken out on the property as collateral only through an abundance of caution, and the transaction terms are no more favorable than they would have been in the absence of a lien;
• A lien has been taken out on the property for purposes other than the real estate's value;
• A lease of real estate is entered into, unless the lease is the economic equivalent of a purchase or sale of the leased real estate;
• The transaction involves an existing extension of credit at the lending credit union provided that there is no advancement of new monies and no obvious or material changes to market conditions;
• The transaction involves the purchase, sale, investment in, exchange of, or extension of credit secured by, a loan or interest in a loan, pooled loans, or interests in real property, including mortgage-backed securities;
• The transaction is wholly or partially insured or guaranteed by a United States government agency or United States government sponsored agency;
• The transaction either: 
  • Qualifies for sale to a United States government agency or United States government sponsored agency; or
  • Involves a residential real estate transaction in which the appraisal conforms to the Federal National Mortgage Association or Federal Home Loan Mortgage Corporation appraisal standards applicable to that category of real estate; or
• The regional director has granted a waiver from the appraisal requirement for a category of loans meeting the definition of a member business loan.

Appendix A to the Interagency Appraisal and Evaluation Guidelines, provides additional guidance on these exemptions and describes how institutions can comply with Title XI of the Financial Institutions Reform, Recovery, and Enforcement Act of 1989 (FIRREA).The guidance was joined by NCUA, and was attached to Letter to Credit Unions 2010-23.

Higher Priced Mortgages

As referenced in §722.3(f), if a loan is a second mortgage that is closed-end consumer credit secured by the consumer’s principal dwelling and qualifies as a higher-priced mortgage loan (HPML), it may require an appraisal under Regulation Z. §1026.35(c). An HPML is a closed-end secured residential loan "with an annual percentage rate that exceeds the average prime offer rate for a comparable transaction by a certain number of percentage points. §1026.35(c)(2) also provides an appraisal threshold exemption which is currently $25,500, along with additional exemptions to the appraisal rule for HPMLs. The threshold is set to increase to $26,000 on January 1, 2018. The CFPB official commentary discusses all these exemptions in further detail and emphasizes that although these types of transactions may be exempt from the CFPB's appraisal rule, the requirements under FIRREA and §722.3 still apply. Thus, an appraisal would be required for HPMLs between $25,500 and $250,000, and a written valuation conforming to the Interagency Appraisal and Evaluation Guidelines would be required for loans that do not require an appraisal under NCUA. An additional written appraisal for HPMLs may be required for recently acquired properties subject to certain conditions found in §1026.35(c)(4).

In summary, it appears any loan with a transactional value of $25,500 or less requires only a written valuation that conforms to Appendix B of the interagency guidance. A loan with a transactional value between $25,500 and $250,000 only requires a formal appraisal if it is a HPML. All loans carrying a value of $250,001 or more require an appraisal.

Loans in Disaster Areas

On October 16, 2017, NCUA, together with several other agencies, released a Letter to Credit Unions (17-CU-06) granting a temporary exemption to the FIRREA appraisal requirements in major disaster areas, as defined by the President. The exemption provides flexibility to credit unions with loans secured by real estate and located in the affected areas, including parts of Florida, Georgia, Puerto Rico, Texas, and the U.S. Virgin Islands. The exemptions will remain in effect for a three-year period from the date of the declaration.

The order specifically requires that the property involved was located within the major disaster area, there is a binding commitment to fund the transaction, the value of the real property supports the institution's decision to enter into the transaction, and the transaction must continue to be subject to review by management in the course of examinations of the institution.

This waiver is an attempt to ensure that any shortage of appraisers would not further delay the recovery process for these regions. We at NAFCU have been saddened to see the extent of the damage and loss of life and have compiled a list of resources to help credit unions in these disaster areas. Our thoughts and prayers go out to all those who have been affected.

NCUA Reverses Position on "Individual Policy" Requirements for Fidelity Bonds

Written by Pamela Yu, Special Counsel for Compliance and Research

NCUA's Office of General Counsel (OGC) recently issued its third formal legal opinion of 2017.  Dated September 26, 2017, the opinion letter concludes that the "individual policy" requirement in NCUA's fidelity bond rule does not prohibit a credit union from purchasing a fidelity bond that covers both the credit union and its credit union service organization (CUSO), provided the credit union owns at least 50 percent of the CUSO or the CUSO qualifies as a "nominee," as defined in the letter.  See, NCUA Legal Opinion 17-0959. 

Notably, the opinion represents a reversal from OGC's previous interpretations of the rule.  Opinion 17-0959 supersedes two previous legal opinions on this topic issued in 2004 and 2014, respectively. See, NCUA Legal Opinions 04-0744 and 14-0311.

Background

The Federal Credit Union Act (FCU Act) directs NCUA to require fidelity bond coverage for credit union employees who handle funds or collateral.  See, 12 U.S.C. §1766(h).  Part 713 of NCUA's regulations, which implements that provision, describes the fidelity bond and insurance coverage required for federal credit unions (the provision is also applicable to federally insured state-chartered credit unions by §741.221). 

The fidelity bond rule requires, among other things, that a bond (at a minimum) must be purchased in "an individual policy."  See, 12 C.F.R. §713.3(a).  According to NCUA, the "individual policy" requirement was added to the rule in 1999 to address specific concerns raised during the public comment period about jointly purchased fidelity bonds:

"[One] commenter was concerned that in [joint fidelity bond policies] a loss suffered by one or two of the joint policy holders could reduce the amount of coverage available for the other joint policy holders below the required minimum amount, i.e. two losses equal to the single loss limit of liability would exhaust the coverage available for all credit unions to zero even though some of these credit unions would not have suffered a loss. This commenter also noted a concern with the joint purchase of fidelity bond policies even when the policy purchased does not have an aggregate limit of liability. While it is true that a loss suffered by one credit union would not reduce the amount of coverage available to the other credit unions purchasing the policy, this commenter suggested that, when several credit unions purchase a policy in a group, they may not give adequate attention to providing for the specific risks faced by individual credit unions. Compromises might be made in coverage amounts that would not be made if the policy were purchased individually.  In addition, this commenter argued that the joint policy holders might not adjust coverages in a timely manner because of the difficulty of doing so in a group purchasing scenario." See, 64 Fed. Reg. 28718, 28719 (May 27, 1999).   

Based on these and other concerns, the NCUA Board clarified the rule to provide that a fidelity bond must be individually purchased by each credit union, but it did not define "individual policy."

Previous Opinions

In 2004, OGC was asked if a CUSO that provided management services for several credit unions could purchase a single fidelity bond with all its credit unions named as insureds. In opinion 04-0744, the office found that the joint bond was not permissible under §713.3(a), noting that "the principal reason for not permitting a credit union’s bond to cover additional insureds is to ensure that the coverage of the other insureds does not conflict with or in any way dilute the individual credit union’s required coverage."

In 2014, the office was asked to consider whether a credit union could include one or more CUSOs as additional insureds under its fidelity bond.  Again, OGC opined that a federally insured credit union is required to obtain fidelity bond coverage under an individual policy, and could not include one or more CUSOs or other parties as additional insureds under its fidelity bond.  See, NCUA Legal Opinion 14-0311. Citing the 2004 opinion and its rationale, OGC further noted that the requirement "prevents a claim against one insured from depleting coverage limits for the credit union."

Reversal

In a departure from its position since 1999, OGC has now changed its opinion of the permissibility of certain joint coverage fidelity bond provisions.  The reversal was precipitated by the office's recent review of bond forms approved by NCUA pursuant to §713.3(b), and the realization that several already-approved bond forms included joint coverage provisions.  For example, some of the approved forms, which NCUA approved before the 1999 rule change, included nominee provisions, joint insureds provisions, and definitions of "insured" that include subsidiaries that are more than 50 percent owned by the insured.  Given the "inconsistency between NCUA's approvals and [OGC's] legal opinions," the office now says that the "individual policy" requirement does not prohibit a credit union from covering its majority owned CUSO under its fidelity bond.   A CUSO may also be covered if it otherwise qualifies as a nominee.  However, joint coverage of non-majority-owned CUSOs or other entities continues to be impermissible.  See, NCUA Legal Opinion 17-0959. 

This change in position may lead to formal amendments or other revisions to the fidelity bond rule.  The opinion notes that NCUA recently published a proposed regulatory reform agenda, which includes a recommendation to consider revisions to Part 713.  See, 82 Fed. Reg. 39702, 39707 (Aug. 21, 2017).

***

Programming Note. NAFCU's offices will close at noon today and also be closed on Thursday and Friday in observance of Thanksgiving. We wish you all a safe and wonderful holiday. We'll be open and back to blogging on Monday.  Happy Thanksgiving!

NCUA Streamlines, Improves Appeals Process

Written by Shari R. Pogach, Regulatory Paralegal

During its October meeting, a new final rule was adopted by the National Credit Union Administration (NCUA) Board to streamline and establish uniform procedures in cases in which a decision by a regional director or other program office director is appealed to the NCUA Board.  Effective January 1, 2018, the new procedures will apply to agency regulations with currently embedded appeals provisions. 

Most authorized appeals to the NCUA Board will be governed by the new 12 CFR part 746, Subpart B. The regulations under which a credit union can appeal initial agency determinations include:

• 701 – Organization and Operation of Federal Credit Unions,
• 703 – Investment and Deposit Activities,
• 705 – Community Development Revolving Loan Fund Access for Credit Unions,
• 708a – Bank Conversions and Mergers,
• 709 – Involuntary Liquidation of Federal Credit Unions and Adjudication of Creditor Claims Involving Federally Insured Credit Unions in Liquidation,
• 741 – Requirements for Insurance,
• 745, Subpart B – Share Insurance and Appendix,
• 747 – Administrative Actions, Adjudicative Hearings, Rules of Practice and Procedure, and Investigations,
• 750 – Golden Parachutes, and
• FCU Act – Chartering and Field of Membership Determinations.

There are, however, five areas that are excluded from the scope of this new rule:  Enforcement Actions; Creditor claims in liquidation that are litigated or reviewed by the Board under formal agency adjudication procedures; Material Supervisory Determinations; Prompt Corrective Action; and Other Exclusions including appeals of adverse determinations under Freedom of Information Act (FOIA), requests made under NCUA's Touhy regulation, appeals of initial determinations made under the Privacy Act and consumer complaints to the agency.  NAFCU members can get more details on the exclusions and procedures outlined in the final rule in Final Regulation 17-EF-12 (your member login is needed).

NCUA's stated intent with this new rule is to provide "credit unions, and other persons or entities that are affected by agency decisions, with an opportunity to obtain meaningful review of those decisions. The Board believes this final rule strikes an appropriate balance that will afford a petitioner fair consideration of the issues while avoiding procedures that are overly burdensome, time consuming, and expensive."

Did you know that NAFCU has an Exam Fairness Guide that's available to members and to nonmembers on our website?  We are all aware that examinations can have a significant impact on a credit union.  This guide takes you through exam basics such as the goals of an NCUA exam, risk-focused versus defined-scope exams, frequency of exams and extended exam cycles. It also has helpful tips for navigating exam challenges, the appeals process and achieving fair exam outcomes.  The current guide reflects the appeals process as it stands today but will be updated in 2018 to reflect the new appeals process procedures.

"Friday Fun: Regulatory Requirements for Online Account Openings"

Written by: Andre' B. Cotten, Regulatory Compliance Counsel

Greetings, Compliance Friends! Opening accounts online is a major convenience for members. However, for compliance officers, the online account opening process is riddled with potential pitfalls. For example, when and how does the credit union provide the account opening disclosures. Today's blog is meant to be a high-level review of some of the relevant requirements credit unions may want to consider when establishing online account opening policies and procedures.

Bank Secrecy Act

From a BSA standpoint, opening accounts online can represent risks related to a credit union's Customer Identification Program (CIP) and Know Your Customer requirements. Generally, a credit union's CIP program is based on its own risk assessment and not prescriptive requirements. Although, from a CIP perspective, members opening accounts online is generally considered higher risk. From NAFCU's understanding, many financial institutions utilize complex vendor software in order to ensure the CIP requirements are met when individuals seek to open accounts online.

The FFIEC BSA/AML exam manual discusses "non documentary" methods of verifying identity that may also be helpful to the credit union. Note, the BSA requires that the credit union know the member's identity with reasonable certainty and have the member's name, address, date of birth and identification number so that guides what needs to be verified.

NCUA

However, a consumer must fall within the field of membership before they can be admitted as a member in the credit union. This determination will depend on the credit union's statement of its field of membership, the clause of the statement relied on by the potential member, and the credit union's policies and procedures.

Note, Article II, Section 2 of NCUA's FCU Bylaws requires a member to sign an application for membership. The credit union might verify this language in its own bylaws, and if it does appear, consider electronic signatures under the E-SIGN Act or whether it will require a member to come in and provide a wet signature for the signature card and to establish insurance under Part 745.

As an additional reference, NCUA Opinion Letter 2004-0543 discusses electronic signatures in the membership context.

E-SIGN

The E-Sign Act requires credit unions to receive the member's affirmative consent to receive electronic records. See, 15 U.S.C. § 7001(c). . As an industry standard, it seems many credit unions require members to comply with the E-SIGN consent and procedures when registered for online banking to give legal effect to the disclosures transmitted to the members  through the online banking platform.

For more information, NCUA issued a Risk Alert soon after the E-SIGN Act became effective in March 2001. Here is an additional link for your reference: Consumer Compliance Outlook 4Q Article on ESIGN .

Regulation E

The determination whether a credit union is required to provide additional disclosures when a member establishes an account online depends on what other types of products or services the member is requesting. For example, if the member requests a debit card to execute electronic fund transfers, then the credit union would need to comply with Regulation E.

Regulation E requires initial disclosures be provided "at the time a consumer contracts for an electronic fund transfer service or before the electronic fund transfer is made involving the consumer's account." Below are some Regulation E links of interest:

• Section 1005.4 contains general disclosure requirements and references providing disclosures electronically (E-SIGN)
• Section 1005.7 contains requirements for initial account disclosures
• Supplement I to Part 1005 contains commentary to both sections that clarify requirements
• Appendix A contains Model Forms for Regulation E – Model Form A-2 applies to initial account disclosures

Truth in Savings

NCUA's Truth in Savings Rule has a similar requirement that specifies that credit union must provide account opening disclosures before the account is opened or a service is provide din connection with the account. See, 12 C.F.R. § 707.4(a)(1)(ii).

Here are some Truth in Savings links of interest:

• Section 707.4 contains the requirements for delivery or initial account disclosures
• Section 707.3 describes how disclosures can be provided electronically (i.e., following E-SIGN) and the relationship to Regulation E
• Appendix C contains commentary to both sections that clarify requirements
• Appendix B contains Model Forms for TIS – Model Form B-1 applies to initial account disclosures

Privacy

Under the GLBA, Initial Privacy Notices and Opt-Out Notices can be provided electronically. The notieces can be delivered pursuant to the E-SIGN Act, or  in certain circumstances, the notices can be delivered when the consumer is conducting transactions electronically. Under section 1016.9(b)(1)(iii), it is considered valid delivery to post the privacy notice on a website and require the consumer to acknowledge receipt of the notice as a necessary step to obtaining a particular financial product or service.

Another privacy consideration for online banking is the Children’s Online Privacy Protection Act (COPPA). COPPA imposes certain requirements on operators of websites or online services directed to children. Credit unions are subject to COPPA if they operate a website or online service directed to children, or have actual knowledge that they are collecting or maintaining personal information from a child online. Making COPPA determinations generally requires an analysis of the specific facts and circumstances surrounding a credit union’s online activities against the requirements of COPPA. Thus, a credit union may want to work with local counsel to see if COPPA applies. The FTC’s website has an excellent overview of COPPA.

State Law

Lastly, there may be state law considerations. An online banking agreement establishes contractual obligations between the credit union and the member. The credit union may consider consulting with local counsel to develop a comprehensive agreement that includes, but is not limited to: balance and transaction information; password creation and maintenance; access authorization; and technical assistance.

Additional Resources

Below are a few resources on authentication, cybersecurity, and other issues related to online banking:

• NCUA Official Sign is required on a webpage where a credit union accepts deposits or opens accounts under section 740.4(a). Downloadable graphics of the sign are available here.
• Regulation CC requires the credit union to provide disclosures relating to funds availability “before opening a new account,” under section 229.17.
• NCUA Letter to Credit Unions 2011-CU-09 discusses Online Member Authentication Guidance
• FFIEC IT Booklets provides guidance on cybersecurity considerations.

CFPB Issues Supervisory Guidance for HMDA; MLA FAQ – MAPR on Periodic Statements

Written by Brandy Bruyere, Vice President of Regulatory Compliance

In the past, when leading up to a substantial compliance deadline, the CFPB has issued guidance indicating that in the early stages of implementation, the Bureau will look for "good faith efforts" to comply. We saw this with TRID in 2015 and with the Dodd-Frank mortgage servicing rules in 2014. We received questions from credit unions regarding whether a similar approach might be taken for HMDA. It turns out, the CFPB has stated this will be its exam approach for HMDA, but the information is buried in a recent edition of the Bureau's Supervisory Highlights. Here is an excerpt from page 41:

As noted above, the 2015 Final [HMDA] Rule’s new data requirements will apply to data collected beginning on January 1, 2018. Given the recent updates to the rule, the Bureau’s current principal focus is on providing regulatory implementation support to financial institutions, to assist them in operationally implementing the recent changes to the HMDA requirements. After the rule takes effect, consistent with our approach to the implementation of other Bureau rules requiring significant systems and operational changes, our approach will generally be diagnostic and corrective, not punitive. In our initial examinations for compliance with the rule, we intend to consider whether companies have made good faith efforts to come into compliance with the rule in a timely manner. Specifically, we will be evaluating a company’s overall efforts to come into compliance, including assessing the compliance management system and conducting transaction testing. If errors are identified, we will work with the institution to determine the root cause of the issue and determine what corrective actions, if any, are necessary. (Emphasis added.)

What about NCUA? In the past, the agency has adopted a similar approach to examinations as the CFPB, such as this Supervisory Letter issued to examiners on the Dodd-Frank mortgage rules back in January 2014. Last week, NAFCU asked NCUA to once again take a similar position as the CFPB and look for credit unions' good faith efforts to comply with the new HMDA provisions in the early phases of implementation. We will keep credit unions posted on the issue.

Meanwhile, as we mentioned last week, the beta version of the CFPB's HMDA Platform is now available for testing. Those responsible for the credit union's HMDA data may want to start testing the platform as the beta version will be removed when the 2017 HMDA filing period opens on January 1, 2018. Issues with the beta version can be reported directly to the CFPB at [email protected] (although the Bureau reminds users not to include personal information in these inquiries).

***

MLA FAQ – MAPR on Periodic Statements

Many credit unions have asked us whether it is required to indicate a covered borrower's Military Annual Percentage Rate (MAPR) on disclosures including periodic statements. The MLA does not require numeric disclosure of the MAPR and in fact, in the preamble to the rule, the Department of Defense indicated that providing both the Regulation Z APR and the MLA MAPR may be confusing to borrowers:

The Department believes that, in light of section 987(i)(4) (“ ‘annual percentage rate’ has the same meaning as in section 107 of [TILA], as implemented by the [Bureau]”), section 987(c)(1)(A) of the MLA (“A statement of the annual percentage rate of interest”) should be interpreted so as not to require a creditor to calculate and disclose to a covered borrower a definitive figure for the “annual percentage rate” of interest applicable to the consumer credit that could include additional charges that must be counted as “interest,” and thereby would be materially different from the figure the creditor is required (under section 987(c)(1)(B) of the MLA) to compute and disclose under TILA. Instead, the Department believes that the appropriate approach to interpret the tension between sections 987(i)(4), 987(c)(1)(A), and 987(c)(1)(B) is to subject a creditor to one set of requirements for calculating and disclosing the costs of the extension of credit, namely, the requirements under TILA. One clear and beneficial consequence of interpreting these ambiguous provisions of the MLA under this approach is that a creditor is not required to provide to a covered borrower two different numerical disclosures, which inevitably would lead to confusion. (Emphasis added.)

While the MLA does require a boilerplate disclosure explaining the MAPR, the rule does not require a numeric disclosure of the MAPR.

***

Palate Cleanser - Trick or Treat

This year, Nolan was a dragon for Halloween which was a far cry from his first Halloween, where he was 3 weeks old so we put silver fabric over his swaddle and stuck a famous burrito company's logo on his chest. Lemmy's not big on costumes, although he really wanted to steal candy. Alas, he was unsuccessful.

CFPB Issues Consumer Protection Principles on Data Sharing

Written by Jennifer Aguilar, Regulatory Compliance Counsel

In the wake of the Equifax breach, data security has been on everyone's mind. Various stakeholders have come together to see that the industry is held responsible – everything from punishing the guilty to establishing nationwide data security standards is being suggested. With most of the conversation focused on what industry can do to improve the situation, the CFPB has come forward with a consumer-focused approach to data security and sharing. Last month, the CFPB issued its Consumer Protection Principles: Consumer-Authorized Financial Data Sharing and Aggregation.

The CFPB recognizes the importance of financial institutions and the vital role third party financial service providers have in the market. Those companies that use financial data to provide consumers with financial management tools, account verification, fraud prevention and other servicers need access to information in order to provide these services. The CFPB stresses that companies need to keep their consumers in mind when designing their information sharing policies. "Consumer interests must be the priority" and "a common understanding of consumer interests is essential so that effective consumer protections can be integrated consistently into [the] market." The Principles are intended to provide that common understanding and provide a frameworks for protecting consumer interests as data is shared between market participants.

The nine principles are:

1. Access: Consumers should have access to information about how they are using financial services and products. Financial institutions, or other service providers, should provide the information requested in a timely manner. Account agreements, or other user terms, should promote access to information.
2. Data Scope and Usability: Information that consumers have access to should include transaction data or other usage data; account terms, such as fee schedules; costs, such as interest paid; and benefits, such as interest earned. Information should be provided in a readily usable format.
3. Control and Informed Consent: Consumers should control their information. Financial institutions, or other service providers, should fully disclose, in an understandable manner, account terms relating to the access, use, storage, and disposal of information. Consumers must give prior consent before third parties may access their information and consent may be revoked at any time. Revocations should be implemented in a timely manner and include deleting information when the consumer makes such a request.
4. Authorizing Payments: Authorization to access information is not authorization to initiate payments. Financial institutions, or other service providers, should obtain separate authorizations for these two activities.
5. Security: All information should be accessed, used, stored, and distributed in a secure manner that mitigates the risk of data breaches, transmission errors, unauthorized use and fraud. Security procedures should be updated frequently.
6. Access Transparency: Consumers should be informed of each third party that has access to their information, what information that party has access to, and how that information is used.
7. Accuracy: All information should be accurate and consumers should always have a means to dispute and resolve inaccurate information.
8. Ability to Dispute and Resolve Unauthorized Access: Dispute resolution procedures should cover instances of unauthorized access, sharing or payment as well as failures to comply with the terms of a consumer's authorization. These procedures should be reasonable and practical and should not require consumers to identify the parties at fault. Parties at fault should be held accountable.
9. Efficient and Effective Accountability Mechanisms: All parties involved – those that use, share, store, or dispose of information – should have similar goals and work together to enable secure transmission of information and deter misuse. Each party should be held accountable for failure to do so.

While these Principles provide a framework for financial institutions and third party service providers to follow, it is important to keep in mind that they are not binding. The Principles are also not meant to replace or interpret any current regulations on data security. Rather, these Principles may assist credit unions in making decisions on how to use and share information. These Principles can also assist credit unions in determining a course of action in dealing with its members or other financial institutions in the event the regulations do not directly address their situation.

The FTC has also put together a few resources on data security that credit unions may find helpful: Start with Security: A Guide for Business and Protecting Personal Information: A Guide for Business. Again, these are not binding, but they do provide some key principles that credit unions may want to consider when assessing their data security programs.

Closed for the Holidays!

HomeClosed for the Holidays!

Written by Reginald Watson, Regulatory Compliance Counsel

Season's Greetings compliance friends! With the upcoming holiday season around the corner, I thought it would be a good idea to review Reg CC's funds availability rules when credit unions close their offices in observance of federal holidays.

Reg CC governs the availability of members' funds that are deposited into transaction accounts. The rule generally requires that cash and certain check deposits be made "available for withdrawal not later than the business day after the banking day on which the funds are deposited." 12 C.F.R. §229.10(a, c). For local check deposits, §229.12(b) requires that funds be made "available for withdrawal not later than the second business day following the banking day on which funds are deposited." Now, it is important to keep in mind the difference between a business day and a banking day. A business day is considered to be any calendar weekday that is not a federal holiday. A banking day on the other hand is any business day on which a credit union is open and able to carry on substantially all of its banking functions. See, 12 C.F.R. §229.2(f). This seems simple enough to understand during the regular course of business, but what happens when a federal holiday falls on a weekend, or the credit union decides to close the Friday after Thanksgiving? How can the credit union be required to make funds available for onsite ATM or overnight lockbox deposits when closed for the holidays?

To start, this only impacts a handful of holidays. Some federal holidays are always on a Monday, such as Labor Day or Memorial Day, and Thanksgiving is always on a Thursday. But for federal holidays with specific dates, such as Veteran's Day, Christmas Day, New Year’s Day, and Independence Day, some years the holiday will fall on a weekend and be officially observed on either the previous Friday, or the following Monday. The federal government seems to recognize Sunday holidays on the following Monday and Saturday holidays on the previous Friday. For example, this month's Veteran's Day (November 11, 2017) will be recognized on Friday, November 10, 2017, granting us an extra day to take advantage of the sales!

Now, ATM and overnight deposits present some challenges when customers expect their deposited funds to be available for withdrawal on days that are not usually considered holidays. The first step to navigating Reg CC's funds availability rules is figuring out when funds are considered deposited. In §229.19(a), the Federal Reserve has determined that funds deposited at a staffed facility or on-site ATM are considered deposited on the day the deposit is given or placed in the ATM. Funds deposited at an overnight depository, lockbox or an off-site ATM are considered deposited on the day the funds are removed and made available for processing by the bank. 12 C.F.R. §229.19(a)(1-4). Regarding federal holidays and other bank closures, the regulation goes on to state that:

"(5) Funds may be considered deposited on the next banking day, in the case of funds that are deposited—

(i) On a day that is not a banking day for the depositary bank; or

(ii) After a cut-off hour set by the depositary bank for the receipt of deposits of 2:00 p.m. or later, or, for the receipt of deposits at ATMs, contractual branches, or off-premise facilities, of 12:00 noon or later. Different cut-off hours later than these times may be established for the receipt of different types of deposits, or receipt of deposits at different locations." See, 12 C.F.R. §229.19(a)

Accordingly, the fact that the credit union is substantially closed for business pushes the calendar forward on when the credit union will be required to make funds available for withdrawal by one banking day. Funds deposited on a day that is not a banking day (i.e. Federal holidays and other days in which the credit union is not carrying on substantially all of its banking functions), would be considered deposited on the following banking day.

Let's consider, for example, a credit union that is essentially closed on the Friday before Veterans Day or the Thursday and Friday of Thanksgiving week. For this credit union, all deposits made at an ATM or overnight lockbox during this time would be considered deposited on the following Monday.  From there, the credit union would follow the general funds availability guidelines. By Tuesday, funds must be available for deposits of cash, electronic payments, U.S. Treasury checks, U.S. Postal Service money orders, Federal Reserve Bank checks, State and local government checks, Cashier's checks, certified checks, and on-us checks. By Wednesday, funds from local checks should be made available for withdrawal. For additional information, the Federal Reserve provides A Guide for Financial Institutions: Compliance with Regulation CC. Happy Shopping!

Veteran’s Day: NAFCU will be closed on Friday in observance of Veteran’s Day. We at NAFCU extend our gratitude and appreciation to current and former members of the military who have bravely served our country. We will return to carrying on substantially all of our blogging functions on Monday, November 13, 2017. Have a nice weekend.

CDD Rule: Beware of Events that May Trigger Beneficial Ownership Reviews; CFPB Releases Beta HMDA Platform

Written by Stephanie Lyon, Regulatory Compliance Counsel

I have exciting news to share; on Friday I became a Certified Anti-Money Laundering Specialist through ACAMS. This is a great milestone for me and nothing could commemorate this accomplishment better than a BSA blog.  Enjoy!

As the Customer Due Diligence (CDD) rule's implementation date gets closer, we have seen an increase in questions regarding the types of events that may lead a credit union to review the beneficial ownership information of an existing account. So we thought it would be helpful to go over the rule's requirements and give examples of potential triggering events. Before we dig in, remember that the definition of a beneficial owner includes two prongs—ownership and control—so when talking about updating information on beneficial owners, we are referring to both prongs.

The 5th pillar of BSA compliance established by the final rule requires that credit unions include in their anti-money laundering (AML) programs, CDD procedures for the purpose of developing a member risk profile and conducting ongoing monitoring of these relationships. See, 81 Fed. Reg. 29449. Before you sound the alarm at your credit union, it is important to know that the final CDD rule does not impose a categorical requirement to regularly update the beneficial ownership information on an existing account. See, 81 Fed. Reg. 29421. However, as part of the on-going monitoring, credit unions may encounter some events that could lead the credit union to believe that there has been a fundamental change to the ownership of the account and hence trigger a review of beneficial owners. See, 81 Fed. Reg. 29399.

What Triggers A Review?

The rule states that beneficial ownership information should be updated when, in the normal course of business, the credit union detects a relevant change to the account that may alert the credit union to a change in the beneficial ownership structure. Here is an excerpt to the preamble of the CDD rule in which FinCEN explains this concept:

"…our requirement is consistent with current practice, and we expect monitoring-triggered updating of beneficial ownership information (as with other customer information) only to occur on a risk basis when material information about a change in beneficial ownership is uncovered during the course of a bank's normal monitoring (whether of the customer relationship or of transactions)... However, there is no expectation that a financial institution obtain updated beneficial ownership information from its customers on a regular basis, whether by using the Certification Form in Appendix A or by any other means." 81 Fed. Reg. 29421.

Unfortunately, the CDD rule does not have a prescriptive list of events that will trigger the review of beneficial ownership information for existing business accounts. Rather the rule follows the same risk-based review format of other Bank Secrecy Act (BSA) requirements. These risk-based provisions allow credit unions the flexibility to determine its own triggering events and implement appropriate review procedures. The rule does provide a few examples of events that could lead to a review of an account's beneficial ownership structure such as:

• "a situation where an unexpected transfer of all of the funds in a legal entity's account to a previously unknown individual would trigger an investigation in which the bank learns that the funds transfer was directly related to a change in the beneficial ownership of the legal entity…;
• when a financial institution detects information (including a change in beneficial ownership information) about the customer in the course of its normal monitoring….; [and/or]
• a significant and unexplained change in the customer's activity, such as executing cross-border wire transfers for no apparent reason or a significant change in the volume of activity without explanation." 81 Fed. Reg. 29421, 29399.

So if the credit union uncovers a potential change to the beneficial ownership information during a high risk review of an account, during the investigation of an AML alert or a SAR filing, the rule would require the credit union to seek updated information for the account at that time. Other triggering events that may require updated beneficial ownership information, depending on specific facts and circumstances, include:

• A notable increase in CTR filings for the legal entity or any of the beneficial owners
• The filing of a SAR (depending on the nature and type of suspicious activity)
• Changes regarding the authorized users or signatories for the account
• Changes regarding the beneficial owners, ownership structure, nature of the business or customer base
• Opening a new subaccount for the business
• A request to close an active subaccount without providing a legitimate reason
• A 314(a) match
• Information obtained/provided from or to other FIs through 314(b) information sharing
• Results from a high-risk review of the account
• Law enforcement subpoenas or search warrants
• Transaction monitoring alerts for unexpected activity

Before the rule becomes final, credit unions may want to review their current due diligence process and create additional risk-based procedures that specify which triggering events should lead to a more thorough review of legal entity accounts—including obtaining updated beneficial ownership information.

***

CFPB Releases Beta Version of HMDA Platform. Credit unions will finally be able to test their HMDA data collected in 2017 for reporting to the CFPB in 2018  through the long awaited beta version of the HMDA portal. The portal allows credit unions to establish test log-in credentials, upload sample files, validate the data, receive edit reports, confirm test data submissions and complete test filing processes.

Equifax Breach Update - What NAFCU Is Doing

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

In the past few weeks, NAFCU has been focused on defending credit unions from the fallout of the Equifax breach specifically, and the cybersecurity risks posed by third parties generally. At this moment, the door is open to cybersecurity legislation that could have real positive impact for the credit union industry, and NAFCU is moving to seize on that opportunity. As legislation may be the best hope to protect credit unions from another breach like the one at Equifax, I'd encourage your credit union to engage with your Members of Congress to ensure they understand that credit unions must be protected in the future. Please visit our Grassroots Action Center for more information.

Equifax Botched It

Equifax was warned of the vulnerability which lead to the breach in December, 2016. This March, Equifax ignored a notification from the Department of Homeland Security, CERT to fix that vulnerability. In August, following the breach, Equifax established an insecure domain for its breach response site which was spoofed. In early October, Equifax's credit protection website was discovered to be hosting malware. The hits keep coming for Equifax, and whatever credibility Equifax might have still had after the breach, it is now completely gone. Equifax is trying to leave consumers, credit unions and other financial institutions to foot the bill for its mess. NAFCU is engaging on all fronts to make sure that doesn't happen.

The Regulators Are Quiet

NAFCU has been in touch with NCUA, but the agency lacks any real authority to take action on the Equifax breach or other third party cybersecurity issues. NAFCU has also reached out to the CFPB, and the Bureau continues to take the position that it would have needed additional authority over the credit reporting bureaus to have prevented the breach from occurring. The Bureau is currently investigating Equifax's use of a mandatory arbitration clause in connection with its breach response website.

The FTC is conducting its investigation into the Equifax breach and the response. NAFCU has encouraged the FTC to keep credit unions apprised of their findings, but we expect that investigation to continue for several years. No matter what that investigation finds, the FTC will not be able to prevent another breach like this from happening again unless Congress steps in.

The Hill Has Questions

The Equifax breach has Congress angry and looking for answers. On October 3, Equifax's former CEO, Rick Smith, testified before the House Energy and Commerce Committee, providing details for the first time about the internal failures at Equifax that lead to the breach, and accounting for the behavior of Equifax leadership in the days that followed. A few days later, the Senate Banking Committee and then the House Financial Services Committee both heard further testimony from Mr. Smith regarding the variety of failures in Equifax's response to and communication about the breach.

While both parties are actively engaged on this issue, it is worth noting the differing approaches of Republican and Democratic Members of Congress. Republican Members of Congress appear to be actively seeking the ways in which regulatory oversight failed with Equifax, and how these gaps can be fixed. Democratic Members of Congress have zeroed-in on how the Equifax breach will affect consumers, and what Equifax and Congress can do to try and make them whole.

While Equifax's current leadership has failed to show up for hearings so far, the credit union industry has come when called. On Wednesday, Debra Schwartz, NAFCU Board treasurer and President and CEO of Mission Federal Credit Union testified on behalf of NAFCU before the House Financial Services Committee about data security and what credit unions need from Congress. Ms. Schwartz explained the sufficiency of the Gramm-Leach-Bliley's existing Safeguard Rule pertaining to financial institutions, and pointed out that the Equifax breach was the failure of examination and oversight of the credit reporting bureaus, rather than a failure of the law itself. She emphasized that if there are not standards throughout the entire payments infrastructure, criminals will go to the weakest link, which is the merchants. She championed the industry and provided important, factual testimony that will aid Congress in drafting a bill that works and can pass. NAFCU will continue to work to ensure that credit unions' voices are heard in these Congressional hearings.

Legislation Is In the Works

There is a strong appetite on both sides of the aisle to pass legislation in response to the Equifax breach. So far, legislative proposals generally fall into one of three buckets: consumer protection proposals in response to the breach, proposals to correct or increase regulatory oversight over the credit reporting bureaus, and broader proposals regarding national standards for cybersecurity.

The PROTECT Act, recently introduced by Representative Patrick McHenry (R-N.C.), has garnered significant attention. This Act would have the FFIEC appoint a supervisory agency and examine the credit reporting bureaus for compliance with the GLBA's Safeguards Rule, correcting the "examination gap" that currently exists with the bureaus. This proposal also contains national requirements regarding the operation of credit freezes, something that is currently handled at the state law level. Of concern is a provision in the Act that seeks to phase social security numbers out of use by the bureaus as a personal identifier. Obviously this raises red flags as social security numbers are critical to properly identifying members, and NAFCU is currently raising these concerns to lawmakers.

While Congress's attention is focused on cybersecurity, NAFCU is pushing to ensure that credit unions can get the protection they need against third party breaches. There is real energy behind getting general data security legislation passed, and NAFCU is seeking to take advantage of that. As always, we are keeping a careful eye to ensuring that organizations subject to the Gramm-Leach-Bliley Act, like credit unions, do not end up being subject to stricter standards. But this may be our moment to get credit unions the protections they need from third party cybersecurity risk, and NAFCU is working to make sure we take as much advantage of the moment as we can.

Litigation Is on the Table

To date, multiple class action lawsuits have been filed against Equifax by financial institutions across the country. It is highly likely that all financial institution class actions suits will eventually be joined together. Filing or joining a lawsuit continues to be an available option which NAFCU closely considering. Only if NAFCU determines that litigation is viable and a worthwhile avenue for recovery for credit unions will we pursue that option.

NAFCU is continuing to engage everywhere we can to protect credit unions from the breach's continuing fall-out, and to demand Congress act so that this cannot happen again.

Please Stop Calling Me...Unless You're My Credit Union

Written by: Ann Kossachev, Regulatory Affairs Counsel

T-C-P-A. This four letter acronym invokes a lot of fear in credit unions across the country. Most of that fear is based on the very real risk of facing a lawsuit for alleged violations of the Telephone Consumer Protection Act (TCPA). There are individuals known as "TCPA trolls" who have made a lot of money filing TCPA lawsuits against those institutions that have intentionally or unintentionally placed calls (including text messages) to their numbers. Plaintiffs' attorneys were quick to notice this trend and have profited greatly from the skyrocketing number of TCPA cases in recent years.

Source: U.S. Chamber of Commerce Institute for Legal Reform

For starters, Congress enacted the TCPA in 1991. That's right, 26 years ago. Considering all of the technological advancements since the '90s, it is no surprise that the Act is in serious need of modernization. The Federal Communications Commission (FCC) has issued several orders since then attempting to clarify the TCPA's vague language, including in 2003, 2012, and (this one is a doozy) 2015. Shortly after the FCC's 2015 Declaratory Ruling and Order (2015 Order), NAFCU detailed the background and details of the FCC's proclamation on this blog. Since then, NAFCU has been very vocal about its concerns with the following aspects of the 2015 Order and the FCC's TCPA regulations generally: (1) the restrictive free-to-end-user exemption; (2) the overly-expansive definition of "automatic telephone dialing system" (autodialers); (3) antiquated distinctions between mobile and residential phones; (4) the very vague standard for revoking previous consent; and (5) a lack of flexibility with regard to reassigned numbers.

The bottom line is that credit unions are not abusing telephone technology to cause a nuisance to and invade the privacy of their members. Nonetheless, credit unions are swept in with intrusive telemarketers and scam robocallers and subject to some pretty hefty restrictions on consumer communications. In 2015, ACA International sued the FCC in the United States Court of Appeals for the District of Columbia Circuit to resolve questions with the 2015 Order and the case was consolidated with similar lawsuits. Shortly thereafter, NAFCU filed a motion to intervene on behalf of the petitioners and the motion was granted. Oral arguments were heard on October 19, 2016 and the three-judge panel appeared to be sympathetic to the petitioners' arguments and questioned the FCC's interpretation of the TCPA. The D.C. Circuit has yet to issue a decision in the case, but it could happen any day now.

Meanwhile, there have been some changes at the FCC. Earlier this year, former Commissioner Ajit Pai was elevated to Chairman and then Brendan Carr and Jessica Rosenworcel were nominated and confirmed as commissioners, filling the remaining two seats and providing the FCC with a majority Republican leadership. Commissioner Michael O'Rielly and Chairman Pai have been outspoken about their disapproval of the 2015 Order. Chairman Pai actually dissented to the order and said "Rather than focus on the illegal telemarketing calls that consumers really care about, the Order twists the law's words even further to target useful communications between legitimate businesses and their customers." Chairman Pai said the 2015 Order would make abuse of the TCPA much easier and primarily benefit trial lawyers, not the American public. NAFCU concurs and is optimistic that under his leadership, Chairman Pai will make serious efforts to clarify the TCPA and undo some of the FCC's harmful regulations, including the 2015 Order.

Unfortunately, until we see a decision in the ACA International case, the FCC is unlikely to make any significant changes to its TCPA regulations.  Despite pleas for relief to the FCC, NAFCU does not anticipate the FCC to modify any of its TCPA rules or exceptions until the D.C. Circuit has spoken. While we wait patiently though, the FCC has taken steps to target unlawful scam robocalls and malicious spoofing and started looking into creating a centralized database for reassigned numbers, which will help ease some of the difficulties related to the TCPA. But these steps still do not solve the primary concerns with the 2015 Order, mainly the definition of autodialer and the exceptions for free-to-end-user calls.

Credit unions deserve better. Credit unions should receive tailored regulations that recognize their unique relationship with members and, in terms of the TCPA, that they typically only contact consumers with useful information regarding their existing accounts. NAFCU has been asking the FCC to make changes to its regulations and to reevaluate the 2015 Order for years now, but again, the FCC appears to have put the issue on hold. For now, NAFCU is working on developing a landing page to keep you updated on the latest TCPA developments and doing everything possible to make sure every commissioner at the FCC knows that credit unions are struggling with TCPA compliance. There is also currently a credit union-specific petition pending before the FCC, which requests an "established business relationship" exception for credit union informational calls to wireless numbers. It is open for comment until November 6, 2017. NAFCU is commenting in support of the petition and encourages you to do the same. You can submit comments here. Other than that, until the D.C. Circuit's decision is released, credit unions and other financial institutions are on the hook. Ring riiiiiing!

Dealing with Closing Disclosure Errors Post-Consummation

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

Credit unions just want to get it right. In terms of getting it right, there may be no greater frustration than getting to the end of a real estate closing, and then discovering an error in the Closing Disclosure after consummation has taken place. The TRID rule is full of flaming hoops to jump through and mud pits to leap over… there's nothing like getting to the end, turning around feeling victorious, and realizing out you left a shoe on the course and that's a technical violation. So, I'm going to walk through some decision points and considerations for credit unions who find themselves staring at an error in a Closing Disclosure for a file that has already been consummated.

The Standard for a Closing Disclosure

It's important to understand that TRID requires a Closing Disclosure to reflect the actual terms of the transaction and the actual costs associated with settlement. See, 12 C.F.R. § 1026.19(f)(1)(i). Unlike with the Loan Estimate, a Closing Disclosure can be revised as necessary before consummation to satisfy the regulation without having to meet any particular circumstantial requirements. The revised Closing Disclosure must simply be provided in the timeframes set out in paragraph 19(f)(1)(ii) and 19(f)(2). However, once consummation has come and gone, a credit union's options begin to narrow quickly.

Inaccuracy Due to Post-Consummation Events Occurring Within 30 Days

If an event occurs within 30 days after the consummation date, and that event causes the Closing Disclosure to become inaccurate in a way that results in a change to an amount actually paid by the consumer, the credit union can mail a corrected Closing Disclosure to the borrower. See, 12 C.F.R. § 1026.19(f)(2)(iii). The Bureau did not want credit unions reissuing Closing Disclosures due to every post-consummation event that could occur. It felt borrowers would only benefit from a corrected disclosure if it changes a charge imposed on the borrower. The corrected Closing Disclosure should reflect that actual terms of the transaction and the actual costs associated with the settlement. It must be mailed no later than 30 days after the credit union discovered the event had occurred. Credit unions are not required to issue corrected Closing Disclosures for terms which changed due to post-consummation event where charges paid by the borrower were not affected. It is important to note that a change resulting from a post-consummation event is different than discovering an error which was not correct at the time of consummation.

Inaccuracy Due to Clerical Errors

If the credit union discovers that a clerical error was made on the Closing Disclosure, it can correct that error post-consummation only if the error was non-numerical. See, 12 C.F.R. § 1026.19(f)(2)(iv) A non-numerical clerical error is an error that does not affect a numerical disclosure and does not affect requirements imposed by paragraphs 19(e) and 19(f). The commentary cites listing the wrong service provider as a correctable, non-numerical clerical error. It cites an incorrect address as a non-correctable error. 12 C.F.R. Part, 1026, Supp. I, comment 19(f)(2)(iv)-1. This is a very narrowly-drawn provision for curing a specific kind of error.

Other Kinds of Errors

So what if you discover an error that is numerical? Or is non-numerical, but affects a requirement in paragraphs 19(e) or 19(f)? The answer is: it’s an incurable violation.

Steady yourselves, compliance officers. Not all violations are created equal. It may be a technical, incurable violation or it might be substantive. NAFCU has repeatedly asked the Bureau to provide additional avenues to cure these issues; after all, credit unions just want to get it right. However the Bureau has demurred. In the TRID preamble, the Bureau stated that it did not want to offer further regulatory provisions on curing errors, because it did not want to affect that statutory liability provision in the Truth in Lending Act itself. So that is where credit unions must go to determine next steps.

The Truth In Lending Act's Correction of Errors Provision

So TRID will not tell you how to correct all possible errors. If the credit union discovers an error post-consummation and it does not fit one of the categories addressed in paragraph 19(f)(2), credit unions can look to the Truth in Lending Act (TILA) itself. The Act is codified at 15 U.S.C. § 1601  et seq. Paragraph (b) in section 1640 discusses how creditors can correct errors in order to avoid any civil liability in connection with the error.

"(b) Correction of errors

A creditor or assignee has no liability under this section or section 1607 of this title or section 1611 of this title for any failure to comply with any requirement imposed under this part or part E of this subchapter, if within sixty days after discovering an error, whether pursuant to a final written examination report or notice issued under section 1607(e)(1) of this title or through the creditor's or assignee's own procedures, and prior to the institution of an action under this section or the receipt of written notice of the error from the obligor, the creditor or assignee notifies the person concerned of the error and makes whatever adjustments in the appropriate account are necessary to assure that the person will not be required to pay an amount in excess of the charge actually disclosed, or the dollar equivalent of the annual percentage rate actually disclosed, whichever is lower." 15 U.S.C. § 1640(b) (Emphasis added).

In other words, the credit can avoid any civil liability if it catches its own errors, and then notifies the member of the error and ensures they did not pay more than what was disclosed. Credit unions must provide this notice within 60 days of identifying the error.

Credit unions may wish to establish a policy as to when corrected Closing Disclosures will be issued to take advantage of the error correction provisions in TILA. Because such a correction only avoids liability for a violation, rather than actually curing the violation itself, it may not always make sense to spend funds and staff time on issuing corrected Closing Disclosures under this provision, as not all errors may create liability to begin with. Local counsel can assist credit unions in making these determinations.

Fourth Corner Credit Union v. Federal Reserve Bank of Kansas City: Round 2 (Ding! Ding!)

Written by Pamela Yu, Special Counsel for Compliance and Research

A few months ago, I blogged about the appellate decision in a lawsuit filed by The Fourth Corner Credit Union (Fourth Corner) against the Federal Reserve Bank of Kansas City (FRB-KC) after the regional bank to the Federal Reserve (Fed) System denied Fourth Corner's application for a master account.  Fourth Corner, a state-chartered credit union based in Denver, was formed in 2014 to serve Colorado's legalized marijuana industry and its advocates and supporters.  Poised to become the nation's first cannabis credit union, since its inception, Fourth Corner has been entangled in lawsuits with the FRB-KS and NCUA and has seen its initial plans to open for business in 2015 go up in smoke. Essentially, without a master account to access the Fed's payments system the cannabis credit union's future has been hazy. 

Without getting too into the weeds, or re-hashing our prior discussions on this topic, on June 27, 2017, the 10^th Circuit Court of Appeals, in a split (2-1) opinion, overturned the U.S. District Court for the District of Colorado's December 2015 ruling in Fourth Corner's lawsuit against the FRB-KC.  The appellate court decision, which vacated the lower court’s order and remanded the case with instructions to dismiss the amended complaint without prejudice, essentially gave Fourth Corner a second chance at applying to the FRB-KC for a master account.  The ruling also left the door open to have the case heard again if the bank denied a new application.  The appellate decision noted that according to statute the FRB-KC must indiscriminately make Fed services available to "all depository institutions."  See, 12 U.S.C. § 248a(c).  But, importantly, the appellate court relied on Fourth Corner's assurances that it would service marijuana-related businesses only if doing so is legal. In other words, the credit union could reapply for a master account to serve legal-marijuana supporters and other individuals and advocacy groups within its field of membership, but the 10^th Circuit emphasized that servicing marijuana-related businesses (still illegal as a schedule 1 substance under the federal Controlled Substances Act) is impermissible.

While a legal victory for the embattled credit union, the high of its appellate win was seemingly short-lived because, according to Fourth Corner's new complaint that was filed on September 29, the FRB-KC is allegedly engaging in an "illegal discriminatory procedure" by "requesting information it is not entitled to receive from any depository institution seeking a master account" in relation to Fourth Corner's renewed application.  Further, Fourth Corner alleges that the FRB-KC is refusing to make “Federal Reserve bank services covered by the fee schedule” available to Fourth Corner within the timeframe it has established for the issuance of master accounts to all depository institutions, in violation of federal statute.  See, 12 U.S.C. § 248a(c)(2). 

The credit union's new complaint, again filed in the U.S. District Court for the District of Colorado, claims that subsequent to the 10^th Circuit's July ruling, on August 10, Fourth Corner received a letter from the FRB-KS stating that the credit union's "unique nature, structure, and history" raised legal and policy issues in connection with its account request and requesting the credit union submit information not required by the standard master account documents.  See, Complaint.  On September 12, Fourth Corner resubmitted to FRB-KC its executed standard master account documents, along with a letter from the state regulator attesting that Fourth Corner "has complied with all applicable requirement(s) of the Colorado Division of Financial Services and its charter is in good standing with this office," and a resolution from its board that "in all of its activities [Fourth Corner] shall follow state and federal law" and that "[Fourth Corner] shall not serve marijuana-related businesses until there is a change in federal law that authorizes financial institutions to serve marijuana-related businesses." See, Complaint.  However, according to Fourth Corner, the FRB-KC nevertheless failed to issue it a master account as mandated by law within the 5-7 business day timeframe the Fed established for the issuance of master accounts to all depository institutions. The credit union argues that the FRB-KC has invoked an improper and discriminatory procedure in requesting information from the credit union that is outside of its normal protocol in processing master account applications. 

The credit union is asking the court to "enforce the law of the case and/or declare anew" that federal statute "unambiguously entitles Fourth Corner to a Master Account," and for the court to issue a mandatory injunction to compel the FRB-KC to "comply with the statutory mandate" that creates a nondiscretionary obligation and "unambiguously entitles [Fourth Corner] to a master account within 5 to 7 business days" of its master account application.  See, Complaint. 

And so, the seeds are sown for round two in this budding legal fight. Watch this space for developments in the Fourth Corner case. Meanwhile, should Fourth Corner prevail and finally get its master account from the FRB-KC, the credit union must still contend with NCUA—the credit union's lawsuit against the agency for its denial of the credit union's federal share insurance application is still pending.

BSA and OFAC Compliance Program Deficiencies Highlighted in Cease and Desist Order; October BSA Blast

Written by Shari R. Pogach, Regulatory Paralegal

I often write about Bank Secrecy Act (BSA) enforcement actions as these tend to illustrate what the regulators are looking for in examining for BSA compliance.  This recent Cease and Desist Order against The Bank & Trust, S.S.B, of Del Rio, Texas, reiterates the need for a robust compliance and risk management program in order to comply with BSA and anti-money laundering (BSA/AML) regulations. The enforcement action also indicates a weakness in this bank's compliance with the Office of Foreign Assets Control of the United States Department of the Treasury (OFAC) requirements.

Under the order, the bank is required to do the following:

• Strengthen board oversight of compliance policies, procedures, standards, staffing and resources;
• Develop an enhanced written BSA/AML compliance program;
• Develop a revised written program for conducting appropriate levels of customer due diligence;
• Develop an enhanced written program designed to reasonably ensure the identification of  and timely, accurate and complete reporting of all known or suspected violations of law or suspicious transactions to law enforcement and supervisory authorities;
• Submit a written plan to ensure qualified independent testing and validation of the bank’s suspicious activity monitoring system;
• Bring in an independent third party to conduct a "look-back" transaction review of the first half of 2016 to see if suspicious activity involving high risk customers and transactions at, by, or through the bank was properly identified and reported; and
• Submit a plan to enhance the bank’s compliance with the OFAC regulations that includes but is not limited to, enhanced OFAC screening procedures, an improved methodology for assessing OFAC risks, and enhanced policies and procedures to ensure compliance with OFAC regulations.

Examples of deficiencies by another institution can be used as road maps to determine where, if any, your own institution's BSA and OFAC compliance programs might have weaknesses.

***

BSA Blast.  The October 2017 issue of the BSA Blast is now available. (NAFCU login required).  The articles in this issue cover: 1) weaknesses in this Florida bank's BSA compliance program are outlined in a very detailed consent order signed with the OCC; and 2) FinCEN issues its first enforcement action against a foreign-located virtual currency exchange.  The quiz included in this issue focuses on FinCEN's advisory guidance on political corruption in Venezuela and OFAC sanctions.

***

2018 BSA Seminar.  Don't have your NAFCU Certified Bank Secrecy Officer (NCBSO)  designation yet?  Make plans to attend NAFCU's 2018 BSA Seminar, August 12-15 in Denver, Colorado.  Advance your career and skills with up-to-the-minute credit union BSA training! 

The CFPB's Final Payday Rule: The PAL Exemption

Written by Jennifer Aguilar, Regulatory Compliance Counsel

On October 5, the CFPB announced it had finalized its rule on payday loans. The final rule seeks to provide "common-sense protections" for payday loans, auto title loans, deposit advance products and certain other longer term loans with balloon payments. A key protection under the new rule is that lenders will be required to conduct an ability-to-repay analysis to determine whether the borrower can repay the full amount of the loan without re-borrowing. The final rule also imposes requirements concerning withdrawal practices, disclosures and recordkeeping. The final rule covers a number of different types of loans, but the rule also provides a number of exclusions and exemptions, one of which is of particular importance for credit unions – the PAL exemption.

New section 1041.3(e) exempts "alternative loans" from the payday rule. In the preamble, the CFPB explains that this exemption applies to any loan that meets the conditions outlined in the final rule so that any lender, not just federal credit unions, may qualify for this exemption. The CFPB found that this was the best approach to ensure the rules are applied consistently to all lenders. In order to qualify as an "alternative loan," the loan must meet all of the following conditions:

1. Loan terms: the loan must not be structured as open-end credit; have a term between one and six months; have a principal between $200 - $1,000; be repayable in two or more equal payments due in equal intervals; completely amortize during the term; and no charges may be imposed other than the rate and application fees permissible under 12 C.F.R. 701.21(c)(7)(iii).
2. Borrowing history: the lender must determine that, if the lender made this loan, the borrower would not be indebted on more than three alternative loans within a 180-day period; the lender may make only one alternative loan at a time to a consumer.
3. Income documentation: the lender must have and must comply with policies and procedures for documenting proof of recurring income.

Any loan that meets all these conditions is an "alternative loan" and is exempt from the payday rule. Section 1041.3(e) goes on to provide a safe harbor for federal credit unions. The safe harbor states that any loan made in compliance with NCUA's PAL program is an "alternative loan" for purposes of the payday rule. This means that a federal credit union does not have to separately meet the conditions above for its PALs in order for that loan to be exempt from the payday rule – as long as it’s a PAL, it’s an alternative loan.

So, now that we know all PALs are alternative loans, the next question is . . . What’s a PAL? Section 707.21(c)(7)(iii) lays out the specific requirements that must be met in order for a loan to qualify as a PAL. According to the rule, all the following conditions must be met:

1. The loan must be closed end, have a principal balance between $200 - $1,000, have a maturity between one – six months, and be fully amortizing;
2. The FCU must not make more than three PALs in any rolling six-month period to any one borrower, make more than one PAL at a time to a borrower, nor roll over any PAL;
3. The borrower must be a member of the FCU for at least one month;
4. Any application fee must be charged to all members, must reflect the actual cost of processing the application, and must not exceed $20; and
5. The FCU has a written lending policy that imposes an aggregate dollar limit for PALs of a maximum of 20% of net worth and implements underwriting guidelines to minimize the risks associated with PALs.

In addition to meeting the payday rule's safe harbor for alternative loans, PALs also qualify for a higher interest rate. The rule permits credit union to charge an interest rate of 1000 basis points above the maximum interest rate set by NCUA.

Time for S'More Learning: Collecting Disaggregated HMDA Data

Written by: André B. Cotten, Regulatory Compliance Counsel

Hi, Compliance Friends. We are currently enjoying some wonderful fall weather here in Washington, DC.

With the pending HMDA changes, some credit unions have been uncertain about the regulatory authority to be currently collecting the disaggregated age, race and sex data. This blog presents the crux of the conflict with Regulation B, which implements the Equal Credit Opportunity Act, current HMDA guidance, and a credit union's options for collecting disaggregated data including how that may impact its implementation of the new HMDA rules.

Regulation B

Generally, Regulation B (Equal Credit Opportunity Act) prohibits credit unions from inquiring into an applicant’s race or ethnicity. However, Regulation B permits inquiries for monitoring purposes in connection with self-testing or HMDA (Regulation C) reporting. 

With that being said, absent regulatory authority, the current collection of disaggregated race and ethnicity data is prohibited until HMDA’s new provisions are in effect. In other words, absent other guidance, credit unions could only inquire into race and ethnicity to the extent required by the current HMDA provisions. However, the CFPB did issue guidance on this last year and amended Regulation B effective January 1, 2018.

HMDA Guidance

While Regulation B allows collecting information that is otherwise prohibited in order to comply with HMDA, Regulation B uses terminology that does not align with the amended version of HMDA. As a result, the CFPB recently released technical amendments that address these types of issues.

The technical amendments also set forth "other permissible collection of information" to allow credit unions to collect this kind of data even if not subject to HMDA reporting. For example, a credit union that submitted HMDA data in any of the past 5 years, but is not currently a "financial institution" under HMDA is permitted collect information for HMDA covered loans. The technical amendments also grant credit unions the option to allow applicants to self-identify using the specific race and ethnicity categories required by HMDA. The actual text is pretty technical so for those working on HMDA compliance at a credit union, it may be worth taking a look at the specific language in the proposal. 

Prior to the recent technical amendments, the CFPB's 2016 Notice of Official Approval granted credit unions the authority to begin collecting disaggregated race and ethnicity data pursuant to Regulation C. The Notice of Official Approval was in part directed at Fannie Mae's updated Uniform Residential Loan Application.

However, for credit unions looking to comply with HMDA requirements, the following excerpt from the Notice of Approval seems to grant credit unions the ability to currently collect disaggregated race and ethnicity information:

"For purposes of submitting HMDA data for applications received on or after January 1, 2017, and before January 1, 2018, and on which final action is taken on or after January 1, 2018, the financial institution, at its option, may submit the information concerning ethnicity and race under § 1003.4(a)(10)(i) using disaggregated categories if the applicant provided such information instead of using the transition rule in Regulation C comment 4(a)(10)(i)-2 as adopted by the 2015 HMDA final rule, or it may submit the information in accordance with that transition rule."

Collecting this information early is not the only option for credit unions. The 2015 HMDA rule created a carve out for disaggregated data collection which allows a credit union to report the applicant's ethnicity, race, and sex required under the Regulation C requirements in effect at the time that the credit union collects the information not when the financial institution takes final action on the application.

Collecting Disaggregated Data

There is also helpful guidance in the small entity compliance guide:

The small entity compliance guide also provided an example that may be helpful to the credit union:

Given the current regulatory guidance, it seems that credit unions have two options for collecting data related to ethnicity, race and sex in the weeks leading up to the HMDA compliance deadline. A credit union can collect the disaggregated data pursuant to the 2016 guidance as a voluntary measure. The credit union can also comply with the transitional rule and comply based on the "requirements in effect at the time the [credit union] collects the information. Note, with the transition method, the credit union would have to be instantly ready for the new HMDA requirements in 2018 versus the more gradual method.

***

CFPB updates HMDA implementation materials and the 2018 Filing Instructions Guide. The updated HMDA implementation materials include a chart on the Collection and Reporting of HMDA Information about Ethnicity and Race, and a Reporting Reference Chart intended to be used as a reference for data points required to be collected, recorded, and reported under Regulation C. The Filing Instructions Guide  is for data collected in 2018 that reflects updates to the Automated Underwriting System.

FinCEN Finalizes Technical Amendments to CDD Rule; CFPB Updates HMDA Guide

Written by Stephanie Lyon, Regulatory Compliance Counsel

FinCEN recently issued technical amendments to its Customer Due Diligence (CDD) rule or as some of you may know it, the Beneficial Ownership rule. These amendments became effective the day they were published in the Federal Register but the compliance deadline is not until May 11, 2018. Unfortunately, the compliance deadline may take away from the enjoyment of celebrating Eat What You Want Day, but I will nonetheless observe this holiday.

I just wanted to note from the onset that these technical amendments do not provide additional guidance on complying with the CDD rule but we do anticipate additional FAQs before the compliance deadline—specifically on complex corporate structures and how deep to dig to find a natural person (finding the heartbeat).

Of the technical amendments, only one part is specifically relevant to credit unions while the other part deals with the training element of the AML program for mutual funds, which was inadvertently omitted from the final rule. See, 81 Fed. Reg. 45183. Here are the applicable corrections noted in the amendment:

Corrections to the Beneficial Owner Certification Form

Under the final CDD rule, credit unions are required to identify up to 4 beneficial owners who own 25% or more of legal entity customers at the time a new account is opened. To comply with this requirement, the credit union may obtain the required information on a standard certification form or through substantially similar means. Credit unions seeking to comply with this requirement through the standard certification form can find an image of the Certification Regarding Beneficial Owners of Legal Entity in Appendix A of the final rule.

The technical amendments made a couple of corrections to the model Certification Form found in Appendix A. The changes are meant to fix inadvertent mistakes instead of imposing additional requirements to obtain information for beneficial owners of legal entities. Here is a summary of the changes:

1. In the first sentence in Part I under the heading “What information do I have to provide?”, the term “foreign persons” is changed to “non-U.S. persons”.
2. In Part II, the heading of Section II b. is changed to “b. Name, Type, and Address of Legal Entity for Which the Account is Being Opened:”
3. In the headings of the last column in the Tables in Section II c and Section II d, the term “Foreign Persons” is changed to “Non-U.S. Persons” and the term “Social Security Number” is added after the term “persons”.
4. In footnote 1, the term “Foreign Persons” is changed to “Non-U.S. Persons” and “a Social Security Number,” is inserted after the word “provide”.

81 Fed. Reg. 45183. For visual learners, such as myself, I summarized the changes in red in the old model form and highlighted the last change in the new model Certification Form:

Change # 1

 

Change #2

Change #3

Change #4

Credit unions that are relying on a forms provider to create the Certification Form may want to ensure the technical amendments are incorporated before the compliance deadline sneaks up. As I recall, the process of requesting a modification to a form, reviewing the changes and approving the final form can take some time so it is important to get the ball rolling. The technical amendment did include a model Certification Form that incorporates the amendments, but the form is spread out into four parts:

https://s3.amazonaws.com/images.federalregister.gov/ER28SE17.004/original.png?1506528076

https://s3.amazonaws.com/images.federalregister.gov/ER28SE17.005/original.png?1506528077

https://s3.amazonaws.com/images.federalregister.gov/ER28SE17.006/original.png?1506528077

https://s3.amazonaws.com/images.federalregister.gov/ER28SE17.007/original.png?1506528093

***

CFPB Updates HMDA Small Entity Compliance Guide. The CFPB just updated their HMDA small entity compliance guide to incorporate the amendments to its 2015 HMDA rule. The updates incorporate changes introduced in the April 2017 HMDA proposal (technical clarifications) and the July 2017 HMDA proposal regarding transactional thresholds for reporting HELOCs.

Regulatory Compliance School and Seminar. I also wanted to say on behalf of the Regulatory Compliance team, thank you for joining us at NAFCU's Regulatory Compliance School and Seminar in sunny San Diego. It is energizing to see so many engaged compliance professionals in one place!

Untangling Service Provider Breaches

Written by Andrew Morris, Regulatory Affairs Counsel

National Cybersecurity Awareness Month began as a tradition in 2004. As you can see above, NAFCU stays ahead of the curve.

October is National Cybersecurity Awareness Month, so today I'm writing about service provider data breaches and member notification rules. I'll also share some insights from a cybersecurity-related event I attended last week at the U.S. Chamber of Commerce.

To start with the basics, Part 748 of NCUA's regulations implements the Gramm-Leach Bliley Act of 1999 (GLBA) and describes a credit union's obligation to adopt various technical and administrative safeguards to protect member information. Appendix B to Part 748 advises credit unions that they should develop a "risk-based response program" to address "incidents of unauthorized access to member information in member information systems." Appendix B also describes the standard for providing notice to members when there is an incident of unauthorized access to "sensitive member information." (Emphasis added.)

Let's unpack some of this language. As an initial matter, Part 748 describes not only what a credit union should do, but also what it must do to safeguard member information. In general, NCUA's IT examination process is risk-based, so it's incumbent upon the credit union to design security controls that are appropriately tailored. However, NCUA advises that a credit union should, at a minimum, consider the specific security measures enumerated in Appendix A to Part 748, which include a response program. In addition, 12 CFR 748.0(b)(3) requires that the credit union's security program be designed to "respond to incidents of unauthorized access to or use of member information that could result in substantial harm or serious inconvenience to a member."

In the context of a breach notification, there is a distinction between incidents of unauthorized access and incidents that could result in substantial harm or serious inconvenience to a member. Likewise, there is also a difference between unauthorized access to member information (defined in Appendix A to Part 748) and unauthorized access to sensitive member information (defined in Appendix B to Part 748). NAFCU's compliance blog has compared the different obligations that could arise as a result of these distinctions in a previous post. If you're interested in the mechanics of notifying NCUA, I would recommend reading it.

Today we will be talking about how a credit union should evaluate the breach of a service provider. Appendix A to Part 748 describes the response program as a protocol specifying "actions to be taken when the credit union suspects or detects that unauthorized individuals have gained access to member information systems, including appropriate reports to regulatory and law enforcement agencies." A member information system can include a system maintained by a service provider.

To reiterate this point, Appendix B to Part 748 also provides that a credit union should be able to address "incidents of unauthorized access to member information in member information systems maintained by its service providers." In practical terms, this means that a credit union's contract with its service provider should require the service provider to address incidents of unauthorized access to member information. Ultimately, it will be the credit union's responsibility to notify members; however, a credit union may authorize or contract with its service provider to notify the credit union’s members or regulators on its behalf.

In the context of service provider breaches, you should remember that the term "member information" applies. Member information means any records containing nonpublic personal information, as defined in 12 CFR 1016.3(p), about a member, whether in paper, electronic or other form, that is maintained by or on behalf of the credit union. Accordingly, it's important that service provider contracts reflect the broader meaning of member information. Credit unions are also advised to monitor service providers based on risk-assessments and to determine whether they are properly safeguarding member information. Appendix A to Part 748 indicates that such monitoring may involve review of audits and test results.

One question credit unions have asked in the aftermath of the Equifax data breach—which we've covered in a previous blog—is whether Equifax might be considered a service provider. Appendix A to Part 748 defines a service provider as "any person or entity that maintains, processes, or otherwise is permitted access to member information through its provision of services directly to the credit union." Many credit unions furnish credit reports to Equifax, but it remains unclear whether this type of exchange would result in a direct service relationship. To obtain the best answer to this question, you will probably want to review the service agreement that Equifax requires for data furnishers.

While it is almost certain that Equifax will be punished in some fashion for its data breach, consumers are eager to know how credit reporting agencies (CRAs) will be held accountable in the future. Many have lamented the fact that the Federal Trade Commission (FTC) lacks the authority to thoroughly examine and supervise data security programs at CRAs, which are generally required to follow the FTC's Safeguards Rule. The Safeguards Rule implements the high level security concepts contained in the GLBA, but is not nearly as comprehensive as the Federal Financial Institutions Examination Council (FFIEC's) IT Booklets and not nearly as prescriptive as the guidance published by individual financial regulators like NCUA. However, the CFPB does have the authority to supervise CRAs with annual receipts in excess of $7 million. That includes Equifax.

Although the CFPB does not enforce regulations implementing the GLBA, it is possible the bureau could also use its unfair deceptive acts and practices (UDAAP) authority to punish Equifax. Last year, the CFPB targeted the lax data security practices at Dwolla—a payment processor—by characterizing its overbroad security assurances as deceptive. As part of the CFPB's enforcement action—the first of its kind to target data security practices—Dwolla was required to pay a $100,000 penalty. Whether the CFPB can craft an enforcement action against Equifax that fits within the UDAAP framework remains to be seen.

Equifax probably won't be the last high profile breach we see this year. So what can credit unions do to better prepare themselves in the event of future cyber disruption? Aside from the usual recommendations—review security policies, train employees to avoid phishing emails, etc.—I would recommend information sharing. I recently attended the U.S. Chamber of Commerce's Annual Cybersecurity Summit and a major focus in almost every presentation was the critical importance of information sharing and analysis organizations (ISAOs). The good news is that the financial sector is already on the cutting edge, with many financial institutions belonging to one or more ISAOs that offer various tools to monitor vulnerabilities and ingest threat data.

As a parting thought, I'd like to say that NAFCU's work on improving information sharing capabilities brings to mind an interesting observation from the Cybersecurity Summit. At the end of the event, former Air Force General Michael Hayden suggested that individuals are more responsible for their safety today than at any point in history since the opening of the Western Frontier. I interpret that to mean that credit unions will need to work together to face the current threat landscape, which includes highly organized criminal syndicates and malicious state actors. To tackle these unprecedented challenges, credit unions should seek to partner with each other to develop best practices and outmaneuver their adversaries.

When You're Kind of a Big Deal: Loans to Directors and Staff

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

Good morning from NAFCU's Regulatory Compliance School being held in San Diego! As we get back to the basics at School, let's have a look at a handful of regulations that many compliance officers may not visit often, but the NAFCU Compliance Team get frequent questions about: NCUA's rules on making loans to directors and staff.

   

Board Review

Section 107 of the Federal Credit Union Act and its implementing regulation in section 701.21 contain requirements that may apply if a director, a member of the supervisory committee, or a member of the credit committee is taking out a loan at the federal credit union where he or she serves.

The initial approval of the loan can be performed by a loan officer or the credit committee, pursuant to the credit union's bylaws. But, if the aggregate of the amount of all loans to the individual director or committee-member exceeds $20,000 plus pledged shares, the board itself must approve the loan. The same rule applies if the director is just going to serve as endorser or guarantor for another borrower.

The federal credit union is required by section 701.21(d) to establish procedures for performing the aggregate calculation to determine whether board approval is required. If, after combining the amount of the loan applied for with all outstanding loans and lines of credit (including unused available balances) to the director, and subtracting any pledged shares, the aggregate amount is over $20,000, then the board must review and approve the loan before the federal credit union can make it. This review is non-delegable. We have previously had a few credit unions ask whether the director or committee member's loan balances and the math involved in the calculation must be reported to the board. There is no requirement in NCUA regulations or guidance that indicates that credit union staff must show their math to the board.

Non-preferential Treatment

All federally-insured credit unions must comply with the requirement of non-preferential treatment found in section 701.21(d)(5). See, 12 C.F.R. § 741.203(a). Any loan made to a director, a supervisory committee member, or a credit committee member cannot have more favorable rates, terms or conditions than those available to other credit union members. This prohibition also extends to the volunteer's spouse or family members in the same household as the volunteer. It also extends to business or investment partners of these volunteers, or the family of those partners.

The prohibition does not extend to staff. Both staff and senior management may enjoy employee rates and other discounts, if the credit union offers them. However, if staff serves on the board or on the supervisory or credit committees, they cannot enjoy these discounts by virtue of their board or committee seat.

Commercial Loans

Section 723.7(a) has its own restrictions on who can obtain a commercial loan at a federal credit union. Any compensated director is prohibited from obtaining a commercial loan from the federal credit union unless the board of directors approves it. The compensated director must recuse himself or herself from any deliberations regarding the loan.

Further, neither senior management involved in commercial loan underwriting, servicing or collection, nor their family, nor those associated with them under the definition in that section, can obtain a commercial loan either.

State-chartered credit unions are exempt from the requirements of Part 723 if NCUA has determined that they are subject to substantially equivalent regulations.

Conflicts of Interest

One other thing to keep in mind is the general prohibition against conflicts of interest found in Article XVI, Section 4 of NCUA's Federal Credit Union Bylaws. See, 12 C.F.R. Part 701, App. A. The provision prohibits directors, committee members, officers, agents or employees from participating in the deliberation of any question affecting his or her financial interests, including through corporations or other organizations they may belong to. The bylaws describe an appropriate procedure for avoiding a conflict of interest in these situations:

"In the event of the disqualification of any director respecting any matter presented to the board for deliberation or determination, that director must withdraw from the deliberation or determination; and if the remaining qualified directors present at the meeting plus the disqualified director or directors constitute a quorum, the remaining qualified directors may exercise with respect to this matter, by majority vote, all the powers of the board. In the event of the disqualification of any member of the credit committee, if applicable, or the supervisory committee, that committee member must withdraw from the deliberation or determination."

Domestic ACH Transactions: To OFAC or Not to OFAC, That is the Question; Programming Note

Written by Shari R. Pogach, Regulatory Paralegal

Wade Gustafson is sending a domestic ACH to Jean Lundegaard through your credit union.   Should an Office of Foreign Assets Control (OFAC) check be run on both Mr. Gustafson (originating party) and Ms. Lundegaard (the recipient)? And, should this be performed in real-time to allow for the transaction to be stopped? 

The conundrum here is that there isn’t a specific regulatory requirement that will tell you which transactions to run against OFAC. If a credit union facilitates a prohibited transaction, there is an OFAC violation. So, each credit union has to come up with an OFAC compliance program designed to ensure compliance based on the institution’s own risk. That basically means these accounts – and their related OFAC risks – should be addressed in your risk assessment, and then your policy designed to mitigate that risk.

The Federal Financial Institutions Examination Council's (FFIEC) Bank Secrecy Act/Anti-Money Laundering (BSA/AML) Examination Manual has a section on OFAC compliance and ACH transactions that discusses the expectations for Originating Depository Financial Institutions (ODFIs) and Receiving Depository Financial Institutions (RDFIs). It essentially appears to say that ODFIs are responsible for verifying the status of the originator and RDFIs are responsible for verifying the status of the receiver/beneficiaries. In the section (pp. 217-224) on Automated Clearing Transactions – Overview, the manual states:

"Because of the nature of ACH transactions and the reliance that ODFIs and RDFIs place on each other for OFAC reviews and other necessary due diligence information, it is essential that all parties have a strong CDD program for regular ACH customers.

[...]

With respect to domestic ACH transactions, the Originating Depository Financial Institution (ODFI) is responsible for verifying that the Originator is not a blocked party and making a good faith effort to ascertain that the Originator is not transmitting blocked funds. The Receiving Depository Financial Institution (RDFI) similarly is responsible for verifying that the Receiver is not a blocked party. In this way, the ODFI and the RDFI are relying on each other for compliance with OFAC regulations.

If an ODFI receives domestic ACH transactions that its customer has already batched, the ODFI is not responsible for unbatching those transactions to ensure that no transactions violate OFAC's regulations. If an ODFI unbatches a file originally received from the Originator in order to process "on-us" transactions, that ODFI is responsible for the OFAC compliance for the on-us transactions because it is acting as both the ODFI and the RDFI for those transactions. ODFIs acting in this capacity should already know their customers for the purposes of OFAC and other regulatory requirements. For the residual unbatched transactions in the file that are not "on-us," as well as those situations where banks deal with unbatched ACH records for reasons other than to strip out the on-us transactions, banks should determine the level of their OFAC risk and develop appropriate policies, procedures, and processes to address the associated risks. Such policies might involve screening each unbatched ACH record. Similarly, banks that have relationships with third-party service providers should assess those relationships and their related ACH transactions to ascertain the bank's level of OFAC risk and to develop appropriate policies, procedures, and processes to mitigate that risk." (Emphasis added).

The BSA/AML Examination Manual indicates noncustomer transactions should be checked against OFAC lists prior to being executed. Although the manual discusses these "responsibilities" as being separated, the duty on both financial institutions to prevent prohibited transactions from occurring is absolute. Both institutions are completely responsible for not facilitating a prohibited transaction.

If the credit union has a particular relationship with another institution (beyond mutual participation in NACHA), there could be contractually-agreed processes for running OFAC checks or due diligence conducted that might justify a decision not to run checks on everyone.  Still reliance on the NACHA rules does not necessarily appear to be sufficient. NACHA issued its own OFAC compliance whitepaper, which states:

“…In terms of the ACH Network, this means that all U.S. ACH participants, including Originators, Originating Depository Financial Institutions (ODFIs), Receiving Depository Financial Institutions (RDFIs), Receivers and third-parties need to be aware that they can be held accountable for sanctions violations by the U.S. Government and must understand their compliance obligations.

[…]

Debit Entries: In the event that the ODFI inadvertently processes an unlawful ACH debit entry to a blocked account, the RDFI holding the blocked account (or an intermediary receiving point such as a correspondent or third-party processor able to identify the transaction), in compliance with OFAC policies, should return the entry in accordance with the NACHA Operating Rules using Return Reason Code R16 (Account Frozen). In this way, the proceeds do not leave the blocked account and the ODFI is informed of the reason.”

The expectation is that ODFIs and RDFIs will work together to prevent OFAC violations. However, NACHA emphasizes that the ODFI also bears the responsibility to make a good faith effort to determination that the originator is not transmitting funds to a blocked party. Similarly, the RDFI is also responsible for knowing and responding properly if a transaction is made from a party subject to sanctions. Ultimately, there is not a "right" answer to this question. It is a question of risk-based decision-making for the credit union and the expectations of the credit union's examiners.

***

Programming Note.  NAFCU will close at noon today and be closed on Monday for the holiday weekend. We will be back to blogging on Wednesday.

NAFCU's compliance attorneys are in San Diego, California,  the rest of next week at the fall session of Regulatory Compliance School and the 2017 Regulatory Compliance Seminar.   We appreciate your patience as your compliance questions will be answered, but our replies might be slightly delayed with the time difference.

Enjoy your weekend!

Don’t You Forget About Us: Prohibitions and Limitations under Regulation Z

Written by Jennifer Aguilar, Regulatory Compliance Counsel

As compliance folks in the post-Dodd–Frank Era, we sometimes get so caught up with what must be disclosed that it's easy to overlook some of the prohibitions and limitations buried in the consumer regulations. Today's post is a roundup of questions that touch on some of the prohibitions and limitations for open-end credit products.

Our credit union would like to increase the late fee for our HELOCs, are there any regulatory issues with this increase?

Section 1026.40(f)(3) generally prohibits credit unions from changing any term on an open-end home equity plan. The commentary explains that this rule prohibits credit unions from increasing fees and imposing new fees once the plan is opened. This rule covers all the plans terms, not just those terms that must be disclosed under Regulation Z.

The rule does, however, provide a number of limited exceptions to this general prohibition. One of these exceptions allows credit unions to change a term as long as it obtains the member's consent. The commentary further explains that the member must expressly agree to the stated change in writing at the time the change is made and that continued use of the credit plan does not constitute consent.

Section 1026.9(c)(1) requires a 15-day advance notice if the credit union changes any term required to be disclosed under section 1026.6(a). Section 1026.6(a) requires credit unions to disclose all finance charges and any other charges that may be imposed as part of the plan. The commentary to paragraph 6(a)(2) specifically includes late fees as other charges imposed as part of the plan, so advance notice is required. The notice must be in writing and sent to each affected member at least 15 days prior to the effective date of the change.

Our credit union would like to start charging member's a fee for paying their credit card by phone. Can we do this?

For credit card accounts, section 1026.10(e) prohibits credit unions from charging a fee to make a payment by any particular method, including payment by phone. However, if the payment method involves an expedited service by a customer service representative, then credit unions may charge a fee for that payment method. This rule covers both fees charged by the credit union as well as fees charges by a third party that collects or processes payments on the credit union's behalf.

The commentary explains that "expedited" means that the credit union actually credits payment the same day or the next day if the payment is received after the established cut-off time. The commentary goes on to explain that "service by a customer service representative" requires the payment transaction be made with the help of a live representative. An automated system is not "service by a customer service representative," but credit unions may use an automated system for a portion of the transaction as long as a live representative is involved with the transaction.

We heard recently that LIBOR may come to an end sometime in the future. We use the 6-month LIBOR as the index for our variable-rate HELOCs. Can we change to a new index now?

For open-end home equity lines of credit, section 1026.40(f)(3) states that a credit union may change the index on a plan only if three conditions are met: (1) the original index is no longer available, (2) the new index's historical movements are substantially similar to the original index, and (3) the new index and margin will result in a rate substantially similar to the rate in effect at the time the original index became unavailable. The commentary reiterates that the original index must actually be unavailable before a credit union may select a new index.

MLA Credit Card FAQ – Bona Fide and Reasonable Fees Outside the Safe Harbor

Written by Brandy Bruyere, Vice President of Regulatory Compliance

Tomorrow is the Military Lending Act (MLA) compliance deadline for credit card products. Compliance officers have been working hard to implement this rule – and several others for that matter like mortgage servicing amendments and the Home Mortgage Disclosure Act (HMDA). As you endeavor to get through the next few months, be careful with the coffee so you don't end up like this guy:

 

via GIPHY

Today, I want to share another frequently asked question about credit card fees that a credit union may be able to exclude from the 36% Military Annual Percentage Rate (MAPR) cap. We have blogged on the safe harbor for fees. As a reminder, the MLA has a safe harbor for excluding an eligible fee from the MAPR for a credit card account. The rule requires using the average fee charged by five or more creditors with at least $3 billion in outstanding credit card balances at any time during a three year lookback. The DoD suggested looking to other institutions call reports and publicly available account agreements for calculating a safe harbor. However, many credit unions have pointed out though that an account can have fees that are not required to be publicly available under Regulation Z. Unfortunately the DoD did not contemplate that there could be fees that do not require disclosure in advertisements or agreements submitted to the CFPB under Regulation Z.

Section 232.4(d)  is structured such that any fee can be excluded from the MAPR as being a "bona fide fee" if it meets two requirements: it is bona fide and it is reasonable.  Whether it is reasonable is determined under section 232.4(d)(3) which includes a "like-kind" standard. The safe harbor provision in section 232.4(d)(3)(ii) – i.e., the comparison to the average of 5 fees charged by institutions with more than 3 billion in outstanding balances, is only one of the available options. Section 232.4(d)(3)(iii) has a general discussion of what may be "reasonable" outside the safe harbor:

(iii) Reasonable fee. A bona fide fee that is higher than an average amount, as calculated under paragraph (d)(3)(ii) of this section, also may be reasonable under paragraph (d)(1) of this section depending on other factors relating to the credit card account. A bona fide fee charged by a creditor is not unreasonable solely because other creditors do not charge a fee for the same or a substantially similar product or service. (Emphasis added.)

This indicates that a fee is not unreasonable simply because the credit union's fee exceeds the safe harbor, or the credit union is charging a fee that others are not charging. If there is not publicly available data that allows a credit union to compute an average fee, it may still be possible to claim the fee is reasonable, here's an excerpt from the rule's preamble:

5. REASONABLE FEE

Section 232.4(d)(3)(iii) provides that a bona fide fee still may be “reasonable” for the purposes of the exclusion even if that fee is higher than an average amount as calculated under proposed § 232.4(d)(3)(ii). In particular, the Department recognizes that, due to several factors in the marketplace for credit cards, the prices of certain fees could drop from current levels, including to zero, and yet the Department believes that a creditor who charges a reasonable fee still should be permitted to avail itself of the exclusion…Accordingly, the Department has adopted a provision that expressly states that “[a] bona fide fee charged by a creditor is not unreasonable solely because other creditors do not charge a fee for the same or a substantially similar product or service.” (Emphasis added.)

A credit union may be able to make case-by-case determinations for fees and where the fee seems reasonable, exclude that fee from the MAPR – although there would not be a clear safe harbor for doing so.

For more information on which fees are in the MAPR, check out this past blog. NAFCU members can find other resources like our comprehensive MLA Compliance Guide here.

***

Upcoming Webcasts:

What's New and Next in Regulatory Affairs – get the latest in what's coming from Washington from NAFCU's Regulatory Affairs team. The team will provide you with an update on recent rules and upcoming regulations from credit union regulators, including the Consumer Financial Protection Bureau (CFPB) and National Credit Union Administration (NCUA).  On-Demand Starting October 3.

How to Detect and Prevent Employee Fraud

Tuesday, October 24 | 2:00 p.m. – 3:30 p.m. ET

CFPB Supervisory Highlights; More HMDA Guidance

Written by: André B. Cotten, Regulatory Compliance Counsel

Hello, Compliance Friends. We are counting down the days to San Diego. The NAFCU Compliance Team will be hosting our Regulatory Compliance School and Regulatory Compliance Seminar the week of October 9^th.

 On September 12, 2017, the CFPB issued its latest supervisory report sharing a plethora of observations from recent examinations and other supervisory activities. The report covers issues observed by the Bureau in the areas of automobile loan servicing, credit card account management, debt collection, deposits, and fair lending. Other topics, such as small-dollar lending, collection, mortgage origination, and mortgage servicing were also addressed. Today's blog will provide some of the highlights of the Bureau's findings.

Automobile Loan Servicing. In recent examinations, CFPB examiners reviewed how servicers are overseeing repossession agents and how repossessions are conducted. The Bureau's report alleges that some servicers are repossessing vehicles after the repossession was cancelled due to a formal extension agreement or the borrower has made a payment.

In these instances, the servicers wrongfully coded the account as remaining delinquent, customer service representatives did not timely cancel the repossession order after borrowers made sufficient payments or entered agreement with the servicer to avoid repossession, or repossession agents had not checked the documentation before repossessing and thus did not learn that repossession had been cancelled.

As a result of the examiner's findings, the servicers implemented a system that requires repossession agents to verify that the repossession order is still active immediately prior to repossessing the vehicle, for example, through a specially designed mobile application for that purpose.

Credit Card Account Management. The Bureau examiners noted that generally their supervised entities are complying with Federal consumer financial laws.

However, CFPB examiners observed that one or more credit card issuers violated Regulation Z by failing to provide the requisite tabular disclosures with the account opening materials provided to numerous cardholders. The entities in question acknowledged the violations with examiners and initiated a review to ensure that the errors were limited, the root causes were identified, and corrective actions were developed.

CFPB Supervision also reviewed the calls between customer service representatives and consumers. The review revealed customer service representatives routinely veering from or abandoning their scripts, which resulted in misrepresentation and higher fees for consumers. To mitigate the deceptive practice, entities established more effective controls over communications to consumers, ensured representatives informed consumers of free payment options prior to authorization of an expedited phone payment and reimbursed fees to consumers impacted by the deceptive representations about the costs and availability of pay-by-phone options.

Debt Collection. The CFPB examiners noted that some entities made false representations to consumers about the effect on their credit score of paying a debt in full rather than settling the debt for less than the full amount. As the CFPB explained in a 2013 bulletin, representations about the impact of paying a debt on a consumer's credit score may be deceptive. The bulletin states that "in light of numerous factors that influence an individual consumer's credit score, such payments may not improve the credit score of the consumer to whom the representation is being made. Consequently, debt owners or third-party debt collectors may well deceive consumers if they make representations that paying debts in collection will improve a consumer's credit score." As a result of these findings, the entities in violation amended training materials to reflect this Bureau's guidance.

Deposits. The CFPB continues to examine financial institutions for compliance with Regulation E as well as review for any unfair, deceptive, or abusive acts or practices (UDAAPs) in connection with deposit accounts.

The CFPB examiners noted that several institutions are engaged in unfair acts or practices by placing hard holds on customer accounts to stop all activity when the institutions observed suspicious activity. These holds resulted in the consumers' accounts being locked, resulting in payments not being honored, deposits being rejected, and the consumer lacking access to his or her funds for as long as two weeks. The examination also found that some institutions also failed to clearly, consistently, and promptly communicate the nature and status of these holds.

As a result, the CFPB directed the institutions to cease unnecessarily placing hard holds on consumer deposit accounts and to develop and implement policies and procedures to clearly, consistently, and promptly communicate with consumers with respect to hard holds place on their accounts.

In addition, the CFPB's Supervisory Highlights also addressed deceptive statements about overdraft protection products. Examiners identified institutions engaged in a deceptive act or practice by misrepresenting their opt-in deposit overdraft protection products when answering inbound telephone calls from consumers, including that:

• The overdraft protection product applied to check, automated clearing house (ACH), and recurring bill payment transactions;
• The overdraft protection product allowed a consumer to withdraw more money than the daily ATM cash withdrawal limit and be subjected to only one overdraft fee; and
• The overdraft protection product would take effect on the same day as enrollment.

Supervision directed the depository institutions in violation to cease misrepresenting features of their overdraft protections products.

Fair Lending. In general, the CFPB examiners found deficiencies in oversight by board and senior management, monitoring and corrective action processes, compliance audits, and oversight of third-party service providers.

The Bureau's review also revealed data quality issues, which were related to a lack of complete and accurate loan servicing records, made certain fair lending analyses difficult or impossible to perform. The examiners attributed these data quality issues to significant weaknesses in compliance management system related policies, procedures, and service provider oversight.

These are just some of the highlights from the CFPB's report. The full report is available here.

More HMDA Guidance

On September 28^th, the CFPB released HMDA implementation materials to support the recently issued 2017 HMDA rule. The Bureau has updated the 2018 Institutional Coverage Chart, the 2018 Transactional Coverage Chart and the Key Dates Timeline.

You can find the materials here on the CFPB's HMDA implementation webpage.

OFAC Requirements for Blocked Property

Written by Stephanie Lyon, Regulatory Compliance Counsel

Last Friday, the Office of Foreign Assets Control (OFAC) released a notice reminding credit unions and other financial institutions that the annual report of blocked property is due by September 30th. As the annual filing is only one of the multiple OFAC requirements for blocked property, we thought it would be helpful to break down the other steps a credit union must take to meet its regulatory requirements.

In general, OFAC regulations require that credit unions block accounts and other property as well as reject unlicensed trade and financial transactions of certain countries, entities, and individuals. See, FFIEC BSA/AML Examination Manual, pp. 147. Aside from that, you may remember that NAFCU blogged earlier this year and noted that OFAC takes a risk-based approach to compliance so credit unions will have the flexibility of determining when and how to run transaction names through OFAC lists. So what happens once the credit union identifies property subject to a blocking program?

Place Funds in Interest-Bearing Accounts

Once the credit union has determined that funds need to be blocked, the blocked property must be placed into an interest-bearing account from which only OFAC-authorized debits may be made. See, 31 C.F.R. § 515.205(a). OFAC defines an interest bearing account as "a blocked account earning interest at no less than the maximum rate payable on the shortest time deposit in the domestic bank where the account is held: Provided however, That such an account may include six-month Treasury bills or insured certificates, with a maturity not exceeding six-months, appropriate to the amounts involved." 31 C.F.R. § 515.205(g).

If the phrase "interest-bearing account" raises a red flag for federal credit unions, it is because NCUA’s Truth in Savings rule prohibits federal credit unions from offering interest-bearing deposit (as defined in in the rule) and may instead offer dividend-bearing deposit accounts. See, 12 C.F.R. § 707, Supp. I, cmt. 707.2(i)-1. 

OFAC and other Treasury regulations are written in a bank-centric manner, so sometimes the language in these regulations have inadvertent construction issues. As there is no carve-out exception for federal credit unions in the section of the regulation that requires placing blocked funds in interest-bearing accounts, many credit unions have interpreted this requirement to mean a dividend-bearing account. To clarify this requirement, NAFCU contacted OFAC's compliance helpline and they agreed with the interpretation that depositing blocked property into dividend-bearing accounts would meet the requirement. However, it would be great to see this glitch clarified by NCUA or OFAC in actual guidance documents such as the NCUA AIRES Exam Questionnaire, OFAC FAQs, or the FFIEC BSA/AML Examination Manual so that federal credit unions could feel more comfortable relying on this interpretation.

As for whether the credit union has to create individual blocked property accounts or one account for all blocked property, OFAC does not have a preference as long as the credit union maintains an audit trail that allows it to determine specific ownership interest of blocked property. See, OFAC FAQs: Sanctions Compliance, Q.32.

Initial Report

Credit unions are also required to file a report of blocked property within 10 business days from the date that property becomes blocked. The report should detail the blocked property and also include information pertaining to payments or transfers that are rejected by the credit union because of a blocked program. See, 31 C.F.R. § 501.603(b)(1)(ii). In the initial report, the credit union must also certify that the blocked funds have been deposited into a blocked account. See, 12 C.F.R. § 501.603(b)(1)(ii).

To ensure all pertinent and required information is included in the initial report, credit unions can use the form provided by OFAC and electronically transmit it to: [email protected] or mail it to: Office of Foreign Assets Control, Compliance Programs Division, U.S. Treasury Department, 1500 Pennsylvania Avenue NW.—Annex, Washington, DC 20220. Credit unions should be aware that there is a separate form for rejected transactions that follows the requirements of section 501.604.

Annual Report

Finally, OFAC requires that credit unions provide a comprehensive list of all blocked property held as of June 30 of the current year by September 30. See, 31 C.F.R. § 501.603. The term blocked property only applies to property that is blocked pursuant to OFAC regulations and does not include property that has been unblocked by general or specific license even if it has not yet been returned to the owner. This means that if the credit union unblocked property on June 29th and returned this property by July 1st, it should not include information on the unblocked property in its annual report. However, note that the regulation also establishes record keeping requirements for all blocked transactions for a period of 5 years after the date of the transaction. See, 12 C.F.R. § 501.601.

The annual reports must be filed using Form TD F 90-22.50, Annual Report of Blocked Property and the form should be sent to [email protected]. In case of additional questions, OFAC recently updated its guidance on filling out the annual blocked property report. The guidance is especially helpful for credit unions with 20 or more blocked accounts as it allows for a spreadsheet instead of a PDF or word document to complete part B of the form.

There you have it— next time you get an OFAC hit subject to a blocking order, you hopefully won't have to go through the entire bank-centric regulation to figure out OFAC's requirements.

2018 Adjusted Threshold Levels for Truth in Lending Regulations (Regulation Z)

Written by Reginald Watson, Regulatory Compliance Counsel

Greetings compliance friends! My name is Reggie Watson, and I recently joined NAFCU as a Regulatory Compliance Counsel. Prior to NAFCU, I spent 3 years investigating financial fraud matters for DOJ's civil division. I am excited to join the Regulatory Compliance family here at NAFCU and look forward to working with all of you soon!

Just recently, the Consumer Financial Protection Bureau (CFPB) issued its annual inflation-based adjustments of certain threshold dollar amounts for transactions covered under Regulation Z (which implements the Truth in Lending Act). The changes include regulations under the Credit Card Accountability Responsibility and Disclosure Act of 2009 (CARD ACT), the Home Ownership and Equity Protection Act of 1994 (HOEPA), and the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act). The Bureau is required to adjust a variety of thresholds annually for inflation. These changes are based on the annual percentage change reflected in the Consumer Price Index in effect on June 1, 2017 and will become effective on January 1, 2018.

Credit Cards

Regulation Z prohibits a card issuer from imposing a fee for violating the terms or other requirements of a credit card account under an open-end (not home-secured) plan unless the fee “represents a reasonable proportion of the total costs” incurred for the violation, or is within the safe harbor provision of 12 C.F.R. section 1026.52(b). If a credit card issuer charges anything up to the safe harbor amount for certain violations, it is considered to be in compliance with Regulation Z. The threshold that triggers requirements to disclose minimum interest charges will remain at $1.00 in 2018.

The safe harbor amounts will also remain the same as in 2017:

• $27 for a first late payment; and
• $38 for each subsequent late payment over six months.

Ability-to-Repay/Qualified Mortgage

For dollar amounts related to determining a borrower’s ability to repay a transaction secured by a dwelling, the threshold for qualified mortgages in 2018 will require that total points and fees not to exceed:

• 3 percent of the total loan amount for a loan greater or equal to $105,158;
• $3,155 for a loan amount greater or equal to $63,095 but less than $105,158;
• 5 percent of the total loan amount for a loan greater or equal to $21,032 but less than $63,095;
• $1,052 for a loan amount greater or equal to $13,145 but less than $21,032; and
• 8 percent of the total loan amount for a loan less than $13,145.

Home Ownership and Equity Protection Act (HOEPA) Loans

Regulation Z sets additional requirements for high-cost mortgages. To be considered a high-cost mortgage, the transaction must be secured by the consumer’s principal dwelling and the APR and loan amount have to be over a certain threshold. For 2018, the total loan amount threshold will be increased to $21,032 and the adjusted points and fees must exceed 5% of the total loan amount. See, 12 C.F.R. § 1026.32(a)(ii). Loans below $21,032 will also be considered a high-cost transaction if the points and fees exceed the lesser of 8% of the total loan amount or $1,052.

For more information on Regulation Z's 2018 adjusted thresholds, see the CFPB's proposed rule in the Federal Register or their press release.

***

Free Webcast!

Equifax Data Breach: Your Vital Next Steps

Thursday, September 28 | 2:00 p.m. – 3:30 p.m. ET

Join NAFCU staff and Reed & Jolly attorney David Reed for this week's free webcast. You'll receive the essential information you need to prepare your credit union for the data breach aftermath.

Key Takeaways:

• Learn the steps to take to ensure your credit union isn't a victim of fraud
• Discover what programs to put in place to assist your members
• Understand how to do your due diligence when using Equifax in the future
• Know what you’re liable for, and how to ensure you have the appropriate coverage for any fraud claims
  

Treasury Addresses Housing Finance Reform at NAFCU's Congressional Caucus

Written by Ann Kossachev, Regulatory Affairs Counsel

Hi everybody! It's been a while, but I am glad to be back on the NAFCU Compliance Blog. I'm also eagerly awaiting my upcoming vacation because it has been busy here the past couple of weeks. As you all know, last week was NAFCU's Congressional Caucus. It was a huge success! Today, I want to discuss something one of the speakers talked about – the future of the government-sponsored enterprises (GSEs), Fannie Mae and Freddie Mac, and housing finance reform. Craig Phillips, Counselor to Treasury Secretary Steven Mnuchin, updated Caucus attendees on the Trump Administration's position and said that the goal is to work with Congress to craft legislation for comprehensive housing finance reform.

Most importantly, Mr. Phillips endorsed NAFCU's interest in and advocacy on housing finance reform. Mr. Phillips said the administration supports a level playing field on pricing and terms regardless of an institution's size and geographic location. This has always been one of NAFCU's primary positions and goals for housing finance reform. NAFCU is very pleased to have the support and endorsement of Mr. Phillips on this important principle and is optimistic that the current administration is on the side of credit unions in this debate.

As he outlined the administration's focus, Mr. Phillips acknowledged the important work credit unions do in their communities. Credit unions have a track record of serving their members by providing high quality mortgage products and services at fair prices. An essential component of credit unions' continued ability to provide such products and services is a steady and reliable source of liquidity through the secondary market, especially through products such as the 30-year, fixed rate mortgage. That's where the GSEs come in. Mr. Phillips said that the administration is committed to achieving long-term, sustainable housing finance reform, which includes:

(1) Removing the GSEs from conservatorship;

(2) Rationalizing the roles of all federal mortgage insurance and guarantee programs (FHA, VA, and USDA) and the mortgage-backed securities (MBS) programs of Fannie Mae, Freddie Mac, and Ginnie Mae; and

(3) Encouraging a vibrant role in the private sector, in part through more tailored regulations which allow bank and non-bank lenders to increase their share of originations.

The GSEs have been in conservatorship for nine years now and have consistently been profitable. All of those profits, however, have been sent to the Treasury Department on a quarterly basis as part of the terms of the government's bailout of the GSEs, based on the rationale of protecting taxpayers. Since the Treasury's initial advance of $187.5 billion to the two companies, both Fannie and Freddie have paid back that money and then some – an additional $83.4 billion to be exact. If another financial crisis strikes and the GSEs still do not have capital reserves, the GSEs could be forced to draw on their Treasury line of credit, at taxpayers' expense. These are the reasons why NAFCU supports allowing the GSEs to begin recapitalizing.

Although Secretary Mnuchin has publicly said that he expects the GSEs to continue to make their dividend payments to the Treasury, FHFA Director Mel Watt has indicated that he is very concerned by the GSEs' lack of capital and the risk it poses to the economy. Allowing the GSEs to rebuild their capital buffers would ensure a more safe and sound economic system, increase investor confidence, and prevent market disruption. This would, in turn, likely mean increased liquidity in the housing finance system. That means more opportunities for credit unions and greater access to the secondary market. NAFCU hopes that Mr. Phillips' endorsement of NAFCU's advocacy on housing finance means that the administration is considering the option of GSE recapitalization.

During his speech, Mr. Phillips also said that Treasury supports the GSEs' release from conservatorship as part of comprehensive housing reform legislation. This is another position NAFCU supports; although NAFCU further believes that any privatization efforts should be gradual to ensure credit unions have uninterrupted access to the secondary mortgage market. Mr. Phillips acknowledged that minimizing the transition is critically important to maintaining a stable market.

In addition, Mr. Phillips said that protecting the interest of taxpayers is critical. He pointed out that part of this mission includes considering an explicit government guarantee for federally-sponsored MBS and adequate protections to make such a guarantee feasible. Yet another position NAFCU supports. An explicit government guarantee on the payment of principal and interest on MBS injects certainty into the market, particularly for investors, and allows for the more consistent movement of liquidity through the mortgage market.

Credit unions provide high quality mortgage products to help their members achieve their dreams of homeownership but cannot continue to do so without guaranteed access to the secondary market. This requires a safe and stable housing finance system. NAFCU is encouraged by Treasury's approach to housing finance reform, as outlined in Mr. Phillips' speech. NAFCU is thankful for Mr. Phillips' support of our interest in reforming the system and is looking forward to collaborating with the administration and Congress to find a solution for our nation's housing finance system. If you are interested in finding out more about NAFCU's position on housing finance reform, please review NAFCU's Housing Finance Reform Principles.

I Am the Very Model of a Modern Arbitration Clause

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

Happy Wednesday, Credit Union Compliance World. As you know, on July 10^th, the CFPB finalized its rule on arbitration agreements. We blogged about the basics of the rule and the epic hero's journey that is trying to identify its scope. On Monday, thankfully, the CFPB released its Small Entity Compliance Guide regarding the final arbitration rule. While the amount of footnotes involved in discussing the scope should be a clue to the Bureau that the rule is painfully technical, it is nice to have a version written in Standard American English.

Thanks to the Equifax breach and the breathtaking cascade of bungled responses in its aftermath, arbitration provisions are back in the limelight. If your credit union is seeking to help assist members affected by the breach, visit NAFCU's Equifax Data Breach Resources webpage. If you're angry, know that your feelings are valid and shared. We've written to Congress, the CFPB, the FTC and NCUA to ask them to take action to protect credit unions and their members. In the meantime, perhaps this is a good time to take a deeper look at the arbitration rule's language requirements.

From Agreements to Delegates, In Order Categorical

NAFCU has gotten a few questions about when it is appropriate to use the nine different model clauses included in the rule. Below is a breakdown of the various clauses in the rule and when and how they can be used.

Firstly, all Pre-Dispute Arbitration Agreements entered into on or after March 19, 2018 must include one of two alternative clauses for the agreement:

Citation	Language	When Required
§ 1040.4(a)(2)(i)	“We agree that neither we nor anyone else will rely on this agreement to stop you from being part of a class action case in court. You may file a class action in court or you may be a member of a class action filed by someone else.”	Generally, unless other language is applicable.
§ 1040.4(a)(2)(ii)	“We are providing you with more than one product or service, only some of which are covered by the Arbitration Agreements Rule issued by the Consumer Financial Protection Bureau. The following provision applies only to class action claims concerning the products or services covered by that Rule: We agree that neither we nor anyone else will rely on this agreement to stop you from being part of a class action case in court. You may file a class action in court or you may be a member of a class action filed by someone else.”	Can be used at the credit union's option as an alternative to the generally required language when the agreement applies to multiple products or services, only some of which are covered under Part 1040.

In addition to the required clauses discussed above, the Bureau has also identified several optional, add-on clauses:

Citation	Language	When Required
§ 1040.4(a)(2)(iv)(A)(1)	“This provision does not apply to parties that entered into this agreement before March 19, 2018.”	Optional add-on to the above agreement clauses
§ 1040.4(a)(2)(iv)(A)(2)	“This provision does not apply to products or services first provided to you before March 19, 2018 that are subject to an arbitration agreement entered into before that date.”	Optional add-on to the above agreement clauses
§ 1040.4(a)(2)(iv)(B)	“This provision does not apply to persons that are excluded from the Consumer Financial Protection Bureau's Arbitration Agreements Rule.”	Optional add-on to the above agreement clauses

Finally, there are two add-on clauses for specific issues:

Citation	Language	When Required
§ 1040.4(a)(2)(iv)(B)	“This provision also applies to the delegation provision.”	For agreements that contain a delegation provision, the required clause must be included in each delegation provision. Alternatively, credit unions can add this language to the generally required clause to meet that requirement.
§ 1040.4(a)(2)(vi)	“However, the defendants in the class action may claim they cannot be sued due to their sovereign immunity. This provision does not create or waive any such immunity.”	Add-on language applicable for an entity that believes it has sovereign immunity from suit.

However, suppose a loan is originated by another lender after March 19, 2018, and the loan agreement includes a Pre-Dispute Arbitration Agreement, but it does not include either of the above required clauses. Perhaps the originating lender was exempt.

Imagine that then, a credit union purchases the loan and steps into the shoes of the original lender with regard to the agreement. When the credit union becomes a party to the agreement established on or after March 19, 2018, and the agreement does not contain either of the required clauses, the Bureau requires the credit union to either amend the agreement to add the above clause or to provide the consumer with a written notice within 60 days. If a credit union opts to send the written notice, it must contain the below model language:

Citation	Language	When Required
§ 1040.4(a)(2)(iii)	“We agree not to rely on any pre-dispute arbitration agreement to stop you from being part of a class action case in court. You may file a class action in court or you may be a member of a class action filed by someone else.”	Written notice language applicable when the agreement only applies to covered products and services.
§ 1040.4(a)(2)(iii)	“This notice applies only to class action claims concerning the products or services covered by the Arbitration Agreements Rule issued by the Consumer Financial Protection Bureau.”	Written notice language applicable when the agreement applies to some products, only some of which are covered under Part 1040.

The final rule and the commentary allow for few other changes; it discusses replacing pronouns and putting it into the same language as the rest of the agreement.

Hope springs eternal that Congress might take action to lift the regulatory burden of this rule with legislation. However, for those of you who are former scouts, you know it's wise to always be prepared. NAFCU members who have questions as they absorb this rule's implications can feel free to reach out to your NAFCU Regulatory Compliance Team.

CFPB Issues First No-Action Letter Under Project Catalyst

Written by Pamela Yu, Special Counsel for Compliance and Research

Last week, the CFPB announced the issuance of a no-action letter to Upstart Network, Inc., its first under the Bureau's Project Catalyst initiative.  The initiative, which launched in 2012, is intended to encourage consumer-friendly innovation in the financial marketplace. To do this, Project Catalyst is tasked with engaging with the innovator community, participating in initiatives that inform its policy work, and monitoring emerging trends in order to remain forward-looking. 

CFPB's Policy Statement on No-Action Letters

Under the Project Catalyst initiative, the CFPB in 2016 finalized a policy statement on no-action letters to reduce potential regulatory uncertainty and enhance compliance in specific circumstances where "a product holds the promise for significant consumer benefit and where there may be uncertainty around how the product fits within an existing regulatory scheme."  For example, the CFPB said the formal no-action policy could be appropriate for new products being developed by innovators in financial technology (fintech) or other startups that involve ground-breaking technology that did not exist, and thus wasn't contemplated, when existing regulations were first adopted.

The Bureau issued the policy statement on no-action letters under its authority in §1021 of the Dodd-Frank Act, which empowers the CFPB to exercise its authorities for the purpose of ensuring that markets for consumer financial products and services operate transparently and efficiently to facilitate access and innovation.  See, 12 U.S.C. 5512(b)(1). 

The no-action policy was designed to foster innovation by enhancing compliance with existing federal consumer financial law and regulation.  Essentially, the policy allows a fintech or other financial startup to seek a statement, or a "no-action letter," from the CFPB advising it that the Bureau has no present intention to recommend an enforcement or supervisory action against the entity for its new product or innovation.  Thus, fintechs concerned about running afoul of federal regulation can have the reassurance of knowing that they can bring a new product or service to market without worrying about whether the CFPB will be coming after them for a regulatory violation. 

Critics of the policy pointed out that a no-action letter would, in practice, offer little reassurance to innovators.  This is because the CFPB's no-action letters are merely a public declaration that the Bureau does not, at present, intend to pursue an enforcement action against a specific financial product or new innovation.  But, no-action letters are fact-specific, revocable at any time, and do not foreclose private enforcement or enforcement by any other regulator (such as NCUA).  In short, no-action letters are non-binding, non-enforceable, non-transferrable, and offer only limited protection to financial innovators.  The policy's clear shortcomings led some members of Congress to declare the no-action policy, and Project Catalyst as a whole, a "flop" (even after the CFPB released its optimistic Project Catalyst Innovation Highlights Report in October 2016).

Yet lo and behold, more than a year and a half after the CFPB announced its no-action policy, the Bureau has finally issued its first no-action letter under the Project Catalyst initiative.

Upstart Network, Inc. No-Action Letter

According to the CFPB's press release, Upstart Network, Inc. is a California-based online lending platform that evaluates consumer applications for personal loans like student loans, credit card refinancing, and debt consolidation, using traditional underwriting factors (e.g., credit score and income), as well as non-traditional information or alternative data (e.g., education and employment history). 

The brief no-action letter simply indicates that CFPB staff has "no present intent to recommend initiation of supervisory or enforcement action against Upstart with respect to the Equal Credit Opportunity Act" for Upstart's model for underwriting and pricing applicants.  Importantly, the letter clearly states that it is fact-specific and does not serve as a general endorsement of the use of any particular underwriting variables or modeling.  Also, the no-action letter is only temporary; it must be renewed after three years.  Keep in mind that the CFPB will likely be under different leadership by that time, which means there is the potential that, in just a few short years, Upstart could very well find itself in regulatory hot water after investing in technology and developing a platform that has been in the market only three years.  Very little reassurance, indeed…

As a condition to the no-action letter, Upstart has agreed to share information with the CFPB; the Bureau is hoping to learn more about alternative data sources to help "credit invisible" consumers, or those with a lack of credit history, gain greater access to credit.

I will be curious to see if, after a slow start, more financial innovators will participate in the CFPB's Project Catalyst initiative, and whether the CFPB will be issuing more no-action letters in the near-term.  The new administration has been vocal in its support for market innovation and economic growth and it will be interesting to see whether the issuance of its first no-action letter signals a shift in how the Bureau is doing things under this administration.  Stay tuned.

After the Equifax Epic Data Breach Fail - What Next?

Written by Shari R. Pogach, Regulatory Paralegal

One would have to have been hiding under a rock not to have heard about the massive Equifax data breach.  The credit reporting agency announced last week that a web application flaw exposed 143 million consumer records to hackers including credit card numbers for 209,000 U.S. consumers and what it described as "dispute documents" containing personal information for 182,000 U.S. consumers.   Equifax stated it discovered the intrusion on July 29.  On top of that, three senior executives sold shares worth almost $1.8 million in the days after the discovery on August 1 and August 2, although Equifax indicated the executives "had no knowledge that an intrusion had occurred at the time they sold their shares."  Equifax's response in responding to the situation fell short of expectations.

 

So what can a credit union do?  

There is no technical federal regulatory requirement for a credit union to notify its members or NCUA of a third party data breach.  A credit union is only required to notify members and NCUA when there has been a direct data breach of the credit union's system maintained by it or its third-party service provider.  That being said, member notification, in any data breach context, may help to mitigate against the risk of fraudulent or unauthorized transactions.  A credit union might also review any contractual agreements with Equifax to see whether and how this situation (arguably, this eventuality) was addressed and whether there are any contractual obligations for either party.

A credit union with a relationship with Equifax could conduct a vendor review if it believes it is appropriate, and question the security surrounding sharing and connections with outside parties. NCUA's Letter to Credit Unions 07-CU-13 and the enclosed Supervisory Letter No. 07-01 might be helpful, as would the Oversight of Third-Party Service Providers section of the Information Security booklet of the Federal Financial Institutions Examination Council's IT Examination Handbook.

What about helping credit union members?

How an individual credit union chooses to serve its members within this context is a business decision.   But a credit union can always provide members with resources such as:

• Equifax's  notification of the breach webpage, including identity theft prevention tips and regulatory contact information;
• Equifax's check for potential impact webpage;
• Equifax's enrollment for credit protection webpage – (note Equifax has backtracked its conditioning of credit protection services on arbitration agreements.);
• Equifax's FAQs on the breach;
• FTC's The Equifax Data Breach: What to Do webpage;
• Krebs on Security – The Equifax Breach: What You Should Know;
• IdentityTheft.gov provides consumer-facing guidance specific to the Equifax breach and specific to the information lost;
• CFPB blog post Identity theft protection following the Equifax data breach;
• MoneyWatch – Equifax data breach: How to protect your credit rating; and
• Members can be reminded of their ability to access their credit reports at AnnualCreditReport.com.

The scale of this breach means that every Social Security Number in the U.S. in conjunction with the associated name must be presumed to be public knowledge.  As a result, security experts are saying a Social Security Number should no longer be used to validate anyone's identity.  In addition it was reported yesterday, Visa and MasterCard are sending confidential alerts to financial institutions across the U.S. this week, warning that more than 200,000 credit cards were stolen from Equifax.  The data was downloaded in "one fell swoop" in mid-May 2017 and the “window of exposure” for the stolen cards was between November 10, 2016, and July 6, 2017.  The breach also impacted an undisclosed number of people in Canada and the United Kingdom but the official list of victim countries may not yet be complete.

The Equifax data breach has already led to the filing of more than 30 lawsuits seeking class-action status. One suit, filed in Portland, Oregon, is demanding up to $70 billion in damages.  Equifax executives can also expect to appear before Congress as a result of the breach.

***

Upcoming NAFCU webcasts:

Regulatory Orders: Getting Out and Staying Out

Tuesday, September 19 | 2:00 p.m. – 3:30 p.m. ET

Achieving Excellence in Consumer Reporting Compliance

Tuesday, September 26 | 2:00 p.m. – 3:30 p.m. ET

How to Detect and Prevent Employee Fraud

Tuesday, October 24 | 2:00 p.m. – 3:30 p.m. ET

CFPB Cracks Down on FCRA Violations

Written by Jennifer Aguilar, Regulatory Compliance Counsel

Last month, the CFPB fined JPMorgan Chase (JPMorgan) $4.6 million for various alleged violations of the FCRA. According to the consent order, the CFPB found that JPMorgan failed to have reasonable policies and procedures in place to ensure it provided accurate information to consumer reporting agencies, failed to inform consumers of the results of dispute investigations and failed to identify the consumer reporting agency on adverse action notices.

Policies and Procedures. The FCRA does not require financial institutions to provide information to consumer reporting agencies. However, if a financial institution elects to do so, the FCRA requires it to provide accurate information. Regulation V requires these financial institutions to have reasonable policies and procedures in place to ensure that information provided to consumer reporting agencies is accurate. The procedures should be designed based on the institution's complexity and scope of activities and updated periodically. The rule also requires institutions to consider the interagency guidelines in developing their policies.

While JP Morgan had policies in place, the CFPB found that these policies were insufficient to ensure it provided accurate information to consumer reporting agencies. The policies did not contain procedures for providing information to consumer reporting agencies and did not address quality assurance, systems testing or training. The policies were also not materially altered or revised anytime between 2005 and 2014. In addition to these specific deficiencies, the CFPB determined that the policies were not appropriate given the size and complexity of JPMorgan's operations. The consent order requires JPMorgan to implement and maintain reasonable policies and procedures that fully comply with the FCRA's requirements and adequately incorporate Regulation V's guidance.

The policies at issue related to the information JPMorgan provided to consumer reporting agencies about its deposit accounts. While the consent order does not attempt to determine whether JPMorgan was providing information to a party it believed was not a consumer reporting agency under the FCRA, it may be helpful to pause for a moment and review exactly who is a consumer reporting agency. The FCRA defines "consumer reporting agency" rather broadly:

"(f) The term “consumer reporting agency” means any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports."

While this certainly covers the big three credit reporting agencies – Transunion, Equifax and Experian – it is important to keep in mind that this also covers a variety of other agencies that may be collecting information other than credit information. Consumer reporting agencies also include "specialty" agencies that collection information regarding medical records or payments, residential history, check writing history, employment history and insurance claims. When reviewing or drafting your policies and procedures on providing information to consumer reporting agencies, remember they may need to cover more than just credit information.

Dispute Investigations. Both the FCRA and Regulation V have specific procedures financial institutions must follow when they receive a direct dispute from consumers regarding the accuracy of information contained in a consumer report. The rules require institutions to conduct a reasonable investigation within 30 days of receiving the dispute, inform the consumer of the results of the investigation and provide each consumer reporting agency with corrected information, if necessary. The CFPB determined that JPMorgan had received thousands of direct disputes between 2010 and 2014 and that JPMorgan failed to provide any notice to these consumers regarding the results of the investigation. Going forward, the consent order requires JPMorgan to inform consumers about the results of all dispute investigations.

Adverse Action Notices. If a financial institution bases any adverse action on information obtained in a credit report, the FCRA requires the institution to provide an adverse action notice. The notice must include the adverse action taken; the credit score disclosure; the name, address and telephone number of the consumer reporting agency that provided the consumer report; a statement that the consumer reporting agency did not make the adverse action decision and inform the consumer of his or her right to obtain a copy of the consumer report. The CFPB found that JPMorgan failed to include the name, address and telephone number of the consumer reporting agency on approximately 17,500 adverse action notices. The notices were later corrected, however, the consent order requires JPMorgan to provide this information on all future adverse action notices.

MLA and Prescreened Offers of Credit; Caucus Kickoff

Written by Brandy Bruyere, VP of Regulatory Compliance

Many credit unions use prescreened offers of credit and similar promotions to market products, especially credit cards. With the upcoming Military Lending Act compliance deadline for credit card products, credit unions have asked how the MLA impacts these kinds of offers, particularly for obtaining a safe harbor for covered borrower status.  The MLA addresses the issue, providing a longer timeframe for "firm offers of credit" such as those provided as part of prescreening programs. Specifically, 32 CFR 232.5(b)(3)(iii) indicates that a covered borrower check performed as part of a prescreened offer of credit would be within the safe harbor if the “consumer responds to that offer not later than 60 days after the time that the creditor had provided that offer to the consumer”.  Note that this 60 day timeframe is from when the offer is provided to the member rather than when the credit union performed the “covered borrower check," here's the relevant provision:

(3) Determination and recordkeeping; one-time determination permitted. A creditor who makes a determination regarding the status of a consumer by using one or both of the methods set forth in paragraph (b)(2) of this section shall be deemed to be conclusive with respect to that transaction or account involving consumer credit between the creditor and that consumer, so long as that creditor timely creates and thereafter maintains a record of the information so obtained. A creditor may make the determination described in this paragraph (b), and keep the record of that information obtained at that time, solely at the time—

[…]

(iii) The creditor develops or processes, with respect to a consumer, a firm offer of credit that (among the criteria used by the creditor for the offer) includes the status of the consumer as a covered borrower, so long as the consumer responds to that offer not later than 60 days after the time that the creditor had provided that offer to the consumer. If the consumer responds to the creditor's offer later than 60 days after the time that the creditor had provided that offer to the consumer, then the creditor may not rely upon its initial determination in developing or processing that offer, and, instead, may act on the consumer's response as if the consumer is initiating the transaction or applying to establish the account (as described in paragraph (b)(3)(i) or (ii) of this section). (Emphasis added.)

The preamble to the final rule contains a further discussion of the prescreened timing:

The Department has designed § 232.5(b)(3) in order to enable a creditor to conduct only one covered-borrower check within the permitted safe harbor at an early stage of the transaction or the relationship with the consumer, including at the time that the creditor develops a firm offer of credit to be provided to the consumer. However, in the scenario which describes what is commonly referred to as a “prescreened” offer of credit (set forth in § 232.5(b)(3)(iii)), the Department has placed a limitation on the amount of time that may lapse between the creditor's delivery of the prescreened offer and the creditor's reliance on its covered-borrower check that formed part of the basis of the offer. The Department believes that there will be many cases when a consumer who is not a covered borrower at the time that a creditor delivers its prescreened offer (which offer is predicated, in part, on that criterion) later responds to that offer, including after becoming a covered borrower…Accordingly, § 232.5(b)(3)(iii) provides that creditor may rely on its initial covered-borrower check so long as the consumer responds to that offer not later than 60 days after the date that the creditor had provided that offer to the consumer. If the consumer responds to the creditor's offer later than 60 days after the date that the creditor had provided that offer to the consumer, then the creditor may not rely upon its initial determination in developing that offer; instead, the creditor may (but still is not required to) act on the consumer's response as if the consumer is initiating the transaction or applying to establish the account... (Emphasis added.)

http://www.federalregister.gov/a/2015-17480/p-428

But what does it mean to "provide" the offer to the member? Is it the day the credit union places the offer in the mail? Or the day the member receives the offer? The MLA is not clear on this point, so some credit unions opt to take a conservative approach and calculate the 60 day window from when the offer is mailed.

Credit unions have also asked about preapproval or prequalification promotions. Note that the carve out is specifically for "firm offers of credit" – and the MLA does not define this term. Of course, "firm offer of credit" is a defined term under the Fair Credit Reporting Act, but this is not cross-applied by the MLA. However, the MLA preamble does reference "prescreened" offers, so the FCRA meaning may at least help when determining the scope of the MLA safe harbor in these cases. Also, the way the provision is written hints at the FCRA prescreen rules, describing offers that are "developed" using certain "criteria." Credit unions will need to determine which promotions are "firm offers of credit" where the covered borrower check would provide a safe harbor for up to 60 days after providing the offer.

***

Caucus Kickoff. NAFCU's Congressional Caucus starts today. Hundreds of credit union representatives will attend meetings with members of Congress and their staff to advocate on key issues, including regulatory relief. NAFCU also continues to advocate on important issues like the MLA in our constant efforts to create a better environment for credit unions. You can also participate by joining our Thunderclap campaign now to make "protect credit unions" a message that thunders across social media on September 12. By calling on Congress to help protect credit unions, you're ultimately calling on Congress to help America. For information on how your credit union can participate in these kinds of advocacy efforts, check out our Grassroots Action Center.

ADA Compliance: What's the deal with websites?

Written by: André B. Cotten, Regulatory Compliance Counsel

Hello, compliance friends! The NAFCU Compliance Team has recently noticed an increase in questions related to potential Americans with Disabilities Act (ADA) website requirements. Credit unions are always eager to help their members, and we've had many credit unions asking about the status of ADA regulations, especially for websites. Today's blog post is meant to provide a very high-level overview of the statutory framework, rulemaking and enforcement activity, and potential for litigation with regard to ADA website compliance.

How the ADA Applies to Credit Unions

Generally, the ADA is intended "to provide a clear and comprehensive national mandate for the elimination of discrimination against individuals with disabilities" and "to provide clear, strong, consistent enforceable standards" addressing such discrimination. See, 42 U.S.C. § 12101(b). The ADA is a complex, fact-specific area of law, and some states have their own statutes addressing similar issues, so consulting with counsel may be necessary to fully assess ADA legal issues and risks. One way the ADA applies to credit unions is through Title III of the Act, which sets standards for certain "public accommodations." Public accommodations include banks and other "service establishments," so these provisions have been interpreted to apply to credit unions. As a result, the ADA requires credit unions to meet standards for "newly constructed or altered places" and has wide-ranging implications that impact how to communicate with persons with disabilities, which ultimately impacts the issue of website accessibility.

ADA discrimination is broadly defined by five categories. The one most applicable to websites is a provision that prohibits excluding, denying services or treating members with disabilities differently because of a lack of "auxiliary aids and services." This generally involves accommodations for persons with vision and hearing related disabilities, providing aids and services like closed-captions, interpreters, Braille materials and similar tools.

There are exceptions such as if the credit union can show that offering services with auxiliary aids and services would fundamentally change the nature of the services, or providing an auxiliary aid would cause an "undue burden." However, these exceptions are generally interpreted narrowly. Overall, the definition of discrimination is highly technical and includes several legal terms of art that are somewhat clarified in the Department of Justice ADA regulations.  

Possible Litigation Risk

ADA website accessibility can present some litigation risk for businesses that are public accommodations, including credit unions. One way a credit union can run afoul of the ADA is by not taking the steps in regulations that address when "auxiliary aids and services" may be necessary to meet objectives like effective communication with individuals with disabilities.

An important question in assessing the risk involved in these issues is what are the possible penalties and damages for ADA violations that may stem from litigation. The ADA permits the DOJ to assess civil penalties, which are currently up to $75,000 for the first ADA violation, and up to $150,000 for additional violations. The ADA and its regulations do not authorize statutory penalties for plaintiffs. However, a court can force a business to meet accessibility standards as part of a private lawsuit and award plaintiffs their attorney's fees, costs and expenses in a suit. Additionally, litigation risk can stem from state statutes. Overall, the rise in litigation is a continuing trend that is in part influenced by the DOJ's previous rulemaking and enforcement activity.

Rulemaking Efforts and Enforcement

In 2010, the DOJ issued an advanced notice of proposed rulemaking (ANPR) aimed at starting the process for adopting formal standards for website accessibility. While acknowledging that neither the Act nor existing regulations "specifically address access to websites," the DOJ indicated its position that the ADA is broad enough to apply to websites.

After collecting information in 2010, the DOJ did not take further rulemaking action that would impose a clear standard for credit unions to follow with regard to website accessibility for persons with disabilities.

In regards to enforcement actions, during the Obama Administration, the DOJ intervened in private lawsuits on the issue of website accessibility, taking the same position set forth in the 2010 ANPR, which is the ADA is broad enough to apply to the websites of public accommodations like credit unions.

For example, on May 31, 2011, the DOJ entered into a settlement agreement with Wells Fargo, indicating that discrimination includes the failure to "provid[e] a website that is accessible to individuals with disabilities, including blind individuals who use screen readers to access web content that is visual and providing captions for deaf individuals . . ." While Wells Fargo committed to making its website more accessible as part of the settlement, the DOJ did not require specific standards to be followed.

In later cases, such as a consent decree with H&R Block in 2014, the DOJ went a bit further than in the Wells Fargo case and actually required H&R Block to commit to following a specific standard in making its website accessible that is known as the Web Content Accessibility Guidelines 2.0 Level A and AA. These are voluntary standards with a dozen separate components. The DOJ also required H&R Block to make not only its website accessible, but its mobile applications as well. Despite not adopting a formal website accessibility standard, the DOJ continued to require this standard in its enforcement actions.

Currently, the Title III rulemaking has been listed as "inactive" on the DOJ's most recent rulemaking agenda. It also appears that formalizing this rule is not a priority for the Trump administration, and it is unclear how the current administration will address these issues from an enforcement perspective. However, the risk for credit unions from private litigations remains active.

Conclusion

Moving forward, a credit union may need to consult with its local counsel to discuss the trends in jurisdictions where it operates relating to potential demand letters and lawsuit activities. Some credit unions may also consider adopting accessibility measures based on the potential litigation and reputation risks. There are also consultants that work to make websites accessible for persons with disabilities and perform ongoing work for changes in content over time which comes with various upfront and continuing expenses.

For further information, please see the March 2017 Monitor Compliance Article written by the VP of Regulatory Compliance, Brandy Bruyere.

 

Regulation E Lesser Known ODP and Compulsory Use Provisions

Written by Stephanie Lyon, Regulatory Compliance Counsel

The compliance team has seen a recent upsurge in Regulation E questions regarding same account terms and conditions for non-overdraft program users and automatic loan repayment requirements so we thought it would be useful to round them up in this blog.

Overdraft Program- Different Terms

We have written many blogs on the requirements of overdraft programs (ODP)—a quick recap is that credit unions must provide appropriate disclosures and obtain a member's opt-in before charging a fee for paying overdrafts for one-time debit card and ATM transactions. A question we often get regarding overdraft programs is whether the credit union can refuse to provide a debit card if a member chooses not to opt in to the overdraft program for one-time debit card and ATM transactions. This is a popular question as transactions made while the system is offline or those that place a hold will be processed regardless of whether the member's account will be overdrawn. So members that have not opted in to the credit union's ODP will benefit from having their overdrafts paid without incurring a fee, while the credit union will be on the hook for collecting the overdraft funds or eat the loss. Unfortunately this may be another one of those 'cost of doing business' issues Regulation E's consumer protections have created.

Section 1005.17(b)(3) of the regulation states that credit unions must provide the same account terms, conditions and features for members who opt in to the credit union's ODP as those who do not. This means that regardless of whether or not Member A opts in, they should have access to the same type of account as Member B who did opt in to ODP. So if the only reason the credit union does not want to offer ATM/debit cards to Member A is because of their opt-out status, the credit union could be running afoul of Regulation E as it may be considered to be offering different account terms on the basis of ODP opt-in/out status. The official interpretations to this section of the regulation gives more insight into what other things the credit union may not do, such as imposing different minimum balance requirements or account fees or offering account services such as bill pay only to those that have opted in.

A variation of this question is whether the credit union can take away a member's debit/ATM card because the member overdrafted their account and refused to opt in to the credit union's ODP. While this is not one of the examples used in the commentary of the rule as a prohibited practice, it still seems to fit within the above analysis in that taking away a member's card for not opting in could be considered offering different account services. See, 12 C.F.R. § 1005.17(b)(3).

Something to consider for excessive overdraft users is that credit unions are not obligated to pay any transactions that would overdraw a member's accounts, regardless of whether the member has opted in or not. So the credit union may want to look at declining one-time debit card and ATM transactions when possible, instead of allowing transactions that overdraw accounts for those members that have not opted-in.

Also, for members that have caused the credit union a loss, the credit union may be able to remove the member's debit card or share checking account privileges through a limitation or suspension of services policy. For more details of limitation or suspension of services, see this blog or this member-only article. However, it is important to understand that taking away debit card/share checking account privileges would not be because the member did not opt-in to the credit union's ODP, but because the member has abused their account through excessive overdrafts or created a loss to the credit union. Credit unions considering this option may want to set up a procedure that addresses members who constantly overdraft their accounts, have cause the credit union a loss or stay overdrawn for a longer time than acceptable to the credit union;  it is also important to apply the consequences uniformly to all members. Otherwise, the credit union may fall under the prohibition of giving members different account terms, conditions and features because of overdraft opt-in choices.

Automatic Loan Repayment- Compulsory Use

To make it easier for members, some credit unions offer to set up a member's account to automatically make biweekly, monthly or other payments to meet a borrower's loan repayment obligations. However, credit unions that offer these automatic repayment services should be aware that Regulation E, section 1005.10(e)(1) generally restricts offering extensions of credit conditioned on automatic repayments of the loan, specifically automatic payments that are preauthorized electronic funds transfers—this is what is referred to as compulsory use.

Regulation E does permit credit unions to offer incentives to members, such as a lower APR, if the member chooses to set-up automatic, recurring payments. The official interpretation to this section provides further clarification regarding this prohibition and permissible incentives. Here is a relevant excerpt:

Loan payments. Creditors may not require repayment of loans by electronic means on a preauthorized, recurring basis. A creditor may offer a program with a reduced annual percentage rate or other cost-related incentive for an automatic repayment feature, provided the program with the automatic payment feature is not the only loan program offered by the creditor for the type of credit involved.

12 C.F.R. § 1005, Supp. I, cmt. 1005.10(e)(1)-1.  So while voluntary agreements to make reoccurring automatic payments are permissible, mandatory ones are not.

***

Don't Miss Our Upcoming Webcasts:

BSA/AML Risk Assessment: Building a Program to Evaluate Risk and Ensure Compliance
Tuesday, September 12 | 2:00 p.m. – 3:30 p.m. ET 

Vendor Management Training
Wednesday, September 13 | 2:00 p.m. – 3:30 p.m. ET

Regulatory Orders: Getting Out and Staying Out

Tuesday, September 19 | 2:00 p.m. – 3:30 p.m. ET

Resources for Credit Unions Affected by Hurricane Harvey; Programming Note

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

The destruction caused by Hurricane Harvey in Texas, Louisiana and other places in the southeast is heart-breaking. The rain may have stopped over Houston, but the flooding continues to pose a real and active threat to the lives and livelihoods of those in and around the city. Our thoughts and prayers are with those in the hurricane's path and suffering in its aftermath. If you would like an opportunity to help communities affected by Hurricane Harvey by helping the credit unions that serve those communities, join me in donating to CUAid.coop.

Resources for Credit Unions Affected by the Hurricane

Disaster Assistance

The President has issued a disaster declaration, so disaster assistance is available for credit unions. NCUA issued a press release describing some available resources for affected credit unions including guaranteeing lines of credit for credit unions through the NCUSIF, making liquidity loans through the CLF, and rescheduling examinations to affected credit unions. Credit unions in Texas wanting to access these resources can contact the Region IV office in Austin at (512) 342-5600 (open Monday-Friday, 7am-5pm Central). Credit unions in Louisiana can contact the Region III office in Atlanta at (678) 443-3000 (open Monday-Friday, 7am-5pm Eastern).

NCUA’s Office of Small Credit Union Initiatives can provide urgent need grants of up to $7,500 to low-income credit unions that experience sudden costs to restore operations interrupted by the storm.

Grants from the National Credit Union Foundation's CUAid relief system are also available. Credit unions can apply for a Disaster Emergency Relief Grant through the Cornerstone Credit Union League here.

Credit unions that offer small business loans through the SBA may be interested in the Administration's Disaster Loan Program. The SBA's Hurricane Harvey Recovery website includes information about the SBA disaster assistance program and available 12-month payment deferments for borrowers in hurricane affected areas.

Reporting Closures and Damage

Section 748.1(b) of NCUA's rules and regulations does require all federally-insured credit unions to notify their regional director within 5 business days of any disaster which results in the physical destruction or damage to the credit union causing an interruption in vital member services, if the interruption is projected to last more than two consecutive business days.

Within a reasonable time afterwards, section 748.1(b) requires that credit unions make a report of the incident, filed in its main office, that records the office/s where the disaster occurred, when it took place, the amount of damage or loss, any operational or mechanical deficiencies that might have contributed to the loss or damage and what has been done or is being done to correct those deficiencies.

State-chartered credit unions may need to report closures and damage to their state-chartering authorities as well. Notices of temporary closings, reports of physical damage, and requests for resources can be made to the Texas Credit Union Department by phone at (512) 837-9236, by fax at (512) 832-0278, or by email at [email protected]. The Department has released a Hurricane Harvey Advisory for Texas Credit Unions.

Notifications of closures can be made to the Louisiana Office of Financial Institutions by fax at (255) 925-4548 or (255) 925-4524 or by email at [email protected]. The office has issued guidance to Louisiana-chartered financial institutions and an Emergency Preparedness Guide & Event Script as well.

Resources for Members

Credit unions may receive calls from affected members regarding flood insurance. FEMA has a host of resources for those affected by Hurricane Harvey, including information on the National Flood Insurance Program and forms and instructions for filing claims.

Closed credit unions who participate in Co-Op Shared Branching can refer their members to the locator website to find open credit unions and ATMs to access their funds.

Credit union members with questions about their Share Insurance coverage may contact the NCUA’s Consumer Assistance Center at (800) 755-1030 Monday through Friday between 8 a.m. and 5 p.m. Eastern.

NAFCU is here to serve credit unions while they serve their communities. Credit unions can access additional resources on our webpage. Please let us know how we can help.

Programming Note

NAFCU's office will close at noon today and will also be closed on Monday for Labor Day. We will be back to blogging on Wednesday. Everyone have a safe Labor Day weekend.

A Little of This, A Little of That in the Waning Days of August.........

Written by Shari R. Pogach, Regulatory Paralegal

The Financial Crimes Enforcement Network (FinCEN) recently issued revised Geographic Targeting Orders (GTO) to target shell companies buying luxury properties.  Transactions conducted in Honolulu, Hawaii, are now included under the revised GTO, making a total of seven major metro areas where U.S. title insurance companies are required to identify the natural persons behind shell companies used to pay for high-end real estate.  The August 22, 2017, revised GTO also has broadened the transaction categories to now include wire transfers.  Any covered transaction made "without a bank loan or other similar form of external financing; and ...  made, at least in part, using currency or a cashier’s check, a certified check, a traveler’s check, a personal check, a business check, or a money order in any form, or a funds transfer" must be reported to FinCEN.

In addition to the revised GTO, FinCEN released FIN-2017-A003 to provide financial institutions and the real estate industry with information on the money laundering risks associated with some real estate transactions.  The guidance provides some red flag activity and case examples.  FinCEN also has a frequently asked questions document here.

***

FFIEC BSA/AML Examination Manual Update.  Word on the street is that an interagency group of federal banking regulators has started working on amending the Federal Financial Institutions Examination Council’s Bank Secrecy Act exam manual to account for the new customer due-diligence rule issued by the Financial Crimes Enforcement Network last year.  No details as yet on how in depth the updated manual and standalone sections on the Customer Due-Diligence Rule will address the extent to which financial institutions will have to obtain and verify beneficial ownership data from existing clients or which of the rule's provisions will be prioritized for enforcement. 

***

Useful Tools.  Our credit union industry friend, Andy Keeney, of Kaufman & Canoles, has provided you with these two useful resource tools:  NCUA's List of Required Policies for Board of Directors of Credit Unions and Credit Union Board Compensation by State.

***

Upcoming NAFCU Webcasts.

CUSO Rules and RegulationsWednesday, September 6 | 2:00 p.m. – 3:30 p.m. ET

BSA/AML Risk Assessment: Building a Program to Evaluate Risk and Ensure ComplianceTuesday, September 12 | 2:00 p.m. – 3:30 p.m. ET 

Vendor Management TrainingWednesday, September 13 | 2:00 p.m. – 3:30 p.m. ET

***

A Final Laugh.  Here, courtesy of Payments.com are a few quick stories of some incompetent bank robbers to hopefully give you a chuckle, because we all just need a laugh once in a while.

CFPB Finalizes HMDA Corrections, Temporary Increase to HELOC Thresholds; Filing 2017 HMDA Data

Written by Brandy Bruyere, VP of Regulatory Compliance

On Thursday, the CFPB published a final rule amending the 2015 Home Mortgage Disclosure Act rule. This finalizes technical changes and amendments that the Bureau proposed back in April 2017 while also finalizing a July 2017 proposal to increase the reporting threshold for open-end home equity loans from 100 loans to 500 loans. The regulatory references to HMDA below are not to the current version of the rule, but the rule as amended in 2015 (and further amended by last week's rule).

Technical Amendments. First, here is a summary of a few of the key amendments to the HMDA rule.

• Counteroffers. Section 1003.4(a)(8)(i) requires credit unions to report the action taken on covered loans and applications. Comment 4(a)(8)(i)– 9 explains how to report the action taken for a counteroffer where the applicant does not accept the counteroffer or fails to respond. The final rule amends comment 4(a)(8)(i)–9 to broaden the possible actions taken that could be reported in these situations, adding the following:

"…If the applicant agrees to proceed with consideration of the [credit union's] counteroffer, the [credit union] reports the action taken as the disposition of the application based on the terms of the counteroffer. For example, assume a [credit union] makes a counteroffer, the applicant agrees to proceed with the terms of the counteroffer, and the [credit union] then makes a credit decision approving the application conditional on satisfying underwriting or creditworthiness conditions, and the applicant expressly withdraws before satisfying all underwriting or creditworthiness conditions and before the institution denies the application or closes the file for incompleteness. The [credit union] reports that the action taken as application withdrawn in accordance with comment 4(a)(8)(i)–13.i. Similarly, assume a [credit union] makes a counteroffer, the applicant agrees to proceed with consideration of the counteroffer, and the [credit union] provides a conditional approval stating the conditions to be met to originate the counteroffer. The [credit union] reports the action taken on the application in accordance with comment 4(a)(8)(i)–13 regarding conditional approvals."

• Temporary and Construction-only loans. Section 1003.3 specifies which transactions are excluded from HMDA reporting. The Bureau finalized clarifying changes to comment 3(c)(3)–1 and to add new comment 3(c)(3)–2 to specify that a construction-only loan or line of credit is considered temporary financing and excluded under § 1003.3(c)(3) if the loan or line of credit is extended to a person exclusively to construct a dwelling for sale. Here's the new comment:

"…Loan or line of credit to construct a dwelling for sale. A construction-only loan or line of credit is considered temporary financing and excluded under § 1003.3(c)(3) if the loan or line of credit is extended to a person exclusively to construct a dwelling for sale. See comment 3(c)(3)–1.ii through .iv for examples of the reporting requirement for construction loans that are not extended to a person exclusively to construct a dwelling for sale."

• Loan purpose for purchased loans originated before January 1, 2018. Section 1003.4(a)(3) requires credit unions to report the purpose of a covered loan or application. Categories include home purchase, home improvement, or refinancing, an “other” category, and a cashout refinancing category. The Bureau is adding new comment 4(a)(3)–6 to clarify that, for purchased covered loans where the origination took place before January 1, 2018, a credit union complies with § 1003.4(a)(3) by reporting that the requirement is not applicable.

There are many more technical amendments and NAFCU is still reviewing the final rule. In the coming weeks, we will publish a Final Regulation for members providing a summary of the changes as well as a consolidated regulatory text so stay tuned.

Amended Open-end Line of Credit Threshold.

Section 1003.2(g) contains an institutional coverage test as one of five criteria for determining if a credit union is a "financial institution" subject to HMDA reporting. This is detailed in a past NAFCU Compliance Blog post, here's some of the commentary explaining the test as originally adopted:

"Originations. Whether an institution is a financial institution depends in part on whether the institution originated at least 25 closed-end mortgage loans in each of the two preceding calendar years [January 1, 2017] or at least 100 open-end lines of credit [January 1, 2018] in each of the two preceding calendar years. Comments 4(a)-2 through -4 discuss whether activities with respect to a particular closed-end mortgage loan or open-end line of credit constitute an origination for purposes of § 1003.2(g)."

The Bureau is amending HMDA effective January 1, 2018, to increase the open-end threshold from 100 to 500. However, this increase is only temporary – effective January 1, 2020, the threshold will revert to 100 open-end lines of credit.

Reporting 2017 HMDA Data (and Beyond). We've had some credit unions ask us about reporting methods for 2017 HMDA data. Currently, and in the past, the FFIEC has collected and processed HMDA data for the CFPB, OCC, FDIC and NCUA. Currently, for 2017 reporting of 2016 data, Appendix A still points credit unions to the FFIEC for reporting.

As we've noted before, the CFPB is developing a web-based submission tool which will be intaking and processing HMDA data on behalf of the agencies. See, 80 Fed. Reg. 66246. That tool will be used for the submission of 2017 data in 2018. Beginning in 2018, Appendix A will direct reporting credit unions to use the CFPB website and it's submission tool/HMDA platform, which should be ready in the 4^th quarter of this year for testing.

Some credit unions have asked if submissions by mail will still be an option. Currently, subsection II.A. in Appendix A states "If…you elect to submit your data by regular mail, then use the following address: […]" and provides the FRB address for mailing data. As of January 1, 2018, the submission instructions in Appendix A will no longer contain any instructions for submission via regular mail, only instructions for submission through the CFPB's portal.

Beginning in 2019, Appendix A will be entirely removed and new section 1003.5(a)(5) will direct reporting institutions to the instructions on submitting data which will live in a separate document on the Bureau's website. The reporting in 2019 will be done under the new rule, meaning the inclusion of instructions for submitting the new data collected in 2018. However, the actual method of submission – the CFPB's HMDA Platform – will have already been used in 2018 while submitting 2017 data.

Another MLA FAQ: Is the Credit Card Rule Retroactive?

Written by Jennifer Aguilar, Regulatory Compliance Counsel  

Over the past several months, the NAFCU Compliance Team has written a few blogs on various aspects of the MLA credit card rules: Bona Fide Fee Exemption; Late Fees, Returned Payment Fees and More and Researching Call Reports and Card Agreements. With the credit card compliance deadline fast approaching, we continue to receive a number of questions on the MLA and its various credit card rules. Today's blog will focus on one particular issue that has come up for various credit unions lately: whether the rules apply retroactively.

The scenario goes somewhat like this: Jane Member opens a credit card before the compliance deadline. Jane is a covered borrower at the time she opens the credit card and remains a covered borrower throughout the life of the credit card. Does the MLA apply to transactions Jane makes on her credit card after October 3? What if Jane requests an increase in her credit limit after October 3, is the credit card now covered by the MLA?

Section 232.2 explains that the MLA applies to "consumer credit" extended to a "covered borrower," as determined at the time the member "becomes obligated on a credit transaction or establishes an account for credit." This suggests that whether a particular transaction is covered by the MLA is determined at consummation. This is supported by the fact that sections 232.12 and 232.13 state the rules do not "apply to [a credit card account] that is extended and consummated before October 3, [2017]." This is further supported by a couple different discussions in the preamble to the final rule:

"The Department proposed to add new subsection (a), stating: “Nothing in this part applies to a credit transaction or account relating to a consumer who is not a covered borrower at the time he or she becomes obligated on a credit transaction or establishes an account for credit.” The Department continues to believe that defining the scope of the regulation to apply only to a covered borrower when he or she enters into a transaction or establishes an account for consumer credit is consistent with the language and structure of 10 U.S.C. 987.[167] Interpreting 10 U.S.C. 987 as applying only to a covered borrower who holds that status when he or she agrees to obtain the consumer credit is fair to the creditor who, at the outset of the transaction, should be in a position to know the status of its counterparty to the agreement." (Emphasis added.) See, 80 Fed. Reg. 43579.

Section 232.12(b) provides a general rule that the definitions, conditions, and requirements of the existing rule apply to transactions involving consumer credit that are consummated or established prior to the compliance date. Relative to the Proposed Rule, the language in § 232.12(b) has been revised to clarify that the “definitions, conditions, and requirements” of the existing rule apply. The Department believes that this provision is equitable, particularly to avoid the potential injustice and operational difficulties that could arise if new requirements under the final rule were to apply to pre-existing transactions or accounts involving consumer credit to covered borrowers. (Emphasis added.) See, 80 Fed. Reg. 43591.

All this together seems to indicate that by “establishing” an account or “extending” credit the DOD was referring to consummation. The preamble discussion indicates that the DOD believes that credit unions are in the best position to determine whether a transaction is covered at the outset and there is no ongoing requirement to ensure the transaction is still not covered. The preamble also explains that the DOD does not expect credit unions to apply the rules retroactively to existing accounts as this may cause unnecessary operational problems. If an account was not covered at consummation, it will not become covered later on.

The DOD appears to apply the same logic to certain changes to existing credit accounts. Increasing a credit is not considered "extending" credit under the MLA if the account and its terms are already established:

"A comment on behalf of certain credit card issuers seeks clarification regarding the potential effects of certain 'customer management actions, such as credit line increases.' The Department believes that an action by a creditor within an existing account, such as to increase the available credit that a consumer may draw upon in an account, does not alter the status of the creditor's prior determination for that account." (Emphasis added.) See, 80 Fed. Reg. 43578.

While the DOD specifically includes credit limit increases as actions within an existing account, it does not expand on what other actions may be "within an existing account." Whether other actions, such as adding a joint owner or changing a rate, will trigger MLA protections is unclear from the rule.  For these changes, a credit union may need to review its underwriting process and internal procedures to make a determination whether new credit is being extended or a member is becoming obligated on or establishing credit. Some considerations may be whether the credit union performs new underwriting, whether the member will take on any new or different legal obligations, or whether new agreements or disclosures will be provided. The credit union may also want to reach out to its attorney to assist the credit union in making a determination or assessing the particular legal risks involved.

Complaint Management and a Review of NCUA's Complaint Process

Written by André B. Cotten, Regulatory Compliance Counsel

Hello, compliance friends! As a millennial, before trying a new restaurant, traveling somewhere new or even a joining a new credit union, I like to at least do some research. Normally, I try to read reviews from various sources to ascertain a broad sense of the market's feedback. As people continue to grow more reliant on the opinions of others, I want to explore what this may mean for credit union complaints and how credit unions can potentially mitigate this risk.

From a reputational risk perspective, a member complaint going viral presents a huge threat to credit unions. To mitigate this risk, a well-designed and properly implemented complaint management program is a tool that can uncover noncompliant business practices. Strong complaint management programs also can improve member service by providing members with an easy-to-use method of resolving issues.

Note: as a credit union considers their complaint management system, the credit union may also want to review and define what constitutes a "complaint" so that staff understands when escalation to the complaint resolution process is necessary. The credit union may also want to institute appropriate training on these policies for any staff members that resolve complaints or may have the opportunity to receive a complaint from a member. It is also important for policies and procedures to include how and when responses should be made, including any regulatory time limitation, i.e. Regulation E's error resolution process.

More importantly, regulators are increasingly focusing on member complaints as a source of future regulation and as an examination trigger. A comprehensive complaint management process allows a credit union to prevent and reduce regulatory violations through self-identification and correction. Alternatively, complaint data can validate a credit union's controls in some areas and indicate risks and the need for training in others.

NCUA Complaint Process

In June 2015, NCUA issued Letter to Credit Unions 15-CU-04 advising that the agency had changed its complaint-handling process to allow credit unions 60 days to resolve most consumer complaints before the NCUA Consumer Assistance Center intervenes. The consumer complaint process has two distinct phases: 1) attempted resolution by the credit union and 2) investigation by the Consumer Assistance Center.

During the first phase, NCUA forwards the complaint to the chairman of the appropriate credit union committee, and the credit union then has the opportunity to review the complaint and has 60 days to attempt its resolution. During the complaint resolution process, the credit union is encouraged to communicate directly with the member. NCUA also recommends the credit union respond in writing to the member, with a copy of the letter going to the Consumer Assistance Center, referencing the case number and whether it was able to resolve the complaint.

The second phase involving a formal investigation will begin if the Consumer Assistance Center does not receive a written response from the credit union within the 60-day time frame or if a response is received advising no resolution was possible. Conversely, if the Consumer Assistance Center is notified in writing within the 60-day period that the matter has been resolved, it will close the case. However, the member retains the right to dispute the resolution of the complaint in writing, within 30 calendar days of the credit union's response letter. A member dispute may also trigger a formal investigation.

Elements of a Comprehensive Complaint Management Program

A comprehensive complaint management program consists of the following: policies and procedures; clear channels of communication; an investigation process; written response; maintaining records; corrective action; and retaining, organizing and analyzing complaint data.

A credit union's written policies and procedures regarding the handling of complaints is critical in creating fair, consistent and timely resolution of complaints. A credit union may also want to establish policies and procedures for both complaints received from a member directly, as well as a complaint received from a regulatory body.

The Office of Consumer Financial Protection and Access's guidance recommends establishing channels to receive member complaints and inquiries such as telephone numbers or email addresses dedicated to receiving this type of correspondence.

After a credit union receives a complaint, the method of investigation depends on the nature of the complaint. However, an investigation may include: interviewing the member; reviewing the member's account information and history; interviewing appropriate credit union officials and staff; reviewing pertinent written and unwritten policies and procedures; reviewing multiple loans to determine the actual practices of the credit union; and reviewing relevant laws and regulation.

Once the investigation is complete, both the supervisory committee guide and the OCFPA recommend that responses to complaints be provided to the member in writing. A written response allows the credit union to explain the resolution of the complaint to the member in a precise and clear manner, as well as creating a record of the date and manner in which the complaint was resolved.

If the investigation of a complaint leads to the discovery of illegal, improper, unfair or discriminatory practices at the credit union, it is critical that the discovery leads to change in that practice. The credit union may also consider developing procedures to address or correct illegal or improper practices. For example, a credit union's recommendation for corrections could include a change to policies and procedures, additional compliance training and monitoring, and updating tools, systems and written materials.

Lastly, collecting and logging complaint data has the potential to reveal a wealth of information. The credit union may want to consider refining its data indicators to better categorize, organize, and analyze complaint data. Theoretically, analyzing complaint data provides a credit union with the opportunity to address trends, isolate areas of risk, identify weakness in controls and self-identify compliance violations.

A comprehensive complaint management system can lead to cost efficiencies by preventing member loss, allowing for self-identification and correction of regulatory violations, and preventing litigation by preemptively fully resolving member complaints.

Please see the Office of Financial Protection and Access for additional complaint management guidance: https://www.ncua.gov/About/leadership/Pages/consumer-protection.aspx

Changes to Foreign TIN Collection Requirements for IRS W-8BEN Form

Written by Stephanie Lyon, Regulatory Compliance Counsel

Back in January 2017, The IRS made a few modifications to its Certificate of Foreign Status of Beneficial Owner for United States Tax Withholding and Reporting for Individuals (W-8BEN form). This form is filled out and returned to credit unions by individual nonresident aliens who are the beneficial owners of an amount subject to withholding. Sources of income that non-resident members may receive from the credit union subject to withholding can be dividends. This is why many credit unions try to obtain a W-8BEN form when a nonresident member opens a share savings account.

While NAFCU Compliance team does not have expertise in tax law, we thought it may be helpful to highlight some of these changes as many credit unions serve international members. For more complex tax law issues, the credit union may want to consult with its tax attorney/professional. The IRS also has a hotline service that is free and available to tax reporting credit unions and may help answer questions on IRS regulations and guidance documents—1-866-455-7438.

The final rule implemented by the IRS requires that credit unions obtain certain information from individual nonresident aliens such as their foreign tax identifying number (TIN) and date of birth on a withholding certificate. See, Instructions for Form W-8BEN (Rev. July 2017). Here is an image of Part I to the form where this information can be recorded:

Beginning in January 2018, if a member does not have a foreign TIN the credit union will be required to obtain a "reasonable explanation" as to why this information was not collected. See, 82 Fed. Reg. 2051. So what exactly is a "reasonable explanation"? According to the 2017 instructions, a reasonable explanation for not providing a foreign TIN could be the following:

… a statement that you are not legally required to obtain a TIN in your jurisdiction of tax residence. The explanation may be written on line 6, in the margins of the form, or on a separate attached statement associated with the form. If you are writing the explanation on line 6, you may shorten it to “not legally required.” Do not write “not applicable.” In addition, if you are not using this form to document a financial account described above, you may provide the TIN issued to you by your jurisdiction of tax residence on line 6 for purposes of claiming treaty benefits (rather than providing a U.S. TIN on line 5, if required).

Under the IRS instructions, if a member is a resident of country that does not issue TINs (i.e. Cayman Islands, Bermuda and Montserrat), a reasonable explanation may look like this:

It is important for credit unions to understand this new requirement as the IRS makes the credit union liable for the withholding and collection of the tax. See, 26 U.S.C. § 1474(a). In the case that the requirements for waiver of withholding are not met, such as when a W-8BEN is not filled out or is improperly filled out, the credit union must collect the full 30 percent tax. 26 U.S.C. § 1472(a)(2). The instructions on the W-8BEN form states:

…Failure to provide a Form W-8BEN when requested may lead to withholding at the foreign-person withholding rate of 30% or the backup withholding rate under section 3406.

***

I know IRS rules can be somewhat dry so I am sharing a picture of my younger sister (who is visiting from Spain for the rest of the summer) and the activities we did on our recent trip to NYC. We had incredible Italian food, saw Anastasia on Broadway and took every tour imaginable—all in 36 hours! Talk about enjoying every minute of the day…

Next week, I am taking her to Universal Studios in Orlando. We cannot wait to visit the Wizarding World of Harry Potter^TM where we will meet up with my older sister who's already scouted out the theme park for us:

Breaking Down the TRID Fix: It's the Same with Affiliates, Only Different

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

As we tackle the painful job of picking apart the CFPB's TRID "Fix" final rule, we are reminded again of the Bureau's deep appetite for technical minutiae. It's a regulation in the style of ancient filigree, complex to behold and not particularly easy to use. Identifying and absorbing these hyper-intricate changes is just step one in the mission to actually understand what will change for credit unions who have to use this rule.

So, today, we are going to look at one piece of the amendments: clarification regarding costs paid to affiliates for which there is no applicable tolerance.

Paragraph 19(e)(3)(iii) Amounts Paid To Affiliates

Paragraph 19(e)(3)(iii) is the paragraph that describes the five categories of charges for which there is no applicable tolerance or comparison to the Closing Disclosure to determine good faith. Currently, it reads like this:

"(iii) Variations permitted for certain charges. An estimate of the following charges is in good faith if it is consistent with the best information reasonably available to the creditor at the time it is disclosed, regardless of whether the amount paid by the consumer exceeds the amount disclosed under paragraph (e)(1)(i) of this section:

(A) Prepaid interest;

(B) Property insurance premiums;

(C) Amounts placed into an escrow, impound, reserve, or similar account;

(D) Charges paid to third-party service providers selected by the consumer consistent with paragraph (e)(1)(vi)(A) of this section that are not on the list provided pursuant to paragraph (e)(1)(vi)(C) of this section; and

(E) Charges paid for third-party services not required by the creditor. These charges may be paid to affiliates of the creditor." 12 C.F.R. § 1026.19(e)(3)(iii) (Emphasis added).

As you can see, the phrase "[t]hese charges may be paid to affiliates of the creditor" is attached only to subparagraph (E). In the proposal, the Bureau stated:

"The Bureau understands that there is uncertainty whether all five of the § 1026.19(e)(3)(iii) categories include charges paid to affiliates of the creditor or if only the § 1026.19(e)(3)(iii)(E) category (i.e., charges paid for third-party services not required by the creditor) includes charges paid to affiliates of the creditor. The Bureau believes there are reasonable arguments to support either of those interpretations under the current rule but is proposing to change the rule prospectively so that all five categories expressly include charges paid to affiliates." 81 Fed. Reg. 54332.

In exchange for choosing the more expansive of these possible interpretations, the CFPB is adding a caveat: a charge paid to an affiliate must be "bona fide" in order for it to have no applicable tolerance rules. The Bureau stated that this addition was intended to limit any potential harm associated with allowing variations without regard to tolerances on charges paid to affiliates.

In the final rule, the Bureau moves the phrase addressing affiliates out of sub-paragraph (E) and into paragraph 19(e)(3)(iii) itself, and adds the language about the charges being bona fide:

"(iii) Variations permitted for certain charges. An estimate of any of the charges specified in this paragraph (e)(3)(iii) is in good faith if it is consistent with the best information reasonably available to the creditor at the time it is disclosed, regardless of whether the amount paid by the consumer exceeds the amount disclosed under paragraph (e)(1)(i) of this section. For purposes of paragraph (e)(1)(i) of this section, good faith is determined under this paragraph (e)(3)(iii) even if such charges are paid to affiliates of the creditor, so long as the charges are bona fide: […]" 81 Fed. Reg. 37768 (Emphasis added).

The final rule also adds new comment 4 to paragraph 19(e)(3)(iii), which describes that a charge is bona fide if it is "lawful and for services that are actually performed."

The comment also reinforces that just because a charge has no applicable tolerance does not mean it is automatically in good faith under section 1026.19(e)(3)(i). The charge must still be consistent with the best information reasonably available to the creditor at the time the disclosure is provided. The existing commentary to section 19(e)(1)(i) directs readers to the commentary to section 1026.17(c)(2)(i) for an explanation of that standard.

The good news is that more fees may not be subject to a tolerance requirement for good faith analysis. The bad news is that there is now yet another hoop in the TRID rules to push a fee through before it can be confidently charged to a borrower. But credit unions and their affiliates are not in the business of charging their members illegal or sham fees, so this one should be relatively painless.

We Need You! NAFCU's Annual Federal Reserve Survey

Written by Pamela Yu, Special Counsel for Compliance and Research

We need your help! Yes, you!  Please make your voice heard by completing NAFCU's Annual Federal Reserve Survey.

What is it?

Since 1992, NAFCU's Board of Directors has met yearly with the members of the Board of Governors of the Federal Reserve System to discuss issues of mutual interest and concern affecting credit unions.  For example, among other things, NAFCU provides information to the Fed on credit union financial conditions, credit union service to members and use of Fed services, key legislative and regulatory issues facing credit unions, and other critical topics of importance for that particular year. 

In preparation for the annual meeting NAFCU produces a written report for each yearly session detailing the latest issues and trends affecting credit unions and the impact of Fed actions. NAFCU's Annual Federal Reserve Survey is an annual assessment of NAFCU members covering the topics discussed in the annual NAFCU Report on Credit Unions.  NAFCU's 2016 Report on Credit Unions was referenced by the Treasury Department in their recent study, which contained a number of credit union-specific and NAFCU-backed recommendations aimed at fostering credit union service to members and communities.

The 2016 NAFCU Report on Credit Unions highlighted a number of areas of concern for credit union compliance officers.  For example, our 2016 report emphasized that credit unions are significantly hindered by regulatory burden and growing compliance costs:

"91.1% of respondents to NAFCU’s 2016 Federal Reserve Meeting Survey cited 'total compliance activities' as an area in which significant expense increases are necessary for the near-term. While smaller credit unions continue to disappear due to the growing burden, all credit unions are finding the current regulatory environment challenging. Credit unions did not contribute to the financial crisis yet are still subject to increasing regulatory requirements mandated under the Dodd-Frank Act."

Our 2016 report also highlighted our members' concerns with respect to the following regulatory and compliance issues:

Federal Reserve

• Payments
• Debit Card Interchange Fees
• Regulation D
• Regulation CC

Consumer Financial Protection Bureau

• Unfair, Deceptive, or Abusive Acts and Practices
• Debt Collection
• Qualified Mortgages
• Mortgage Servicing
• Reputation Risk
• Remittances
• Home Mortgage Disclosure Act Requirements
• Privacy
• Overdraft
• Payday Lending
• Arbitration

National Credit Union Administration

• Risk-Based Capital
• Investment Authority

Department of Defense

• Military Lending Act

Federal Communications Commission

• Telephone Consumer Protection Act

By drawing attention to these crucial issues, our hope is that the Fed, and other federal financial regulators, can gain a better appreciation for our members' concerns with respect to regulatory burden and the tremendous compliance and operational challenges associated with implementing many extensive and complex rules.

Why does it matter?

NAFCU’s annual meeting with the Federal Reserve is one of the more important ways we ensure that our members’ concerns are heard at the highest levels of government.

Credit unions have always been some of the most highly regulated of all financial institutions, facing restrictions on who they can serve and their ability to raise capital. Additionally, there are many consumer protections built into the Federal Credit Union Act, such as the only federal usury ceiling on financial institutions, the statutory prohibition on prepayment penalties, and the arbitrary cap on credit union member business lending.  Despite the fact that credit unions are already heavily regulated and did not cause the financial crisis, they are still laboring under the weighty regulatory burden in the post-Dodd-Frank environment. Small credit unions, in particular, struggle to afford costly compliance expenses. Those that cannot keep up with ballooning compliance costs have disappeared due to merger at an alarming rate—the industry continues to lose roughly one credit union per day.

Now, more than ever, credit unions' voices must be heard.

Participate in NAFCU's 2017 Annual Federal Reserve Survey

In preparation for NAFCU’s 2017 meeting with the Federal Reserve, we would like your credit union's feedback on a variety of topics, including lending, liquidity and housing conditions, as well as a number of regulatory issues and strategic challenges. Your responses to these survey questions are very important to both the Federal Reserve Board and to credit union advocacy efforts.  Every survey response is helpful and greatly appreciated! Please participate today, or pass the survey along to the appropriate personnel within your credit union.

The survey results will be summarized the 2017 Report on Credit Unions. Participants will receive a free copy of the 2017 report later this year.

The deadline for the survey is August 25, 2017. Participants can either complete the survey online or download a fillable pdf version.

We look forward to hearing your thoughts!

Law Enforcement to Financial Institutions: SARs Are Being Used to Put Away the Bad Guys; MLA Update

Written by Shari R. Pogach, Regulatory Paralegal

Last week, several of my NAFCU colleagues and I attended the 11^th Mid-Atlantic Anti-Money Laundering Conference, a multi- day symposium held here in Washington, DC, and presented by the FBI, ICE, U.S. Secret Service, IRS and DEA.  This conference is a useful one in that it gives financial institution attendees the opportunity to hear law enforcement cases that illustrate how the "bad guys" are using the U.S. financial system to launder their ill-gotten proceeds.  It's also helpful to hear that the information you all submit doesn't just disappear into a black hole. 

The information provided in Suspicious Activity Reports (SARs) is useful and appreciated.  During the conference, multiple law enforcement investigators noted how important SARs are to their investigations and in one illustrated case, a SAR was the actual trigger for the investigation.  Whether a SAR starts an investigation or enhances an ongoing one, law enforcement stresses that such information sharing is vital.

Some additional takeaways from the conference:

Trends in Red Flag Activity

• Third party service providers and facilitators are moving monies for everyone – the provider simply wants the commission.
• In some cases a third party may have been with an institution for years – look for a sudden spike in activity as it may now be being used as a shell company for money laundering.
• Newly created companies with a great deal of account activity could be a possible indicator of fraudulent activity.
• Sudden usage of dormant accounts – law enforcement sees dormant accounts as vulnerable for fraudulent activity.
• Trade based money laundering, such as textiles, phones, vehicles and electronics, is growing.
• Think about when your institution's systems are sleeping – this vulnerability was handily used in the Bangladesh Bank heist, i.e., weekends, holidays and time zone differences.
• Employee benefit plan and trust fraud – fraud is ripe in instances where there is a single plan administrator. Look out for transactions making no business sense or sudden stoppage of deposits as funds could be improperly rerouted. There is no reason for funds to be transferred out of a pension plan. 
• While it is not illegal for a doctor's office to accept cash payments, it is a little strange especially if the amounts are quite high.
• Commodity purchases are being financed through financial institutions with the repayments being made with drug proceeds. How often do you review your repayments as opposed to deposits?

Maintaining a Strong BSA/AML Program

• Be proactive, not reactive!
• Understand the nature and purpose of your member's business.
• What triggers the re-categorization of your member from low risk to high risk?
• Make sure your BSA staff has the proper stature and influence within your institution. They should be involved with product and member/customer development.
• Your internal controls must not remain static in conjunction with your institution's risk profile.
• Update and evaluate your systems continuously – the robustness and effectiveness must be ongoing along with ongoing validation of rules.
• There should be clear elevation protocols and procedures for reporting of issues.
• Geographic risk must also be taken into consideration even by smaller financial institutions.

***

MLA Update.  The Department of Defense informed NAFCU in a letter that, at this time, it would not delay its October 3 implementation date for credit card compliance under the Military Lending Act rule. More details can be found in this NAFCU Today story, here.

Significant Changes Require Advance Notice: What’s Significant?; Fiduciary Rule Delay Update

Written by Jennifer Aguilar, Regulatory Compliance Counsel

For one reason or another, credit unions often find themselves updating their credit agreements. Inevitably, this leads to the all-important question: Do I need to tell members before I make this change? While it is generally a good idea to inform members of changes to their credit agreements, Regulation Z has specific rules for when a credit union must provide advance notice – any significant change requires advance notice. So, the next question is: What's a significant change?

While Regulation Z covers various types of credit, this post focuses on the change in terms rules for open-end credit that is not secured by a home. Section 1026.9(c)(2)(i)(A) states that when a "significant change in account terms" is made, a credit union is required to provide written notice at least 45 days prior to the change taking effect. In the real world, we all have a general understanding of what significant means, but, under Regulation Z, this is a defined term with a very specific meaning that does not necessarily align with our real world understanding. Paragraph (c)(2)(i)(A) points you to another paragraph for the definition of significant changes and that paragraph redirects you to yet another paragraph. These incessant cross-references are enough to confuse any diligent compliance officer, so here's the basic starting point: the account opening disclosures.

For open-end credit that's not secured by a home, the account opening disclosure rules can be found in section 1026.6(b). A change to a term required to be disclosed under paragraphs (b)(1), (b)(2) or (b)(4) is defined as a "significant change in account terms."  The definition covers any change to these terms, not just increases or additions. This covers the following terms:

• Periodic rate and APR;
• Fixed finance charge and/or minimum interest charge;
• Transactions charges;
• Grace period;
• Balance computation method;
• Fees for the following events: cash advances, late payments, over-the-limit transactions, balance transfers and returned payments;
• Fees for required insurance, debt cancellation or debt suspension coverage; and
• Certain variable rate information.

In addition to the account opening disclosures, Regulation Z's change in terms rule also includes two other changes in the definition of a significant change in account terms. These are: increases in the required minimum periodic payment and the acquisition of a security interest. For all significant changes, the rule requires 45-day advance notice. The notice must be in writing and state the following:

• A summary of the change;
• A statement that changes are being made;
• For non-credit card accounts, a statement that the consumer has the right to opt out of the change;
• The date the change is effective;
• A statement that additional information about the change can be found in the notice, if applicable; and
• For APR increases:
• the balances to which the new rate will apply,
• if a penalty rate applies at the time, a statement that the new rate will not apply until the penalty rate no longer applies, and
• for credit card accounts, a statement of reasons for the rate increase.

There are account opening disclosures relating to some charges that may not require a 45-day advance written notice, but could still require notice before the member "becomes obligated" to pay the charge. These charges are detailed in section 1026.6(b)(3) and include certain finance charges; taxes; charges that affect the member's access to the plan; termination charges and charges for voluntary credit insurance, debt cancellation or debt suspension coverage. For changes to these charges, the rule requires a credit union to either comply with the 45-day advance notice requirement or provide notice before the member must pay the charge. Decreases to these charges do not require notice. For more details, see section 1026.9(c)(2)(iii).

There are also a few related items to keep in mind when dealing with changes in terms. The right to reject for credit card plans applies to significant changes in account terms. The change in terms rule excludes certain changes from the 45-day notice requirement such as changes the member agreed to and rate increases due to delinquency, default or as a penalty. These changes have their own notice requirements. There is also a separate notice rule for decreasing a member's credit limit. Finally, there is a list of changes that do not require advance notice detailed in section 1026.9(c)(v) which include "reduction of any component of a finance charge," extension of the grace period, and some situations where the line is suspended or terminated.

NAFCU members can find more resources related to change in terms notices in this past Compliance Monitor article.

* * *

On Wednesday, the Department of Justice filed a notice of plans to delay implementation of three fiduciary rule exemption changes from Jan. 1, 2018, to July 1, 2019. More details on this notice can be found in yesterday's NAFCU Today. NAFCU will keep its members posted as more information is released.

HMDA – Lessons from the CFPB's Recent Webcast; LEI FAQs

Written by Brandy Bruyere, Vice President of Regulatory Compliance

Some of you may have tuned in to the CFPB HMDA webcast that NAFCU hosted last Thursday (available on demand here and free for both members and nonmembers). Michael Byrne, project director in the CFPB's Technology and Innovation Division, provided an overview of the CFPB's new web-based HMDA data submission tool. Here are a few of the FAQs that seem worth sharing based on the webcast, with summarized answers.

Question- We use different loan platforms for our closed-end mortgages, HELOCs, and business loans, and each system produces its own set of data. Will the new system allow credit unions to submit multiple LARs and stack the documents within the application?

Answer – The new system will not accept multiple LARs so credit unions will need to aggregate all the data into one document before uploading to the new filing application. Also, every time a new file is uploaded, the application will overwrite the previously submitted file.

Question – We currently input LARs manually for some kinds of loans because our volume is not that high. Will we need software now to create LAR files?

Answer – The CFPB created an Excel based LAR Formatting tool on its HMDA for Filers webpage which will help with these kinds of situations. The tool can be downloaded here.

Question – How many individual log ins does the new system allow a credit union to create? Can the credit union allow third-party vendors to access the application?

Answer – The new application leaves it to the credit union to determine how many users can log into the system and whether or not to allow any third parties to have access.

Question – Will the system allow for administrator-level type privileges to be designated so the credit union can delete the log on files for employees who have left the credit union, limit access for some personnel at some points in the process, and similar situations?

Answer – At this time, the system is not configured for this kind of feature.

Question – When will we have access to the 2017 HMDA submission platform?

Answer – The tentative production schedule has the beta version of the 2017 submission platform becoming available sometime in the third quarter of 2017 and the final version available sometime in the fourth quarter 2017. On a related note, the previously promised check digit tool and geocoding tool are also tentatively scheduled to be available in fourth quarter 2017. The production schedule, which was provided in the handouts to last week's webcast, can be downloaded here:  Download HMDA Tools Production Schedule. (Editorial note – we've blogged about these "missing" tools in the past so we appreciated this news).

The webcast covered many more questions than these and in some cases added additional details. If you missed it or there is someone in your credit union that handles HMDA filing and would benefit from more information, please feel free to share with them.

***

LEI Questions. Recently, a member shared some insights about the process for registering for a Legal Entity Identifier with the GMEI Utility (note, Bloomberg is also offering an LEI service). Overall, there are questions that do not seem to apply to credit unions, like the name of the "ultimate parent" or the "registration authority" of the organization. While Bloomberg had response options like "no known person" some of these issues seemed less clear for using GMEI's system. I sent a couple of questions to their customer service email address, and thought I would share their answers.

Question – For some states, under "03. Entity Information," there is a "Registration Authority ID" for Alaska, California, Montana, Nebraska, and Utah. Federal credit unions are not incorporated under state laws like other US entities as they are federally chartered. Would federal credit unions from these states just put "not available" even if they operate in one of these 5 states?

Answer – "The Registrations Authority ID pertains to the relevant state business or regulatory registry the entity is listed with. The choices for this field are currently limited; for a credit union I would advise selecting “Not Available” from the drop down."

Question –  Federal credit unions that seem to have successfully registered for an LEI have answered the question about "ultimate" and "direct" parent listings as "opt out" and then "no known person" but some have asked whether this is actually accurate.

Answer – "…if you are at all unsure about what to select for parentage, you choose to “OPT OUT” of providing both direct and ultimate parent information. Please then select the reason as “NO LEI” and you should be able to proceed to the next section. Please find a direct link to our FAQ documents below which includes guidance on Level 2 data; opt out reasons are found under the heading “What if I am not able to provide this information?”:

https://www.gmeiutility.org/frequentlyAskedQuestions.jsp"

Question –Does GMEI Utility send an email or other notification/reminder that the LEI is up for renewal before the year mark, or is the entity responsible for keeping track of that date itself and following up accordingly next year to renew?

Answer – "The [credit union's] contact will receive automated renewal reminders approximately 60 days prior to the next renewal date. Further reminders will subsequently be sent 30 days, 15 days, 10 days, 5 days and 1 day prior to renewal."

Overall, I found GMEI Utility to have a helpful customer service option, although it did take about two weeks to receive a response. For those using Bloomberg, they have a 24 page User Guide and their own email address to contact for help – [email protected].

***

Palate Cleanser. It's been a while since I've posted a Nolan/Lemmy update. Lemmy turns 6 this month, but for a big guy he's still in pretty good shape. Here he is trying to pretend he does not want to steal my dinner. Meanwhile, Nolan is turning the corner towards 3 and since he's so active, he's in toddler soccer!

  

CFPB: "Hello, hello. It's Pay by Phone Fees and UDAAP"

Written by: André B. Cotton, Regulatory Compliance Counsel

Recently, the CFPB issued a Compliance Bulletin that provides guidance to credit unions regarding fee assessments for pay-by-phone services and the potential for unfair, deceptive, or abusive acts or practices (UDAAPs) when assessing phone pay fees. The Bulletin also provides guidance to debt collectors about compliance with the Fair Debt Collection Practices Act (FDCPA) when assessing phone pay fees.

The CFPB's Compliance Bulletin summarizes the current law, highlighting relevant examples of conduct observed during supervisory examinations and enforcement investigations that may violate Federal consumer financial law. Today's post will provide an overview of some of the CFPB's fact specific examples.

Background

The CFPB has observed across various consumer financial products and services, many financial institutions provide consumers with multiple payment options. For example, a credit union may provide its members the option of making payments over the phone by using an automated system or speaking with a live representative. A credit union may also provide members the option to make phone payments by using a debit card, electronic check, or to have their payment expedited. A number of financial institutions also use third-party service providers to handle and process the payments.

Examples of Conduct that May Violate or Risk Violating the Prohibition on UDAAPs

Pursuant to the Dodd-Frank Act, "an act or practice is unfair when (i) it causes or is likely to cause substantial injury to consumers; (ii) the injury is not reasonably avoidable by consumers; and (iii) the injury is not outweighed by countervailing benefits to consumers or competition." Furthermore, an "act or practice is deceptive when (i) the act or practice misleads or is likely to mislead the consumer; (ii) the consumer's interpretation is reasonable under the circumstances; and (iii) the misleading act or practice is material" The CFPB notes that UDAAP violations depends on the facts and circumstances. Below, I have included a non-exhaustive list of examples of conduct related to phone pay fees.

Failing to Disclose the Prices of All Available Phone Pay Fees When Different Phone Pay Options Carry Materially Different Fees

For example, the CFPB has noted that many financial institutions charge different phone pay fees depending on the payment method. Some financial institutions send periodic billing statements or other documentation that discloses that "transaction fee may apply" to various payment methods, but the statements do not disclose the relevant fees to be charged for those methods. In some other instances, a financial institution may solely depend on phone representatives to disclose the relevant fees before the charge is imposed. However, in some cases, the phone representatives only reveal the higher-cost options. Consequently, this conduct poses a risk of an unfair practice.

Misrepresenting the Available Payments Options or that a Fee is Required to Pay by Phone

In an enforcement action, the CFPB alleges that a mortgage servicer engaged in a deceptive practice by misrepresenting to consumers, both expressly and by implication, that a particular pay-by-phone option was the only available payment method, or that consumers must use the particular pay-by-phone option in order to avoid negative consequences, including incurring a late fee or even facing foreclosure. To the contrary, in this case, the servicer accepted several payment options free of charge.

Failing to Disclose that a Phone Pay Fee would be Added to a Consumer's Payment could Create the Misimpression that there was No Service Fee

For example, a member owes a payment of $300. The member calls and tells the credit union's customer service representative that he will pay by phone. The member customer service representative confirms that the member borrower authorizes a payment of $300. In fact, the member's checking account is debited $315, which is the $300 for the otherwise applicable payment amount and $15 for a pay-by-phone fee.

Lack of Employee Monitoring or Service Provider Oversight may lead to Misrepresentations or Failure to Disclose Available Options and Fees

A number of financial institutions have policies and procedures that direct live representatives to disclose all available phone pay options and fees. Many entities even provide representatives with detailed phone scripts. Unfortunately, when live representatives veer off-script, they potentially misrepresent available phone payment options and fees. This may result in members being charged higher fees than otherwise would have been applicable. The CFPB recommends adequate monitoring can reduce the risk of misrepresentations.

Examples of Conduct that May Violate or Risk Violating the FDCPA

Pursuant to Section 808(1) of the FDCPA, "a debt collector may not collect any amount (including any interest, fee, charge, or expense incidental to the principal obligation) unless such amount is expressly authorized by the agreement creating the debt or permitted by law."

CFPB Supervision has noted that one or more mortgage services meet FDCPA definition of "debt collector". Thus, when these mortgage servicers charged fees for taking mortgage payments over the phone, they violated the FDCPA because the mortgage instruments did not expressly authorize collecting such fees. As a result, the CFPB instructed the mortgage servicers in question to review mortgage notes and applicable state law, and to only collect pay-by-phone fees where expressly authorized by contract or state law.

The Bureau's Expectations

The CFPB expects entities to review their practices on charging phone pay fees for potential risks of committing UDAAPs or violating the FDCPA. Credit Unions may consider the following suggestions in assessing whether their practices present a risk of constituting a UDAAP or FDCPA violation:

• Review applicable law (state, federal, FDCPA) to confirm whether the credit union is permitted to charge phone pay fees
• Review debt agreements to determine whether such fees are authorized by contract
• Review internal and third-party vendor policies and procedures on phone pay fees
• Review whether information on phone pay fees is shared with the membership (i.e. account disclosure, periodic statements, payment coupon books, on the company's website, over the phone, etc.)
• Incorporate pay-by-phone issues in regular monitoring or audits
• Review member complaints regarding phone pay fees
• Perform regular reviews of third-party provider practices
• Ensure that the credit union has a corrective action program to address any identified violations and reimburse members when appropriate

The CFPB will continue to closely review the practices of entities charging phone pay fees for potential UDAAPs and FDCPA violations. The CFPB will use all appropriate tools to assess whether supervisory, enforcement, or other actions may be necessary.

***

Last week, I attended NAFCU Risk Seminar in Denver, Co. I learned a lot, and I am now André B. Cotten, Esq., NCCO, NCRM! Here's a photo from my hike at the Red Rocks Amphitheatre:

 

BSA Concerns: From Under-filing to Over-filing SARs

Written by Stephanie Lyon, Regulatory Compliance Counsel

First of all, I wanted to congratulate our newest class of NCBSOs! NAFCU wrapped its second BSA Seminar in beautiful Colorado last week where several questions were asked and concerns raised that are worth noting. Apparently, the latest issue with Bank Secrecy Act (BSA) examinations seems to surround examiners who believe credit unions may be over-filing Suspicious Activity Reports (SARs). FinCEN addressed this issue back in 2004 when it coined the term "defensive filing" to mean "when an institution files a suspicious activity report on an activity or transaction that really is not suspicious."

Prior to this over-filing concern, credit unions were criticized a couple of years ago for potentially under-filing SARs and CTRs. These over/under-filing concerns are leaving credit unions attempting to comply with BSA requirements feeling a little bit like this:

Before we attempt to understand examiners' concerns, let's start with the basics on SAR filings. Under the BSA, credit unions are required to file these reports in several circumstances. For example, credit unions must file a SAR for insider abuse involving any amount (insiders may include employees, officials, and managers). Credit unions are also required to file a SAR when there is a criminal violation of $5,000 or more and the suspect is known or can be identified. See, 31 C.F.R. § 1020.320(a)(2). In instances when the suspect is unknown, the credit union must file a SAR if the criminal violation amounts to $25,000 or more.

Other SAR triggers include transactions conducted or attempted by, at or through the credit union and aggregating $5,000 or more if the credit union suspects, or has reason to suspect that the transaction may involve potential money laundering or other illegal activity. The same requirement applies if the credit union suspects the member may be structuring to evade BSA reporting or if the transaction has no business or apparent lawful purpose. See, 31 C.F.R. § 1020.320(a)(2)(ii)-(iii). Aside from these required filings, the BSA also allows credit unions to file SARs to "report of any suspicious transaction that it believes is relevant to the possible violation of any law or regulation…" See, 31 C.F.R. § 1020.320(a)(1). This is commonly known as a catch-all provision.

Identifying suspicious activity requires some level of subjective judgement as what may appear suspicious account activity for one member may be normal or have a reasonable explanation for another account. Generally, the Bank Secrecy Officer or SAR committee is in the best position to make the judgment call as to whether transactions require a SAR or simply monitoring. For that reason, guidance from the FFIEC BSA/AML Examination Manual explains that examiners should ensure credit unions establish and implement risk-based policies, procedures and processes to comply with the Bank Secrecy Act instead of questioning individual determinations unless the decisions are egregious. Here is an excerpt from the manual regarding the amount of deference that should be given to SAR decision-makers:

"The decision to file a SAR is an inherently subjective judgment. Examiners should focus on whether the bank has an effective SAR decision-making process, not individual SAR decisions. Examiners may review individual SAR decisions as a means to test the effectiveness of the SAR monitoring, reporting, and decision-making process. In those instances where the bank has an established SAR decision-making process, has followed existing policies, procedures, and processes, and has determined not to file a SAR, the bank should not be criticized for the failure to file a SAR unless the failure is significant or accompanied by evidence of bad faith."

So it is clear for BSA examinations, the role of the examiner is not to comb through all credit union's SARs. Rather examiners are tasked with ensuring the credit union is effectively monitoring accounts and transactions, flagging suspicious activity, and reporting the activity per the SAR requirements. After all, FinCEN even recognizes that a "one-size fits all approach" is not appropriate for suspicious activity monitoring and reporting.

The takeaway here is that in the interest of complying with BSA laws, credit unions should ensure they are filing SARs whenever they suspect illegal activity is involved with an account or transaction(s). This is especially important as FinCEN's recent enforcement actions against financial institutions target BSA program failures to detect and report suspicious activity. For more in-depth information on enforcement actions, see NAFCU's quarterly BSA Blast (member log-in required).

 If your examiner feels the credit union is over-filing, this may be a good time to: (1) have a conversation about the appropriateness of the credit union's internal controls, policies and procedures to identify suspicious activity instead of defending specific decisions; and (2) review the SAR narrative to make sure it is effectively explaining why the activity appears suspicious and drawing contrast to the prior use of the account—which according to the FFIEC BSA/AML Examination Manual, examiners "should not criticize the [credit union's] interpretation of the facts."

The CFPB's Final Arbitration Rule; NAFCU's Annual Federal Reserve Survey

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

On July 10^th, the CFPB finalized its rule on arbitration agreements. On July 19^th, the final rule was published in the Federal Register. If you haven't had a change to read it yet, prepare yourself -- it's already a CFPB classic. The final rule establishes Part 1040, which consists of 5 sections regarding the use of arbitration agreements and reporting of arbitration outcomes.

Despite the fact that it only establishes five sections… it still clocks in at 775 pages, making it longer than Ayn Rand's The Fountainhead (and, coincidentally, just as easy to read). In typical CFPB fashion, just understanding the scope of products and services covered in the regulatory text requires cross-referencing multiple portions of the U.S. Code (which then contain their own cross-references) and multiple regulations. It leaves you feeling a bit like this:

Definitions and Coverage in Sections 1040.2 and 1040.3

The general coverage of the rule (in extreme summary) is anyone that provides financial products or services to consumers primarily for personal, family, or household purposes -- or anyone that offers certain ancillary services to a provider of those products or services to consumers. The definition of consumer refers only to individuals, not legal entities, so the rule would not apply to incorporated member businesses or trusts.

Among the broad list of financial products and services included in coverage is the majority of credit union offerings, including deposit accounts covered by Truth in Savings and/or Regulation E, loans, check cashing and fund transfer services, and automobile leasing. Providers may also be covered if they offer certain ancillary services to institutions that offer these products, like settlement services, loan servicing, consumer reporting and debt collection. For the sake of clarity from here on out, I'm going to refer to credit unions that are providers of covered products and services under Part 1040 as "credit unions."

Requirements of Section 1040.4

Section 1040.4(a) prohibits credit unions from relying on arbitration agreement provisions with respect to any class action suits regarding the products and services that are covered. It also requires that any arbitration agreements contain the following language:

“We agree that neither we nor anyone else will rely on this agreement to stop you from being part of a class action case in court. You may file a class action in court or you may be a member of a class action filed by someone else.”

There is separate language if the agreement includes products or services not covered by the rule, or if the agreement was originated by another party. The Bureau also offers some fun optional add-ons like:

“This provision does not apply to parties that entered into this agreement before March 19, 2018.”

Section 1040.4(b) contains the requirements for submitting records from court and arbitration proceedings. These requirements apply to any claim filed in arbitration in connection with a covered product or service that has an arbitration provision under Part 1040. In each of these cases, the section requires a credit union to submit:

• The initial claim and any counterclaim;
• Any answers to the above claims;
• The pre-dispute arbitration agreement;
• The judgment and/or award issued by the arbitrator;
• Any communication refusing or dismissing a case due to the credit union's failure to pay fees;
• Any communication from the arbitrator indicating that the arbitration agreement does not comply with applicable fairness principles, rules or other requirements for arbitration; and
• Any court filings relying on the arbitration to support dismissal, deferral or stay.

The section requires these to be provided to the Bureau within 60 days of filing the applicable document with the court or arbitrator, and allows for the redaction of certain information. The Bureau intends to post these records on the internet, and sets deadlines for itself in doing so.

Effective Dates of Section 1040.5

The rule becomes effective 60 days after publication, i.e. September 18, 2017. However, section 1028 of the Dodd-Frank Act, which was the provision requiring the CFPB to consider arbitration agreement regulations, stated that the provision would not apply to agreements until "after the end of the 180-day period beginning on the effective date of the regulation." To accommodate this delay period, the text of section 1040.5(a) specifies that it only applies to pre-dispute arbitration agreements entered into on, or after, March 19, 2018.

There is an exception for agreements already packaged into general-purpose prepaid cards where the consumer for the card is unknown. If the consumer becomes known and the credit union can contact the consumer in writing, it must amend the arbitration agreement to contain the appropriate language within 30 days of obtaining that contact information.

The commentary discusses when a pre-dispute arbitration agreement is "entered into." Obviously, this means when a new agreement is established, but it also includes when a credit union provides a member with a new covered product or service that is subject to a preexisting arbitration agreement, or when the credit union purchases a loan and obtains the rights under a preexisting arbitration agreement.

The commentary also clarifies instances that are not "entering into" an arbitration agreement, including modifying or amending the terms of a current loan subject to a preexisting arbitration agreement.

We are still digesting this rule and, given the Bureau's appetite for hyper-technical requirements, you will probably be hearing more from us on it as we pick it apart.

NAFCU's Annual Federal Reserve Survey

In preparation for NAFCU’s annual meeting with the Federal Reserve, we would like to know your opinion on a variety of topics, including lending, liquidity and housing conditions, as well as a number of regulatory issues and strategic challenges. Your responses to these survey questions are very important to both the Federal Reserve Board and to the credit union community, and every survey response is helpful and greatly appreciated! The survey results will be summarized in our annual Report on Credit Unions, a publication referenced by the Treasury Department in their recent study. Participants will receive a free copy of the 2017 report later this year.

The deadline for the survey is August 25, 2017. Participants can either complete the survey online or download a fillable pdf version.

Back to Basics: Are All Members Created Equal?

Written by Pamela Yu, Special Counsel for Compliance and Research

With reportedly 108 million credit union members, it's no secret that credit unions are a terrific choice for American consumers seeking financial services. Credit unions are member-owned, not-for-profit cooperative financial institutions that provide local communities with key financial products.  Unlike banks, which operate with the purpose of maximizing shareholder profits, credit unions operate with the purpose of returning benefits to their member-owners in the form of lower interest rates on loans and higher returns on savings and deposits. According to an independent study released by NAFCU earlier this year, the cumulative benefit credit unions provide the greater economy totals over $16 billion per year. 

Of course, to benefit from the advantages of credit union membership, individuals must be eligible to join a credit union. Usually, this means a person falls within a credit union's field of membership. A federal credit union's field of membership may include individuals who share a common bond of occupation, association, or community.  But if a person doesn't directly qualify for membership, they may still be eligible to join because of a close relationship with someone who does qualify.

"Primary" and "Secondary" Credit Union Membership

There are two types of credit union members: primary and secondary (or derivative) members. The way an individual may qualify for credit union membership depends on whether that person is a potential primary member or a potential secondary member.

NCUA's chartering and field of membership rules allow a federal credit union the discretion to include in its field of membership (FOM) "other persons eligible for credit union membership," including among others, "members of the immediate family or household."  The Chartering and FOM Manual defines "immediate family" as "spouse, child, sibling, parent, grandparent, or grandchild. This includes stepparents, stepchildren, stepsiblings, and adoptive relationships."  In addition, "household" is defined as "persons living in the same residence maintaining a single economic unit." This definition includes any person who is a permanent member of and participates in the maintenance of the household, including family members, domestic partners, foster children, and legal guardian relationships. Roommates in a single residence would also meet this definition, but a fraternity, sorority, or nursing home relationship would not. See, NCUA Letter to Federal Credit Unions 99-FCU-2, p. 23.

If such "other persons" are included in the credit union's FOM, both "primary" and "secondary or derivative" membership in the credit union is permitted.  NCUA has issued a number of legal opinions discussing the meaning and parameters of both primary and secondary membership.  Those opinions explain that an individual that is within a federal credit union's FOM is eligible for membership as a primary member.  Immediate family and household members of the primary member, because of their close relationship to the federal credit union's common bond group, are considered potential secondary or derivative members of the credit union. See, NCUA Legal Opinion 97-1020. 

The eligibility rules for primary membership vary from those for and secondary membership.  NCUA's Chartering and FOM Manual provides:

"Membership eligibility is extended only to individuals who are members of an “immediate family or household” of a credit union member. It is not necessary for the primary member to join the credit union in order for the immediate family or household member of the primary member to join, provided the immediate family or household clause is included in the field of membership. However, it is necessary for the immediate family member or household member to first join in order for that person's immediate family member or household member to join the credit union." (Emphasis added).

Thus, where a federal credit union has included the immediate family or household member clause in its field of membership, the immediate family and household members of a primary individual may join the credit union as long as the primary individual is within the credit union's FOM at the time the family or household member joins the federal credit union. In other words, immediate family and household members are allowed to join a federal credit union even if the primary individual is not a member, as long as the primary individual is currently within the federal credit union's FOM.  However, if the primary individual leaves the FOM without having become a member, the immediate family or household members of the primary individual are no longer eligible to join the credit union. See, NCUA Legal Opinions 97-1020; 98-0404.

On the flip side, if an immediate family or household member of a primary individual joins the credit union and, subsequently, that primary individual leaves the FOM, the family member can stay with the credit union.  Under the "once a member always a member" policy, immediate family or household members can maintain their membership in a federal credit union even if the primary individual is no longer within the field of membership. See, NCUA Legal Opinion 97-1020.  For example, in the circumstance where a primary individual dies, NCUA has opined that immediate family or household members that have already joined a federal credit union through their relationship to the primary individual within the credit union's common bond may continue their membership after that individual's death. See, NCUA Legal Opinion 97-1019.

 Example

 The flow charts below demonstrate primary and secondary membership eligibility.  For ease of reference, the charts analyze an immediate family or household relationship:

 

Keep in mind that there are other ways to qualify for secondary membership, aside from a close family or household relationship.  For example, "other persons" like volunteers, by virtue of their close relationship with a sponsor group, may also be included in the credit union's FOM. 

Finally, remember that eligibility alone is not enough to establish credit union membership. Under the Federal Credit Union Act, membership in a federal credit union requires an approved membership application and payment and maintenance of at least a par value share (as well as any applicable entrance fee). See, 12 U.S.C. §1759(a); FCU Bylaws, Article III.  

New York's DFS Final Cybersecurity Requirements – Will Others Follow?

Written by Shari R. Pogach, Regulatory Paralegal

While NAFCU is focused on federal compliance issues, a new state cybersecurity rule has made waves in recent months. The New York State Department of Financial Services (DFS) issued final regulations with mandatory cybersecurity requirements for financial services entities in February of this year.  The regulations became effective March 1, 2017, with a series of implementation deadlines for covered entities at six months, one year, 18 months and 24 months  – meaning for state-chartered credit unions in this state, the first compliance deadline is around the corner, August 28, 2017.  A covered entity is defined as all entities operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the New York banking, insurance or financial services laws.  There are exemptions for those entities with fewer than 10 employees, less than $5 million in gross annual revenue for three years or less than $10 million in year-end total assets. The New York state regulations indicate an enhanced focus on risk-prioritized and managed cybersecurity with corresponding burden and associated increased costs to financial institutions.

Here are some of the significant requirements under the DFS cybersecurity regulations:

• Written and ongoing maintained cybersecurity policies that must include a written incident response plan.
• A designated chief information security officer (CISO) to oversee the cybersecurity program that must have board and/or senior management access with annual reporting to same.
• Any cybersecurity events, incidents and/or breaches must be reported to the DFS no later than 72 hours from a determination that a cybersecurity event has incurred that: 1) requires reporting to a government, regulatory or supervisory body; or have a reasonable likelihood of material harm to the normal operations of the covered entity.
• Board or senior management certification of covered entity compliance.
• Penetration testing and vulnerability assessments with zero acceptance risk appetite levels.
• A five year audit trail retention period containing enough data to be able to recreate material transactions.
• A compliance monitoring and effectiveness program.
• Third party service provider security policy for risk management and review of the cybersecurity practices of the providers with periodic assessment and audit.

Many of these requirements are broad in scope so the DFS issued further guidance on a frequently answered questions page, including questions on the scope of entities that must comply, which can be found here. 

It is believed in the industry the DFS will be quick to enforce its regulations with infractions incurring civil penalties and possiblly criminal penalties.  The requirement for a designated CISO is to ensure an ability to determine going forward " a person, who is to blame" for any infractions. Unfortunately, the actions by New York DFS may be a harbinger to come of  similar regulation by other states or by the federal government as the United States is considered to behind in comparison to the  European Union's General Data Protection Regulation (GDPR).  

 

Overdrafts Still on the Radar

Written by Jennifer Aguilar, Regulatory Compliance Counsel

With the overdraft lawsuits still in the news, we have had a number of questions in the compliance inbox lately on the overdraft rules. The questions have touched on a number of the different overdraft provisions in both Truth in Savings and Regulation E. Here is a primer on the various rules that should serve as a helpful starting point in researching overdraft issues.

Truth in Savings

Section 707.11 of NCUA's Truth in Savings rule provides a couple different overdraft provisions. First, the disclosure requirements. The rule requires credit union to disclose two pieces of information about overdrafts fees on each periodic statement: (1) the total dollar amount of all fees imposed for paying items when there are insufficient or unavailable funds in the account, and (2) the total dollar amount of all fees imposed for returning items unpaid. The rule requires these totals to be provided for both the statement period and year-to-date. The commentary to this section explains that these totals must include per-item fees, interest charges, daily or other periodic fees and any fees for maintaining an overdrafted account. Credit unions may itemize fees in addition to providing the totals but are not required to do so.

Second, the advertising rules. If an advertisement promotes the payment of overdrafts, the rule requires that advertisement to also state: (1) the fee for paying each overdraft, (2) which transactions a fee for paying overdrafts will be imposed on, (3) the time period the member has to repay the overdraft, and (4) when the credit union will not pay an overdraft. These disclosures must appear on the advertisement in a clear and conspicuous manner. The rule also provides a number of exceptions including member-initiated inquiries, television or radio advertisements, billboards and ATM receipts.

Truth in Savings does not provide a specific definition for overdrafts. However, the commentary explains that overdrafts do not include transfers of funds from the member's other accounts even if the credit union charges a fee for the transfer or overdraft services subject to Regulation Z.

Regulation E

In addition to the Truth in Savings requirements, overdrafts are also covered by Regulation E. Section 1005.17(a) defines an overdraft service as a service where a credit union charges a fee on a member's account for paying a transaction when there are insufficient or unavailable funds in the account. Regulation E also does not cover transfers of funds from the member's other accounts or overdraft services subject to Regulation Z.

If a credit union charges a fee for its overdraft service in connection with an ATM or one-time debit card transaction, section 1005.17(b) requires members to opt-in to the overdraft service for these transactions. The rule requires credit unions to provide a written notice, a reasonable opportunity for the member to opt-in, the member's affirmative consent to opt-in and a confirmation of the opt-in. The notice must be provided separately from all other information. The member's affirmative consent to opt-in must be provided before a credit union may impose any fees for paying overdrafts on ATM or one-time debit card transactions. All overdraft fees must also be disclosed under section 1005.7(b)(5).

The written notice must be substantially similar to Model Form A-9. Section 1005.17(d) requires the notice to include: (1) a description of the overdraft service that includes the types of transaction that are covered by the service; (2) all fees associated with paying an overdraft including per-item fees, daily fees or other periodic fees and negative balance fees; (3) any maximum number of fees that will be imposed per day; (4) an explanation of the member's right to opt-in and (5) all other options for paying overdrafts that the credit union offers, such as a service that transfers funds from the member's other accounts.

Overdraft Litigation

As with most of the consumer regulations, Truth in Savings and Regulation E focus on specific disclosure requirements rather than any operational requirements. This has proved to be an area of concern in the overdraft lawsuits filed in the past few years. Both PNC and Bank of America got tied up in litigation over their transaction reordering practices. The banks would rearrange transactions and process the highest dollar transactions first rather than processing the transactions chronologically. This resulted in consumers being charged multiple overdraft fees in one day as opposed to a single overdraft fee that would have been charged if the banks had processed the transactions in chronological order.

Credit unions have also gotten hit with lawsuits over their practice of calculating the balance on a member's account. These credit unions used a member's available balance rather than actual balance to determine when an overdraft fee would be charged. A member's actual balance may differ from her available balance due to debit card or check holds and the fact that the actual balance differed from the available balance is not always apparent to the member.

While the overdraft rules in Truth in Savings and Regulation E do not provide requirements for how to apply transactions or calculate account balances, the rules do require credit unions to describe how the overdraft service works. Omitting key facts from that description can lead to costly litigation. NCUA's overdraft guidance is also a useful resource in determining best practices for overdraft services. The guidance suggests that credit union should clearly explain the operation, costs and discretionary nature of the service. The guidance also suggests that credit unions should explain transaction clearing practices and inform members as soon as the service has been used.

CFPB Proposes Change to HMDA HELOC Threshold, Releases HMDA Loan Scenarios; Rulemaking Agendas Updated

Written by Brandy Bruyere, Vice President of Regulatory Compliance

NAFCU has been working on issues with HMDA implementation on Capitol Hill and now we are seeing some results. As background, back in June Senators Mike Rounds and Heidi Heitkamp proposed legislation to change the reporting thresholds under HMDA, following up on with a letter to CFPB Director Cordray on the same issue. On July 10, 2017 Director Cordray responded to the Senators' letter indicating that the bureau was considering increasing the threshold for reporting open-end mortgages from 100 loans to 500 loans over a two year lookback period. For a little more information on HMDA thresholds for reporting, check out this blog or for a detailed overview, NAFCU members can access this article with their log in.

On July 14, 2017 the bureau issued its proposal with comments due by July 31, 2017 indicating that the CFPB may intend to move quickly on this action. The CFPB indicated that this is temporary at least for the time being while the bureau investigates what the appropriate threshold should be for reporting open-end dwelling secured loans:

The Bureau has heard concerns that, in setting the open-end transactional coverage threshold at 100 transactions, the Bureau set it too low. The Bureau is now proposing to increase that threshold to 500 or more open-end lines of credit for two years (calendar years 2018 and 2019). During that period, the Bureau will reconsider the open-end transactional coverage threshold: This temporary increase would allow the Bureau to do so without requiring financial institutions originating fewer than 500 open-end lines of credit per year to collect and report data with respect to open-end lending in the meanwhile.

Note, this proposal would not change the low reporting threshold for closed-end dwelling secured loans, which is set at 25 such loans under HMDA. NAFCU will submit comments on this proposal.

HMDA Loan Scenarios. On July 19, 2017 the CFPB released a set of hypothetical transactions as an additional tool for complying with upcoming changes to HMDA. Three different scenarios are covered: single-family closed-end purchase loans, non-natural person, multifamily purchase loans, and open-end lines of credit. The scenarios include data mapping samples based on the loan scenarios presented as storylines, with assumptions made "for the sake of simplicity and continuity," but may help credit unions make some determinations as to how to report some data points. The CFPB also made some changes to the documents on its Resources for HMDA Filers page.

Spring Rulemaking Agendas Released. The "Spring" 2017 rulemaking agendas are now available. While these documents are usually updated in late May, there was a bit of a delay this year, perhaps due to having a new administration. It may be helpful to compare the Fall 2016 agendas to the Spring 2017 agendas for an indication on priorities given the changes in Washington. NCUA's Fall 2016 Agenda is available here, and Spring 2017 here. The CFPB's Fall 2016 agenda is here, and Spring 2017 agenda here.