NAFCU Compliance Blog

The Final Prepaid Rule: Version 3.0; Refresher on the EU's GDPR

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

Since 1982, no less than seven different cuts of Ridley Scott's science fiction masterpiece Blade Runner have been shown to theater audiences. The initial workprint version didn't test well, so the studio re-cut it, adding a rightfully maligned voice-over and a preposterous "happy ending." Both the director and generations of film snobs-to-come found it insufferable. A version with extended, more violent fight scenes was released for international audiences, and a version with toned down violence and nudity was produced for television broadcast. In the early 90's, positive responses to an unauthorized release of the original workprint prompted the 1992 release of a director's cut version, but Ridley Scott still didn't feel he had sufficient time or control to finish it the way he wanted. In 2007, Scott was able to make the version he wanted -- the "Final Cut" -- which was released with the 25th Anniversary Edition blu-ray. Blade Runner is one of my favorite movies, and it proves that, sometimes to get something right you need a quarter of a century and at least seven iterations.

Which is to say, the CFPB is still working on the Prepaids Rule.

The initial proposed rule was released on December 23, 2014, with following corrections to the proposal being released February 5, 2015. The rule went final for the first time on November 22, 2016, with an effective date of October 1, 2017. Less than 4 months later, on March 15, 2017 the Bureau issued another proposal, recognizing some issues with implementation of the final rule, seeking more time for additional adjustments and suggesting the effective date be delayed six months. That proposal went final on April 25, 2017, with a new effective date of April 1, 2018. However, the Bureau did believe further adjustments were necessary, and on June 29, 2017, another proposal was issued, delaying the implementation date further and proposing changes to the regulation. While it has not yet been published in the Federal Register, the Bureau has released the third Final Rule on prepaids, and the new effective date is April 1, 2019.

With all this rule writing and rewriting, one of the more painful parts of this process has been identifying the regulatory language that would be current on the effective date. On that front, the CFPB has done us a solid: they finally released an unofficial, informal redline of the rule, allowing compliance personnel to read the rules as a whole. The redline is even bookmarked!

The FINAL Final Rule

The most recent final rule makes several changes to the rule, most significant of which is the April 1, 2019 effective date. Other changes include:

• Revising the error resolution and limited liability provisions so that they only apply to prepaid accounts that are registered with the credit union and for which the identity of the account holder has been verified;
• Creating limited exceptions to the credit-related provisions to address situations where a credit card is liked to a digital wallet;
• Expanding situations where an account issuer can run a negative balance, if certain conditions are met;
• Making clarifications and minor adjustments to several provisions in Regulation E, including the definition of a prepaid account, unsolicited issuance of access devices, pre-acquisition disclosure requirements and submission of prepaid account agreements; and
• Technical corrections!

Refresher on the European Union's GDPR

 The NAFCU Compliance Team has seen an uptick in questions about the scope of the European Union's General Data Protection Regulation (GDPR). Apparently some vendors are raising the red flag for their clients. NAFCU recently hosted a webcast (for purchase) on the GDPR which credit unions may find helpful. We also blogged about the GDPR in May of last year, and that might be worth revisiting: Privacy Laws from Across the Pond: Scoping Out the GDPR.

The GDPR's scope is drawn very broadly. It does not require the credit union to have a location in the EU or for the website user to be an EU citizen or resident for the rule to apply. Here is a section from that prior blog post:

"Scope

The Directive applied mostly to organizations that had an establishment or "means of processing" physically located within the EU. The GDPR, however, expands the application of EU privacy law to organizations not located in the EU, but doing certain business in the EU.

For entities that do not have an establishment in the EU, the GDPR applies to any organization that processes the personal data of natural persons in the EU under two circumstances: 1) when offering them goods or services, even if it's not in return for payment, or 2) in monitoring their behavior which takes place within the EU. See, EU Regulation 2016/679, Ch. 1, Art. 3(2)."

The full post contains more detail, including the definitions that are necessary to really understand this scope. However, even if the credit union falls within the scope, there is still a question as to whether and when compliance with the rule may be appropriate for individual credit unions. It is not clear how the European Union would enforce the law against organizations without a presence in the EU. Neither the CFPB nor NCUA have indicated an appetite to examine for it. Credit unions seeking a realistic assessment of the risk that GDPR noncompliance would pose to the credit union should speak with an attorney experienced in international law. A proper assessment of this risk should help the credit union assess whether GDPR compliance is appropriate and necessary at this time.

Not Déjà Vu: Just Another Prepaid Proposal; Programming Note

Written by Stephanie Lyon, Regulatory Compliance Counsel

If you feel like you have heard a lot more about prepaid rules this past year than you would have liked, there's a reason for that. NAFCU's compliance team has blogged, written an article (member-only) and released a final rule alert about the not so final, final prepaid rule and about the rule's delay that pushed the compliance deadline to April 1, 2018. But that is just the start, in the rule's delay announcement, the CFPB stated it would also review a couple of substantive issues through a separate notice and comment rulemaking process. So today's blog focuses on the CFPB's latest proposal to amend the final prepaid rule specifically in regards to the error resolution and limitation of liability sections; credit-related provisions to digital wallets; and certain other clarifications and minor adjustments.

Error Resolution & Liability Limitations

The error resolution section of the final prepaid rule requires credit unions to promptly investigate a member’s notification of unauthorized EFTs on all prepaid accounts. The rule does contain a couple of timing and provisional credit variances if a credit union establishes a member identification and verification process and the member has not concluded or the credit union was unable to verify the member. See, 81 Fed. Reg. 83986. However, the credit union is still supposed to complete the investigation and credit members per the error resolution and liability sections of the rule. The CFPB received many comments from stakeholders on the error resolution and member liability requirements as the current Regulation E process for EFTs is already considered to be expensive and time consuming by many financial institutions.

So the bureau proposed to revise the error resolution and member liability sections to limit the error resolution requirements of Regulation E to verified prepaid accounts and to all verified and unverified prepaid payroll card or government benefit accounts. See, 82 Fed. Reg. 29632.  While helpful, there is a caveat to this limit. If a member is later verified, the credit union would then have to resolve errors with regard to disputed transactions that occurred prior to verification and credit members, consistent with the timing requirements and liability limitations of the prepaid rule. The proposal is attempting to strike a balance between overly burdensome error resolution and liability provisions while still protecting as many consumers from fraudulent transactions. 

Digital Wallets

What are these products exactly? Digital wallets are considered a "card, code, or other device that is capable of accessing two or more payment credentials for purposes of making payment for goods and services at multiple unaffiliated merchants." See, 81 Fed. Reg. 83967. Because of the final prepaid rule's broad definition of prepaid accounts, digital wallets can trigger both Regulation E and certain Regulation Z protections if the technology is capable of holding funds and accessing a separate credit feature. During implementation of the rule, it became apparent that there are some complications with applying the credit provisions of the prepaid rule to credit card accounts linked to digital wallets that can store funds where the credit card accounts are already subject to Regulation Z’s open-end credit card rules.

So the bureau proposed a limited exception in which members using digital wallets linked to a traditional credit card product would continue to receive Regulation Z’s open-end credit protections but would not receive the protections of the credit-related provisions of the prepaid rule (which apply to hybrid-prepaid credit cards) if the following five conditions are met:

1. The credit card account is a credit card account under an open-end (not home- secured) consumer credit plan that a member can access through a traditional credit card.
2. The prepaid account issuer and the card issuer will not allow the prepaid card to draw, transfer, or authorize the draw or transfer of credit from the credit card in the course of authorizing, settling, or otherwise completing transactions conducted with the card to obtain goods or services, obtain cash, or conduct P2P transfers, except where the prepaid account issuer or the card issuer has received from the member a written request that is separately signed or initialized to authorize the prepaid card to access the credit card account as described above.
3. The prepaid account issuer and the card issuer do not condition the acquisition or retention of the prepaid account or the credit card account on whether a member authorizes the prepaid card to access the credit card account as described in proposed section 1026.61(a)(5)(iii)(D)(2).
4. The prepaid account issuer applies the same terms, conditions, or features to the prepaid account when a member authorizes linking the prepaid card to the credit card account as described above in proposed § 1026.61(a)(5)(iii)(D)(2) as it applies to the member's prepaid account when the member does not authorize such a linkage. In addition, the prepaid account issuer applies the same fees to load funds from a credit card account that is linked to the prepaid account as described above as it charges for a comparable load on the member's prepaid account to access a credit feature offered by a person that is not the prepaid account issuer, its affiliate, or a person with which the prepaid account issuer has an arrangement.
5. The card issuer applies the same specified terms and conditions3 to the credit card account when a member authorizes linking the prepaid card to the credit card account as described above in proposed § 1026.61(a)(5)(iii)(D)(2) as it applies to the member's credit card account when the member does not authorize such a linkage. In addition, the card issuer applies the same specified terms and conditions to extensions of credit from the credit card account made with the prepaid card as with the traditional credit card.

See, 82 Fed, Reg. 29649.

Implementation Date

The CFPB's proposed rule would take effect concurrently with the general effective date of the prepaid rule—April 1, 2018. However, the bureau is considering whether this proposal will warrant an additional delay for the implementation of the prepaid rule so that credit unions and other industry stakeholders have time to modify disclosures and procedures or whether the proposed changes would eliminate the need for an additional delay.

These are just some of the proposed changes the bureau is seeking comments. So be sure to read NAFCU's Regulatory Alert (members-only) for more proposed changes and send us your comments so that we can ensure the soon-to-be final final prepaid rule makes sense for your credit union.

***

Programming Note.  In recognition of Independence Day, NAFCU's offices will close early today at noon, and we will be closed on Tuesday, July 4. We'll reopen and be back to blogging on Wednesday. Have a safe and enjoyable holiday weekend… I know the Lyon household will be grilling and viewing the amazing D.C. fireworks!

Exceptions to the Prepaid Rule: What's Missing from the Buffet?

Written by Stephanie Lyon, Regulatory Compliance Counsel

The CFPB’s final rule on prepaid accounts, which is the Bureau's version of all you can eat regulation, was issued near the end of 2016. We have previously blogged on the general application of the rule as well as the definition of a prepaid account. Today’s blog focuses on what's missing from the buffet.

Issuers of Prepaid Access

Smaller credit unions have recently asked if the prepaid rule carved out an exception for smaller financial institutions. Unfortunately, the rule does not have an asset size threshold requirement for compliance with the prepaid rule. Hence all credit unions that are issuers of prepaid access will have to comply with the final rule. This requires providing the credit union’s prepaid account agreements to the Bureau for posting on the CFPB’s website on a rolling basis (not quarterly). See, 81 Fed. Reg. 84129.

There is an exception, however, that will not require credit unions with less than 3,000 “open” prepaid accounts to provide their agreements to the Bureau. See, 81 Fed. Reg. 84140.  So what exactly does “open” mean? The rule defines a prepaid account as open if either:

1. There is an outstanding balance in the account;
2. the member can load funds to the account even if the account does not currently hold a balance; or
3. the member can access credit (i.e. overdraft line of credit) from a covered separate credit feature offered in connection with a prepaid account.

See, 81. Fed. Reg. 84133. Nonetheless, credit unions will still be required to post the prepaid account agreements to their own website and to have the agreement readily available upon request. See, final 12 C.F.R. § 1005.19(c).

This is a great time to communicate with vendor providers of prepaid cards and outside packaging to establish who will lead the compliance efforts for the product so that the credit union can continue to issue prepaid cards to its members without fear of the approaching compliance deadline. After all, compliance cannot be outsourced, but credit unions may contractually require vendors to adhere to regulatory requirements to ease its compliance effort.

Sellers of Prepaid Access

According to the most current 5300 call report on the NCUA’s webpage, only about 16% of credit unions issue prepaid cards. Other smaller credit unions however, choose to sell prepaid cards issued by a different financial institution or third-party service provider. Luckily for these credit unions, the CFPB drew a distinction between issuers of prepaid access and other institutions that merely sell prepaid cards.

In order for a credit union to be within the scope of Regulation E, which will implement part of the prepaid rule, it has to either:

1. Directly or indirectly hold prepaid accounts, or
2. issue prepaid accounts and agree to provide electronic funds transfer services.

See, 12 C.F.R. § 1005.2(i). Credit unions that merely sell prepaid cards but do not hold the accounts or agree to provide electronic funds transfers for these prepaid accounts would not meet the definition of a financial institution that issues prepaid accounts or access. Specifically, the prepaid rule states, “… the burden of and liability for complying with this final rule would generally fall on the financial institution that issues the prepaid accounts, not on the banks or credit unions selling those products.” 81 Fed. Reg. 83964.

If your credit union is only selling prepaid access, you may still want to review and familiarize yourself with the lengthy requirements of the rule. While the issuer of the card will be primarily liable for prepaid access compliance, the credit union may take an active approach to compliance and create a checklist of the disclosures and information that should be on and off the prepaid card and package to ensure members receive great service.

What’s a Prepaid Account?

Written by Brandy Bruyere, Director of Regulatory Compliance

On October 5, 2016 the CFPB finalized its rules for prepaid accounts, with most provisions becoming effective on October 1, 2017.  An initial question for determining how the rule may impact a credit union is whether any of the credit union’s products fall within the scope of the rule by meeting the new definition of “prepaid account” in Regulation E. New section 1005.2(b)(3) includes:

• A “payroll card account,” meaning one directly or indirectly established through an employer where a consumer’s wages, salary or other compensation are sent by electronic funds transfer;
• A “government benefit account,” as defined in revised section 1005.15(b)(2) to mean those established by a government agency for distributing government benefits (although not needs-tested benefits) to a consumer electronically;
• An account that is marketed or labeled as “prepaid” and that is redeemable upon presentation at multiple, unaffiliated merchants for goods or services or usable at ATMs; or
• An account that meets the following conditions:
  • Issued on a prepaid basis in a specified amount, or not issued on a prepaid basis but can be loaded with funds later;
  • Has the primary function of conducting transactions with multiple unaffiliated merchants for goods or services, at ATMs, or to conduct person-to-person (P2P) transfers; and
  • Is not a checking account, share draft account or negotiable order of withdrawal account.

There are some exceptions to the definition. If the account is not a payroll card account or government benefit account, then the following accounts are not “prepaid accounts” under section 1005.2(b)(3)(ii):

• An account loaded only with funds from a health savings account, medical savings account, flexible spending arrangement, dependent care assistance program, or transit/parking reimbursement;
• An account directly or indirectly established through a third party that is loaded only with qualified disaster relief payments;
• The P2P function is established through the US government with the primary function to conduct closed-loop transactions on US military installations or similar government facilities;
• Gift certificates as defined in section 1005.20(a)(1) and (b);
• Store gift cards, as defined in section 1005.20(a)(2) and (b);
• Loyalty, award or promotional gift carts, as defined in section 1005.20(a)(4) and (b); or
• A general use prepaid card as defined in section 1005.20(a)(3) and (b), that is marketed as a gift card or gift certificate; or
• An account established for distributing needs-tested benefits in a program established under state or local law, or administered by a state or local agency.

Certain pass-through services are also excluded from the general definition of a prepaid account. Staff comment 1005.2(b)(3)(i)—6 says the following:

6. Prepaid account acting as a pass-through vehicle for funds. To satisfy § 1005.2(b)(3)(i)(D), a prepaid account must be issued on a prepaid basis or be capable of being loaded with funds. This means that the prepaid account must be capable of holding funds, rather than merely acting as a pass-through vehicle. For example, if a product, such as a digital wallet, is only capable of storing a consumer's payment credentials for other accounts but is incapable of having funds stored on it, such a product is not a prepaid account. However, if a product allows a consumer to transfer funds, which can be stored before the consumer designates a destination for the funds, the product satisfies § 1005.2(b)(3)(i)(D).

In other words, if a service merely operates as a digital wallet that stores payment credentials, the member cannot store funds, and the member cannot access the balance then it would not be a prepaid account. However, further commentary clarifies that to meet the definition of prepaid account, it is not necessary that the account be reloadable by the consumer or a third party. Official Interpretation 1005.2(b)(3)(i)—7.

As with many regulations, including existing Regulation E, the commentary is key here, so this blog is really just a glimpse as some of the intricacies in this 1,689 page rule – and does not even get to what products might be a “hybrid prepaid-credit card” that will be subject to certain provisions in Regulation Z.  For more information, NAFCU members can find our Final Regulation summary of this rule here (log in required).

Seem like a lot? The CFPB must have thought so too, since the Bureau created a six page flowchart to help credit unions determine whether a particular product meets the definition of “prepaid account.” You can find it here and other Bureau resources here.

***

Black Friday. Instead of scrambling against the crowds at stores for discounts, on the day after Thanksgiving my parents and I took Nolan to nearby Great Falls National Park. He kept trying to climb over the railings, but it was a fun trip. Nolan also learned a new word this weekend - pie! 

CFPB Issues Final Prepaid Rule

Written by Pamela Yu, Special Counsel for Compliance and Research

Happy Wednesday!  I hope you all had a pleasant Columbus Day weekend, or, as we like to call it in my expat-Canadian household, Thanksgiving weekend.  Yes, that’s right. Canadian Thanksgiving is in October.  What else is different about Thanksgiving in Canada versus in the U.S.?  Not much—just like in America, it’s all about turkey coma and pumpkin pie.  Except instead of watching football we watch the Toronto Blue Jays sweep the Texas Rangers to advance to the American League Championship Series (Go Jays!). 

Now that NAFCU’s Compliance team is back in the office, it’s time to start diving into CFPB’s new final rule on prepaid accounts (Prepaid Rule).  The Prepaid Rule, which is a healthy 1,689 pages, mandates comprehensive consumer protections for prepaid accounts under Regulation E, which implements the Electronic Fund Transfer Act; Regulation Z, which implements the Truth in Lending Act; and the official interpretations to those regulations.

The final rule modifies Regulation E to create prepaid account provisions governing disclosures, limited liability and error resolution, and periodic statements.  It also adds new requirements regarding the posting of account agreements.  Additionally, the final rule regulates overdraft credit features that may be offered in conjunction with prepaid accounts.  Such credit features, with some exceptions, will be covered under Regulation Z where the credit feature is offered by the prepaid account issuer, its affiliate, or its business partner and credit can be accessed in the course of a transaction conducted with a prepaid card. 

The rule is effective October 1, 2017.  However, the requirement (in § 1005.19(b)) for prepaid account issuers to submit their prepaid account agreements, which must satisfy the rule’s form and content requirements, to the CFPB for posting on its website is delayed until October 1, 2018.

The final rule was issued by the CFPB last Wednesday and NAFCU’s Regulatory Affairs team will be providing a detailed summary of the final rule shortly, which will be available to NAFCU members on our website (member login required).  NAFCU issued a Regulatory Alert on the proposed rule in late 2014, which is currently available to members on our website (14-EA-27).  The CFPB has also provided a new implementation web page.  In the meantime, this post will provide a high-level overview of the scope of the “prepaid account” definition in the final rule.

The Prepaid Rule adds the term “prepaid account” to the definition of “account” in Regulation E. Accounts within the scope of the rule’s definition of prepaid account are subject to various requirements under amended Regulation E.  

Definition. The criteria for whether an account is a prepaid account under the final rule are set forth in 12 CFR 1005.2(b)(3). See p. 1425-1427 of the Prepaid Rule.

Under the rule, payroll card accounts and government benefit accounts are prepaid accounts.  Additionally, a prepaid account includes a product that is either of the following, unless a specific regulatory exclusion applies:

• An account that is marketed or labeled as “prepaid” and is redeemable upon presentation at multiple, unaffiliated merchants for goods and services or usable at automated teller machines (ATMs); or
• An account that meets all of the following: (1) Is issued on a prepaid basis in a specified amount or is capable of being loaded with funds after issuance; (2) Whose primary function is to conduct transactions with multiple, unaffiliated merchants for goods or services, to conduct transactions at ATMs, or to conduct person-to-person (P2P) transfers; and (3) Is not a checking account, a share draft account, or a negotiable order of withdrawal (NOW) account.

Exclusions. An account that satisfies one or both of the above tests is not a prepaid account for the purposes of the rule if it is any of the following:

• An account loaded only with funds from a health savings account, flexible spending arrangement, medical savings account, health reimbursement arrangement, dependent care assistance program, or transit or parking reimbursement arrangement;
• An account that is directly or indirectly established through a third party and loaded only with qualified disaster relief payments;
• A gift certificate;
• A store gift card;
• A loyalty, award, or promotional gift card;
• A general-use prepaid card that is both marketed and labeled as a gift card or gift certificate; or
• An account established for distributing needs-tested benefits in a program established under state or local law or administered by a state or local agency.

Additionally, the P2P functionality of an account established by or through the U.S. government is not a prepaid account under the rule if the account’s primary function is to conduct closed-loop transactions on U.S. military installations or vessels, or similar government facilities.

Also, an account established for a commercial purpose is not a prepaid account because, under the existing definition of account in Regulation E, an account is subject to Regulation E only if it is established primarily for a personal, household, or family purpose.  In addition, under the existing definition in Regulation E, an account held under a bona fide trust agreement is not an account subject to Regulation E; therefore, an account held under a bona fide trust agreement is also not a prepaid account.

It is important to note, however, that the definition of prepaid account is not limited to general purpose reloadable cards or prepaid products that otherwise function as transaction account substitutes. 

CFPB has provided a flow chart that may help credit unions to determine if an account is a prepaid account under the final rule.

NAFCU’s Regulatory Compliance team is continuing to analyze the new Prepaid Rule to understand its full impact on credit unions.  Stay tuned for more information in the coming weeks.  

Agencies Issue Guidance on Applying Customer Identification Program Requirements to Holders of Prepaid Cards

Written by Benjamin M. Litchfield, Regulatory Compliance Counsel

On March 21, 2016, the federal banking agencies, FinCEN, and NCUA issued interagency guidance on applying customer identification program (CIP) requirements to certain prepaid cards issued by banks, savings associations, or credit unions. In general, the guidance states that financial institutions should apply CIP to general purpose prepaid cards that provide a cardholder with the ability to reload funds or access to credit or overdraft features.

The agencies believe that the issuance of these types of prepaid cards establishes a formal banking relationship that is equivalent to opening an account for purposes of the CIP rule. For prepaid cards that require the purchaser to contact the issuing bank or credit union in order to active these types of features, the agencies “believe that an account is not established until a reload, credit, or overdraft feature is activated by cardholder registration.”

For purposes of complying with the CIP rule, the guidance states that banks and credit unions should treat the cardholder as the bank or credit union’s customer even if the cardholder is not the named account holder. This is typically the case when the prepaid program is run by a third-party intermediary who uses a pooled account to fund the prepaid cards. Therefore, the fact that the funds are held in a pooled account “should not affect the status of the cardholder as the bank customer, assuming the cardholder has established an account with the bank [or credit union] by activating the reloadable functionalities…” of the card.

The guidance also discusses how the CIP rule applies to specific prepaid card programs such as payroll, government benefit cards, and health benefit cards. For payroll cards, the guidance states that the bank or credit union should treat the employer as its customer and does not need to apply its CIP to each employee unless the card allows the employee to access credit through the card or reload the payroll card from sources other than the employer. In these cases, the bank or credit union would be required to treat the employee as its customer and apply its CIP to the employee.

For government benefit cards, the guidance reminds banks and credit unions that government agencies are not typically considered “customers” for CIP purposes and therefore the institution is not normally required to apply its CIP to government benefit cards. That being said, if the card program allows the cardholder-beneficiary to load non-government funds onto the card or provides access to credit, then a customer relationship is established and the institution must perform its CIP on the cardholder-beneficiary.

For health benefit cards, the guidance discusses CIP requirements for health savings accounts, flexible spending arrangements, and health reimbursement arrangements. Since employees typically establish health savings accounts, the guidance states that the bank or credit union should treat the employee establishing the account as the institution’s customer for CIP purposes. On the other hand, for flexible spending arrangements and health reimbursement arrangements, the guidance states that banks or credit unions should treat employer as the institution’s customer since no person other than the employer establishes these types of accounts.

Finally, the guidance notes that for banks or credit unions that work with third-party program managers that design, manage, and operate prepaid card programs, the institutions should have “well-constructed, enforceable contracts” with third-party program managers that clearly outline CIP obligations and ensure the bank or credit union has access to all CIP information collected by the third-party program manager.

Ultimately, it is unclear whether this guidance will be particularly useful to credit unions since credit unions may not typically provide services to nonmembers. For credit unions operating prepaid programs, these types of services are usually offered to members whose identities have already been verified at the time the member opened his or her initial share account. That being said, the guidance may be useful to credit unions that offer payroll cards to employees of their business members or for credit unions that may want to administer government benefit programs for state or local governments.

***

Programming Note: This is just a reminder that NAFCU will be closing at 12:00pm today in celebration of the holiday weekend. We wish a happy holiday to those of you and your families who may celebrate the holiday. Personally, I’m looking forward to the discounted candy sales on Monday.

CFPB’s Policy Priorities Confirm Rulemaking Plans on Overdraft, Debt Collection and Interest in Small Business Lending

Written by Shereefat Balogun, Regulatory Compliance Counsel

On Thursday, February 25, 2016, the CFPB held a Consumer Advisory Board meeting which generally provided an overview of the bureau’s strategic outlook. The CFPB subsequently published a report outlining its two-year supervision and enforcement priorities. Many of the stated priorities are iterations of previous comments made by the bureau, and confirm impending rulemaking. Others provide insight on new areas of interest.  Credit unions under the bureau’s jurisdiction should note the following priorities as they set their compliance goals for the next two years:

• Arbitration: The CFPB indicated that it will continue the rulemaking process to regulate the use of arbitration clauses, especially those that limit a consumer’s right to bring a class action.

• Consumer Reporting: The bureau reported that it will continue to examine and investigate consumer reporting companies and furnishers of information, with a focus on accuracy and dispute resolution processes. The CFPB also stated that it may consider rulemaking around furnisher and consumer accuracy, dispute resolution, and related issues.

• Debt Collection: The CFPB confirmed that it will initiate the rulemaking process and finalize a rule that establishes guidelines to ensure that debt collectors treat consumers with respect, substantiate the debts they collect on, and “provide consumers with appropriate information about their rights and the debt collection process.”

• Mortgages: The CFPB has restated its commitment to ensure that the Home Mortgage Disclosure Act (HMDA) rule is successfully implemented, and that its supervisory and enforcement programs work to provide equal and fair access to mortgage credit. The CFPB also indicated a particular focus on implementing its mortgage servicing rules. Lastly, the bureau stated that it will begin to assess the effectiveness of significant rules that are already in place.

• Overdraft: The bureau makes clear that it fully intends to move forward with the rulemaking process related to overdrafts, with a purported goal of making the overdraft market “fairer and more transparent”.

• Small Business Lending: The CFPB confirmed its growing interest in small business lending, and lists its plan to build a small business lending team and begin “market research and outreach for a rulemaking on business lending data collection.” The bureau also indicated that it will continue to examine small business lenders for compliance with fair lending laws. As a reminder, Dodd-Frank amended the Equal Credit Opportunity Act (ECOA), requiring financial institutions to collect and maintain certain information in connection with credit applications submitted by women-owned, minority-owned or small businesses.

This is a few of the priorities listed in the report. NAFCU previously reported on the full list of priorities. Notably, the CFPB clarifies that, in addition to the stated priority goals, it will continue its ongoing efforts in its fair lending oversight of indirect auto lenders and rulemaking on prepaid cards. The bureau also advises companies to “continue their focus on complying with the law beyond the particular issues described in the goals, whether or not they see their particular industry or product mentioned explicitly among the shared cross-Bureau priorities.”

As a reminder, this will only be applicable to credit unions directly supervised by the CFPB- those with over $10 billion in assets. For those credit unions not subject to CFPB’s supervision, the priorities may nonetheless be a useful tool. The policy priorities can be found here. Credit unions are also advised to review NCUA’s Supervisory Priorities for 2016.

CFPB Semiannual Rulemaking Agenda; NAFCU Risk Management Seminar

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

CFPB Semiannual Rulemaking Agenda. As Brandy mentioned last week, the CFPB recently announced its Semiannual Rulemaking Agenda for Spring 2015. The agenda includes a listing of regulations in the various rulemaking stages.  A couple of highlights from those in the final rule stage include:

• Home Mortgage Disclosure Act (HMDA) (Regulation C). The CFPB estimates that it will release a final rule amending Regulation C in August 2015. Under the HMDA proposed rule, depository and non-depository institutions meeting all other criteria under Regulation C, and which had originated 25 or more covered loans in the previous calendar year, would be required to report expanded HMDA data.

 

• Prepaid Accounts Under the Electronic Fund Transfer Act (Regulation E) and the Truth in Lending Act (Regulation Z). The CFPB also anticipates that it will release a final rule on prepaid products in January 2016. The prepaid accounts proposed rule would establish new consumer protections for the prepaid market that would require market participants to limit consumers’ losses when funds are stolen or cards are lost, investigate and correct errors, provide free access to account information, and follow the practices of credit card protections if a credit product is offered in connection with a prepaid account. The CFPB also proposes new “Know Before You Owe” prepaid disclosures that would provide consumers with clear information about the costs and risks of prepaid products upfront.

The CFPB’s semiannual rulemaking agenda is available in its entirety here.

***

NAFCU Risk Management Seminar. Shameless Plug Alert! Join us in the Mile High City this summer, August 3-5, 2015, for critical credit union risk training. Developed in part by a taskforce of peers who are experts in the field, this new conference will give you a 360° view of the internal and external risks facing your credit union, and gain a better understanding of how to properly manage them. From credit and interest rate risk to compliance, strategic and reputation risk, NAFCU's new Risk Management Seminar will give attendees the tools needed to properly navigate the most serious risks threatening their credit union. Save $100 with promo code RISKSAVINGS. Offer ends 6/5/15. Click here to enroll.

The Prepaid Proposed Rule

By Eliott C. Ponte, Regulatory Compliance Counsel

It was no secret that the CFPB wanted to crack down on prepaid debit cards.  After conducting studies, issuing advance notices of proposed rulemaking, and testing various disclosures regimes, at midnight last Thursday, the CFPB dropped a bomb on the prepaid community:  a nine hundred page proposed rule on prepaid cards.  In this blog post, I hope to capture the high points of the prepaid rule issued by the CFPB on November 13, 2014.  

As I type this blog post, know that NAFCU’s Regulatory Affairs attorneys are working on summarizing the prepaid rule in a NAFCU Regulatory Alert.  Once the Regulatory Alert is completed, NAFCU will publish it on our website (unfortunately, this is a member’s only publication).

The Highpoints

Prepaid Expanded:  The proposed rule defines “prepaid account” as a card, code, or other device that is capable of being loaded with funds, which is not otherwise an account under 12 C.F.R. 1005.2(b)(1), established primarily for personal, family, or household purposes, and is redeemable upon presentation at multiple, unaffiliated merchants for goods or services, or useable at either ATMs or for P2P transfers.  The definition would specifically exclude gift certificate as defined in § 1005.20(a)(1) and (b); a store gift card as defined in § 1005.20(a)(2) and (b); a loyalty, award, or promotional gift card as defined in § 1005.20(a)(4) and (b); and a general-use prepaid card as defined in § 1005.20(a)(3) and (b) that is both marketed and labeled as a gift card or gift certificate.

Prepaid is the New Credit Card:  The proposed rule imposes many credit card protections on to prepaid cards that allow users to spend more money than is deposited on the prepaid account. These protections include ascertaining the consumer’s ability to repay before credit is extended, monthly periodic statements (including the requirement to give users at least 21 days to repay their debt before charging interest or a late fee), limits on first-year total fees, late fee limits, and 45-day advance notice for interest rate increases.  In addition to the protections listed above, the rule prohibits the extension of credit within the first 30-days of the consumer registering the prepaid card, and prevents lenders from offsetting a person’s account to pay their prepaid account.  Even if consumers affirmatively opted-in to allow such a repayment, lenders are still subject to additional requirements:  For instance, the lender cannot take funds more frequently than once per calendar month, and must wait 21 days after the mailing of the periodic statement. 

Know Before You Owe:  The proposed rule requires prepaid issuers to provide standard easy-to-understand disclosures.  The CFPB envisions purchasers will first receive the short form (prior to purchase) and then the long form (after purchase).  The proposed rule includes two model forms (safe harbor) that prepaid issuers can use, which discloses information like the monthly fee, fee per purchase, ATM withdrawal cost, and fee to reload cash onto the account.  Too boot, the CFPB will be requiring that prepaid issuers post the long form on its website, and give the CFPB a copy of the long form so that the disclosures can be posted on the bureau’s website.

In addition, the proposed rule expands the existing Regulation E account opening disclosures for prepaid accounts by proposing that the new disclosures includes the listing of all fees (not just electronic fund transfer fees).

Liability and Error Resolution:  Under the proposed rule, Regulation E liability and error resolution requirements are extended to prepaid accounts registered with the issue.  The proposed rule does not apply to unregistered prepaid accounts if the risk of non-registration has been disclosed.  

***

For those of you who are brave enough to read the entire prepaid proposed rule, you can be taken to all 900 pages of the proposed rule by clicking here.  In addition to publishing the proposed rule, the CFPB issued a press release, which can be found here, and published comments by Director Cordray, which can be found here. Comments to the proposed rule are due 90 days from the date of publication in the Federal Register.

CFPB Testing Prepaid Card Disclosures; NCUA Listening Sessions, Financial Literacy Webinar

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

Prepaid Cards. Last week, the CFPB blogged about a couple of model prepaid card disclosures (Model Form 1 and Model Form 2) currently being tested with consumers. In its blog post, the CFPB provides examples of some of the current prepaid card disclosures out in the market, and suggests that the different styles and formats could make it difficult to find and compare important disclosure information.

The CFPB has had prepaid cards on its radar for some time.  Back in May 2012 we blogged about a CFPB Advance Notice of Proposed Rulemaking (ANPR) seeking comments and information from the public about general purpose reloadable prepaid cards. The CFPB intends to issue a proposed rule later this spring addressing consumer protections for prepaid cards, including standardized disclosures.

***

NCUA Listening Sessions. Online registration is now open for NCUA listening sessions taking place this summer in Los Angeles, Chicago and Alexandria, Va. NCUA Chairman Debbie Matz and Board Member Rick Metsger will attend the sessions. The sessions provide an opportunity for credit union officials to discuss any topics related to the NCUA and are scheduled to take place before NCUA’s proposed risk-based capital rule is finalized. Registration is free, but space is limited and on a first-come, first-served basis.  Click here to register.

***

Financial Literacy Webinar.  NCUA is also hosting a free webinar on how credit unions can promote financial literacy.  Topics to be covered include: the link between financial literacy and the credit union mission; NCUA financial literacy resources; tips on building a successful financial literacy program based on credit union size and specialized member demographics; information about improving financial literacy efforts through the creation of key local and national financial literacy partnerships; and the Treasury Department’s recent financial literacy pilot research program.

This free webinar will be held on Thursday, April 3, 2014, at 2 p.m. EDT.  Register here. 

Participants may submit questions in advance at [email protected]. The subject line of the email should read “Financial Literacy Webinar.”

CFPB Releases Semiannual Regulatory Agenda--Fall 2013

Written by Brandy Bruyere, Regulatory Compliance Counsel

Happy Monday compliance folks! My name is Brandy Bruyere and I am one of two new Regulatory Compliance Counsels here at NAFCU. As this is my first blog post, and it's Monday, we'll start with something short.

Last week the CFPB posted its Semiannual Regulatory Agenda for Fall 2013. This agenda provides insight into which regulations the CFPB will focus on over the next six months. The agenda is organized by rulemaking stage and is current as of September 6, 2013.” Here is the list of various regulations by stage:

Prerule State:

• Home Mortgage Disclosure Act (Regulation C)
• Annual Privacy Notice
• Payday Loans and Deposit Advance Products
• Debt Collection Rule
• Overdraft
• Further Amendments to 2013 Mortgage Rules (Regulations X and Z)

Proposed State:

• Requirements for Prepaid Cards (Regulation E)
• Supervision of Certain Nonbank Covered Persons—Defining Larger Participants in Certain Consumer Financial Product and Service Markets
• Amendments to FIRREA Concerning Appraisals
• Extension of the Temporary Exception for Certain Disclosures Under the Remittance Transfer Rule

Final Rule Stage:

• Restatement of Federal Consumer Financial Law Regulations
• Amendments to TILA Concerning Appraisals
• Integrated Mortgage Disclosures under RESPA (Regulation X) and TILA (Regulation Z)
• Equal Access to Justice Act Implementation Rule
• Rules of Practice for Issuance of Temporary Cease-and-Desist Orders
• The Expedited Funds Availability Act (Regulation CC)
• Defining Larger Participants of the Student Loan Servicing Market*
• Amendments to 2013 Mortgage Rules (Regulations B, X, and Z)

* Since releasing the agenda last week, the CFPB has published a final rule on “Defining Larger Participants of the Student Loan Servicing Market.”

The CFPB blog announcing the release of the agenda also highlights certain pending rulemakings such as regulation of prepaid card products and its expectations to release a proposal to reduce the annual privacy notices customers must receive. The blog also discusses areas the agency will consider in 2014 for potential regulation such as debt collection, payday loans and deposit advance products.

Research Tips for the New Mortgage Rules; NAFCU Webcast on New Rules

Written by Steve Van Beek

Over the past two months, we've written numerous blog posts on the new mortgage regulations. Included a few posts which contain research tips on how to track and find the new requirements. Below is a consolidated listing of those blog posts so that you have them in one central location:

• February 5th - CFPB Rules in the Federal Register; NAFCU Rule Summaries

• February 11th - Finding the New Requirements in the Electronic Code of Federal Regulations

• February 13th - NAFCU's Scope & Applicability Charts for the New Mortgage Rules

• February 22nd - Finding the New Reg Z & Reg X Requirements in the Electronic Code of Federal Regulations

• March 4th - Research Tip: Tracking Rulemakings in the Federal Register

Hopefully you find the above useful. We're always looking for blog ideas - so just let us know if there is something you'd like to see us cover in a future blog post.  

***

NAFCU Webcast on Mortgage Rules. NAFCU's compliance team will be conducting a webcast tomorrow on a few of the "under the radar" issues from the CFPB's new mortgage rules. We'll discuss:

• Details on homeownership counseling requirements;

• Mortgage loan originator qualifications, certifications and training requirements;

• New appraisal disclosure and delivery requirements;

• The small creditor exemption for the escrow requirement for higher-priced mortgage loans; and

• Other frequently-asked-questions regarding the new rules.

We'll also provide a "look ahead" at what other issues the CFPB is targeting in 2013.  

Registration is still open - Sign Up Today!  Remember, NAFCU's webcasts are available to anyone and everyone.  

Mortgage Headache Areas; Upcoming Mortgage Reform Webcasts

Written by Steve Van Beek

Yesterday was NAFCU's first webcast as part of our Mortgage Reform Webcast Series.  I provided an overview of the seven new mortgage regulations - focusing specifically on the scope & applicability of the new requirements.  

I also provided some insight on "Headache Areas" and included this list at the end of the presentation:

• Determining Exemption Applicability

• New Notices – Content-Rich and Strict Timelines

• Error Resolution & Information Request Procedures

• Loan Originator Compensation Determinations

• Implementing So Many Changes At One Time

And, there will be many additional headaches as credit unions work toward implementing the new requirements.  Even self-induced ones.  

There is some hope on the horizon as the CFPB issued their best press release of their history which highlights their Implementation Plan for New Mortgage Rules.  The CFPB's plan indicates they are listening to NAFCU and credit union concerns regarding the overwhelming burden of reading, understanding, interpreting and implementing numerous requirements simultaneously.  Of course, we'll have more information on the CFPB's plan in future blog posts.

***

Upcoming Mortgage Reform Webcasts.  As I mentioned, yesterday's webcast was the first of our series and registration for the next three is now open.

• CFPB's Ability to Repay and Qualified Mortgage Requirements - March 6, 2013 - 2:00 p.m. to 3:30 p.m.

On March 6, Andy Keeney from Kaufman & Canoles will be examining the details of the CFPB's Ability-to-Repay Requirements and Qualified Mortgage Standards.  Andy will walk through the new underwriting guidelines - including the debt-to-income requirements - and explain how these rules will impact credit union mortgage lending.  And, importantly, the steps your credit union needs to take to comply by January 10, 2014.  

• Digging Deeper: CFPB's Mortgage Rules - March 27, 2013 - 2:00 p.m. to 3:30 p.m.

I'll be joined by my colleagues JiJi Bahhur, Bernadette Clair and Mike Coleman as we explore details of the CFPB's new mortgage requirements.  We'll provide answers to Frequently-Asked-Questions that our team has fielded from NAFCU member credit unions.  And, we'll take a look ahead at what other areas the CFPB is likely to address in 2013.  

• Which New Requirements Apply to HELOCs? - April 10, 2013 - 2:00 p.m. to 3:30 p.m.

I'll provide a detailed look at which requirements apply to home equity lines of credit and - just as importantly - which do not apply so that your credit union can best position your implementation strategy.  If your credit union makes HELOCs, this is one you'll want to attend as the new requirements are sprinkled throughout the CFPB's 3507 pages!

***

Programming Note:  NAFCU's offices will be closing early tomorrow and will be closed on Monday for the Federal holiday.  We'll have a blog post tomorrow and then start back up again on Tuesday.   

CFPB Releases Semiannual Regulatory Agenda - Spring 2012; Seminar in Seattle

Written by Steve Van Beek

CFPB Regulatory Agenda.  Yesterday, the CFPB posted its Semiannual Regulatory Agenda - for spring 2012.  The previous Semiannual Regulatory Agenda was released in February 2012.  The latest release follows the same format and includes a listing of regulations in the various rulemaking stages: prerule stage, proposed rule stage, final rule stage, long-term actions and completed actions.  

Below is a listing of the various future regulations - organized by rulemaking stage.  Keep in mind the agenda is current as of April 13, 2012 and the CFPB has taken numerous actions since putting this agenda together.    

Prerule Stage:

• Registration of Certain Nonbank Covered Persons
• Supervision of Larger Depository Institutions and Affiliates
• Home Mortgage Disclosure Act (Regulation C)
• Requirements for Prepaid Cards (Regulation E) 

Proposed Stage:

• Amendments to TILA and FIRREA Concerning Appraisals
• Disclosure Rules and Substantive Protection for Certain High Cost Mortgage Loans (Regulation Z)** (proposed on July 9th)
• Mortgage Originator Standards (Regulation Z)
• Mortgage Servicing (Regulation X; Regulation Z)
• TILA/RESPA Mortgage Disclosure Integration (Regulation X; Regulation Z)** (proposed on July 9th)
• Credit Card Pre-Opening Account Fees (Regulation Z)
• Procedural Rule To Establish Supervisory Authority Over Certain Nonbank Covered Persons Based on Risk Determination
• Supervision of Certain Nonbank Covered Persons—Defining Larger Participants in Certain Consumer Financial Product and Service Markets (LP 2) 
• Copies of Appraisals or Other Valuations To Be Furnished by Creditor (Regulation B)

Final Rule Stage:

• Supervision of Certain Nonbank Covered Persons—Defining Larger Participants in Certain Consumer Financial Product and Service Markets (LP 1)** (finalized on July 16th)
• Disclosure of Records and Information
• State Official Notification Rule
• Rules Relating to Investigations
• Rules of Practice for Adjudication Proceedings
• Restatement of Federal Consumer Financial Law Regulations
• Requirements for Escrow Accounts (Regulation Z)
• TILA Ability to Repay (Regulation Z)
• Confidential Treatment of Privileged Information
• Disclosure Rules for Remittance Transactions (Regulation E)

Long-Term Actions:

• Alternative Mortgage Transaction Parity (Regulation D)
• Business Lending Data (Regulation B)
• TILA Mortgage Amendments (Regulation Z) 

Completed Actions: 

• Disclosure Rules for Remittance Transactions (Regulation E)

***

Only 27 potential rulemakings!!  The Regulatory Agenda also includes a short summary of each rulemaking that is useful for providing a quick overview of what will be covered by the rulemaking.  However, as last Monday's proposed rules show - a short summary doesn't do much when the proposals are 1099 pages and 293 pages.  

***

NAFCU's 2012 Regulatory Compliance Seminar.  Luckily, you don't have to read and understand all 27 potential rulemakings on your own.  We'll be covering quite a few of them at our 2012 Regulatory Compliance Seminar in Seattle, Washington - October 23-26.

The program-at-a-glance is available here (and we'll be including additional sessions as the proposals continue to flow).  We already have a session on the TILA/RESPA mortgage disclosures, the upcoming mortgage servicing proposal (including the periodic statement requirement) as well as a session on the remittances final rule.  Detailed session descriptions can be found here.

Remember - you do not need to be a NAFCU member to attend.  And, Save $100 if you Register by August 31st!

More on Prepaids; NCUA Grants Available; NCUA on YouTube; Flood Insurance Update

Written by Steve Van Beek

Below are just a couple short items to help you ease into the upcoming long weekend.

CFPB ANPR on Prepaids.  The CFPB's ANPR was published today in the Federal Register.  Comments are due by July 23, 2012.  NAFCU members - our Regulatory Affairs team will have a Regulatory Alert out in the near future.

For more on prepaids, the CFPB's press release is here and Director Cordray's speech is here.  

***

NCUA Grants and Loans.  Credit unions with a low-income designation might want to take a look at NCUA grants and loans through their Community Development Revolving Loan Fund (CDRLF).  NCUA has a YouTube video with additional details on the program.  

Importantly, NCUA has prioritized its 2012 grants for the following:

• Financial literacy and education in school branches;
• New product and service development;
• Staff, official, and board member training;
• Student and job creation internships; and
• Volunteer Income Tax Assistance. (emphasis added).

Additional information on the process can be found in Letter to Credit Unions 12-CU-04 and the Enclosure (which includes the grant guidelines).  

***

NCUA's May Economic Update.  NCUA has a new Youtube video with their May 2012 Economic Update.  

***

Flood Insurance.  The NAFCU Today has the latest on a possible Flood Insurance extension.  If you are interested in having the NAFCU Today emailed to you each day, you can sign up here.  The NAFCU Today is open to everyone who is interested.   

CFPB Looking at Prepaid Cards; ERM and CFPB Webcasts; 2012 Seminar

Written by Steve Van Beek

Prepaid Cards Field Hearing.  The CFPB recently announced a field hearing on prepaid cards - which will be held today in Durham, North Carolina starting at 12:00 p.m. EDT.  The CFPB's blog indicates to check back if you want to view the live broadcast.  [As of now, there is no link to the feed.  But, past live feeds were available here if you want to try around noon]. 

Upcoming Prepaid Card Regulation.  In conjunction with today's field hearing, the CFPB announced its intent to regulate the prepaid card market.  The CFPB announced an Advanced Notice of Proposed Rulemaking (ANPR) which is an initial step in the rulemaking process and is usually one where an agency gathers information about the market - prepaid cards in this situation - in anticipation of future regulation.  

In addition to the ANPR, the CFPB issued a Fact Sheet on Prepaid Cards and a Ask CFPB: Prepaid Cards search function on their website.   

By the way - it is good to see the CFPB's website is capable of having a search bar!  I can't wait until they upgrade to the third version of their website and provide a search bar to help credit unions and other entities find the information they need.  

***

NAFCU Webcasts.  NAFCU has a full slate of webcasts for June.  Remember, all of NAFCU's events and conferences are open to anyone - this includes webcasts.  

• June 13 - Building an Effective Enterprise Risk Management Program
• June 20 - The Impact, Expectations and Future of the CFPB on Credit Unions
• June 27 - BSA for Experts - Registration available soon!

***

Regulatory Compliance Seminar.  Also, don't forget to look at NAFCU's 2012 Regulatory Compliance Seminar in Seattle, Washington.  Save $100 when you register by August 31st!  For potential topics, check out this past blog post.