NAFCU Compliance Blog

The Final Prepaid Rule: Version 3.0; Refresher on the EU's GDPR

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

Since 1982, no less than seven different cuts of Ridley Scott's science fiction masterpiece Blade Runner have been shown to theater audiences. The initial workprint version didn't test well, so the studio re-cut it, adding a rightfully maligned voice-over and a preposterous "happy ending." Both the director and generations of film snobs-to-come found it insufferable. A version with extended, more violent fight scenes was released for international audiences, and a version with toned down violence and nudity was produced for television broadcast. In the early 90's, positive responses to an unauthorized release of the original workprint prompted the 1992 release of a director's cut version, but Ridley Scott still didn't feel he had sufficient time or control to finish it the way he wanted. In 2007, Scott was able to make the version he wanted -- the "Final Cut" -- which was released with the 25th Anniversary Edition blu-ray. Blade Runner is one of my favorite movies, and it proves that, sometimes to get something right you need a quarter of a century and at least seven iterations.

Which is to say, the CFPB is still working on the Prepaids Rule.

The initial proposed rule was released on December 23, 2014, with following corrections to the proposal being released February 5, 2015. The rule went final for the first time on November 22, 2016, with an effective date of October 1, 2017. Less than 4 months later, on March 15, 2017 the Bureau issued another proposal, recognizing some issues with implementation of the final rule, seeking more time for additional adjustments and suggesting the effective date be delayed six months. That proposal went final on April 25, 2017, with a new effective date of April 1, 2018. However, the Bureau did believe further adjustments were necessary, and on June 29, 2017, another proposal was issued, delaying the implementation date further and proposing changes to the regulation. While it has not yet been published in the Federal Register, the Bureau has released the third Final Rule on prepaids, and the new effective date is April 1, 2019.

With all this rule writing and rewriting, one of the more painful parts of this process has been identifying the regulatory language that would be current on the effective date. On that front, the CFPB has done us a solid: they finally released an unofficial, informal redline of the rule, allowing compliance personnel to read the rules as a whole. The redline is even bookmarked!

The FINAL Final Rule

The most recent final rule makes several changes to the rule, most significant of which is the April 1, 2019 effective date. Other changes include:

• Revising the error resolution and limited liability provisions so that they only apply to prepaid accounts that are registered with the credit union and for which the identity of the account holder has been verified;
• Creating limited exceptions to the credit-related provisions to address situations where a credit card is liked to a digital wallet;
• Expanding situations where an account issuer can run a negative balance, if certain conditions are met;
• Making clarifications and minor adjustments to several provisions in Regulation E, including the definition of a prepaid account, unsolicited issuance of access devices, pre-acquisition disclosure requirements and submission of prepaid account agreements; and
• Technical corrections!

Refresher on the European Union's GDPR

 The NAFCU Compliance Team has seen an uptick in questions about the scope of the European Union's General Data Protection Regulation (GDPR). Apparently some vendors are raising the red flag for their clients. NAFCU recently hosted a webcast (for purchase) on the GDPR which credit unions may find helpful. We also blogged about the GDPR in May of last year, and that might be worth revisiting: Privacy Laws from Across the Pond: Scoping Out the GDPR.

The GDPR's scope is drawn very broadly. It does not require the credit union to have a location in the EU or for the website user to be an EU citizen or resident for the rule to apply. Here is a section from that prior blog post:

"Scope

The Directive applied mostly to organizations that had an establishment or "means of processing" physically located within the EU. The GDPR, however, expands the application of EU privacy law to organizations not located in the EU, but doing certain business in the EU.

For entities that do not have an establishment in the EU, the GDPR applies to any organization that processes the personal data of natural persons in the EU under two circumstances: 1) when offering them goods or services, even if it's not in return for payment, or 2) in monitoring their behavior which takes place within the EU. See, EU Regulation 2016/679, Ch. 1, Art. 3(2)."

The full post contains more detail, including the definitions that are necessary to really understand this scope. However, even if the credit union falls within the scope, there is still a question as to whether and when compliance with the rule may be appropriate for individual credit unions. It is not clear how the European Union would enforce the law against organizations without a presence in the EU. Neither the CFPB nor NCUA have indicated an appetite to examine for it. Credit unions seeking a realistic assessment of the risk that GDPR noncompliance would pose to the credit union should speak with an attorney experienced in international law. A proper assessment of this risk should help the credit union assess whether GDPR compliance is appropriate and necessary at this time.

Equifax Breach Update - What NAFCU Is Doing

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

In the past few weeks, NAFCU has been focused on defending credit unions from the fallout of the Equifax breach specifically, and the cybersecurity risks posed by third parties generally. At this moment, the door is open to cybersecurity legislation that could have real positive impact for the credit union industry, and NAFCU is moving to seize on that opportunity. As legislation may be the best hope to protect credit unions from another breach like the one at Equifax, I'd encourage your credit union to engage with your Members of Congress to ensure they understand that credit unions must be protected in the future. Please visit our Grassroots Action Center for more information.

Equifax Botched It

Equifax was warned of the vulnerability which lead to the breach in December, 2016. This March, Equifax ignored a notification from the Department of Homeland Security, CERT to fix that vulnerability. In August, following the breach, Equifax established an insecure domain for its breach response site which was spoofed. In early October, Equifax's credit protection website was discovered to be hosting malware. The hits keep coming for Equifax, and whatever credibility Equifax might have still had after the breach, it is now completely gone. Equifax is trying to leave consumers, credit unions and other financial institutions to foot the bill for its mess. NAFCU is engaging on all fronts to make sure that doesn't happen.

The Regulators Are Quiet

NAFCU has been in touch with NCUA, but the agency lacks any real authority to take action on the Equifax breach or other third party cybersecurity issues. NAFCU has also reached out to the CFPB, and the Bureau continues to take the position that it would have needed additional authority over the credit reporting bureaus to have prevented the breach from occurring. The Bureau is currently investigating Equifax's use of a mandatory arbitration clause in connection with its breach response website.

The FTC is conducting its investigation into the Equifax breach and the response. NAFCU has encouraged the FTC to keep credit unions apprised of their findings, but we expect that investigation to continue for several years. No matter what that investigation finds, the FTC will not be able to prevent another breach like this from happening again unless Congress steps in.

The Hill Has Questions

The Equifax breach has Congress angry and looking for answers. On October 3, Equifax's former CEO, Rick Smith, testified before the House Energy and Commerce Committee, providing details for the first time about the internal failures at Equifax that lead to the breach, and accounting for the behavior of Equifax leadership in the days that followed. A few days later, the Senate Banking Committee and then the House Financial Services Committee both heard further testimony from Mr. Smith regarding the variety of failures in Equifax's response to and communication about the breach.

While both parties are actively engaged on this issue, it is worth noting the differing approaches of Republican and Democratic Members of Congress. Republican Members of Congress appear to be actively seeking the ways in which regulatory oversight failed with Equifax, and how these gaps can be fixed. Democratic Members of Congress have zeroed-in on how the Equifax breach will affect consumers, and what Equifax and Congress can do to try and make them whole.

While Equifax's current leadership has failed to show up for hearings so far, the credit union industry has come when called. On Wednesday, Debra Schwartz, NAFCU Board treasurer and President and CEO of Mission Federal Credit Union testified on behalf of NAFCU before the House Financial Services Committee about data security and what credit unions need from Congress. Ms. Schwartz explained the sufficiency of the Gramm-Leach-Bliley's existing Safeguard Rule pertaining to financial institutions, and pointed out that the Equifax breach was the failure of examination and oversight of the credit reporting bureaus, rather than a failure of the law itself. She emphasized that if there are not standards throughout the entire payments infrastructure, criminals will go to the weakest link, which is the merchants. She championed the industry and provided important, factual testimony that will aid Congress in drafting a bill that works and can pass. NAFCU will continue to work to ensure that credit unions' voices are heard in these Congressional hearings.

Legislation Is In the Works

There is a strong appetite on both sides of the aisle to pass legislation in response to the Equifax breach. So far, legislative proposals generally fall into one of three buckets: consumer protection proposals in response to the breach, proposals to correct or increase regulatory oversight over the credit reporting bureaus, and broader proposals regarding national standards for cybersecurity.

The PROTECT Act, recently introduced by Representative Patrick McHenry (R-N.C.), has garnered significant attention. This Act would have the FFIEC appoint a supervisory agency and examine the credit reporting bureaus for compliance with the GLBA's Safeguards Rule, correcting the "examination gap" that currently exists with the bureaus. This proposal also contains national requirements regarding the operation of credit freezes, something that is currently handled at the state law level. Of concern is a provision in the Act that seeks to phase social security numbers out of use by the bureaus as a personal identifier. Obviously this raises red flags as social security numbers are critical to properly identifying members, and NAFCU is currently raising these concerns to lawmakers.

While Congress's attention is focused on cybersecurity, NAFCU is pushing to ensure that credit unions can get the protection they need against third party breaches. There is real energy behind getting general data security legislation passed, and NAFCU is seeking to take advantage of that. As always, we are keeping a careful eye to ensuring that organizations subject to the Gramm-Leach-Bliley Act, like credit unions, do not end up being subject to stricter standards. But this may be our moment to get credit unions the protections they need from third party cybersecurity risk, and NAFCU is working to make sure we take as much advantage of the moment as we can.

Litigation Is on the Table

To date, multiple class action lawsuits have been filed against Equifax by financial institutions across the country. It is highly likely that all financial institution class actions suits will eventually be joined together. Filing or joining a lawsuit continues to be an available option which NAFCU closely considering. Only if NAFCU determines that litigation is viable and a worthwhile avenue for recovery for credit unions will we pursue that option.

NAFCU is continuing to engage everywhere we can to protect credit unions from the breach's continuing fall-out, and to demand Congress act so that this cannot happen again.

Fraud, Schemes and Scams: Let's talk Regulation P and Privacy

Written by: André B. Cotten, Regulatory Compliance Counsel

Regulation P requires credit unions to create a privacy policy that describes the information that it gathers and shares from and with third parties. Credit unions must disclose this policy to new members and to all members on an annual basis. Generally, credit unions that wish to share sensitive information with non-affiliated third parties must give affected members the right to opt out or block such sharing. This general right to "opt out," however, is subject to three large exceptions.

The first exception found in section 1016.14 allows credit unions to disclose nonpublic personal information to nonaffiliated third parties for "processing or servicing transactions" in without triggering the notice and opt out requirements.

Section 1016.15  provides other general exceptions to Regulation P's general rule. For example, a credit union may disclose nonpublic personal information where a consumer has consented and does not revoke the consent to the specific disclosure. A credit union may also disclose nonpublic personal information under this exception to comply with a properly authorized subpoena or with federal, state or local laws.

The last exception found in section 1016.13 permits a credit union to disclose nonpublic personal information to nonaffiliated third parties that perform services or functions for the credit union without providing an opt out. The credit union must satisfy conditions to qualify for this exception. The credit union must first describe the disclosure in its privacy notice. The credit union must also have an agreement with the recipient that prohibits it from using the information other than for the purposes for which it received the information and that it will properly maintain the confidentiality of the information.

Today's blog will focus on a couple of the section 1016.15 exceptions to access a member's nonpublic personal information through a subpoena or to prevent fraud.

Subpoena

Regulation P permits the credit union to disclose nonpublic personally identifiable information in order to comply with a properly authorized "civil, criminal or regulatory investigation, or subpoena or summons by Federal, state, or local authorities." 12 C.F.R. § 1016.15(a)(7)(ii).

Periodically, the NAFCU Compliance Team receives the question regarding what a credit union should do if it receives a subpoena that requires a member's nonpublic personal information. First, the credit union may want to contact local counsel. The credit union may also want to identify and calendar when it must respond to the subpoena. Since the recipient of a subpoena has a duty to identify and preserve responsive documents, the credit union may want to develop and implement a policy to ensure all responsive documents are identified, collected and preserved.

Furthermore, the credit union may want to determine potential response options. This will be a fact specific analysis to discuss with local counsel, however the credit union may have several response options, which may include:

• Comply with the subpoena and provide the requested testimony, documents or both;
• Serve written objections to a document subpoena;
• Move to quash (or modify) the subpoena;
• Move for a protective order;
• Contact the party who served the subpoena in an attempt to informally resolve the issue
• Contact an adverse party (that is, party to the litigation whose interests are adverse to those of the party that issued the subpoena) in an attempt to have the adverse party exercise its rights against the party who issued the subpoena

Ultimately, the decision whether to comply or resist the subpoena will be a risk-based business decision for the credit union. Several considerations impact the decision of whether to comply with (or resist) a subpoena, including: the time, effort and cost of compliance; whether or not sound legal and practical arguments to support non-compliance are available under the circumstances; the likelihood that arguments in support of non-compliance may be successful.

This article may be a helpful resource for credit unions seeking more guidance on how to deal with a subpoena.

Fraud

Regulation P also permits the credit union to disclose nonpublic personally identifiable information "to protect against or prevent actual or potential fraud, unauthorized transactions, claims or other liability."

Absent a legal directive, the credit union will have to make a risk-based business decision as to what degree of information is necessary to protect against or prevent fraud. From a conservative perspective, the credit union may consider only disclosing the information that is necessary to strike the appropriate balance between the credit union's desire to share information and its duty to safeguard member information from unauthorized access pursuant to part 748 of NCUA's Rules and Regulations.

Remember, the NCUA also has several resources that may assist the credit union with making this risk-based business decision:

• NCUA's Fraud Prevention Centerwebsite
• NCUA's Fraud Series videos
• AIRES Examination Questionnaires on "Red Flags" and "Internal Controls-Management"
• NCUA's Interpretive Ruling and Policy Statement 87-1regarding the Bank Bribery Act and codes of ethics

Moreover, the credit union may also want to review its member agreements for any contractual authority or obligations. Ultimately, the credit union's local counsel will be in the best position to offer further guidance.

Upcoming Webcasts:

FREE: Understanding the New HMDA Submission Tool
Thursday, August 3 | 2:00 p.m. – 3:30 p.m. ET 

Speakers from the CFPB will unveil and demonstrate the HMDA submission tool—be among the first to see it so you're best prepared. 

Accounting Changes: Everything but CECL
Wednesday, August 2 | 2:00 p.m. – 3:30 p.m. ET

Understand the details of accounting changes such as the new lease accounting standard, plus explore the role of the private company council and its impacts on your credit union.

 

Privacy Laws from Across the Pond: Scoping Out the GDPR; No Further Delay of DOL Fiduciary Duty Rule, But Limited Enforcement Until 2018

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

The internet has made the world both smaller and more complex. The opportunity that mobile and online banking can offer credit unions and their members is powerful, but as Spiderman (the absolute lamest of all superheroes) once said -- with great power comes great responsibility. The NAFCU Regulatory Compliance Team has had a handful of credit unions reach out to ask what, if any, responsibility they might have under the European Union's new General Data Protection Regulation (GDPR). Today we're going to take a very high-level look at the scope of the GDPR, so credit unions can begin to figure out whether they will be affected.

Background

In 1995, the European Union adopted the Data Protection Directive 95/46/EC, ominously referred to as "the Directive" in many publications, establishing the right to privacy of one's personal data. Each member state in the EU adopted its own laws and regulations to implement the Directive, creating a patchwork of privacy laws across Europe. In 2012, the EU sought to harmonize and update European privacy regulations and proposed the GDPR. The GDPR was finalized on May 24, 2016, and the deadline for compliance will be May 25, 2018.

Scope

The Directive applied mostly to organizations that had an establishment or "means of processing" physically located within the EU. The GDPR, however, expands the application of EU privacy law to organizations not located in the EU, but doing certain business in the EU.

For entities that do not have an establishment in the EU, the GDPR applies to any organization that processes the personal data of natural persons in the EU under two circumstances: 1) when offering them goods or services, even if it's not in return for payment, or 2) in monitoring their behavior which takes place within the EU. See, EU Regulation 2016/679, Ch. 1, Art. 3(2).

Definitions

The GDPR defines "personal data" as any information relating to an identifiable natural person. It does not cover anonymized data. "Processing" means any operation (or set of operations) performed on personal data, whether automated or not. This can include collection, storage, disclosure, use erasure or destruction. The GDPR contains requirements for both entities that "control" or "process" personal data. A controller is the entity that determines the purpose and means of the processing of the data. The processor is the entity that actually does the processing. So if a vendor processes data on behalf of the credit union, both the credit union and the vendor might be subject to the GDPR. See, EU Regulation 2016/679, Ch. 1, Art. 4(1)-(2) and (7)-(8).

Regarding what constitutes offering goods or services, the GDPR states that this is a case-by-case determination. Merely offering website accessibility of a service in the EU does not necessarily trigger the GDPR. However, offering a service or product in EU languages (other than those generally used in the US) or currency, or marketing the availability of goods or services to those in the EU are factors indicating the GDPR may be triggered. See, EU Regulation 2016/679, Rec. 23. The question boils down to whether the factors indicate that the credit union envisions offering goods or services to persons in the EU or not.

As with offering goods or services, what constitutes monitoring behavior is also determined on a case-by-case basis. Examples of monitoring behavior can include tracking an EU resident on the internet or using data processing techniques to profile an individual in the EU. See, EU Regulation 2016/679, Rec. 24. This could include lots of e-commerce trackers, cookies and other tools credit unions might use in website analytics.

The GDPR throws a pretty wide net, but there are lots of wrinkles involving various kinds of data processing, consent, and international jurisdictions and enforcement. Credit unions who think they may fall within the scope of the GDPR may want to consult with counsel or a consultant experienced with international privacy law to determine whether their activities might fall within the GDPR and compliance would be appropriate.

In the meantime, here are some resources on the GDPR:

• Full-text, English language version of the GDPR
• KattenMuchinRosenman's Client Advisory on the GDPR
• White & Case's Unlocking the EU General Data Protection Regulation: A Practical Handbook on the EU's New Data Protection Law
• DigitalGuardian's GDPR Infographic
• PwC's Safe Harbor and GDPR Action Plan one-sheet

No Further Delay of DOL Fiduciary Duty Rule, But Limited Enforcement Until 2018

In a Wall Street Journal op-ed, Labor Secretary Acosta stated that there was no legal basis to further delay the first implementation phase of the Fiduciary Duty Rule, and that it would go into effect on June 9th. The DOL will continue to review the rule as required by President Trump. However, the DOL also issued a Field Assistance Bulletin describing its temporary enforcement policy for the rest of the year: "the Department will not pursue claims against fiduciaries who are working diligently and in good faith to comply with the fiduciary duty rule and exemptions, or treat those fiduciaries as being in violation of the fiduciary duty rule and exemptions."

Two Roads Diverged, and I Could Not Travel Both: Regulation P's Limitations on Down-Stream Information Sharing; CFPB Proposes Delay for Prepaid Rule

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

Most credit unions are not used to thinking of themselves as the non-affiliated third party when it comes to information sharing and Regulation P… but the NAFCU Compliance Team has received a couple of questions lately about how credit unions are permitted to use and share nonpublic personal information that it receives from a nonaffiliated third party, such as from an automobile dealership through an indirect lending relationship. Regulation P does directly address how shared information can be used by those downstream in the flow of information sharing. The bottom-line: credit unions are limited by the restrictions on the entity upstream who shared the information with them.

Regulation P contains a general prohibition against sharing nonpublic personal information with nonaffiliated third parties. In order to share this information without violating the regulation's prohibition, an organization subject to Regulation P has two avenues it can take:

• Avenue 1 ― The organization can provide its privacy and opt out notice describing the organization's sharing practices, give consumers an opportunity to opt out of that sharing and honor any opt outs it receives; or

• Avenue 2 ― The organization can rely on an exception in sections 1016.13 through 1016.15 of Regulation P.

Avenue 1: The Road That Bent In the Undergrowth

Where the downstream credit union received information shared pursuant to the first avenue (i.e. notice and opt out), section 1016.11(b) contains the applicable limitations. Essentially, the downstream credit union can use the information for any reason the upstream organization could. However, this means the downstream credit union is subject to the restrictions contained in the upstream organization's sharing practices disclosed in its privacy notice and any opt out elected by the consumer. In guidance predating the Dodd-Frank Act, the Federal Reserve indicated that this means the downstream organizations wishing to use and share consumer information must have a mechanism in place which allows it to monitor and implement subsequent opt out elections received by the upstream organization. While this guidance is not binding on the CFPB, it is still informative in the absence of guidance from the bureau on this point. See, Q&A G.4.

Avenue 2: The Road That’s Grassy and Wanted Wear

Sharing done under the exception in section 1016.13 for service providers and joint marketing has its own built-in limitation on how third parties it shares with can use that information. The exception requires that a contractual agreement to be in place prohibiting the third party from disclosing or using the information for any reason other than to carry out the purpose of the disclosure.

Section 1016.11(a) contains limitations on how a downstream credit union can use and share information provided to it under the exceptions in sections 1016.14 and 1016.15. Essentially, section 1016.11(a)(1)(iii) allows the downstream credit union to disclose and use the information "in the ordinary course of business to carry out the activity covered by the exception" under which the information was provided to the credit union. For example, if information is shared with the credit union in order to process a financial product or service requested by the consumer under the exception in section 1016.14(a)(1), the credit union would not be able to further share or use that information, except to carry out the business activity of processing that product or service.

Entities Just As Fair and Having Perhaps the Better Claim

It is important to note that section 1016.11 contains additional provisions with regard to sharing with affiliates of entities already involved in the flow of information. Regardless of the avenue under which information was shared, a downstream credit union is permitted to disclose information to affiliates of the upstream organization. Downstream credit unions are also permitted to disclose information to its own affiliates, but the credit union's affiliates are bound by the same limitations on sharing and use of the information that apply to the credit union.

What Makes All the Difference

Regulation P's limitations on sharing and use by downstream credit unions requires a certain amount of knowledge about the privacy policies, opt out elections and methods of regulatory compliance of the upstream third party. This highlights the importance of considering a third party's compliance management regarding Regulation P, its privacy policies and contractual limitations regarding information sharing during the due diligence process. Credit unions can see NCUA Letter to Credit Unions 2007-13 for more information on third party due diligence.

CFPB Proposes to Prepaid Rule...But Also Releases Guide on Prepaid Form

Yesterday, the CFPB announced a proposal to delay effective date of the prepaid accounts rule by six months, or an effective date of April 1, 2018. In a related note, on March 7^th, the CFPB issued a new guide to preparing the short form disclosure required under the new prepaids rule. The short form disclosure for prepaid accounts is required by revised section 1005.18(b)(2). NAFCU-member credit unions can find more information about the prepaids rule in this Compliance Monitor article.

There is a Pokémon Gym at my Credit Union! Annual Privacy Notice Rule Proposal

Written by Stephanie Lyon, Regulatory Compliance Counsel

Thousands of people downloaded the Pokémon Go app this month and inadvertently granted the app full access to their Gmail accounts. Several Reports indicate that people did not read the information gathering clause found in the app’s Terms of Privacy. The extensive permissions could have allowed the app to obtain non-public information for the financial benefit of Niantic (if it hadn't been for meddling kids calling attention to this ‘glitch’). Why is this relevant to financial institutions? These kinds of blanket permissions found in many terms of privacy highlight the public policy reason for the implementation of privacy regulations, such as the Privacy of Consumer Financial Information rule (“Regulation P”), which implements requirements under the Gramm-Leach-Bliley Act (GLBA). Generally, Regulation P requires credit unions to provide new members with Annual Privacy Notices and send updated notices during the term of the financial relationship. 12 C.F.R. Pt. 1016. The notice is meant to alert members the manner in which their non-public information is used by the credit union and gives them an opportunity to opt-out from certain information sharing practices. See, 12 C.F.R. § 1016.1.

Regulation P requires credit unions to provide an initial notice of its privacy policies when a member joins the credit union, every year the financial relationship continues, and whenever the credit union changes its privacy policy to being sharing nonpublic personal information with nonaffiliated third parties. See, § 1016.5(a)(1) & 1016.8(a)(1)-(4). In 2014, the CFPB adopted a rule to allow financial institutions to use an alternative delivery method by posting the notices on their websites if certain conditions were met. See, § 1016.9(c)(2)(ii)(B).

On December 2015, GLBA was amended as part of the FAST Act. The amendment added a section that relived financial institutions from having to mail Annual Privacy Notices to consumers if they meet certain requirements. For more in-depth information regarding the December 2015 GLBA amendment, read Annual Privacy Notices: Can You Keep It To Yourself? (NAFCU log-in required). The statutory amendment became effective upon enactment for GLBA, but Regulation P must also be amended to formally implement the statutory changes. Hence, the CFPB is proposing to amend Regulation P to implement the 2015 GLBA amendment. The CFPB’s rule proposal would implement a new regulatory exception to limit the circumstances under which credit unions will be required to deliver annual privacy notices to their members, among other technical revisions.

The rule proposal has three main parts. The first part proposes the implementation of GLBA’s section 503(f):

(i) financial institution must not share nonpublic personal information about customers except as described in certain statutory exceptions, and

(ii) financial institution must not have changed its policies and practices with regard to disclosing nonpublic personal information from those that the institution disclosed in the most recent privacy notice it sent.

See, GLBA section 503(f)(i)-(ii), codified at 15 U.S.C. § 6803(f). The proposal also sets timeframes for delivery of notices for credit unions that fall out of the exception at some point.

The second part eliminates the ability of credit unions to post their Annual Privacy Notice onto their website as the 2014 amendment allowed. The CFPB stated in their proposal that the alternative delivery method would become unnecessary as credit unions which qualify for the alternative delivery method would no longer be required to send annual privacy notices, as the requirements are essentially the same. Hence, the CFPB argues that eliminating this requirement will create less work for credit unions and streamline the regulation.

And finally, the CFPB want to make a technical revision to a definition. Currently, Regulation P’s substantive requirements, including the requirement to deliver privacy notices, are generally imposed upon entities that meet the definition of “You” found in § 1016.3(s)(1). That provision defines “You” as a “financial institution or other person for which the Bureau has rulemaking authority under section 504(a)(1)(A) of the GLBA.” The Bureau however, does not have rulemaking authority over financial institutions in that section but rather in section 504(a)(1)(A). Hence the CFPB would correct this definition to ensure the correct section is quoted in Regulation P. Comments on the proposal are due August 10, 2016. Please let NAFCU know how this proposal could affect your credit union.

Annual Privacy Notices are an important component of keeping members informed and in control of the use of their nonpublic personal information. The proposed rule aims to streamline Regulation P by implementing the 2015 GLBA amendment.

Here is a picture of Peppermint (left), my 5 year old furry child, helping me catch Pokémons. Her brother, Chewbacca (right), doesn’t seem to share her sixth sense though…

PCI DSS Version 3.2!

Written by Eliott C. Ponte, Regulatory Compliance Counsel

Last month, the Payment Card Industry Security Standards Council released an update to its data security standards, version 3.2. The new version of the Payment Card Industry Data Security Standard (PCI DSS) will replace the current version, version 3.1, which is set to expire on October 31, 2016.

At NAFCU compliance, from time to time, we receive general questions on PCI compliance. While no one at NAFCU holds themselves as PCI Compliance expert, I wanted to answer some general PCI questions that the compliance team frequently receives, as well as highlight some of the changes to version 3.2.

 What is PCI DSS?

PCI DSS is an information security standard for organizations designed to ensure certain intuitions process, store, or transmit credit card information. This standard provides operational requirements to protect card data against unauthorized access, use, or disclosure. PCI DSS is administered by the Payment Card Industry Security Standards Council, which is an organization founded by the major credit card brands (MasterCard, Visa, American Express, Discover, etc.).

 Who must comply with PCI DSS?

PCI is a contractual compliance requirement issued by the major card brands. PCI DSS generally applies to all entities involved in payment card processing, including merchants, processors, acquirers, issuers, and service providers as well as all other entities that store, process, or transmit cardholder data and/or sensitive authentication data. Credit unions may be both merchants, if the credit union allows cash withdrawals from credit cards at the teller line, and service providers, if their member’s credit card information stored on their systems.

Periodic validation of compliance is usually required. Non-compliance with PCI DSS requirements could result in potential liability, including fines levied by the payment card brands and the CFPB. Each payment card brand has its own program for compliance, validation levels, and enforcement. More information about compliance can be found at the links below:

• MasterCard: mastercard.com/sdp
• American Express: americanexpress.com/datasecurity
• Discover: discovernetwork.com/fraudsecurity/disc.html
• JCB International: http://partner.jcbcard.com/security/jcbprogram/
• Visa Inc: visa.com/cisp

 What Does Version 3.2 Change?

According to the PCI press release on version 3.2, the primary changes are clarifications on requirements that help organizations ensure critical data security controls are in place, monitored, and effectively tested. Nevertheless, the updated PCI DSS changes are significant.

One major change to PCI DSS is that version 3.2 implements a multi-factor authentication process for all personnel with non-console administrative access and all personnel with remote access to the cardholder data environment. Another major change affects requirements for entities using Secure Socket Layer/early Transport Layer Security for encrypted data transmission, and the integration of Designated Entities Supplemental Validation assessment.

Credit unions that meet the definition of service providers will want to pay particular attention to the new requirements imposed on them. For example, service providers will be required to maintain a documented description of the cryptographic architecture, detect and report on failures of critical security control systems, and perform reviews at least quarterly to confirm personnel are following security policies and operational procedures. Requirements 3.5.1; 10.8; 12.11. In addition, executive management is now responsible for the protection of cardholder data and PCI DSS compliance. Requirement 12.4.1.

For a high-level overview, the Payment Card Industry Security Standards Council released a summary of the changes from version 3.1 to version 3.2. The summary places changes into three different categories: (1) clarifications to existing rules, (2) additional guidance, and (3) “evolving requirements” (updated or new requirements). Credit unions should note that “evolving requirements” have an effective date of February 1, 2018. Credit union’s that are required to conduct PCI compliance should carefully review this document to determine how the new version affects their security standards. Other resources available to credit union's include a quick reference guide, a version 3.2 resource guide, a PCI FAQ database, a guide on migrating from SSL and Early TLS, and a version 3.2 high-level webinar. The Security Standards Council also has a blog, which provides some background commentary on the changes.

NCUA Issues Letter to Credit Unions on GLBA Privacy Amendment; Dog’s First Snow Fall, Cat Doesn’t Care

Written by Eliott C. Ponte, Regulatory Compliance Counsel

Regular readers of the NAFCU compliance blog will note that we have been covering the recent change to annual privacy notices since the enactment of the “Fixing America’s Surface Transportation Act,” or the “FAST Act.”  As noted in our December 30^th  and December 23^rd blogs NAFCU was pleased that the Gramm-Leach-Bliley Act (GLBA) was amended, as NAFCU had long advocated for regulatory relief  because our members have consistently communicated that their members find these disclosures more confusing than helpful.  Upon the enactment of the FAST Act, NAFCU President and CEO Dan Berger wrote Director Cordray urging the Bureau to “act swiftly to implement these statutory changes and clarify the controlling law.”  The CFPB responded a few days later by stating that financial institutions are not expected to comply with the regulatory requirements that were superseded by the FAST Act.

On Monday, NCUA chimed in on the recent change by issuing a letter to Federally Insured Credit Unions further clarifying the new expectations under the amended GLBA.  Most notably, the NCUA stated that it has instructed credit union examiners to only expect annual privacy notices to be provided if a credit union does not meet the new annual notice requirements.  Furthermore, the NCUA shared what examiners will be looking for when determining if the credit union is required to send annual privacy notices.  In relevant part, the NCUA letter states:

“Dear Board of Directors and Chief Executive Officer:

If you have not changed your credit union’s privacy policy since your last annual privacy notice, you may not have to send another privacy notice this year—as long as you meet the conditions described in this letter.

 ....

Based on the amendment, your credit union need not provide an annual privacy notice if:

• Your policies and practices have not changed since your credit union provided its most recent privacy notice to consumers; and
• You share nonpublic personal information with nonaffiliated third parties only in accordance with requirements for certain existing GLBA exceptions, including those related to:
  • Performing services for, or functions on behalf of, the credit union, pursuant to a joint marketing agreement;
  • Administering, servicing, or processing a transaction a consumer requests or authorizes; maintaining or servicing certain consumer accounts; or performing securitizations, secondary market sales, or similar transactions; or
  • Other specified operational and legal purposes, including disclosure with the consumer’s consent or at the consumer’s direction and disclosure to protect the confidentiality and security of records related to the consumer, service, product, or transaction.

NCUA examiners have been notified that if your credit union meets the applicable requirements, you need not send annual privacy notices unless and until your credit union no longer meets those requirements. NCUA examiners will only expect annual privacy notices to be provided if your credit union does not meet the new requirements described in this letter.

NCUA staff will consult with Consumer Financial Protection Bureau staff as CFPB works to implement the FAST Act’s amendment to GLBA and address interactions with other laws, such as the Fair Credit Reporting Act.”

16-CU-03 (emphasis added).  As consistent with our prior blog posts, credit unions that meet the outlined criteria can take advantage of the newly amended GLBA exception and not provide annual privacy statements to their members.  Credit unions that plan on taking advantage of the newly amended GLBA should review the FAST Act to ensure their credit union qualifies for the exception. 

The full letter can be found on the NCUA’s website.

***

Dog Meets Snow; Cat Doesn’t Care About Snow

This weekend was a very exciting time for my puppy, Macie,  She experience snow for the first time.  It was an exciting experience for her.  I share her experience with you in the video below (if you cannot see the embedded video, click here):

 

 I thought she would miss the warm weather of Puerto Rico after the blizzard hit, but it looks like she found bliss in our cold climate.

Miles, my youngest cat, didn't care about snow or the blizzard.  In fact, the only thing my cat cares about is hot radiators.  

 In my house, once we turn on the heat, Miles glues himself to our radiators.

 

 This is him after we removed all of our holiday cards.  I am really not sure he moves. Oh to be a cat!

 

Transportation Bill Modifies Annual Privacy Notice Requirement for Credit Unions; Programming Note and Happy New Year from NAFCU Blog!

Written by Shereefat Balogun, Regulatory Compliance Counsel

As we noted in last week's blog, on December 4, 2015, President Obama signed a transportation bill formally known as the “Fixing America’s Surface Transportation Act”, or the “FAST Act”. Now, one would not typically expect to find anything pertaining to financial privacy in a transportation bill. However, buried in the 490 page bill is a significant amendment to the Gramm-Leach-Bliley Act’s (“GLBA”) annual consumer privacy notice requirement. Specifically, the FAST Act amends the GLBA by adding an exemption to the requirement.

Section 503 of the GLBA, and Regulation P which implements the act, require that credit unions send annual privacy notices to their members. These notices must describe whether and how the credit union shares members’ nonpublic personal information. If the credit union discloses this information with nonaffiliated third parties, generally the credit union must notify members of their right to opt-out of the sharing.

The FAST Act’s new amendment provides an exception to the annual privacy notice requirement for any credit union that satisfies the following two conditions:

1. the credit union does not share nonpublic personal information with nonaffiliated third parties, except under certain exceptions enumerated in Regulation P, e.g., to service providers who perform services on behalf of the credit union pursuant to a joint agreement; or as necessary to administer or enforce a transaction requested or authorized by the member; and
2. the credit union has not changed its privacy policies and practices with respect to disclosing nonpublic personal information since it last provided a privacy notice to its members.

Under the amended law, if a credit union meets both of these conditions, it is no longer required to provide privacy notices to individual members on an annual basis. Alternatively, if a credit union cannot meet both of these conditions, it must continue to provide a privacy notice annually. In other words, annual privacy notices are required if and when a credit union makes changes to data sharing or begins sharing member data in a way that would trigger an opt out right. Keep in mind that these kinds of changes often require a revised privacy notice under section 1016.8      

If a credit union does not satisfy these conditions, and thus must provide annual privacy notices, it may post the privacy notice online rather than issue individual notices by mail pursuant to a final rule issued by the CFPB last fall.  Note, however, that this online notice alternative is available if certain conditions are met, such as not sharing data in ways that would trigger members’ opt-out rights. NAFCU previously published a Compliance Monitor article that discusses last year's changes, including when an annual privacy notice may be provided online. 

NAFCU has long advocated for regulatory relief in this area because our members have consistently communicated that their members find these disclosures more confusing than helpful. NAFCU hopes that these amendments will both reduce member confusion and lower credit unions’ administrative costs.

Note that the amendment to the GLBA became effective on December 4, 2015.  Moreover, the CFPB recently confirmed with NAFCU that it will treat the FAST Act’s amendment as controlling law.  Specifically, the bureau stated that it “is conveying to its supervision and enforcement staff that the law is effective immediately so that no financial institution is expected to comply with superseded regulatory requirements.” It is anticipated that the CFPB will amend Regulation P to reflect the new exception sometime in the coming year.

Programming Note & Happy New Year From the NAFCU Blog

NAFCU will be closed on December 31^st and January 1^st for the holidays, but we will be back to blogging on Monday, January 4^th. From everyone here, we wish you and yours a safe and happy holiday and a prosperous New Year!

Annual Privacy Notice Update; Rates They Are A-Changin’ Part II: Advertising and Marketing Variable Rate Products; The Truth About Ollie; Programming Note & Happy Holidays from the NAFCU Blog

Written by Elizabeth M. Young LaBerge, Regulatory Compliance Counsel

Annual Privacy Notice Update

When the relief measures regarding privacy notices were signed into law earlier this month as part of the transportation authorization bill, focus turned to the CFPB in hopes it would implement regulatory changes to the privacy notice requirements. Hearing the need for clarity from credit unions, NAFCU President and CEO Dan Berger wrote Director Cordray last week urging the Bureau to "act swiftly to implement these statutory changes and clarify the controlling law through a formal announcement or the promulgation of an interim final rule."​As you may have already read, the CFPB responded to NAFCU’s call for clarity yesterday and explained that it is conveying to its supervision and enforcement staff that no financial institution is expected to comply with the regulatory requirements which were superseded by that law. In the meantime, the CFPB is working with other regulators on a rulemaking to reconcile regulatory requirements with the law on the books. The full text of the response is available here. We will keep you updated as we hear more from the regulators on these changes.

Advertising and Marketing Variable Rate Products

 

Now that rates have budged for the first time in six years, we thought it might be good to refresh your memory regarding regulations specific to variable rate products. Last week, Benjamin Litchfield provided a summary of the disclosures requirements on variable rate products. Below is a quick outline of common regulations involved in advertising variable rate products.

Truth in Savings (TIS)

Section 707.8 of NCUA’s Truth in Savings regulations addresses advertising, and would apply to the advertisement of share or deposit accounts. If the advertisement states a rate of return, it must state the rate as an “annual percentage yield,” though if that phrase has been stated once, the term “APY” may be used thereafter. See 12 C.F.R. § 707.8(b). Under the regulation, the annual percentage yield (APY) is a trigger term, and if it is included in the advertisement, additional information must also be included, including whether the APY is variable. If the APY is variable, the advertisement must clearly and conspicuously state that the rate may change after the account is opened. See section 707.8(c)(1).

There are exemptions to this requirement for certain media outlets or methods of advertisement. If an advertisement is done over broadcast or electronic media (e.g. television or radio), outdoor media (e.g. billboards) or telephone response machines, then it is allowed to only use the shorter phrase “APY,” and the variable APY statement is not required. Also, if the advertisement is on a sign located inside a credit union or a share or deposit broker, or in a newsletter sent by the credit union, APY can be used throughout, and the variable statement if not required, though it must contain a statement advising members to contact an employee for further information about applicable fees and terms. See section 707.8(e).

Regulation Z

With regard to loans, Regulation Z contains multiple sections and subsections on advertising. More than one section may come into play, depending on the product advertised, the method of advertisement and the content of the advertisement.

When advertising variable rate, closed-end credit, if the APR is stated in the advertisement, it must also state that the APR is subject to increase. See 12 C.F.R. § 1026.24(d)(2)(iii). If the loan is also secured by a dwelling, the advertisement must state a simple rate based on a reasonably current index and margin, the period of time each rate will apply and an APR. See section 1026.24(f)(2)(i). In subsection 1026.24(i), there are strict requirements for certain practices, such as using the word “fixed” in connection with a variable rate transaction or advertising comparisons of payments and rates. As in Truth in Savings, there are disclosure exceptions and alternatives related to the advertising media or method ― consult the full regulation for details.

Regarding open-end credit, Regulation Z requires that when the periodic rate is stated in the advertisement, it should be stated as an annual percentage rate. If the rate is variable, that must be disclosed. See section 1026.16(b)(1)(ii). To disclose the APR for a variable rate plan, a credit union can use an insert showing the current rate or provide a rate as of a specified recent date. When advertising home equity plans, the advertisement must clearly and conspicuously state the maximum annual percentage rate (APR) that may be imposed. See section 1026.16(d)(1)(iii). Again, the regulations includes exceptions and alternatives for disclosures with certain methods of advertisements. For example, television and radio advertisements can avoid some disclosures by listing a toll free number to obtain additional information. See section 1026.16(e).

When advertising promotional rates, there are similar requirements for both home secured and non-home secured open-end credit plans. The advertisements must disclose that the rate will be variable and disclose a “reasonably current” APR that will apply after the promotional period ends. See subsections 1026.16(d)(2) and (g)(4). An APR is reasonably current if it is based on an index and margin current within 60 days before mailing to a physical address, or 30 days before e-mailing, posting on a website or printing in a generally available publication. See sections 1026.60, 1026.16 and Supplement I to Part 1026, comment 1026.16(d)-6. For non-home secured open end credit, if the rate or margin is determined by the consumer’s creditworthiness, the advertisement must disclose a list or range of rates that could apply. See section 1026.16(g)(4)(ii). There are slight differences between home secured and non-home secured disclosures, so be sure to check the correct subsection of 1026.16 when reviewing open-end credit advertisements.

If sending solicitations for credit cards, consult section 1026.60 which contains detailed requirements for solicitations, separated by the method of solicitation. For NAFCU members, the October 2015 Compliance Monitor contained an article entitled Opening Credits: Reminders For Advertising, Soliciting, Underwriting and Other Regulations Regarding Opening Credit Card Accounts which contains details regarding credit card solicitations and may be useful.

As always, if you are a NAFCU member struggling with finding the advertisement guidance you need, contact your NAFCU compliance team for assistance. We are here to help!

The Truth About Ollie

Earlier this month, I mentioned that I had ordered a genetic test to determine the breed of my dog Ollie. Guesses as to Ollie’s breed included Maltese, Lhasa Apso, Maltipoo, Maltichons, Havenese, Cotonese, Coton de Tulear, and a variety of other breeds I have never heard of before. Who knew the universe of tiny, white dogs is so big? In the end, no one nailed it exactly.

The results are in and Ollie is…

My husband and I have been referring to him as a Bichon-Maltijack, but a quick google search indicates that we may have made that up. If you are interested in reading the full report, it is here.

Programming Note & Happy Holidays From the NAFCU Blog

NAFCU will be closed on December 24^th and 25^th for the holidays, but we will be back to blogging on Monday, December 28^th. From everyone here, we wish you and yours a safe and happy holiday!

NCUA Issues Regulatory Alert: Qualifying Credit Unions Can Post Privacy Notices Online

Victoria Daka, Regulatory Compliance Specialist

The NCUA recently issued a regulatory alert notifying credit unions that qualifying credit unions may now provide annual privacy notices required under the Gramm-Leach-Bliley Act (GLBA) and its implementing regulation, Regulation P, by posting information online. This alert is in response to the CFPB’s recently issued final rule.

The GLBA requires financial institutions to provide their customers with annual notice of their privacy policies. The implementing regulation of GLBA, Regulation P, specifically provides ways in which financial institutions may provide this notice, which includes mail, hand delivery and now online for qualifying credit unions.

In order for credit unions to use the new alternative delivery method, they must satisfy the following conditions:

• Not disclose customer’s nonpublic personal information to nonaffiliated third parties except for purposes in which Regulation P draws out a limited exception from the opt-out requirements;
• Not include an “opt out” under the Fair Credit Report Act (FCRA) on the privacy notice;
• Must have previously satisfied the affiliate marketing provisions of FCRA and its implementing regulation, Regulation V, if applicable, or the annual privacy notice is not the only notice provided to satisfy those requirements;
• The information in the most recent privacy notice must remain consistent with previous notices with the exception of eliminating categories of information shared or parties in which the credit union shares customer information with; and
• Must use the form provided in the appendix to Regulation P for the annual privacy notice.

How the new alternative delivery method works:

The final rule permits credit unions to deliver the annual privacy notice on the credit unions’ website, provided the credit union satisfies the above conditions, and provides notice to the customer that the privacy notice is available on the credit unions’ website, compliant with the rules procedures.

The final rule provides an example of a proper disclosure.

Going forward, credit unions may…

• If the credit union elects to employ the new alternative delivery method, it must notify members through a “clear and conspicuous” notice that its privacy notices are now available on the credit unions’ website. However, the credit union must inform members that members reserve the right to continue with the traditional delivery methods of mailing or hand delivery. Credit unions should make this notification available to the member’s account statement or coupon book.
• If the credit union elects to continue delivery of annual privacy notices to customers by the traditional methods of delivery, mailing or hand delivery, it can disregard the above procedures.

To view the NCUA’s Regulatory Alert in its entirety, see here.

Election Day and Lame Duck Congress around the Corner

Written by, Jillian Pevo, Director of Legislative Affairs               

It seems like we are in a perpetual campaign cycle here in Washington, DC, I’m sure many of you have seen enough political commercials, yard signs and shameless self-promotion in the last six months to last a lifetime. The stakes seem to be pretty high for a midterm election with Senate Democrats fighting to keep a razor thin majority and a number of competitive statewide races that could go either way. In the House of Representatives, Republicans are expected to retain their majority but there will still be some personnel changes on key committees. With just over a week to go, national headlines are being dominated by issues of concern to many Americans including the government’s response to the Ebola virus and Islamic State in Iraq and Syria (ISIS). These high-profile issues and others could sway undecided voters as they head to the polls next Tuesday. 

Regardless of election outcomes, the current Congress is scheduled to reconvene one last time after election day for a “lame duck” session.  While much of the session’s agenda will be shaped by what happens on election day and who will control Congress in January, there are a few items that are very likely to see action, including government funding and expiring tax provisions known as tax extenders. At NAFCU, we will continue to push the Senate to take up House-passed regulatory relief measures that will make small but positive changes at our nation’s credit unions. These measures include:

• Exempting financial institutions from sending annual privacy notice disclosures when policies have not changed (House-passed H.R. 749/S. 635 awaits Senate action).  While the CFPB has recently acted on this issue, we believe a legislative solution is the better answer in the long run;
• Providing credit unions parity with FDIC-insured institutions when it comes to deposit insurance coverage on Interest on Lawyers Trust Accounts or IOLTAs (House-passed H.R. 3648/S. 2699 awaiting Senate action); and
• Amending the calculation of points and fees under the CFPB’s qualified mortgage rule (House-passed H.R. 3211/S. 1577 awaiting Senate action).        

While legislative action this Congress is unlikely, NAFCU will also continue to push lawmakers to address the lack of national data security standards at retailers. Countless breaches occurred while Congress was out of session including the massive Home Depot breach. NAFCU has called for the creation of a bipartisan-bicameral Congressional working group to get key lawmakers together to devise a set of legislative policy prescriptions that would put standards into place at retailers and ensure that they are financially liable when a breach occurs on their end. President Obama recently called for national legislation to address ongoing data security breaches and we are hopeful that Congress acts with urgency.

Please don’t hesitate to reach out to NAFCU’s Legislative Affairs division should you have any questions about matters before Congress. And, don’t forget to vote! 

CFPB Finalizes the Privacy Notices Rule; Seminar 2014 Wrap and Group Photo; Fall Fun with the Fam

Written by JiJi Bahhur, Director of Regulatory Compliance

On Monday, the CFPB announced that it finalized the privacy notices rule with the intent to promote more effective privacy disclosures from financial institutions to their customers/members.  So now the answer to the burning question that so many credit unions have been asking: Does the credit union still need to send annual privacy notices to its members? 

Short Answer

Yes, the credit union still needs to send annual privacy notices to its members; however, the CFPB’s final rule allows a credit union to post this annual privacy notice online instead of sending it out individually to members IF certain conditions are met.  

Long(er) Answer

Under the CFPB’s privacy notices final rule, credit unions will be able to post annual privacy notices online instead of distributing an annual paper copy to each individual member, if the credit union satisfies the following conditions:

1. The credit union does not share its members’  nonpublic personal information with nonaffiliated third parties in a manner that triggers Gramm-Leach Bliley Act (GLBA) opt-out rights;
2. The credit union does not include on its annual privacy notice information about certain consumer opt-out rights under section 603 of the Fair Credit Reporting Act (FCRA);
3. The credit union’s annual privacy notice is not the only notice provided to satisfy the requirements of section 624 of the FCRA;
4. The information included in the privacy notice has not changed since the member received the previous notice; and
5. The credit union uses the model form provided in GLBA’s implementing Regulation P.

Credit unions that meet the conditions above and that choose to rely on this new method of delivering privacy notices are also required to:

1. Convey at least annually on a regular consumer communication, such as a monthly billing statement, that the credit union’s privacy notice is available on its website and in paper and will be mailed upon request made to the provided toll-free number. This notice or disclosure would have to also include a specific web address that takes the member directly to the privacy notice;
2. Post the credit union’s current privacy notice continuously on a page of its website that contains only the privacy notice, without requiring a login or any conditions to access the page; and
3. Promptly mail (within 10 days) the credit union’s current privacy notice to consumers who request it by telephone.

If the credit union does not meet the conditions above or chooses not to use the new disclosures method, it will need to continue to deliver annual privacy notices to its members using other delivery methods. 

This blog won’t address some of the nitty gritties within each of the conditions above, but I do want to make a few quick mentions:

• While this final rule constitutes an important step to achieving improved annual privacy notice requirements, it is only available to those credit unions that do not share information with nonaffiliated third parties outside of the Regulation P exceptions [Ed. 10/23] .  In other words, credit unions that do share information with nonaffiliated third parties cannot take advantage of this final rule.

• NAFCU has long advocated for the elimination of duplicative and costly annual privacy notices.  In its comment letter, NAFCU noted that CFPB should not require credit unions to continuously post their privacy notices on their websites.  NAFCU argued that this “continuously” verbiage would effectively require that credit unions’ website remain functional at all times.  In the preamble to the final rule, the CFPB discussed NAFCU’s concerns and emphasized that this requirement “assumes that financial institutions will post the privacy notice on their websites so that the notice is available but for occasional or unavoidable interruptions, such as routine maintenance or unexpected malfunctions.”   In other words, the credit union will not violate this requirement if its website temporarily malfunctions.

The final rule is available in its entirety here.  NAFCU’s Regulatory Affairs team is working on a summary of the final rule, which when available, will be located here.  Also, NAFCU’s compliance team intends to address this final rule in more depth in near future publications. 

***

Seminar 2014 Wrap and Group Photo.  Last week, NAFCU held its 2014 Regulatory Compliance Seminar.  The program contained 4 days of the hottest credit union compliance topics, great speakers, and an amazing group of attendees.  Below, I’ve shared a group photo taken during the event.

If you’re interested in attending Seminar next year, check out some of the details here.

***

Fall Fun with the Fam.  I had to sneak this in.  It’s not often that I can get the entire family to look at the camera at the same time!

CFPB Extends Privacy Notice Comment Period; More on NCUA’s Associational Common Bond Proposed Rule; Free Kick; Programming Note

Written by Ricardo Piñeres, Regulatory Compliance Counsel

CFPB Extends Privacy Notice Comment Period.  On Wednesday, the CFPB extended the comment period for its proposed rule regarding annual privacy notices.  The substance of the proposal remains unchanged, but the deadline for comments has been moved from June 12 to July 14.  A brief summary of the proposed rule can be found in our May 9, 2014, blog post.  Furthermore, NAFCU has published a Regulatory Alert regarding the proposed rule (NAFCU member log-in required to access the alert).

***

More on NCUA’s Associational Common Bond Proposed Rule.  Our April 25, 2014, recap of the April NCUA Board Meeting included a brief summary of NCUA’s Associational Common Bond Proposed Rule.  The summary covers two of the three parts of the proposal: the new purpose of formation threshold and the new factors regarding corporate separateness to the “totality of the circumstances” test.

The final portion of the proposal would make the process for adding some associational groups easier.  In reviewing past determinations, NCUA has identified certain associational groups that it has historically and regularly determined satisfy the associational common bond requirements.  These groups are:

• Alumni associations;
• Religious organizations (including churches or groups of related churches);
• Electric cooperatives;
• Homeowners associations;
• Labor unions;
• Scouting groups; and
• Associations that have a mission based on preserving or furthering the culture of a particular national or ethnic origin.

When a federal credit union applies for one of these groups to be added to its field of membership, the proposal would call for the associational group to be automatically approved, thus not having to go through the threshold or “totality of the circumstances” determinations.  While the proposed rule identified the above groups for this fast-track approval, NCUA is seeking public comment on whether other categories of associational groups should be included when the final rule is released.  Comments on this issue and the rest of the proposed rule are due by June 30.

Outside of the proposed rule’s changes to the Chartering and Field of Membership Manual, the preamble section of the proposal makes mention of NCUA’s ongoing associational group quality review process.  The preamble says:

“[ ] NCUA is finding that associational groups, in conjunction with or at an FCU’s instigation, are adding members outside of the FCU’s historical operating area to increase FCU membership. This practice does not comply with the limitations in the Chartering Manual.  Other associations have changed significantly since they were added to an FCU’s [field of membership], and no longer meet the criteria for the totality of the circumstances test they once met. NCUA is currently reviewing several associations. If any of these associations no longer meet the totality of the circumstances test or an association is not operating according to their official bylaws in a way that impermissibly affects credit union membership, NCUA will remove the association from the FCU's [field of membership].”

This is the first instance, that NAFCU is aware of, where NCUA has publically announced this quality review process.  That said, the agency notes that it is already in place and is an ongoing program run by NCUA’s Office of Consumer Protection.  The program reviews associational groups on a case-by-case basis to determine their compliance with the current associational common bonds requirements.  While nothing in the proposal would change this program, NCUA chose to highlight it in the proposed rule in light of the agency’s increasing concerns that federal credit unions are artificially using associational groups for the sole purpose of increasing a credit union’s membership.  This concern is also highlighted in NCUA’s September 2013 Letter to Federal Credit Unions where the agency stated its concerns regarding advertisements that claim that a federal credit union’s fields of membership is “open to anyone.”  NAFCU will continue to monitor and talk to NCUA about this quality review process.

Lastly, NAFCU has released a helpful Regulatory Alert (NAFCU member log-in required) on the proposed rule, and is currently in the process of developing a comment letter on behalf of our members.  NAFCU member credit unions that would like to provide us with input that can be used in our comment letter are highly encouraged to fill out our Associational Common Bond Survey by June 6, 2014.

***

Free Kick.  I am taking a break from my World Cup group previews, so that I can take a moment to express my joy over the fact that the long, nine-year wait for silverware has finally come to an end!  It wasn’t pretty, but somehow Arsenal was able to claw their way back after digging themselves an early 0-2 hole in the FA Cup Final.  I still believe that the squad needs to be improved during the summer transfer window, and Arsene Wenger must do a better job of ensuring that the team doesn’t start big matches in such a flat manner.  That said, I will categorize this season as a success.

Well done, Gunners!  Proud to be a supporter of the 2014 FA Cup Champions!!!

***

Programming Note.  NAFCU’s offices will close at noon today for the Memorial Day Holiday and will reopen on Tuesday, May 27.  We will be back to blogging on Wednesday, May 28.

CFPB Proposed Rule Round-up; Spoiled Pup

Written by Brandy Bruyere, Regulatory Compliance Counsel

Happy Friday everyone! There’s reason to feel a bit optimistic today, a rare treat for those who spend their time navigating complex regulations. Today we’ll review some of the key provisions of three recent CFPB proposed rules in the areas of privacy, mortgages, and remittances.

Proposed Rule on Privacy Disclosures

On May 6^th, the CFPB proposed a rule that would bring some relief for the requirement to provide annual privacy notices. Currently, credit unions must mail or electronically deliver a privacy notice to each member every year. Under the proposed rule, a credit union could generally post this notice on their website instead, provided that five conditions are met:

(1) the credit union does not share the member’s nonpublic personal information with nonaffiliated third parties in a way that triggers a member’s opt-out rights;

(2) the credit union does not include on its annual privacy notice a FCRA opt-out notice;

(3) the credit union’s annual privacy notice is not the only notice provided regarding sharing consumer reports with affiliates for marketing purposes under the FCRA;

(4) the information included in the privacy notice has not changed since the member received the previous notice; and

(5) the credit union uses the model form provided in Regulation P.

The proposed rule would require credit unions that use this alternative delivery method to provide a “clear and conspicuous statement” annually on a notice or disclosure that is sent to the member announcing that the privacy disclosure is available online. Credit unions would also have to mail the notice to members who request it. Comments are due to the CFPB thirty days after the proposed rule is published in the Federal Register.

Proposed Changes to the Ability-to-Repay/Qualified Mortgage Rule

On April 30^th, the CFPB proposed some “minor” changes to the mortgage rules. Two of these changes relate to certain 501(c)(3) nonprofits and do not impact credit unions, but the third may help some credit unions meet the points and fees requirements of a Qualified Mortgage (QM).  The points and fees calculation under the Ability to Repay (ATR) rule is very complex, and the CFPB acknowledged that this can lead to “inadvertent errors” in making the QM determination. Under the proposed rule, under certain limited circumstances, if a loan inadvertently exceeds the points and fees limit, the credit union could “cure” this problem after consummation.  To be eligible for this relief, the credit union would have to meet three requirements:

• The credit union originated the loan in good faith as a QM and the loan otherwise meets the requirements of the ATR rules;
• The credit union refunds the member any points and fees over the 3% threshold within 120 days of consummating the loan; and
• The credit union maintains policies and procedures for reviewing loans post-consummation  and making refunds as needed.

In addition to these provisions, the CFPB is also seeking comment on whether a similar post-consummation cure could be provided for loans exceeding the ATR rule’s 43% debt-to-income ratio requirement. The Bureau is also seeking feedback from smaller creditors regarding how their lending operations have changed due to the new mortgage rules. Comments are due to the CFPB  by July 7, 2014.

Proposed Changes to Remittance Rule

Finally in case you missed it, on April 15^th, the CFPB is considering some revisions to the remittance rule. First, the proposed rule would extend the temporary exception that allows credit unions to estimate fees and exchange rates in some cases. If finalized, the exception would apply until July 21^st, 2020, the latest date permitted under Dodd-Frank. Second, the Bureau is seeking comment on how to treat US military bases abroad under the rule. The CFPB proposal would consider these military bases to be within a “State” for the purposes of the rule. This would mean that transfers to “designated recipients” located on US military bases from the US or another such base would not be considered a remittance for the purposes of the rule. Other minor proposed revisions include:

• Determine the purpose of the transfer based on the purpose of the sender’s account (i.e. personal, family, or household purposes);
• Revise the CFPB staff commentary to clarify that disclosures may be provided by fax; and
• Change sections of the rule’s error resolution process.

Comments are due to the CFPB by May 27, 2014.

Spoiled Pup

We finally got rid of one of our last “college kid” pieces of furniture and replaced our couch. Of course, it did not take long for Lemmy to decide that he belonged on the chaise lounge. He even prefers to make use of a decorative throw pillow to further cushion his head. I keep telling myself I’ll be firmer with him, but saying no to that face is hard!

CFPB Releases Semiannual Regulatory Agenda--Fall 2013

Written by Brandy Bruyere, Regulatory Compliance Counsel

Happy Monday compliance folks! My name is Brandy Bruyere and I am one of two new Regulatory Compliance Counsels here at NAFCU. As this is my first blog post, and it's Monday, we'll start with something short.

Last week the CFPB posted its Semiannual Regulatory Agenda for Fall 2013. This agenda provides insight into which regulations the CFPB will focus on over the next six months. The agenda is organized by rulemaking stage and is current as of September 6, 2013.” Here is the list of various regulations by stage:

Prerule State:

• Home Mortgage Disclosure Act (Regulation C)
• Annual Privacy Notice
• Payday Loans and Deposit Advance Products
• Debt Collection Rule
• Overdraft
• Further Amendments to 2013 Mortgage Rules (Regulations X and Z)

Proposed State:

• Requirements for Prepaid Cards (Regulation E)
• Supervision of Certain Nonbank Covered Persons—Defining Larger Participants in Certain Consumer Financial Product and Service Markets
• Amendments to FIRREA Concerning Appraisals
• Extension of the Temporary Exception for Certain Disclosures Under the Remittance Transfer Rule

Final Rule Stage:

• Restatement of Federal Consumer Financial Law Regulations
• Amendments to TILA Concerning Appraisals
• Integrated Mortgage Disclosures under RESPA (Regulation X) and TILA (Regulation Z)
• Equal Access to Justice Act Implementation Rule
• Rules of Practice for Issuance of Temporary Cease-and-Desist Orders
• The Expedited Funds Availability Act (Regulation CC)
• Defining Larger Participants of the Student Loan Servicing Market*
• Amendments to 2013 Mortgage Rules (Regulations B, X, and Z)

* Since releasing the agenda last week, the CFPB has published a final rule on “Defining Larger Participants of the Student Loan Servicing Market.”

The CFPB blog announcing the release of the agenda also highlights certain pending rulemakings such as regulation of prepaid card products and its expectations to release a proposal to reduce the annual privacy notices customers must receive. The blog also discusses areas the agency will consider in 2014 for potential regulation such as debt collection, payday loans and deposit advance products.

The 12%: The Ballad of the 113th Congress

Written by Katie Marisic, VP of Political Affairs

With all the new regulations about to go in effect in the coming months we thought we’d give you a little break from the normal updates and let you sit back, relax and enjoy what Congress has to offer. But first here is a corgi doing an impression of Congress  trying to pass legislation.

It’s been week after the government shutdown ended and Washington, D.C. is quickly returning to its “normal state.”  Federal employees have returned to work, acrimonious congressional hearings   are being held and the panda cam is back in action.

Next week the budget conference committee tasked with finding a compromise on the Continuing Resolution and Extension of the Debt Ceiling will meet. There was a lot of talk going around that a compromise would involve major tax reform, but yesterday both Senate Majority Leader Harry Reid (D-NV) and House Budget Committee Chairman Paul Ryan (R-WI) appeared to rule out the idea of a grand bargain.

With an approval rating of 12%, and a record of passing legislation that has them on track to be the least effective Congress in American history, the idea to scale back the grandiose rhetoric and focus on something that is achievable seems like a pretty good plan. Here's that corgi again.

But just because tax reform might not be in this compromise doesn’t mean that the issue is going away. Both Sen. Max Baucus (D-MT) and Rep. Dave Camp (R-MI), chairmen of the committees that deal with tax reform have repeatedly expressed their desire to pass legislation this Congress. Sen. Baucus is retiring and Camp’s tenure as Chairman is term limited so both of them have significant interest in making something happen before 2015.

If Congress does a 180, and starts working together anything could happen. It’s important that we keep encouraging them to focus on legislation that is beneficial to credit unions. S. 635, the Privacy Notice Modernization Act of 2013, is one bill that we want to make sure stays on their radar. Similar legislation has already passed in the House and a presidential signature on this bill would be a boon to credit unions.

All of this is assuming they come to a compromise, if the conference committee can’t come to a bargain by December 15 be prepared for round two of shutdowns. But just because Congress might not be able to meet their deadlines doesn’t mean you can miss yours. Make sure your credit union is prepared for all the compliance deadlines by visiting the NAFCU Compliance Calendar.

Before you return to your regularly scheduled program here is one more video to get you through your day.

Have a great weekend!

NCUA Finalizes Technical Amendments on Privacy; SAFE Act & Share Insurance

Written by Steve Van Beek

Last Thursday, NCUA issued a final rule which made numerous technical corrections to NCUA's regulations. Of note are three that had caused continued confusion for compliance officers of credit unions:

• NCUA's Privacy Regulation - 12 CFR 716

• NCUA's SAFE Act Regulation - 12 CFR 761

• Share Insurance Coverage of Noninterest-bearing Transaction Accounts - 12 CFR 745.14

Privacy & SAFE Act. NCUA lost authority for both privacy and the SAFE Act on July 21, 2011 when regulatory authority transferred to the CFPB and the technical amendments add cross-references to the CFPB's regulations which credit unions must follow. Here is from the final rule:

"In 2010, President Obama signed into law the Dodd-Frank Act. The Dodd-Frank Act substantially changed the federal legal framework with respect to consumer financial protection regulation. Among the many changes, title X of the Dodd-Frank Act transferred to the CFPB NCUA’s rulemaking authority under the Gramm-Leach-Bliley Act and the Secure and Fair Enforcement for Mortgage Licensing Act of 2008.

…

To assist federally insured credit unions, the rescinded parts of NCUA’s regulations will retain their original heading and be amended to include a cross citation to the CFPB’s republished version of the regulation."

NCUA's regulations will be updated with the cross-reference after the final rule is published in the Federal Register. The CFPB’s privacy regulation is 12 CFR 1016 and the SAFE Act regulation is 12 CFR 1007.

Share Insurance. The third amendment I wanted to highlight - the amendment to NCUA's Share Insurance regulation - was one that NAFCU had asked for numerous times since December 31, 2012 (including our "Update the Regulations, Please!" blog post). Here is NCUA's summary of their amendment:

"Section 343 of the Dodd-Frank Act provided that, on a temporary basis, NCUA would fully insure the net amount that any member or depositor at an insured credit union maintained in a noninterest-bearing transaction account. NCUA amended part 745 of its regulations to implement these temporary statutory changes through a final rule that became effective on June 24, 2011. Consistent with the sunset provisions in Dodd-Frank Act section 343(b)(3) and §745.14 of NCUA’s regulations, NCUA is rescinding its regulations implementing the temporary expanded insurance coverage granted under Dodd-Frank Act section 343(b)(1). In particular, the rule removes the definition of “noninterest-bearing transaction account” in §745.1(f), and removes §745.14 governing noninterest-bearing transaction accounts. The Board notes, however, that these accounts continue to be insured under other provisions of part 745."

The unlimited share insurance coverage for noninterest-bearing transactions accounts expired on midnight on December 31, 2012. This change should also be reflected in the Electronic Code of Federal Regulations after the final rule is published in the Federal Register.

***

Programming Note: NAFCU's offices will be closing early today and we'll also be closed on Monday for the holiday. 

We'll be back blogging on Tuesday - have a great weekend!

FTC Issues COPPA FAQs

Written By JiJi Bahhur, Regulatory Compliance Counsel

The Federal Trade Commission (FTC) recently issued Complying with COPPA: Frequently Asked Questions which aims to help the industry understand recent changes to the Child Online Privacy Protection Act (COPPA) regulations that go into effect July 1, 2013.  The FAQs – a small entity compliance guide – feature 92 frequently asked questions on the recently amended COPPA. 

When delving into the COPPA amendments, the FAQs are definitely the place to reference if you have any questions.  The Table of Contents is very well-organized so you can go right to the area of concern rather than digging through all 92 questions to find what you are looking for. From the FAQs, here is the Table of Contents: 

Contents:

• GENERAL QUESTIONS ABOUT THE COPPA RULE
• COPPA ENFORCEMENT
• PRIVACY POLICIES AND DIRECT NOTICES TO PARENTS
• WEBSITES AND ONLINE SERVICES DIRECTED TO CHILDREN
• PHOTOS, VIDEOS, AND AUDIO RECORDINGS
• GEOLOCATION DATA
• GENERAL AUDIENCE, TEEN, AND MIXED-AUDIENCE SITES OR SERVICES
• VERIFIABLE PARENTAL CONSENT
• EXCEPTIONS TO PRIOR PARENTAL CONSENT
• PARENTAL ACCESS TO CHILDREN’S PERSONAL INFORMATION
• DISCLOSURE OF INFORMATION TO THIRD PARTIES
• REQUIREMENT TO LIMIT INFORMATION COLLECTION
• COPPA AND SCHOOLS
• COPPA SAFE HARBOR PROGRAMS

The FTC’s FAQ announcement is here.  To view the Rule and compliance materials, go to the FTC's COPPA page for businesses. Some other resources that can be found on that page are as follows:

• Case Highlights (23)
• Reports and Workshops (19)
• Laws, Rules, and Guides (4)
• Compliance Documents (19)

 

 

House Passes H.R. 749 - The Eliminate Privacy Notice Confusion Act

Note: If you are reading this post via the email delivery subscription option - you may have noticed a delay the past couple of days. We're aware of the issue but a solution isn't readily apparent. You can always find the daily blog post directly on the blog's website (just scroll down past the "Welcome Blog Post").

So, if you need your daily fix and haven't seen the email - be sure to check the blog's main website as the post is usually up there by 6 a.m.  Have a great day!

***

Written by Steve Van Beek

One of the pieces of NAFCU's five point plan for regulatory relief is Operational Improvements for Credit Unions - including a specific push for elimination of unnecessary privacy notices. Yesterday, the House took an important step toward this goal by passing H.R. 749.

Now, you might be having déjà vu. Didn't the House pass a similar bill back in December?  They sure did - but since this is a new Congress, they needed to introduce and pass the bill again. And, now attention turns back to the Senate - which failed to pass similar legislation in 2012.

Below is a summary from our December 14th blog post that I've updated slightly with the information from yesterday's action.

***

The Elimination Privacy Notice Confusion Act & What it Means to Your Credit Union

Summary.  The bill - H.R. 749 - was passed by the House on Tuesday and now awaits action in the Senate.

What will the bill do?  The bill would remove the annual privacy notice requirement for certain financial institutions.  

How do we find out if we would be one of these "certain" financial institutions?  Ah, please join me (again!!) as we wander down the rabbit hole called Regulatory & Legislative Complexity (the middle name is "&" for those keeping score at home).     

The Start.  The annual privacy notice requirement comes from Section 503 of Gramm-Leach-Bliley (15 USC 6803):"

"(a) Disclosure required

At the time of establishing a customer relationship with a consumer and not less than annually during the continuation of such relationship, a financial institution shall provide a clear and conspicuous disclosure to such consumer, in writing or in electronic form or other form permitted by the regulations prescribed under section 6804 of this title, of such financial institution’s policies and practices with respect to..."  (emphasis added)."

The Bill.  The bill would add subsection (f) to Section 503 of Gramm-Leach-Bliley:

‘‘(f) EXCEPTION TO ANNUAL NOTICE REQUIREMENT.—A financial institution that—

‘‘(1) provides nonpublic personal information only in accordance with the provisions of subsection (b)(2) or (e) of section 502 or regulations prescribed under section 504(b), and

‘(2) has not changed its policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed in the most recent disclosure sent to consumers in accordance with this subsection, shall not be required to provide an annual disclosure under this subsection until such time as the financial institution fails to comply with any criteria described in paragraph (1) or (2)."

Ok - so there are two main prongs to obtaining this potential exception.  We'll take them in reverse order. 

Prong 2 - No Changes Since Your Last Privacy Policy.  This is the easier prong.  If you've changed your privacy policy, you'd need to send the annual notice so that members are aware of your new sharing practices.    

Prong 1 - Shares Information Only in Accordance with Exceptions.  This one is where things get a bit dicey.  I'll spoil the ending by letting you know that if this bill becomes law - the CFPB should be amending Regulation P and will have a great opportunity to provide clarity to everyone (credit unions, banks, consumers, etc).    

In order to satisfy Prong 1, credit unions need to share nonpublic personal information about their members "only in accordance with the provisions of subsection (b)(2) or (e) of section 502 or regulations prescribed under section 504(b)."  But, what does that mean?   

These two provisions discuss the situations where credit unions can share nonpublic personal information with nonaffiliates without having to provide the member an opt-out.  

Section 502(b)(2) - 15 USC 6802(b)(2).  This provision outlines the exception for service providers and joint marketing agreements.  It is implemented in 12 CFR 1016.13 of Regulation P.  

Section 502(e) - 15 USC 6802(e).  This provision contains the general exceptions to the opt-out requirements.  Credit unions can share information with nonaffiliated third parties in these situations - such as to service or process a transaction or at the member's request - without needing to provide the member an opportunity to opt-out.  These exceptions are outlined in 12 CFR 1016.14 & 12 CFR 1016.15 of Regulation P.   

***

Confused?  The crux is that in order to satisfy Prong 1 your credit union would need to only share information with nonaffiliates in ways that do not trigger the requirement to provide members the right to opt-out.  Prong 2 is easier in that it will be met if you have had no changes to your privacy policy since your last mailing.  

Your Homework?  Check out whether your credit union's existing privacy policy requires you to provide members the right to opt-out because your credit union shares nonpublic personal information with nonaffiliated third parties.  

Outcome 1:  If you aren't currently required to provide the opt-out to members, this bill could provide some real regulatory relief as it could remove the requirement to send your privacy policy on an annual basis.

Outcome 2:  If you currently share with nonaffiliated third parties (outside of the exceptions discussed above) and are required to provide members the opt-out, check how many nonaffiliated third parties you share with.  How valuable are those relationships?  How does that compare with the regulatory cost (and printing costs and mailing costs) of sending the annual privacy notice?  

***

Reminder:  Keep in mind that this bill still needs to work its way through the Senate.  Additionally, the CFPB would need to amend Regulation P to implement these changes and provide clarity. And, as we discussed in yesterday's blog post - it isn't always a fast process. 

The Eliminate Privacy Notice Confusion Act & What it Means to Your Credit Union

Written by Steve Van Beek

First off, the title of the bill will not help with the confusion that compliance officers face with regard to privacy notices.  Instead, it is meant to address the confusion that faces members as they receive multiple privacy policies from multiple financial institutions and dutifully read them.

Summary.  The bill - H.R. 5817 - was passed by the House on Wednesday and now awaits action in the Senate.

What will the bill do?  The bill would remove the annual privacy notice requirement for certain financial institutions.  

How do we find out if we would be one of these "certain" financial institutions?  Ah, please join me as we wander down the rabbit hole called Regulatory & Legislative Complexity (the middle name is "&" for those keeping score at home).     

The Start.  The annual privacy notice requirement comes from Section 503 of Gramm-Leach-Bliley (15 USC 6803):"

"(a) Disclosure required

At the time of establishing a customer relationship with a consumer and not less than annually during the continuation of such relationship, a financial institution shall provide a clear and conspicuous disclosure to such consumer, in writing or in electronic form or other form permitted by the regulations prescribed under section 6804 of this title, of such financial institution’s policies and practices with respect to..."  (emphasis added)."

The Bill.  The bill would add subsection (f) to Section 503 of Gramm-Leach-Bliley:

‘‘(f) EXCEPTION TO ANNUAL NOTICE REQUIREMENT.—A financial institution that—

‘‘(1) provides nonpublic personal information only in accordance with the provisions of subsection (b)(2) or (e) of section 502 or regulations prescribed under section 504(b), and

‘(2) has not changed its policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed in the most recent disclosure sent to consumers in accordance with this subsection, shall not be required to provide an annual disclosure under this subsection until such time as the financial institution fails to comply with any criteria described in paragraph (1) or (2)."

Ok - so there are two main prongs to obtaining this potential exception.  We'll take them in reverse order. 

Prong 2 - No Changes Since Your Last Privacy Policy.  This is the easier prong.  If you've changed your privacy policy, you'd need to send the annual notice so that members are aware of your new sharing practices.    

Prong 1 - Shares Information Only in Accordance with Exceptions.  This one is where things get a bit dicey.  I'll spoil the ending by letting you know that if this bill becomes law - the CFPB should be amending Regulation P and will have a great opportunity to provide clarity to everyone (credit unions, banks, consumers, etc).    

In order to satisfy Prong 1, credit unions need to share nonpublic personal information about their members "only in accordance with the provisions of subsection (b)(2) or (e) of section 502 or regulations prescribed under section 504(b)."  But, what does that mean?   

These two provisions discuss the situations where credit unions can share nonpublic personal information with nonaffiliates without having to provide the member an opt-out.  

Section 502(b)(2) - 15 USC 6802(b)(2).  This provision outlines the exception for service providers and joint marketing agreements.  It is implemented in 12 CFR 1016.13 of Regulation P.  

Section 502(e) - 15 USC 6802(e).  This provision contains the general exceptions to the opt-out requirements.  Credit unions can share information with nonaffiliated third parties in these situations - such as to service or process a transaction or at the member's request - without needing to provide the member an opportunity to opt-out.  These exceptions are outlined in 12 CFR 1016.14 & 12 CFR 1016.15 of Regulation P.   

***

Confused?  The crux is that in order to satisfy Prong 1 your credit union would need to only share information with nonaffiliates in ways that do not trigger the requirement to provide members the right to opt-out.  Prong 2 is easier in that it will be met if you have had no changes to your privacy policy since your last mailing.  

Your Homework?  Check out whether your credit union's existing privacy policy requires you to provide members the right to opt-out because your credit union shares nonpublic personal information with nonaffiliated third parties.  

Outcome 1:  If you aren't currently required to provide the opt-out to members, this bill could provide some real regulatory relief as it could remove the requirement to send your privacy policy on an annual basis.

Outcome 2:  If you currently share with nonaffiliated third parties (outside of the exceptions discussed above) and are required to provide members the opt-out, check how many nonaffiliated third parties you share with.  How valuable are those relationships?  How does that compare with the regulatory cost (and printing costs and mailing costs) of sending the annual privacy notice?  

***

Reminder:  Keep in mind that this bill still needs to work its way through the Senate.  Additionally, the CFPB would need to amend Regulation P to implement these changes and provide clarity.  

Lastly, let's take a minute to appreciate a 4-page bill.  Considering we are fast approaching Dodd-Frank Implementation Season^TM, any regulatory relief is a welcome sight (even if there is a need to wade through some legalese to get there).  

Have a great weekend! 

Keeping a Record of NCUA's Regs; NAFCU's Comment Letter on TILA/RESPA

Written by Steve Van Beek

On Tuesday we blogged about the FTC's rescission of their regulations that transferred to the CFPB.  We also indicated that NCUA was likely to follow soon after and rescind their rules.  We also included this information about making a copy of the current rules:

"Prior to this occurring, it might be a good business practice to make a copy of the soon-to-be rescinded regulations to ensure your credit union has a copy of the regulations in effect in the past in the case of a member complaint, exam issue or lawsuit."

A very helpful comment highlighted that the Government Printing Office (GPO) retains a copy of each year's CFR in PDF or XML format.  Below are the 2011 PDFs of the rules that transferred from the NCUA to the CFPB.   

Main Rules.  These three rules were transferred either completely (Privacy and SAFE Act) or almost completely (Fair Credit Reporting Act).

• Part 716 - Privacy of Consumer Financial Information
• Part 717 - Fair Credit Reporting
• Part 761 - Registration of Residential Mortgage Loan Originators 

There are a few other regulations listed in the CFPB's Federal Register notice on the transferred regulations but they are not major changes and only impact certain situations.  Part 707 - NCUA's Truth in Savings regulation - is also included on the list but rulemaking authority for Part 707 remains with NCUA.

Note:  Prior years of regulations can be found by using this GPO starting page.  Hat tip to Kennyb.      

***

TILA/RESPA Disclosure Combination.  On Monday, NAFCU submitted a comment letter to the CFPB on their plans to combine the TILA and RESPA disclosures.  The comment letter is 7 pages long and highlights areas of concerns as the CFPB continues along their Dodd-Frank mandate.  

Remember:  The CFPB has to have an official proposal out for the TILA/RESPA combined disclosures by July 21, 2012.  Their Know Before You Own project was not an official proposed rule and was not part of the Administrative Procedures Act.   

Updated 2012 NAFCU Credit Union Compliance GPS is Now Available!

Written by Steve Van Beek

Shameless Plug Alert!

We are very pleased to announce the availability of the Updated 2012 NAFCU Credit Union Compliance GPS.  Over the course of the last year, there have been many small tweaks and changes that have made life difficult for credit unions and, specifically, compliance officers (and many others as well).  These included technical changes to regulations as well as substantive changes to regulations and regulators.  

The Updated 2012 GPS has been thoroughly updated and edited to reflect these changes and provide those researching credit union issues a useful, electronic guide. 

For example, the Updated GPS includes:

• A New Section on the Consumer Financial Protection Bureau;
• Updated Links after NCUA's Website Change;
• Updated Regulatory Citations Reflecting the CFPB's Ownership of the Consumer Regulations;
• Links to the CFPB's Version of the Electronic Code of Federal Regulations;
• An Expanded Bank Secrecy Act Section;
• A Separate Section on Vendor Management; and
• Many more additional updates and edits to ensure accuracy.   

In non-bullet format, the Updated 2012 GPS contains all new links to the updated NCUA website (including Legal Opinion Letters and Letters to Credit Unions).  The GPS also contains the new, correct citation to the CFPB's regulations (i.e., 12 C.F.R. 1026 rather than 12 C.F.R. 226 for Regulation Z) as well as links to the CFPB's regulations to help you find the most up-to-date version of the consumer regulations.       

Pricing.  The Updated 2012 GPS is $399 for NAFCU members and $499 for anyone else.  The GPS is not limited to credit unions and can be purchased by anyone interested in learning more about credit union laws and regulations. 

***

Table of Contents.  To get a feel for the Updated 2012 GPS, take a look at the following Tables of Contents which list the Sections that are included in each Chapter (plus the Appendix).

• Main Table of Content - 1-Page Snapshot of the 2012 GPS
• Chapter Specific Cover Pages - Listing of the Sections by Chapter
• Complete Table of Content - Listing the Contents of Each Section
• The Consumer Financial Protection Bureau Section Table of Contents 

***

Below are a couple of additional items about the Updated GPS.  

Electronic Manual.  The GPS is designed to be a an electronic manual as it contains numerous links to regulations and guidance documents.  Of course, you can print off your own copy of the GPS and use the hardcopy as a quick resource guide.  But, the best bang for your buck is being able to use the electronic links and be taken directly to the NCUA Legal Opinion Letter being described or NCUA's Statutory Lien regulation in 12 C.F.R. 701.39.

Available to Everyone.  The GPS is available for purchase by anyone and everyone.  We've had law firms and audit firms purchase the GPS in the past in addition to numerous credit unions.  Additionally, your credit union does not need to be a NAFCU member to purchase.  We hope the GPS serves as a valuable resource for anyone seeking to learn more about credit unions and the regulations that impact their daily operations.

One GPS Per Credit Union.  Remember - the purchase of the GPS provides access to your entire credit union or organization!  Please feel free to share the GPS with your colleagues at your credit union.  However, we put a lot of time and effort into creating and editing the GPS and we ask that you not share your GPS with other credit unions or third-parties.  

Regulatory Compliance School.  If your credit union sent someone to NAFCU's 2012 Regulatory Compliance School last week, that person should already have an electronic copy of the Updated GPS.  Be sure to track that copy down and share throughout your credit union.  No additional purchase would be required.  

Finding the CFPB's Regulations

Written by Steve Van Beek

Dodd-Frank transferred authority for the "enumerated consumer laws" to the CFPB on July 21, 2011.  In late December, the CFPB officially republished the regulations that implemented these "enumerated consumer laws" in its own section of the Electronic Code of Federal Regulations.

For credit unions, this means we need to use the CFPB's regulations for our research and our citations.  For example, the correct citation for Regulation Z is now 12 C.F.R. 1026 and not 12 C.F.R. 226.  

***

Why does this matter?  When the CFPB issues changes to these regulations - such as the remittances final rule - these regulations will only update the CFPB's Regulation E.  The prior version of Regulation E - under the Federal Reserve - will not be updated.  In order to research the latest and most accurate information, look to and cite the CFPB's regulations.  Note:  The remittances final rule can be found in Subpart B to Regulation E.    

***

CFPB Regulations.  Below are links to the CFPB's regulations with the updated citations.  This should be the starting point for your research.  

• 12 C.F.R. 1002 - Regulation B:  Equal Credit Opportunity Act
• 12 C.F.R. 1003 - Regulation C:  Home Mortgage Disclosure Act
• 12 C.F.R. 1005 - Regulation E:  Electronic Funds Transfers
• 12 C.F.R. 1006 - Regulation F:  Fair Debt Collection Practices Act
• 12 C.F.R. 1007 - Regulation G:  SAFE Act Mortgage Licensing - Federal System
• 12 C.F.R. 1016 - Regulation P:  Privacy of Consumer Financial Information
• 12 C.F.R. 1022 - Regulation V:  Fair Credit Reporting Act
• 12 C.F.R. 1024 - Regulation X (RESPA):  Real Estate Settlement Procedures Act
• 12 C.F.R. 1026 - Regulation Z - Truth in Lending Act

Above is not a complete list, but they are the ones with the biggest impact on credit unions.  The full listing of the CFPB's regulations is in Section 1000-1099 of Title 12 of the Electronic Code of Federal Regulations.

***

A couple of other items to keep in mind:

• Truth in Savings.  Credit Unions need to follow Part 707 for Truth in Savings rather than Regulation DD.  This blog post has more information.
• Federal Reserve.  The Federal Reserve lost authority for quite a few regulations.  However, they retain control over regulations that were not deemed to be "consumer" regulations.  This blog post has additional information on which regulations stayed with the Federal Reserve.  

More Republishing; Part 707 - Truth in Savings; Wish Granted

Written by Steve Van Beek

A Quick Note:  NAFCU's offices will be closed Friday, December 23rd and Monday, December 26th for the Christmas holiday.  We will be back blogging on Tuesday.  We hope you all have a wonderful holiday weekend!

***

We've tracked the CFPB's republishing in Monday and Tuesday's blog posts.  The CFPB hasn't slowed down.  

• Published in the Federal Register on Wednesday, December 21:
  • Equal Credit Opportunity (Regulation B)
  • Fair Credit Reporting (Regulation V)
  • Interstate Land Sales Registration Program (Regulations J, K, and L)
  • Privacy of Consumer Financial Information (Regulation P)
  • Truth in Savings (Regulation DD)

• Published in the Federal Register on Thursday, December 22:
  • Truth in Lending (Regulation Z)

***

On December 7th, we blogged on the possibility of the CFPB combining consumer regulations when it conducted its republishing.  Now that the CFPB has made progress on their republishing, we know additional information.  

NCUA will retain authority over Part 707 - implementing the Truth in Savings Act for credit unions.  Footnote 2 of the Proposed Rule contains this information:

"2. Dodd-Frank section 1029 generally excludes from this transfer of authority, subject to certain exceptions, any rulemaking authority over a motor vehicle dealer that is predominantly engaged in the sale and servicing of motor vehicles, the leasing and servicing of motor vehicles, or both. Further, Dodd-Frank section 1100B did not grant the Bureau TISA rulemaking authority over credit unions or repeal the NCUA's TISA rulemaking authority over credit unions under 12 U.S.C. 4311."  (emphasis added)

The proposed regulation (12 CFR 1030) mirrors the current Regulation DD (12 CFR 230) and includes this language in Part 1030.1(c):

"(c) Coverage. This part applies to depository institutions except for credit unions. In addition, the advertising rules in § 1030.8 of this part apply to any person who advertises an account offered by a depository institution, including deposit brokers."

What this means is that NCUA will need to follow the CFPB's lead on Truth in Savings issues just as they did in the past following the Federal Reserve.  The U.S. Code section cited by the CFPB - 12 U.S.C. 4311 - still requires NCUA to adopt a "substantially similar" regulation within 90 days.  NCUA's regulation, which will still be located in 12 C.F.R. 707, will continue to reflect the unique nature of credit unions.  

***

This year - my Christmas gift came early.  Two months ago, in fact.       

Michigan's victory over Ohio State wasn't too bad either.  I was able to enjoy The Game with my father-in-law (as he is from Ohio, he didn't enjoy it as much).  Luckily, we were able to get a photo before the game where we both were happy.  

Have a wonderful holiday weekend!

This and That; A Well-Fed Elmo

Posted by Anthony Demangone

Here's a few things to finish off the week.

NCUA.  NCUA held its monthly board meeting yesterday.  There was a minor tweak to its Truth in Savings regulation to bring it into line with Regulation DD.  The also disclosed their priorities for 2011.  You can access the items from the board meeting here.  In addition, we did write an article for today's NAFCU Today on the meeting.   NCUA also issued its most recent edition of the NCUA Report.  This issue tackles some timely issues:

• Financial literacy
• Recent board actions
• Risk management on online banking
• Trends in mortgage delinquencies
• Contingency fund planning

Privacy.  The OTS has issued a compliance guide for the model privacy notice. While this would have been handy dandy three months ago, the guide looks to be written in a clear manner and should be useful if you still have issues in that area. 

MBLs.  Here's a nice historical look at member business lending at credit unions. (Elliot Kashner, at CreditUnions.com)

***

Here's how we found Elmo the other day, thanks to Kate.  I'm just glad that Elmo didn't ask for cottage cheese.  I'm off to State College this weekend to visit family and kneel at the shrine. Have a great weekend, everyone!

Tuesday Grab Bag

Posted by Anthony Demangone

Here are a few items of interest.

Discrimination.  HUD is going to investigate 22 banks and mortgage lenders to see if there is illegal discrimination against minorities related to FHA loans. 

The investigations are in response to 22 complaints the National Community Reinvestment Coalition (NCRC) filed with HUD alleging that the loan activities of the mortgage originators showed that their home lending practices deny FHA- insured loans to African Americans and Latinos with credit scores as high as 640. Federal Housing Administration (FHA) guidelines allow mortgages to borrowers with credit scores above 580, provided the borrowers have down payments equaling 3.5 percent of the loan amount, or above 500, provided the borrowers have down payments equaling 10 percent of the loan amount.

Regulation Z.  The OCC has updated its Regulation Z examination procedures.   These procedures are a great way to gain a solid overview of examiner expectations.  And while the OCC does not regulate credit unions, its views on Regulation Z matters should be useful, as Regulation Z applies evenly to both credit unions and banks.

NCUA Legal Opinion on Gift Card Incentives. Can a credit union use a gift card give-away to boost attendance at its annual meeting?  Yes, but credit unions must be judicious in their use.  At some points, examiners may raise objections on "safety and soundness or corporate waste grounds."  That puts credit unions in a tough position, as this opinion letter doesn't give bright-line guidance or any safe harbors.  When is a gift-card attendance campaign too much? When does it raise a safety and soundness or corporate waste issue? Much like Supreme Court Justice Potter Stewart said about hard-core pornography, I guess that examiners will know it when they see it.  

Privacy.  This blog post provides a nice overview of a recent Commerce Department report on privacy. (Privacy & Security Law Blog.) This isn't a regulatory proposal, so there aren't any changes to our privacy requirements on the horizon (other than the move to the model privacy disclosure).  But privacy is an important issue, and a fluid one.  As technologies and marketing methods evolve, you'll see efforts to amend privacy requirements for American businesses.  This blog post is a nice reminder of that fact. 

Privacy; This and That

Posted by Anthony Demangone

I know that some of you are putting the final touches on your credit union's privacy policy to align it with the new model privacy form.  I'm not going to go into the nuts and bolts of the new model privacy form.  I did this post earlier that covered the "nuts and bolts" issues.  Today, I want to touch on two common questions that we've seen.

1. I don't see a requirement to post our privacy policy on our web site site.  Really? Yes, really.  There's no requirement to post your privacy policy there.  Keep in mind, not every credit union has a web site.  The requirement is to deliver it at account opening, and thereafter on an annual basis per the privacy regulation's requirements.  Again - there's no requirement to post it on your website.  But here's a thought: why wouldn't you post your privacy policy online? 
2. The next question comes in two flavors.  Flavor one: Do we have to use the new form? Flavor two: There is no way we're going to have our form ready by January 1, 2011.  I know the Mayans think the world is ending in 2012, but I fear our demise might come one year earlier based on our progress with this project.  No - there's no requirement to use the new form.  It is a model form, and if you use it according to its requirements beginning on January 1, 2011 - you'll exist in the regulatory Nirvana known as "Safe Harborville." Put another way, regulators and others will not be able to criticize your form if you use it properly.  If you don't have your new form ready on January 1, 2011, will the world end?  I really hope not based on my conversations with a few credit unions.  I'll just say this much...the regulators have given us a model form that provides a safe harbor.  If you don't take advantage of it on January 1, 2011, you will increase your compliance risk.  How much?  I can't speak for the regulators.  But I'll say this: which form would you rather have as your form if an examiner walked into your office on January 1, 2011?  (OK, I understand your credit union is likely closed that day to allow all employees to watch the "can't miss" Outback Bowl, featuring the football powerhouses Penn State and Florida.  But you get my point.)

Here are some other issues that caught my eye.

• Here's yet another wonderful post on overdraft protection from the Bank Lawyer's Blog that provides another view of the recently issued FDIC overdraft protection guidance.  You should read this guy's blog. Every day. And twice on Tuesdays.
• The Fed has issued this notice, WHICH CONTAINS THE INTER-AGENCY EXAM PROCEDURES FOR RISK-BASED PRICING NOTICES. I would have made that text blink if I had a clue about computers and such.  This is a nice little Holiday Gift from the Fed which should give us a better idea of regulator expectations on this issue.  And based on the emails and calls we've been receiving, quite a few of you are still working on this issue.

PS: Apologies for letting Pearl Harbor Day pass without mention yesterday. Shame on me. To any and all veterans out there, many thanks.

Some Private Thoughts; Early Bird Expires Today

Posted by Anthony Demangone

Quite a few NAFCU members have called us on privacy issues.  It seems that quite a few credit unions are in the midst of creating a new privacy disclosure using the new model privacy disclosure format. Quite a few callers are confused as to what a non-affiliated third party is, or when a member gets the right to opt-out of information sharing.  Other callers simply do not have a good handle on how they handle and share member information.

With that in mind, here are some general thoughts for those who are drafting privacy disclosures.

• Your privacy policy drives the disclosure.  To fill out the form correctly, a credit union has to know how it shares information.  This should be spelled out in a policy, and that policy should be shared with anyone who has the ability to share member information.  Does your credit union share information with non-affiliated third parties outside of one of the exceptions to providing an opt-out?  Don't look at me.  That's something you must be able to answer yourself.  
• Think about having a privacy officer.  I just made that up, but it might make sense.  You have many different parts of your credit union that share member information with third parties - hopefully in concert with your privacy policy.  When someone wants to do something new, such as share information with another company to market something, are they reviewing the privacy policy to see if the new practice is kosher? Are they reporting the proposed information sharing relationship to the person who is managing the privacy disclosure? Having a central person to manage information sharing would help to keep everyone on the same page.
• Shameless plug. If you’re interested in having NAFCU print and deliver your privacy notice after you’ve customized it based on your privacy policy, you click here to learn more. 
• Here are some aids that might help you as you put together your model disclosures:
  • NCUA's Small Credit Union Privacy Compliance Guide.  This resource provides a wonderful overview of NCUA's privacy rule, and it reviews basic privacy concepts that are fundamental to understanding the regulation.  Keep in mind that this guide was written before the model form was created, so please ignore any discussion in the guide concerning how to construct a privacy notice.
  • The FDIC's Model Privacy Form Compliance Guide.  The FDIC did a nice job of discussing issues related to the new model form, and they put together a 7 page compliance guide.  Very handy!
  • NCUA's Consumer Privacy FAQ document. There are a ton of gems in there.  Such as ....

Q. I offer consumer checking accounts. I notify my customers that, among other things, I make disclosures as permitted by law. My checking account customers deposit checks made payable to my customer but drawn on a financial institution unaffiliated with me. My practice is to write my customer’s account number on the back of the deposited check to facilitate its processing. The check itself then goes to the maker’s financial institution, with my customer’s account number on the check. Is this a disclosure of nonpublic personal information that would be subject to opt out requirements or the prohibition against sharing account numbers?

A. No. The opt out provisions do not apply to disclosures in connection with servicing or processing a financial product or service that a consumer requests or authorizes. Nor do they apply to disclosures that are required, or are a usual, appropriate, or acceptable method in connection with settling, processing, clearing, transferring, reconciling or collecting amounts charged, debited or otherwise paid. §§ ___.14(a), ___.14(b)(2)(vi)(A). Also, because the account number is added to the check solely for use in processing the check and is not used in connection with marketing by a third party, this disclosure is not prohibited by the ban on disclosing account numbers for marketing purposes. § ___.12.

Here's one final thought.  The new model privacy form is not mandatory.  Said another way, you don't have to use it. But it is the only way to enjoy "safe harbor" protection beginning in 2011.  Moving to the new model form may not be easy, but always keep your eye on the prize(the safe harbor).

***

The early bird pricing for the November 3 NAFCU "Annual Compliance Roundup" webcast ends today. Hey - I won't be offended if you don't sign up.  I understand that training budgets are limited.  But if you do plan to sign up, by all means do so today. You'll save $100. 

NCUA LOL on compensation and the IRS; A little privacy help from the FDIC

Posted by Anthony Demangone

Yesterday, NCUA released Legal Opinion Letter 10-0919 (September 22, 2010)  via its Express Subscription Service.   The opinion letter addresses NCUA's compensation regulation.

In short, NCUA regulations contain a general prohibition against compensating directors and other volunteer officials, not including the one paid director position as allowed by the Federal Credit Union Act. General rules often contain exceptions, as does this one.  For example, under NCUA's compensation rule, you can pay for a director's health insurance (subject to the rule's limitations), and this insurance benefit does not violate NCUA's general ban on compensation.  The same goes for training expenses.  

The exceptions, though, only pertain to NCUA's rule.  As NCUA indicates in its legal opinion:

The use of the term “compensation” in §701.33 is only for the purpose of describing the kind and amount of payment or reimbursement an FCU is permitted to provide to a board officer. NCUA’s use of that term does not in any way affect an FCU’s obligation to issue a Form 1099 to an individual when the IRC requires it.

So, there really is a two-step process.  First, when conferring a benefit or reimbursing expenses for a volunteer, the payment or benefit first must be able to pass through NCUA's compensation regulation.  If the payment can pass through the rule's requirements, a credit union must then determine if it must issue an appropriate 1099, in the name of the director. 

***

The FDIC issued FIL-60-2010 to help supervised banks comply with the new model privacy notice requirements.  The guidance does a nice job of framing the issue.  While the guidance applies to banks, I believe credit unions will find it to be a useful overview.

Massachusetts Privacy Law; Any Authors Out There?

Posted by Anthony Demangone

OK, here's a tidbit from San Francisco: The new Massachusetts Privacy Rule.  First, here are some useful links:

• The press release from the good Commonwealth of Massachusetts.
• The rule itself.
• An FAQ document about the rule.

The rule creates data security requirements for anyone who holds "personal information" of a Massachusetts resident.  The reach of the rule is long - Massachusetts believes it applies to all entities in the U.S. who hold such data.  It went into effect on March 1, 2010. 

But wait...don't FCUs have to comply with federal security regulations?  Yes, but those regulations were written under the Gramm-Leach Bliley Act.  That Act does not preempt state laws that offer greater protection.

The Massachusetts requirements are very similar to NCUA's security regulation, but not identical.  The one difference that caught my eye is found under section 17.04.  It deals with encryption.

*******

17.04: Computer System Security Requirements

Every person that owns or licenses personal information about a resident of the Commonwealth and electronically stores or transmits such information shall include in its written, comprehensive information security program the establishment and maintenance of a security system covering its computers, including any wireless system, that, at a minimum, and to the extent technically feasible, shall have the following elements:

(1) Secure user authentication protocols including:

(a) control of user IDs and other identifiers;

(b) a reasonably secure method of assigning and selecting passwords, or use of unique identifier technologies, such as biometrics or token devices;

(c) control of data security passwords to ensure that such passwords are kept in a location and/or format that does not compromise the security of the data they protect;

(d) restricting access to active users and active user accounts only; and

(e) blocking access to user identification after multiple unsuccessful attempts to gain access or the limitation placed on access for the particular system;

(2) Secure access control measures that:

(a) restrict access to records and files containing personal information to those who need such information to perform their job duties; and

(b) assign unique identifications plus passwords, which are not vendor supplied default passwords, to each person with computer access, that are reasonably designed to maintain the integrity of the security of the access controls;

(3)Encryption of all transmitted records and files containing personal information that will travel across public networks, and encryption of all data containing personal information to be transmitted wirelessly.

(4) Reasonable monitoring of systems, for unauthorized use of or access to personal information;

(5) Encryption of all personal information stored on laptops or other portable devices;

(6) For files containing personal information on a system that is connected to the Internet, there must be reasonably up-to-date firewall protection and operating system security patches, reasonably designed to maintain the integrity of the personal information.

(7) Reasonably up-to-date versions of system security agent software which must include malware protection and reasonably up-to-date patches and virus definitions, or a version of such software that can still be supported with up-to-date patches and virus definitions, and is set to receive the most current security updates on a regular basis.

(8) Education and training of employees on the proper use of the computer security system and the importance of personal information security.

*******

NCUA's security regulation does not have such a clear mandate for encrypted data. (Appendix A of Part 748 indicates that credit unions should use encryption, if appropriate.)  While Massachusetts has limited resources and won't be able to enforce this rule in every corner of the U.S., I wanted to make you aware of this new expectation.

***

So, you think you can dance write? One of my friends at Sheshunoff forwarded this:

Become a Published Writer.  Sheshunoff Information Services is looking for experienced content experts with strong organizational and writing skills for quarterly updating of its publications. Sheshunoff publishes authoritative, timely, and practical guidance for financial institution professionals. Whether your expertise is in policy drafting, information technology, or compliance – this is your opportunity to share your valuable expertise with financial institutions across the country.

Interested?  Email them.

Model Privacy Notice Online Form Builder Released; Flash Report on Compliance Crunch

Posted by Anthony Demangone

Yesterday, the Federal Reserve, along with other regulations (including NCUA) announced the availability of an online privacy notice form builder.  Financial institutions, including credit unions, can use the form builder to...well, build their privacy notice in a way that complies with the new model privacy form that regulators released not all that long ago.  Start building your form here.  Here's a form I created for the mythical Anthony Demangone Federal Credit Union.  Note: it is short on compliance, but long on sarcasm.)   But I built it in 5 minutes, so it should give you an idea of how easy the system is to use.  Other things to note:

• You still will need to understand how the privacy regulation works to complete the form properly. The online form builder does link to the 2009 final rule. 
• Building the form should be a group effort.  Does any one person at your credit union really understand how your credit union shares information?  A good blend of different departments should be used to make sure the person who builds the form really understands how you gather and share information.
• You can use the new model form, and you'll enjoy a "safe harbor." What is a "safe harbor?"   If you use the model form, you pretty much are bullet-proof when it comes to this issue on exams, as long as you use the form as outlined in the regulation. 
• Your current privacy notice likely uses clauses provided by regulators back in 2001.  The 2009 privacy rule eliminates the safe harbor permitted for notices based on those old sample clauses for privacy notices provided after December 31, 2010.   Again, I'm guessing many of you created privacy notices using those sample clauses.  So, your notices will be OK - they will enjoy a safe harbor - through the end of this year.  On January 1, 2011, the safe harbor for those sample clauses disappears.  Clearly, regulators are hoping that everyone transitions to the model form.
• On January 1, 2012, those old sample clauses will be removed from privacy regulations, including NCUA's.  Like they never existed.  I wonder if we'll be able to even speak about them?
• You don't have to use the new model form, but you're on your own if you create your own language.  In other words, you won't enjoy the safe harbor protection.

It should not be forgotten that the Federal Government gave us this free tool on tax day.  I'm not saying this makes us even, but free is good.

***

NAFCU members may want to take a look at NAFCU's February Flash Report (log in needed),  which highlights the cost of compliance.  For example, 83.6 % of respondents believe compliance costs will increase this year.  No one thinks the costs are going to decrease.

Balance Transfers; NCUA SAFE Act LOL; Blah, Blah, Blah

Posted by Anthony Demangone

Here's another Reg Z wrinkle that many folks may not have seen.  I'm speaking of 12 C.F.R. Part 226.55(d). As we know, section 226.55 provide a general prohibition on increasing credit card rates unless the increase can fit within one of our exceptions found in that section.  But look at .55(d):

(d) Continuing application. This section continues to apply to a balance on a credit card account under an open-end (not home-secured) consumer credit plan after:

(1) The account is closed or acquired by another creditor; or

(2) The balance is transferred from a credit card account under an open-end (not home-secured) consumer credit plan issued by a creditor to another credit account issued by the same creditor or its affiliate or subsidiary (unless the account to which the balance is transferred is subject to § 226.5b).

In other words, if you close a credit card account, or it is acquired by another creditor in a merger or acquisition, or if the balance is transferred from one account to another account by the same creditor - the protections of 226.55 come along for the ride.  The Fed was concerned that card issuers would attempt to increase the APR on existing balances by wooing consumers to convert an existing card to a new one that had a short-term promotional rate of say, 2.99 APR, but with a much higher rate that would kick in after the promotion ended.  With the 226.55(d), the existing balance remains protected.  As always, please read the reg and staff commentary for additional details.

Before you hyperventilate, the restriction will not govern balance transfers from other card issuer accounts that the member transfers to your credit union.  If a member transfers a balance from say, Bank of America, to your credit union, you can charge whatever your rate is on whatever they transfer.  But if you acquire a credit card account from another credit union via a merger or acquisition, then those balances are protected via 226.55.

***

NCUA issues Legal Opinion Letter 09-1018 to clarify that, in its opinion, that federal law preempts a North Carolina state law that attempts to require federal credit unions to file a notice of exemption from state licensing requirements.  The letter has SAFE Act implications.  Here's a snippet:

"While the SAFE Act contemplates separate state and federal regimes for mortgage loan originators, it provided for a national registration system and required NCUA, the other federal banking agencies, and the Farm Credit Administration to develop and maintain a system for registering mortgage loan originators employed by institutions regulated by these agencies. The federal agencies have published a proposed rule, 74 Fed. Reg. 27,386 (June 9, 2009), to establish the Nationwide Mortgage Licensing System (NMLS) for individuals engaged in the business of residential mortgage loan origination and a final rule is expected soon. Individuals, if employed at a federally regulated institution, must register on the NMLS. Individuals who are not employed at a federally regulated institution must be licensed under state law and register on the NMLS.

NCUA’s regulatory provision on preemption of state law states it does not apply to aspects of credit transactions primarily regulated by other federal law. 12 CFR §701.21 (b)(3). The SAFE Act expressly addresses the registration requirements for mortgage loan originators regulated by federal agencies. FCUs and their employees who originate mortgages will be required to register under this federal registration regime. In addition to the provisions of the FCU Act supporting preemption of the exemption notice requirement in North Carolina law, the SAFE Act addresses the sole basis identified in the state law for requiring exempt institutions to "claim and confirm" their exemption. The SAFE Act requires a national registry open to consumers and, thus, fully addresses the basis identified in the state law, namely, to facilitate the referral of consumers who contact the state commissioner. N.C. Gen. Stat. §53-244.050 (g). Therefore, we conclude federal law preempts the state provision requiring FCUs to file a notice of exemption from the state licensing requirements under the North Carolina SAFE Act. "

So, if a state SAFE Act system tries to have you file an exemption, NCUA has taken the stance that such a requirement is preempted.

***

I'm going to yabba-dabba at a number of NAFCU events in the near future, if you are interested.

• The NAFCU member call-in, on February 10.  This member-only overview is very good, and very free. 
• A Reg Z and Reg E webcast, on February 17.   Members and nonmembers, and even non credit unions (such as law firms) can sign up for this event.

• NAFCU's Regulatory Compliance School, on March 22-26.   I'm the MC.  (Yes, I have lots of bad jokes planned.) And I'll talk on the Right to Financial Privacy Act, Privacy and Security of Member Info, and BSA.  This event is open to all, as long as your check clears. The early bird registration discount ends this Friday.

• NAFCU's Volunteer's Conference, on May 20-22.  I'll be speaking on general regulations for board members and supervisory committee members, and BSA for credit union officials.  And I'll likely be eating my weight in wonderful Tex-Mex food, as the educational event takes place in San Antonio along the River Walk.  Again, members and non-members are welcome.

Model Privacy Form

Posted by Anthony Demangone

Yesterday, a number of government agencies indicated that regulators, including NCUA, have released the model privacy form.  There's no word from NCUA yet, but I bet they make their own announcement very soon.  Here's some information from the Fed.

Eight federal regulatory agencies today released a final model privacy notice form that will make it easier for consumers to understand how financial institutions collect and share information about consumers. Under the Gramm-Leach-Bliley Act (GLB Act), institutions must notify consumers of their information-sharing practices and inform consumers of their right to opt out of certain sharing practices. The model form issued today can be used by financial institutions to comply with these requirements.

... The final rule provides that a financial institution that chooses to use the model form obtains a "safe harbor" and will satisfy the disclosure requirements for notices.  The rule also removes, after a transition period, the sample clauses now included in the appendices of the agencies’ privacy rules.

Here's basically what the rule does. 

• The regulation, and the model form, becomes effective 30 days after publication in the Federal Register.  But don't panic.
• You can use the new model form, and you have a "safe harbor" once the rule is effective. What is a "safe harbor?"  If you use the model form, you pretty much are bullet-proof when it comes to this issue on exams, as long as you use the form as outlined in the regulation.
• In addition, the rule eliminates the safe harbor permitted for notices based on sample clauses contained in the current rule for privacy notices provided after December 31, 2010.   I'm guessing many of you created privacy notices using those sample clauses.  So, your notices will be OK - they will enjoy a safe harbor - through the end of next year.  On January 1, 2011, the safe harbor for those sample clauses disappears.  Clearly, regulators are hoping that everyone transitions to the model form.
• On January 1, 2012, the sample clauses will be removed from privacy regulations, including NCUA's.  Like they never existed.  I wonder if we'll be able to even speak about them?
• You don't have to use the model form, but you're on your own if you create your own language.  In other words, you won't enjoy the safe harbor protection.

Grab Bag

Posted by Anthony Demangone

Please let me pause our Regulation Z discussion to touch upon some things that have been bouncing around my in-box.  I understand how important Reg Z is, but other things continue to happen.

• HUD has updated its RESPA FAQs again.
• The FTC settled charges against an apparel company for alleged violations of COPPA.  You don't see these very often, so the settlement serves as a nice reminder that COPPA is alive and well.  And yes, it applies to credit unions.  The announcement also provides background information on COPPA.
• Earlier this month, the Fed announced its annual adjustments to the Regulation D reserve tranches.  I like this update each year, because it is the only time get to use the word tranche.
• NCUA issued Letter to Credit Unions 09-CU-21to remind credit unions about how to properly use the NCUA official sign.  This would be a good piece of guidance to share with marketing.

• HOEPA's higher-priced mortgage loans will affect HMDA reporting.  The OTS has updated its exam procedures, and they do a great job of highlighting these changes.

• The free go-to-webinar that will discuss our on-line training program will take place next Tuesday from 1 until 2 p.m. EST.  I had the wrong time in yesterday's blog posting.  Register here.

***

The Saturday after our Regulatory Compliance Seminar, I had the pleasure of watching Penn State play Michigan with my colleague, Steve.  Steve is a big Michigan fan, and I went to Penn State.  I didn't watch all of it, as I was distracted by a couple of brand new Penn State fans who joined us to watch the game.  Kate was so excited to wear her Penn State shirt that she couldn't sit still for the photo.

Grab Bag

Posted by Anthony Demangone

While the proposed changes to Regulation Z have grabbed our attention, other compliance issues continue to come up.  With that in mind, here are a few things that have happened recently that I wanted to mention.  We'll get back to Reg Z tomorrow.

• Everyone continues to ask HUD to delay implementation of its RESPA rule, due to take affect January 1, 2010.  RESPA keeps saying, thanks, but no thanks.

• The CFPA debate continues to rage on the Hill.  The latest development?  An amendment that would exempt credit unions under $1.5 billion in assets.  Stay tuned.

• The Fed continues its check processing restructuring.  Yesterday, the Fed issued a final rule to implement recent changes.  In this notice, I saw something of note.  The Fed gave us a heads up that they'll need to tinker with Reg CC's rules.  I'm not sure what those changes will look like, but here's why they'll need the changes.  Due to the consolidation of check processing centers, next year at some point...all checks will be considered local. 

• OTS issued a CEO memorandum that does a great job of summarizing how the recently enacted HOEPA rules affect HMDA reporting.  In short, OTS has amended their HMDA examination procedures, and this CEO memo addresses those changes.  It is a concise, clear overview.

• The revised model privacy form is coming. Soon.

• FinCEN has released the latest issue of its SAR Activity Review, Trends, Tips and Issues.   This document is a BSA goldmine.  In this issue, there's an article on SAR completion tips from law enforcement and another on how to avoid errors in SAR filings.

• Also, we hear that FinCEN is planning to release its rule to put stored value cards under its BSA requirements in February.

There. That's more than enough for a Monday.

Fryzel Speaks; Model Privacy Notice

Posted by Sarah Loats

NCUA Chairman Michael Fryzel made his first public speech since NCUA placed US Central and WesCorp into conservatorship. He addressed the attendants of the Texas Credit Union League's 75th Annual Meeting in Austin. Urging industry unity in resolving corporate issues, Fryzel stated in part:

“The Corporate Stabilization Plan is what we need for credit unions today. I need you to roll up your sleeves and in that great credit union tradition of grassroots activism, get it enacted into law so we can mitigate the cost to the system and allow credit unions to continue to serve their members. When this stabilization proposal becomes law, our job will not be finished. I have made a commitment to the Administration, to Congress and to you in the industry that NCUA would undertake a broad and comprehensive reform of the corporate system. We have initiated a rulemaking process that I promise will yield results.”

You can find NCUA's full press release here.

***

Back in 2007 NCUA, along with the other federal financial regulators, issued a proposed rule, which would create a model privacy form in Appendix A of Part 716 of NCUA's regulations. Use of the model form would constitute compliance with the notice content requirements of sections 716.6 and 716.7. In developing the model form, the agencies decided to carry out two phases of consumer testing. The first phase involved form development research on an alternative format and the second phase to entail quantitative research on the effectiveness of the proposed alternative. The proposed rule included the phase one form development research. The phase two effectiveness research was to be conducted after the public comment period of the proposed rule.

Well, phase two is here, and the comment period for the proposed rule has been re-opened for 30 days to allow interested persons to comment on the additional quantitative testing documents. If you have any interest in how the consumer testing was conducted and the results you may find this to be a good read.

Privacy Guidance

NCUA's privacy rule is an interesting regulation.  We aren't allowed to share information with third parties without offering an opt-out, unless the sharing falls into one of three exceptions.  Some of those exceptions are less than clear, though.  Can you write the account number of your member on the back of checks?  Can you verify funds when other financial institutions call?  These are tough questions. 

A few weeks ago, I stumbled upon some guidance issued by the NCUA.  (What scares me is that I likely found this before, but just forgot that it existed.  Ugh.)  The guidance really clears up these issues. (Note that the citations refer to the applicable section of NCUA's privacy regulation, which is found at 12 C.F.R. Part 716.)

 Q. I made a loan to a consumer who defaulted. In trying to collect the bad loan, I wish to learn information to locate the defaulting borrower. I believe that a financial institution unaffiliated with me may have some helpful information about the borrower. If I were to ask that institution for information, I would disclose nonpublic personal information, such as the fact that I have a loan to a particular consumer. I previously notified my borrower that, among other things, I make disclosures as permitted by law. Must I allow my borrower to opt out of my question to the financial institution?

A. No. You may disclose nonpublic personal information to the financial institution without complying with the opt out provisions as necessary to enforce a consumer loan where the disclosure is required or is one of the lawful or appropriate methods to enforce your rights. § ___.14(b)(1).

 Q. We often receive phone calls from auto dealers or other financial institutions requesting loan pay-off amounts on our customers. May we respond to these requests without providing those members with a reasonable opportunity to opt out of that kind of disclosure?

A.Yes, if the disclosure is in connection with servicing or processing a financial product or service from the third party that the member has requested or authorized. In your case, for example, you may disclose loan pay-off information to a third party lender where your member seeks to refinance the loan with the other lender. Alternatively, you may disclose nonpublic personal information that is required, or is a usual, appropriate or acceptable method to carry out the transaction that the member has requested or authorized. § ___.14(a). This would be the case, for example, if the car dealer accepts your member's car as partial consideration for the purchase of another vehicle and wants to know the outstanding amount on the member's car loan with you.
As discussed in response to several of the questions above, you should be aware of the possibility that the caller may be attempting to obtain information about your member through false or fraudulent statements to you. Toward this end, you must ensure that you respond to the caller in accordance with the controls you have implemented as part of your information security program.

Q. I offer consumer checking accounts. I notify my members that, among other things, I make disclosures as permitted by law. My checking account members deposit checks made payable to my member but drawn on a financial institution unaffiliated with me. My practice is to write my member's account number on the back of the deposited check to facilitate its processing. The check itself then goes to the maker's financial institution, with my member's account number on the check. Is this a disclosure of nonpublic personal information that would be subject to opt out requirements or the prohibition against sharing account numbers?

A.No. The opt out provisions do not apply to disclosures in connection with servicing or processing a financial product or service that a member requests or authorizes. Nor do they apply to disclosures that are required, or are a usual, appropriate, or acceptable method in connection with settling, processing, clearing, transferring, reconciling or collecting amounts charged, debited or otherwise paid. §§ ___.14(a), ___(b)(2)(vi)(A). Also, because the account number is added to the check solely for use in processing the check and is not used in connection with marketing by a third party, this disclosure is not prohibited by the ban on disclosing account numbers for marketing purposes. § ___.12.

• Go here to see the NCUA source document for these questions and answers.  There is a lot of delicious, privacy goodness there.
• Go hereto view NCUA's Privacy Regulation.

 

President-Elect Obama and Privacy; Reg D Indexes Updated

When a new President is elected, many wonder how the new Commander-in-Chief will change the compliance culture.  What will he emphasize?  Here's a great post from Brendon Tavelli at Proskauer Rose LLP that analyzes what may be on the horizon in the area of privacy.  It is a very good read.  According to Mr. Tavelli, we could see changes in the following areas:

1. A national privacy law
2. Data breach notifications
3. A beefed up FTC

We'll have to stay tuned.  Changes of these sorts take time and a whole lot of cat-herding on the Hill. 

***

Note that NCUA issued Regulatory Alert 08-RA-04 to notify credit unions that Reg D's reserving requirement indexes have been updated for 2009.  Read all about it here.