NAFCU Compliance Blog

"Friday Fun: Regulatory Requirements for Online Account Openings"

Written by: Andre' B. Cotten, Regulatory Compliance Counsel

Greetings, Compliance Friends! Opening accounts online is a major convenience for members. However, for compliance officers, the online account opening process is riddled with potential pitfalls. For example, when and how does the credit union provide the account opening disclosures. Today's blog is meant to be a high-level review of some of the relevant requirements credit unions may want to consider when establishing online account opening policies and procedures.

Bank Secrecy Act

From a BSA standpoint, opening accounts online can represent risks related to a credit union's Customer Identification Program (CIP) and Know Your Customer requirements. Generally, a credit union's CIP program is based on its own risk assessment and not prescriptive requirements. Although, from a CIP perspective, members opening accounts online is generally considered higher risk. From NAFCU's understanding, many financial institutions utilize complex vendor software in order to ensure the CIP requirements are met when individuals seek to open accounts online.

The FFIEC BSA/AML exam manual discusses "non documentary" methods of verifying identity that may also be helpful to the credit union. Note, the BSA requires that the credit union know the member's identity with reasonable certainty and have the member's name, address, date of birth and identification number so that guides what needs to be verified.

NCUA

However, a consumer must fall within the field of membership before they can be admitted as a member in the credit union. This determination will depend on the credit union's statement of its field of membership, the clause of the statement relied on by the potential member, and the credit union's policies and procedures.

Note, Article II, Section 2 of NCUA's FCU Bylaws requires a member to sign an application for membership. The credit union might verify this language in its own bylaws, and if it does appear, consider electronic signatures under the E-SIGN Act or whether it will require a member to come in and provide a wet signature for the signature card and to establish insurance under Part 745.

As an additional reference, NCUA Opinion Letter 2004-0543 discusses electronic signatures in the membership context.

E-SIGN

The E-Sign Act requires credit unions to receive the member's affirmative consent to receive electronic records. See, 15 U.S.C. § 7001(c). . As an industry standard, it seems many credit unions require members to comply with the E-SIGN consent and procedures when registered for online banking to give legal effect to the disclosures transmitted to the members  through the online banking platform.

For more information, NCUA issued a Risk Alert soon after the E-SIGN Act became effective in March 2001. Here is an additional link for your reference: Consumer Compliance Outlook 4Q Article on ESIGN .

Regulation E

The determination whether a credit union is required to provide additional disclosures when a member establishes an account online depends on what other types of products or services the member is requesting. For example, if the member requests a debit card to execute electronic fund transfers, then the credit union would need to comply with Regulation E.

Regulation E requires initial disclosures be provided "at the time a consumer contracts for an electronic fund transfer service or before the electronic fund transfer is made involving the consumer's account." Below are some Regulation E links of interest:

• Section 1005.4 contains general disclosure requirements and references providing disclosures electronically (E-SIGN)
• Section 1005.7 contains requirements for initial account disclosures
• Supplement I to Part 1005 contains commentary to both sections that clarify requirements
• Appendix A contains Model Forms for Regulation E – Model Form A-2 applies to initial account disclosures

Truth in Savings

NCUA's Truth in Savings Rule has a similar requirement that specifies that credit union must provide account opening disclosures before the account is opened or a service is provide din connection with the account. See, 12 C.F.R. § 707.4(a)(1)(ii).

Here are some Truth in Savings links of interest:

• Section 707.4 contains the requirements for delivery or initial account disclosures
• Section 707.3 describes how disclosures can be provided electronically (i.e., following E-SIGN) and the relationship to Regulation E
• Appendix C contains commentary to both sections that clarify requirements
• Appendix B contains Model Forms for TIS – Model Form B-1 applies to initial account disclosures

Privacy

Under the GLBA, Initial Privacy Notices and Opt-Out Notices can be provided electronically. The notieces can be delivered pursuant to the E-SIGN Act, or  in certain circumstances, the notices can be delivered when the consumer is conducting transactions electronically. Under section 1016.9(b)(1)(iii), it is considered valid delivery to post the privacy notice on a website and require the consumer to acknowledge receipt of the notice as a necessary step to obtaining a particular financial product or service.

Another privacy consideration for online banking is the Children’s Online Privacy Protection Act (COPPA). COPPA imposes certain requirements on operators of websites or online services directed to children. Credit unions are subject to COPPA if they operate a website or online service directed to children, or have actual knowledge that they are collecting or maintaining personal information from a child online. Making COPPA determinations generally requires an analysis of the specific facts and circumstances surrounding a credit union’s online activities against the requirements of COPPA. Thus, a credit union may want to work with local counsel to see if COPPA applies. The FTC’s website has an excellent overview of COPPA.

State Law

Lastly, there may be state law considerations. An online banking agreement establishes contractual obligations between the credit union and the member. The credit union may consider consulting with local counsel to develop a comprehensive agreement that includes, but is not limited to: balance and transaction information; password creation and maintenance; access authorization; and technical assistance.

Additional Resources

Below are a few resources on authentication, cybersecurity, and other issues related to online banking:

• NCUA Official Sign is required on a webpage where a credit union accepts deposits or opens accounts under section 740.4(a). Downloadable graphics of the sign are available here.
• Regulation CC requires the credit union to provide disclosures relating to funds availability “before opening a new account,” under section 229.17.
• NCUA Letter to Credit Unions 2011-CU-09 discusses Online Member Authentication Guidance
• FFIEC IT Booklets provides guidance on cybersecurity considerations.

Complaint Management and a Review of NCUA's Complaint Process

Written by André B. Cotten, Regulatory Compliance Counsel

Hello, compliance friends! As a millennial, before trying a new restaurant, traveling somewhere new or even a joining a new credit union, I like to at least do some research. Normally, I try to read reviews from various sources to ascertain a broad sense of the market's feedback. As people continue to grow more reliant on the opinions of others, I want to explore what this may mean for credit union complaints and how credit unions can potentially mitigate this risk.

From a reputational risk perspective, a member complaint going viral presents a huge threat to credit unions. To mitigate this risk, a well-designed and properly implemented complaint management program is a tool that can uncover noncompliant business practices. Strong complaint management programs also can improve member service by providing members with an easy-to-use method of resolving issues.

Note: as a credit union considers their complaint management system, the credit union may also want to review and define what constitutes a "complaint" so that staff understands when escalation to the complaint resolution process is necessary. The credit union may also want to institute appropriate training on these policies for any staff members that resolve complaints or may have the opportunity to receive a complaint from a member. It is also important for policies and procedures to include how and when responses should be made, including any regulatory time limitation, i.e. Regulation E's error resolution process.

More importantly, regulators are increasingly focusing on member complaints as a source of future regulation and as an examination trigger. A comprehensive complaint management process allows a credit union to prevent and reduce regulatory violations through self-identification and correction. Alternatively, complaint data can validate a credit union's controls in some areas and indicate risks and the need for training in others.

NCUA Complaint Process

In June 2015, NCUA issued Letter to Credit Unions 15-CU-04 advising that the agency had changed its complaint-handling process to allow credit unions 60 days to resolve most consumer complaints before the NCUA Consumer Assistance Center intervenes. The consumer complaint process has two distinct phases: 1) attempted resolution by the credit union and 2) investigation by the Consumer Assistance Center.

During the first phase, NCUA forwards the complaint to the chairman of the appropriate credit union committee, and the credit union then has the opportunity to review the complaint and has 60 days to attempt its resolution. During the complaint resolution process, the credit union is encouraged to communicate directly with the member. NCUA also recommends the credit union respond in writing to the member, with a copy of the letter going to the Consumer Assistance Center, referencing the case number and whether it was able to resolve the complaint.

The second phase involving a formal investigation will begin if the Consumer Assistance Center does not receive a written response from the credit union within the 60-day time frame or if a response is received advising no resolution was possible. Conversely, if the Consumer Assistance Center is notified in writing within the 60-day period that the matter has been resolved, it will close the case. However, the member retains the right to dispute the resolution of the complaint in writing, within 30 calendar days of the credit union's response letter. A member dispute may also trigger a formal investigation.

Elements of a Comprehensive Complaint Management Program

A comprehensive complaint management program consists of the following: policies and procedures; clear channels of communication; an investigation process; written response; maintaining records; corrective action; and retaining, organizing and analyzing complaint data.

A credit union's written policies and procedures regarding the handling of complaints is critical in creating fair, consistent and timely resolution of complaints. A credit union may also want to establish policies and procedures for both complaints received from a member directly, as well as a complaint received from a regulatory body.

The Office of Consumer Financial Protection and Access's guidance recommends establishing channels to receive member complaints and inquiries such as telephone numbers or email addresses dedicated to receiving this type of correspondence.

After a credit union receives a complaint, the method of investigation depends on the nature of the complaint. However, an investigation may include: interviewing the member; reviewing the member's account information and history; interviewing appropriate credit union officials and staff; reviewing pertinent written and unwritten policies and procedures; reviewing multiple loans to determine the actual practices of the credit union; and reviewing relevant laws and regulation.

Once the investigation is complete, both the supervisory committee guide and the OCFPA recommend that responses to complaints be provided to the member in writing. A written response allows the credit union to explain the resolution of the complaint to the member in a precise and clear manner, as well as creating a record of the date and manner in which the complaint was resolved.

If the investigation of a complaint leads to the discovery of illegal, improper, unfair or discriminatory practices at the credit union, it is critical that the discovery leads to change in that practice. The credit union may also consider developing procedures to address or correct illegal or improper practices. For example, a credit union's recommendation for corrections could include a change to policies and procedures, additional compliance training and monitoring, and updating tools, systems and written materials.

Lastly, collecting and logging complaint data has the potential to reveal a wealth of information. The credit union may want to consider refining its data indicators to better categorize, organize, and analyze complaint data. Theoretically, analyzing complaint data provides a credit union with the opportunity to address trends, isolate areas of risk, identify weakness in controls and self-identify compliance violations.

A comprehensive complaint management system can lead to cost efficiencies by preventing member loss, allowing for self-identification and correction of regulatory violations, and preventing litigation by preemptively fully resolving member complaints.

Please see the Office of Financial Protection and Access for additional complaint management guidance: https://www.ncua.gov/About/leadership/Pages/consumer-protection.aspx

Managing the Risk of Paid Ahead Loans

Written by Stephanie Lyon, Regulatory Compliance Counsel

The compliance team is often asked whether there is a federal regulation that limits the number of days a loan can be paid ahead. While there is no federal regulatory limit on how far in advance a loan can be paid, there are a few risk management practices and contractual limitations the credit union may want to consider. 

To begin with, the credit union's loan agreement with the member may govern how payments are applied to the loan. For example, there may be a clause in the agreement regarding how payments in excess of the principal, interest and escrow (if any) will be applied such as advancing the due date or paying down the principal. Generally, ambiguities in a contract are left to state law interpretation so it is important to ensure contract clauses regarding the application of payments are clear. If the credit agreement is silent on the matter, the manner in which the credit union applies excess payments may come down to internal policies or even case law which may not be ideal as courts may interpret things differently yielding various results. If the credit union permits the due date to advance, here are some risk management principles to note.

There are several instances in which NCUA references paid ahead loans as part of a credit union's overall risk management strategy. For instance, transaction risk is defined in NCUA's Examiner's Guide, Chapter 1 as follows:

The risk to earnings or capital arising from fraud or error that results in an inability to deliver products or services, maintain a competitive position, and manage information. This risk (also referred to as operating or fraud risk) is a function of internal controls, information systems, employee integrity, and operating processes. This risk arises on a daily basis in all credit unions as they process transactions.

Paid ahead loans may affect a credit union's transaction risk because some members that obtain a loan may subsequently make large loan payments in excess of the required monthly payment to advance their due dates and skip town—potentially defrauding the credit union. Maintaining some level of contact with these paid ahead members may be necessary to manage transaction risk and ensure the member or the collateral does not do a Houdini disappearance trick. This is not to say that perfectly legitimate reasons why members may pay more to advance their due dates do not exists. For example, a member may be planning to go backpacking through Europe or simply decide to pay more to get ahead of their debts. So a couple of things to note is how far in advance a member seeking to advance their due date and whether the member has a legitimate reason to pay ahead.

NCUA’s Examiner Guide, Chapter 4 and Chapter 10 discuss transaction risk, reviewing paid ahead loans and internal controls in more detail.  Here are a couple of relevant excerpts:

Paid Ahead Loans report - Identifies loans with advanced due dates.

When reviewing this report, the examiner should compare the borrower’s actual payments over time to the note’s required payment schedule. If discrepancies exist, the examiner should review a sample of related loan files, being especially cognizant of paid ahead loans where staff performs frequent file maintenance changes or where the prior activity date is long past (may be a deficiency balance that the credit union failed to charge off). Since a payment is due every month on open-end loans, they should not appear on the paid ahead report. Most IS reports flag open end loans so they do not appear on this report; however, the credit union may not have implemented this feature.

 […]

 Transaction risk. Numerous transaction risks accompany lending. The strength of the credit union’s internal controls will determine the extent of the risk. Management may demonstrate their control of transaction risk through reviewing internal reports such as Paid Ahead Loans, Non-Amortizing Loans, File Maintenance, Supervisory Override, Accrued Interest Greater than Payment, etc. Appendix 4B to the Internal Controls chapter of this Guide discusses other specific loan-related reports.

Finally, NCUA’s Supervisory Committee Guide also talks about paid ahead loans and states that credit unions may want to ascertain the reason a loan is paid ahead more than 60 days. Here is the relevant excerpt from Chapter 7 of the Guide:

What reports should we review as part of the audit if the credit union has an [Electronic Data Processing] EDP system?

7.16 You should review the following reports:

• Negative share reports.

• Unposted item reports for NSF drafts and NSF ATM transactions.

• Computer file maintenance (data change) reports – focusing on loan data changes and address changes.

• Loans by interest rate summary -- look for loans with unusually low interest rates.

• Paid ahead loan report -- review the reason the loan is paid ahead more than 60 days.

• Dormant (inactive) share account reports.

• Any exception reports.

(Emphasis added.) Paid ahead loans can be difficult to manage so it is important the credit union establishes policies and procedures to ensure it is adequately mitigating its transaction risk and protecting itself from potential scams.

***

While some of our colleagues are celebrating NAFCU's 50^th Anniversary at our Annual Conference & Solutions Expo in Hawaii, some of the fort holders in the Government Affairs team attended the Consumer Federation of America awards dinner in Washington, DC. I have to say, it was really fun catching up with local credit union folks during this event and hearing wonderful remarks about the credit union industry from other attendees. Here is a picture of Ann Kossachev, whom you may recognize from several Regulatory Alerts and previous blogs, and me.

Mortgage Servicing Gone Rogue

By Stephanie Lyon, Regulatory Compliance Counsel

As some of you may have heard, the CFPB recently sued one of the country's largest nonbank mortgage loan servicers—Ocwen Financial Corporation and its subsidiaries (Ocwen)—for numerous mortgage servicing violations. The 93 page complaint is very informative and provides insight into what practices make the CFPB tick. While Ocwen is not a financial institution, it does have to follow some of the same mortgage servicing rule as credit unions. So breaking down the alleged violations is helpful when reviewing your credit union's policies and procedures to make sure it is not engaging in the same practices that got Ocwen into hot waters with the bureau. The alleged deficiencies include the following:

1. Used incorrect information to service loans

Regulation X requires mortgage servicers to maintain policies and procedures to provide timely and accurate information. See, 12 C.F.R. § 1024.38. Allegedly, Ocwen loaded incorrect information into its loan servicing system and also managed to change correct information because of system errors and deficient programming. Ocwen's own Head of Servicing described Ocwen’s technology as "[a]n absolute train wreck." The CFPB claims that even though Ocwen was aware of these deficiencies, it used the faulty information to service borrowers’ loans. Some of the issues caused by using the erroneous information was failing to cancel borrowers’ private mortgage insurance (PMI) in a timely manner which caused borrowers to overpay about $1.2 million for PMI premiums. Ocwen did eventually refund this money, but only after the CFPB called it to its attention.

2. Illegally foreclosed on homeowners

Section 1024.41 of Regulation X has requirements for loss mitigation procedures. Under the rule, if a mortgage servicer offers loss mitigation options and receives a completed application more than 37 days before foreclosure, it must evaluate the borrower for all loss mitigation options and notify the borrower of its determination. See, 12 C.F.R. § 1024.41(c). Ocwen allegedly failed to provide required foreclosure protections and wrongfully initiated foreclosure proceedings and sales on at least 1,000 borrowers. More specifically, the bureau claims that Ocwen initiated the foreclosure process before completing a review of borrowers’ loss mitigation applications and foreclosed on those who were fulfilling their obligations under a loss mitigation agreement.

3. Failed to resolve errors

Regulation X has error resolution procedures that generally require the servicer to investigate and correct servicing errors within 7 days of receiving a notice of error. See, 12 C.F.R. § 1024.35(a)-(e). Ocwen received numerous error notices on inappropriately credited payments and allegedly failed to correct these billing and payment crediting errors. The CFPB claims that Ocwen's policies and procedures required that borrowers complained at least five times in nine days before Ocwen automatically escalates their complaint to be resolved.

4. Incorrectly managed escrow accounts

There are several requirements associated with escrow accounts, such as providing an annual escrow account statement; conducting an analysis to resolve escrow surpluses or shortages and notifying borrowers of shortage or deficiencies in the account. See, 12 C.F.R. § 1024.17(f)-(g). Even though Ocwen manages escrow accounts for the majority of the loans it services, the servicer allegedly failed to conduct escrow analyses and sent some borrowers’ escrow statements late or not at all. Ocwen also allegedly failed to resolve escrow shortages by misapplying borrowers' payments resulting in some borrowers paying inaccurate amounts towards their escrow accounts.

Servicers that administer escrow accounts must also make timely insurance and tax payments on behalf of the borrower. In addition to the other escrow managing deficiencies, Ocwen allegedly failed to make timely insurance payments to pay for borrowers’ home insurance premiums which led to the lapse of homeowners’ insurance coverage for more than 10,000 borrowers. Because of this error, some of these borrowers had to pay for force-placed insurance.

5. Failed to assist heirs seeking foreclosure alternatives

Current mortgage servicing rules require the servicer to "promptly identify and facilitate communication with the successor in interest of the deceased borrower with respect to the property secured by the deceased borrower's mortgage loan." 12 C.F.R. § 1024.38(b)(1)(vi). Once these successors in interest are identified, the servicer is supposed to evaluate loss mitigation options for those who may be eligible. Ocwen allegedly mishandled accounts for successors-in-interest by failing to properly recognize individuals as heirs, denying assistance to help avoid foreclosure and in some instances, foreclosing on individuals who may have been eligible to save these homes through a loan modification or other loss mitigation option.

6. Deceptively signed up and charged borrowers for add-on products

The CFPB also claims that Ocwen took some other lenders' playbook and enrolled some consumers in add-on products through deceptive solicitations or without the consumer's consent. Ocwen then billed and collected payments for these ad-on products that the borrowers had not requested.

CFPB's complaint against Ocwen is a great example of when a mortgage servicer does not have proper internal controls, policies and procedures or a culture of compliance.

"What's New?" : NCUA Enhances the Compliance Risk Indicators—

Written by: André B. Cotten, Regulatory Compliance Counsel

On March 29, 2017, NCUA released a supervisory letter in a Letter to Credit Unions (17-CU-02) that provides an updated list of Compliance Risk Indicators. The updated list builds upon the previous guidance issued in a 2002 Letter to Credit Unions. NCUA notes that the "updated list of indicators does not impose any new or higher supervisory expectations to credit unions." The updated list of Compliance Risk Indicators took effect on March 31, 2017.

The 2002 Letter to Credit Unions, 02-FCU-09, highlighted the NCUA's risk-focused examination process. The Agency designed this process to be "forward-looking, with an emphasis on management's ability to identify and monitor current and potential areas of risk." The risk-focused examination process evaluates both the credit union's performance and the management's ability to identify, measure, monitor and control risk.

During a risk-focused exam, the NCUA examiner reviews the credit union's risk profile, which consists of seven specific categories of risk. Credit, interest rate and liquidity risks can be assessed using objective financial data, combined with management's awareness and ability to control the risk.

However, transaction, compliance, strategic and reputation risks are more subjective and are difficult to measure using financial data. Alternatively, compliance, strategic and reputation risks are evaluated in terms of the credit union's control structure and risk management systems.

In last week's the supervisory letter, the NCUA provided an updated list of Compliance Risk Indicators along with an updated AIRES questionnaire for Compliance Risk. According to the supervisory letter, "[t]he update reflects transformations in technology, business models, and members' banking habits since the list of Compliance Risk Indicators [was] originally developed in 2002." The NCUA anticipates the updated list will result in a "more comprehensive, integrated and transparent framework in evaluating a credit union's ability to manage its risk of violations and non-compliance applicable law and regulations."

The supervisory letter also advises that a credit union's compliance risk is best managed when they are proactive, self-identify, and self-correct any identified deficiencies. The updated Compliance Risk Indicators framework includes three broad categories: Board and Management Oversight; Compliance Programs; and Violations of Law and Consumer Harm. Below are the categories along with several factors:

• Board and Management Oversight
  • Commitment to the credit union's compliance management system.
  • Effectiveness of change management processes.
  • Risk management associated with products, services, and activities.
  • Self-Identification efforts and corrective actions taken.
• Compliance Program
  • The effectiveness of a credit union's compliance management system.
  • Policies and procedures, training, monitoring, and audit programs, and complaint resolution.
• Violations of Law and Consumer Harm (if applicable)
  • Pervasiveness of the violation.
  • Root cause of the violation.
  • Severity of the violation or any consumer harm.
  • Duration of the violation.

The NCUA examiners will continue to use the Management CAMEL component rating and the CAMEL composite rating as appropriate to reflect their conclusion about a credit union's compliance risk. In assigning a Compliance Risk rating, field staff will consider the totality of the Compliance Risk Indicators.

***

In reviewing the differences between the Compliance Risk Indicators provided in 2002 and the recent supervisory letter, the NCUA appears to have provided a greater level of detail and modified some of the terminology used to describe compliance risk factors.

For instance, the 2002 Compliance Risk Indicator has a factor called "Response to Changes". In 2002, the NCUA provided the following as guidance:

• Low Risk
  • Anticipates and responds well to market or regulatory changes.
• Moderate Risk
  • Adequately responds to market or regulatory changes.
• High Risk
  • Does not anticipate or take timely or appropriate actions in response to market or regulatory changes.

Using last week's supervisory letter, the factor "Response to Changes" is now called "Change Management", and it is now listed under the broader category Board and Management oversight. The updated Compliance Risk Indicator list provides the following in regards to "Change Management":

• Low Risk
  • Management anticipates and responds promptly to changes in applicable laws and regulations, market conditions and products and services offered by evaluating the change and implementing responses across impacted lines of business.
  • Management conducts due diligence in advance of product changes, considers the life cycle of a product before implementing the change, and reviews the change after implementation to determine whether actions taken have achieved planned results.
• Moderate Risk
  • Management responds timely and adequately to changes in applicable laws and regulations, market conditions, and products and services offered by evaluating the change and implementing responses across impacted lines of business.
  • Management evaluates product changes before and after implementing the change.
• High Risk
  • Management does not respond adequately or timely or fails to respond to changes in applicable laws and regulations, market conditions, and products and services offered.

The above is an example of how the NCUA has enhanced the Compliance Risk Indicators. For further comparisons, please refer to the the previous list of Compliance Risk Indicators ( Download 02-FCU-09 Risk-Focused Examination Program (Compliance Only) ). Also, here is the 
 full 2002 letter to credit unions, and the most recent supervisory letter.

***

On a personal note, I traveled home to Mississippi this past weekend to celebrate my cousins' initiation into Delta Sigma Theta Sorority, Inc. Here's a picture from their new member presentation on Saturday night!

Bank Secrecy Act: Red Flags of Money Laundering

Written by Shereefat Balogun, Regulatory Compliance Counsel

So we all know that credit unions are required to file a Suspicious Activity Report (SAR) where a member appears to be engaged in illegal or suspicious activity.  While, we all know the general SAR requirements, there are many questions about what activity is considered suspicious; or more precisely what are the “red flags” of money laundering.  In light of the looming concerns in this area and increased regulatory scrutiny around the failure to file a SAR in certain instances, this post will provide a non-exhaustive list of some of the common indicators of money laundering activity that your credit union can prepare for. 

As an initial matter, the BSA/AML regime requires credit unions to file a SAR if it involves at least $5k and the credit union has reason to suspect that the transaction: (i) involves funds derived from money laundering or any other illegal activity; (ii) is designed to evade the BSA or its implementing regulations; or (iii) has no apparent business or lawful purpose, or is not the type of transaction that the member would normally be expected to engage in.  See, 12 CFR 748.1.  Credit unions are encouraged to develop appropriate policies, procedures, and processes that monitor and identify unusual or suspicious activity.  But what is suspicious? The following are examples of possible situations that may indicate money laundering.  Two considerations should be noted: one, this list is non-exhaustive.  Two, the presence of a red flag is not conclusive evidence of criminal activity.  Rather, the presence of a red flag should prompt additional investigation and scrutiny in order to determine whether a SAR should be filed.

Avoiding Recordkeeping and Reporting Requirements

• Member asks about record-keeping or reporting requirements
• Member discourages employee from filing required reports or complying with recordkeeping requirements
• Member reluctant to proceed with cash transaction after being told it must be reported

Suspicious Customer Identification Behavior

• Member uses unusual or suspicious identification documents, or refuses to produce originals for verification
• Member refuses to provide personal background information when opening an account
• Member’s permanent address is outside of the credit union’s service area
• Member indicates that he/she does not want a statement of account or nay mail sent to his/her address
• A business member is reluctant to provide information about the nature and purpose of its business, expected account activity, or the names of its officers and directors

Suspicious Cash Transactions

• Member regularly uses ATMs to make several deposits below the reporting threshold
• Member comes in with another member and they go to different tellers to conduct currency transactions under the reporting threshold
• Member opens different accounts under different names, and then makes several cash deposits under the reporting threshold
• Member deposits cash into several accounts in amounts below the reporting threshold and subsequently transfers the funds into one account and wire transfers them overseas
• Member attempts to take back a portion of a cash deposit that exceeds the reporting threshold after being told a CTR must be filed
• Member makes numerous purchases of monetary instruments with cash in amounts less than the reporting threshold
• Member purchases a number of prepaid cards for large amounts, inconsistent with normal account activity

Suspicious Activity in Credit Transactions

• Member suddenly pays down or pays off a large loan with no credible explanation as to where the funds came from
• Member purchases certificates of deposit and uses them as loan collateral
• Loans are made for, or paid on behalf of, a third party with no plausible explanation
• Member’s loan proceeds are unexpectedly transferred offshore or member requests that loan proceeds be wired transferred

Suspicious Employee Activity

• Employee lives a lavish lifestyle that cannot be supported by his salary
• Employee fails to adhere to credit union’s internal policies, procedures, and processes and frequently overrides internal controls
• Employee is reluctant to take a vacation

Again, this post lists just some of the various transactions and activities that may indicate potential money laundering.  For a more comprehensive list, check the FFIEC’s BSA/AML Examination Manual, Appendix F. 

As an aside, our members have been letting us know that this year’s examination has focused a lot on BSA compliance.  Indeed, NCUA’s Letter to Credit Union 16-CU-01 identifies BSA as an examination priority for 2016.  Below are some resources your credit union can rely on to be prepared. 

• NCUA Examiner's Guide
• AIRES BSA Questionnaire
• NCUA Compliance Self-Assessment Guide
• Interagency Statement on Enforcement of BSA AML Requirements

As always, if you have any questions relating to this article or any other BSA issue, please contact NAFCU’s regulatory compliance team.  We’re here for you!

Wait!!! While we're on the topic of BSA, have you registered for NAFCU's upcoming BSA seminar?  We’ll be holding our first in-person, BSA Seminar in New Orleans from October 24 – 28.  You can expect a full week of everything you’ve ever wanted to know about BSA, but didn’t have time to ask. It’s designed for just credit union professionals. You’ll find no erroneous “bank” information that doesn’t apply to credit unions. Check out the full agenda and sessions.

There’s an optional, pre-conference workshop to help get you up-to-speed on BSA fundamentals – it’s perfect if you’re new to BSA or just want a refresher. And at the end of the week, you’ll have the opportunity to get certified when you sit and pass the NAFCU Certified Bank Secrecy Officer (NCBSO) exam.

This seminar, and the certification, is an excellent way to demonstrate to NCUA and FinCEN you’re dedicated to compliance and to protecting your credit union against financial crime. It was designed by NAFCU’s Director of Education Devon Lyon, former director of BSA at State Department Federal Credit Union – so the curriculum is extremely relevant at both a strategic and tactical level. You’ll walk away ready to master your AML responsibilities. And of course, it fulfills your yearly BSA training requirement!

We have limited seating – so register early!

 

Mitigating Mobile Banking Compliance Risk

Written by Shari R. Pogach, Regulatory Paralegal

The Federal Financial Institutions Examination Council (FFIEC) has added a new Appendix E to the Retail Payment Systems Booklet within its Information Technology Examination Handbook (IT Handbook).  As more consumers turn to the convenience of mobile banking, more financial institutions are providing financial services through mobile device channels such as: short message service (SMS)/text messaging; mobile-enabled websites and browsers; mobile applications; and wireless payment technologies. 

The appendix provides a broad overview of the steps a financial institution should take as part of its risk identification process with the types of mobile services it offers.  How complex and deep this process should be will depend on the type of functionality an institution allows through the mobile channel and the type of data in transit and at rest.  In addition, this process should include risks at the institution and those associated with mobile devices where the consumer implements and manages the security settings.  The FFIEC notes that management should identify what risks are involved with an institution’s implementation of mobile products and services, particularly in these areas: strategic, operational, compliance and reputation.

Mobile services technology continues to evolve with any innovations mostly driven by entities outside of the financial industry.  However, current consumer laws, regulations and supervisory guidance that apply to a given financial product or payment method generally still apply, regardless of the technology used to provide the product or service.

In terms of compliance risk, the appendix states an institution’s management and system designers should work with compliance staff to minimize compliance risk.  An institution’s mobile service services should be reassessed regularly with management, compliance and legal staff reviewing those laws and regulations (including consumer protection laws and regulations) that may apply to its offerings.  According to the FFIEC, in order to minimize compliance risk, a compliance officer should:

• Determine whether applicable disclosure requirements are fully accessible on the mobile device.

• Review the institution's existing compliance management system and ability to make appropriate modifications to policies and procedures to address the products, services, and operating features of the mobile financial service technology.

• Monitor for any legal and regulatory changes that may be applicable to mobile financial service on an ongoing basis.

• Train institution staff regarding compliance implications of mobile financial service.

The appendix also includes a detailed outline of work program objectives to assist an examiner in determining "the inherent risk and adequacy of controls at an institution or third party" providing mobile financial services.

BSA/AML Compliance Requirements: Frequently Asked Questions This Week; NAFCU’s new BSA Seminar + Certification is Here!

Written by Shereefat Balogun, Regulatory Compliance Counsel

This week NAFCU hosted its annual Regulatory Compliance School, focusing on the most important regulatory compliance issues facing credit unions. Today’s session will cover the Bank Secrecy Act (BSA) and OFAC (Office of Foreign Assets Control) regulatory framework. However, attendees seemed all too anxious and could not wait to ask their BSA/AML related questions- and understandably so. With an increase in enforcement actions for BSA/AML violations, ongoing OFAC sanctions and impending rules on customer due diligence, credit unions, and other financial institutions, are working hard to keep up with their compliance requirements under the BSA/AML regime. Today’s “FAQs” were inspired by the many BSA/AML related questions and concerns raised throughout the week.

Q: Does a credit union have an obligation to reconcile conflicting identification information provided by a member? We have a member who recently filled out a change of address form, and the SSN he put down is completely different from the one he gave to open this account. Is there any responsibility on the credit union’s part to take any action concerning this discrepancy?

A: Yes, the credit union does have an obligation to address any discrepancies as it pertains to identifying information.  Generally, before opening an account for a customer, the credit union must be able to form a reasonable belief that it knows the true identity of the customer based on the information gathered. The conflicting information may have been made in error.  In any event, the CIP procedures must specify how the credit union will resolve the discrepancies.  If the information is indeed conflicting and can’t be reconciled, the credit union may have an obligation to file a SAR.

Each credit union must have a written CIP that allows it to form a reasonable belief that it knows the true identity of each customer.  The CIP must contain procedures for opening an account that specify the identifying information that will be obtained from each customer.  The credit union must obtain, at a minimum, the following four pieces of information from the customer prior to opening an account:

• Name
• DOB for individuals
• Address
• Identification Number

In addition to gathering the four pieces of information outlined above, the credit union is required to verify the identity of the customer using the information gathered.  In verifying the information, the credit union may use documents and/or non-documentary methods, if its CIP procedures allow for that.  If there are discrepancies in the information, this may create a challenge in the credit union’s ability to form a reasonable belief that it  knows the true identity of a member.  The CIP procedures should outline steps the credit union will take to properly, and more accurately, identify an individual.  The conflicting information may have been made in error.  In any event, the CIP procedures must specify how the credit union will resolve discrepancies using documents and/or non-documentary information.   This may include calling the member to address inconsistencies, relying on other sources such as public databases, or checking references with other banks and/or credit unions.  If the information is indeed conflicting and can’t be reconciled, the credit union may have an obligation to file a SAR. Also note that the credit union is well within their right to put the account on hold while it reconciles the information.

 

Q: Can a credit union accept a current passport instead of a taxpayer identification number or social security number at account opening?

A: Generally, credit unions must obtain an identification number before opening an account for a prospective member.  For US persons, this would be a taxpayer identification number.  For non-US persons, a current passport would suffice.  It appears, however, that a credit union may accept other forms of ID if its CIP procedures provide for that, especially where the customer has applied for a taxpayer identification number, but has not yet received one.  Generally, before opening an account for a customer, the credit union must be able to form a reasonable belief that it knows the true identity of the customer based on the information gathered. The relevant rules can be found in 31 CFR 1020.220.

Before opening an account for a customer, a credit union must collect identifying information, including an identification number.  For a U.S. person, this will be a taxpayer identification number.  For a non-U.S. person, one or more of the following will be acceptable: (i) a taxpayer identification number; (ii) passport number and country of issuance; (iii) alien identification card number; or (iv) number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard.

The rule does make an exception for individuals who are applying for a taxpayer identification number.  According to the rule, a credit union’s CIP may include procedures for opening an account for someone who has applied, but not received a taxpayer identification number.  This may include accepting other forms of identification number, including a current passport.  However, the procedures must ensure that the individual obtains the taxpayer identification number within a reasonable period of time after the account is opened.

(B) Exception for persons applying for a taxpayer identification number. Instead of obtaining a taxpayer identification number from a customer prior to opening the account, the CIP may include procedures for opening an account for a customer that has applied for, but has not received, a taxpayer identification number. In this case, the CIP must include procedures to confirm that the application was filed before the customer opens the account and to obtain the taxpayer identification number within a reasonable period of time after the account is opened.  31 CFR 1020.220(a)(2)(i)(B)(emphasis added.).

Also, the rules provide credit unions with the ability to verify identification through non-documentary methods.  The credit union’s CIP must specify the situations where a credit union would use non-documentary methods to verify a customer’s identity and how to handle them, including when a customer doesn’t have all the necessary documents at the time he/she comes in to open the account.

 

Q: Is a credit union required to file a CTR where a member withdraws $9,500 in cash from a rep payee account and $700 from his personal account on the same day? 

A: The answer to your question can be found in Treasury’s BSA/AML regulations, 31 CFR 1010.  Yes, in this situation, the credit union is required to file a CTR because, although there were multiple transactions, the transactions: (i) resulted in a cash withdrawal in excess of $10k; (ii) occurred during the same business day; and (iii) were made by the same person.

31 CFR 1010.311 requires that a credit union report cash transactions in excess of $10,000 during the same business day. Indeed, the rule states:

Each financial institution other than a casino shall file a report of each deposit, withdrawal, exchange of currency or other payment or transfer, by, through, or to such financial institution which involves a transaction in currency of more than $10,000, except as otherwise provided in this section.  31 CFR 1010.311 (emphasis added.).

Moreover, the amount over $10,000 can be either in one transaction or a combination of cash transactions.  The credit union should treat the multiple transactions as a single transaction if the credit union knows that the transactions are by the same person. The rule provides:

(b) Multiple transactions. In the case of financial institutions other than casinos, for purposes of the transactions in currency reporting requirements in this chapter, multiple currency transactions shall be treated as a single transaction if the financial institution has knowledge that they are by or on behalf of any person and result in either cash in or cash out totaling more than $10,000 during any one business day (or in the case of the U.S. Postal Service, any one day). Deposits made at night or over a weekend or holiday shall be treated as if received on the next business day following the deposit.  31 CFR 1010.313 (b)(emphasis added.).

Here, although the first cash withdrawal of $9,500 was made from a rep payee account, and thus was not his own personal account and not his own personal funds, the aggregate amount withdrew on that day was in excess of $10,000 and was made by the same person.  The credit union was asked to give a single person more than $10,000 in cash on a single day. The fact that the transactions involved multiple, or different, accounts is irrelevant.  Accordingly, the credit union should file the CTR with FinCEN.

 

Q: What steps should a credit union take when it gets an “OFAC hit”?

A: OFAC’s (Office of Foreign Assets Control) regulations prohibit all US persons from engaging in transactions with certain specified persons and countries. Specifically, credit unions must: (i) block accounts and other assets of “Specifically Designated Nationals” (SDNs) and “Blocked Persons”; and (ii) block or reject prohibited transactions with SDNs and Blocked Persons.

Generally, if the credit union gets an “OFAC” hit, the credit union needs to confirm that the individual that was flagged is indeed the individual on the SDN list. Treasury has a hotline dedicated to providing assistance with making a determination if the person is the same. If the person or entity is indeed the same included on the SDN list, the credit union cannot open the account; but rather must block the transaction and account, and also report the blocked transaction/account to OFAC.

While not required by specific regulation, NCUA expects that a credit union will establish and maintain an effective, written OFAC compliance program commensurate with its OFAC risk profile. Amongst other things, the policies, procedures and processes should address how the credit union will identify and review transactions and accounts for possible OFAC violations. The policies and procedures should also define the credit union’s criteria for comparing names provided on the OFAC “SDN” list with the names in the credit union’s files or transactions and for identifying transactions or accounts involving sanctioned countries. Furthermore, the policies and procedures should address how the credit union will determine whether an initial OFAC hit is a valid match or a false hit.

 

Q: Where can I go for assistance in developing our BSA/AML risk-based model? The rules don’t say anything. I’ve checked the FFIEC BSA/AML examination manual and it doesn’t say much on how the risk based model program should look like.

A: Honestly, the guide or the rules will not go into that level of detail. Here’s the reason. Generally, governments around the world feel that the risk-based approach is preferable to a more prescriptive approach in the BSA/AML space because it is:

1. Flexible- AML/BSA risks vary across jurisdictions, customers and products; and
2. Effective- Credit unions are better equipped than legislators to effectively assess and mitigate specific BSA/AML risks they face.

Notwithstanding the lack of specific guidance, however, there are four main things a credit union’s risk assessment should consider:

1. Members- Who are you selling your products or offering services to? Individuals or private companies? Foreign public officials? Money Servicing Businesses?
2. Products and Services- What products and services are you offering that may be vulnerable to money laundering? Online banking? Private banking? Correspondent banking? Wire transfers?
3. Geographical Location- In what countries do your members reside and what are their countries of citizenship? Where are your corporate customers headquartered and where do they conduct their business? Are you engaging in transactions involved with countries included on any government lists?

Generally, some member types , products and services, and geographical locations pose higher risks than others, and thus your program wants to properly identify those and tailor its monitoring accordingly.

As indicated above, we received a substantial number of BSA/AML inquiries. Indeed, compliance with the BSA/AML rules remains a top priority for financial institutions. NAFCU is here to assist you as you navigate through the rules and will keep you abreast of emerging challenges, and regulatory developments. In fact, the industry is still awaiting FinCEN’s final rule on Customer Due Diligence and beneficial ownership requirements, which is expected this year. We will keep you posted.

###

NAFCU’s new BSA Seminar + Certification is Here!

We’ve had hundreds of requests from credit unions to provide more BSA training, and I’m excited to announce, it’s here. We’ll be holding our first in-person, BSA Seminar in New Orleans October 24 – 28. If those dates and location sound familiar to you, it’s not déjà vu. We’ll be running this BSA Seminar concurrently to our Regulatory Compliance Seminar. While they are two separate educational events, the networking aspects will be co-mingled, making it an awesome way to build your network of credit union and BSA professionals from around the country.

You can expect a full week of everything you’ve ever wanted to know about BSA, but didn’t have time to ask. It’s designed for just credit union professionals. You’ll find no erroneous “bank” information that doesn’t apply to credit unions. Check out the full agenda and sessions.

There’s an optional, pre-conference workshop to help get you up-to-speed on BSA fundamentals – it’s perfect if you’re new to BSA or just want a refresher. And at the end of the week, you’ll have the opportunity to get certified when you sit and pass the NAFCU Certified Bank Secrecy Officer (NCBSO) exam.

This seminar, and the certification, is an excellent way to demonstrate to NCUA and FinCEN you’re dedicated to compliance and to protecting your credit union against financial crime. It was designed by NAFCU’s Director of Education Devon Lyon, former director of BSA at State Department Federal Credit Union – so the curriculum is extremely relevant at both a strategic and tactical level. You’ll walk away ready to master your AML responsibilities. And of course, it fulfills your yearly BSA training requirement!

We have limited seating – so register early!

The Federal Reserve Presents a Framework for Managing Product Risk

Written by Elizabeth M. Young LaBerge, Regulatory Compliance Counsel

Welcome back to your regularly scheduled NAFCU Compliance Blog programming! I hope everyone had a wonderful, relaxing Labor Day weekend. When a long weekend is upcoming, it feels like there is always a mad rush on Friday to take care of business―to get all your ducks in a row so that you can spend the holiday actually relaxing. I know there was for me, and it seems like maybe there was for the Federal Reserve too.

In the waning, twilight hours of the Friday afternoon before the long weekend, as most of us were packing up and heading out, the Federal Reserve quietly released the 7th Anniversary Issue of the Consumer Compliance Outlook. With a September release date, it is a little late―this is only the second quarter issue. It is also a little thin―it contains only one article. The article is entitled Managing Risk Throughout the Product Life Cycle and it describes a product-focused risk management framework largely through a UDAAP lens, which may be especially useful for financial institutions considering the introduction of new products and services. As UDAAP enforcement actions by the CFPB continue to materialize, the Fed is suggesting a risk management framework that may help manage some of the uncertainty.

NCUA examination of risk management for all credit unions includes a risk-based review of the type of products and services offered by the credit union, and the depth and breadth of potential exposures created by those offerings. This framework is one way that a credit union can gauge and mitigate that risk, though certainly not the only way. The particular framework suggested by the Fed divides up a product life cycle into seven stages, and sets out a list of recommendations, risk factors, compliance considerations, and self-check questions for each stage. The seven stages of a product life cycle include strategic considerations, product design, marketing, product delivery, origination or consummation, product use and duration, and termination.

Strategic considerations includes the initial analysis of a potential product, including the determination of the product’s fit with the credit union, the product’s benefit to its members, and the identification of various components tied to product development. During this stage, a credit union would want to involve the board, management, compliance staff and appropriate business line staff to determine the strategic goals of the product and how it fits into the credit union’s strategic plans and risk appetite; the full scope of any compliance and regulatory issues; and what changes to processes, procedures, and system capabilities may be necessary.

Product design is the second stage, and one in which compliance personnel are critical. The Fed indicates some institutions make the mistake of not involving compliance in product design until final review. The Fed recommends that product design be conducted with not only regulatory compliance in mind, but also with ongoing consideration of the complexity of the product and of the fairness to consumers. With continued regulatory focus on fairness and consumer harm, a credit union might try to address any possible UDAAP implications when designing a product. This could include simplifying a product to ensure a consumer can understand it and that the credit union can fully deliver on its terms.

Marketing of a product also presents openings for possible UDAAP violations, for example, if products and services are targeted to potentially vulnerable populations. To avoid this risk, as well as the compliance risk involved in creating advertisements, the Fed recommends that compliance staff and marketing staff collaborate in the development of marketing plans and strategies. Bringing compliance into the marketing process early can result in time and cost savings to credit unions, in addition to supporting an overall culture of compliance.

Product Delivery focuses on the sales and applications processes and can take place in a variety of channels. Each delivery channel contains its own risks and a credit union would want to consider the appropriateness and fairness of using each channel for a particular product. Risks may be regulatory in nature, but they may also be reputational in nature. The Fed uses the delivery of a product across social media as an example. While Twitter and Facebook offer exciting new ways to connect with members and potential members, they also have the potential to allow a dissatisfied member’s comment to echo and escalate across the internet and traditional media.

Origination and Consummation describes the stage where the consumer has decided on a product or service. A credit union must determine adequate pricing controls and appropriate limitations on discretion so as to avoid any UDAAP risk. Well-documented qualification standards and pricing guidelines help mitigate this risk. The Fed also stresses that technical satisfaction of regulations, such as initial disclosures, may not be enough―a credit union must consider the fairness, consistency, and clarity of the method and form of disclosures to ensure a consumer was not otherwise misled about a product.

Product Use and Duration describes the stage where the product itself is in use and can vary widely, depending on the type of the product. Whereas a remittance transfer is a one-time transaction that is completed quickly, a mortgage may be in active repayment for thirty years. The nature of the compliance risk associated with a product must be determined individually, depending on the life of the product, the amount of service that product requires, and the amount of regulation surrounding service of the product. Additionally, the Fed recommends monitoring and evaluating member complaints as a tool to pinpoint compliance risks associated with the use of a product.

Termination describes both the end of a product in its natural course, such as a product reaching maturity or voluntary account closures, as well as early termination of a product or service by the credit union. Early termination by a credit union could be the discontinuation of a product or service or the termination of an individual product or service due to non-performance by a member. While any termination of a product or service may trigger regulatory requirements, termination initiated by a credit union may pose significant reputational risk, and should be carefully considered and planned.

The article contains a number of additional examples and recommendations for each stage of a product life cycle, and a number of useful questions a credit union should be able to answer as it makes the changes to its products and services. The article is practical and worth a read, especially to any credit union considering making new offerings to its members. But don't take my word for it...

Strengthening Your “Privileged Access” Procedures

Written by JiJi Bahhur, Director of Regulatory Compliance

With all the hype on cyber and data security, it would be appropriate to point out that it’s not always external threats we need to be wary of.  Internally, the credit union needs to be aware of and take appropriate steps to ensure that sound practices are in place for managing and monitoring privileged access to data and systems. 

In its August 2015 issue of the NCUA Report, NCUA defines privileged users and systems as “those with credentials that provide them with significant or unrestricted access to a credit union’s applications, systems and technologies.”  The article, What to Consider When Reviewing Privileged Access, goes on to state, “While this [privileged access] is necessary for the implementation, maintenance and operation of some of a credit union’s most vital systems, these people and systems also represent a significant risk.  These users have the potential to cause enormous damage if they act maliciously or inappropriately.” 

The short article goes on to provide key considerations that should be addressed during a credit union’s review of privileged access and users, which should occur, according to NCUA, at least annually.  The four key considerations discussed in the article include:

• Do our users need the level of access they currently have?
• Have we segregated sensitive systems and data stores into secure enclaves?
• Do we have effective oversight of privileged access?
• How can we make active monitoring part of our culture?

I’ll let you read the article to get more details on those four particular points, but I would like to take a moment to point you to other sources of information on how to strengthen your privileged access procedures, which in turn will assist with minimizing risks from the inside. 

FFIEC IT Examination Handbook

The Federal Financial Institutions Examination Council’s (FFIEC) IT Examination Handbook is a great resource for determining the types of internal controls that will strengthen your privileged access procedures.  Specifically, take a look at the Information Security Booklet.  Within the Information Security Booklet’s subsections, you will find good practices for controlling privileged access; information on restricting and monitoring privileged access; the importance of activity monitoring; and examination procedures that may help your credit union determine the effectiveness of your current processes. 

IT Aires Questionnaire

Credit unions may also find NCUA’s AIRES IT Exam Questionnaire useful when determining whether they have strong procedures in place for dealing with privileged access.  The questionnaires consist of a checklist of questions that examiners use when determining whether the credit union is in compliance or has a strong program in place to address risks. 

Actively managing privileged access by taking the steps addressed – in both the above-mentioned resources and article – can assist in reducing unauthorized access of critical systems. 

***

Time Flies.  My little buds are growing up so fast – they turned 3 just last week!  “Time flies, but memories last forever” . . . thanks to cameras!  And a big thanks to you all for sharing in on those memories with me! 

 

FFIEC Updates Business Continuity Planning Guidance; BSA Stats

Written by Shari R. Pogach, Regulatory Paralegal

The Federal Financial Institutions Examination Council (FFIEC) has revised its Business Continuity Planning Booklet with a new appendix entitled, Appendix J: Strengthening the Resilience of Outsourced Technology Services.  In addition to providing guidance for examiners in evaluating financial institution and service provider risk management processes, the booklet was also designed to help financial institutions with business continuity process implementation. 

The FFIEC recognizes that many financial institutions depend on third-party service providers to perform or support critical operations but warns that this does not relieve the institution from its responsibility to ensure that outsourced technology activities are conducted in a safe and sound manner.  Oversight of these outsourced relationships is the responsibility of the institution’s board of directors and senior managements. To be effective, a third-party management program will provide the framework for management to identify, measure, monitor and mitigate the risks associated with outsourcing. 

In its release the FFIEC states, “Specifically, a financial institution should ensure that its third-party service providers do not negatively affect its ability to appropriately recover IT systems and return critical functions to normal operations in a timely manner.”

The appendix discusses four key elements of business continuity planning that should be addressed to ensure that an institution is contracting with technology service providers that are strengthening the resilience of technology services.  The appendix covers: 

• Third-Party Management - addresses management’s responsibility to control the business continuity risks associated with its technology service providers and their subcontractors.
• Third-Party Capacity - addresses the potential impact of a significant disruption on a third-party servicer’s ability to restore services to multiple clients.
• Testing with Third-Party Technology Service Providers - addresses the importance of validating business continuity plans with technology service providers and considerations for a robust third-party testing program. 
• Cyber Resilience - covers aspects of business continuity planning unique to disruptions caused by cyber events.

The booklet is part of the larger FFIEC Information Technology Examination Handbook.  The IT Handbook is available here.

***

314(a) Fact Sheet. The Financial Crimes Enforcement Network (FinCEN) most recent 314(a) Fact Sheet indicates the agency’s 314 Program Office has processed 2,391 law enforcement requests as of February 3, 2015.  FinCEN’s regulations under Section 314(a) allow federal, state, local and European Union law enforcement agencies to contact and work with more than 22,000 financial institutions to locate financial assets and transactions of subjects of criminal investigations.   As a result, the program has afforded productive leads for both terrorist financing (464 cases) and money laundering (1,927 cases) investigations.  According to current feedback from law enforcement to the agency, 95 percent of 314(a)
requests have contributed to arrests or indictments.

***

SAR Stats.  FinCEN’s January 15 quarterly update of suspicious activity report (SAR) filings by depository institutions indicates credit unions filed 77,972 SARs in 2014, up 24 percent from a total of 62, 877 the previous year. FinCEN’s statistics track filings from March 1, 2012 through December 31, 2014.  The top five types of suspicious activity reported covered:  multiple transactions below the currency transaction reporting threshold; suspicions regarding the source of funds; transaction with no apparent economic business or lawful purpose; transaction not in customer’s normal pattern and suspicious usage of multiple locations.  The top five states for overall filings:  California, New York, Ohio, Texas and Florida. 

Holiday News from the NCUA; Programming Note; Speaking of Holidays

Written by JiJi Bahhur, Director of Regulatory Compliance

With 2014 coming to an end, I thought I'd put on your radar some of the more recent items released by the National Credit Union Administration (NCUA) during this very busy holiday season.

MSB Exam Guidance from the NCUA.  For sake of not bogging you down on New Year’s Eve, I won’t be covering this guidance in any detail here (but we’ll be sure to do so in a very near future blog post).  What I do want to do is put it on your radar in case you missed it during the busy holiday season.

Just briefly, what is this guidance?  NCUA released Letter to Credit Unions 14-CU-10 (“letter”) to provide guidance to credit unions that provide or intend to provide account services to a money service business (MSB).  In the letter, it discusses what an MSB is, the potential risks posed by MSBs, and how a credit union can mitigate those risks.  Moreover, the letter advises credit unions to review the enclosed examiner guidance – Supervisory Letter No. 14-05 – because NCUA’s field staff have been provided this examiner guidance and will use it to evaluate credit unions that provide account services to MSBs.   

First 2015 Grant Round for Low-Income CUs.  With an application period between February 2 and March 3, 2015, NCUA is inviting applications for low-income credit unions interested in providing staff training or hiring interns through use of funds from the Community Development Revolving Loan Fund.  NCUA has stated that it will provide at least $360,000 in funding during this first grant round in 2015, which will cover more than 100 requests from low-income credit unions for internships or staff or volunteer training programs.  If you are designated as a low-income credit union, check out the NCUA’s announcement here for more information and how to apply.  

Latest Videos from the NCUA.  In the last couple of weeks, the NCUA has made available the following videos:

• NCUA Assessment Update - Stabilization Fund –posted on December 16^th, the video is based on information presented at the July 2014 NCUA open Board meeting. 
• New Economic Update Video – posted on December 23^rd, this video covers the latest economic activity, the 2015 economic outlook and the performance of federally insured credit unions during the third quarter.
• New NCUA Video Outlining Field of Membership Options and Strategies – posted on December 29^th, the video provides an overview of the various field of membership types available to federal credit unions and briefly identifies expansion and conversion opportunities available for each field of membership type.

***

Programming Note.  NAFCU’s offices will close today at noon for the New Year and will reopen on Monday, January 5.  Happy New Year to you all! We’ll be back to blogging on Monday.

***

Speaking of the holidays – my two-year old twins, Kyse and Ava, had a blast opening presents and going from house to house visiting family.  Some photos from the festivities:

Happy New Year to you all! 

NCUA Report; Understanding Risks in Electronic Payment Systems

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

A couple of weeks ago, NCUA released its November 2014 Report. Featured articles include:

• Office of National Examinations and Supervision Report: ATM Skimmers: Can You Spot Them?
• Chairman’s Corner: Honoring Our Nation’s Veterans
• Board Perspectives: Taking the Time to Get it Right
• Board Actions October 2014: No Share Insurance Fund Premium for 2014; Board Approves Proposed Amendments to Corporate, Flood Insurance Rules
• Region II Report: Understanding Risks in Electronic Payment Systems
• Office of Small Credit Union Initiatives Report: Five New NCUA Videos to Fight Fraud
• Office of National Examinations and Supervision Report: Mobile Banking, Payments Increase Among Smartphone Users
• Find a Credit Union with our Locator App

***

Understanding Risks in Electronic Payment Systems. One of the articles in this month’s NCUA Report that caught my attention discusses the risks associated with electronic payment systems (ACH, ATM, wire transfers, and remote deposit capture) that credit unions should consider when offering or expanding these services. These risks fall into several familiar categories – credit, fraud, compliance, liquidity, systemic, operational or transactional, strategic, and reputation.

Here’s a snippet from the article, with just a few of the questions that NCUA has developed to help credit unions develop electronic payments risk-management policies and procedures:

“Policy and Procedures — Are our policies sufficient enough to address the risks associated with our credit union’s activities? Do our policies describe program objectives, the board’s risk appetite and tolerances? Have we identified and formally approved all activities the credit union will engage in? Do our written procedures match our current practices? Do our current practices address such things as Bank Secrecy Act or customer identification and verification concerns? Have we established and documented our incident response and communication expectations? Does our credit union have effective internal controls?

Audit — Has my credit union completed an acceptable audit? Was the audit completed by a person independent of my credit union’s operations? Do our internal audits sufficiently identify potential risk across all operational areas? Has my credit union taken action to correct any issues found in the audit?

Risk Assessment — Has our management evaluated the risks associated with electronic payments processing? Is our credit union’s risk assessment commensurate with the type and complexity of our activities? Does the assessment consider all categories of risk? Does it identify inherent risk, risk mitigating controls in place and residual risk?”

For the complete list of questions NCUA has developed, as well as links to several NCUA Letters to Credit Unions containing additional guidance, the article is available in its entirety here.

FFIEC Releases Statements on Cyber-Attacks on ATMs, Card Authorization Systems, and DDoS Attacks

Written by Brandy Bruyere, Regulatory Compliance Counsel

Cybersecurity continues to be a hot issue from both a compliance and risk-management standpoint. Given the variety of cyber-attacks that can impact credit unions, last week FFIEC released two statements relating to some specific issues. The first statement addresses cyber-attacks on ATMs and card authorization systems. The second statement discusses the continued problem of distributed denial of service (DDoS) attacks on websites. FFIEC’s statements detail the steps regulators expect credit unions to take with regards to these cyber-threats.

Cyber-attacks on ATMs and Card Authorization Systems

Recently, hackers have targeted ATMs by installing malware programs on a bank or credit union’s network that will allow for “unlimited” withdrawals or “Unlimited Operations.” This means that the hacker could extract money from an account beyond the available balance. FFIEC notes a case where this kind of attack caused over $40 million in fraud using only twelve stolen debit accounts. In other words, these attacks do not have to be broad in nature to cause serious consequences.

FFIEC warns that these kinds of attacks often stem from phishing emails sent to employees in order to gain access to the credit union’s network and install the malware needed to manipulate the ATM’s controls. To mitigate against the risks of these attacks, FFIEC outlines steps credit unions are expected to take:

• Conduct ongoing information security risk assessments.
• Perform security monitoring, prevention, and risk mitigation.  
• Protect against unauthorized access.
• Implement and test controls around critical systems regularly.
• Conduct information security awareness and training programs.
• Test incident response plans.
• Participate in industry information sharing forums.

These points are discussed in further detail in the FFIEC statement and are worth reviewing, especially as these kinds of cyber-attacks can impact credit unions of all sizes.

DDoS Cyber-Attacks

DDos attacks continue to be a problem and can prevent members from accessing the credit union’s web-based services, disrupt employees’ work, generally slow down a website, and even be accompanied by fraud. This means that these attacks can impact several areas of risk such as reputation risk, operational risk, and capital risk. Credit unions’ security programs should address DDoS cyber-attacks. According to FFIEC, this includes:

• Maintain an ongoing program to assess information security risk that identifies, prioritizes, and assesses the risk to critical systems, including threats to external websites and online accounts;
• Monitor Internet traffic to the institution’s website to detect attacks;
• Activate incident response plans and notify service providers, including Internet service providers (ISPs), as appropriate, if the institution suspects that a DDoS attack is occurring. Response plans should include appropriate communication strategies with customers concerning the safety of their accounts;  
• Ensure sufficient staffing for the duration of the DDoS attack and consider hiring pre-contracted third-party servicers, as appropriate, that can assist in managing the Internet-based traffic flow. Identify how the institution’s ISP can assist in responding to and mitigating an attack;
• Consider sharing information with organizations, such as the Financial Services Information Sharing and Analysis Center and law enforcement because attacks can change rapidly and sharing the information can help institutions to identify and mitigate new threats and tactics; and
• Evaluate any gaps in the institution’s response following attacks and in its ongoing risk assessments, and adjust risk management controls accordingly.

In addition to these FFIEC statements, NCUA has a Cybersecurity Resources webpage to help credit unions navigate these issues. The FFIEC IT Handbook can also be a useful tool when assessing your credit union’s cybersecurity program. Finally, NAFCU members can access a Regulatory Alert summarizing NIST’s Voluntary Cybersecurity Framework which was just released by our Regulatory Affairs team.

NCUA Launches Cyber Security Resources Webpage; Free Kick; Fair Lending Webcast

Written by Ricardo Piñeres, Regulatory Compliance Counsel

NAFCU has been beating the drum loudly on data security, and calling for action to ensure that merchants are properly protecting consumer information and actively working to prevent data breaches.  While the most recent and far-reaching problems have occurred at the merchant level, credit unions are not immune from cyber-attacks.  And that is the message that NCUA Chairman Debbie Matz delivered earlier this week.

During a speech in Washington, DC, on Monday, Chairman Matz highlighted the threats posed by cyber-criminals and how credit unions must step up their efforts to ensure that members’ funds and information are protected.  “Attacks, intended to create disruption, can crash networks but can also serve as a diversion for more damaging assaults,” Chairman Matz said.  “Imagine cyber-terrorists stealing passwords from your credit union and using your credit union as an entry point to gain access to every payment system and every vendor with which you have a digital relationship. Think about the damage they could do. The worst-case scenario doesn’t just deny services; it destroys security and dismantles systems.”

Chairman Matz’s speech is just one of the ways that the NCUA is calling attention to the issue of cyber security.  Back in January, the agency released its 2014 Supervisory Focus that prominently highlighted the need for credit unions to ensure that they have cyber security programs capable of dealing with 21^st Century threats to the financial networks.  During examinations, credit unions can expect examiners to focus on the institutions’ ability to assess and mitigate cyber security risks, and respond to possible attacks.  Credit unions are expected to have the appropriate risk mitigation controls in place to better prevent, detect, and recover from cyber-attacks, including:

• Vendor due diligence;
• Strong password processes; and
• Proper patch management and network monitoring.

While Chairman Matz’s speech was a call to action, she also acknowledged that the NCUA must have a role in helping credit unions prepare to deal with cyber threats.  Because of this, she announced that the agency has launched a webpage devoted to helping credit unions prepare to deal with cyber threats.  The NCUA’s Cyber Security Resources page includes helpful information that the agency believes will help credit unions strengthen their cyber security policies and programs.  The webpage includes sections on:

• Relevant NCUA regulations and guidance;
• Relevant federal requirements and guidelines;
• Information sharing forums on cyber threats;
• Best practices;
• Privacy and protecting personally identifiable information; and
• Other additional resources.

Chairman Matz didn’t stop with credit unions and other financial institutions.  She reiterated that in order for the system to be properly protected, merchants must be held to a higher standard.  NAFCU is in absolute agreement with Chairman Matz’s observation that data protection requirements for retailers are inadequate, and appreciates her strong call for tighter data security standards for retailers.

***

Free Kick. Next week brings another round of international friendlies.  Normally, I would be inclined to just brush them off and wait until club action resumes on the weekend, but this is a World Cup year.  Barring major injuries, little of what will happen during these friendlies will give us much new information regarding the globe’s top teams.  That being said, there are some intriguing fixtures on March 5.  Here are five matches that have piqued my interest:

• Colombia v. Tunisia (1:00 pm EST).  Those that have read my previous posts know that I was born in Colombia.  Anytime that Colombia takes the pitch, I am transfixed.  Outside of my usual devotion to the Cafeteros, I am particularly interested in seeing how Colombia begins to plot a strategy for playing without Radamel Falcao Garcia.  While there is still hope that Falcao will play in Brasil, Colombian manager Jose Pekereman will be looking to find attack options to take Falcao’s place should the striker’s knee not heal in time for the World Cup.
• Ukraine v. United States (2:00 pm EST).  The core of the U.S. Men’s National Team is pretty much set, but this match could go a long way in determining the last five or six spots on the roster.  With Jurgen Klinsmann set to use a primarily-European based squad, I’ll be keeping my eye on the battle for the last couple of defensive spots.  It’ll be interesting to see if Tim Ream, John Brooks, or Oguchi Onyewu can make a favorable impression.  Outside of the football, this match will be interesting to watch because of the political unrest that has engulfed the Ukraine (the match has been moved to Cyprus to protect the safety of all the players involved).  How will the Ukrainian players react, and will we see some inspired play from the highest-ranked team not heading to Brasil?
• Belgium v. Ivory Coast (2:45 pm EST).  Neither of these squads is going to catch anybody off-guard in Brasil, as they are extremely talented squads full of players from top European clubs.  Furthermore, both have their squads pretty much set.  What makes this match interesting is the off-the-pitch rivalry that is starting to boil over between Belgium’s top two keepers (Liverpool’s Simon Mignolet and Atletico Madrid’s Thibaut Courtois).  Mignolet has been vocal in his displeasure of being demoted to the back-up role by manager Marc Wilmots.  This has infuriated Courtois, and has led to an ongoing battle being fought in the press by both keepers and other members of the squad.
• Spain v. Italy (4:00 pm EST).  Anytime these European powerhouses face off, it’s a must watch fixture.  Each brings a distinctive style and flair to the pitch, and even in a friendly, it’s a pleasure to watch.
• Mexico v. Nigeria (8:30 pm EST).  El Trí endured their worst qualifying campaign in decades, yet they still find themselves heading to Brasil.  After a rocky 2013 that saw three different managers get sacked, I am intrigued to see if manager Miguel Herrera can put the pieces back together and form a squad that more closely resembles the Mexican national teams that we have been accustomed to seeing.  He has made some progress by getting some of the higher-profile players back into the squad, but there is still a lot of work left to do.

Lastly, with a little over 100 days left until the World Cup kicks off, ESPN has been kind enough to give us ample time to plan out our work and DVR schedules by releasing the television schedule for the entire tournament.

***

Webcast. Fair Lending: The Indispensable Essentials.

Save time on common conundrums; we’ll answer the most frequently asked Fair Lending questions NAFCU receives. Plus explore the fundamentals of Fair Lending and the recent rise of enforcement actions and litigation.  Register by Mar. 11 to save $100.

NCUA’s Supervisory Focus for 2014; NCUA Webinar on Exam Modernization

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

NCUA’s Supervisory Focus for 2014.  Last Friday, NCUA released Letter 14-CU-02, detailing its 2014 examination focus. For 2014, the emphasis is heavy on risk mitigation. From the letter – “In 2014, NCUA will be working to ensure that credit unions identify and mitigate forward-looking risks before they threaten the viability of credit unions and the stability of the Share Insurance Fund.” (My emphasis.)

Specific areas of supervisory focus for 2014 include:

• Interest Rate Risk
• Cybersecurity Threats
• Money Services Businesses (MSBs)
• Private Student Lending

In addition to these specific areas of focus, the letter highlights compliance with new rules.  NCUA also says it will be looking to reallocate resources “more efficiently and effectively” and describes several steps NCUA will be taking in 2014, intended to improve and streamline the exam process – let’s hope so!

The information in this letter is invaluable for exam preparation this year, so be sure to give it a read, available here.

****

NCUA Webinar on Exam Modernization. This month, NCUA will be hosting a free webinar on its new examination report process. The webinar will provide an overview of the changes NCUA has made to streamline and improve the consistency of the examination report process, and give participants an opportunity to get a better understanding of the new procedures related to Documents of Resolution and the examination report.

This free webinar will be held on Wednesday, January 22, 2014, at 2 p.m. EST. Register here.

Participants may submit questions in advance at [email protected]. The subject line of the email should read “Examination Modernization Webinar.”

NCUA Releases Risk Management Expectations

Written by JiJi Bahhur, Director of Regulatory Compliance

Last Tuesday, the National Credit Union Administration (NCUA) released Letter to Credit Unions 13-CU-12 and a Supervisory Letter, clarifying its supervisory expectations for credit unions’ risk management processes.  The Supervisory Letter begins with a detailed overview of enterprise risk management (ERM) and then goes into NCUA’s risk management expectations for natural person credit unions. 

Although enterprise risk management (ERM) is not a regulatory requirement for natural person credit unions, the Supervisory Letter provides that the core ERM principles can be integrated into the overall infrastructure of credit unions of all sizes.  During the examination process, NCUA examiners will be ensuring that smaller, less complex natural person credit unions have a sufficient risk management framework in place to manage major risks within the credit union.  For larger, more complex natural person credit unions, examiners will ensure that a more comprehensive risk management program is employed. 

For further detail regarding the NCUA’s expectations with regard to natural person credit unions’ risk management programs, take a look at 13-CU-12 here and the Supervisory Letter here.  In all cases, no matter credit union size, examiners are expected to take a risk-based approach when evaluating a credit union’s risk management processes.  The Supervisory Letter covers what factors the examiner will consider when examining the credit union and explains the “total analysis process” it will employ when evaluating the credit union and measuring its risk. 

NCUA Report: Protecting Members from Holiday Fraudsters; NAFCU's 2014 Technology and Security Conference

Written by Bernadette Clair, Regulatory Compliance Counsel

Recently, my colleague Tessema Tefferi blogged about the importance of cybersecurity awareness, providing links to many useful resources credit unions can use to manage cybersecurity risks. Although credit unions’ websites and computer systems are the main target of attacks such as Distributed Denial-of-Service (DDoS) attacks, it’s important to remember that fraudsters often target members directly, attempting to steal personal information through identity theft scams, social engineering, and computer malware, to name just a few methods. Educating members about information security and how they can protect their personal information is one tool credit unions can use to help mitigate some of the cybersecurity risks.

Along these lines, NCUA’s October 2013 Report that we blogged about last week, includes an article on Protecting Members from Holiday Fraudsters, just in time for the start of the holiday shopping season. The article encourages credit unions to educate members about how they can protect themselves against fraud, and provides strategies members can use to detect and avoid falling victim to fraud and identity theft. From the article:

“Review Credit Reports at Least Once a Year. This will help your members ensure fraudulent accounts have not been opened using their personal information. Additionally, the Fair Credit Reporting Act entitles consumers to a free credit report once a year from each of the three nationwide credit reporting agencies. Members can receive their report by contacting the credit reporting agencies directly or by visiting www.annualcreditreport.com.

Monitor Financial Statements and Online Banking Regularly. Members should get into the routine of checking their statements and periodically reviewing their account transactions and online activities. This will help members identify unauthorized account activities early, preventing potential losses to their personal accounts and negative impact to your credit union’s reputation.

Ensure Children Understand What Information to Provide Online. Fraudsters will often use a game or a free offer that will request personal information, or will include spyware to track and steal information from a member’s computer or mobile device. Members can protect themselves by encouraging their children to limit online contact to friends they actually know, setting privacy controls to restrict access to private information, and enabling parental controls that allow access to only trusted sites. Members should also talk to their children about not giving out their name, address, date of birth, or any other personal information online without talking to a parent first.

Beware of Downloading Sneaky Apps. Smartphone or social networking applications may provide application developers with access to your members’ personal information, such as their messages, contacts, emails and photos. Often, this information isn’t related to the application’s purpose. Instead developers may share member’s information with marketers or other third parties. Members should read the privacy policy of each application before downloading to understand what private information they are sharing.

Shred Documents with Personal and Financial Information. Financial statements, credit card offers and billing statements are examples of documents members should be shredding. Consider hosting a shred day at your credit union so members can safely discard their personal and financial records.

Look Out for Scams Involving Social Engineering. Fraudsters may impersonate a credit union (or other legitimate organizations) to trick members into giving out personal account information. This social engineering tactic is often utilized as part of an elaborate scheme involving phone calls, emails, text messages and other forms of communication. Remind members to never reply to unsolicited telephone, email, text or pop-up messages asking for personal account information. Members should understand legitimate organizations never ask for sensitive information over unsecured communication channels. Also, educate members on what policies and procedures your credit union follows when requesting sensitive information.”

****

NAFCU's 2014 Technology and Security Conference. Speaking of cybersecurity, NAFCU’s 2014 Technology and Security Conference, which will be held February 11-13 in Las Vegas, is a great place to discover the latest credit union security and technology trends. Conference topics include fraud trends, core processing issues, big data and credit union crisis management. Registration discounts are in effect until Nov. 15th. Check out more information about the conference and register here.

Cybersecurity: An Essential Function

Written by Tessema Tefferi, Senior Regulatory Affairs Counsel

The headline-grabbing news yesterday, and rightfully so, was that the Federal government is shut down.  However, the Administration and many in Congress have been clear that essential personnel will continue to work and the government’s essential functions will not be discontinued or disrupted.  Thankfully, one of these essential functions is to defend against cyber-attacks!  And thank goodness the government has determined that this function is essential.

Credit unions should also consider cybersecurity as an essential function, if they have not already done so. Whether the threat emanates from any or all corners of the world, in a credit union’s own operating system (for lack of adequate safety guards), or a garage or basement in any of our towns, it is no longer a threat that can be taken lightly.

Credit unions have heard for years about the ongoing cybersecurity threat.  Many have implemented sophisticated and effective safeguards and offer members tips to minimize risk against being hacked, but with October being Cybersecurity Awareness Month, I thought it would be good to point to some helpful resources that might help your credit union bolster the measures it has already taken (note: some of the government websites are ironically not functional during the shutdown!).   

• Internet Crime Complaint Center (IC3)
• FS-ISAC
• FTC - Privacy and Security
• National Cyber Security Alliance Stay Safe Online
• OnGuardOnline.gov
• U.S. Computer Emergency Readiness Team
• Stay Safe Online
• STOP.THINK. CONNECT.™
• Small Biz Cyber Planner (FCC)
• 10 Cybersecurity Strategies for Small Business tip sheet (FCC)

NCUA’s cybersecurity guidance, 13-Risk-01, is also helpful and lists a number of mitigation practices that credit unions should implement, including:

• Maintaining strong information security awareness programs for employees and members.
• Utilizing transaction monitoring, verification procedures, and appropriate limits commensurate with the risk of applicable funds transfers.
• Implementing strong controls over computers used to process commercial payments, including but not limited to:
  • Multifactor authentication.
  • Removal of hardware tokens upon session completion.
  • Prohibited or highly filtered use of Internet browsing.
  • Dedicated, corporate-owned systems without administrator privileges.
• Following network and application security best practices with regard to configuring systems, patch management, and security testing.

NAFCU's 2014 Technology and Security Conference. NAFCU’s work to provide you with pertinent information on cybersecurity is ongoing, but I’d be remiss to not remind you that NAFCU’s 2014 Technology and Security Conference will be heavy on cybersecurity.  Check out more information about the conference and how to register here.

Have a great day!  

Leadership; QRM; Interchange Update; September Compliance Monitor

Written by Steve Van Beek

Last week, I wrote an article for CUinsight.com that asked How Can Credit Unions Create a Culture of Compliance? Here is a snippet:

"So, how can we change our culture into a culture of compliance – an environment where we can stop compliance snafus before they begin, by building risk management into product development from the start?

In the past, a compliance officer would be brought into a discussion at the tail end of a project’s development, to give approval or disapproval. In today’s world, a compliance officer needs a seat at the table to help evaluate the various risks of a new product or service. The Consumer Financial Protection Bureau is not just rule- and requirement-focused – it is principle-focused. Their offices want to know not only if a credit union’s product or service is compliant with rules and guidance, but if that product or service provides a real benefit to members." (Emphasis added).

As compliance plays a larger and larger role at credit unions, compliance officers need to expand their skill sets. Rather than sitting back, they need to take charge and demonstrate how an effective compliance program at the credit union can reduce compliance, strategic and reputation risks. 

While compliance professionals usually attend NAFCU's two compliance conferences (School & Seminar), I'd recommend taking a look at NAFCU's Management & Leadership Institute - October 7-11 in Philadelphia, PA. To successfully create a culture of compliance, compliance officers need to expand their leadership skills and this conference provides those tools - including:

• Tools to effectively build relationships with board members;

• Successful communication techniques to help move projects forward;

• Tactics for leading a successful credit union— from operations to marketing; and

• Clarity on board vs. management roles.

More information on the "institute experience" can be found here and the overall conference details are here.

***

Qualified Residential Mortgage Proposal. Last week, the FDIC, OCC, FHFA, SEC and the Federal Reserve released a joint proposed rule (replacing the prior proposal) that would define a "qualified residential mortgage." Importantly, this proposed rule would not directly impact credit unions; however, it will impact the secondary mortgage market. 

One important improvement is that the proposed definition of "qualified residential mortgage" would be aligned with the CFPB's definition of "qualified mortgage." However, the devil is always in the details and the proposed definition of "qualified residential mortgage" would only be aligned with the CFPB's "general definition of qualified mortgage." According to the proposal, the definition of "qualified residential mortgage" would not include a mortgage that attains “qualified  mortgage” status on the basis of being eligible for purchase by Fannie Mae or Freddie Mac, issued by a “small creditor” (as defined in the CFPB’s rule), or is a “qualified mortgage" balloon loan.

***

Latest Interchange Video. Looking for the latest on interchange? Check out NAFCU's Interchange Fee issue page - including the latest video update from NAFCU's Carrie Hunt.

***

September Compliance Monitor. The September 2013 NAFCU Compliance Monitor is now available for download by NAFCU members. This month's articles are on NCUA's Loan Participation Rule and the CFPB's Remittance Transfer Rule. And, of course, the latest Compliance Calendar is also available.

Is Your Credit Union Tracking Member Complaints?

Written by Steve Van Beek

We've written tons about member complaints and the increased reputation risk for credit unions - especially in this viral media environment. The risk from member complaints was one of my messages to attendees at NAFCU's Annual Conference two weeks ago in Boston:

The CFPB's recent Dodd-Frank Mortgage Rules Readiness Guide also included some questions for financial institutions about how they track and analyze member complaints:

Regardless of whether the complaint was a formal complaint through NCUA or an angry tweet or Facebook message - tracking and analyzing that information can help manage the credit union's reputation and compliance risks.

Below is the closing paragraph from an article on Enhancing the Compliance Management Program with Complaint Data that highlights this point:

"CONCLUSION

Analyzing consumer complaint data and appropriately addressing issues noted in complaints will enhance and strengthen a financial institution's compliance management program. A wealth of information can be found in consumer complaint data, and one complaint could be the catalyst for an examination or further review. By analyzing complaint data, a financial institution can use the findings to regularly assess its compliance risk, validate its compliance controls, and provide a comprehensive compliance assessment to its board. A financial institution can also leverage its complaints to proactively prepare for regulatory examinations and to anticipate potential areas of congressional focus for future regulation."

I'd encourage you to review the full article. 

Natural Person Credit Union Guidance for NCUA’s Final Credit Ratings Rule

Written by JiJi Bahhur, Regulatory Compliance Counsel

In December 2012, NCUA issued a final rule to remove reference to credit ratings in regulations and substitute other standards of creditworthiness that are considered appropriate.  As a result, revisions to NCUA’s investment regulations – Parts 703, 704, 709 and 742 of NCUA’s Rules and Regulations – took effect on June 11, 2013. 

The final credit ratings rule has prompted some confusion among credit union officials.  To assist with this matter, NCUA has issued natural person credit union guidance – Letter to Credit Unions 13-CU-05 – to clarify NCUA’s expectations regarding issues of creditworthiness and due diligence.  As an enclosure to 13-CU-05, NCUA has provided Supervisory Letter 13-03, which provides the new investment guidance NCUA has shared with its examiners.  The Supervisory Letter will provide your credit union with the key elements of the due diligence process and how to evaluate the risks associated with its investment purchases. 

Although the natural person guidance comes after the passing of the effective date (better late than never), I found it to be very well-organized and full of information that could be of great help to credit unions.  It starts off with what credit unions are subject to the guidance and then addresses why credit ratings have been removed from the regulations. It goes on to provide regulatory expectations for credit unions and considers factors involved in a creditworthiness determination without sole reliance on credit ratings.  The guidance then outlines key factors to consider in analysis for specific security types, counterparty agreements and credit risk and provides additional guidance for structured securities analysis.  And last, the guidance clarifies situations whereby investment positions are grandfathered. 

I also wanted to bring to your attention other credit ratings guidance that may be of use. First, NCUA released Corporate Credit Union Letter 2013-01, but of more interest to natural person credit unions may be NCUA’s Town Hall Webinar on Thursday, July 18, at 3 p.m. EDT.   The webinar will include several updates and guidance, including guidance on credit ratings and risk management.  Registration is free and available here.  And the last piece of guidance I want to mention is a NAFCU article on credit ratings and the impact on credit union investment activities (available with Member log-in). 

OCC Speech on Risk Culture

Written by Steve Van Beek

As I catch up on my summer reading......I've found some absolute gems - including this speech by Carolyn DuChene, the Deputy Comptroller for Operation Risk at the OCC. The speech talks about risk management and, especially, the importance of a risk culture at financial institutions:

"Every organization has a unique risk culture. You might think of it as the organization's 'DNA.' The risk culture consists of core values that drive business practices and that shape executive decision-making as well as employee actions...Risk culture is the navigational beacon by which the board, the officers, and the employees make sound decisions that are aligned with long-term strategy. It is the guiding light that helps each person take prudent actions knowing that he or she owns and is responsible for the results. When that beacon isn't working, an organization can lose direction and may chart the wrong course, entering markets and introducing new products without appropriate due diligence, or aggressively pursuing earnings and growth at 'any cost.' The navigational beacon can also guide appopriate risk taking and actively discourage inappropriate risk taking."

DuChene's speech goes on to discuss five elements of an institution's risk culture:

• Enterprise
• Ethics
• Education/Expertise
• Empowered and Engaged Employees
• Executive Expectations

The closing of the speech includes this:

"The establishment and cultivation of a risk culture is, in the end, all about good stewardship, and the recognition that a firm and its reputation prosper across the economic cycles when the human element is in sync with the risk management environment...Risk culture is an issue that is independent of size. In community banks, it can be the single most important element that guides them through economic cycles. Along with sound risk management and solid well-developed business strategies and capital plans, a healthy risk culture contributes to success. I believe banks that continually improve on these elements have a competitive advantage."

Of course, the speech was directed to a banking crowd - but the overall message applies to credit unions as well and I'd encourage you to read the full speech. 

***

If you are interested in learning more - I'd encourage you to read my Three-Dimensional Compliance article from the May/June The Federal Credit Union and consider attending NAFCU's Regulatory Compliance Seminar where David Reed and Rusty Vellek will be discussing similar themes in their Featured Presentation: What Does Having a Culture of Compliance Mean for Your Credit Union?

NCCOs - Seminar is the perfect place to recertify your NCCO as you'll earn the full 24 credits. 

Today's Reports are Tomorrow's Regulations: Overdraft Edition

Written by Steve Van Beek

On Tuesday the CFPB issued a Study of Overdraft Programs which outlines their findings of studying the overdraft market.

The Study was supplemented by the following materials:

• Press Release: CFPB report raises concerns about impact of overdraft practices on consumers

• Prepared Remarks: Director Richard Cordray on overdraft report press call

• 3-Page Fact Sheet: CFPB report raises concerns about impact of overdraft practices on consumers

For compliance officers and risk managers, I'd start with the Fact Sheet and then dive into Cordray's speech and then the Study to get an idea of where the CFPB is heading next on overdrafts.

***

Here are a couple of items that stood out to me from Cordray's remarks:

"Our report today examined overdraft practices at some of the country’s larger financial institutions and found wide variations across them when it comes to overdraft opt-in rates and costs. At some institutions, more than 40 percent of new customers were opting in for overdraft coverage; at others, it was less than 10 percent. The gap may reflect differences in the substance of overdraft programs, or differences in customer base, or differences in marketing approaches. On this point, we are interested to dig in and learn more about the reasons why." (Emphasis added).

What is your credit union's opt-in rate? How are you marketing your overdraft programs?

"A second takeaway is that financial institutions have very different policies, procedures, and practices that can be highly complex and difficult for consumers to understand, yet greatly affect whether and how often they will incur overdraft fees...Some charge no overdraft fees on items under a certain amount (say, for example, a transaction of $5 or less); others do not charge if the total amount of the net overdraft at the end of the day is under a certain amount. At still other institutions, if you miss by as little as a penny, you may incur a hefty overdraft fee. Predicting or planning around these results can be highly complex." (Emphasis added).

Does your credit union have a de minimis exception for overdrafts?

According to the recent Pew Trusts report, 22 of the largest 36 banks had minimums before an overdraft would be charged:

One change suggested in the Pew Report was to add a "reasonable and proportional" limit on overdraft fees. In other words, if a member overdraws by $5 - you'd be limited to a $5 overdraft fee. Similar to the existing restrictions on penalty fees for credit cards under 12 CFR 1026.52(b)(2).

NCUA Report: Electronic Banking Threats and Security

Written by Bernadette Clair, Regulatory Compliance Counsel

One of the articles in NCUA's May 2013 Report, takes a look at Electronic Banking Threats and Security. The article reminds credit unions to be diligent in safeguarding member information and ensuring proper security and controls when offering E-banking services, such as internet banking, phone banking, mobile banking, etc. (Exam Tip: According to the article, NCUA examiners have received updated training on E-banking security and have been instructed to review these areas in more detail during exams.)

The article highlights guidance from the regulators related to E-banking. From the article:

"In October 2005, the Federal Financial Institution Examination Council (FFIEC) issued guidance entitled Authentication in an Internet Banking Environment. The guidance provided minimum supervisory expectations for effective authentication controls related to high-risk online transactions involving access to customer information or the movement of funds to other parties.

In 2006, NCUA issued a Letter to Credit Unions, No. 06-CU-13, to aid in the implementation of the authentication guidance and provided answers to frequently asked questions. The letter reinforced the risk-management framework specified in the FFIEC’s earlier letter and updated supervisory expectations for effective member authentication mechanisms, layered security and other controls to combat identity theft, cyber attacks and online transaction fraud.

A 2011 Letter to Credit Unions, No. 11-CU-09, reflects a more layered approach to risk-management, and includes annual risk assessments for E-banking services. It discusses minimum monitoring requirements at initial login and for funds transfers, as well as additional guidance on challenge question authentication techniques. The letter also has valuable information about new expectations for customer awareness programs, as well as, recommendations for increased scrutiny of commercial accounts.

In February 2013, NCUA issued additional guidance in the form of a Risk Alert, 13-Risk-0[1]. The Alert encourages risk mitigation strategies, against DDoS attacks such as: 

• performing risk assessments aimed at identifying risks associated with DDoS attacks;
• ensuring incident response programs include DDoS attack scenarios during testing; and
• performing ongoing third-party due diligence of Internet and web-hosting service providers to identify risks and implement appropriate traffic management policies and controls."

Here are links to the guidance documents referenced  in the excerpt above:

FFIEC’s Authentication in an Internet Banking Environment

NCUA Letter to Credit Unions, No. 06- CU-13

NCUA Letter to Credit Unions, No. 11-CU-09

NCUA Risk Alert, 13-Risk-01

See the article for additional details and guidance resources.

What is Three-Dimensional Compliance?

Written by Steve Van Beek

Last week, I shared two slides from my upcoming presentation How the CFPB Impacts Your Credit Union at NAFCU's Directors Conference in Asheville, NC. One of the key takeaways will be the idea of Three-Dimensional Compliance.

So, what is Three-Dimensional Compliance? In short, it is a new way to think about the role compliance plays in the credit union. Here is a snippet from my article in the May/June The Federal Credit Union magazine:

"Beyond the Checklist

The creation of the CFPB means that credit unions need to review the role compliance plays in the credit union. Often the compliance officer is brought into a discussion late in the process, and her job is to approve or disapprove a particular action based on the regulatory requirements. Going forward, this “yes or no” approach to compliance will need to change. The CFPB’s focus is principle-based as well as requirement-based. Not only will credit unions need to determine if their product or service is compliant with laws, regulations and guidance, but they will also need to expend resources to document that the product or service provides a benefit to members.

When new requirements are issued, credit unions won’t be able to simply work through a checklist of new requirements and make tweaks to their products and disclosures. They will also need to undertake a three-dimensional analysis of the product or service, asking: 

• Why is the regulator taking this action?

• How were consumers impacted by the prior practices?

• How do consumers view the product or service?

• How does the credit union market the product or service?

• Does the credit union’s marketing of the product or service correspond with how the product or service is used by members? 

In other words, when regulators identify a product or service that has been abused (by either consumers or financial institutions), credit unions need to complete a full 360-degree review of their offerings in order to reduce their compliance, reputation and strategic risks."

You can find the full article here.

***

Reading the CFPB's Tea Leaves. If that message sounds like something your senior managers or Board needs to hear, be sure to pass along information about NAFCU's Annual Conference - specifically our Regulation & Economy Track. We'll be meeting in Boston from July 9-13 and you can see the description of my talk below:

Reading the CFPB’s Tea Leaves 

The pace of the Consumer Financial Protection Bureau’s rulemaking has put credit unions on the defensive. For example, the CFPB’s final mortgage regulations will require a complete overhaul of credit unions’ mortgage operations. Hear which requirements will need special time and attention from your staff and gain best practices to stay on track with your implementation plan. And, just as importantly, hear which areas the CFPB is looking at next. Today’s scrutiny leads to tomorrow’s regulatory requirements. We’ll discuss the CFPB’s focus on prepaid cards, private student lending, overdraft protection programs and checking account disclosures – including what steps your credit union can take now to prepare for new requirements. 
Steve Van Beek, Esq., NCCO, Director of Regulatory Compliance, NAFCU

Full information on the conference can be found here.

2013 HMDA Getting it Right Guide; New NAFCU Calendar; Reg Alert on Escrow Proposal

Written by Steve Van Beek

2013 HMDA Guide. Yesterday, the Federal Financial Institution Examination Council (FFIEC) issued the 2013 HMDA Getting it Right! guide. According to the main page:

"The 2013 edition reflects the transfer of authority over Regulation C from the Federal Reserve Board to the Consumer Financial Protection Bureau. Appendix D, comment 1003.2 (Financial Institution)-2 is updated with the asset-size threshold exemption applicable to collection of 2013 data. There are also minor changes to the general text of the Guide, including updates to Sources of Geographic Information and Submitting the LAR."

You can find the full PDF of the 2013 Guide here.  

***

Long Time Coming. Now, you may be wondering when the last version of the Guide was issued?  2010.  The 2011 version would have been the lame duck one when the Federal Reserve still had authority for Regulation C (HMDA). However, there was no guide issued. On July 21, 2011, the CFPB took over Regulation C and they failed to release a guide in 2012.  Fortunately, in year two, the CFPB found the time to update the Guide and provide guidance to HMDA-reporting institutions.

***

Garbage In, Garbage Out? The CFPB is a self-described "data-driven" agency. If you doubt it, take a read through this Bloomberg.com story: U.S. Amasses Data on 10 Million Consumers as Banks Object. To me, if you want to be data-driven - the best first step is to make sure your regulatory requirements are clear and understandable so that the data you collect (whether it be consumer complaints, HMDA data, or anything else) is as reliable as possible. But, that's just me.  

***

NAFCU Calendar.  NAFCU has a new calendar on our website that features:

• Compliance Deadlines;

• Important Regulatory Dates;

• Education & Conferences;

• CU Research Survey Deadlines; and

• Other Important Dates.

The calendar allows you to navigate month-by-month, click to find more information and add dates to your own calendar. For example, the "more information" link on the June 1st Escrow Changes Deadline includes this information:

CFPB Compliance Deadline: Escrow Requirement

Description:

Amended escrow requirements for higher-priced mortgage loans. Added a new small creditor exemption for credit unions that meet a four-part test.

Regulatory Text: 12 CFR 1026.35

NAFCU Compliance Blog: Mortgage Reform - Escrows

NAFCU Resources: www.nafcu.org/mortgagerules/#escrow

Download the latest full Compliance Calendar, including proposed regulations, past deadlines and more.

Date:Jun 01, 2013    

Add to Calendar                                             Back to Calendar

***

NAFCU Members. The Mortgage Rules webpage includes NAFCU's Regulatory Alert on the CFPB's recent proposed rule. The proposal was published in the Federal Register yesterday and only provided 15-days for comments (comments to NAFCU on the Regulatory Alert are due on Wednesday, April 24).  

Outstanding Article on Reg E Error Resolution Procedures; Upcoming NAFCU Webcasts

Written by Steve Van Beek

Last Wednesday, I blogged on an article from the Fourth Quarter 2012 Philadelphia Federal Reserve's Consumer Compliance Outlook on Vendor Risk Management. Today, I wanted to share another outstanding free article on Error Resolution Procedures and Consumer Liability Limits for Unauthorized Electronic Funds Transfers.

The article is an absolute must read  - especially the examples which demonstrate the timeframes and liability limits. I strongly suggest passing this around to others at your credit union and consider using for training.

Reg E error resolution procedures has been mentioned by NCUA's Office of Consumer Protection in the past as an area where they see numerous member complaints and technical violations by credit unions (for example, by missing the timeframe requirements).  Again, take a look at the full article and be sure to share liberally at your credit union to ensure everyone is on the same page.

***

Upcoming NAFCU Webcasts.  We have another full slate of webcasts for the next month or so. Registration is open for all the webcasts listed below:

• Which New Requirements Apply to HELOCs? - April 10, 2013.  Register by COB Wednesday to Save $100!
  • Unfortunately, the new requirements applicability to HELOCs are scattered throughout the 3507 pages of mortgage information released by the CFPB. I'll be explaining which requirements apply to HELOCs and, just as importantly, which do not. If your credit union makes HELOCs, be sure to sign up!

• Preparing for New Mortgage Servicing Notices - April 17, 2013
  • Suzanne Garwood of Venable, LLP will explain new mortgage servicing notices including the mortgage periodic statement, interest rate adjustment notices (ARM notices) and force-placed insurance notices. Keep in mind that the small servicer exemption only applies to the periodic statement requirement and all credit unions servicing closed-end mortgages would need to comply with the ARM notices and force-placed insurance notices. Sign up by April 10 to Save $100!

• A Look Inside NCUA's National Supervision Policy Manual - May 1, 2013
  • Hear from experienced credit union attorney David Reed and Larry Fazio, Director of NCUA's Office of Examination & Insurance, on NCUA's new National Supervision Policy Manual. You'll receive an overview of the examination process - including recent (and future) changes by NCUA. Sign up today!

• NCUA's Office of Consumer Protection: Function, Role and Objectives - May 8, 2013 - Free to all credit unions!!
  • Keeping an eye on NCUA's Office of Consumer Protection was a key takeaway from NAFCU's Regulatory Compliance School. The webcast will feature Gail Laster, Director of NCUA's Office of Consumer Protection, and Moisette Sweat, Director of Consumer Compliance Policy & Outreach, as they explain the role of NCUA's Office of Consumer Protection. Because of the importance of this information, we are making this webcast available for free to all credit unions.  Sign-up here (look to the right for the "Register Now" button).

You can find additional information on NAFCU's live and on-demand webcasts here.  

Vendor Risk Management - Compliance Considerations

Written by Steve Van Beek

Back in May 2012, the Philadelphia Federal Reserve's Consumer Compliance Outlook webinar series discussed Vendor Risk Management - Compliance Considerations (the slides are available here). The Fourth Quarter 2012 Consumer Compliance Outlook publication included an article that provides highlights of the main themes. As you can see from the headings and subheadings, this article is a must read:

Vendor Risk Management - Compliance Considerations

QUESTIONS ABOUT THIRD PARTIES

What Are Common Types of Third-Party Relationships?

What Are the Risks of Using Vendors?

PRACTICES THAT INCREASE THE RISK OF VIOLATIONS

• Overreliance on third-party vendors.
• Failure to train new staff or retain knowledgeable staff.
• Failure to adequately monitor the vendor.
• Failure to set clear expectations.

EXAMPLES OF VENDOR RISK MANAGEMENT COMPLIANCE ISSUES

Flood Insurance Monitoring

Loan Modifications

Credit Card Administration

Disclosure Software

Revenue Enhancements

BEST PRACTICES

• Due diligence.
• Risk assessment.
• Clear contractual expectations.
• Comprehensive monitoring program.
• Board oversight.

CONCLUSION

Vendors provide value in the expertise and experience they offer; however, financial institutions must still maintain active oversight. It is important to remember that when a vendor performs a service or function, the institution bears ultimate responsibility for compliance. Because varying levels of risk remain with the institution that offers the product or service, a strong vendor risk management program is key to maintaining compliance and avoiding claims of improper treatment of bank customers. With good vendor management, banks can minimize the risk of less direct oversight or control and maximize the benefits gained through a well-managed vendor relationship. Specific issues about vendor risk management should be raised with your primary regulator.

Again, I recommend reviewing the full article and passing it along to your colleagues.

***

I also wanted to highlight the subsection on board oversight - which states:

"Board oversight. Keeping the board of directors properly informed about the vendor management program is key to ensuring that they can provide proper oversight and that the bank’s management process addresses the risks inherent in third-party relationships. The board should review the vendor management policy, due diligence reports, risk assessments, and monitoring results."

Board of Directors & Risk Management. Risk management and the role of the credit union's board of directors will be the focus of my colleague Anthony Demangone's presentation at NAFCU's upcoming Board of Directors and Supervisory Committee Conference.

Additionally, I'll be presenting on How the CFPB Impacts Your Credit Union and will include a discussion of the CFPB's latest actions related to "unfair, deceptive or abusive acts or practices" (UDAAP) - including how the actions of third-parties resulted in liability for the financial institutions. If your board is considering attending, sign up by Friday, March 29th to Save $100.

***

NAFCU's Online Training Program also includes 14 courses for credit union boards - including one on Risk Management.  

Five Takeaways from Regulatory Compliance School; Earn your NCCO!

Written by Steve Van Beek

Last week was NAFCU's 2013 Regulatory Compliance School, and we had an outstanding class. Great questions, great speakers and great networking opportunities.  

Here are five takeaways from School:

• The role of compliance is changing and credit unions need to make sure their compliance function is three-dimensional

• Credit unions need to establish a mortgage rule implementation team to manage the numerous changes

• The actions of the CFPB and NCUA's Office of Consumer Protection have the potential to increase reputation risk at credit unions

• Compliance officers need a seat at the table during product development and rollout

• No one can do it alone - compliance officers should reach out to colleagues (both internal and at other credit unions) to ensure their CU is keeping up with all the new requirements

Congratulations to the Class of 2013 - it was truly a pleasure to spend the week examining the existing (and future) regulatory environment facing credit unions.  

***

Compliance Seminar. If you missed Compliance School, consider joining us in October for our Regulatory Compliance Seminar in Nashville where we'll be reviewing the latest compliance issues facing credit unions. We're building the agenda now, so if you have any suggestions of "must cover" topics - just shoot us an email.

***

Earn Your NAFCU Certified Compliance Officer (NCCO) designation. Compliance School offers the ability for attendees to sit for four examinations and earn the NCCO designation. We also offer a self-study approach that allows anyone seeking a thorough understanding of the laws and regulations impacting credit union operations. 

The NCCO exams track NAFCU's Credit Union Compliance GPS (the 2013 version) and interested persons can purchase all four exams and have them proctored by a colleague at the credit union. If you are interested in earning your NCCO exam, take a look at the following resources:

• What is on the NCCO exams?

• NAFCU's 2013 Credit Union Compliance GPS*

• 2013 NCCO Exam Study Guide (opens as a PDF)

• NCCO Program Frequently-Asked-Questions

The FAQs include this one making it clear the NCCO designation is open to everyone:

Does my credit union or organization need to be a member of NAFCU for me to pursue the NCCO designation? 

No, the NCCO program is open to everyone. Any credit union professional who desires to improve their overall comprehension and skills in the compliance arena may pursue the NCCO designation.  Currently, there are CEOs, compliance officers, internal auditors, attorneys, lending officers, risk managers, vendors and numerous other individuals who have successfully passed the exams to become NCCOs.    

*The GPS is not required to take the NCCO exams. However, it is strongly recommended as it serves as the primary text for the NCCO exams. In other words, the information needed to answer each exam question is covered in the GPS text. Additionally, keep in mind that the GPS is one per credit union (or organization). If your credit union sent one person to our 2013 Compliance School (or you've purchased the 2013 GPS), you would not need to purchase another copy.  

***

Or, budget to join us for our 2014 Regulatory Compliance School where you'll receive in-person training and the opportunity to sit for the NCCO exams!  

Today's Reports are Tomorrow's Regulations - Private Student Loans Edition

Written by PJ Hoffman, Regulatory Affairs Counsel

In case you haven’t noticed, it seems that everyone has an opinion about private student lending. In just the past few months we have seen regulators, legislators, and news outlets all getting in on the act. If your credit union is involved with private student lending or anticipates entering into the market sometime soon, then you need to be paying attention. After all, today’s reports are tomorrow’s regulations. 

We’ve been ringing the bell here at NAFCU on student lending as reports and requests for information have come up, but it is important to understand the landscape going forward.

The CFPB has had this issue in their sights for a while now. In October 2012, the CFPB’s Student Loan Ombudsman released a report on private student loans that highlighted and summarized information and complaints received by the CFPB concerning the student loan marketplace. Many of the issues centered on frustration about the inability to speak with personnel empowered to negotiate a repayment plan, inability to refinance, and inability to access repayment plans previously advertised. While the CFPB acknowledged that credit unions and other small financial institutions generated very few complaints and that increased participation from those same small institutions might benefit the market, it is incumbent upon us to see that today’s reports are tomorrow’s regulations.

The CFPB has taken it two steps further in focusing on financial products offered to students, which Steve mentioned here on this blog, when they introduced two requests for information on financial products marketed to students through colleges and universities and another on the private student loan market. NAFCU has put out Regulatory Alerts on both available here with comment letters to follow.

Just last week, the CFPB offered a proposed rule to define larger participants of the student loan servicing market. This would extend the CFPB’s supervisory authority to encompass any non-bank and non-credit union that services over 1 million student loans. Although this rule will not affect credit unions directly, it will undoubtedly change the student loan servicing market and therefore any credit union that deals in that market.

The CFPB is not the only regulatory agency keep their eye on private student lending. Our own NCUA just published an article in their March report titled “Understanding The Risks of Private Student Loans” where they warn of upcoming risks to credit unions regarding private student loans. With quotes like “NCUA anticipates private student loan delinquency rates will likely increase in coming years” and “NCUA expects credit unions to establish reasonable concentration limits for a private student loan portfolio to protect against risk” you know that the NCUA is keeping a keen eye on private student lending. It’s not a coincidence that this article is coming out around the same time as the CFPB requests and we need to be sure to read the tea leaves going forward on this issue.

We’ll be keeping you informed as we hear and see new developments but if your credit union is involved with private student lending please be aware of the recent increase in attention by regulators. 

Help is Here: NAFCU’s 2013 Credit Union Compliance GPS

Written By JiJi Bahhur, Regulatory Compliance Counsel

We talk to credit unions every day. And, we hear the same concerns, fears and frustrations:

• How do we keep up?
• How do we know if this is the latest information?
• Where can I find that guidance document?
• When will someone explain this information in plain English?
• How do we get everyone on the same page without busting our limited training budget?

It is with these conversations in mind that we created the GPS and are pleased to announce the 2013 edition (with a very shameless plug).

***

NAFCU's Credit Union Compliance GPS - 2013 Edition. Hot off the electronic presses is the 2013 edition of NAFCU’s Credit Union Compliance GPS.  Written by NAFCU's compliance team, this electronic manual spans almost 500 pages and covers everything from the basic anatomy of a federal credit union to specific regulations from the NCUA, CFPB, and more.  It is the ideal companion for all credit union compliance officers and staff, consultants, vendors and attorneys.  The GPS translates complex regulatory language into plain English to help credit unions on a day-to-day basis while at that same time providing links to the applicable regulations, laws, and guidance documents.

And here’s the great part – you don’t have to be a NAFCU member to purchase the GPS.  The GPS is available to anyone and everyone at one affordable price ― $399 for NAFCU members and $499 for nonmembers. One purchase allows you to share the electronic manual with your entire credit union or business. And for no additional cost, your purchase of the 2013 GPS includes access to NAFCU’s new Scope & Applicability Charts to help you make sense of the CFPB’s new mortgage rules.

If your credit union has a prior version of the GPS (via purchase or attending a prior Regulatory Compliance School), you'd need to purchase the new 2013 GPS in order to receive the latest information. We've put a ton of time and effort into thoroughly reviewing the 2013 GPS to reflect regulatory changes. Additionally, we provided some additional bells and whistles to the 2013 GPS based on credit union feedback:

• an expanded section on the CFPB;
• user-friendly bookmarks, hyperlinks and pagination for easy navigation; and
• enhanced study tips for those studying for the NAFCU Certified Compliance Officer (NCCO) exams.

For a closer look, click here and check out our “sneak peek” documents available in the tabs to the right-hand side of the webpage (e.g., main table of contents, one page table of contents, section by section listing). 

***

NAFCU Certified Compliance Officer (NCCO) Program. NAFCU’s Credit Union Compliance GPS serves as the learning manual for NAFCU’s annual Regulatory Compliance School held each March.  NAFCU also offers a self-study program which allows anyone interested in obtaining a solid foundation of the compliance issues facing credit unions to take the four exams required to earn the NCCO designation.

If you are interested in the GPS, take a look at our new NCCO Exam Study Guide (opens as a PDF) and consider taking the next step and obtaining your NCCO.  

The Extra 30 Minutes & Director Education

Written by Steve Van Beek

On Friday I blogged about the Importance of Informed, Decisive and Strategic Board Members.  Over the weekend, I read another article that highlighted this issue and included a great tip.  The article was from NCUA Board Member Michael Fryzel and states:

"Recently, when visiting a credit union, I heard an excellent idea on helping board members better understand the many aspects of the financial services world. I call the idea "the extra 30."

Each month, prior to their board meeting, directors arrive at the credit union 30 minutes early. Those extra 30 minutes are then spent listening, asking questions and learning about one specific topic that will help them do their jobs better.

The range of subjects covered during the extra 30 minutes can be anything from the value of passbook accounts to asset liability management. It can even be a discussion on an NCUA regulation or the benefits of derivatives.

The extra 30 sessions should be concise, plain English presentations that provide solid information on a particular subject. The session should leave the participants knowing a little more than they knew before and eager for what is to come at the next session."

Of course, when I'm reading the section above I'm thinking about ways credit unions can use NAFCU's Online Training Program which includes 14 unique modules for boards. The majority of the modules are between 25 and 35 minutes in length - a great way to train during "the extra 30 minutes."

Board Member Fryzel continues:

"Director education is one of the most important functions of a credit union. The people entrusted with fiduciary responsibility need to know what their credit union is doing and what they are voting to approve when making decisions. Credit unions must continue to provide directors with the opportunity to understand and become familiar with the many aspects of our ever changing financial world. The first step in achieving that goal is to make education easy, available and understandable.

What better way to begin than with just an extra 30?"

Again - this builds on Friday's blog post on the Importance of Informed, Decisive and Strategic Board Members.  

***

Modules from NAFCU's Online Training Program. Below is a listing of the 14 board modules in NAFCU's Online Training Program:

1. The Nature, Foundation and Organization of Federal Credit Unions (33 minutes)
2. The Role of the Federal Credit Union's Board (34 minutes)
3. The Role of the Supervisory Committee (33 minutes)
4. Ethics and Fiduciary Duties (26 minutes)
5. The Regulation of Federal Credit Unions (23 minutes)
6. The Examination of Federal Credit Unions (38 minutes)
7. Risk Management (36 minutes)
8. Privacy, Security & Identity Theft (19 minutes)
9. The Bank Secrecy Act, Money Laundering and Financial Crime (44 minutes)
10. Asset Liability Training (35 minutes)
11. Discrimination Issues for Credit Unions (32 minutes)
12. On-Demand Webcast:  Essential Financial Literacy Education (60 minutes)
13. On-Demand Webcast:  Corporate Governance and Board Fiduciary Duties (90 minutes)
14. On-Demand Webcast:  BSA & OFAC Compliance for Directors and Supervisory Committee Members (75 minutes)

I see numerous opportunities to get your extra 30!  You can get a sneak peek at the Online Training Program here.

The Importance of Informed, Decisive and Strategic Board Members

Written by Steve Van Beek

Yesterday, we blogged on the latest The Federal Credit Union magazine - including an article on The Vital Life of the CU Director.

Well, that article isn't the only one focusing on the role of the credit union's board of directors.  The NCUA Report has included detailed articles in both the January and February issues.

The January issue had an article from Region V titled Strong Board Leadership is Essential for Successful Credit Unions.  The article includes this summary:

"We found the most successful directors display three overarching and essential characteristics.

• They have a clear understanding of their role.
• They are engaged in critical decisions.
• They have a strategic mindset."

You can find the full article here.

The February issue includes an article from NCUA Chairman Debbie Matz titled Volunteer Directors Play Critical Role in Safety & Soundness (continued on page 6).

The article focuses on the board's duties to oversee the direction of the credit union as well as their risk management duties - including:

• Interest Rate Risk
• Third-Party Risk - including

1. Credit Risk; and
2. Reputation Risk

• Aging Membership

The article ties risk management back into overall safety and soundness.  

Read together - these articles provide a compelling case for informed, decisive and strategic credit unions boards.

***

With the above in mind, I wanted to share two NAFCU resources to help ensure your credit union's board is informed, decisive and strategic.  

NAFCU's Board of Directors & Supervisory Committee Conference.  NAFCU's 32nd Board of Directors Conference will be held May 15 - 17 in beautiful Asheville, North Carolina.  You can view the conference agenda here, which includes the following:

• Bank Secrecy Act and Risk Management with NAFCU's Anthony Demangone

• Fiduciary Duties and Ethics: The Top 10 Things Credit Union Directors Need to Know with NAFCU's Carrie Hunt

• Strategic Succession Planning

• How the CFPB Impacts Your Credit Union with Yours Truly

• Regulatory Update with NAFCU's Carrie Hunt

And, much more - including the opportunity to earn Bank Secrecy Act and Financial Literacy training certificates.  You can find additional information here (including the full conference brochure).

Sign up by March 22nd to get the early-bird rate!

***

NAFCU's Online Training Program.  NAFCU also offers an affordable online training program for credit unions.  The program includes 14 modules for board members - including two on the Bank Secrecy Act and one on Financial Literacy (training certificates are available for board members who view those modules).  You can find FAQs here and pricing information here.  If you have any questions - just shoot me an email and I'll help in any way I can.     

***

Be sure to pass the articles and the training opportunities along to your management and board.  And, remember that all of NAFCU's educational events - including our Board of Directors conference and Online Training Program - are open to all credit unions regardless of NAFCU membership.

***

Have a great weekend!  

The Federal Credit Union Magazine; Upcoming NAFCU Webcasts

Written by Steve Van Beek

The March-April edition of NAFCU's The Federal Credit Union magazine is now available.  I thought you'd enjoy the following articles:

• Rules, Rules and More Rules: How the CFPB is Impacting CUs

• The Vital Life of the CU Director

• NAFCU Expands Regulatory Team

• NAFCU's Legislative Priorities

• Management, Gen Y Style - including these five great tips:

1. Hire those who know more than you.
2. Work thoroughly and slowly.
3. Mentor and be mentored.
4. The art of woo.
5. Think of others first.

• Learning from Noncompliance

• What Bankers Worry About

As you can see, there is a little bit for everyone - be sure to pass along to others at your credit union that might be interested.  

***

Upcoming NAFCU Webcasts.  We have a full slate coming up.  Remember - NAFCU's conferences and webcasts are open to anyone and everyone (NAFCU members receive preferred pricing). 

• An Inside Guide to CU Board of Directors - March 13

• BSA Compliance Update: Citations, Investigations and Criminal Activity - March 19

• Digging Deeper: CFPB's Mortgage Rules with NAFCU's Compliance Team - March 27

• Which New Requirements Apply to HELOCs?  - April 10

• Preparing for New Mortgage Servicing Notices - April 17

• A Look Inside NCUA's National Supervision Policy Manual - May 1

I'm biased - but that is a great slate of upcoming webcasts.  If you're thinking - I want them all - we got you covered.  You can still purchase NAFCU's Unlimited Webcast Subscription - including access to the six webcasts we've already held in 2013.  

FFIEC's Proposed Social Media Guidance

Editor's Note by Steve Van Beek

NAFCU's offices are technically closed today due to the weather in the Washington D.C. area.  Of course, we'll still be available to help NAFCU member credit unions.  To help ensure employee safety, some of our compliance team is working remotely.  If you have a compliance question, the best way to reach us is via email: [email protected].

NAFCU's Ability to Repay/Qualified Mortgage Webcast.  Today's webcast will continue as planned.  Andy Keeney from Kaufman & Canoles will be speaking and I'll be moderating.  If you're joining us - see you there (or, at least, you'll see me there)!  If the weather prevents your credit union from viewing today, the webcast - as with all NAFCU webcasts - will be available for on-demand viewing allowing you to reschedule and watch at a more convenient time.

***

Written by Bernadette Clair, Regulatory Compliance Counsel

The FFIEC is seeking comment on proposed social media risk management guidance designed to address the applicability of federal consumer protection and compliance laws, regulations, and policies to activities conducted via social media by credit unions and other financial institutions.  The guidance would cover credit unions’ activities on Facebook, Twitter, blogs, forums, and YouTube, to name just a few of the covered social media tools.

The proposed guidance discusses various risks associated with social media –such as compliance, legal, reputation, and operational risks – and sets forth a framework for establishing a risk-based management program designed to identify, measure, monitor, and control these risks.  Of note, the proposed guidance states that the components of a risk management program should include the following:

• A governance structure with clear roles and responsibilities whereby the board of directors or senior management direct how using social media contributes to the strategic goals of the institution (for example, through increasing brand awareness, product advertising, or researching new customer bases) and establishes controls and ongoing assessment of risk in social media activities;
• Policies and procedures (either stand-alone or incorporated into other policies and procedures) regarding the use and monitoring of social media and compliance with all applicable consumer protection laws, regulations, and guidance. Further, policies and procedures should incorporate methodologies to address risks from online postings, edits, replies, and retention;
• A due diligence process for selecting and managing third-party service provider relationships in connection with social media;
• An employee training program that incorporates the institution's policies and procedures for official, work-related use of social media, and potentially for other uses of social media, including defining impermissible activities;
• An oversight process for monitoring information posted to proprietary social media sites administered by the financial institution or a contracted third party;
• Audit and compliance functions to ensure ongoing compliance with internal policies and all applicable laws, regulations, and guidance; and
• Parameters for providing appropriate reporting to the financial institution's board of directors or senior management that enable periodic evaluation of the effectiveness of the social media program and whether the program is achieving its stated objectives.

The FFIEC invites comments on any aspect of the proposal, but is specifically requesting comments on the following questions:

1. Are there other types of social media, or ways in which financial institutions are using social media, that are not included in the proposed guidance but that should be included?
2. Are there other consumer protection laws, regulations, policies or concerns that may be implicated by financial institutions’ use of social media that are not discussed in the proposed guidance but that should be discussed?
3. Are there any technological or other impediments to financial institutions’ compliance with applicable laws, regulations, and policies when using social media of which the Agencies should be aware?

If you would like to weigh in on this proposed guidance, comments must be received by the FFEIC on or before March 25, 2013.

Mortgage Headache Areas; Upcoming Mortgage Reform Webcasts

Written by Steve Van Beek

Yesterday was NAFCU's first webcast as part of our Mortgage Reform Webcast Series.  I provided an overview of the seven new mortgage regulations - focusing specifically on the scope & applicability of the new requirements.  

I also provided some insight on "Headache Areas" and included this list at the end of the presentation:

• Determining Exemption Applicability

• New Notices – Content-Rich and Strict Timelines

• Error Resolution & Information Request Procedures

• Loan Originator Compensation Determinations

• Implementing So Many Changes At One Time

And, there will be many additional headaches as credit unions work toward implementing the new requirements.  Even self-induced ones.  

There is some hope on the horizon as the CFPB issued their best press release of their history which highlights their Implementation Plan for New Mortgage Rules.  The CFPB's plan indicates they are listening to NAFCU and credit union concerns regarding the overwhelming burden of reading, understanding, interpreting and implementing numerous requirements simultaneously.  Of course, we'll have more information on the CFPB's plan in future blog posts.

***

Upcoming Mortgage Reform Webcasts.  As I mentioned, yesterday's webcast was the first of our series and registration for the next three is now open.

• CFPB's Ability to Repay and Qualified Mortgage Requirements - March 6, 2013 - 2:00 p.m. to 3:30 p.m.

On March 6, Andy Keeney from Kaufman & Canoles will be examining the details of the CFPB's Ability-to-Repay Requirements and Qualified Mortgage Standards.  Andy will walk through the new underwriting guidelines - including the debt-to-income requirements - and explain how these rules will impact credit union mortgage lending.  And, importantly, the steps your credit union needs to take to comply by January 10, 2014.  

• Digging Deeper: CFPB's Mortgage Rules - March 27, 2013 - 2:00 p.m. to 3:30 p.m.

I'll be joined by my colleagues JiJi Bahhur, Bernadette Clair and Mike Coleman as we explore details of the CFPB's new mortgage requirements.  We'll provide answers to Frequently-Asked-Questions that our team has fielded from NAFCU member credit unions.  And, we'll take a look ahead at what other areas the CFPB is likely to address in 2013.  

• Which New Requirements Apply to HELOCs? - April 10, 2013 - 2:00 p.m. to 3:30 p.m.

I'll provide a detailed look at which requirements apply to home equity lines of credit and - just as importantly - which do not apply so that your credit union can best position your implementation strategy.  If your credit union makes HELOCs, this is one you'll want to attend as the new requirements are sprinkled throughout the CFPB's 3507 pages!

***

Programming Note:  NAFCU's offices will be closing early tomorrow and will be closed on Monday for the Federal holiday.  We'll have a blog post tomorrow and then start back up again on Tuesday.   

NAFCU's Fred Becker to Retire; ADA Lawsuits; NCUA-CFPB Town Hall Webinar

Written by Steve Van Beek

NAFCU’s Fred Becker to Retire July 31^st.  NAFCU’s President and CEO Fred Becker recently announced his decision to retire after 13 very successful years leading NAFCU.  Becker will be replaced by Dan Berger who has led NAFCU’s Government Affairs department – including NAFCU’s Compliance team – since 2006.  The motto at NAFCU is “business as usual.”  Looking at the transition through the compliance lens, we’re excited because, like Fred before him, Dan has detailed experience with the compliance issues facing credit unions (as does NAFCU’s Chief Operating Officer Anthony Demangone).  To see more about Fred Becker’s retirement and his future plans, check out this interview with CU Broadcast.  

***

ADA Lawsuits.  There has been an uptick in new ATM lawsuits – this time alleging noncompliance with the Americans with Disabilities Act.  The new speech output requirements became effective in March 2012 and the lawsuits started soon after.  Now is a very good time to audit and document your compliance with the new ADA requirements.  Past blog posts on the ADA can be found here.   

***

NCUA-CFPB Town Hall.  On Tuesday, February 5^th, NCUA Chairman Debbie Matz and CFPB Director Richard Cordray will be on a free Town Hall webinar.  The webinar starts at 3:00 p.m. on February 5^th and registration is open.  You can also submit questions in advance by using this link.    

Potential Credit Card Surcharges; Legal Hurdles in 2013; NAFCU Member Call-In; Save $100 on NAFCU Conferences; NCCO Exam Info

Written by Steve Van Beek

I'm sure everyone has plenty of reading to do with the mortgage regulations (I sure do!), so here are a few small items that should be on your radar.

Potential Credit Card Surcharges.  As part of a recent settlement, merchants gained the ability to surcharge for credit card purchases on January 27, 2013.  While this won’t directly impact your credit union, it has the potential to impact your members.  It is unknown how prevalent merchant credit card surcharging will be, but it might be a good idea to put an article in your credit union newsletter or some information on your website.  For more information, visit VISA’s website – which includes a list of state laws that still prohibit surcharges.  

***

Legal Hurdles in 2013.  The Credit Union Times ran a great article from Andy Keeney of Kaufman & Canoles on Legal Hurdles Facing Credit Unions in 2013.  Be sure to take a look and pass along to your colleagues.

***

NAFCU Members:  Don’t miss NAFCU’s first Member Call-In of 2013 – February 12 at 3:30 p.m. EST.  NAFCU’s President and CEO Fred Becker and NAFCU’s Government Affairs team will provide updates on the legislative, regulatory and compliance landscapes.  The call is free, but you must register.  New to 2013: You can submit questions in advance using the form here.  Of course, if you have a specific compliance question you can always email NAFCU’s Compliance team directly.   

***

Extra Savings for School & Seminar end on Thursday.  NAFCU is offering $100 off any conference through Thursday, January 31st.  This includes NAFCU's Regulatory Compliance School (March 18-23 at National Harbor, MD) and NAFCU's Regulatory Compliance Seminar (October 22-25 in Nashville, TN).  

Use the promo code NEWYEAR when your register to get the $100 off. 

***

School & NCCO Exams.  For those of you registered for School (or considering it), we've put together some FAQs on the process for taking the NAFCU Certified Compliance Officer (NCCO) exams.  We'll also have a NCCO Exam orientation on Sunday, March 17th (optional) as well as quick NCCO Study Sessions at the end of each day to help you keen in on which issues to study for the Exams.  

CFPB Field Hearing - Atlanta; Mortgage Servicing Final Rule; Appraisals for Higher-Risk Mortgages Final; NAFCU Final Regulation on Qualified Mortgages

Written by Steve Van Beek

CFPB Field Hearing.  Today, we should get a look at the CFPB's next final rules for the mortgage market.  We are expecting the final rules for mortgage servicing (both Reg Z and Reg X), mortgage loan originator compensation (and much more), and possibly the Reg B final rule for appraisal disclosures.  

***Updated at 8:00 a.m.***

Mortgage Servicing Final Rule.  As expected, the mortgage servicing rules will be the main focal point of the CFPB's field hearing today.  The rules should be online later today (when it is, it will be posted here).  

As of 8:15 a.m., there is a short summary and a fact sheet.  

***At 9:30 a.m., the CFPB posted their press release, Director Cordray's speech and a webpage with the final rules (the Reg X/REPSA rule is 753 pages and the Reg Z/TILA rule is 426 pages).*** 

Effective Date:  The summary indicates January 10, 2014 as the effective date (in other words, the CFPB is providing less than 12 months for this rule).  

Small Servicer Exemptions:  I also noticed this paragraph in the fact sheet:

"SMALL SERVICER EXEMPTIONS

Recognizing that small servicers approach servicing quite differently, the CFPB has made certain exemptions to today’s mortgage servicing rules. Servicers that service 5,000 mortgage loans or less and only service mortgage loans that they or an affiliate own or originated are exempt from some of the new rules. These exemptions include many of the procedural rules, including most of the requirements regarding the handling of loss mitigation applications."

We'll have additional details on exactly which mortgages are included in this 5000 in a future blog post.  For now, check how many mortgages you currently service and you'll get a good initial look at how onerous the mortgage servicing rules will be for your CU.  

***  

Appraisals for Higher-Risk Mortgages.  On Tuesday, the FDIC posted an approved version of the joint final rule on appraisals for higher-risk mortgages.  There are additional details in the NAFCU Today.  Both the CFPB and NCUA were joint on this rulemaking, so expect the CFPB to have additional details on this final rule in the near future (most likely a press release and short summary - and, hopefully, a Fact Sheet for compliance officers).  

***

NAFCU Final Regulation on Qualified Mortgages.  NAFCU's Regulatory Affairs team has finished their summary of the Qualified Mortgage/Ability-to-Repay final rule.  NAFCU members can find it here (13-EF-01).  

They are also working on summaries of the escrow final rule, HOEPA/high-cost final rule and the concurrent proposal for the qualified mortgage rule.  When they are available, NAFCU members can find the Final Regulations here and the Regulatory Alert here.  

Reminder: You can find information on the first three final rules in this blog post.  NAFCU also has a Mortgage Reform Webcast Series planned for 2013 and we'll also have a special Regulatory Update day - including sessions on the new moretgage regulations - on the Thursday of Regulatory Compliance School.  P.S. Register for School by January 31st using the promo code NEWYEAR to save $100.  

Change in Terms Required for Change to CFPB Website on Credit Card Disclosures?

Written by Steve Van Beek

Over the past weeks and months many credit unions, their vendors, their attorneys, their trade associations and many others have been struggling with trying to determine whether a 45-day change-in-terms notices is required solely due to a technical change to Regulation Z.  This blog post will try to provide an overview of this situation and where things stand.  Unfortunately, there is not a perfect answer as the CFPB will not provide formal guidance on this situation.  

Devil is in the Details.  The Dodd-Frank Act transferred authority for Regulation Z from the Federal Reserve to the Consumer Financial Protection Bureau.  This meant that the CFPB has authority for interpreting Regulation Z as well as providing information to consumers regarding credit cards.  To implement its authority under Reg Z, the CFPB republished Reg Z under 12 CFR 1026.  During this republishing, the CFPB indicated it was making solely technical changes and there would be no substantive changes.  However, as we all know - the devil is in the details.  

CFPB Website.  One of the changes during the republishing is that the CFPB website needs to be used by credit unions in their credit card disclosures after January 1, 2013.  This requirement comes from 12 CFR 1026.6(b)(2)(xiv) of Reg Z:

"(xiv) Web site reference. For issuers of credit cards that are not charge cards, a reference to the Web site established by the Bureau and a statement that consumers may obtain on the Web site information about shopping for and using credit cards. Until January 1, 2013, issuers may substitute for this reference a reference to the Web site established by the Board of Governors of the Federal Reserve System."

Ok, this seems simple.  In fact, we blogged on this as early as January 10th of 2012.  Credit unions have been making these updates throughout the year and most are ready to go on their disclosures for new credit card disclosures.    

Complicated, Interconnected Regulations.  However, this simple change also potentially triggered a change-in-terms notice - to existing credit cardholders - because of the complexity of Regulation Z.  Here is the requirement for when a change-in-terms notice is triggered - from 12 CFR 1026.9(c)(2):

"(2) Rules affecting open-end (not home-secured) plans. (i) Changes where written advance notice is required. (A)General. For plans other than home-equity plans subject to the requirements of § 1026.40, except as provided in paragraphs (c)(2)(i)(B), (c)(2)(iii) and (c)(2)(v) of this section, when a significant change in account terms as described in paragraph (c)(2)(ii) of this section is made, a creditor must provide a written notice of the change at least 45 days prior to the effective date of the change to each consumer who may be affected." (Emphasis added).

Thus, the analysis needs to jump to 1026.9(c)(2)(ii) to determine which changes are "significant changes in account terms":

"(ii) Significant changes in account terms. For purposes of this section, a “significant change in account terms” means a change to a term required to be disclosed under § 1026.6(b)(1) and (b)(2), an increase in the required minimum periodic payment, a change to a term required to be disclosed under § 1026.6(b)(4), or the acquisition of a security interest."  (Emphasis added).

So - this is where things get weird.  The disclosure of the CFPB's website is required by 1026.6(b)(2)(xiv) which would bring it under the definition of a "significant change in account terms."  This is even though the credit union did not make the change and the disclosure of the CFPB website is not actually a "term" of the account that impacts members (rather, it is a mandated disclosure).  

Is There an Applicable Exception?  Thus, a strict reading of Regulation Z indicates that this switch to the CFPB's website would be a "significant change in account terms."  But, does this trigger the change-in-terms notice?  It doesn't seem like it would as the credit union didn't make this change.  Congress did.  Dodd-Frank transferred authority to the CFPB and this required the CFPB to change Regulation Z and include their website - rather than the Federal Reserve's - under 1026.6(b)(2)(xiv).  Why should credit unions have to send notices to their existing cardholders of this change?  Further, this disclosure of the CFPB's website is only required in the application/solicitation and account opening disclosures - why would it need to be disclosed to existing members when it is changed?

Well, there is an exception in the official staff commentary that has been pointed out by quite a few credit unions, vendors, attorneys, and others as indicating the change-in-terms notice would not be required.  It comes from the staff commentary of 1026.9(c)(2)(v):

"9(c)(2)(v) Notice not Required

1. Changes not requiring notice. The following are examples of changes that do not require a change-in-terms notice:

i. A change in the consumer's credit limit except as otherwise required by § 1026.9(c)(2)(vi).

ii. A change in the name of the credit card or credit card plan.

iii. The substitution of one insurer for another.

iv. A termination or suspension of credit privileges.

v. Changes arising merely by operation of law; for example, if the creditor's security interest in a consumer's car automatically extends to the proceeds when the consumer sells the car."  (Emphasis added).

This sounds great.  The argument is that the change to the CFPB's website is a "change arising merely by operation of law."  Dodd-Frank transferred authority to the CFPB and that is the only reason why this technical change occurred.  Done deal, right?

Informal Agreement.  I've talked with CFPB staff on this issue (as have many others) and CFPB staff agrees that this "operation of law" exception applies and credit unions do not need to send the change-in-terms notice in this situation.  Unfortunately, the CFPB staff is unwilling to put their opinions in a formal writing.  This means that credit unions are left with an informal agreement that a change-in-terms notice is not required.

***

Documentation is Key.  Because the CFPB will not put their opinion in writing, it is important that credit unions document their decision-making as to why they did not send the change-in-terms notice in this situation.  Remember, the CFPB staff is not examining and auditing your credit union - so be sure to have documentation of your decision not to send the notice in case this issue comes up.    

Notice Already Sent.  Of course, if your credit union has already decided to send the notice - you are in a great position as you can move on to many other compliance issues facing your credit union.  Additionally, if you have the wheels in motion to get the notice out to your members in the near future - there is nothing wrong with sending the notice.  

Risk-Averse.  If your credit union decides it doesn't feel comfortable relying on an informal (2nd-hand) agreement from the CFPB staff - by all means send the notice.  And, then document why you sent the notice and the burden caused by the CFPB's unwillingness to put their opinion in writing.     

***

Legal Disclaimer.  Now is a very good time to remind blog readers of the blog's legal disclaimer:

"LEGAL DISCLAIMER

This website is intended to provide general compliance information in regard to the subject(s) covered. It is provided with the intent and understanding that the publisher is not engaged in the act of rendering legal, accounting or any other professional advice. The information provided in this website is not intended nor should be used as a substitute for legal advice or other expert opinions and services in specific situations. NAFCU is not responsible for the content of comments and reserves the right to delete or block comments that it finds inappropriate."

CFPB Consumer Complaint Database Updates

Written by Michael Coleman, Regulatory Compliance Counsel

We previously blogged about the CFPB’s Consumer Complaint Database on a couple of occasions, highlighting the (relatively ineffective) disclaimer at the top of the page among other things. In the wake of the release of the CFPB Consumer Complaint Database, we also discussed member complaints and the reputation risks associated with the nature of viral media, NCUA’s member complaint procedures, and supervisory committee complaint procedures.

On October 10^th, 2012, the CFPB announced that its Consumer Complaint Database left the beta stage. The CFPB blog had this to say about the move out of beta:

“While we will continue to expand functionality, data fields, and the “look and feel” of the database, after performing for three months as designed and without incident, the database is no longer a beta product.”

Another important update to the Consumer Complaint Database is the addition of consumer credit card complaint data going back to December 1, 2011. The Complaint Database previously contained only those credit card complaints received by the CFPB on or after June 1, 2012.

Also, the CFPB has reiterated its intention to include other financial products in the Consumer Complaint Database, from the blog post:

“One potential area for database expansion is the inclusion of additional products and services. Over the summer we asked for public comment on this idea and got a wide range of comments from a range of interested stakeholders. We are in the process of evaluating those comments and anticipate a final Bureau decision in early 2013.”

The CFPB’s notice for public comment (referenced in the quote above) outlines the CFPB’s rationale for expanding the database to include other financial products services in addition to credit cards. NAFCU submitted a comment letter to the CFPB expressing its continued concerns that the release of unverified complaints to the public poses serious reputation risk issues to credit unions given the nature of viral media and the speed at which information is disseminated, and that this expansion will only compound those concerns. This comment letter echoes NAFCU’s previous comment letter regarding the Consumer Complaint Database.

Note that the database will only contain information of credit unions directly supervised by the CFPB, those with over $10 billion in assets, and that NCUA has not expressed any intention to create a similar database. However, if a member of a credit union with less than $10 billion in assets submits a complaint to the CFPB, the CFPB will forward the complaint to NCUA's Office of Consumer Protection for resolution according to NCUA's procedures. 

Remittances Webinar; Fair Lending Webinar; Archived Nonaccrual/TDR Webinar

Written by Steve Van Beek

Remittances.  The CFPB recently opened their Remittances Webinar to everyone - without the need to register (the webinar is free).  The webinar will be available on this page beginning at 2:30 p.m. Eastern.  The webinar will last 90 minutes.

That is TODAY at 2:30 p.m. Eastern.  Be sure to tune in.    

NOTE - The CFPB issued their small entity compliance guide yesterday.  

*** 

Fair Lending.  The Philadelphia Federal Reserve's Consumer Compliance Outlook will be hosting a Fair Lending Webinar tomorrow - October 17th from 2:00 - 3:30 p.m. Eastern.  You can register here.   

The presentation slides are already available here.  Topics to be discussed are:

• Recent Fair Lending Enforcement Actions
• Risk Assessments
• Fair Lending Compliance Management
• Data Reporting and Analysis
• FHA LGBT Rule, Disability Discrimination, Maternity Leave Discrimination
• Loss Mitigation and Loan Modification
• Redlining

Remember - TOMORROW at 2:00 p.m. Eastern.  Register here.   

***

Nonaccrual and TDR Webinar.  NCUA's webinar on Workouts, Nonaccrual and TDRs is now archived and available.  The webinar can be watched here.  A transcript is also available inside the webinar (or at this link).       

NCUA Proposes Rule on Maintaining Access to Emergency Liquidity

Written by Bernadette Clair, Regulatory Compliance Counsel

NCUA’s proposed rule requiring federally insured credit unions (FICUs) to plan for or maintain emergency liquidity has been published in the Federal Register.  The proposed rule, approved at NCUA’s July 24^th Board Meeting, is intended to address liquidity concerns arising out of the anticipated closing of U.S. Central Bridge Corporate Credit Union (U.S. Central Bridge) later this year in October 2012.

Credit unions that have access to the Central Liquidity Facility (CLF) by belonging to a corporate credit union that is part of the agent group headed by U.S. Central Bridge will no longer have this source of backup liquidity once U.S. Central Bridge closes.  Subsequently, these credit unions will need to establish alternative means of backup liquidity, such as finding another agent through which to maintain membership in the CLF, or maintaining membership in the CLF directly.

 The proposed rule sets forth a three-tiered approach based on the asset size of the FICU. Here are the highlights:

Credit unions under $10 million in assets would have to maintain a written liquidity policy approved by their board and a list of contingent liquidity sources that can be employed under adverse circumstances.

Credit unions with $10 million or more in assets would have to establish a formal contingency funding plan (CFP) that clearly sets out strategies for addressing liquidity shortfalls in emergency situations.  The CFP must address, at a minimum, the following:

• The sufficiency of the institution's liquidity sources to meet normal operating requirements as well as contingent events;
• The identification of contingent liquidity sources;
• Policies to manage a range of stress environments, identification of some possible stress events, and identification of likely liquidity responses to such events;
• Lines of responsibility within the institution to respond to liquidity events;
• Management processes that include clear implementation and escalation procedures for liquidity events; and
• The frequency that the institution will test and update the plan.

 Credit unions with more than $100 million in assets would, in addition to maintaining a CFP, have to demonstrate access to at least one of the following three options for a backup federal liquidity source:  becoming a member of the CLF; becoming a CLF member through a CLF agent; or establishing direct borrowing access to the Federal Reserve’s Discount Window.

NAFCU’s Regulatory Affairs team is preparing a Regulatory Alert for members.  The deadline for submitting comments on the proposed rule is September 28, 2012.

Supervisory Committee Complaint Procedures; On-Demand Webcasts

Written By Michael Coleman, Regulatory Compliance Counsel

Last month in the wake of the CFPB’s new Consumer Complaint Database, we blogged about member complaints and reputation risk, and NCUA’s member complaint process. Today’s post is the last in the series, and we want to talk about a credit union’s Supervisory Committee complaint procedures.

NCUA's Division of Consumer Compliance and Outreach (CCO) is responsible for the management of member complaints received by NCUA. NCUA Letter to Credit Unions 11-CU-17 details the responsibilities of CCO and also outlines NCUA's process for handling member complaints, which it states are in accordance with section 4.12 of the Supervisory Committee Guide. 

NCUA stresses that a member should try to resolve the issue directly with the credit union before submitting a complaint to NCUA. NCUA also directs members to submit complaints directly to a credit union's Supervisory Committee if the member feels the credit union is unresponsive to their complaint.

When NCUA does receive complaints, NCUA refers the matter to the credit union’s Supervisory Committee for investigation. The Supervisory Committee Guide outlines in detail the investigation procedures which the Supervisory Committee is expected to follow. These procedures start on page 4-10 and include numerous steps the Supervisory Committee should take in the investigation, including these highlights:

“(g) Interview appropriate credit union officials and/or employees.

[…]

 (i) Determine the validity of the complaint.

• Do not rely on the credit union’s manager or employees to do the investigation for the committee.  You should obtain all information firsthand, where possible.  Try to determine what actually happened, rather than obtaining various versions of what happened.

• You should not initiate a joint meeting between the complainant and the credit union officials as a means of resolving disputes or expediting the investigation.  This is often counter-productive and may intimidate the complainant.  You act as a liaison between members and management when disputes arise.

• Remember that no one likes to be investigated.  Credit union officials and employees will often be defensive and complainants may also be antagonistic.  You will need to be very skillful and tactful in obtaining the necessary information without alienating any of the parties involved.

j) Work with the officials to develop plans to correct any improper, unfair, or discriminatory practices, if applicable, or make appropriate recommendations.

k) Have corrective action implemented or obtain agreements from appropriate credit union officials and/or employees they will make corrections within a specified time.” (emphasis added)

From a review of the procedures, it is apparent that the Supervisory Committee is expected to complete a thorough, independent and impartial investigation into member complaints. As you can see from the highlighted sections above, while the credit union officials and employees are not expected to conduct the investigation, they are expected to facilitate the investigation. Working cooperatively with your credit union's Supervisory Committee when they are conducting an investigation into a member complaint provides another opportunity to help manage reputation risk. 

***

NAFCU's Interest Rate Rule Webcast. With the upcoming compliance deadline of September 30, 2012, for NCUA's final rule on the required  interest rate risk policy and program, now is the perfect time to order NAFCU's May 24th, 2012 webcast: A Detailed Look Inside NCUA's New Interest Rate Risk Rule, which is available on-demand here. All of NAFCU's prior webcasts are available for order on-demand, you can find the event list here.  

FFIEC Statement on Cloud Computing; FinCEN Hearing on Customer Due Diligence

Written by Bernadette Clair, Regulatory Compliance Counsel

Earlier this week, the Federal Financial Institutions Examination Council (FFIEC) issued a statement addressing risk management of outsourced cloud computing activities.

Current guidance contained in the FFIEC Information Technology Examination Handbook, and in particular the Outsourcing Technology Services Booklet (“Outsourcing Booklet”), already addresses cloud computing.  This statement is intended to provide an expanded discussion of the risks, as well as key elements of outsourced cloud computing implementation and risk management as they relate to the existing guidance.

Covered topics include:

• Due Diligence
• Vendor Management
• Audit
• Information Security
• Legal, Regulatory, and Reputational Considerations
• Business Continuity Planning

In particular, the section on due diligence caught my eye, noting the responsibility of the board and management “to ensure that the third-party activity is conducted in a safe and a sound manner and in compliance with applicable laws and regulations.”  Potential cloud computing issues noted under the due diligence section include:

 “Data classification: How sensitive is the data that will be placed in the cloud (e.g., confidential, critical, public) and what controls should be in place to ensure it is properly protected? Does the cloud service provider appropriately encrypt or otherwise protect non-public personal information (NPPI) and other data whose disclosure could harm the institution or its customers?

 Data segregation: Will the financial institution’s data share resources with data from other cloud clients? For example, will the data be transmitted over the same networks, and stored or processed on servers that are also used by other clients? If so, what controls does the service provider have to ensure the integrity and confidentiality of the financial institution’s data?

 Recoverability: How will the service provider respond to disasters and ensure continued service? Do the financial institution’s disaster recovery and business continuity plans include appropriate consideration of this form of outsourcing, the service provider’s disaster recovery and business continuity plans, and the availability of essential communications links?”

 See the statement for the complete discussion.

 ****

FinCEN Hearing.  FinCEN intends to hold a series of hearings on issues raised by commenters regarding the Advance Notice of Proposed Rulemaking (ANPR) on Customer Due Diligence (CDD) Requirements for Financial Institutions.  The first hearing is scheduled for July 31st.

FinCEN seeks clarification primarily on issues dealing with beneficial ownership, risk mitigation, due diligence on trust accounts, and shell companies.  See the notice for the complete list of issues, and information on providing comments or attending the hearing.

For more information on the ANPR itself, see our previous blogs on March 5th and March 6th.

NCUA Member Complaint Process; Reports from NCUA's OCP

Written by Michael Coleman, Regulatory Compliance Counsel

Last week we blogged about the CFPB's new Consumer Complaint Database, and we also blogged about the reputation risk associated with member complaints. Given the nature of viral media, managing reputation risk is of primary concern to credit unions, and the proper management of member complaints is one way to reduce reputation risk.  

Today we want to talk about NCUA's procedures for handling member complaints. NCUA's Office of Consumer Protection (OCP) is NCUA's newest office, and OCP's Division of Consumer Compliance and Outreach (CCO) is responsible for the management of member complaints received by NCUA. NCUA Letter to Credit Unions 11-CU-17 details the responsibilities of OCP and CCO and also outlines NCUA's process for handling member complaints. NCUA stresses that a member should try to resolve the issue directly with the credit union before submitting a complaint to NCUA.

However, when a member is unsuccessful in resolving the issue with the credit union, Letter to Credit Unions 11-CU-17 provides the following procedures for how NCUA's CCO will handle the member complaint:  

• The member may submit a written complaint (on-line, by e-mail, by fax or by regular mail) along with any supporting documentation to CCO;

• CCO sends a letter to the chairman of the federal credit union’s supervisory committee, including the member’s original complaint, requesting a response usually within 21 days from the date of the letter;

• CCO sends an acknowledgement letter to the member including the date the supervisory committee is to respond to NCUA;

• Once the supervisory committee’s response is received, CCO reviews the response to ensure it adequately addresses the member’s complaint and that the action(s) taken, if any, are consistent with consumer protection laws and regulations;

• If the federal credit union did not address all of the member's concerns or there are remaining questions involving regulatory or consumer compliance issues, CCO will request additional information and/or clarification from the supervisory committee and notify the member that the complaint investigation is still ongoing;

• Once all issues associated with the complaint have been adequately addressed by the supervisory committee and analyzed by CCO, NCUA notifies the federal credit union and the member of one of the five following actions:
  • The federal credit union has resolved the issue to the member’s satisfaction and the case is being closed;
  • The federal credit union did not violate either a consumer protection law or consumer compliance regulation and the case is being closed;
  • One of the two parties initiated litigation; therefore, the courts will decide the outcome and the case is being closed;
  • Upon further investigation the issue does not involve either a consumer protection law or consumer compliance regulation; therefore, it does not fall under NCUA’s purview (Examples of this are complaints involving state contract law, state foreclosure procedures, etc.); or
  • A violation of either a consumer protection law or consumer compliance regulation has occurred. CCO cites the specific violation or the law or regulation and required corrective action(s) to be taken by the federal credit union.

Letter to Credit Unions 11-CU-17 also references in a footnote that the CCO handles member complaints in accordance with section 4.12 of the Supervisory Committee Guide. We will talk about these procedures in a future blog post. 

Reports from NCUA's OCP.  NCUA's Newsletter, the NCUA Report, sometimes features a section from the OCP. The March 2012 edition of the NCUA Report contained this report from the OCP, it is worth taking a look at. The good news from the report is that although NCUA is receiving and processing member complaints, federal credit unions are largely in compliance with federal regulations, and that where necessary federal credit unions have taken swift corrective action. The December 2011 report also contained a report from OCP, it is also worth a read.  

Member Complaints & Reputation Risk; CUSO Rule Delayed

Written by Michael Coleman, Regulatory Compliance Counsel

Yesterday we blogged about the CFPB's new Consumer Complaint Database. We mentioned that unfounded complaints can present a reputation risk to credit unions. Today we want to focus on NCUA's procedures and guidance for complaints made to NCUA, and some steps that credit unions can take to manage their reputation risk.

NCUA's Office of Consumer Protection (OCP) is NCUA's newest office and is responsible for member complaints. OCP maintains a Consumer Assistance Center which contains the page "Help With My Credit Union" designed to help members with the complaint process. NCUA states the following regarding when to file a complaint with NCUA:

"First, Attempt to Resolve the Complaint Directly with Your Credit Union 

Before you contact NCUA, please contact the credit union directly to attempt to correct the problem. You can do this over the phone, in person or in writing. If you believe the credit union's staff is unresponsive to your inquiry or complaint, address your concerns in writing to the president or chief executive officer of the credit union or the credit union’s supervisory committee."(emphasis added).

As you can see, NCUA stresses the importance of trying to resolve the complaint directly with the credit union before submitting a complaint to NCUA. This is a great opportunity for your credit union to manage your reputation risk. As we have talked about in the past, there are bound to be some complaints received at your credit union, but poor handling of member complaints can negatively affect your credit union's reputation. Here are some steps that your credit union can take to mitigate these reputation risks arising from complaints:  

• Establish a process for handling member complaints and train your staff to implement it. Prompt responses to member complaints will hopefully resolve the issue and prevent a complaint from being submitted to NCUA.
• Create written policies and procedures for member complaints.
• Monitor the complaints that you receive. This will help you identify patterns in complaints and help you take corrective action where necessary.

Even with effective reputation risk management and an effective complaint response program at your credit union, some complaints may still be submitted to NCUA.  We'll talk more about the actual complaint process in a future blog post.

***

CUSO Rule Pulled.  Yesterday, NCUA heeded NAFCU's advice and removed their CUSO rule from their June Board Meeting.  And, since the CUSO rule was the only agenda item - canceled the open meeting.  NAFCU Today has more information.

Upcoming Hearings, Webcasts, and Comments

Written By JiJi Bahhur, Regulatory Compliance Counsel

Upcoming Hearings. On Wednesday, June 6, there are two hearings that you may find of interest.

From 10am to 12pm, the Senate Banking Committee plans a hearing on "Implementing Wall Street Reform: Enhancing Bank Supervision and Reducing Systemic Risk," with Consumer Financial Protection Burean Director Richard Cordray among the witnesses. Although credit unions aren't affected by this part of Dodd-Frank, NAFCU is monitoring developments in this area for its market impact on cooperatives.

Then, from 2pm to 3pm, the Committee on Financial Services plans a hearing on "An Examination of the Federal Reserve's Final Rule on the CARD Act's 'Ability to Repay' Requirement."  This issue was discussed in NAFCU's Comment Letter to the CFPB on Regulatory Streamlining (see page 3).

***

Upcoming NAFCU Webcasts. NAFCU has several compliance webcasts on the horizon that might be of interest:

• June 13, 2012 - Building an Effective Enterprise Risk Management Program

• June 20, 2012 - The Impact, Expectations and the Future of the CFPB on Credit Unions

• June 27, 2012 - Bank Secrecy Act Compliance for Experts

• July 11, 2012 - Mid-Year Regulatory Update with NAFCU

Note that these webcasts are open to all credit unions, regardless of membership or charter type.

***

NAFCU Members. NAFCU's Regulatory Alert on NCUA's 2012 Regulatory Review is available. The NCUA conducts a review of one-third of its existing regulations on an annual basis and NAFCU is closely reviewing these regulations in order to select sections that have proved especially problematic for credit unions in recent years. Comments are due to NAFCU on July 6, 2012. NCUA is accepting comments until August 3rd.

CFPB Looking at Prepaid Cards; ERM and CFPB Webcasts; 2012 Seminar

Written by Steve Van Beek

Prepaid Cards Field Hearing.  The CFPB recently announced a field hearing on prepaid cards - which will be held today in Durham, North Carolina starting at 12:00 p.m. EDT.  The CFPB's blog indicates to check back if you want to view the live broadcast.  [As of now, there is no link to the feed.  But, past live feeds were available here if you want to try around noon]. 

Upcoming Prepaid Card Regulation.  In conjunction with today's field hearing, the CFPB announced its intent to regulate the prepaid card market.  The CFPB announced an Advanced Notice of Proposed Rulemaking (ANPR) which is an initial step in the rulemaking process and is usually one where an agency gathers information about the market - prepaid cards in this situation - in anticipation of future regulation.  

In addition to the ANPR, the CFPB issued a Fact Sheet on Prepaid Cards and a Ask CFPB: Prepaid Cards search function on their website.   

By the way - it is good to see the CFPB's website is capable of having a search bar!  I can't wait until they upgrade to the third version of their website and provide a search bar to help credit unions and other entities find the information they need.  

***

NAFCU Webcasts.  NAFCU has a full slate of webcasts for June.  Remember, all of NAFCU's events and conferences are open to anyone - this includes webcasts.  

• June 13 - Building an Effective Enterprise Risk Management Program
• June 20 - The Impact, Expectations and Future of the CFPB on Credit Unions
• June 27 - BSA for Experts - Registration available soon!

***

Regulatory Compliance Seminar.  Also, don't forget to look at NAFCU's 2012 Regulatory Compliance Seminar in Seattle, Washington.  Save $100 when you register by August 31st!  For potential topics, check out this past blog post.