NAFCU Compliance Blog

FFIEC Issues Final Social Media Guidance; Berger at MACUMA: Enough is enough

Written by Alicia Nealon, Regulatory Compliance Counsel

Happy Friday compliance community! My name is Alicia Nealon and I am one of two new Regulatory Compliance Counsels here at NAFCU. As this is my inaugural blog post, and they always say you only get one chance to make a first impression, I figured I would start with something that we can all relate to- social media.

Social Media has all but exploded in the past five years.  Today, three out of every four Americans belong to social media sites.  Visiting these social media sites has become the fourth most popular online activity-ahead of even personal email. In fact, in August 2011, Facebook surpassed Google as the site where internet users spend the majority of their time.  Today, 41.1 million hours are spent on Facebook every single week.

Regulators, and the compliance community, have struggled to adapt to how the explosion of social media has consumed current culture and business practice.  But on Wednesday, the Federal Financial Institutions Examination Council (FFIEC) issued a final guidance aimed at helping, banks, credit unions and other financial institutions manage risks related to social media. 

The FFIEC published the guidance in proposed form in January 2013 and invited public comments through March 25, 2013.  Taking into account the 81 official comments on the proposal, this final guidance differs from the proposal released in January in several respects, most notably the expectations for risk management practices and the definition of social media. 

Addressing the concerns raised by NAFCU Regulatory staff and other commenters that that the proposal appeared to recommend a "one-size-fits-all" approach for all lenders, the FFIEC acknowledged that a financial institution’s approaches to managing social media risk will vary according to its size, complexity, activities and relationships with third parties.  For example, commenters worried that the proposed guidance would require banks and credit unions to monitor all online communications that mention their institutions.  The final guidance clarifies this is not the case, but rather each financial institution should conduct its own risk assessment to determine the appropriate approach to take regarding monitoring of, and any response to, online complaints and inquiries about the institution.

The revised guidance also incorporates the requests from NAFCU Regulatory staff and other commenters to recognize that social media differ from other modes of communication.  Under the final guidance, traditional emails and text messages, standing alone, are not social media. However, messages sent through social media channels are social media.  The guidance cautions financial institutions to stay abreast of existing laws for emails and text messages, as they may overlap with social media regulations.

The guidance covers several other areas specific to the credit union industry, including clarification that the existing requirements regarding NCUA membership and share insurance apply equally to advertising and other activities conducted via social media as they do in other contexts. For more information, take a look at the guidance here. 

***

While the FFIEC guidance does not impose any new regulatory requirements on financial institutions, NAFCU is committed to combat those existing and pending regulations that have begun to wreak havoc on the credit union industry.  Earlier in the week, NAFCU President and CEO Dan Berger spoke about the overregulation of credit unions as well as NAFCU’s plan to target “the dirty dozen” top regulations that must be eliminated or changed during his address Tuesday night before the Metropolitan Area Credit Union Management Association in Arlington, Va.

"Credit unions cannot serve Main Street if they remain locked in an uphill battle with Wall Street,” Berger said. “In its very essence, overregulation is nothing more than a regressive tax – one that hamstrings our fundamental ability to compete. Most important, every dollar credit unions spend on regulatory compliance is a dollar they cannot invest in a family's dream of homeownership or a budding entrepreneur's vision for a small business. It's far past time for a common-sense approach to regulation based on government's power to help rather than its ability to hinder.”

Berger cited several legislative efforts to curb the overregulation of the industry, including the “Regulatory Relief for Credit Unions Act,” introduced by Rep. Gary Miller, R-Calif. He also highlighted NAFCU’s decision to go after the top 12 regulations that pose unnecessary burdens on the industry– the “dirty dozen” – which affect whether credit unions can change their fields of membership, whether their members can transfer money from savings accounts more than a certain number of times per month, and more. Details about the 12 regulations are available on the NAFCU website.

Is Your Credit Union Tracking Member Complaints?

Written by Steve Van Beek

We've written tons about member complaints and the increased reputation risk for credit unions - especially in this viral media environment. The risk from member complaints was one of my messages to attendees at NAFCU's Annual Conference two weeks ago in Boston:

The CFPB's recent Dodd-Frank Mortgage Rules Readiness Guide also included some questions for financial institutions about how they track and analyze member complaints:

Regardless of whether the complaint was a formal complaint through NCUA or an angry tweet or Facebook message - tracking and analyzing that information can help manage the credit union's reputation and compliance risks.

Below is the closing paragraph from an article on Enhancing the Compliance Management Program with Complaint Data that highlights this point:

"CONCLUSION

Analyzing consumer complaint data and appropriately addressing issues noted in complaints will enhance and strengthen a financial institution's compliance management program. A wealth of information can be found in consumer complaint data, and one complaint could be the catalyst for an examination or further review. By analyzing complaint data, a financial institution can use the findings to regularly assess its compliance risk, validate its compliance controls, and provide a comprehensive compliance assessment to its board. A financial institution can also leverage its complaints to proactively prepare for regulatory examinations and to anticipate potential areas of congressional focus for future regulation."

I'd encourage you to review the full article. 

FFIEC's Proposed Social Media Guidance

Editor's Note by Steve Van Beek

NAFCU's offices are technically closed today due to the weather in the Washington D.C. area.  Of course, we'll still be available to help NAFCU member credit unions.  To help ensure employee safety, some of our compliance team is working remotely.  If you have a compliance question, the best way to reach us is via email: [email protected].

NAFCU's Ability to Repay/Qualified Mortgage Webcast.  Today's webcast will continue as planned.  Andy Keeney from Kaufman & Canoles will be speaking and I'll be moderating.  If you're joining us - see you there (or, at least, you'll see me there)!  If the weather prevents your credit union from viewing today, the webcast - as with all NAFCU webcasts - will be available for on-demand viewing allowing you to reschedule and watch at a more convenient time.

***

Written by Bernadette Clair, Regulatory Compliance Counsel

The FFIEC is seeking comment on proposed social media risk management guidance designed to address the applicability of federal consumer protection and compliance laws, regulations, and policies to activities conducted via social media by credit unions and other financial institutions.  The guidance would cover credit unions’ activities on Facebook, Twitter, blogs, forums, and YouTube, to name just a few of the covered social media tools.

The proposed guidance discusses various risks associated with social media –such as compliance, legal, reputation, and operational risks – and sets forth a framework for establishing a risk-based management program designed to identify, measure, monitor, and control these risks.  Of note, the proposed guidance states that the components of a risk management program should include the following:

• A governance structure with clear roles and responsibilities whereby the board of directors or senior management direct how using social media contributes to the strategic goals of the institution (for example, through increasing brand awareness, product advertising, or researching new customer bases) and establishes controls and ongoing assessment of risk in social media activities;
• Policies and procedures (either stand-alone or incorporated into other policies and procedures) regarding the use and monitoring of social media and compliance with all applicable consumer protection laws, regulations, and guidance. Further, policies and procedures should incorporate methodologies to address risks from online postings, edits, replies, and retention;
• A due diligence process for selecting and managing third-party service provider relationships in connection with social media;
• An employee training program that incorporates the institution's policies and procedures for official, work-related use of social media, and potentially for other uses of social media, including defining impermissible activities;
• An oversight process for monitoring information posted to proprietary social media sites administered by the financial institution or a contracted third party;
• Audit and compliance functions to ensure ongoing compliance with internal policies and all applicable laws, regulations, and guidance; and
• Parameters for providing appropriate reporting to the financial institution's board of directors or senior management that enable periodic evaluation of the effectiveness of the social media program and whether the program is achieving its stated objectives.

The FFIEC invites comments on any aspect of the proposal, but is specifically requesting comments on the following questions:

1. Are there other types of social media, or ways in which financial institutions are using social media, that are not included in the proposed guidance but that should be included?
2. Are there other consumer protection laws, regulations, policies or concerns that may be implicated by financial institutions’ use of social media that are not discussed in the proposed guidance but that should be discussed?
3. Are there any technological or other impediments to financial institutions’ compliance with applicable laws, regulations, and policies when using social media of which the Agencies should be aware?

If you would like to weigh in on this proposed guidance, comments must be received by the FFEIC on or before March 25, 2013.