NAFCU Compliance Blog

Reg E Error Resolution for POS Disputes and Unjust Enrichment; Blockchain Resources

By Stephanie Lyon, Regulatory Compliance Counsel

Talk about Black Friday, the perfect opportunity for fraudsters to go holiday shopping with your member's debit cards, online or in store. The holiday season truly is a fantastic time to review key provisions of the error resolution process of Regulation E. So let's dig in!

The basic concept of the error resolution process is that members will notify their credit union when they notice an unauthorized EFT from their account. See, 12 C.F.R. § 1005.11(b). The credit union will receive the information needed to investigate the claim and resolve the issue within a specified time period. While the credit union investigates the error, the member will be provided with provisional funds to minimize disruptions to the member's life.  See, 12 C.F.R. § 1005.11(c)(2)(i). Finally, the credit union will notify the member of the resolution and make the provisional credit final or revoke the credit if no error occurred. Sounds simple enough, right?

Wrong. Regulation E is deceptively simple, but it is full of compliance pitfalls and stumbling blocks. We have already addressed a couple of these issues in prior blogs here and here. Today's blog focuses on point-of-sale (POS) dispute timelines and what to do if you finalized the provisional credit and new information shows the member was already refunded by the merchant or the transaction was not unauthorized.

The normal timeline to resolve a Reg E error is within 10 business days of when the member notifies the credit union of an unauthorized transfer from their account. See, 12 C.F.R. § 1005.11(c)(1). Some credit unions pride themselves in providing extreme member service and correcting most errors within this timeline and to save themselves the hassle of providing provisional credit. While admirable and very member-friendly, this also means the credit union will have to mad-rush to investigate the dispute, contact merchants, compare signatures, pull video from the security cameras (if any) and come to a conclusion. Whew! I am exhausted just thinking about the process. In POS dispute cases, 10 days is simply not enough to even get a return call from merchants, let alone any documentation of the transaction.

To remedy this, the regulation permits the investigation period to be extended up to 90 days for point-of-sale (POS) debit card transactions such as swiping your debit card at any store in the mall. See, 12 C.F.R. § 1005.11(c)(3)(ii). To take advantage of the extended timeline, the credit union must: (1) provisionally credit members for the amount of the alleged error as long as the member notifies the credit union in writing; (2) notify the member within 2 business days of the amount and date the provisional credit was given; and (3) give the member full use of the provisional credit while the investigation is pending.

Taking the time to investigate a POS dispute is essential as lately, credit unions are noticing that merchants are refunding members after the credit union has already resolved the error and finalized provisional credit. Basically, the member is getting back their money twice. As awesome as it is to get a windfall, it is simply not right. So credit unions want to know whether they can remove funds from a member's account if the member had been made whole by the merchant or if the credit union uncovers convincing evidence that the transaction was not unauthorized.

The answer to this question is not found in the regulation—of course. That would make it way too easy on the NAFCU compliance team that takes these questions as a white elephant gift from the regulators. Regulation E explicitly states that credit unions can reverse provisional credit if there was no error or a different error occurred. See, 12 C.F.R. § 1005.11(d). Nothing in the regulation states that credit unions can take back final credit if it later discovers that no error or a different error occurred. If this seems inherently unfair, you are not alone. There is an entire contract law concept called unjust enrichment that has been around long before any of us or our predecessors were thinking about compliance. The just of this notion is that someone received a benefit they were not entitled to at the expense of someone else. Unfortunately, to pursue an unjust enrichment claim, the credit union would have to file a civil suit against the member who received the windfall. A less expensive option may be to politely ask the member to reimburse the credit union if the merchant credited the member or if the member later admits to having made the transaction. But an even better option is probably to take the full 90 days to investigate the dispute and ensure the credit union is monitoring the member's account during that time.

Regardless of the option, this is an area where the regulation is not entirely clear on when or whether a credit union has the ability to revoke final credit if the member is unjustly enriched. Interestingly enough, the remittance transfer rule that makes up sections 1005.30 to 1005.36 of Regulation E, has a provision regarding these types of unjust enrichment cases that should be added to the EFT error resolution part of the regulation. Here is a relevant excerpt from the official interpretation to section 1005.33(f):

…In addition, nothing in this section prevents an account-holding institution or creditor from reversing amounts it has previously credited to correct an error if a sender receives more than one credit to correct the same error. For example, assume that a sender concurrently asserts an error with his or her account-holding institution and remittance transfer provider for the same error, and the sender receives credit from the account-holding institution for the error within 45 days of the notice of error. If the remittance transfer provider subsequently provides a credit of the same amount to the sender for the same error, the account-holding institution may reverse the amounts it had previously credited to the consumer's account, even after the 45-day error resolution period under §1005.11.

12 C.F.R. § 1005, Supp I, 1005.33(f)—1 (emphasis added). I am just going to put it out there, adding this to the official interpretation of section 1005.11(d) would be a pretty fantastic present for all compliance officers.

***

Blockchain Resources

NAFCU Regulatory Affairs Counsel Andrew Morris recently wrote an article for our Cyber Café edition of the Compliance Monitor (log-in required). To continue to assist credit unions interested in staying ahead of the curve he teamed up with NAFCU Special Counsel Pamela Yu, to produce a webpage that describes how blockchain technology impacts credit union regulations from BSA to Mortgage Servicing. This resource is available to all and can be accessed here.

ADA Compliance: What's the deal with websites?

Written by: André B. Cotten, Regulatory Compliance Counsel

Hello, compliance friends! The NAFCU Compliance Team has recently noticed an increase in questions related to potential Americans with Disabilities Act (ADA) website requirements. Credit unions are always eager to help their members, and we've had many credit unions asking about the status of ADA regulations, especially for websites. Today's blog post is meant to provide a very high-level overview of the statutory framework, rulemaking and enforcement activity, and potential for litigation with regard to ADA website compliance.

How the ADA Applies to Credit Unions

Generally, the ADA is intended "to provide a clear and comprehensive national mandate for the elimination of discrimination against individuals with disabilities" and "to provide clear, strong, consistent enforceable standards" addressing such discrimination. See, 42 U.S.C. § 12101(b). The ADA is a complex, fact-specific area of law, and some states have their own statutes addressing similar issues, so consulting with counsel may be necessary to fully assess ADA legal issues and risks. One way the ADA applies to credit unions is through Title III of the Act, which sets standards for certain "public accommodations." Public accommodations include banks and other "service establishments," so these provisions have been interpreted to apply to credit unions. As a result, the ADA requires credit unions to meet standards for "newly constructed or altered places" and has wide-ranging implications that impact how to communicate with persons with disabilities, which ultimately impacts the issue of website accessibility.

ADA discrimination is broadly defined by five categories. The one most applicable to websites is a provision that prohibits excluding, denying services or treating members with disabilities differently because of a lack of "auxiliary aids and services." This generally involves accommodations for persons with vision and hearing related disabilities, providing aids and services like closed-captions, interpreters, Braille materials and similar tools.

There are exceptions such as if the credit union can show that offering services with auxiliary aids and services would fundamentally change the nature of the services, or providing an auxiliary aid would cause an "undue burden." However, these exceptions are generally interpreted narrowly. Overall, the definition of discrimination is highly technical and includes several legal terms of art that are somewhat clarified in the Department of Justice ADA regulations.  

Possible Litigation Risk

ADA website accessibility can present some litigation risk for businesses that are public accommodations, including credit unions. One way a credit union can run afoul of the ADA is by not taking the steps in regulations that address when "auxiliary aids and services" may be necessary to meet objectives like effective communication with individuals with disabilities.

An important question in assessing the risk involved in these issues is what are the possible penalties and damages for ADA violations that may stem from litigation. The ADA permits the DOJ to assess civil penalties, which are currently up to $75,000 for the first ADA violation, and up to $150,000 for additional violations. The ADA and its regulations do not authorize statutory penalties for plaintiffs. However, a court can force a business to meet accessibility standards as part of a private lawsuit and award plaintiffs their attorney's fees, costs and expenses in a suit. Additionally, litigation risk can stem from state statutes. Overall, the rise in litigation is a continuing trend that is in part influenced by the DOJ's previous rulemaking and enforcement activity.

Rulemaking Efforts and Enforcement

In 2010, the DOJ issued an advanced notice of proposed rulemaking (ANPR) aimed at starting the process for adopting formal standards for website accessibility. While acknowledging that neither the Act nor existing regulations "specifically address access to websites," the DOJ indicated its position that the ADA is broad enough to apply to websites.

After collecting information in 2010, the DOJ did not take further rulemaking action that would impose a clear standard for credit unions to follow with regard to website accessibility for persons with disabilities.

In regards to enforcement actions, during the Obama Administration, the DOJ intervened in private lawsuits on the issue of website accessibility, taking the same position set forth in the 2010 ANPR, which is the ADA is broad enough to apply to the websites of public accommodations like credit unions.

For example, on May 31, 2011, the DOJ entered into a settlement agreement with Wells Fargo, indicating that discrimination includes the failure to "provid[e] a website that is accessible to individuals with disabilities, including blind individuals who use screen readers to access web content that is visual and providing captions for deaf individuals . . ." While Wells Fargo committed to making its website more accessible as part of the settlement, the DOJ did not require specific standards to be followed.

In later cases, such as a consent decree with H&R Block in 2014, the DOJ went a bit further than in the Wells Fargo case and actually required H&R Block to commit to following a specific standard in making its website accessible that is known as the Web Content Accessibility Guidelines 2.0 Level A and AA. These are voluntary standards with a dozen separate components. The DOJ also required H&R Block to make not only its website accessible, but its mobile applications as well. Despite not adopting a formal website accessibility standard, the DOJ continued to require this standard in its enforcement actions.

Currently, the Title III rulemaking has been listed as "inactive" on the DOJ's most recent rulemaking agenda. It also appears that formalizing this rule is not a priority for the Trump administration, and it is unclear how the current administration will address these issues from an enforcement perspective. However, the risk for credit unions from private litigations remains active.

Conclusion

Moving forward, a credit union may need to consult with its local counsel to discuss the trends in jurisdictions where it operates relating to potential demand letters and lawsuit activities. Some credit unions may also consider adopting accessibility measures based on the potential litigation and reputation risks. There are also consultants that work to make websites accessible for persons with disabilities and perform ongoing work for changes in content over time which comes with various upfront and continuing expenses.

For further information, please see the March 2017 Monitor Compliance Article written by the VP of Regulatory Compliance, Brandy Bruyere.

 

PCI DSS Version 3.2!

Written by Eliott C. Ponte, Regulatory Compliance Counsel

Last month, the Payment Card Industry Security Standards Council released an update to its data security standards, version 3.2. The new version of the Payment Card Industry Data Security Standard (PCI DSS) will replace the current version, version 3.1, which is set to expire on October 31, 2016.

At NAFCU compliance, from time to time, we receive general questions on PCI compliance. While no one at NAFCU holds themselves as PCI Compliance expert, I wanted to answer some general PCI questions that the compliance team frequently receives, as well as highlight some of the changes to version 3.2.

 What is PCI DSS?

PCI DSS is an information security standard for organizations designed to ensure certain intuitions process, store, or transmit credit card information. This standard provides operational requirements to protect card data against unauthorized access, use, or disclosure. PCI DSS is administered by the Payment Card Industry Security Standards Council, which is an organization founded by the major credit card brands (MasterCard, Visa, American Express, Discover, etc.).

 Who must comply with PCI DSS?

PCI is a contractual compliance requirement issued by the major card brands. PCI DSS generally applies to all entities involved in payment card processing, including merchants, processors, acquirers, issuers, and service providers as well as all other entities that store, process, or transmit cardholder data and/or sensitive authentication data. Credit unions may be both merchants, if the credit union allows cash withdrawals from credit cards at the teller line, and service providers, if their member’s credit card information stored on their systems.

Periodic validation of compliance is usually required. Non-compliance with PCI DSS requirements could result in potential liability, including fines levied by the payment card brands and the CFPB. Each payment card brand has its own program for compliance, validation levels, and enforcement. More information about compliance can be found at the links below:

• MasterCard: mastercard.com/sdp
• American Express: americanexpress.com/datasecurity
• Discover: discovernetwork.com/fraudsecurity/disc.html
• JCB International: http://partner.jcbcard.com/security/jcbprogram/
• Visa Inc: visa.com/cisp

 What Does Version 3.2 Change?

According to the PCI press release on version 3.2, the primary changes are clarifications on requirements that help organizations ensure critical data security controls are in place, monitored, and effectively tested. Nevertheless, the updated PCI DSS changes are significant.

One major change to PCI DSS is that version 3.2 implements a multi-factor authentication process for all personnel with non-console administrative access and all personnel with remote access to the cardholder data environment. Another major change affects requirements for entities using Secure Socket Layer/early Transport Layer Security for encrypted data transmission, and the integration of Designated Entities Supplemental Validation assessment.

Credit unions that meet the definition of service providers will want to pay particular attention to the new requirements imposed on them. For example, service providers will be required to maintain a documented description of the cryptographic architecture, detect and report on failures of critical security control systems, and perform reviews at least quarterly to confirm personnel are following security policies and operational procedures. Requirements 3.5.1; 10.8; 12.11. In addition, executive management is now responsible for the protection of cardholder data and PCI DSS compliance. Requirement 12.4.1.

For a high-level overview, the Payment Card Industry Security Standards Council released a summary of the changes from version 3.1 to version 3.2. The summary places changes into three different categories: (1) clarifications to existing rules, (2) additional guidance, and (3) “evolving requirements” (updated or new requirements). Credit unions should note that “evolving requirements” have an effective date of February 1, 2018. Credit union’s that are required to conduct PCI compliance should carefully review this document to determine how the new version affects their security standards. Other resources available to credit union's include a quick reference guide, a version 3.2 resource guide, a PCI FAQ database, a guide on migrating from SSL and Early TLS, and a version 3.2 high-level webinar. The Security Standards Council also has a blog, which provides some background commentary on the changes.

FFIEC Implores Financial Institutions to Stop the Bleeding; Free Kick

Written by Ricardo Piñeres, Regulatory Compliance Counsel

On Thursday, April 10, the Federal Financial Institutions Examination Council (FFIEC) released an alert regarding the “Heartbleed” vulnerability.  The alert is intended to make credit unions, and other financial institutions, aware of the seriousness of the “Heartbleed” vulnerability and how it can create a situation where attackers could access private information that would normally be encrypted.

“Heartbleed” is a vulnerability in the OpenSSL cryptographic library that may put systems that use this encryption method at risk.  OpenSSL is an open-source implementation of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols commonly used to protect data in transit.  OpenSSL, popular for implementing encryption in websites, e-mail servers, and applications, is used in common network services such as web servers, email servers, virtual private networks (VPN), instant messaging, and other applications.  Financial institutions may be using OpenSSL to cryptographically authenticate their servers to customers, and to protect passwords and other sensitive data from eavesdropping.

The vulnerability has existed in OpenSSL versions 1.0.1 through 1.0.11 since December 31, 2011, but it was not discovered until April 7 of this year.  Because of the vulnerability, an attacker may be able to decrypt, spoof, or perform man-in-the-middle attacks on network communications that would otherwise be protected by encryption.  Furthermore, attackers could potentially impersonate bank services or users, steal login credentials, access sensitive email, or gain access to internal networks.

FFIEC’s alert urges financial institutions to:

• Ensure third-party vendors using OpenSSL on their systems are aware of the vulnerability and take appropriate mitigation steps;
• Monitor the status of their vendors’ efforts;
• Identity and upgrade vulnerable internal systems and services; and
• Follow appropriate patch management practices and test to ensure a secure configuration.

FFIEC also suggests replacing private keys and X.509 encryption certificates after applying patches.  Furthermore, the alert says financial institutions should assume current encryption keys for vulnerable servers are no longer viable and that institutions should also strongly consider having users and administrators change passwords after applying the OpenSSL patch.

For more information on the “Heartbleed” vulnerability and how it works, visit Codenomicon’s webpage devoted to the vulnerability.  Three security engineers from Codenomicon, along with an individual from Google Security, were the discoverers of the vulnerability.  There is also a simplistic, yet fun, comic strip that explains the basics of “Heartbleed.”  Lastly, the FDIC put out a useful press release last week that lists several helpful resources for improving financial institutions' cyber security.

***

Free Kick.  With under two months left until the start of the World Cup, I thought that I would start my group previews.  Today, I’ll give a brief preview of Groups A and B, and future posts will preview the rest of the groups.

Group A: As the host country, Brasil was placed in Group A, and they received a pretty favorable draw.  Without a doubt, the host nation is the class of the group and I would be shocked if they don’t win all three of their group games.  Luiz Felipe Scolari’s greatest challenge will be keeping a very talented squad loose and ensuring that the pressure does not derail Neymar and Company.

After a bizarrely sluggish final qualifying phase, Miguel Herrera appears to have Mexico going in the right direction.  Croatia have a strong squad, but I think that the one-match suspension to Mario Mandzukic and the ten-game suspension (currently being appealed) to Josip Simunic may be just a little too much for them to overcome.  Cameroon will struggle in this group because of their lack of quality goal scorers beyond Samuel Eto’o.

Key Match: Mexico v. Croatia, June 23 (4:00 pm EDT).  The final group match for both teams will likely decide which team joins Brasil in the knock-out rounds.

Projected Finish: (1) Brasil; (2) Mexico; (3) Croatia; and (4) Cameroon.

 

Group B: The first of the three “Groups of Death” features both finalists from South Africa (Spain and the Netherlands), Chile, and Australia.  Let’s dispense with the obvious, Australia will struggle to get even a point out of this group.  Even though they are a bit more vulnerable than back in 2010, I still think that Spain is the favorite to top this group.  There is just too much depth and familiarity amongst the players for Spain to not have a positive showing at this tournament.

On paper, the Netherlands has more attacking options and more solid core in the midfield than Chile, but they may have the same problems that plagued them in Euro 2012 – a lack of chemistry amongst their younger players.  As Alexis Sanchez goes, so will Chile.  If he is on, they will be a threat to make a run in this tournament.  While Chile caught fire at the end of qualifying, their occasional defensive lapses may end up costing them against the deadly attacking options possessed by Spain and the Netherlands.

Key Matches: Spain v. the Netherlands, June 13 (3:00 pm EDT); and Chile v. the Netherlands, June 23 (12:00 pm EDT)

Projected Finish: (1) Spain; (2) the Netherlands; (3) Chile; and (4) Australia

NCUA Report: Protecting Members from Holiday Fraudsters; NAFCU's 2014 Technology and Security Conference

Written by Bernadette Clair, Regulatory Compliance Counsel

Recently, my colleague Tessema Tefferi blogged about the importance of cybersecurity awareness, providing links to many useful resources credit unions can use to manage cybersecurity risks. Although credit unions’ websites and computer systems are the main target of attacks such as Distributed Denial-of-Service (DDoS) attacks, it’s important to remember that fraudsters often target members directly, attempting to steal personal information through identity theft scams, social engineering, and computer malware, to name just a few methods. Educating members about information security and how they can protect their personal information is one tool credit unions can use to help mitigate some of the cybersecurity risks.

Along these lines, NCUA’s October 2013 Report that we blogged about last week, includes an article on Protecting Members from Holiday Fraudsters, just in time for the start of the holiday shopping season. The article encourages credit unions to educate members about how they can protect themselves against fraud, and provides strategies members can use to detect and avoid falling victim to fraud and identity theft. From the article:

“Review Credit Reports at Least Once a Year. This will help your members ensure fraudulent accounts have not been opened using their personal information. Additionally, the Fair Credit Reporting Act entitles consumers to a free credit report once a year from each of the three nationwide credit reporting agencies. Members can receive their report by contacting the credit reporting agencies directly or by visiting www.annualcreditreport.com.

Monitor Financial Statements and Online Banking Regularly. Members should get into the routine of checking their statements and periodically reviewing their account transactions and online activities. This will help members identify unauthorized account activities early, preventing potential losses to their personal accounts and negative impact to your credit union’s reputation.

Ensure Children Understand What Information to Provide Online. Fraudsters will often use a game or a free offer that will request personal information, or will include spyware to track and steal information from a member’s computer or mobile device. Members can protect themselves by encouraging their children to limit online contact to friends they actually know, setting privacy controls to restrict access to private information, and enabling parental controls that allow access to only trusted sites. Members should also talk to their children about not giving out their name, address, date of birth, or any other personal information online without talking to a parent first.

Beware of Downloading Sneaky Apps. Smartphone or social networking applications may provide application developers with access to your members’ personal information, such as their messages, contacts, emails and photos. Often, this information isn’t related to the application’s purpose. Instead developers may share member’s information with marketers or other third parties. Members should read the privacy policy of each application before downloading to understand what private information they are sharing.

Shred Documents with Personal and Financial Information. Financial statements, credit card offers and billing statements are examples of documents members should be shredding. Consider hosting a shred day at your credit union so members can safely discard their personal and financial records.

Look Out for Scams Involving Social Engineering. Fraudsters may impersonate a credit union (or other legitimate organizations) to trick members into giving out personal account information. This social engineering tactic is often utilized as part of an elaborate scheme involving phone calls, emails, text messages and other forms of communication. Remind members to never reply to unsolicited telephone, email, text or pop-up messages asking for personal account information. Members should understand legitimate organizations never ask for sensitive information over unsecured communication channels. Also, educate members on what policies and procedures your credit union follows when requesting sensitive information.”

****

NAFCU's 2014 Technology and Security Conference. Speaking of cybersecurity, NAFCU’s 2014 Technology and Security Conference, which will be held February 11-13 in Las Vegas, is a great place to discover the latest credit union security and technology trends. Conference topics include fraud trends, core processing issues, big data and credit union crisis management. Registration discounts are in effect until Nov. 15th. Check out more information about the conference and register here.

Cybersecurity: An Essential Function

Written by Tessema Tefferi, Senior Regulatory Affairs Counsel

The headline-grabbing news yesterday, and rightfully so, was that the Federal government is shut down.  However, the Administration and many in Congress have been clear that essential personnel will continue to work and the government’s essential functions will not be discontinued or disrupted.  Thankfully, one of these essential functions is to defend against cyber-attacks!  And thank goodness the government has determined that this function is essential.

Credit unions should also consider cybersecurity as an essential function, if they have not already done so. Whether the threat emanates from any or all corners of the world, in a credit union’s own operating system (for lack of adequate safety guards), or a garage or basement in any of our towns, it is no longer a threat that can be taken lightly.

Credit unions have heard for years about the ongoing cybersecurity threat.  Many have implemented sophisticated and effective safeguards and offer members tips to minimize risk against being hacked, but with October being Cybersecurity Awareness Month, I thought it would be good to point to some helpful resources that might help your credit union bolster the measures it has already taken (note: some of the government websites are ironically not functional during the shutdown!).   

• Internet Crime Complaint Center (IC3)
• FS-ISAC
• FTC - Privacy and Security
• National Cyber Security Alliance Stay Safe Online
• OnGuardOnline.gov
• U.S. Computer Emergency Readiness Team
• Stay Safe Online
• STOP.THINK. CONNECT.™
• Small Biz Cyber Planner (FCC)
• 10 Cybersecurity Strategies for Small Business tip sheet (FCC)

NCUA’s cybersecurity guidance, 13-Risk-01, is also helpful and lists a number of mitigation practices that credit unions should implement, including:

• Maintaining strong information security awareness programs for employees and members.
• Utilizing transaction monitoring, verification procedures, and appropriate limits commensurate with the risk of applicable funds transfers.
• Implementing strong controls over computers used to process commercial payments, including but not limited to:
  • Multifactor authentication.
  • Removal of hardware tokens upon session completion.
  • Prohibited or highly filtered use of Internet browsing.
  • Dedicated, corporate-owned systems without administrator privileges.
• Following network and application security best practices with regard to configuring systems, patch management, and security testing.

NAFCU's 2014 Technology and Security Conference. NAFCU’s work to provide you with pertinent information on cybersecurity is ongoing, but I’d be remiss to not remind you that NAFCU’s 2014 Technology and Security Conference will be heavy on cybersecurity.  Check out more information about the conference and how to register here.

Have a great day!  

NCUA to Cease Paper Mailings - Sign-Up for NCUA Express; Google Reader Ending Service on July 1st

Written by Steve Van Beek

Last week Bernadette highlighted the May 2013 NCUA Report. On the very last page was this notice:

"NCUA will stop mailing Letters to Credit Unions and other regulatory alerts as part of its ongoing efforts to reduce operating costs and become more efficient.

NCUA CU Express recipients automatically get the latest regulatory guidance and letters. All credit unions CEOs and Board Chairmen with emails provided in the CU Profile system are automatically subscribed to NCUA CU Express, and should currently be getting all regulatory letters or alerts.

NCUA CU Express emails are mandatory for credit union CEOs and Board Chairmen, while the separate, but similar NCUA Express is open to the public and subscriber-driven. In addition to regulatory alerts, you can sign up and receive NCUA’s monthly newsletter, The NCUA Report, legal opinions, press releases and more, using the NCUA Express system.

For more information about NCUA Express and to subscribe, free of charge, visit http://go.usa.gov/TDsC."

If you haven't already, consider signing up for the NCUA Express. At a minimum, be sure to pass this along to your colleagues in case they rely on the paper mailings. And, while you are at it - make sure your CEO and Board Chairmen's emails are current so they are getting all the information from the NCUA CU Express.

***

Google Reader. Many blog readers use an RSS aggregator such as Google Reader. On July 1st, Google will no longer be supporting Google Reader - so it makes sense to begin the migration to a new RSS aggregator soon. Personally, I've switched over to Feedly (and since wondered multiple times why I didn't earlier). And, best of all - you can connect your existing feeds from Google Reader over to Feedly. Of course, there are additional alternatives as well. 

If you're wondering what RSS is, Wikipedia has some good information. In short, RSS feeds (and an RSS aggregator) allow you to receive updates to a particular blog (or other website) when they occur. If your email inbox is overflowing with blog posts and other resources, having an RSS aggregator can help you stay on top of the news you need without it cluttering up your inbox.  

***

Asheville, North Carolina. Last week, Erin and I had the chance to head down to Asheville for NAFCU's Board of Directors Conference. Asheville is a special city for us as we got engaged there over Labor Day weekend in 2010.

Biltmore Gardens

Chimney Rock State Park, Chimney Rock, NC. And, that is Lake Lure in the background. Erin informed me numerous times (plus or minus 20) that Lake Lure was where "Dirty Dancing" was filmed.

Cyber Threats; SCRA; Fannie Mae Resources; Economic Update; Mortgage Servicing Transfers

Written by Steve Van Beek

Below are couple of tidbits for your Tuesday.

***

NCUA Risk Alert on Cyber Threats.  NCUA issued Risk Alert 13-Risk-01 on steps credit unions should take to protect against Distributed Denial-of-Services (DDoS) attacks.  In recent months, these attacks have ticked up at financial institutions – including credit unions.  Be sure to pass this Risk Alert along to those in charge of risk management and information technology at your credit union.    

***

CFPB “Hit or Myth” on SCRA.  The CFPB had a recent blog post on various confusing issues related to servicemember protections under SCRA.  These “Hit or Myth” questions and answers might be useful for internal SCRA training.  For more CFPB information on servicemembers, check out this page.    

*** 

Fannie Mae Loan Quality Resources. If your credit union sells loans to Fannie Mae, be sure to check out their new resources regarding Loan Quality.  The webpage includes resource guides as well as free webinars to help understand Fannie Mae’s procedures.  Be sure to pass along the resource page to others at your credit union. 

***

NCUA’s February Economic Video.  NCUA’s latest economic video is now available for viewing on YouTube.  Each month, NCUA’s Chief Economist John Worth provides an overview of the economic market and how it impacts credit unions.  These are great videos to include in strategic planning or board sessions as NCUA comes directly to you – via YouTube – each month with an economic update.  

***

CFPB Bulletin on Mortgage Servicing Transfers.  In addition to changing nearly all the mortgage servicing requirements in January, the CFPB has mortgage servicing transfers in their crosshairs.  In mid-February, the CFPB announced their intent to “closely monitor transfer activity” by mortgage servicers.  In conjunction with the announcement, the CFPB issued Bulletin 2013-1 which provides specific information regarding the CFPB’s detailed focus on mortgage servicing transfers.  

New NAFCU Blog, Same Approach

Written by Anthony Demangone 

When my father dropped me off at McKean Hall for my freshman year at Penn State, I knew I wanted to be a journalist.  I quickly joined the college newspaper and started writing.  I never found stories about intrigue and politics interesting to write.  Rather, I focused on things that interested me.  

I somehow got sidetracked on my road to the Pulitzer Prize. Life happens.  But my love of writing never wore off.  That’s one of the reasons I started the NAFCU Compliance Blog back in 2007.  

But life happened…again.   When I took on the role of NAFCU COO, I handed off this blog to Steve’s capable hands.  

Well, the addiction has overtaken me yet again.  As Steve mentioned a few weeks ago, I’ve started a new blog – Musings from the CU Suite.  What’s the new angle?  Work and management are tough.  But there’s a ton of good information out there about how to be better at both.  My new blog will attempt to bring the best of all of that to you.  

I hope you consider wandering over to sign up for the blog.  It would be great to have you join the conversation.

Now, I did write along those lines a wee bit back in the day.  Here are some of those old posts, which I hope you find useful.  

• Just how did my view of compliance change now that I’m NAFCU’s COO?
• A good compliance officer should try to read the tea leaves.
• In an age of Google, Facebook, Twitter, and iPads, don’t forget the research power of picking up the phone. 
• The art of making decisions when you are “off the grid.”
• My ode to compliance officers.  

Have a great week, guys.  

This and That: CIiCU; SCRA; NAFCU Comment Letters & Finals

Written by Steve Van Beek

The latest Current Issues in Credit Unions podcast is now available.  Rob Rutkowski does a great job with these monthly podcasts and both he and Katherine Weber will be down at NAFCU's Regulatory Compliance Seminar in late October to do a live taping of the podcast.  

Speaking of Seminar........the agenda for this year's Seminar is now out - take a look for yourself.  We also have time set aside for "Compliance Hot Topics" as we all know there is a good chance for some regulatory shenanigans between now and October.  During those sessions Sarah and I will cover some of the latest rules and guidance issued.

Also, keep in mind that anyone can attend: NAFCU member; non-member; attorney; consultant; vendor - you name it - we'd love to see you in Florida.  Diversity of background and viewpoints are terrific things.   

***

A couple months back, Buckley Sandler delivered a webinar on SCRA issues.  The webinar and slides are here and might prove useful to review SCRA issues at your credit union in anticipation of increased scrutiny.

***

NAFCU has sent a couple of comment letters to NCUA recently.  One was our comment letter on Incentive-Based Compensation and the other our comment letter on NCUA's Proposed Voluntary Prepayment plan.

Our Regulatory Affairs team was also busy publishing Final Regulations on the Noninterest-bearing Transaction Account rule and the NCUA's Accuracy in Advertising rule.  NAFCU Members can access those Finals and others here.  

FTC Strikes Again

Posted by Steve Van Beek

Yesterday, the Federal Trade Commission (FTC) announced a settlement with Sony BMG Music Entertainment for violations of the Child Online Privacy Protection Act (COPPA).  Sony BMG agreed to pay $1 million to settle the alleged violations which is the largest penalty in a COPPA case.  Here is some information on the alleged deficiencies in Sony BMG's website maintenance:

"The company operates over 1,000 Web sites for its musical artists and labels. Sony Music requires users to submit a broad range of personal information, together with date of birth, in order to register for these sites. On 196 of these sites, Sony Music knowingly collected personal information from at least 30,000 underage children without first obtaining their parents’ consent, in violation of COPPA. Many of these sites also enable children to create personal fan pages, review artists’ albums, upload photos or videos, post comments on message boards and in online forums, and engage in private messaging. In this way, children were able to interact with Sony Music fans of all ages, including adults."

But, here might be the clincher - they did not follow their own privacy policy:

"The FTC’s complaint also charges Sony Music with violating Section 5 of the Federal Trade Commission Act by falsely stating in its privacy policy that users who indicate that they are under 13 on its Web site registration pages will be restricted from participating in Sony Music’s web page activities. In fact, Sony Music accepted registrations from children who entered a date of birth indicating that they were under 13."

Here is a link to a May blog posting by Anthony that discusses COPPA and contains links to FTC and NCUA guidance regarding COPPA compliance. 

Have a safe, warm weekend. 

NCUA Moving to Online 5300 Call Reports in Late 2009

On Tuesday, NCUA posted frequently asked questions (FAQs) related to their future shift to online 5300 Call Reports.  The switch to online reporting is scheduled for late 2009 (natural person credit unions) and 2010 (corporate credit unions).

The first five Q&As provide the basic details (there are 22 total Q&As):

"1. What changes are being made?
NCUA is developing an online (web-based) environment for federally insured
credit unions to self-manage profile information, submit data, and receive
information from NCUA.

2. When do these changes take effect?
The new online profile and Call Report will be deployed in late 2009 for natural
person credit unions and 2010 for corporate credit unions.

3. What is the “online profile”?
The online profile will include information that NCUA maintains about a credit
union that infrequently changes. For example, the credit union address(es), phone
number(s), list of officials, hours of operation, etc. Credit unions will be able to
change certain fields online to provide a real-time environment for updating
contact information.

4. Will I be required to use the online system?
Yes. All federally insured credit unions with access to the Internet will be
required to submit their data online. Hardship provisions will be made for
computer disruptions during the upload period.

5. I am a manual credit union. How does this affect me?
Policies will be established addressing manual credit unions and submission of
their data. NCUA will release more information on this topic at a later date."

Additionally, the Report of Officials (ROO) will be moving online as well.  View the FAQs to get answers to your questions and look for more info from NCUA as the shift gets closer.

***

The Compliance Guy will make his long-awaited return on Tuesday.  Thanks for being kind to Sarah and me.

Enjoy the first weekend of college football.  Have a safe, relaxing holiday weekend.      

VISA Pilot Program to Provide Alerts to Wireless Devices

I must admit, I'm one of those people.  You know - the ones who are constantly checking their account balances and transactions online.  What can I say, I like confirming that my automatic payments have been processed and my credit card transactions are correct.

Needless to say, I was pretty stoked to read this NAFCU Today article highlighting the new pilot program being tested by VISA.  The program will use text messages and emails to alert cardholders of activity on their accounts. 

Here is more information from the VISA press release:

"Based on Visa's state-of-the-art transaction authorization system, and its ability to analyze and conduct risk score transactions "in-flight," the service allows Visa cardholders to set thresholds that will trigger a transaction alert. Alert types that Visa cardholders may choose in the pilot include:

    * cash withdrawal from an ATM machine;
    * a transaction initiated cross border;
    * an Internet or telephone transaction and
    * a transaction that exceeds an amount that has been chosen by the cardholder.

Through the alert received via email or SMS text, cardholders can verify the transaction details, and if the transaction appears to be irregular, can immediately contact their bank to help stop further transactions on the card. The service is designed to help cardholders keep closer track of their transactions and spending levels as they go about their daily routine."

Sign me up.  I would love the ability to set a dollar threshold above which I would receive a text message or email.  Imagine the reduction in fraud-related charges if your member was notified immediately of a transaction they did not authorize rather than reviewing (or not reviewing) their periodic statement.

***

Looking for growth in the Generation X & Y markets?  The VISA press release includes information from a Pew Research Center study:

"more than 80 percent of consumers between the ages of 18 and 49 use their mobile devices to engage in activities such as sending text messages, taking pictures and accessing the Internet."

This study was conducted by the Pew Internet & American Life Project at the Pew Research Center and the full 12-page report would be a great read for strategic planning and marketing purposes.