Source: https://nafcucomplianceblog.typepad.com/nafcu_weblog/fcra/
Timestamp: 2019-04-25 01:48:19+00:00

Document:
Last month, the CFPB fined JPMorgan Chase (JPMorgan) $4.6 million for various alleged violations of the FCRA. According to the consent order, the CFPB found that JPMorgan failed to have reasonable policies and procedures in place to ensure it provided accurate information to consumer reporting agencies, failed to inform consumers of the results of dispute investigations and failed to identify the consumer reporting agency on adverse action notices.
Policies and Procedures. The FCRA does not require financial institutions to provide information to consumer reporting agencies. However, if a financial institution elects to do so, the FCRA requires it to provide accurate information. Regulation V requires these financial institutions to have reasonable policies and procedures in place to ensure that information provided to consumer reporting agencies is accurate. The procedures should be designed based on the institution's complexity and scope of activities and updated periodically. The rule also requires institutions to consider the interagency guidelines in developing their policies.
While JP Morgan had policies in place, the CFPB found that these policies were insufficient to ensure it provided accurate information to consumer reporting agencies. The policies did not contain procedures for providing information to consumer reporting agencies and did not address quality assurance, systems testing or training. The policies were also not materially altered or revised anytime between 2005 and 2014. In addition to these specific deficiencies, the CFPB determined that the policies were not appropriate given the size and complexity of JPMorgan's operations. The consent order requires JPMorgan to implement and maintain reasonable policies and procedures that fully comply with the FCRA's requirements and adequately incorporate Regulation V's guidance.
"(f) The term “consumer reporting agency” means any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports."
While this certainly covers the big three credit reporting agencies – Transunion, Equifax and Experian – it is important to keep in mind that this also covers a variety of other agencies that may be collecting information other than credit information. Consumer reporting agencies also include "specialty" agencies that collection information regarding medical records or payments, residential history, check writing history, employment history and insurance claims. When reviewing or drafting your policies and procedures on providing information to consumer reporting agencies, remember they may need to cover more than just credit information.
Dispute Investigations. Both the FCRA and Regulation V have specific procedures financial institutions must follow when they receive a direct dispute from consumers regarding the accuracy of information contained in a consumer report. The rules require institutions to conduct a reasonable investigation within 30 days of receiving the dispute, inform the consumer of the results of the investigation and provide each consumer reporting agency with corrected information, if necessary. The CFPB determined that JPMorgan had received thousands of direct disputes between 2010 and 2014 and that JPMorgan failed to provide any notice to these consumers regarding the results of the investigation. Going forward, the consent order requires JPMorgan to inform consumers about the results of all dispute investigations.
Adverse Action Notices. If a financial institution bases any adverse action on information obtained in a credit report, the FCRA requires the institution to provide an adverse action notice. The notice must include the adverse action taken; the credit score disclosure; the name, address and telephone number of the consumer reporting agency that provided the consumer report; a statement that the consumer reporting agency did not make the adverse action decision and inform the consumer of his or her right to obtain a copy of the consumer report. The CFPB found that JPMorgan failed to include the name, address and telephone number of the consumer reporting agency on approximately 17,500 adverse action notices. The notices were later corrected, however, the consent order requires JPMorgan to provide this information on all future adverse action notices.
Hello, compliance compadres! As you are well aware, the Fair Credit Reporting Act (FCRA) and its requirements govern the furnishing of information to the credit reporting agencies ("CRAs"). The FCRA subjects data furnishers to various duties, such as, but not limited to the following: the duty to provide accurate information; the duty to provide notice of dispute; the duty to provide notice of delinquency of accounts and the duty to provide notice of negative information to members. See, 15 U.S.C. § 1681s-2(a).
Recently, I have spoken to a few members about pending changes at the big three credit reporting agencies (Transunion, Equifax, and Experian) that are aimed at improving the accuracy of consumer credit reports and better enabling consumers to dispute and correct incorrect credit information. The changes are a result of increased regulatory supervision and a 2015 consumer protection settlement with state attorneys general. Today, I will provide you with some insight into the regulatory and litigation background that and what that may mean for credit unions.
The CFPB has reported that consumers continue to complain about the credit reporting industry in high numbers. The Bureau reports handling approximately 185,700 credit reporting complaints as of February 1, 2017.
Fixing data accuracy at consumer reporting companies: Previously, examiners found more than one of the CRAs lacked good quality control to check the accuracy of their consumer records. Consequently, the CRAs have instituted quality control programs to identify whether reports are produced for the wrong consumer and whether reports contain mixed-up files. The CRAs are also taking better corrective actions when mistakes are identified.
Repairing broken dispute processes at consumer reporting companies: CFPB examiners discovered more than one CRA was not following the federal regulatory requirement that consumers receive notice of dispute results. Examiners also found that the companies were failing to consider documentation provided by consumers on disputed items. As a result, the CRAs have improved processes for investigating disputes and are improving response letters to consumers.
Cleaning up information from furnishers: Through reviewing information from banks and nonbanks, CFPB examiners also noticed widespread problems with furnishers supplying incorrect information, mishandling disputes, and not completing investigations. As a result, data furnishers are now better handling investigations of disputes, notifying consumers of results, and taking corrective action when inaccurate information has been supplied.
From a litigation perspective, in 2015, the CRAs reached a consumer protection settlement with the New York Attorney General's Office concerning, among other things, the accuracy of consumer credit information maintained by the CRAs; the CRAs’ practices regarding investigation of consumer disputes of alleged inaccuracies in credit reports; and the reporting of medical debt. Thirty-one other states followed suit. As a result of the 2015 settlement, CRAs are required to remove several types of data sets that report to personal credit. These are the pending changes that we are now seeing coming into effect. For example, non-loan related items such as gym memberships in default, library fines, and unpaid traffic tickets will no longer be reported. According to the terms of the settlement made in 2015, Equifax, Transunion and Experian are required to complete these additional changes 3 years and 90 days from the date of the settlement.
Medical debts willnot be reported until after 180-day "waiting period" to allow insurance payments to be applied. The CRAs will also remove from credit reports previously reported medical collections that have been or are being paid by insurance.
Consistent standards will be reinforced by the CRAs to lenders and others that submit data for inclusion in a credit report (data furnishers).
Data furnishers will be required to report a delete for accounts that are being paid or were paid in full through medical insurance.
A multi-company working group of the nationwide consumer credit reporting companies has been formed to regularly review and help ensure constancy and uniformity in the data submitted by data furnishers for inclusion in a consumer's credit report.
A few members have expressed concern about the potential rise in FICO scores as a result of the forthcoming changes. Credit unions may want to temper their actions until the impact of the changes become more tangible. Since these changes are uniform, credit unions may notice a wide-spread rise in FICO scores, which may lead to natural adjustments in their risk based pricing.
Credit unions may also want to remember that the FICO score is only one of the factors used when determined whether a member qualifies for a product. There are other vital factors that will not be impacted by the CRA changes including, but not limited to the following: annual income; employment history; and debt to income ratio.
Generally, credit unions may want to continue to monitor their credit portfolios as usual for safety and soundness. If the credit union notices negative trends developing, then it should begin to make adjustments.
In the meantime, credit unions may want to revisit their lending policies, consult with their compliance officers, and contact their CRA representative to discuss the pending changes and their potential impact.
Good morning Credit Union Compliance World.
When a member (or potential member) applies for a loan, it is not uncommon for the applicant to request a copy of the credit report that was pulled in connection with the application. From the member's perspective, it's something they've paid for - either literally, or because the credit inquiry will hit their credit report and possibly harm their scores.
Whether the credit union can provide that report is a common question, and you may not be surprised that neither the FCRA nor Regulation V provides clear answers.
The FCRA does not prohibit a consumer report user from providing a copy of the report, or otherwise disclosing it or any item or items of information in it (or any score based on the information), to the consumer who is the subject of the report.106 See also section 607(c)." 40 Years guidance, p. 42 (citing FTC interpretations at 16 C.F.R. Part 600, App., Section 604―General, comment 3 (2005)).
While the FTC interpretations indicated that the FCRA does not prohibit the credit union from providing a copy of the report, it also does not require it. While this guidance is non-binding on the CFPB, in the absence of clarification by the Bureau, it is instructive.
(c) Disclosure of consumer reports by users allowed. A consumer reporting agency may not prohibit a user of a consumer report furnished by the agency on a consumer from disclosing the contents of the report to the consumer, if adverse action against the consumer has been taken by the user based in whole or in part on the report." FCRA, § 607(c).
While a copy of the report must be provided in connection adverse actions regarding employment, that is not true for adverse credit decisions. See, FCRA, § 615(a).
So, a CRA can't prohibit the credit union from disclosing the contents of the report with the applicant where they were denied. But, the FCRA does not state what "disclosing the contents" means or whether the CRAs can prohibit sharing a report with approved applicants. While the FTC's guidance states that credit unions are not prohibited from providing a copy of the report to applicants or disclosing the contents to approved applicants, the FCRA itself seems to leave the door open for the CRAs to set boundaries on these kinds of sharing contractually.
There is no limitation in the FCRA on the CRAs' ability to contractually prohibit a credit union from sharing a credit report with approved applicants. Further, as the FCRA did not specify what "disclosing the contents of a report," means, it's possible that a CRA may define how the credit union may disclose the contents in its agreements, such as allowing the consumer to view but not receive a copy of the report. Credit unions considering sharing reports with applicants should consult their agreements with their CRAs to determine whether it is prohibited from sharing reports with approved applicants, and if the method of disclosing the contents of the report is specified by agreement.
The credit union might also consider whether it is sure that the applicant is who they say they are, especially if an application was made over the phone or the internet. Providing a credit report without seeing an applicant in-person creates a risk of releasing a credit report to an applicant who is pretending to be someone else. Without confirming the applicant's identity, the credit union could expose itself to liability concerning the privacy of and harm to the person whose identity is being stolen and misused. What information or procedures are necessary for the credit union to feel comfortable releasing the credit report is a risk-based issue for the credit union to determine.
Further, a credit union might consider any possible liability that arises if the member accepts a copy of the report and then loses it. If the report, with the credit union's subscriber code, is used to steal the identity of the member, a question could arise as to whether it got to the fraudster through the credit union or through the member's own negligence. Some financial institutions have suggested redacting sensitive information like social security numbers and the subscriber code before letting the report leave the building for this reason.
Sections 609 and 610 of the FCRA explicitly require that the CRAs provide free credit reports to consumers, along with certain disclosures regarding their rights and the proper procedures for disputing information in their credit reports. The disclosures and reports are specifically formatted to be easier for consumers to understand and act on. Many credit unions to try steer members requesting a copy of their report to these free reports as they are intended for consumer use and better accomplish the policy goals of the FCRA.
The Fair Credit Reporting Act and its requirements relating to reporting to credit reporting agencies seem to be of concern and interest to many of our members. So, we thought we’d offer a primer to assist with compliance in this area.
*Safe harbor alert (YES!): The FCRA provides a safe harbor if the credit union clearly and conspicuously specifies an address where members can send disputes concerning the accuracy of information about them. See, §623(a)(1)(C).
Additionally, if the credit union determines that the information it has furnished is not complete or accurate, the FCRA requires it to promptly notify the CRA of the determination and provide updated correct information. See, §623(a)(2).
The Duty to Provide Notice of Dispute. If the information that is being furnished to a CRA is being disputed by the member, the credit union may not provide that information to the CRA without a notice that the information is being disputed. See, §623(a)(3).
The Duty to Provide Notice of Delinquency of Accounts. A credit union that furnishes information to a CRA about a delinquent account being placed for collection or charged to profit or loss, is required to notify the CRA of the date of the delinquency no later than 90 days after furnishing the information. The date of delinquency is the month and year the first payment was missed. See, §623(a)(5).
The Duty to Provide Notice of Negative Information to Member. The FCRA requires that a notice of negative information be provided to a member when a credit union furnishes negative information to a CRA regarding the extension of credit to a member. See, §623(a)(7). “Negative information” means information relating to a member’s delinquencies, late payments, insolvency, or any form of default. See, §623(a)(7)(G)(i). The FCRA requires the credit union to provide the notice either: (i) before furnishing the negative information to the CRA; or (ii) 30 days after furnishing the information. The notice may be included on or with other disclosures such as a notice of default, a billing statement, or any other materials provided to the member, and must be clear and conspicuous. Notwithstanding the general ability to provide the notice with other disclosures, if the credit union opts to provide the notice before it furnishes the information to a CRA, it may not include the notice with the initial disclosures provided under TILA AND Regulation Z. See, §623(a)(7)(B). Regulation V contains a model notice.
The Duty to Investigate and Report after Receiving Notice of Dispute from a Member. The FCRA provides that a credit union must take certain actions after receiving a notice of dispute from a member, including the duty to: (i) investigate the disputed information; (ii) review all relevant information provided by the member in the notice of dispute; (iii) timely complete the investigation and report the results to the member; and (iv) if it is determined that the information was inaccurate, promptly notify each CRA the information was furnished to and provide any corrections to make the information accurate. See, §623(a)(8)(E). Section 1022.43 of the regulation sets forth the types of disputes that are subject to the duty to investigate, as well as the exceptions.
The Duty to Investigate and Report after Receiving Notice of Dispute from a CRA. Sometimes members send a notice of dispute the CRA(s). If this happens, the FCRA requires the CRA to promptly notify the credit union. Once the credit union receives the notice of dispute from a CRA, it is required under the FCRA to: (i) investigate the disputed information; (ii) review all relevant information provided by the CRA; (iii) report the results to the CRA; and (iv) if it is determined that the information was inaccurate, report those results to all other CRAs the information was furnished to; and if the disputed information is found to be inaccurate or incomplete, promptly modify the information, delete the information, or block the reporting of that information. The duty to investigate in this instance is triggered once the notice is received from a CRA. See, §623(b)(1)(E).
Duty to Establish and Implement Reasonable Policies to Ensure the Accuracy and Integrity of the Information Furnished. Under the FCRA and Regulation V, a credit union that reports information to a consumer reporting agency is required to have policies and procedures in place to ensure the accuracy and integrity of the information furnished. See, 12 C.F.R. §1022.42. The policies and procedures should be designed to promote certain objectives, as spelled out in Appendix E, such as: (i) to furnish information about accounts or other relationships with a member that is accurate; (ii) to conduct investigations of member disputes and take appropriate actions based on the results of the investigations; and (iii) to update the information it furnishes when necessary, to reflect the current status of the member account or other relationship, including a transfer of an account by sale or assignment for collection to a third party. See, 12 C.F.R. Part 1022, App. E.
This is not an exhaustive list, please refer to §623 of the FCRA for a comprehensive list of duties imposed on credit unions that decide to furnish information to a CRA.
It makes sense that credit unions want to ensure compliance here. The CFPB has stated that it “will continue to monitor furnishers’ compliance with the FCRA regarding consumer disputes of information they have furnished to CRAs. Furnishers should take immediate steps to ensure they are fulfilling their obligations under the law.” CFPB Bulletin 2014-01.
If you have any questions relating to this article or any other FCRA issues, please contact NAFCU’s regulatory compliance team. We’re here for you!
Last week I wrote about permissible purposes under the Fair Credit Reporting Act (FCRA), and generally stated that a credit union may not use a consumer report obtained with a permissible purpose to later cross-sell other products or services…absent a separate permissible purpose. Since then, I have received a lot of feedback and thought it may be necessary to clarify a few points.
Point #1: Section 604 of the FCRA provides the permissible purposes for which a consumer report may be obtained and used. Cross-selling, by itself, is not listed as a permissible purpose under the FCRA.
Point #2: One key permissible purpose under section 604(a)(2) of the FCRA is where the credit union acts “in accordance with the written instructions of the consumer to whom [the consumer report] relates…” under section 604(a)(2). This allows credit unions that obtain written authorization from the member to use the report which could include cross-selling activities.
Point #3: When obtaining a consumer report, the FCRA generally requires credit unions to certify the purposes for which the information is sought, and “certify that the information will be used for no other purpose.” See, 15 U.S.C. §1681e(a).
Point #4: While authority to regulate the FCRA has been transferred from the FTC to the CFPB, and previous FTC guidance can be useful, it is important to note that the FTC formally rescinded all of its FCRA guidance. Absent any new guidance from the CFPB, credit unions often continue to refer to FTC advisory letters, including the “Gowen Letter,” and other guidance such as “40 Years of Experience with the Fair Credit Reporting Act.” However it is important to keep in mind that this information, while helpful, is not binding.
Points #1 and #2 generate a lot of discussion. The FCRA generally requires credit unions to have a “permissible purpose” in order to access a consumer report. The definition of permissible purpose in the statute does not include things like cross-selling using a consumer report that the credit union previously obtained for a permissible purpose.
However, one permissible purpose is having the member’s written instructions, or authorization to access their consumer report. This means that the credit union may be able to obtain the member’s written authorization that grants the ability to cross-sell. For example, some credit unions obtain a separate written authorization from members specifically for cross-marketing activities. Other credit unions have built in some form of written authorization in their membership applications or loan applications. Others use a separate disclosure and authorization form that is maintained in the member’s file. Overall, many credit unions have worked with outside counsel to develop acceptable written authorizations that address cross-selling or other purposes. In any event, past FTC guidance, which again is not binding but informative, indicates that written authorization should be clear and have a certain degree of specificity. Credit unions considering adding such language to their agreements may need to consult with local counsel regarding the specific verbiage needed to be compliant.
Cross-selling products and services can mutually benefit members and the credit union. Indeed, credit unions pride themselves in their ability to offer members better terms and rates. A carefully constructed process for obtaining written authorizations can accomplish these goals while remaining within the parameters established by the FCRA.
As always, if you have any questions relating to this article or any other FCRA issues, please contact NAFCU’s regulatory compliance team. We’re here for you!
Lately, we have been receiving a good amount of questions relating to the Fair Credit Reporting Act (FCRA). Specifically, many of our compliance officers want to know whether a credit union may use a credit report, pulled with a permissible purpose, to subsequently cross-sell other products. The answer to this generally is a resounding NO!!!!
When there is a legitimate business need for the information in connection with a business transaction that is initiated by the consumer; or to review an account to determine if it still meets the terms.
In all pulls for consumer reports, the credit union must ensure that there is a permissible purpose. Moreover, for all pulls, credit unions must certify the purposes for which the information is sought, and certify that the information will be used for no other purpose. See, 15 U.S.C. §1681e(a).
Section 603(m) states that the term “credit or insurance transaction that is not initiated by the consumer” does not include the use of a consumer report by a person with whom the consumer has an account or insurance policy, for purposes of (1) reviewing the account or insurance policy; or (2) collecting the account.
Section 604(c) provides that, generally, it is not a permissible purpose to provide a consumer report in connection with “any credit or insurance transaction not initiated by the consumer” unless the consumer consents or the transaction consists of a firm offer of credit or insurance. However, an existing creditor’s use of consumer reports for review or collection of its accounts does not fall within the definition of “credit or insurance transaction that is not initiated by the consumer.” Rather, an existing creditor may obtain consumer reports for review or collection of its accounts under section 604(a)(3)(A), but its use of those reports is limited to that purpose. Accordingly, a CRA may provide reports to creditors to review or collect existing credit accounts, but not to market other products or services. See comment 604(a)(3)(A)-4A.
5. Marketing purposes. This section does not allow a CRA to provide a creditor with consumer reports to “review” accounts in order to market its other products or services. See also comments 603(m)-1 and 604(a)(3)(F)-6.
“Prescreening” is the common term for the process by which creditors and insurers use consumer report information to identify consumers to receive firm offers. Prescreening is the only circumstance in which consumer report information may be used for marketing purposes, and one of the few circumstances in which consumer report information may be provided in the absence of a consumer-initiated transaction. A CRA either edits a list of consumers developed by the requesting creditor or insurer (or its agents) or independently creates a list of consumers according to the requesting entity’s specifications.
The prescreening and firm offers provisions are addressed in section 604(c) of the FCRA. Section 604(c) allows the credit union to prescreen members for credit transactions not initiated by the member. Generally, the credit union sends its criteria to the credit bureau and the credit bureau then determines which members meet the criteria. Members meeting the criteria are sent the prescreened offer, provided that the member has not opted out of prescreening and the member is not under 21 (unless that member has opted in). See, 15 U.S.C. §1681b(c). Note, that a firm offer of credit must be provided to members meeting the criteria. See, 15 U.S.C. §1681b(c). The prescreen disclosure and opt-out requirements can be found in Regulation V, 12 CFR 1022.54.
A consumer’s written consent qualifies as an “instruction” that provides a permissible purpose under this section if it clearly authorizes the issuance of a consumer report on that consumer. For example, a consumer’s clear and specific written statement that “I authorize you to procure a consumer report on me” provides a permissible purpose under this section. However, the consumer’s signature on a form that includes the statement “I understand that where appropriate, credit bureau reports may be obtained” is not a sufficiently specific instruction from the consumer to authorize a CRA to provide a consumer report. This language is more in the nature of a notification that a consumer report might be procured, as opposed to a grant of permission to obtain the consumer report.
Moreover, the FTC has some advisory letters on the consent issue which credit unions may want to spend some time reviewing.
On February 3, the CFPB held a field hearing in Kentucky to discuss consumer access to checking accounts. This is an area of ongoing concern to the bureau, and those following this issue may recall that the CFPB held a previous hearing on this issue back in October, 2014.
As part of last week’s hearing, the CFPB issued Compliance Bulletin 2016-01 regarding the Fair Credit Reporting Act and implementing Regulation V’s provisions regarding the duties of furnishers of information with regard to credit reporting. As a reminder, these provisions apply to “any person that furnishes information to a consumer reporting agency [CRA],” and require credit unions to “establish and implement reasonable written policies and procedures regarding the accuracy and integrity” of the consumer information a credit union may provide to CRAs. While these rules are not highly prescriptive, Appendix E to Regulation V provides some basic guidelines regarding the accuracy and integrity of information provided to CRAs.
“Examiners found that one or more entities failed to establish and implement reasonable written policies and procedures regarding the accuracy and integrity of information furnished to CRAs, as required by Regulation V. Examiners found that while one or more entities had policies and procedures addressing accuracy and integrity with respect to their furnishing of information to CRAs on credit accounts, they failed to have policies and procedures addressing accuracy and integrity with respect to their furnishing information on deposit accounts. Regulation V requires that such policies and procedures be appropriate to the nature, size, complexity, and scope of each furnisher’s activities, and requires that furnishers consider Appendix E of Regulation V, the “Interagency Guidelines Concerning the Accuracy and Integrity of Information Furnished to Consumer Reporting Agencies,” and incorporate those guidelines as appropriate. In addition, examiners found that one or more entities failed to periodically review and update their policies and procedures, as required by Regulation V.
In other words, Regulation V does not only apply to consumer information that a credit union may provide in relation to lending products, but the kind of information share account information a credit union may provide to CRAs like Chexsystems. The regulation requires policies and procedures to address this kind of data in order to be sure the information is accurate and has integrity. Keep in mind that “accuracy” and “integrity” are both defined terms under Regulation V.
This bulletin summarizes similar issues, noting that Regulation V “applies to furnishing to all CRAs” and emphasizing that Regulation V requires furnishers to “periodically review and update its policies and procedures to ensure their continued effectiveness.” It may be worth reviewing although Regulation V and Appendix E provide more details.
Avoid the risk of being scrutinized by regulators; ensure you successfully comply with advertising requirements as put forth by the Truth in Savings disclosure. Join this webcast to better understand advertising regulations and why they’re important. Explore advertising trigger terms, APY disclosures, NCUA insurance adverting, courtesy pay programs and more essential topics. You’ll also learn to stay clear of compliance violations by receiving advertising compliance best practices.
On January 28, 2016, the CFPB released its Monthly Complaint Report for December 2015, which provides a high-level snapshot of trends in consumer complaints. It is important to keep in mind that credit unions under $10 billion are not included in the Consumer Complaint Database, which forms the basis of the monthly reports. Notwithstanding, the reports can be a useful tool, as they can help credit unions evaluate which products and services are more problematic and thus, should be addressed in order to avoid or mitigate regulatory risks.
For the 28th consecutive month, the CFPB handled more complaints about debt collection than any other type of complaint. Debt collection complaints represented about 31% of complaints in December 2015.
Debt collection, mortgage, and credit reporting complaints continue to be the top three most-complained-about consumer financial products and services, which together represented 68% of all complaints submitted in December 2015.
Equifax, Transunion, and Experian were the most-complained-about companies for August-October 2015.
As stated previously, credit unions under $10 billion are not included in the Consumer Complaint Database. Rather, the CFPB will forward any complaints from these credit unions to NCUA, and credit unions will need to follow NCUA's procedures for responding to member complaints.
MLA Database Update. As NAFCU reported earlier this week, DMDC agreed to extend the deadline to seek direct access to the MLA database until February 15, 2016. Those credit unions who express interest in the direct connect option will receive a questionnaire in a response email. DMDC set a February 19, 2016 deadline for interested credit unions to complete and return this questionnaire. If you have any questions about this deadline or the database, please email Brandy Bruyere, NAFCU’s Director of Regulatory Compliance, bbruyere@nafcu.org.
As a serious compliance professional, you either have, or are thinking about earning, your NAFCU Certified Compliance Officer (NCCO) designation. This challenging but comprehensive exam will prove that you have a solid understanding of the major regulations that govern credit union operations. Join this free webcast for an in depth look at how to best prepare for the NCCO exam and utilize the material. NAFCU’s very own Director of Regulatory Compliance and Director of Education will guide you through learning the best approach for earning this prestigious designation.
The Monthly Complaint Report for August indicated that the CFPB handled 26,700 complaints in the month of July, bringing the total number to approximately 677,200 as of August 1, 2015.
The good news is that complaints about bank accounts and services represent the greatest decrease in the report: complaints are down 2% from the previous month and 4% from the previous year. Complaints surrounding debt collection remain the highest in terms of volume, with the CFPB receiving 8,224 in the month of July. The second highest in terms of volume and the highest increase over the previous month was related to credit reporting. Credit reporting complaints increased 56% over the previous month and 45% over the previous year. 97% of these complaints were directed at one of the three major credit reporting agencies.
Company level data is reported on a three-month rolling basis, so the majority of data on any given report is largely repetitive of the data on the previous report. July’s report on complaint volume by company covered data from February – April of 2015, and August’s report covered data from March–May of 2015. Both reports named Equifax and Experian as the first and second most-complained-about-companies, respectively, and TransUnion as the fourth most-complained-about-company.
Between the high increase in complaints about credit reporting and the continued presence of the three major credit reporting agencies in the top four most-complained-about-companies, it is not surprising the CFPB made credit reporting the focus of the monthly report. The report stated that 77% of complaints to the CFPB regarding credit reporting involve incorrect information on reports, including the appearance of paid debts and debt belonging to other persons on consumers’ reports.
If you are the kind of person that reads about credit reporting complaints and immediately becomes nervous about whether your credit union is in compliance with Regulation V, now might be a good time to revisit Subpart E regarding the duties of furnishers of information and Appendix E containing the Interagency Guidelines Concerning the Accuracy and Integrity of Information Furnished to Consumer Reporting Agencies.
In April, this blog discussed concerns about releasing complaint narrative data without any kind of investigation, which raises safety and soundness concerns and unduly places financial institutions’ reputation at risk. Further, we have previously discussed the concern that disclosing narrative information could lead to the inadvertent release of personal information about consumers. In late July, the Office of the Inspector General evaluated the effectiveness of the information securities controls and techniques related to the Complaint Database and reported several control deficiencies. Recommendations were made to protect consumer information, and the OIG reported that the CFPB’s Chief Information Officer is working to implement those changes. A few weeks ago, the Office of the Inspector General released its ongoing Work Plan which announced its intentions to conduct an audit of the Complaint Database in the third quarter of 2015. The audit’s objective will be to assess the effectiveness of the CFPB’s controls over the accuracy and completeness of the public complaint database.
On a personal note, in addition to being new at NAFCU, I am new to DC. I only just moved from Portland, Maine to DC this summer with my husband and our two dogs: Boomer and Ollie.
Moving isn’t always easy for dogs, but our two boys do pretty well with travel.
Boomer (left) is a 6 year-old bichon frisé rescue from Missouri. Luckily for my husband and me, a good attitude comes with the breed. Ollie (right) is a 4 year-old rescue from Pennsylvania. We are not sure of his breed ― we suspect he is a combo of two adorable breeds but it is hard to say which ones. Ollie is a sweet boy who usually takes Boomer’s lead. I’ll let you all know how they get on in the big city.
CFPB Bulletin 2013-09. Earlier this month, the CFPB released CFPB Bulletin 2013-09 (Bulletin), putting on notice companies that supply information to consumer reporting companies. The Bulletin stresses that compliance with the Fair Credit Reporting Act (FCRA) requires furnishers of such information to investigate consumer disputes forwarded by the consumer reporting companies, and to review all relevant information provided with the disputes, including documents submitted by consumers.
Subject to its supervisory and enforcement authorities, the CFPB intends to evaluate compliance with the requirements set forth within the Bulletin and expects each furnisher, in summary, to comply with the FCRA by receiving information and investigating disputes, providing investigation results, and correcting inaccurate information.
For more details on what the CFPB expects, view the press release here and the Bulletin here.
NAFCU’s Online Training Updated. Are you looking for essential trainings for your Board and new employees? NAFCU’s recently updated Online Training program covers important education for board members and new staff, without requiring a travel budget. New and updated courses include Bank Secrecy Act, member data security, financial literacy and fiduciary duties, how credit unions are regulated and examined and more! For a full listing of training modules available under NAFCU’s Online Training program, visit here.
And wait! It gets even better! If your credit union is interested in NAFCU’s Unlimited Webcast Subscription and Online Training program, we now offer the Virtual Learning Package, combining both the Webcast Subscription and Online Training at a great savings! Credit unions that buy now will have access through the end of 2014!
Ballapalooza Fun. I was planning on sharing some of the pictures from Kyse and Ava’s first birthday party, but to my dismay, they either came out blurry or they were crying in them (teething)! On a good note, I have some great pictures of them playing with one of their birthday gifts – the Ballapalooza!
Quick Update - The deadline for NCUA's Loan Participation final rule has been extended to September 23, 2013. NAFCU's Compliance Calendar has already been updated to reflect the new date.
Why is this so important? As the article explains, “To ensure compliance, it is important to understand how the requirements of Regulation B [ECOA] and the FCRA relate to and differ from one another.” And that’s exactly what this article does: it explains that there are two laws that require adverse action notices; it reviews the adverse action requirements of both the ECOA and the FCRA; and it provides tables to further illustrate the requirements.
If your weekend hasn’t already started, have a great one! I’m not sure what my weekend will consist of yet, but one thing’s for sure: I can’t wait to spend it with these bundles of joy!
NCUA Economic Videos. NCUA recently released a couple of new videos, available on YouTube. The first video, NCUA Economic Update – June 2013 Part I, provides an update on the economy and includes a discussion on the housing market, labor market, consumer confidence statistics, and the recent rise in interest rates and potential challenges to credit unions.
The second video, NCUA Economic Update – June 2013 Part II, focuses on NCUA’s proposed derivatives rule. This proposed rule would provide qualified credit unions limited authority to engage in derivatives activities for purposes of mitigating interest rate risk, but would also establish a “pay to play” requirement. See our May 17th blog post for more details on the proposed rule.
Have a great 4th of July! We'll be back blogging on Friday.
Appendix N – Notice of User Responsibilities.
Of particular importance to credit unions is the “Summary of Your Rights Under the Fair Credit Reporting Act” form (Summary of Consumer Rights), which can be found in Appendix K of the final rule. Changes to this form included removing the reference to the Federal Trade Commission and replacing it with CFPB instead; updating the addresses for contacting the Assistant General Counsel for Aviation Enforcement and Proceedings and the Surface Transportation Board; and correction of typographical errors in the Spanish language translation at the top of Appendix K.
Credit unions that use credit reports as part of the hiring, promoting, or firing process (i.e., for an employment purpose) should be cognizant of these changes, as this form must go to employees, or applicants, after the credit union has acquired a consumer report, but before it has taken adverse action based on that report. Credit unions that use consumer reports for employment purposes should be aware of the requirements, and should have a detailed policy and procedures to ensure compliance.
That being said, if your credit union uses these forms, it would be a good idea to start taking steps to update to these new forms. Additionally, it looks like the CFPB has plans to make additional changes to Regulation V in 2013 – so stay tuned.
It's a miracle! The professional photographer was able to catch several photos of all four of us looking at the camera at the same time. So, as promised, here is the family photo we chose...and of course I had to purchase the rights to all of the pics taken because there were some other memorable photos I just had to have (and I've shared one of those with you all as well).
Larger Participants. The CFPB's regulatory and supervision authority extends beyond depository institutions and into nonbanks. One part of this authority is the CFPB's ability to define "larger participants" in consumer markets that it will then regulate. The CFPB had issued proposed rules for the consumer reporting market and the debt collection market and had also issued a general request for comment on other consumer markets for future regulation.
The CFPB indicates in their final rule that they intend to define "larger participants" in other consumer markets in the near future - most likely next with the debt collection market.
Economic Monitor. The latest issue of NAFCU's Economic and CU Issues Monitor is now available for download. The Economic and CU Issues Monitor is NAFCU's monthly update on the macroeconomic and financial trends affecting credit unions. Each month, a "Special Topic" is addressed, concerning various issues of interest to the credit union community. NAFCU members can download the latest issue here. Additional resources and information from NAFCU's Research division can be found here.
Hope everyone had a great weekend - below is a great resource that might be useful.
Reg Z Account Opening Disclosures for Open-end Credit.
We'll look at some of these violations in more detail later this week.
For now, I'm just glad the Philadelphia Federal Reserve has continued this publication even though authority for the consumer regulations passed to the CFPB. In the future, I'm hoping the CFPB (and NCUA) realize how useful an informal publication like the Consumer Compliance Outlook can be in highlighting common issues and explaining the requirements to increase compliance among financial institutions.
We expect that both the adverse action notices and the risk-based pricing notices will be published in the Federal Register today. We are not clairvoyant, but there is a process that allows you to see what will be included in the next day's Federal Register pages. This is the "Public Inspection Desk."
Regulation B (adverse action model forms) here.
Regulation V (risk-based pricing notices) here.
Note: While both the amendments indicate they are effective in 30 days, the underlying requirements of Section 1100F from Dodd-Frank become effective on July 21, 2011. Credit unions should do their best to get their notices updated and ready for July 21, 2011.
Final Rule – Parts 700, 701, 702, and 741 of NCUA’s Rules and Regulations, Net Worth and Equity Ratio Definitions.
Interim Final Rule – Section 701.30 of NCUA’s Rules and Regulations, Remittance Transfers.
Proposed Rule – Part 712 of NCUA’s Rules and Regulations, Credit Union Service Organizations (CUSOs).
The text of these proposals and final rules will be available on the morning of the Board meeting - a familiar date - July 21, 2011.
The Federal Trade Commission announced a new CAN-SPAM education tool for small businesses. The new video discusses "seven things you need to know to comply with CAN-SPAM." There is also a useful transcript of the video at the bottom of the page.
Last Wednesday, the Federal Reserve released final rules on both risk-based pricing notices and adverse action notices. Both changes were required by Section 1100F of Dodd-Frank.
There is a bit of confusion in this area because there are actually two separate adverse action notices. Regulation B has an adverse action notice. And, the Fair Credit Reporting Act (FCRA) also has a requirement for an adverse action notice. Oftentimes, credit unions are required to send both notices and they meet this requirement by sending a combined Reg B/FCRA adverse action notice. In some other situations, only the Reg B adverse action notice is required (i.e., no credit report is used).
The Dodd-Frank Act changed the FCRA adverse action notice. Of note, there is not a regulation that implements the FCRA adverse action notice. Rather, the Federal Reserve provides combined model forms in Regulation B that provide the required language for both the Reg B and the FCRA adverse action notices.
And, that is why the Fed amended Reg B even though Section 1100F of Dodd-Frank made a change to the FCRA adverse action notice.
Adverse Action. The trigger for the FCRA adverse action notice is when the CU takes adverse action based "in whole or in part" on information from a consumer report. With the new changes - the FCRA adverse action will need to also include the credit score information if the CU used the credit score in taking adverse action against the member.
"Under Section 1100F of the Dodd-Frank Act, a person is not required to disclose a credit score and related information if a credit score is not used in taking the adverse action."
Similar to the risk-based pricing rule, if the CU obtains a credit score it would need to be able to demonstrate that the credit score played no role in the adverse action determination. Quite a tough hurdle.
"Disclosure that no credit score is available. In some cases, a creditor may try to obtain a credit score for an applicant, but the applicant may have insufficient credit history for the consumer reporting agency to generate a credit score. One commenter asked that the creditor have the option to provide the applicant notice that no credit score was available from a consumer reporting agency in the space available for the credit information disclosure.
Section 1100F only applies when a creditor uses a credit score in taking adverse action. The creditor cannot disclose credit score information if an applicant has no credit score. Nothing in section 1100F of the Dodd-Frank Act prevents a creditor, however, from providing the applicant notice that no credit score was available from a consumer reporting agency, although section 1100F does not require such notice."
"As explained in the proposed rule, the Board recognizes that a key factor(s) that adversely affected the consumer’s credit score may be the same as a specific reason(s) for denying credit or taking other adverse action. However, some specific reasons for taking adverse action may be unrelated to a consumer’s credit score, such as reasons related to the consumer’s income, employment, or residency. Therefore, the Board continues to believe the disclosure of both the key factors that adversely affected the consumer’s credit score and the specific reasons for denying credit or taking other adverse action is necessary to fulfill the separate requirements of the ECOA and the FCRA. The Board believes providing separate lists, and thus distinguishing factors that adversely affected the credit score from reasons for the adverse action determination, will be more useful and clearer for consumers."
Credit Score Information on Separate Document? Unlike the risk-based pricing rule - which allows credit unions to staple the new credit score information to their existing RBPN - the Fed has indicated the credit score information needs to included on the adverse action notice. A few industry commenters had asked that institutions be able to attach a form from a consumer reporting agency to their existing adverse action notices. The Fed declined stating that "providing a form with credit score information separately from an adverse action notice does not appear to be consistent with the legislation."
Timing. Similar to the risk-based pricing notices, the Fed stated the new requirements of Dodd-Frank become effective July 21, 2011. Credit unions should do their best to meet the July 21, 2011 deadline.
Welcome to Friday! The week goes by pretty fast when the Fed is issuing final rules left and right.
Timing. We had quite a few questions on the timeline for the Reg V and Reg B notices. The model forms carry a compliance date of 30 days after the rules are published in the Federal Register.
Does that mean you have extra time to comply? Let's put it this way. I wouldn't want to delay working on getting the credit score information included. I'd want to make sure my forms were ready to go on July 21, 2011. Why? The Federal Reserve went out of its way to indicate its hands were tied by Section 1100F's July 21, 2011 effective date.
Then why the 30 days after the Federal Register for the listed compliance date? This is due to the rulemaking process that federal agencies - including the Federal Reserve - must follow. Those rules come from the Administrative Procedures Act and govern the "notice and comment" rulemaking procedures. One of those rules requires agencies to give 30 days after they finalize a rule. See 5 U.S.C. 553(d).
So didn't the Federal Reserve hamstring financial institutions by getting the final rule out so late? Yes.
What if we can't be ready by July 21, 2011? Document your compliance efforts and the actions the CU has taken to get as close as possible to the July 21, 2011 date.
"Contact information for the entity that provided the credit score. An industry commenter asked that the Agencies add language to the model forms directing the consumer to the consumer reporting agency for more information about the credit score. The commenter believed that consumers may otherwise contact creditors with questions about their credit score, but that creditors are not in a position to answer those questions.
The Agencies are adding optional language to model forms H-6 and H-7 of the Board‘s rule and B-6 and B-7 of the Commission‘s rule directing the consumer to the entity (which may be a consumer reporting agency or, in the case of a proprietary score that meets the definition of a credit score, the creditor itself) that provided the credit score for any questions about the credit score, along with the entity‘s contact information. Creditors may use or not use the additional language without losing the safe harbor, since the language is optional. The final rules add new instruction 4. to Appendices H and B to make clear that this disclosure of the entity‘s contact information is optional."
This little tweak allows the CU to put information about the credit reporting agency (CRA) into the credit score disclosure portion of the risk-based pricing notice. This is useful as it means an issue with the credit score itself is more likely to be asked of the correct party (the CRA and not the CU). Note: This optional language is the final section of the H-6 and H-7 notices and is in brackets - which indicates it is optional.
.........Thus, the Agencies believe that a creditor will be deemed to have used H-6 or B-6 if it staples or appends to H-1 or B-1 the credit score information contained in the section "Your Credit Score and Understanding Your Credit Score" that is contained on the second page of H-6 and B-6. Instruction 3. to Appendices H and B sets out the modifications that may be made to the model forms without losing the benefit of the safe harbor."
As I stated above, this does not change the information that needs to be given - but it does allow the CU the flexibility to work on getting the credit score information ready and attaching or stapling it to their existing risk-based pricing notice. See Page 20.
Also, I added a new link to yesterday afternoon's blog that contains the new regulatory text of the "Multiple Consumer" situation - which includes a useful example.
Sarah and I will be doing a webcast on the recent clarifications to the Credit CARD Act. If you are interested, the webcast is on Wednesday, August 10.
This morning's blog post discussed the minimal implementation time given by the Federal Reserve. This post will get into some of the weeds of the risk-based pricing notice final rule. We will pick up on other issues tomorrow and the changes to Reg B's model forms next week.
Credit Score Exception Notices. The recent changes will not impact your credit union if you use the credit score disclosure exception notices. I blogged about this back in late March. However, consumer groups made a strong push to remove these exception notices completely. The Fed did not follow - but remember the new Consumer Financial Protection Bureau (CFPB) takes over the consumer laws, including Reg V, and will be a new ear for consumer groups. The two pages of discussion are here if you want to review the discussion - which provides a good reminder for the role of comment letters.
Key Factors. The Fed clarified that credit unions who purchase a credit score from a consumer reporting agency (CRA) can rely on the "key factors" provided by the CRA to disclose the key factors that adversely affected the credit score.
Use of Credit Score. This new requirement - from Section 1100F of Dodd-Frank - applies when the credit unions uses a credit score in setting or reviewing the APR on the account. If the credit union uses a credit score in the credit decision, it must include these new disclosures.
"A creditor that obtains a credit score and engages in risk-based pricing would need to disclose that score, unless the credit score played no role in setting the material terms of credit. Moreovers, even if the credit score was not a significant factor in setting the material terms of credit but was a factor in setting those terms, the creditor will have used the credit score for purposes of Section 1100F of the Dodd-Frank Act." (emphasis added). Page 9.
Here is the problem with that: how do you prove to an examiner that you did not use a credit score that you have in your possession? That might be a very tough hurdle and strong procedures and documentation might not be able to satisfy an examiner. A separate question might be: why is the CU obtaining a credit score when it is not using it in the decision process?
Guarantors & Co-Signers. Regulation V does not require the credit union to send a risk-based pricing notice to a guarantor or co-signer on an account because the CU is not granting credit to that person (see 75 Fed. Reg. 2731 for more discussion). However, the credit union may need to send a risk-based pricing notice to the actual applicant.
"The Agencies continue to believe that the credit score of one consumer, such as a guarantor, co-signer, surety, or endorser, should not be disclosed to a different consumer entitled to receive a risk-based pricing notice."
Multiple Consumers. Last month, I blogged on the proposed change for sending risk-based pricing notices when there are multiple applicants. This change was finalized and will require the credit union to send separate risk-based pricing notices to co-applicants - even if they reside in the same household - if the notice contains credit score information. In other words, the credit score information is private information and cannot be shared with other co-applicants. Update (7/7/11): For the regulatory text, see section 222.75(c)(1) and the example in 222.75(c)(3).
"A creditor therefore must provide a risk-based pricing notice to all co-applicants, and not only to the applicant whose credit score was used in setting the material terms of credit." Pages 15-17.
There was also an interesting statement by the Fed in their final rule to Reg V. The Fed was asked to considering changing the language on the model form so that the form did not state the terms (i.e., the APR) were "set" or "based on" information in the credit report. The commenters asked that the language be changed to broader language - such as "based in whole or in part on information from a consumer report."
The Fed said no. Why? "The Agencies believe that the current language in the regulation and model forms is more concise and understandable to consumers than the language suggested by the commenters."
"§ 222.72 General requirements for risk-based pricing notices.
(2) Based in whole or in part on the consumer report, grants, extends, or otherwise provides credit to that consumer on material terms that are materially less favorable than the most favorable material terms available to a substantial proportion of consumers from or through that person."
Why do credit unions have to use concise language and regulators do not? This looks like a perfect area for Ms. Warren and the CFPB to step in and make sure credit unions do not need "an army of lawyers" to understand the legal requirements.
Yesterday, the Federal Reserve finalized rules on model adverse action notices and risk-based pricing notices to implement Section 1100F of Dodd-Frank. Section 1100F of Dodd-Frank required "credit score information" to be added to both Fair Credit Reporting Act (FCRA) adverse action notices and risk-based pricing notices (required by FCRA and implemented in Reg V).
A final rule amending Regulation B's Model Forms - which include combined Reg B/FCRA adverse action notices.
A final rule amending the Federal Reserve's Regulation V - which requires risk-based pricing notices.
Effective Date. Both rules carry an effective date of 30 days after the rules are published in the Federal Register (which might not be until early next week). We will post a notice on the blog when the rules are published in the Federal Register.
"Even if the Agencies did not modify the model forms to incorporate this additional minimum content, creditors would be required to disclose this information pursuant to the statute.
Rather than have creditors create their own notices in order to comply with section 1100F of the Dodd-Frank Act, the Agencies are exercising their existing authority to amend the model notices to reflect these changes to avoid consumer confusion, and to ensure timely, consistent, and uniform compliance with the new content provisions. Section 615(h) gives the Agencies the authority to issue rules implementing the risk-based pricing provisions, including authority to address “the form, content, timing, and manner of delivery” of risk-based pricing notices. The Agencies believe that adding to the requirements for the risk-based pricing notice the content required by section 1100F of the Dodd-Frank Act, and providing revised model notices is appropriate. These final rules are thus effective and compliance is mandatory beginning 30 days after the date of publication in the Federal Register."
Wow - the Fed almost makes it sound like they are doing credit unions a favor by waiting until 15 days prior to the July 21, 2011 date to finalize the model forms. The Fed included similar language in the Reg B final rule (pages 17-18).
We will have more on these final rules in the near future. For now, know that the Fed did not provide any wiggle room on the implementation date and credit unions need to make sure their notices are being updated with the new required information.
Back in late March, I blogged briefly about the proposed changes to the risk-based pricing notices. The ink was barely dry on the risk-based pricing rules before Dodd-Frank required the notices to be updated. As the March blog post notes, this change impacts institutions using the traditional risk-based pricing notices. The "credit score disclosure exception notices" are not impacted because they already contain the credit score information.
The changes to the risk-based pricing notices have not been finalized but they will become effective July 21, 2011 (unless the Fed extends the compliance date when it issues the final rule). When finalized, credit unions will need to include credit score information on all risk-based pricing notices. This is required by Section 1100F of Dodd-Frank which amended Section 615(h) to the Fair Credit Reporting Act (which is then implemented by Regulation V).
This requirement for the credit score information dovetails with the requirement for the credit score information which will soon be required for FCRA adverse action notices. Dodd-Frank required these changes to ensure consumers knew their credit score information and that it was a factor in the credit union's decision. In the past, the adverse action notice and traditional risk-based pricing notice only required a disclosure about the consumer's right to receive and review their credit report. Going forward, these notices will need to have the credit score as well.
The proposed rule - which includes proposed model forms - is located here.
The rationale for the Dodd-Frank change makes some sense. Congress wanted to give consumers a right to their credit score in addition to their ability to obtain their credit report. However, sometimes I think Congress does not give enough attention to the burden this places on small institutions.
"(c) Multiple consumers —(1) Risk-based pricing notices. In a transaction involving two or more consumers who are granted, extended, or otherwise provided credit, a person must provide a notice to each consumer to satisfy the requirements of §222.72(a) or (c). If the consumers have the same address, a person may satisfy the requirements by providing a single notice addressed to both consumers. If the consumers do not have the same address, a person must provide a notice to each consumer.
(2) Credit score disclosure notices. In a transaction involving two or more consumers who are granted, extended, or otherwise provided credit, a person must provide a separate notice to each consumer to satisfy the exceptions in §222.74(d), (e), or (f). Whether the consumers have the same address or not, the person must provide a separate notice to each consumer. Each separate notice must contain only the credit score(s) of the consumer to whom the notice is provided, and not the credit score(s) of the other consumer."
There was some flexibility built into the Regulation V risk-based pricing notice. This allowed institutions who were sending the traditional risk-based pricing notices to send one notice in situations where the consumers both had the same address (this was not allowed for credit unions sending the credit score disclosure exception notices).
This new change will ultimately remove this flexibility. All risk-based pricing notices will now need credit score information. This means credit unions that previously sent one notice to members jointly at the same address will need to send two separate notices - even if the members reside at the same address - because of the credit score information.
Now, you may be thinking - this is not a huge change. But - I'd argue this small change (sending two notices rather than one) has a large compliance cost. Remember, the risk-based pricing rule just became effective on January 1, 2011. This change from Dodd-Frank will become effective July 21, 2011. That is just over six months. The cost of this change is not just the additional cost of mailing out an additional notice each time. Credit unions will also need to update their current procedures and retrain staff. And that is just on this small mailing change. Credit unions will also need to spend time and resources reading and digesting the other changes in the final rule which hasn't arrived yet.
NAFCU Members: Our Reg Alert on the changes to Regulation V (11-EA-07) can be found here.
Adverse Action Forms. Confusion abounds surrounding the proposed adverse action forms under Reg B. The confusion probably stems from the fact that the change required by the Dodd-Frank Act (to include credit scores and other information in an adverse action notice) is a change to the FCRA adverse action notice requirements. Changes are not being made to the ECOA/Reg B adverse action requirements at this time.
However, very often a credit union needs to send both adverse action notices at the same time. Therefore, the Federal Reserve created model forms that combine the Reg B and FCRA adverse action notice requirements. These model forms are housed in Appendix C to Reg B, and because there are changes to the FCRA notice requirements the Federal Reserve needs to change those model forms that purport to satisfy both the Reg B and FCRA adverse action notice requirements.
The proposed model forms were published in the Federal Register in March. The FCRA notice requirements kick-in July 21, 2011 per the Dodd-Frank Act. Final forms have not yet been issued, but keep an eye out for them because July 21 is just around the corner. If you are itching for a more detailed discussion of this issue, please see the Background section of the proposed rule. If that link doesn't work for you, go to the Fed's press release announcement. You can access the proposed rule from there as well.
Fiduciary Duties Policy. NAFCU members, another very generous member has offered a sample Fiduciary Duties policy for the policy exchange library. If you'd like to review it, you can go to the library and peruse the Miscellaneous section. It is aptly named Fiduciary Duties. And when that generous nature strikes you, please consider offering a sample policy of your own.
NCUA Webinar. NCUA will be holding a free webinar Thursday May 26 (tomorrow) at 4 pm. The topic is the proposed voluntary prepaid Corporate Stabilization Fund assessments program that NCUA announced at its May 19 Board meeting. NCUA's press release about the webinar contains a link to register.
With the creation of the new Consumer Financial Protection Bureau (CFPB), there has been an extra focus on clarity of information. The CFPB has consistently stated that one of its main missions will be to remove the "tricks and traps" currently used in the financial marketplace. It is with that background in mind that I want to walk through an example of where regulators have placed complicated and unnecessary roadblocks on the road to compliance.
The recent risk-based pricing rule in Regulation V contains a requirement for institutions to send a risk-based pricing notice when the credit union has conducted an "account review" and increased the APR on an existing loan. Note: This post is not going to discuss the Regulation Z issues involved (i.e., change-in-terms process and APR review process if a credit card account).
(ii) Based in whole or in part on the consumer report, increases the annual percentage rate (the annual percentage rate referenced in §222.71(n)(1)(ii) in the case of a credit card).
(2) Example. A credit card issuer periodically obtains consumer reports for the purpose of reviewing the terms of credit it has extended to consumers in connection with credit cards. As a result of this review, the credit card issuer increases the purchase annual percentage rate applicable to a consumer's credit card based in whole or in part on information in a consumer report. The credit card issuer is subject to the requirements of paragraph (a) of this section and must provide a risk-based pricing notice to the consumer."
Regulation V includes a model form for this notice; the H-2 notice.
"Industry commenters objected to this requirement, stating that account review is not covered by the statute. They also argued that the provision was not needed because adverse action notices were already provided when annual percentage rates are increased during account review.
Paragraph (d) of the final rules is adopted as proposed. The legislative history indicates that the statute was meant to apply to account reviews, as well as to new accounts. Moreover, the Agencies acknowledge that there are circumstances where an adverse action notice is provided to the consumer in connection with an account review that results in a rate increase. In these circumstances, the exception for adverse action notices, discussed below, would apply and the creditor would not be required to provide the consumer with a risk-based pricing account review notice. However, if an adverse action notice is not provided to a consumer, a risk-based pricing account review notice must be provided to the consumer." 75 Fed. Reg. 2736.
So, the Fed (and the FTC) are telling institutions they need to send a risk-based pricing notice to members where their APR has been increased. But, the notice is not required if an adverse action notice has been sent (the exception is located in 12 C.F.R. 222.74(b)).
"(2) Example. A credit card issuer periodically obtains consumer reports for the purpose of reviewing the terms of credit it has extended to consumers in connection with credit cards. As a result of this review, the credit card issuer increases the purchase annual percentage rate applicable to a consumer's credit card based in whole or in part on information in a consumer report. The credit card issuer is subject to the requirements of paragraph (a) of this section and must provide a risk-based pricing notice to the consumer." (emphasis added).
To me, this is a "trick and trap" conducted by the regulators. Industry commenters specifically mentioned that an adverse action notice is sent in a majority of these "account review" situations and that a risk-based pricing notice would be redundant. The Fed (and the FTC) acknowledged this in the preamble but did not change the language of the regulation.
Thus, now we have a situation where a reading of the regulation implies an "account review" risk-based pricing notice would need to be sent. But, the adverse action notice exception, in 12 C.F.R. 222.74(b), still applies. How do we know the adverse action exception applies? The Fed (and the FTC) acknowledged this in the preamble.
Have you seen any discussion about important account terms being "tucked away in the fine print"? To me, this regulation does the exact same thing. Would it have been so hard to include a reference to the adverse action exception in the example used in 12 C.F.R. 222.74(d)(2)?
"(2) Example. A credit card issuer periodically obtains consumer reports for the purpose of reviewing the terms of credit it has extended to consumers in connection with credit cards. As a result of this review, the credit card issuer increases the purchase annual percentage rate applicable to a consumer's credit card based in whole or in part on information in a consumer report. The credit card issuer is subject to the requirements of paragraph (a) of this section and must provide a risk-based pricing notice to the consumer.
If a credit card issuer has sent an adverse action notice to the consumer, the credit card issuer would not be required to also send a risk-based pricing notice to the consumer. Refer to 12 C.F.R. 222.74(b) for more details on this exception."
Please Note - the above is a hypothetical regulatory section for informational purposes and is not real.
Another common refrain from the CFPB is that they understand how an increasing regulatory burden disproportionately hurts small financial institutions - including credit unions. To help ease this burden, regulators need to reduce the situations where key issues are "buried in the preamble" rather than reflected in the regulation or in the staff commentary.
If the goal is increased clarity of information, regulators need to join the party as well.
RBPNs: Can you tweak the model forms?
A credit union compliance officer asked me a wonderful question the other day. His credit union wanted to add information to a model risk-based pricing notice, such as the member's name. He was concerned, however, that by tweaking the model form, he might lose safe harbor protection.
The Agencies agree that creditors should have some additional flexibility to modify the content of the model forms, while still retaining the safe harbor. Language has been added to the final rules to clarify that technical modifications to the language of the forms are permitted. More examples also have been added to the list of examples of acceptable changes to the model forms: substitution of the words ‘‘credit’’ and ‘‘creditor’’ or ‘‘finance’’ and ‘‘finance company’’ for the terms ‘‘loan’’ and ‘‘lender’’; including pre-printed lists of the sources of consumer reports or consumer reporting agencies in a ‘‘check-the-box’’ format; and including the name of the consumer, transaction identification numbers, a date, and other information that will assist in identifying the transaction to which the form pertains. The final rules also specifically state that unacceptable changes to the model forms include: providing model forms on register receipts or interspersed with other disclosures and eliminating empty lines and extra spaces between sentences within the same section.
A discussion of acceptable changes is found within Appendix H of the final rule.
For those into compliance, you may have heard of NAFCU's Regulatory Compliance School. It is a week-long, intense educational conference designed to hammer compliance into the minds of its attendees. There is optional testing, all with the goal of obtaining the NAFCU Certified Compliance Officer (NCCO) designation.
We are revamping the school, from top to bottom. Check out the new agenda.
Why we are revamping it. Any product or service must adapt. For those who attended the School in the past, you may recall that it had entire sessions devoted to the Right to Privacy Act and NCUA's Credit Practices Rule. But the school didn't address credit union bylaws, share insurance, RegFlex, the right of offset, and many other important topics. In addition, while the old format shoveled information at attendees, the School never talked about research skills, how to write effectively, or what the role of the compliance officer really is.
What we did. You'll see many more topics in the agenda. However, you may see that many of the sessions are shortened. We simply can't touch on many new things while devoting 2 hours to Regulation Z. Or an hour to the Right to Financial Privacy Act. We've tried to create a School manual that provides detailed information about each regulatory area, while also providing research tips and resources. In addition, we devote an entire day (Wednesday) on "compliance officer skills." Finally, we're moving to a four-test format. Many attendees in the past indicated that they were simply burned out by the end of the week. We decided that cutting a test allowed us to create a day (Wednesday) when attendees could learn how to be a better compliance officer without the stress of a test hanging over their head.
If I had to sum up why we're changing school and what our goal is, it would be this.
In the current regulatory climate, rote memorization and intense study will only get you so far. Memories fade, and regulations morph. The true way to achieve regulatory success is to build skills through which a compliance officer can assimilate and research new changes as they come along, while maintaining a solid understanding of basic regulatory framework.
That's our goal. We hope you consider joining us.
FinCEN has released a guidance document that provides a number of questions and answers about it Travel Rule requirement.
The Fed has released a consumer's guide to credit reports, credit scores and credit report errors. It might be something for you to consider including on your website to help your members understand how these things affect them.
There are never enough hours in the day! With that in mind, NAFCU members should know that our overview of the Regulation Z proposal concerning mortgages, HELOCs and reverse mortgages is available. (The proposal addresses other things as well.) These overviews can be a great resource.
An article on changes to the HUD-1.
Furnisher requirements under the FACT Act.
An index of all of their articles.
A super useful calendar of upcoming requirements.
Sign up to receive email notifications when new issues are available here.
NCUA charters 2 "bridge" corporate credit unions.
NAFCU members: We've issued a "Final Regulation" for NCUA's recent Short Term/Small Amount Loan Regulation.
The FDIC has issued guidance on the security risks involved with digital images stored on copiers, fax machines, and printers. You may recall that we wrote about this issue back in August. In short, these machines store digital images of the faxes, copies or items that you print. When you get rid of the machines, the images go with them unless you have policies and procedures in place to strip the potentially sensitive data. The security risk increases compliance risks related to Part 748 of NCUA's rules and regulations, not to mention Red Flags.
Does a lapse in FEMA flood insurance authority mean that loans secured by improved real property located in special flood hazard areas may not be made by lenders?
No, it does not. Lenders are not precluded during a lapse in flood insurance authority from making loans due to a lack of NFIP flood insurance. However, flood insurance is not available under the NFIP during a lapse. During a lapse, a lender may legally make a loan to a borrower secured by improved real property in a SFHA without requiring the borrower to obtain flood insurance coverage. This does not mean, however, that a lender is relieved of other obligations under federal flood insurance law nor does it mean that safety and soundness considerations can be disregarded. Both of these matters are dealt with in more detail below.
As always, read all of the guidance document. There is a ton of useful information there.
The Fed also issued this CA letter concerning the submission of consumer credit card agreements, now a requirement (with exceptions) thanks to the Credit CARD Act.
Finally, there is this CA letter, which addresses interagency exam procedures regarding the FACT Act "Duties of Furnishers of information" requirements. NCUA issued its own rules, in Part 717 of its rules and regulations. Attached to the letter is a copy of the exam procedures. The procedures give background information as well as the questions that examiners will be asking. Good, good stuff.
Reminder: I want to invite you to attend a free regulatory compliance overview that I’ll be providing during NAFCU’s upcoming Volunteers Conference in San Antonio, Texas. The session will run from 2:00 p.m. to 4:00 p.m. on Thursday, May 20, 2010 at the Marriott San Antonio Rivercenter.
I plan to cover a wide range of compliance topics (ramble) during these two hours. I'm sure I'll hit on overdraft protection, Reg Z, the SAFE Act and more. I'll probably mention Penn State football and force you to see a few pictures of my kids as well. Attendees of this session will also obtain 1.75 credit hours for their NCCO designation.
After our compliance session, you are also invited to attend the opening cocktail party at the Volunteers Conference. The cocktail party is from 4:00 p.m. to 5:00 p.m. at the Marriott San Antonio Rivercenter and serves as a meet and greet opportunity for folks attending the conference.
There is no registration fee or cost for you to attend this compliance roundup, and it is open to NAFCU members and non-members.
We do need you to RSVP ASAP so we can make arrangements for meeting space at the hotel. So please contact NAFCU staffer Olivia Gonzaga, at ogonzaga@nafcu.org or 703-842-2205, to let us know how many from your credit union will be attending this special compliance roundup.
1. Regulation Z open-end lending rules. Prior to the Credit CARD Act, the Federal Reserve issued final rules to the open-end lending rules. This was a major overhaul of the open-end lending rules, amending the rules for applications and solicitations, initial disclosures, periodic statements, and advertising, among other things. For the changes that haven't been swallowed up by the Credit CARD Act, the effective date is still July 1, 2010.
2. FACT Act. By July 1, 2010, credit unions must have in place policies and procedures regarding the accuracy and integrity of information provided to consumer reporting agencies. This rule also addresses direct disputes from consumers.
3. Regulation E overdraft rules. This rule is probably fresh in your head, but again, the effective date is July 1, 2010.
Truth in Savings (disclosures of overdraft fees on periodic statements and disclosure of account balances through automated systems) - January 1.
Private Student Lending - February 14. .
Credit CARD Act - February 22.
Reg GG - June 1.
More Credit CARD Act (gift cards, reasonableness and proportionality of fees, reevaluation of credit card rate increases) - August 22.
HELOC and closed-end mortgages amendments to Reg Z and SAFE Act registration requirements- who knows???
1. Do the Red Flags Rules, Card Issuers’ Rules, or Address Discrepancy Rules contain record retention requirements?
These three Rules do not contain specific record retention requirements. However, financial institutions and creditors must be able to demonstrate that they have complied with the requirements of the Red Flags and Card Issuers’ Rules, and users of consumer reports must be able to demonstrate that they have complied with the requirements of the Address Discrepancy Rules, in addition to any other applicable record retention requirements.
8. Are credit union service organizations (CUSOs) covered by the Red Flags Rules and Guidelines?
CUSOs, according to the Federal Credit Union Act, provide “services which are associated with the routine operations of credit unions” and are “established primarily to serve the needs of its member credit unions, and whose business relates to the daily operations of the credit unions they serve.” 12 U.S.C. §§ 1757(5)(D), (7)(I). A CUSO that is a “creditor” under the FCRA is covered by the Red Flags Rules and Guidelines issued by the FTC.
The WHO has officially declared a pandemic. What does this mean for compliance? The WHO lists the risk of a pandemic with phases, numbered one through six. We're now at WHO pandemic phase six. Some credit unions use the WHO stages to trigger different parts of their pandemic plan. You may want to check your pandemic plan to see what phase 6 triggers.
Here's one interesting angle of the credit card bill that I overlooked. While the provisions within the bill are very similar to UDAP, the reach of the bill is effectively larger. Remember, NCUA's UDAP rule only applies to federal credit unions. The FTC could write UDAP rules, but their rule-making process is much, much slower than NCUA's or the Federal Reserve's. The credit card bill, on the other hand, will apply to all issuers of credit cards once signed. And NCUA will have enforcement authority for both state and federal credit unions for its requirements.
Each corporate credit union is required to provide a summary of its annual audit reports to its members at its annual meeting. NCUA has loosened that requirement in light of the current situation. NCUA has indicated that it will not take exception to a corporate credit union not providing that summary if the audit has not been completed before the meeting. Corporates should indicate the reason for the delay and and inform members that a copy will be provided when available. Since members of corporates are natural person members - this will affect you.
NCUA held its monthly board meeting yesterday.
Here's a link to the results, which include the items considered by the board.
Here's NCUA's presser on the meeting.
In the meeting, NCUA approved one of the remaining FACT Act regulations still in limbo. (Can you believe that regulators have been issuing regs on these for 5 years now?).
NCUA Board approved a final rule implementing the accuracy and integrity and the direct dispute provisions of the FACT Act. The final rule requires furnishers, including credit unions, to establish reasonable policies and procedures for implementing the guidelines found within the new reg. It also states when a furnisher must reinvestigate disputes about the accuracy of information contained in a consumer report based on a direct request from a consumer (the direct dispute regulations).
The accuracy and integrity regulations also contain definitions of key terms such as “accuracy,” “integrity,” “direct dispute” and “furnisher” and require furnishers to establish and implement reasonable written policies and procedures regarding the accuracy and integrity of consumer information provided to a CRA. Also included are guidelines concerning the accuracy and integrity of information furnished to CRAs that furnishers must consider in developing their policies and procedures.
establish when a furnisher may deem a direct dispute to be frivolous or irrelevant.
Effective date: July 1, 2010. NCUA looked at other issues during the meeting, so I'd check out their presser, which is linked above.
Another great team effort, including the Compliance Guy's first appearance (which include two line drive singles and an amazing play at first base to preserve the lead). Thanks for letting him play Mandy! Can you tell Anthony is my boss?
"The technical corrections included in this Federal Register document revise one of the affiliate marketing model forms and the instructions to the model forms to correct inadvertent omissions and conform the model forms and the instructions to the affiliate marketing rules, and correct minor errors in the identity theft red flags and address discrepancy rules and guidelines. The substantive requirements of the affiliate marketing and the identity theft red flags and address discrepancy rules are unchanged."
NAFCU softball found itself in familiar territory last night - a split of a doubleheader. The first game was a 13-2 NAFCU victory spurred on by a nine run 3rd inning. However, the second game result in a 8-5 defeat despite a late rally from NAFCU. The current record stands at 2-4.
Game ball goes to Corey Davis of Member Services - two big hits in the first game to seal the victory.
This would have been nice to have last year.
But beggars taxpayers can't be choosers. So here's a link to the FTC resource. If you are in charge of your Red Flags program, this resource might be something to scan. And it is written in a very rare language for regulators: English.
BSA E-Filers, lend me your ears. FinCEN gives you this important reminder. In short, FinCEN is moving into Phase 2 of its BSA E-Filing Batch Validation process at the end of July. They intentionally allowed some errors to slip through during Phase I, but starting on July 31, 2009, they will get out their "reject" stamp for certain errors. If you use the system, I would give the guidance a read.
FACTA AIRES Questionnaires; Reg Z Reg Alert; 12-month Exam Cycle?
On Friday, NCUA released a letter to credit union (08-CU-24) to notify credit unions of two new AIRES questionnaires regarding FACTA compliance.
Here's a link to the letter.
Here's a link to the first attachment, which is an AIRES questionnaire on Red Flags Identity Theft.
Here's the second attachment, which is an AIRES questionnaire for consumer report address discrepancy procedures and for the proper record disposal procedures.
As FCUs are now complying with these requirements, these questionnaires and the letter are must reads.
NCUA issued Regulatory Alert 08-RA-06, which details recent changes to Regulation Z. If you do mortgage lending, read it.
Amendments to the Home Mortgage Provisions of Regulation Z (Truth in Lending). The Federal Reserve Board recently approved a final rule for home mortgage loans to better protect consumers and facilitate responsible lending. The rule prohibits unfair, abusive or deceptive home mortgage lending practices and restricts certain other mortgage practices. The final rule also establishes advertising standards and requires certain mortgage disclosures be given to consumers earlier in the mortgage lending process. These rules apply to all credit unions providing mortgage loans to their members.
Last week, NCUA Chairman Michael Fryzel announced plans to increase NCUA's budget to hire additional examiners and senior executives. One thing this would accomplish would allow NCUA to transition to a 12-month examination cycle. Read the Chairman's statement about the initiative here.

References: § 1681
 § 607
 § 615
 §623
 §623
 §623
 §623
 §623
 §623
 §623
 §623
 §623
 §1022
 §623
 §1681
 §1681
 §1681
 §1681
 V. 
 V.

 V.

 V. 
 §222
 §222
 §222