Source: https://nafcucomplianceblog.typepad.com/nafcu_weblog/twins/
Timestamp: 2019-04-19 03:15:59+00:00

Document:
With all the hype on cyber and data security, it would be appropriate to point out that it’s not always external threats we need to be wary of. Internally, the credit union needs to be aware of and take appropriate steps to ensure that sound practices are in place for managing and monitoring privileged access to data and systems.
Do our users need the level of access they currently have?
Have we segregated sensitive systems and data stores into secure enclaves?
Do we have effective oversight of privileged access?
How can we make active monitoring part of our culture?
I’ll let you read the article to get more details on those four particular points, but I would like to take a moment to point you to other sources of information on how to strengthen your privileged access procedures, which in turn will assist with minimizing risks from the inside.
The Federal Financial Institutions Examination Council’s (FFIEC) IT Examination Handbook is a great resource for determining the types of internal controls that will strengthen your privileged access procedures. Specifically, take a look at the Information Security Booklet. Within the Information Security Booklet’s subsections, you will find good practices for controlling privileged access; information on restricting and monitoring privileged access; the importance of activity monitoring; and examination procedures that may help your credit union determine the effectiveness of your current processes.
Credit unions may also find NCUA’s AIRES IT Exam Questionnaire useful when determining whether they have strong procedures in place for dealing with privileged access. The questionnaires consist of a checklist of questions that examiners use when determining whether the credit union is in compliance or has a strong program in place to address risks.
Actively managing privileged access by taking the steps addressed – in both the above-mentioned resources and article – can assist in reducing unauthorized access of critical systems.
Time Flies. My little buds are growing up so fast – they turned 3 just last week! “Time flies, but memories last forever” . . . thanks to cameras! And a big thanks to you all for sharing in on those memories with me!
NAFCU continues to receive TILA/RESPA Integrated Mortgage Disclosures questions from its members. As someone who has been digging through this rule for over a year, I must say these questions are not easy, especially since the questions become even more nitty gritty as the effective date, August 1, becomes nearer. Recently, a TILA/RESPA question was posed at a compliance roundtable that NAFCU attended. When the question was posed, I said to myself that it sounded awfully familiar . . . maybe something I recently read . . . and I was right.
The question was as follows: Is it permissible to use the TILA/RESPA disclosures instead of the currently-required Good Faith Estimate (GFE) and HUD-1 disclosures for those loans that are not under the scope of the TILA/RESPA rule? If so, this would prevent some credit unions from having to utilize two parallel systems.
The Short: No. Creditors originating transactions that are not covered under the TILA/RESPA rule must continue to use, as applicable, the GFE, HUD-1, and TIL disclosures required under current law.
Mortgage loans made by a person or entity that is not a “creditor” under Regulation Z.
For transactions not covered under the TILA/RESPA rule, as listed above, creditors originating these types of mortgages must continue to use, as applicable, the GFE, HUD-1, and TIL disclosures required under current law. In other words, creditors cannot use the new integrated disclosure forms instead of the GFE, HUD-1, and TIL forms for non-covered transactions, thus requiring the use of two systems/platforms to generate applicable forms.
“4.2 What are the disclosure obligations for transactions not covered by the TILA-RESPA rule, like HELOCs and reverse mortgages?
Cookie Break. Imagine this – a family with over a dozen sets of twins, three sets of which are 8 to 10 months apart in age and live within a 2-block radius of each other. Yep, no imagination needed here – that’s my family. And this is what a cookie break looks like on a warm Saturday afternoon after tons of running around the yard!
If you don’t normally follow my blogs, my twins – Ava and Kyse – are, from left to right, third and fifth on the bench.
As credit unions dig further into the TILA/RESPA Integrated Mortgage Disclosures rule, it is becoming more apparent that the rule itself and other CFPB-issued guidance does not address, clearly, some of the more nitty gritty issues that are surfacing. In fact, NAFCU has been receiving a number of these questions – and I tell you – they are not easy to research and the answers are not all clear.
Today, I won’t bog you down with difficult-to-comprehend information – after all, it is Friday! Instead, I’d like to make you aware of another great TILA/RESPA resource that I recently stumbled upon. As some of you know, over the last year, the CFPB and Federal Reserve Board have been co-hosting webinars that address questions about the TILA/RESPA Integrated Mortgage Disclosures rule. Currently, four (4) of these co-hosted webinars exist and provide another avenue of guidance – oral guidance – from the CFPB on the TILA/RESPA rule. Ideally, it would be nice if the CFPB transcribed these webinars, thus providing easily accessible, written guidance, but the CFPB has no plans of doing so (at least that I know of).
November 18, 2014: During this session, the Bureau addressed frequently asked questions relating to the Closing Disclosure. Our unofficial transcript is available here, and the recording is available here.
October 1, 2014: During this session, the Bureau addressed frequently asked questions relating to the Loan Estimate. Our unofficial transcript is available here, and the recording is available here.
August 26, 2014: During this session, the Bureau addressed frequently asked questions regarding the operational requirements of the rule. Our unofficial transcript is available here, and the recording is available here.
June 17, 2014: During this session, the CFPB provided a high-level overview of the rule. BuckleySandler did not transcribe this webinar, but the recording is available here.
Bubbles. Kyse and Ava love bubbles. I’m pretty sure I love bubbles even more because it keeps my kids entertained on the weekend. Last weekend, we spent Saturday and Sunday blowing bubbles, riding bikes/cars, and playing with the neighbor kids.
I look forward to this weekend’s adventures! Have a great weekend, all!
TILA-RESPA: Disclosing “No Cost” Loan Transaction on Loan Estimate and Closing Disclosure; Sibling Love?
With the effective date soon approaching, NAFCU continues to receive a number of questions from its members on the Truth in Lending Act and Real Estate Settlement Procedures Act (TILA-RESPA) Integrated Mortgage Disclosure rule. Today, I’d like to tackle the treatment of “no cost” loan disclosures under the TILA-RESPA rule. Let’s take a look at it from the Loan Estimate standpoint and then the Closing Disclosure.
[Note: hyperlinked references to “final rule” will direct you to Federal Register /Vol. 78, No. 251 /Tuesday, December 31, 2013 /Rules and Regulations 79825].
Question: Are credit unions required to disclose “no cost” loan transactions on the Loan Estimate form?
Answer: Yes. Credit unions are required to disclose “no cost” loan transactions on the Loan Estimate form.
According to the Preamble of the TILA-RESPA final rule, the CFPB “does not believe that it would be appropriate to exempt “no cost” loans from § 1026.19(e)(3)(i); therefore, “no cost” loans must still comply with the current limitations on settlement charge increases in Regulation X. See, Final Rule, Page 350. Section 1026.19(e)(3)(i) applies to all costs “imposed on the consumer,” even ones that may not be paid by the consumer. The closing costs in “no cost” loan transactions qualify as costs imposed on the consumer – under § 1026.19(e)(3)(i) – even though the costs are not paid by the member or financed by the creditor. See, Final Rule, Page 350. The costs paid by creditors on a member’s behalf in “no cost” loan transactions must, therefore, be disclosed under the “Closing Cost Details,” “Loan Costs,” or “Other Costs” sections of the Loan Estimate form as applicable.
This standard applies to all loans for which closing costs are offset by credit or rebate provided by the creditor, regardless of whether all or just a portion of the closing costs are being offset. See, Final Rule, Page 1803. Under such circumstances, the creditor must disclose the credit or rebate as lender credit, using a negative number, with the label “Lender Credits” under the subheading “Total Closing Costs.” See, 12 CFR § 1026.37(g)(6)(i)-(ii). However, “any credit disclosed should be sufficient to cover the total amount of closing costs” that the credit union represented to the member is covered by the Lender Credit under the loan terms. See, Final Rule, Page 864.
Question: Are credit unions required to disclose “no cost” loan transactions on the Closing Disclosure form?
Answer: Yes. Credit unions are required to disclose “no cost” loan transactions on the Closing Disclosure form.
Both generalized and specific credits that a credit union provides for closing costs must be disclosed. Generalized credit provided for closing costs must be disclosed as a negative number under “Lender Credits” and designated as borrower-paid at closing. See, 12 CFR § 1026.38(h)(3). Specific credits attributable to a particular loan cost or other cost, such as the fees that the credit union currently pays, must be listed in the “Paid by Others” column in the “Closing Cost Details” table under § 1026.38(f) or (g). See, Final Rule, Page 1843.
For a description of lender credits from the creditor, see comment 17(c)(1)-19. For a discussion of general lender credits and lender credits for specific charges, see comment 19(e)(3)(i)-5.
Like much of the TILA-RESPA Integrated Mortgage Disclosure rule, how to address “no cost” loans is highly technical, but there is helpful clarification in the commentary. Where even the commentary is difficult to apply, sometimes the explanations in the Preamble to the rule, while not binding, can provide further explanation—but the Preamble is long, so searching key terms helps.
Sibling Love? It's Wednesday - that time of the week when some people can use a funny story or a bit of fresh air to get them to Friday. So today, I share this with you.
These twins appear to be loving and easy-going but I assure you that Kyse and Ava are like any other brother and sister - they love to annoy each other! Don't let the photo fool you! Ava is actually crying her eyes out because Kyse invited himself as a passenger and the last thing she wanted to do was share!
In a recent blog post, I discussed pre-consummation changes that would require the credit union to issue a corrected Closing Disclosure to the consumer. Today, as part of our continued TILA/RESPA blog series, I’d like to now focus on the “other” situations that can trigger the need for a corrected Closing Disclosure.
During the 30-day period following consummation, if an event in connection with the settlement of the transaction occurs that causes the disclosures to become inaccurate and results in a change to an amount paid by the consumer, the creditor will be required to provide a corrected Closing Disclosure. In this situation, the creditor must deliver or place in the mail a corrected Closing Disclosure not later than 30 days after receiving information sufficient to establish that such an event has occurred.
"For example, if the disclosure identifies the incorrect settlement service provider as the recipient of a payment, then §1026.19(f)(2)(iv) requires the creditor to deliver or place in the mail corrected disclosures reflecting the corrected non-numeric disclosure no later than 60 days after consummation. However, if, for example, the disclosure lists the wrong property address, which affects the delivery requirement imposed by §1026.19(e) or (f), the error would not be considered clerical."
To correct non-numeric clerical errors, a creditor must deliver or place in the mail a corrected Closing Disclosure no later than 60 days after consummation.
Finally, if a creditor provides a consumer with a refund to cure a tolerance violation in connection with the good faith analysis of the estimated closing costs, the creditor must deliver or place in the mail a corrected Closing Disclosure that reflects the refund no later than 60 days after consummation.
Stay tuned! NAFCU’s TILA/RESPA blog series will continue to break-down sections of the rule over the next several months.
Join Us for NAFCU’s Member-Only Call.
Please join NAFCU’s CEO Dan Berger, Senior Vice President of Government Affairs and General Counsel Carrie Hunt, and other Senior Staff, on Wednesday, March 18, at 4:00 p.m. Eastern for our first legislative and regulatory briefing of 2015. We'll discuss what’s ahead in the credit union industry and provide an outlook for the economy and more.
Participation is free for all members, but you must register to attend. If you need assistance registering for the call, please contact NAFCU’s Member Service Center at 800-344-5580 or msc@nafcu.org.
TGIF. I thought I'd close out the week with a picture of my smiling twins! They turned two-and-a-half this week. Wow, how time flies!
FFIEC Cybersecurity Best Practices. Earlier this week, the Federal Financial Institutions Examination Council (FFIEC) released observations from a recent cybersecurity assessment. The “FFIEC Cybersecurity Assessment General Observations” suggests best practices to consider when assessing institutions’ cybersecurity preparedness.
What types of connections (e.g., virtual private networks, wireless networks, telnet, etc.) does my financial institution have?
How are we managing these connections in light of the rapidly evolving threat and vulnerability landscape?
Do we need all of our connections? Would reducing the types and frequency of connections improve our risk management?
How do we evaluate evolving cyber threats and vulnerabilities in our risk assessment process for the technologies we use and the products and services we offer?
How do our connections, products and services offered, and technologies used collectively affect our financial institution’s overall inherent cybersecurity risk?
Cyber incident management and resilience.
As part of the assessment, the FFIEC also recommended that regulated financial institutions, including credit unions, participate in the Financial Services Information Sharing and Analysis Center (FS-ISAC) as part of their process to identify, respond to, and mitigate cybersecurity threats and vulnerabilities. The FS-ISAC is a non-profit, information-sharing forum established by financial services industry participants to facilitate the public and private sectors’ sharing of physical and cybersecurity threat and vulnerability information.
And last, as a result of the assessment, the FFIEC mentions in its assessment that it is reviewing and updating current guidance to align with changing cybersecurity risk. To see the assessment in its entirety, including other questions to consider when managing cybersecurity at your credit union, click here.
Free Webcast. Digital Commerce: The Future is Here!
Emerging payments technologies such as Apple Pay can level the playing field with your biggest competitors. Stay relevant in the face of dynamic change; attend this webcast to learn how different payments options work and how to best implement them in your credit union. MasterCard’s Vice President of Emerging Payment Solutions, Rita Ramirez will provide you with the information you need to begin taking advantage of the exciting new changes in payments technologies. Free for NAFCU members and nonmembers!
Thing 1 and Thing 2. This year for Halloween, I decided to be creative and make my kids’ wigs from scratch for their Halloween costumes. I’d say I did pretty darn well! Toot, toot!
There’s nothing better than a quick, but solid burst of information on a lovely Friday (okay, that’s a stretch . . . but hopefully an attention-grabber for those of you who are eagerly awaiting the weekend to begin).
Earlier this week, the Consumer Financial Protection Bureau (CFPB) updated both its Small Entity Guide for the Truth-in-Lending Act / Real Estate Settlement Procedures ACT (TILA-RESPA) Integrated Disclosure Rule and its Guide to Forms. Prior to this September 2014 update, the last editions were published in March 2014 and April 2014, respectively.
New to its available resources, the CFPB also released a timeline to assist with understanding the time requirements under the TILA-RESPA rule. If you’ve been following NAFCU’s TILA-RESPA blog series, you’ve seen that there are a number of different timeframes that creditors, such as credit unions, need to be aware of. The CFPB’s timeline shows how to apply the process and timing requirements under the TILA-RESPA rule for a specific real estate purchase transaction.
Just a friendly reminder, the TILA-RESPA rule goes into effect on August 1, 2015. It seems like a ways away, but there is plenty that credit unions can be doing right now towards implementation (sounds like an opener for a near future blog)!
For past blogs on this rule, take a look here.
Don’t wait until the last second. At almost 2,000 pages long, start preparing now to meet the requirements of the new TILA-RESPA Integrated Disclosure Rule. This vital webcast will give you a better understanding of the new rule and how your credit union will need to respond to it. This is one of the most important issues your credit union may face in the coming months — but we’ll offer solutions to help you and your colleagues sleep at night.
It's Been a While. Okay, it’s been a while but I’ve finally been able to glance through some recent photos of the kiddies. Now two years old, here are a couple recent photos of my twins, Kyse and Ava.
Happy Friday to you all, and have a great weekend!
In the last TILA-RESPA blog posting, we covered the general requirements for the new Loan Estimate. Today, I’d like to highlight the when and how the Loan Estimate should be delivered.
For purposes of the Loan Estimate, there are two timeframes that the creditor should be aware of. First, the Loan Estimate must be delivered or placed in the mail to the consumer no later than the third business day after the creditor receives the consumer’s application for a mortgage loan.
Second, the creditor must deliver or place the Loan Disclosure in the mail not later than the seventh business day before consummation of the transaction.
The term “business day” has two different meanings for purposes of the Loan Estimate. For purposes of providing the Loan Estimate within three business days from application, the definition of “business day” is “a day on which the creditor’s offices are open to the public for carrying on substantially all of its business functions.” For many credit unions, this will not include Saturdays. When calculating whether the Loan Estimate is provided at least seven business days before consummation, the term “business day” means “all calendar days except Sundays and the legal public holidays.” Unlike the first definition of “business day,” the latter definition includes Saturday as a business day.
The creditor is responsible for ensuring that the Loan Estimate is received by the consumer in accordance with the timing requirements discussed above. New sections 1026.19(e)(1)(iii)-(iv) provide that if the creditor delivers the Loan Estimate to the consumer in person, it is considered received by the consumer on the day that it is provided. If the creditor uses another method of delivery other than in-person delivery, the consumer is considered to have received the Loan Estimate three business days after it is delivered or placed in the mail.
In instances where a mortgage broker relationship is utilized, the mortgage broker may provide the Loan Estimate to the consumer on the creditor’s behalf, but it is the creditor’s responsibility to ensure that the content, delivery and timing requirements under the final rule are met.
The next TILA-RESPA posting will discuss the good faith requirement and how it applies to the tolerance limitations prescribed by the TILA-RESPA rule.
To all, I wish you a lovely weekend. I intend to spend a ton of quality time with my buds this weekend since I take off for Annual Conference (AC) on Monday. Stay cool, and if you're attending AC, come say hi!
TILA-RESPA Integrated Mortgage Disclosures Rule: The Loan Estimate Disclosure – General Requirements; Programming Note; What Are You Reading?
As part of the TILA-RESPA blog series, I’d like to take a look at the general requirements applicable to the Loan Estimate Disclosure today.
The new Appendix H to Part 1026 contains model forms, including multiple variations of each page of the Loan Estimate. The standard form, H-24, must be utilized for all loans subject to the TILA-RESPA rule that are federally related mortgage loans. For loans that are not federally related mortgage loans but that are subject to the TILA-RESPA rule, creditors are not strictly required to use the H-24 form; however, the disclosure used by the creditor must contain the exact same information and be made with headings, content and format substantially similar to that form.
For a page-by-page overview of the Loan Estimate, the CFPB has provided a couple of resources that may be beneficial to a credit union. First, the CFPB’s TILA-RESPA Small Entity Guide provides page-by-page visuals of the form with general information describing what creditors are required to disclose. For further guidance, the CFPB has provided the TILA-RESPA Guide to Forms, which provides detailed, illustrated instruction on how to complete the individual fields and calculations for the Loan Estimate.
It should be noted that NAFCU’s June Compliance Monitor included an article entitled A Deep Dive into the Loan Estimate Disclosure: Requirements, Timing and Tolerances. For fuller detail on the Loan Estimate, including information on delivery/timing and tolerance restrictions, take a look at that article (NAFCU log-in required).
Programming Note. NAFCU's office will close at noon on Thursday and will also be closed on Friday for the long holiday weekend. We will be back to blogging on Monday. Have a great long weekend!
Last week, the Consumer Financial Protection Bureau (CFPB) released a fair lending report to Congress that highlights its enforcement actions under the Home Mortgage Disclosure Act (HMDA) and Equal Credit Opportunity Act (ECOA) during an 18-month period (July 21, 2013 – December 31, 2013). Fulfilling part of its fair lending mandate under the Dodd-Frank Act, the CFPB’s report gives Congress an update on the bureau’s fair lending-related efforts and outlines key priorities for its supervision and enforcement work.
“Guidance on supervisory reviews. The Bureau publicly released information about the methods our examination teams use to conduct three types of fair lending supervisory reviews: ECOA Baseline Reviews, ECOA Targeted Reviews, and HMDA reviews. Through these supervisory activities we detected some violations of ECOA and HMDA; we also found that many lenders have instituted and maintained strong fair lending compliance management systems (CMS) and had no violations of ECOA and HMDA. Using the guidance issued by the Bureau describing these reviews, lenders may self-assess their own compliance with ECOA and HMDA. We also provided guidance to industry via Supervisory Highlights and Bulletins discussing fair lending topics.” (My emphasis added).
Although the CFPB only has examination authority over credit unions with assets of $10 billion or more, its supervisory focus affects credit unions of all sizes; and as the “key development” above states, the CFPB’s guidance and reports such as its fair lending report, serve as means for credit unions of all sizes to stay compliant with federal consumer financial laws such as the HMDA and ECOA.
You can access the CFPB’s latest fair lending report here.
A credit card company for several violations of consumer protection laws, including unlawfully discriminating against card applicants on the basis of age.
An indirect auto lender for harming minority borrowers who were charged higher interest rates than similarly creditworthy non-Hispanic white borrowers.
Additionally, we’ve released important information about fair lending, which we hope will benefit consumers, advocates, and industry. We introduced our HMDA Database, which allows the public to study trends in the mortgage market across the nation and in their own communities. We also released two fair lending bulletins to help consumers and industry stakeholders recognize fair lending and access to credit risks in the home mortgage and auto lending markets. And, we’ll continue to work with industry and trade representatives, fair lending, civil rights, consumer and community advocates to make sure that consumers know their rights and that lenders know how to comply with the rules."
Last, but definitely not least (at least in my book), I’d like to kick off the week by sharing some photos of my kiddies from this weekend. It was beautiful this past weekend in the D.C. area and I know my family took full advantage of getting some much needed Vitamin D.
On Monday, NCUA’s new derivatives rule went into effect. The rule allows credit unions with $250 million or more in assets that have a CAMEL rating of 1, 2, or 3 and a management component of 1 or 2 to use derivatives to hedge against interest rate risks. Credit unions meeting this criterion must complete a two-step application process in order to qualify for derivatives authority.
Coinciding with the effective date of the rule, NCUA issued Letter to CU 14-CU-04 to describe this application process. NCUA also included Supervisory Letter No. 14-02, which clarifies the agency’s supervisory expectations about those derivatives products used by federal credit unions and federally-insured, state-chartered credit unions.
For more information on the derivatives rule, be sure to check out NAFCU’s Final Regulation, which provides a summary and detailed breakdown of the rule’s requirements.
NAFCU Resources Updated. I wouldn’t want to toot our horn or anything, but I will on this lovely Friday morning. NAFCU’s compliance team has updated a number of its compliance resources which are now available to members (NAFCU log-in required).
NAFCU’s ten (10) mortgage rule scope and applicability charts have been updated and made available on our mortgage resources webpage.
Also, the mortgage rules consolidated regulatory text was updated and posted to the website.
Last, a new section – TILA/RESPA Integrated Mortgage Disclosures – was added to the mortgage resources page. This new section will be further developed with more resources on the final rule throughout 2014.
And don’t worry! We’ve got something for members and non-members alike. In February, the compliance team completed an extensive editing project of NAFCU’s Credit Union Compliance GPS. The electronic manual was edited to include regulatory changes throughout the past year, including the addition of 7 new sections on the CFPB’s mortgage regulations and a more developed subsection on remittances in the Regulation E section. The GPS overhaul resulted in over 100 new pages in the manual. The 2014 GPS will be available for purchase in the next week or so.
Programming Notes. Next week (March 10 – 15), NAFCU’s compliance team and several other NAFCU staff will either be attending or presenting at NAFCU’s 2014 Regulatory Compliance School. Because the compliance team will be in and out of the office all week, it is possible that we will have a delay on responding to our member questions, but we will get back to you as soon as possible!
If you’re attending School, please don’t hesitate to come up and say hello! We love putting faces with names. And, if you have been following the growth of my twins on this blog - now 18 months old - you just might catch a glimpse of them in the halls of the Gaylord at the end of the week!
With April 1 approaching, I thought today would be a good time to remind you all that after March 31, 2013, the legacy reports can no longer be used for filing SARs and CTRs. Starting April 1, 2013, the new SAR and CTR forms must replace the legacy forms if you have not already said your goodbyes to those forms.
For more information, check out FinCEN’s guidance on this matter and past blog posts written by NAFCU’s Compliance Team (here, here, and here).
In last Friday’s blog post, Steve mentioned that the CFPB issued a final rule requiring the removal of the Regulation E requirement to place ATM fee disclosure language “on the machine.” He also mentioned that the final rule would be effective immediately upon publication in the Federal Register. Well, as of March 26, 2013, the final rule has been published in the Federal Register. And on a grander note, the language has already been removed from the Electronic Code of Federal Regulations, thus making everything consistent.
“§ 1005.16 Disclosures at automated teller machines.
(a) Definition. “Automated teller machine operator” means any person that operates an automated teller machine at which a consumer initiates an electronic fund transfer or a balance inquiry and that does not hold the account to or from which the transfer is made, or about which an inquiry is made.
(b) General. An automated teller machine operator that imposes a fee on a consumer for initiating an electronic fund transfer or a balance inquiry must provide a notice that a fee will be imposed for providing electronic fund transfer services or a balance inquiry that discloses the amount of the fee.
(c) Notice requirement. An automated teller machine operator must provide the notice required by paragraph (b) of this section either by showing it on the screen of the automated teller machine or by providing it on paper, before the consumer is committed to paying a fee.
Now when credit unions research Regulation E, the regulation matches the underlying law! Imagine that!
The twins and I intend to just relax this weekend. We hope you can do the same!
In case you’re looking for something juicy to read, I thought I’d point you to an interesting topic (okay, okay…it’s interesting, but not interesting enough to call it juicy): highly problematic areas that financial institutions are struggling to stay compliant in. As part of the supervisory authority given to the CFPB through the Dodd-Frank Act, the CFPB released its first issue of Supervisory Highlights, which highlights supervisory actions found between July 21, 2011, and September 30, 2012. The CFPB’s Supervisory Highlights serve as a means to communicate to the public and financial services industry about its examination process and the kinds of problems CFPB examiners discovered through that process.
to take to correct their deficiencies.
I’ll leave the reading to you. The report is short and sweet and very well-organized. But just as a taste, the CFPB broke the deficiencies down into two main categories: (1) Compliance Management Systems and (2) Significant Violations Detected.
The CFPB deems a robust and effective compliance management system (CMS) as a critical component of a well-run financial institution. The CFPB found financial institutions to be lacking across its entire consumer financial portfolio in instances where it failed to adopt and follow comprehensive internal policies and procedures, resulting in a breakdown in compliance and numerous violations of Federal consumer financial law. Further, it found a CMS to be deficient in situations where there was failure to oversee affiliate and third-party service providers.
The CFPB found violations involving credit card, credit reporting, and mortgage origination activities to be significant violations. Some of these violations resulted in public enforcement actions while others resulted in nonpublic supervisory actions. At any rate, the discovered violations were of a broad spectrum and financial institutions were required to take corrective action, including but not limited to stopping the illegal practices, adopting effective policies and procedures, implementing robust compliance management programs, and paying out large sums of relief and civil money penalties.
The CFPB also released an appeals policy for supervised institutions as well as an updated version of the CFPB Supervision and Examination Manual, the guide used by examiners during the supervision process. The appeals policy provides a means for financial service providers to request a review of any adverse findings set forth in its examination report. The Manual serves as a great indicator of what the CFPB has authority to supervise and what it will be looking for during the examination process. Even those credit unions under $10 Billion can use this Manual to ensure that it is compliant with Federal consumer financial laws.
For those of you that are members of NAFCU, you can find a more detailed article on this topic in NAFCU’s January 2013 Compliance Monitor.
On an even more interesting note (or at least I’d like to think so), my husband and I made an attempt this past weekend to take a professional family photo with the kiddies. We decided to go professional when we realized we couldn’t seem to get a good picture where all four of us are actually looking at the camera. I’m hoping to share the “good” picture with you all once I have access to it, but in the meantime, here is our “nonprofessional” attempt at getting us all in one picture…of course the boys aren’t looking the right way.
I thought I’d keep it simple today with a couple…okay, a whole lot of…FYIs that you may (or may not) find interesting.
The CFPB has issued a notice stating that if you receive a call from the “CFPB” in regards to a “sweepstakes” offer, it is a scam. Be careful not to provide any personal, consumer, or commercial information.
FinCEN has released its seventeenth issue of The SAR Activity Review – By the Numbers (BTN). The report is only published once a year and provides numerical data on SAR filings from the last 12 months. It is available here.
In April, NCUA filed its first report to Congress on its Office of Minority and Women Inclusion (OMWI) and is expected to issue a proposal for comment in the future on standards for assessing credit unions' diversity policies. NAFCU wrote a letter to NCUA addressing OMWI’s assessment of credit unions’ diversity policy. March 29, 2012 - OMWI Assessment of CU's Diversity Practices.
NCUA’s OMWI was created in accordance with the Dodd-Frank Act. Its focus is diversity, civil rights and the promotion of minority and women hiring and contracting practices throughout the credit union industry.
NCUA’s 2011 annual report notes actions taken thus far toward developing standards for assessing the diversity policies and practices of entities it regulates. It also looks at steps taken within the agency to promote diversity in its own hiring and procurement practices.
If you remember from Steve’s blog post on April 30th, we were waiting to see NCUA’s Annual Report on the Plain Writing Act. That report is now available on NCUA’s webpage dedicated to the Plain Writing Act.
I could keep going, but I think I’ll stop right there for now. Okay, wait…one more...FYI: I’m having twins (a boy and a girl)!
I love my job. I always have. But I love NAFCU. Always have. Ever since I joined this organization in 2004. So it is with mixed emotions that I have to tell you that my days as NAFCU's head compliance geek are at their end. In a few short days, I'll transition into the role of NAFCU's Senior Vice President and Chief Operating Officer. I'll be replacing Pat Morris, who is moving on to be CEO at the ACA. That's very good news for a very good guy, and I can safely speak on behalf of NAFCU when I say that we wish him nothing but the best.
It has been a sincere pleasure working with all of you, and I thank you for allowing me to barge into your office each morning through this blog. Credit union compliance officers are my kind of people. You stand for the rule of law. You respect process and procedures. You bow to internal controls. You understand that just because you can do something doesn't necessarily mean you may do it, or should. Your role within an organization should be treasured, nurtured, and respected.
In my new role at NAFCU, I'll be removed from NAFCU's compliance program. I'll be in charge of helping my colleagues at NAFCU get what they need so they can do their jobs - which is to serve NAFCU's members. I'll take with me the respect of risk management, internal controls, and critical analysis that I gained alongside you these past 6-plus years. I'm humbled and excited at the challenge.
NAFCU's compliance services will still be here, and they'll continue to be great. And the blog will live on as well. No one person is indispensable, and that certainly extends to me. Our compliance services will be headed up by someone else, and that's fine. NAFCU is busy finding my replacement, but until then Sarah, Steve and Shari are here to help.
Change is good, and learning new things and challenging yourself is great. Thanks again for humoring me with this blog, and I wish you all the best.
PS: And since I know what you really will miss most, here are a final few pics of Kate and Briggs.
NCUA Board Meeting; The Chairman on Comment Letters; Mortgage Doc Prototypes Near?
Happy Friday, everyone. We somehow made it through another week as compliance officers!
NCUA. Yesterday, NCUA held its monthly board meeting. You can access the meeting materials here. It wasn't a huge compliance day, although NCUA did issue rules regarding corporates and they finalized a proposed IRPS that tweaks NCUA's Supervisory Review Committee. NAFCU Today will provide overview of the meeting here.
Comment letters. NCUA Chairman Debbie Matz gives some great advice on how to write comment letters. Via this link, you can read a quick overview of the four major areas where she gives advice, as well as watch a 5-minute video on the art of writing comment letters. This clearly is on the Chairman's mind right now, as she covered the same topic in this month's NCUA Report.
The Mortgage Forms Are Coming. Reportedly, the CFPB is close to releasing prototype model mortgage disclosure forms. This will be our first chance to see how they'll handle model forms.
As you can see, Kate and Briggs would rather be outside, enjoying springtime. I hope you follow their lead, and enjoy your weekend! If you are travelling, be safe.
Yogi Berra is a smart man. This is one of his best observations.
Baseball is 90 percent mental. And the other half is physical.
That is actually true, for anyone who has played the game. I think Professor Berra was on to something. A similar calculation could be used for regulations.
Ninety-percent of regulatory burden is made up of all the rules and regulations. The other half is how those rules are written.
One of these days, someone is going to reinvent how regulations are drafted and presented. If they get it right, I think it will be a win-win. The regulations will be easier to read and understand. And that will lead to greater compliance. Usually, the goal of a regulation is to solve a simple problem. If regulators can come up with simple, creative ways to solve that problem, everyone will be better off.
Here are two examples off what I mean.
1. The CARD Act and Regulation Z. When the CARD Act became law, it mandated that the Fed issue a number of credit card-related regulations. Those were issued in three waves. The first proposal totaled more than 800 pages (ultimately 241 in the federal register) of dense regulatory language. We spent a lot of resources helping our member figure out how to break the rule down into readable portions. (When someone can add value by helping someone else figure out how to read a regulation you've written, you may have a problem.) Over the course of the next year, additional proposals and clarifications were issued.
And it continues. Just last month, the Fed issued another "clarification" to clear up a hand-full of CARD Act-related issues. The length of that clarification totaled more than 300 pages.
2. Unnecessary complexity. MDIA has created an interesting discussion that has reached the level of complexity needed to launch a rocket into space. What is that issue? If you overstate the loan's APR in your dwelling-secured loan's disclosures, must you re-disclose your MDIA disclosures under Regulation Z? You'd think this would be a simple question. But it is not. I won't bore you with the bloody details. But if you want to see the complexity - read this article issued by the Fed.
To paraphrase Allen Iverson, we're talking about an overstated APR. An overstated APR. A creditor in this situation has disclosed an APR to the member that ends up being higher than what the member will get. The member will get a lower APR when the loan is consummated. In many cases, the member is no better or worse off - they pay the same amount. But in some cases, the lender must halt the process, re-disclose, and then wait for the necessary time before the loan can move to closing.
This could have been regulated a different way. How about this general rule? If you overstate the APR, no harm, no foul. No need to re-disclose. Just let the member know at closing what the new APR is. If the member proceeds to closing, they surely didn't mind the higher APR. And for those who think that this creates a perverse incentive to inflate costs to err on the side of overstating the APR, thereby erasing the need for re-disclosure, Adam Smith is rolling over in his grave. Market pressures will demand that they get that as close as possible. If it is too high, they'll lose mortgages at the margins to other lenders.
These were just two examples of how the regulatory system seems to be breaking down. When it takes hundreds of pages to explain one provision of a rule, be it a provision of the CARD Act or MDIA, it may be time to come up with a different rule altogether.
What if financial organizations could create their consumer disclosures using a risk-based system that is based on their products and services. The regulation could come up with certain over-arching goals, such as clarity of disclosures, and certain prohibited practices. But beyond those basic requirements, each organization would have to defend its disclosures and advertisements against basic principles: Is this disclosure or advertisement easy to understand? Does it accurately describe the features and costs of the account or service? Can we say (with a straight face) that it would not mislead or confuse the average consumer.
Yes, we like the compliance stuff...but we really like pictures of your kids.
They just had their 2-year check up. Kate is now 3 foot, one inch tall. Briggs is a clean three feet. They both weigh just under 26 pounds. Kate is in the 99th percentile for height. Briggs is in the 86th percentile. Come on, growth! The Demangone side of the gene pool never saw 6 feet, to the best of my knowledge. I look forward to when my kids can look down on me.
As we look toward 2011, I thought I'd spend the next week or so discussing some ideas that might help you in the coming year. Today, I'd like to talk about citations. Not the kind that you get for double-parking. I mean legal or regulatory citations that point to a specific part of a law, regulation, or guidance document.
Oh, and the same goes for examiners.
So, in 2011, ask for citations. It will help you verify that an auditor, consultant, attorney or examiner is correct. And it might force them to be a bit more judicious with their recommendations, knowing that they have to provide some legal or regulatory authority each time they tell you to do something.
Happy Holidays, everyone. NAFCU's offices will be closed tomorrow in observation of Christmas. We'll get back at it on Monday.
The more I think about it, the next photo is a bit more aligned with the life of a compliance office in 2010. You hold on for dear life and hope for the best. Here's hoping Santa is good to each and every one of you!
Some Scary Stuff; Happy Halloween!
With Halloween just a few days away, I thought I'd share some news and items that might be considered spooky.
Elizabeth Warren. If you have any doubt about how Ms. Warren views the financial services industry, watch this video. But I think you really can see her true colors when she answers a question regarding the fact that some institutions are instituting account fees to try to compensate for lost revenue due to all of the new regulations. You can jump to that specific question and answer by scrolling down and clicking the fifth hyperlink below the video. Here's a transcript.
Question: I have a question that came in a couple of seconds ago from Allen G. The banking industry is try to offset lost revenues due to new regulations - Credit CARD (Act), overdraft - by charging consumers additional fees on checking and other products. What are your thoughts on what the industry is doing?
Ms. Warren's Response. You know, I have to say this...it really does amaze me. There was a major financial institution that sent out a letter to its shareholders in the last quarter. And the letter said, in effect, I'm paraphrasing - but only slightly - the new laws, because remember - we've already gotten some new law in place, the card law for example, that eliminate some of the worst practices on credit cards. These new laws that have come into place under the current leadership have cost us $650 million this quarter. And you know, I had this moment when I read that and I thought, hmmm, one company $650 million that they say that these new laws outlawing these bad practices cost them, I kind of read that the other way. That's $650 million that stayed in the hands of American families. $650 million from just one company on just a few bad practices that were banned thanks to the work of the current Congress, thanks to the work of Carolyn Maloney, who was one of the persons who really lead the efforts on this. Thanks to the work of President Obama. So here's my view on the card, or any other creditor, that somehow they are entitled to certain level of revenue, particularly a level of revenue set in a time when, you know, when it was kind of an anything-goes world, I'm just not there. Instead, my view is let's see what a competitive market brings us. There may be a period of time when some of the larger financial institutions to squeeze out every last nickel - to push harder on fees in one place because they can't do them in another, but over time, I'll tell you where this Agency (CFPB) is driving - we are striving toward a consumer market in which products are easier to read, easy to see what the costs are and easy to make comparisons. As we push toward that, the room for anyone within the financial services industry to make their money by squeezing you here and squeezing you there through tricks and traps - that's going to go away. And I want to be clear -I think there are some banks that will be glad to see that day come and I think they'll do very well competitively. And banks that don't like it are the ones that eventually customers like you will make the difference on whether or not they survive.
The settlement is based on the OCC’s conclusion that the bank engaged in unfair or deceptive practices that violated the Federal Trade Commission Act. Specifically, the bank assessed excessive amounts of overdraft fees and improperly assessed recurring fees, or “continuous overdraft fees” against certain consumers. In addition, in its marketing brochures the bank emphasized the free or low cost features of certain accounts while omitting information about costly features such as overdraft protection. The bank’s marketing also suggested that certain accounts were well-suited for consumers who had previous difficulty in managing their bank accounts, while omitting information about the high-cost features of its overdraft protection.
FDIC lawsuits. Here's a scary blog post regarding the FDIC possible getting ready to launch a "tsunami" of lawsuits against the officers and directors of failed banks. (Bank Lawyer's Blog.) NCUA rarely does this, although they do have one suit going against officers and directors of U.S. Central. If this waive of litigation takes place, I wonder what it will do to the cost and requirements involved with D&O insurance?
Killer bees. There has been a sighting of large bees near Arlington, Virginia. Be careful. Very, very careful.
I should have a sign in my office that reads "Things will hopefully slow down tomorrow." If I sold that sign to compliance officers, I might be writing this blog from my boat in the Bahamas.
Indirect lending. NCUA Board Member Gigi Hyland announced that NCUA will host a free webinar on indirect lending on Tuesday, November 9. If you look at the panel of speakers, you'll see that NCUA is having senior members of its staff make the presentation. They always answer a ton of questions and answers, so these webinars are a good place to measure NCUA's expectations on a topic.
RESPA. The OCC has updated its RESPA exam procedures. They might come in handy, as RESPA is RESPA is RESPA, no matter if you are a bank, thrift or credit union.
The primary causes of MainStreet’s failure were its large investment in fixed assets, high overhead costs, and a very competitive local market. In 1998, MainStreet purchased a $22 million branch office and constructed a $4 million main office, which represented approximately 30 percent of the thrift’s total assets. The occupancy and related personnel expense increased the thrift’s overhead costs significantly and resulted in weak earnings. Management tried to implement a growth strategy in deposits and commercial real estate lending but was unsuccessful due to the highly competitive local market and a low net interest margin. Consequently, MainStreet could not absorb the increased overhead costs and incurred losses in 8 of the previous 11 years. These conditions were exacerbated by the deterioration in the Michigan economy. Loan delinquencies and classified assets increased significantly, which resulted in higher net operating losses that further diminished earnings and capital, and ultimately, led to MainStreet’s failure.
Sleep. A certain set of twins in Arlington, Virginia seem to think it is perfectly acceptable to get up somewhere between 3:30 and 5 a.m. each morning. They generally fall back asleep just as their father heads out the door for work. Their father is not amused, but he is keeping tabs on the behavior and will dock their future allowances accordingly.
I was out of the office at NAFCU's Volunteer's Conference in San Antonio last week. It is amazing how quickly one's email inbox can get out of control. As I cleaned out my inbox, here are some things that caught my eye.
Current Issues in Credit Unions. I co-host a podcast with a number of talented legal eagles. The most recent edition is available here. We touch upon, Reg Z, interchange, CUSOs, Reg GG, and more!
Risk-Based Pricing Notice. NAFCU members, we have produced a final regulation to help you comply with the upcoming requirements here.
Board Member Hyland. Speaking of podcasts, NCUA Board Member Gigi Hyland participated in a podcast that addressed the state of the industry, compliance with Red Flags, vendor management and more. Listen to it here. Some of you may not know that Ms. Hyland is an attorney who served as GC for a corporate at one point. So her views on compliance-related issues are worth a listen. The podcast is only 18 minutes long, and spends a good deal of time on fraud prevention and internal controls.
Credit card agreements. The Fed's online system is up and running. The first thing I did was to check to see if my credit union's agreement was there. I bet your members will do the same thing if they stumble upon the site.
Reg GG. The OCC has issued a nice overview document which includes exam procedures for Reg GG.
OK, I think that's enough for the Friday before Memorial Day. I have three things to say about the upcoming three-day weekend.
Remember the reason we celebrate Memorial Day.
Enjoy your family. I'll do the same.
This and That; Happy Birthday, Kate and Briggs!
Here are a few things that were kicking around in my in-box.
NCUA issues Regulatory Alert 10-RA-06 to alert credit unions to recent FinCEN guidance. The guidance authorizes an exception for the CIP rule concerning address confidentiality programs. I wrote about this earlier on the blog.
Next week is NAFCU's Regulatory Compliance School, where many folks will prepare to pass exams in order to obtain their NCCO designation. NAFCU members, note that Steve and Sarah will make multiple presentations, and that I will be at the conference all week. Please be patient with our response times. As always, a great way to get us is via compliance@nafcu.org.
People often ask where I find many of the things that appear on the blog. I respond that I don't find them. They come to me, usually via my RSS reader. An RSS reader pulls information from websites and blogs, and organizes them within a reader. My RSS reader is provided by Google, and it tracks roughly 60 compliance-related blogs and websites. (And some Big 10 football websites as well.) I usually start my day with a cup of coffee while I scan new items. Interested? This video does a great job of filling in the details.
Happy first birthday, Kate and Briggs! The last year has been a wonderful roller coaster of feedings, diapers, laughter and...well, more diapers. Life is good. For those who may be interested in pictures, visit the family blog here.
You'll have to forgive me - this will be fairly brief. We're all a wee bit whipped from yesterday's 2-hour webcast on Reg E and Reg Z. Here's some stuff that has been kicking around my in-box.
The FFIEC has released a white paper titled "Mortgage Fraud White Paper: The Detection and Deterrence of Mortgage Fraud Against Financial Institutions." If your credit union does mortgage lending, this is a must read. At a minimum, pass this along to whomever is responsible for fraud prevention at your credit union.
The Department of Education has released the final version of the "self certification form" that you'll need to do private student lending. Here's a cover letter from the agency highlighting the news.
Don't ask my how, but my kids are now 11 months old. Briggs is growing so quickly, he has begun supervising my work.
Briggs: Dad, let me know when you're done, and I'll open up this gate.
You know how much I love FAQs. Well, here's another. FinCEN has issued an FAQ document for BSA E-Filers. You can access it here. The FAQ also is a transition document to help E-Filers transition to the world of "Adobe."
Last week, the Federal Reserve issued final regulations to implement the Mortgage Disclosures Improvement Act. NAFCU Today wrote a nice article about the changes here. Yesterday, the Fed published the final rule and commentary in the Federal Register. Access the Federal Register Notice here. Access the Fed's press release about the changes here.
Yesterday was a big day on the Hill. The House passed a Credit Union Stablilization bill, and the Senate passed a credit card reform bill. Read more about those developments here.
I was out with Kate and Briggs recently. As you can see, I sort of forgot about that pig flu thing. Luckily, this pig said he had his flu shots this year.
Question: There is some confusion within our credit union as to when the clock starts ticking for suspicious activity reporting. We have 30 days to file a Suspicious Activity Report (SAR). Is that 30 days from the day of the actual transaction or 30 days from when we determine we need to file a report?
Answer: The Bank Secrecy Act (BSA) file rules require credit unions to file a SAR no later than 30 calendar days from the date of the initial detection of facts that indicate a SAR is required. The Financial Crimes Enforcement Network (FinCEN) notes that the 30-day (or 60-day, if the suspect cannot be identified) period does not begin until a credit union has conducted an appropriate review and determined that the transaction under review is “suspicious” within the meaning of the BSA regulations. FinCEN has further clarified that the “initial detection” of suspicious activity “does not necessarily occur on the date of the transaction(s), the date when an automated system generates a notice or red flag alert or the date when an employee initially reviews the transaction(s).” See FinCEN SAR Activity Review – Trends, Tips & Issues, (Issue 14, October 2008), pages 37-38. Once a credit union has made its review and determined that the activity does not appear to have a business or lawful purpose and is therefore suspicious, the credit union then has 30 days from that date of determination to file a SAR.
However, FinCEN reminds credit unions that any reviews of suspicious activity should be completed within a reasonable period of time. Issue 14 of FinCEN’s SAR Activity Review – Trends, Tips & Issues provides three excellent examples illustrating that the date of the initial detection does not necessarily trigger the 30 day filing period. You can access it here.
NAFCU is getting ready to launch a new online training program that I designed. Get some details about it here. I had a lot of fun with this project, and I'm very excited about it. Then again, I'm hugely biased.
I know it is a Monday. But cheer up. As this photo points out, Summer cannot be far away. I just have to find a way to keep flip-flops on their feet. My idea of duct tape was quickly shot down by Mandy. I told her I was kidding, but I think Mandy has her doubts.
If the member gives his or her personal data away after falling victim to a text message scam, they must be on the hook for any resulting unauthorized transactions. Right?
Consumer negligence. Negligence by the consumer cannot be used as the basis for imposing greater liability than is permissible under Regulation E. Thus, consumer behavior that may constitute negligence under state law, such as writing the PIN on a debit card or on a piece of paper kept with the card, does not affect the consumer's liability for unauthorized transfers.
If the member gives his or her debit card information away to a crook over the phone, that might be negligence. As noted above, however, that negligence means nothing. The member gave his or her data over the phone because the member thought there was some security-related freeze on their card. They thought they were authorizing the lifting of the freeze, not the subsequent transactions. It is a very one-side rule that favors consumers.
Mandy was laughing a few nights ago. Here's what she found in the nursery.
I told him he could sleep there whenever he wants, as long as he learns to change diapers.
President Obama has asked federal regulators to hold off on finalizing new or proposed regulations. His request also includes possible extensions on existing compliance deadlines. Read all about it here, in a very good NAFCU Today article. The article provides a good overview, as well as a link to the White House Memorandum.
NCUA has already pulled one final rule back due to the memo. NCUA officials report that it is possible that other rules, including UDAP, could be affected. Stay tuned.
Electronic stop payment orders? You bet, says NCUA, as far as it is concerned. In Legal Opinion Letter 08-1122 (January 5, 2009), NCUA indicates that NCUA regs do not require a signed, paper form. But they do ask that credit unions look at state law requirements on the subject. The letter is a good refresher on NCUA's recordkeeping requirements.
The two cribs are built. So is a chest of drawers. I have two words to describe my recent long weekend: allen wrench. A bunch of folks have been asking, so I just wanted to pass along that Mandy is doing well and that the dynamic duo should be along in mid-March.

References: § 1026
 § 1026
 § 1026
 § 1026
 § 1026
 §1026
 §1026