SIPPS Archives - Page 11 of 24

National Credit Union Administration Anti-Money Laundering and Countering the Financing of Terrorism Program Requirements

NASCUS Legislative and Regulatory Affairs Department
July 24, 2024

Background

The OCC, FRB, FDIC, and the NCUA (the “Agencies”) have published a notice of proposed rulemaking and request for comment that would amend the requirements each Agency has issued for its supervised entities under the Bank Secrecy Act. For purposes of this summary, we will refer specifically to the NCUA.

The amendments are intended to align with the changes concurrently proposed by FinCEN as required by the AML Act of 2020.

NASCUS summary of FinCEN’s proposal can be found here.

The proposed rule incorporates a risk assessment process in the AML/CFT program rules that requires consideration of the national AML/CFT Priorities published by FinCEN. Additionally, the proposed rule would add customer due diligence requirements to reflect prior amendments to FinCEN’s rule and, concurrently with FinCEN, propose clarifying and other amendments to codify longstanding supervisory expectations and conform to AML Act changes.

Comments will be due 60 days after the proposed rule is published in the Federal Register.

Summary

The proposed rule would make several changes to NCUA’s BSA compliance program rules. As previously discussed, the main reason for the proposed changes is that NCUA and the Agencies’ BSA compliance program rules will remain aligned with FinCEN’s rule to avoid confusion and additional burdens upon supervised entities.

Proposed Rule

1. Purpose Statement
Like FinCEN, NCUA is proposing a statement describing the purpose of an AML/CFT program requirement which is: “To ensure that each bank implements an effective, risk-based, and reasonably designed AML/CFT program to identify, manage, and mitigate illicit finance activity risks that: complies with the requirements of subchapter II of chapter 53 of title 31, United States Code, and the implementing regulations promulgated thereunder by the Department of the Treasury at 31 CFR chapter X; focuses attention and resources in a manner consistent with the risk profile of the bank; may include consideration and evaluation of innovative approaches to meet its AML/CFT compliance obligations; provides highly useful reports or records to relevant government authorities; protects the financial system of the United States from criminal abuse; and safeguards the national security of the United States, including by preventing the flow of illicit funds in the financial system.”

The statement is intended to summarize the overarching goals of credit unions’ effective, risk-based, and reasonably designed AML/CFT programs.

2. Establishment and Contents of an AML/CFT Program

Establishment: As addressed in FinCEN’s proposed rule, a credit union must establish, implement, and maintain an effective, risk-based, and reasonably designed AML/CFT program. While financial institutions are already required to maintain a “reasonably designed AML/CFT program, the proposal would add the terms “effective” and “risk-based” to the existing requirements.
Also reflective of FinCEN’s proposal, NCUA is proposing to add the terminology “AML/CFT” to this rule, consistent with the AML Act.
AML/CFT Program: The proposed rule establishes the following minimum requirements and are not meant to stand alone, but rather form the basis of an effective AML/CFT program:
- A risk assessment process that serves as a basis for the credit union’s AML/CFT program;
- Reasonable management and mitigation of risks through internal policies, procedures, and controls;
- A qualified AML/CFT officer;
- An ongoing employee training program;
- Independent, periodic testing conducted by qualified personnel of the bank or by a qualified outside party; and
- Customer due diligence

NASCUS would like to highlight while the AML Act did not change the existing BSA requirement that each credit union designate a compliance officer as part of its BSA compliance program, the NCUA is proposing clarifying and technical changes to this subsection to codify existing regulatory expectations and conform to FinCEN’s proposal.

Accordingly, for an AML/CFT program to be effective, reasonably designed, and risk-based, the compliance officer must be qualified. Based on the experience of the Agencies in examining BSA compliance programs, the compliance officer’s qualifications (i.e., the requisite training, skills, expertise, and experience) need to be commensurate with the bank’s ML/TF and other illicit finance activity risks.

In addition to qualifications, the proposed rule states the credit union’s organizational structure must enable the compliance officer to effectively implement the credit union’s AML/CFT program. This means this individual’s authority, independence, and access to resources within the credit union is critical.

3. Board Oversight
Although not a new requirement to some FIs, the NPRM requires documentation of the AML/CFT program. In addition, the AML/CFT program must be approved by and overseen by the board of directors (or equivalent governing body). This is not a new practice for credit unions. Finally, the proposal contains new oversight requirements, such as governance mechanisms, escalation, and reporting lines, to ensure the board properly oversees the AML/CFT program.

4. Presence in the United States
Section 6101(b)(2)(C), of the AML Act, provides that the duty to establish, maintain, and enforce a bank’s AML/CFT program shall remain the responsibility of, and be performed by, persons in the United States who are accessible to, and subject to oversight and supervision by, the Secretary of the Treasury and the appropriate Federal functional regulator. The proposed rule would incorporate this statutory requirement into the AML/CFT program rule by restating that the duty to establish, maintain, and enforce the AML/CFT program must remain the responsibility of, and be performed by, persons in the United States who are accessible to, and subject to the oversight and supervision by, the relevant Agency.

5. Customer Identification Program
There are no changes to the current CIP requirements. The proposed rule would only move them to a separate section.

Request for Comment

The proposed rule consists of twenty-seven questions separated into the following categories:

Incorporation of AML/CFT Priorities
Risk Assessment Process
Updating the Risk Assessment
Effective, Risk-Based, and Reasonably Designed
Other AML/CFT Program Requirements
Innovative Approaches
Board Approval and Oversight; and
Duty to establish, maintain, and enforce an AML/CFT Program in the United States

Financial Crimes Enforcement Network (FinCEN): Anti-Money Laundering and Countering the Financing of Terrorism Programs

NASCUS Legislative and Regulatory Affairs Department
July 15, 2024

NASCUS summary of NCUA’s proposal can be found here.

Background

FinCEN has proposed a rule to “strengthen and modernize financial institutions’ anti-money laundering and countering the financing of terrorism (AML/CFT) programs according to the Anti-Money Laundering Act of 2020 (AML Act).”

FinCEN intends for these updates to:

Reinforce the risk-based approach for AML/CFT programs;
Make AML/CFT programs more dynamic and responsive to evolving ML/TF risks;
Ultimately render AML/CFT programs more effective in achieving the purposes of the BSA; and
Reinforce the focus of AML/CFT programs toward a more risk-based innovation, and outcomes-oriented approach to combating illicit finance activity risks and safeguarding national security.

The Bank Secrecy Act (BSA) requires financial institutions to establish AML/CFT programs that include (at a minimum):

Development of internal policies, procedures, and controls;
The designation of a compliance officer;
Ongoing employee training programs; and
An independent audit function to test programs.

The AML Act of 2020 amended the BSA in several ways. This proposal addresses changes to the existing AML program requirements, including inserting “countering the financing of terrorism” (CFT) when describing AML program requirements. The proposed rule applies broadly to any “financial institution” as defined in 31 CFR §1010.100(t) and (ff).[1]

Comments on the proposed rule are due by September 3, 2024.

Summary

What is Changing?

Purpose Statement

The NPRM would add a new policy statement describing the purpose of an AML/CFT program under the newly proposed program rules. The NPRM proposes the following policy statement:

“The purpose of this section is to ensure that a financial institution implements an effective, risk-based, and reasonably designed AML/CFT program to identify, manage, and mitigate illicit finance activity risks that: complies with the Bank Secrecy Act and the requirements and prohibitions of this chapter; focuses attention and resources in a manner consistent with the risk profile of the financial institution; may include consideration and evaluation of innovative approaches to meet its AML/CFT compliance obligations; provides highly useful reports or records to relevant government authorities; protects the financial system of the United States from criminal abuse; and safeguards the national security of the United States, including by preventing the flow of illicit funds in the financial system.”

Risk Assessment Process:

AML/CFT Priorities

The proposal makes numerous changes to the overall risk assessment process. It codifies the requirement that all financial institutions must have a risk assessment as part of an effective, risk-based, and reasonably designed AML/CFT program. The risk assessment is intended to serve as the foundation for the overall AML/CFT program and must contain certain components.

Risk assessments are already common practice among credit unions and are existing expectations of regulators and examiners, however, they are not “required” by regulation. The proposed rule now explicitly expresses a risk assessment as a requirement. The risk assessment will require several components.

The first required component of the risk assessment is the inclusion of the AML/CFT priorities. Section 6101 of the AML Act requires FIs to review and incorporate the AML/CFT priorities set by FinCEN. The NPRM indicates that the inclusion of the AML/CFT priorities ensures that FIs understand risk exposure in important areas at a national level.

In 2021, FinCEN issued the AML/CFT priorities. As a reminder, these eight priorities are:

Corruption;
Cybercrime;
Domestic and international terrorist financing;
Fraud;
Transnational criminal organizations;
Drug trafficking organizations;
Human trafficking and human smuggling; and
Proliferation financing.

The proposed rule provides minimal detail on how FIs should consider the priorities in their risk assessment. While the proposal indicates flexibility in documenting the results of a risk assessment, the risk assessment will now be subject to greater examiner scrutiny.

Business Activities

The risk assessment must also include the risks unique to FIs based on business activities including:

Products;
Services;
Distribution channels;
Customers;
Intermediaries; and
Geographic locations

Many of these items are already incorporated into FI risk assessment processes, however, unique to this proposal from current processes is the attention on “distribution channels” and intermediaries” as potentially new concepts for certain FIs.

A “distribution channel” refers to the methods and tools used to open accounts, e.g., online account opening.
An “intermediary” refers to non-customer third-party relationships that allow financial activities by, at, or through a FI, that facilitates the introduction or processing of financial transactions, financial products and services, and customer-related financial activities.

The proposal provides that FIs may use sources for determining potential risks such as information from 314(a) or (b) information sharing programs, payment transactions with other FIs that have been flagged or returned due to AML/CFT concerns, or feedback from regulators and law enforcement. It is important to note that the NPRM states any “exercise of discretion or judgment” with the analysis performed in connection with the risk assessment process should be documented and subject to oversight and governance. The proposal also indicates “information obtained by marketing and business components of the FI can be relevant to the risk assessment created by the compliance component.”

BSA Reports

The proposal indicates the last required component of a risk assessment is the review of any reports filed by FIs pursuant to 31 CFR Chapter X. This may include Suspicious Activity Reports (“SARs”), Currency Transaction Reports (CTRs), Forms 8300, and any other relevant BSA reports.

FinCEN believes the review of these reports may assist FIs in understanding patterns or trends to incorporate into the risk assessment.

Frequency

FIs are already updated risk assessments periodically with the introduction of new products and services or the opening of a new branch location. The proposed rule would require, at a minimum, FIs update their risk assessment using the process outlined above, when there are material changes in their products, services, distribution channels, customers (members), intermediaries, and geographic locations.

Internal Policies, Procedures, and Controls

The proposed rule would require AML/CFT Programs to “reasonable manage and mitigate ML/TF risks to the FI through internal policies, procedures, and controls that are “commensurate with those risks and ensure ongoing compliance with the BSA and its implementing regulations.” The Bank Secrecy Act requires FIs to develop “internal policies, procedures, and controls” therefore this should not be a significant lift for FIs to update, with the focus on FIs managing and mitigating illicit activity risks.

Of note – the proposed rule provides financial institutions with the regulatory flexibility to consider innovative approaches to comply with BSA requirements, including determining not only the total amount of resources but also the nature of those resources. The proposed rule’s inclusion of innovation reflects one of the AML Act’s key purposes of “encourage[ing] technological innovation and the adoption of new technology by financial institutions to more effectively counter money laundering and financing of terrorism.”

AML/CFT Officer

The proposed rule would provide that an AML/CFT program must designate one or more qualified individuals to be responsible for coordinating and monitoring day-to-day compliance with the requirements and prohibitions of the BSA and FinCEN’s implementing regulations. With this proposal, FinCEN is updating the reference in current regulation from “BSA officer” to “AML/CFT officer” to formally reflect the CFT considerations for this role under section 6101 of the AML Act. The proposal also states for the AML/CFT program to be effective, the AML/CFT officer must be “qualified.” Whether an individual is qualified will depend, in part, on the FI’s ML/TF risk profile, as identified by the results of the risk assessment process.

In addition, the AML/CFT officer’s position in the financial institution’s organizational structure must enable the AML/CFT officer to effectively implement the financial institution’s AML/CFT program. Importantly, an AML/CFT officer should have decision-making capability regarding the AML/CFT program and sufficient stature within the organization to ensure that the program meets the applicable requirements of the BSA.

Training, Documentation of AML/CFT Program, and Board Oversight

The proposed rule would amend the current training requirements to provide that, to be effective, risk-based, and reasonably designed, an AML/CFT program would need to include an ongoing employee training program that is also risk-based. The training program would be focused on areas of risk as identified by the risk assessment process and the frequency of training would be dependent on an FIs risk profile. Additionally, the language in the proposed rule shifts slightly to require “ongoing employee training” whereas current rules are directed at “appropriate persons or appropriate personnel.”

Although not a new requirement to some FIs, the NPRM requires documentation of the AML/CFT program. In addition, the AML/CFT program must be approved by and overseen by the board of directors (or equivalent governing body). This is not a new practice for credit unions. Finally, the proposal contains new oversight requirements, such as governance mechanisms, escalation, and reporting lines, to ensure the board properly oversees the AML/CFT program.

Additional Considerations

The proposed rule provides some additional and broader considerations for an effective risk-based AML/CFT program and framework as intended by the AML Act. For instance, as required under the BSA, FinCEN has considered the goal of extending financial services to the underbanked and facilitating financial transactions while preventing criminals from abusing financial services networks. With the proposal’s emphasis on risk-based AML/CFT programs, FinCEN is seeking to avoid a one-size-fits-all approach to customer risk that can lead to financial institutions declining to provide financial services to entire categories of customers.

Concerning enhanced feedback by law enforcement to FIs – another goal of the AML Act – the NPRM acknowledges the importance of such feedback and lists prior efforts by FinCEN to engage with industry groups but does not propose concrete regulations specifically addressing feedback from the government. Rather, the proposed rule suggests that FinCEN will continue its outreach programs and that the focus on the AML/CFT Priorities will facilitate such efforts.

The federal banking regulators have issued a proposal and request for comment to update their requirements for supervised institutions to establish, implement, and maintain effective, risk-based, and reasonably designed AML/CFT programs. The amendments are “intended to align with FinCEN’s proposal.

Request for Comment

The proposed rule includes forty-five questions on specific areas of the proposal under the following categories:

Purpose Statement
Incorporation of AML/CFT Priorities
Risk Assessment Process
Updating the Risk Assessment
Effective, Risk-Based, and Reasonably Designed
Metrics for Law Enforcement Feedback
De-Risking and Financial Inclusion
Other AML/CFT Program Components
Duty To Establish, Maintain, and Enforce an AML/CFT Program in the United States
Innovative Approaches
Board Approval and Oversight
Technical Updates
Implementation

[1] The definition of “financial institution includes: Banks, Casinos, Money Service Businesses (MSBs), Brokers or dealers in securities, Mutual funds, Insurance companies, Futures commission merchants, Dealers in precious metal, stones, or jewels, Credit card system operators, Loan or finance companies, Housing GSEs

NASCUS Summary re: CFPB Interim Final Rule on Small Business Lending Under the ECOA; Extension of Compliance Dates

12 CFR Part 1002

The Consumer Financial Protection Bureau (CFPB) is amending Regulation B to extend the compliance dates sets forth in its 2023 small business lending rule and to make other date-related conforming adjustments.

The Interim Final Rule is effective as of August 2, 2024. Comments must be received on or before August 2, 2024. The rule can be found here.

Summary

Dodd Frank amended the Equal Credit Opportunity Act (ECOA) to require that financial institutions collect and report to the CFPB certain data regarding applications for credit for women-owned, minority-owned and small businesses. Section 1071’s statutory purposes are to (i) facilitate enforcement of fair lending laws, and (ii) enable communities, governmental entities, and creditors to identify business and community development needs and opportunities of women-owned, minority-owned and small businesses.

In March 2023, the CFPB issued a final rule to implement Section 1071. The US District Court for the Southern District of TX issued an order to temporarily enjoin the 2023 final rule pending the Supreme Court’s ruling in Community Financial Services Association of America v. CFPB. The court’s order stayed all deadlines for compliance with the requirements of the 2023 final rule. On May 16, 2024, the Supreme Court reversed the Fifth Circuit’s ruling in CFSA.

The CFPB issued the interim final rule to extend the compliance dates set forth in the 2023 final rule and making conforming adjustments. The compliance dates are being extended 290 days to compensate for the period the rule stayed (July 31, 2023 to May 16, 2024).

The rule divided institutions into three categories and assigned compliance dates according to those tiers. Origination requirements for the tiers are as follows:

Tier 1 institutions are those that originated at least 2500 covered transactions in both calendar years 2022 and 2023.
Tier 2 institutions are those that originated at least 500 covered transactions in both calendar years 2022 and 2023.
Tier 3 institutions are those that originated at least 100 covered transactions in both calendar years 2022 and 2023.

Additionally, the final rule permits financial institutions to use its originations of covered credit transactions in each of calendar years 2023 and 2024, rather than those in 2022 and 2023 to determine its compliance date.

Compliance and Data Submission Dates:

Tier 1 institutions now have a compliance date of July 18, 2025. Tier 2 institutions now have a compliance date of January 16, 2026 and Tier 3 institutions now have a compliance date of October 18, 2026.
Tier 1 institutions will make their first data submission by June 1, 2026; Tier 2 and Tier 3 by June 1, 2027.

U.S. Department of Treasury Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector

NASCUS Legislative and Regulatory Affairs Department
July 1, 2024

The U.S. Department of Treasury has issued a request for information (RFI) seeking comment on the uses, opportunities, and risks presented by developments and applications of artificial intelligence (AI) within the financial sector.

With this RFI, Treasury acknowledges it is working to catch up with the use of AI in this sector and must quickly learn more about AI and how the financial services industry is utilizing it. The RFI covers a wide range of issues, including anti-money laundering (AML) and anti-fraud compliance, fair lending, and consumer protection concerns – with a heavy focus on those protections concerning bias.

Comments are due on the RFI by August 12, 2024.

Summary

Background: Treasury’s previous work surrounding AI

The RFI summarizes Treasury’s previous engagement with stakeholders in developing an understanding of the developments and application of AI within the financial services space. Previous work includes:

November 2022 report, Assessing the Impact of New Entrant Non-bank firms on Competition in Consumer Finance Markets. This report found many non-bank firms were using AI to expand their capabilities and service offerings, creating new data privacy and surveillance risks. The report also identified concerns related to bias and discrimination in the use of AI in financial services including “challenges and explainability” – the ability to understand a model’s output and decisions, or how the model establishes relationships based on the model input – and ensuring compliance with fair lending requirements.
December 2023 RFI soliciting input on developing a financial inclusion strategy. The strategy included questions related to the use of AI in the provision of consumer financial services and financial inclusion.
March 2024 report on AI and cybersecurity, which identified opportunities and challenges that AI presents to the security and resiliency of the financial services sector. This report also outlines next steps to address AI-related operational risk, cybersecurity, and fraud challenges.
2024 National Strategy for Combating Terrorist and Other Illicit Financing, which found that “innovations in AI, including machine learning and large language models such as generative AI, have significant potential to strengthen anti-money laundering/countering the financing of terrorism (AML/CFT) compliance by helping financial institutions analyze large amounts of data and more effectively identify illicit finance patterns, risks, trends, and typologies.”
December 2018 Joint Statement on Innovative Efforts to Combat Money Laundering and Terrorist Financing issued by FinCEN and the federal banking agencies, “which encouraged banks to use existing tools or adopt new technologies, including AI, to identify and report money laundering, terrorist financing, and other illicit financial activity.”

The RFI also refers to FinCEN’s discussions through Exchange events and the Bank Secrecy Act Advisory Group (BSAAG) surrounding AI and its use for detecting illicit financial activity and observes that Section 6209 of the AML Act of 2020 requires Treasury to issue a rule specifying standards for testing technology and related internal processes designed to facilitate effective compliance with the BSA by financial institutions. We are still awaiting rulemaking under Section 6209.

Current Request for Information

“Financial Institution” for purposes of this RFI includes not just traditional FIs covered by the Bank Secrecy Act (BSA), but also fintech, and “any other company that facilitates or provides financial products or services under the regulatory authority of the federal regulators and state financial or securities regulators.”

The RFI utilized the definition of AI outlined in 15 U.S.C. §9401(3):

[A] machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations or decisions influencing real or virtual environments. Artificial intelligence systems use machine and human-based inputs to perceive real and virtual environments; abstract such perceptions into models through analysis in an automated manner; and use model inference to formulate options for information or action.

With this RFI, Treasury seeks to identify what types of AI models and tools FIs are currently using. Treasury is specifically interested in gaining insights into the use of AI by FIs including but not limited to the following areas:

Provision of products and services – how FIs are using AI to assist in decisions related to offering financial products and services;
Risk management – how FIs are using AI or what are the potential uses of AI for managing risk including credit risk, market risk, operational, fraud, cyber, compliance, and reputation risk, as well as interest rate, liquidity, model risk, legal risk, and even asset-liability management;
Capital markets – how are FIs using AI to assist in capital markets activities, investments, etc.;
Internal operations – how FIs use AI to manage internal operations, payroll, training, software development;
Customer service – how FIs use AI in customer management, including complaint handling;
Regulatory compliance – how FIs are using AI to manage regulatory requirements, BSA/AML requirements for example;
Marketing – how are FIs using AI to market to individuals, groups, etc.

Questions:

The RFI consists of 19 questions broken into three categories with a series of subcategories surrounding four specific topics related to AI in financial institutions. The four topics are potential opportunities and risks; explainability and bias; consumer protection and data privacy; and third-party risk management.

General Use of AI in Financial Services
Under this category, Treasury is interested in how FIs are using or exploring the use of AI in financial services as discussed above. Treasury looks to understand the types of AI being used, specifically any developments made to existing AI and emerging AI technologies, and how they are developed and deployed by financial institutions. Finally, Treasury is interested in gaining insights into the general accessibility of AI.
Actual and Potential Opportunities and Risks Related to Use of AI in Financial Services
This section consists of 12 questions specific to opportunities and risks related to the use of AI in financial services. The 12 questions are separated into a series of subcategories seeking feedback surrounding:
1. Actual and Potential Opportunities and Benefits of AI in Financial Services
2. Actual and Potential Risks and Risk Management Oversight of AI – Explainability and Bias
3. Fair Lending, Data Privacy, Fraud, Illicit Finance, and Insurance; and
4. Third-Party Risks
Further Actions
Under this final category, Treasury asks 2 additional questions seeking to identify what actions are necessary to promote responsible innovation and competition concerning the use of AI in financial services and to what extent differences in jurisdictional approaches inside and outside the United States pose concerns for management of AI-related risks.

NASCUS Summary re: CFPB Request for Information Regarding Fees Imposed in Residential Mortgage Transactions
CFPB-2024-0021

The Consumer Financial Protection Bureau issued a Request for Information (RFI) seeking comment from the public related to fees charged by providers of mortgages and related settlement services.

Comments are due by August 2, 2024.

Summary

The Bureau notes that mortgages come with associated fees and costs, referred to as “closing costs,” that can significantly impact the costs of a home purchase. According to the Bureau, closing costs have risen sharply with the median total loan costs increasing over 36% on home purchase loans between 2021 and 2023.

These increased costs, along with increased home prices and interest rates, have placed increased pressure on borrowers’ budgets, contributing to a lack of access to credit and decreased home affordability. The Bureau also noted that lenders are also impacted by rising closing costs such as increased costs related to credit scores, credit report and employment verification.

The RFI looks at the impact of several loan costs related to “required services” such as origination fees and fees related to settlement services.

Comments Requested:

The Bureau is seeking input from the public on the impact closing costs have on borrowers and the mortgage market, including the degree to which they add overall costs or otherwise cause borrower harm. The Bureau is interested in hearing from consumers, industry participants, social services organizations, small business owners, consumer rights and advocacy organizations, legal aid attorneys, academics and researchers, and State and local governments.

The Bureau welcomes stakeholders to submit stories, data and information about mortgage closing costs. The Bureau has issued the following questions. However, they are interested in any comments submitted related to mortgage closing costs.

Are there particular fees that are concerning or cause hardships for consumers?
Are there any fees charged that are not or should not be necessary to close the loan?
Provide data or evidence on the degree to which consumers compare closing costs across lenders
Provide data or evidence on the degree to which consumers shop for closing costs across settlement providers
How are fees currently set? Who profits from the various fees? Who benefits from the service provided? What leverage or oversight do lenders have over third-party costs that are passed onto the consumer?
Which closing costs have increased the most over the past several years? What is the cause of such increases? Do they differ for purchase or refinance? Please provide data to support if possible.
What is driving the recent price increases of credit reports and credit scores? How are different parts of the credit report chain (credit score provider, national credit reporting agencies, reseller) contributing to this increase in costs? What competitive forces are or can be brought to bear on these costs? What are the impacts on consumers of the increased costs?
Would lenders be more effective at negotiating closing costs than consumers? Are there reports or evidence that are relevant to the topic?
What studies or data are available to measure the potential impact closing costs may have on overall costs, housing affordability, access to homeownership or home equity?

Decennial Notice of Regulatory Review and Request for Comment
NCUA: “Applications and Reporting” and “Powers and Activities”

NASCUS Legislative and Regulatory Affairs Department
June 24, 2024

On May 23, 2024, the NCUA Board approved a voluntary regulatory review and request for comment. The Economic Growth and Regulatory Paperwork Reduction Act of 1996 (EGRPRA) requires the FFIEC and federal bank regulatory agencies to review their regulations every 10 years to identify any outdated, unnecessary, or unduly burdensome regulations applicable to insured depository institutions. While this statute does not apply to the NCUA, the agency is voluntarily participating in this review process.

Over the next two years, the NCUA will publish four Federal Register notices each requesting comment on multiple categories or regulations. This first notice requests comments on regulations concerning “Applications and Reporting” and “Powers and Activities.”

Comments on the voluntary regulatory review are due on or before August 21, 2024.

Summary

Due to the unique circumstances of federally insured credit unions and their members, the NCUA Board is issuing a separate request from the other agencies, including issues unique to credit unions. In previous decennial reviews, the Board developed and published for comment 10 categories of the NCUA’s regulations. The Board is following the previous reviews and is utilizing the same 10 categories in this multi-year review. The categories are:

Agency Programs;
Applications and Reporting;
Capital;
Consumer Protection;
Corporate Credit Unions;
Directors, Officers and Employees;
Anti-Money Laundering and Bank Secrecy Act;
Powers and Activities;
Rules of Procedure; and
Safety and Soundness

The first of four requests for comment NCUA is publishing addresses the following categories of NCUA’s regulations:

Applications and Reporting; and
Powers and Activities

These two categories include the following regulations for which NCUA is seeking comment:

[kp_table]

CATEGORY OF REGULATION	SUBJECT	REGULATION CITE	APPLIES TO FISCUS
1. APPLICATIONS AND REPORTING
	Change in official or senior executive officer in credit unions that are newly chartered or in troubled condition	12 CFR 701.14	Yes, by reference in §741.205
	Federal credit union chartering, field of membership modifications, and conversions	12 CFR 701.1; Appendix B to Part 701	FCUs only
	Federal credit union bylaws	12 CFR 701.2; Appendix A to Part 701	FCUs only
	Fees paid by Federal credit unions	12 CFR 701.6	FCUs only
	Bank Conversions and Mergers	12 CFR 708a	FCUs only
	Mergers of Insured Credit Unions into Other Credit Unions; Voluntary Termination or Conversion of Insured Status	12 CFR 708b	Yes, by reference in §741.208
	Applications for insurance	12 CFR 741.0; 741.3; 741.4
	Financial, statistical, and other reports	12 CFR 741.6	Yes
	Conversion to a State-chartered credit union	12 CFR 741.7	Yes
	Purchase of assets and assumption of liabilities	12 CFR 741.8	Yes
2. POWERS AND ACTIVITIES
2a. Lending, Leasing, and Borrowing
	Loans to members and lines of credit to members Loan participations	12 CFR 701.21; 12 CFR 701.22	Yes, by reference in §741.225 (Loan participations)
	Purchase, sale, and pledge of eligible obligations	12 CFR 701.23	FCUs only
	Borrowed funds	12 CFR 701.38	FCUs only
	Statutory lien	12 CFR 701.39	FCUs only
	Leasing	12 CFR 714	FCUs only
	Member Business Loans; Commercial Lending	12 CFR 723	Yes, by reference in §741.203
	Maximum borrowing	12 CFR 741.2	Yes
2b. Investments and Deposits
	General Investment and Deposit Activities Derivatives	12 CFR 703 Subpart A; 12 CFR 703 Subpart B	Yes, by reference in §741.219
	Loans to credit unions (subordinated debt)	12 CFR 701.25	Yes, by reference in §741.227
	Federal credit union occupancy and disposal of acquired and abandoned premises	12 CFR 701.36	FCUs only
	Credit Union Service Organizations (CUSOs)	12 CFR 712	Yes, by reference in §741.222
	Payment on shares by public units and nonmembers	12 CFR 701.32	Yes, by reference in §741.204
	Designation of low-income status	12 CFR 701.34	Yes, by reference in §741.204
	Share, share draft, and share certificate accounts	12 CFR 701.35	FCUs only
	Treasury tax and loan depositories; depositories and financial agents of the Government	12 CFR 701.37	FCUs only
	Refund of interest	12 CFR 701.24	FCUs only
	Trustees and Custodians of Certain Tax-Advantaged Savings Plans	12 CFR 724	FCUs only
2c. Miscellaneous Activities
	Incidental Powers Charitable contributions and donations; charitable donation accounts	12 CFR 721.12; 12 CFR 721.3(b)	FCUs only
	Credit union service contracts	12 CFR 701.26	FCUs only
	Services for nonmembers within the field of membership	12 CFR 701.30	FCUs only
	Suretyship and guaranty	12 CFR 701.20	Yes, by reference in §741.221
	Foreign branching	12 CFR 741.11	Yes

[/kp_table]

NASCUS Summary re: CFPB Request for Information Regarding Fees Imposed in Residential Mortgage Transactions
CFPB-2024-0021

The Consumer Financial Protection Bureau issued a Request for Information (RFI) seeking comment from the public related to fees charged by providers of mortgages and related settlement services.

Comments are due by August 2, 2024. The RFI can be accessed here.

Summary

The RFI looks at the impact of several loan costs related to “required services” such as origination fees and fees related to settlement services.

Comments Requested:

Are there particular fees that are concerning or cause hardships for consumers?
Are there any fees charged that are not or should not be necessary to close the loan?
Provide data or evidence on the degree to which consumers compare closing costs across lenders
Provide data or evidence on the degree to which consumers shop for closing costs across settlement providers
How are fees currently set? Who profits from the various fees? Who benefits from the service provided? What leverage or oversight do lenders have over third-party costs that are passed onto the consumer?
Which closing costs have increased the most over the past several years? What is the cause of such increases? Do they differ for purchase or refinance? Please provide data to support if possible.
What is driving the recent price increases of credit reports and credit scores? How are different parts of the credit report chain (credit score provider, national credit reporting agencies, reseller) contributing to this increase in costs? What competitive forces are or can be brought to bear on these costs? What are the impacts on consumers of the increased costs?
Would lenders be more effective at negotiating closing costs than consumers? Are there reports or evidence that are relevant to the topic?
What studies or data are available to measure the potential impact closing costs may have on overall costs, housing affordability, access to homeownership or home equity?

NASCUS Summary re: CFPB Interpretive Rule on Application of Regulation Z to Digital User Accounts that Access Buy Now, Pay Later Loans

12 CFR Part 1026

The Consumer Financial Protection Bureau (CFPB) issued an interpretative rule to address the applicability of subpart B of Regulation Z to lenders that issue digital user accounts to access credit, including those lenders that market loans as “Buy Now, Pay Later.”

The rule is applicable as of July 30, 2024. The Bureau is taking comments on the rule until August 1, 2024.
The rule can be found here.

Summary:

The CFPB’s interpretative rule describes how these lenders meet the criteria for being “card issuers” for purposes of Regulation Z. Lenders that extend credit are also “creditors” subject to subpart B of Regulation Z, including those provisions governing periodic statements and billing disputes. The Bureau published this rule to clarify existing obligations for market participants with specific business practices.

Definitions

Buy Now, Pay Later (BNPL) refers to a consumer loan for a retail transaction that is repaid in four (or fewer) interest-free installments and that does not impose a finance charge. The loan generally requires an initial down payment of 25 percent, followed by three additional installments due every two weeks.

Legal/Regulatory Analysis

Under the rule’s legal analysis, lenders that issue digital user accounts used by consumers (from time to time) to access credit products to purchase goods/services are “card issuers” under Regulation Z, including when those products are marketed as BNPL. Such digital user accounts are “credit cards” under Regulation Z. Traditional BNPL products are closed-end loans payable in four or fewer installments without a finance charge, used to make purchases on credit. As a result, the rule concludes that BNPL loans are subject to some, but not all, of Regulation Z’s credit card regulations. The rule goes on to say that digital user accounts that consumers use to access BNPL credit mimic conventional credit cards. They meet the regulatory definition of “credit cards” as defined in 12 CFR 1026.2. Lenders that issue such digital user accounts are “card issuers” under 12 CFR 1026.2(a)(7) and “creditors” for purposes of subpart B of Regulation Z. However, traditional BNPL products do not meet the definition of “open-end credit” as defined in 12 CFR 1026.2 or of a “credit card account under an open-end (non-home secured) consumer credit plan.”

As a result, lenders that issue digital user accounts to access BNPL credit are subject to regulations appearing in subpart B of Regulation Z, including provisions governing credit card dispute and refund rights. The Bureau notes that Section 1026.2 “specifically states that subpart B also applies to credit that is not open end if, as with BNPL, the credit is not subject to a finance charge and is not payable by written agreement in more than four installments.” Further, the Bureau states that “Congress expressly instructed the Bureau to apply open-end credit regulations to this form of credit that is not open end.” In addition, the rule notes that the Bureau is required by the Truth in Lending Act (TILA)to apply open-end credit requirements to card issuers that extend credit with no finance charge that is payable in four or fewer installments, to the extent appropriate, even though the requirements of the open-end credit provisions are by their terms applicable only to creditors offering open-end credit plans.

The CFPB affirms via this interpretative rule that BNPL lenders that extend credit – even though that credit is not subject to a finance charge and is not payable by written agreement in more than four installments—are creditors subject to subpart B of Regulation Z, including those provisions governing costs of credit disclosures and billing disputes.

U.S. Department of Treasury Summary: 2024 National Strategy for Combatting Terrorist and Other Illicit Financing

NASCUS Legislative and Regulatory Affairs Department
May 23, 2024

With little fanfare, on May 16, 2024 the U.S. Department of Treasury issued its 2024 National Strategy for Combatting Terrorist and Other Illicit Financing. The document is 55 pages and according to Treasury’s press release, “addresses the key risks from the 2024 National Money Laundering, Terrorist Financing, and Proliferation Financing Risk Assessments.”

The document is extensive and discusses a lengthy list of topics. At a high level, it identifies four “priorities” and 15 “supporting actions” to support the four priorities. Each of the priorities and supporting actions is to support the goals of the U.S. Anti-Money Laundering/Countering Financial Terrorism regime.

The four priority recommendations according to the press release and report are:

1Close legal and regulatory gaps in the U.S. AML/CFT framework that illicit actors exploit to anonymously access the U.S. financial system by operationalizing the beneficial ownership information registry for law enforcement, national security, and intelligence use; finalizing rules related to the residential real estate and investment adviser sectors; and assessing other sectors that may be vulnerable to illicit finance;
Promote a more effective and risk-focused U.S. AML/CFT regulatory and supervisory framework for financial institutions to make them more efficient and effective in preventing illicit finance by providing clear compliance guidance, sharing information appropriately, and ensuring adequate resourcing for supervisory and enforcement functions;
Enhance the operational effectiveness of law enforcement, other U.S. government agencies, and international partnerships in combating illicit finance so threat actors cannot find safe havens for their operations; and
Realize the benefits of responsible technological innovation in the United States by developing new payments technology, supporting the use of new mechanisms for private sector compliance, and utilizing automation and innovation to find novel ways to combat illicit finance.

The report also includes a graphic that details the primary goals, priorities, and supporting actions.

While these are laudable goals the report also leads one to question how Treasury will accomplish these goals as the document acknowledges the lack of government resources, particularly when it comes to monitoring non-bank financial institutions, which are becoming a much greater focal point.

Financial Crimes Enforcement Network: Financial Trend Analysis: Elder Financial Exploitation

NASCUS Legislative and Regulatory Affairs Department
May 15, 2024

FinCEN issued a Financial Trend Analysis focusing on patterns and trends identified in Bank Secrecy Act (BSA) data linked to Elder Financial Exploitation (EFE). In developing this analysis FinCEN examined BSA reports filed between June 15, 2022, and June 15, 2023, using the key term referenced in FinCEN’s June 2022 EFE Advisory or checking “elder financial exploitation” as a suspicious activity type. This amounted to 155,415 filings, indicating roughly $27 billion in EFE-related suspicious activity.

Summary

In this latest trend analysis, FinCEN identified two predominant categories of victimization across EFE-related BSA filings:

Elder scams where the victim does not know the perpetrator and;
Elder theft, where the victim knows the perpetrator.

The report also identified that banks filed 72% of all EFE-related BSA filings. Two banks reported 33 percent, or 50,670 BSA filings, of the filings in the dataset obtained. Credit unions accounted for 8 percent of filings.

Financial institutions filed more elder scam-related BSA filings than elder theft-related
Account takeover was the most frequently cited EFE typology with the majority of elder scam-related filings also referenced account takeover activity.
Adult children were identified as the most frequent elder theft-related perpetrators.
Perpetrators in elder theft relied on mostly unsophisticated means to steal funds that minimized direct contact with financial institution employees.

In instances of elder theft, filers reported an average suspicious activity amount of $98,863 and a median amount of $23,762. For elder scams, filers reported an average suspicious activity amount of $129,483 and a median amount of $33,499.

The report notes the methods of elder theft varied, but generally relied on cash withdrawals, card transactions, online bill pay, and funds transfers. Furthermore, the analysis details that in elder scams, money was most commonly transmitted through checks and domestic wires.

FinCEN’s manual review of each filing indicated perpetrators used the following scams:

Impersonation – 8%
Romance scams – 9%
Tech support – 10%
Account takeover – 22%
Scam unidentified – 23%
41 Other scam types – 28%

Reporting

FinCEN recommends that if a credit union suspects EFE with a member it should file a Suspicious Activity Report (“SAR”) as well as refer customers who may be victims of EFE to the Department of Justice’s National Elder Fraud Hotline at 833-FRAUD-11 or 833-372-8311 for assistance with reporting suspected fraud to the appropriate government agencies.

In addition to FinCEN’s recommendations, credit unions should review individual state laws and associated reporting requirements.

Takeaways

This report shines a light on EFE as a growing problem and one that is showing no signs of slowing down. Financial institutions should develop internal protocols and controls similar to the following steps to protect against EFE.

Offering age-friendly services to older consumers, including protective opt-in account features such as withdrawal limitations, alerts, and transaction restrictions for merchant categories; and
Ask detailed questions when the elder account holder requests account transactions that are unusual for the account (i.e., wire transfers and large cash withdrawals) and monitor account activity to help prevent and detect scams and theft.

Further, FIs must train their employees to prevent, detect, and respond to EFE. The training should include descriptions of indicators of potential EFE and preventative measures and action steps for responding to and reporting Elder Financial Exploitation.

Advanced Notice of Proposed Rulemaking and Request for Comment
NCUA Part 749: Records Preservation Program and Appendices – Record Retention Guidelines; Catastrophic Act Preparedness Guidelines

NASCUS Legislative and Regulatory Affairs Department
May 8, 2024

On April 24, 2024, the NCUA Board issued an Advanced Notice of Proposed Rulemaking (ANPR) soliciting comments on ways the agency can improve and update its records preservation program regulations and accompanying guidance under Part 749. The NCUA is also seeking input from stakeholders on the content of the regulation, which has not been updated in 15 years, as well as feedback on the structure of the regulation due to the combination of regulatory requirements and guidance.

Comments on the proposed rule are due on or before June 24, 2024.

Summary

Part 749 requires all federally insured credit unions (FICU) to maintain a records preservation program to identify, store, and reconstruct vital records if a credit union’s records are destroyed. The regulation also requires a FICU’s vital records program to be in writing and include procedures for maintaining duplicate records at an offsite location.

Under the current regulation, ‘vital records’ are defined as:

A list of share, deposit, and loan balances for each member’s account as of the close of the most recent business day with enough information to locate each member, such as address and phone number;
A financial report lists all of the credit union’s assets and liability accounts and bank reconcilements as of the previous month-end;
A list of the credit union’s accounts at financial institutions, insurance policies, and investments along with related contact information, current as of the previous month-end;
Emergency contact information for employees, officials, regulatory offices, and vendors used to support vital records.

Appendix A to Part 749 provides ‘suggested guidelines’ for record retention and advises several additional sets of records be retained permanently. These records include:

Official records of the credit union such as:
- Charter, bylaws, and amendments;
- Certificates or licenses to operate.
Key operational records such as:
- Minutes of membership meetings, board meetings, credit committee, and supervisory committees;
- One copy of the financial report, NCUA Form 5300 or 5310, and Credit Union Profile Report;
- One copy of each supervisory committee annual audit report and attachments;
- Supervisory committee records of account verification;
- Applications for membership and joint share account agreements;
- Journal and cash record;
- General ledger;
- Copies of member periodic statements
- Bank reconcilements; and
- Listing of records destroyed.

The interaction between Part 749 and Appendix A has been a point of confusion for credit unions. For example, Appendix A consists of ‘suggested guidelines” for record retention. If a credit union opted to not retain an item listed under these guidelines permanently, what would the repercussions be? There is also confusion between 749 and other parts of NCUA’s regulations that have retention requirements that are not referenced in 749.

The ANPR consists of 20 questions divided into 4 separate categories.

Definitions

A category for definitions, including whether or not there are additional documents not listed that should be considered as “vital records.” Additionally, two questions addressing catastrophic preparedness in Appendix B and recommended changes.

Records Retention Practices

This category consists of 10 questions in which the NCUA seeks to understand current credit union record retention practices and whether Part 749 is properly serving its purpose which is for a credit union to identify, store, and reconstruct vital records in the event it needs to do so.

Additional Guidance

The Board believes the benefit to credit unions in having the guidance in the appendix to the regulatory requirement will enhance access to the guidance and will facilitate compliance. In the part 749 rulemaking, the Board further noted that “including specific words like `recommended’ and `guidance’ means, as a legal matter, that the guidance is just that—guidance—and is not enforceable as a regulation.

The 4 questions in this section ask what guidance would be helpful to better reflect the types of records to be retained under Part 749 as well as ask what provisions in Appendix A or B do not align with Part 749.

Other NCUA Requirements

The final question asks if there are other provisions in the NCUA’s regulations that contain record retention requirements that should be incorporated into Part 749.

Notice and Request for Information and Comment
FinCEN: Customer Identification Program Rule Taxpayer Identification Number Collection Requirement

NASCUS Legislative and Regulatory Affairs Department
Summary prepared April 12, 2024

On March 28^th, 2024, FinCEN issued a request for information (RFI) seeking comment regarding the Customer Identification Program (CIP) Rule requirement that credit unions (and other covered entities) [1] collect a full taxpayer identification number (TIN) before opening an account from an individual and a U.S. person (in most cases, for US citizens, this would be their Social Security Number or SSN). An RFI is not a rulemaking, rather it is an agency seeking background information to help determine if a future rulemaking is necessary.

In this case, FinCEN seeks perspectives on whether allowing credit unions and other covered entities to collect only partial TIN or SSN information would be beneficial.

Comments on the RFI are due on or before May 28, 2024.

Summary and Request for Information

Under the BSA/AML, credit unions are to obtain an individual’s full SSN prior to opening an account as part of the institution’s Customer Identification Process (CIP). Generally, institutions are required to collect the information directly from the member opening the account.

When the rule was first adopted, institutions were exempt from the requirements to collect identifying information including the TIN/SSN directly from the consumer when opening credit card accounts because traditionally, institutions used third party sources to collect SSN information when opening those accounts. When implementing the CIP, FinCEN recognized that common practices in situations when the customer was likely not physically present (like opening a credit card account) practice was to forego asking for the TIN/SSN as potential customers would often be uncomfortable giving out that information in a remote setting. The final CIP rule respected that practice. As a result, credit card accounts, think of Chase, American Express, or Capital One for example, were exempt from the CIP Rule’s information collection requirements and institutions may obtain identifying information from a third-party source, such as a credit bureau.

FinCEN has heard from stakeholders seeking a change to the CIP to allow for partial collection of TIN/SSN for all account openings. The agency also acknowledges advancements in technology and tools that may provide additional means of identifying a consumer.

FinCEN recognizes there are risks and concerns with permitting partial SSN collection at account opening. For example, failing to obtain full SSNs could result in increased identity theft or other fraud. There are also risks of inaccurate third-party data.

For these reasons, FinCEN seeks comments and perspectives on the risks, benefits, and safeguards surrounding the collection of partial SSNs by banks. As part of this RFI FinCEN is also seeking information about current industry practices regarding SSN collection. There are a series of eight questions with additional sub-questions. FinCEN requests that commenters note their highest priorities in their response, along with an explanation of how or why certain suggestions have been prioritized, when possible. You can find the complete list of questions here.

The eight categories of questions include:

Should banks be permitted to collect part or all of a customer’s SSN for a U.S. individual from a third-party source prior to account opening? Should FIs be permitted to collect other customer-identifying information required by the CIP Rule from a third-party source?
If banks were permitted to collect partial SSN information from a customer in the case of a U.S. individual and subsequently use a reputable third-party source to obtain the full SSN prior to account opening, what risks, benefits, safeguards, and due diligence would be conducted.

- This question has a series of ten additional questions specific to overall due diligence.

Regarding the current CIP Rule SSN collection requirement for FIs to collect the full SSN for a U.S. Individual directly from the customer prior to account opening, this question also asks a series of additional questions surrounding:

- The impact of the current requirements on FIs and their customers
- How they impact their AML programs and;
- The risks and benefits of collecting a full SSN directly from the customer.

Regarding current practices by parties not subject to the CIP Rule’s SSN collection requirement (i.e. non-banks) when using third-party sources for SSN collection, this question asks several questions specific to:

- Risks and benefits of using a third-party source for SSN collection;
- The minimum due diligence processes the non-bank typically conducts before contracting third-party sources;
- What on-going due diligence and monitoring is conducted;
- How they ensure the privacy and security of customer data;
- Notification to customers of obtaining their SSN from a third-party source.

Provide any publicly available studies or data points that demonstrate:

- Customer behavior in seeking or avoiding access to financial products or services based on risks associated with a customer providing a full SSN;
- Accuracy and reliability of third-party sources from which SSN information could be acquired;
- Impact on financial crime or other illicit finance activity risks when a customer is not required to provide a full SSN;
- The benefits and risk for non-banks (e.g., employers, retailers, financial service providers, and government agencies) and third-party service providers in obtaining a partial SSN from the customer and then using a third-party source to obtain the customer’s full SSN.

Regarding current CIP practices of all financial institutions, both banks, and non-banks, this question asks a series of questions about:

- Risks identified with the SSN collection requirement and how risks are mitigated;
- Whether FIs rely on documentary and non-documentary methods to verify identity;
- The variations of TIN collection and verification practices;
- Other processes for TIN collection and verification;
- Processes and technologies used for verification; and
- Similarities and differences in the collection and verification practices by FIs between individuals who provide SSNs and legal entities that provide Employer Identification Numbers (EINs).

What are the competitive advantages and disadvantages between banks that are required to collect the full SSN from the customer and those non-banks that collect a partial SSN from the customer and then use a third-party source to obtain the customer’s full SSN?
What types of products/services are impacted by differing regulatory requirements related to SSN collection?

[1] For purposes of this summary banks also refers to credit unions.

NCUA Summary: Anti-Money Laundering and Countering the Financing of Terrorism Program Requirements