By: Joseph Herald

On May 9, 2019, FinCEN issued guidance relating to business customers who deal with money transmission through a substitute for currency and even more specifically those deemed convertible virtual currencies (CVCs) and how those businesses can be defined as an Money Service Business (MSBs).

The 2011 MSB Final Rule clearly defined that persons who accepted or transmitted that which is a substitute for currency, such as virtual currency, would be deemed a money transmitter and would be required (like all money transmitters) to register with FinCEN as an MSB and comply with AML program, recordkeeping, monitoring, and reporting requirements (such as the filing of SARs and CTRs).

The guidance also contains examples of how the money transmitter regulations apply to some of the more common business models that would involve convertible virtual currencies (CVCs) such as natural persons providing CVC money transmission or P2P exchangers (4.1), CVC wallets (4.2), CVC money transmission services provided through electronic terminals (CVC “Kiosks”, “ATMs”, or “Vending Machines”)(4.3), CVC money transmission through decentralized applications (DApps)(4.4), anonymity-enhanced CVC transactions (4.5), payment processing services involving CVC money transmission (4.6), and CVC money transmission performed by internet casinos.

It is highly recommended that all financial institutions, regardless of size, be mindful of the regulatory guidance regarding these types of MSBs. Cryptocurrency is not limited to metro-areas or larger institutions due to the easy obtainability of several types of CVCs. Financial Institutions should begin performing due diligence on their existing customer base and include questions on account opening questionnaires to help anticipate customers who could be engaged in CVC activity.

Finally, FinCEN is expecting that financial institutions who introduce some of these more innovative products and services to an area that is highly regulated (money transmission) will ensure that they will comply with the regulatory framework for such activities before taking these new innovations to market.

The complete guidance may be found at: https://www.fincen.gov/sites/default/files/2019-05/FinCEN%20Guidance%20CVC%20FINAL%20508.pdf

FinCEN also issued an advisory on illicit activity involving CVCs which details out some of the risks posed by these types of currency, the types of marketplaces in which this currency can be abused, valuable information in reporting suspicious activity involving virtual currencies, and some red flag indicators that CVC-focused MSBs could be abusing virtual currencies.
​
​The full advisory can be found at: https://www.fincen.gov/sites/default/files/advisory/2019-05-10/FinCEN%20Advisory%20CVC%20FINAL%20508.pdf

By: Jeremy Clifton, CRCM, CAMS

If your institution offers online account opening, the Making Online Banking Initiation Legal and Easy (MOBILE) Act will possibly affect how your institution retains documentation for CIP purposes. The MOBILE Act officially became law on May 24, 2018 and clarifies that institutions can obtain scanned copies or images of identification cards (e.g. driver’s license or other ID cards) as part of a request to open an account in an online environment. However, the institution is required to delete the image or copy of the ID card after the institution has obtained the required information from the ID card. This will be a change to some institution’s CIP procedures where copies of ID cards were retained for CIP record keeping but remember these rules only apply to accounts initiated via online channels.  As applicable, institutions should consider updating their CIP program to comply with this act.  

The Biggert-Waters Flood Insurance Reform Act of 2012 (the Biggert-Waters Act) amended Federal flood insurance legislation to require the federal regulatory agencies to issue a final rule that directs insured depository institutions to accept private flood insurance.  On February 13, 2019 federal regulatory agencies announced the issuance of a joint final rule to amend their respective regulations regarding loans in special flood hazard areas to incorporate and implement certain provisions regarding private flood insurance.

In general, the final rule requires institutions to accept flood insurance policies that meet the statutory definition of private flood insurance in the Biggert-Waters Act and permits institutions to exercise their discretion to accept flood insurance policies issued by private insurers and flood plans provided by mutual aid societies, even if such policies or coverage do not meet the statutory definition of private flood insurance, as long as certain criteria are met.
The final rule covers three key provisions:

• Mandatory Acceptance of Private Flood Insurance and Compliance Aid
• Discretionary Acceptance of Private Flood Insurance
• Coverage by Mutual Aid Societies

Mandatory Acceptance of Private Flood Insurance and Compliance Aid

The Biggert-Waters Act requires institutions to accept private flood insurance that meets both the statutory definition of private flood insurance and meets the existing mandatory purchase requirement.  The final rule includes a streamlined compliance aid provision to assist institutions with evaluating policies by relying on written assurances from the insurer that a policy satisfies the criteria set out in the Biggert-Waters Act.  This provision allows an institution to conclude that a private flood insurance policy meets the definition of private flood insurance, without further review of the policy, if the following statement is included within the policy or as an endorsement to the policy by the insurer:

“This policy meets the definition of private flood insurance contained in 42 U.S.C. 4012a(b)(7) and the corresponding regulation.”

An institution may also choose not to rely on an assurance statement and conduct its own due diligence to ensure the private policy meets the definition of private flood insurance which is provided in the final rule.

Discretionary Acceptance of Private Flood Insurance 

The final rule provides that institutions may accept private flood insurance policies that do not meet the Biggert-Waters Act's criteria for mandatory acceptance, provided that certain conditions are met. 

Specifically, the final rule permits institutions to accept flood insurance policies issued by private insurers that do not meet the statutory and regulatory definition of private flood insurance if the policy:

1. Provides coverage in the amount required by the flood insurance purchase requirement;
2. Is issued by an authorized insurer that is licensed, admitted, or not disapproved by a state insurance regulator;
3. Covers both the mortgagor(s) and the mortgagee(s) as loss payees, except in the case of a policy that is provided, and for which the premium is paid by a condominium association, cooperative, homeowners association, or other applicable group; and 
4. Provides sufficient protection of the designated loan, consistent with general safety and soundness principles

When using its discretion to accept a non-conforming private insurance policy the financial institution must document its conclusion regarding sufficiency of the protection of the loan in writing.

Coverage by Mutual Aid Societies 
 
The final rule allows institutions to accept certain flood plans provided by mutual aid societies, such as an Amish Aid Plan, when certain conditions are met.  As defined in the final rules, a mutual aid society means an organization whose members share a common religious, charitable, educational, or fraternal bond that covers losses caused by damage to members’ property pursuant to an agreement, including damage caused by flooding if the common bond has a demonstrated history of fulfilling the terms of agreements to cover losses to members’ property caused by flooding. 
 
Pursuant to the final rule, an institution, in satisfaction of the mandatory flood insurance requirement, may accept a plan provided by a mutual aid society, if the institution’s primary Federal supervisory agency has determined that such plans qualify as flood insurance for purposes of the Biggert-Waters Act and the plan:

1. Provides coverage in the amount required by the flood insurance purchase requirement;
2. Covers both the mortgagor(s) and the mortgagee(s) as loss payees; and
3. Provides sufficient protection of the designated loan, consistent with general safety and soundness principles 

When accepting a flood insurance policy issued by a mutual aid society the lending institution must document its conclusion regarding sufficiency of the protection of the loan in writing.
 
Effective Date

The final rule becomes effective on July 1, 2019. As such financial institutions should work diligently to make necessary changes to their policies, procedures and operating systems to ensure compliance by the effective date. 
​
Click on the link below to access the joint final rule in its entirety, for additional information, including the statutory definition of private flood insurance:

https://www.fdic.gov/news/news/press/2019/pr19006a.pdf  

​ By James M. Moore, CRCM
 
One more year has passed, and we are faced with the new challenges of 2019.  Anyone with a compliance background understands there is no such thing as a fresh start for a new year.  The following is a list of reminders and updates to make sure you are heading in the right direction for the New Year. 
 
Deposit Compliance:

• Regulation CC training should have been provided during 2018 and make plans to provide Reg. CC training during 2019.
• Annual privacy training should have been provided for 2018 to all bank personnel and make sure annual privacy training is scheduled for 2019.  Furthermore, ensure that the Board of Directors has received privacy training.
• Ensure annual privacy disclosures will be mailed during 2019 or verify the bank’s exemption status for 2019.   
• Determine the number of remittance transfers under Regulation E from the previous calendar year to ensure the institution has not exceeded the threshold for “normal course of business.”
• Ensure the ID Theft Program administrator has reported to the Board annually on the status of the ID Theft Program.

 Loan Compliance:

• The 2018 HMDA LAR and CRA LAR for large institutions must be submitted by March 1, 2019.
• Check the historic examples for HELOC and/or ARM application disclosures to ensure the most recent 15 years are used in the examples.
• The CRA Public File should be updated by April 1, 2019.
• Check the accuracy of the affiliated business disclosures to ensure all affiliated businesses are disclosed along with the current range of fees and the current ownership interest of each affiliated business.
• The 2019 HOEPA points and fees test will use the following:
  • > 5% of loan amounts of $21,549 or more
  • > lesser of 8% of loan amounts under $21,549 or $1,077
• The 2019 QM points and fees test will use the following:
  • For a loan amount greater than or equal to $107,747: 3% of the total loan amount
  • For a loan amount greater than or equal to $64,648 but less than $107,747: $3,232
  • For a loan amount greater than or equal to $21,549 but less than $64,648: 5% of the total loan amount
  • For a loan amount greater than or equal to $13,468 but less than $21,549: $1,077
  • For a loan amount less than $13,468: 8% of the total loan amount
• The 2019 Truth In Lending threshold increases to $57,200 for loans not secured by real property and private education loans.
• The 2019 “small creditor” threshold is $2.167 billion as of December 31, 2018.
• The 2019 “small loan” exemption for HPML appraisal rules is $26,700.
• If the creditor allows borrowers to shop for any required services for TRID loans, it should update (as necessary) the written list provided with the Loan Estimate to identify at least one available provider for each settlement service for which the consumer is permitted to shop. 
• Ensure that bank personnel have received fair lending and CRA training for 2018.  Further, ensure that the Board of Directors has received annual fair lending and CRA training for 2018.  Training should be planned for 2019.
• CRA asset size thresholds for 2019 are under $321 million for small bank, at least $321 million up to $1.284 billion for intermediate small bank, and $1.284 billion and over for large bank (based on both of the last two calendar years).
• The HMDA asset size threshold for depository institutions for 2019 is $46 million.
• In addition to meeting the above HMDA asset threshold, an institution must have in each of the two preceding calendar years, originated at least 25 or more covered closed-end dwelling secured loans to report closed-end loans.  Dwelling secured open-end lines of credit must be reported in 2019 if a covered institution originated 500 or more covered dwelling secured open-end lines of credit in each of the previous two calendar years.  Ensure a review of 2017 and 2018 transaction data is conducted for 2019 reporting requirements. 
• Ensure procedures are in place for performing escrow account analyses and that the bank has implemented procedures for providing annual escrow account notices.
• Ensure loan officers completed S.A.F.E. Act license renewal procedures.
• Ensure an annual independent S.A.F.E. Act audit has been performed.
• Ensure lenders who receive compensation based on insurance sales (credit life/disability) complete license renewal procedures.
• Ensure the bank has documented whether or not they meet the definition of a small servicer and that documentation of the determination is retained for record retention.
• Ensure the bank has documented whether or not they meet the definition of a small creditor and that documentation of the determination is retained for record retention.
• Review the final list or rural or underserved counties for 2018, calculate rural or underserved status by address on the CFPB’s website for covered loans, and ensure the bank has documented whether or not it qualifies for the rural / underserved TILA exemption by originating at least one covered loan in a rural or underserved area and that documentation of the determination is retained for record retention.

 BSA Compliance:

• Ensure annual training was conducted for all employees during 2018 and is scheduled for 2019.  Furthermore, the Board of Directors should also be receiving annual BSA training, which should be documented in the Board minutes.
• Annual reviews should be conducted of all exempt customers for suspicious activity and continued eligibility.
• Update procedures for monitoring high-risk customers and reevaluate the risk levels of each customer designated as high risk.
• Ensure annual due diligence is completed for MSBs, remote deposit capture, private ATM customers, and deposit brokers in accordance with the bank’s BSA/AML program.

By: Kyle Davis, CRCM, CAMS

On September 7, 2018, FinCEN finalized permanent exceptive relief from the beneficial ownership requirements for certain rollover products and services.  The ruling is in response to industry feedback to question 12 found in the April 3, 2018 frequently asked questions.  See the FAQs here. 

Question 12 defined the term “account” consistent with previously issued CIP guidance which states that each loan renewal or CD rollover establishes another formal banking relationship. Per this definition, question 12 directed institutions to collect beneficial ownership upon the first renewal or rollover after May 11, 2018.  Additionally, question 12 allowed institutions to rely upon customer certification that the bank would be notified of any changes in beneficial ownership information. 

​After the FAQs were published, financial institutions responded that it is industry practice not to treat such rollovers and renewals as the opening of a new account.  In response, on May 16, 2018, FinCEN issued a 90-day temporary and limited exceptive relief, retroactive to May 11, 2018, and which FinCEN extended an additional 30 days.  Based upon discussions with stakeholders and industry personnel during the 120 days, FinCEN is providing permanent exceptive relief for these products.
​
The relief from the requirements of the beneficial ownership rule applies only when a legal entity customer opens a new account under the following scenarios:

• A rollover of a certificate of deposit (CD);
• A renewal, modification, or extension of a loan (e.g., setting a later payoff date) that does not require underwriting review and approval; 
• A renewal, modification, or extension of a commercial line of credit or credit card account (e.g., a later payoff date is set) that does not require underwriting review and approval; and
• A renewal of a safe deposit box rental.

​The exception affects the accounts described in this ruling in two ways: by removing the obligation to collect beneficial ownership information when an account opened before May 11, 2018 rolls over or renews after May 11, 2018, as if it were a new account, and by removing that same obligation for rollovers, modifications, extensions, and renewals of such accounts opened after May 11, 2018.
 
There are a few important details to highlight from the ruling.  FinCEN notes that current industry practice for renewing or extending these types of account relationships is generally automated and does not require an affirmative action from the customer.  This narrow definition appears to eliminate the relief for instances where a business customer deposits funds to a CD during a grace period.  It appears that the ruling views a deposit during a grace period as an interaction with a legal entity customer and an opportunity to obtain or re-certify the beneficial ownership information.

The ruling with regards to credit products also presents additional questions.   The guidance does not define the terms underwriting and approval.  These definitions are left to institution’s specific loan policies and processes. Typically, underwriting and/or approval is required for most loan renewals. Further, there are limited credit products with automatic renewal features that require no action from the customer. 

However, FinCEN does provide an example of relief in the ruling with respect to credit card accounts, “the financial institution may change certain terms of a commercial line of credit or of a credit card, such as the credit limit, without requiring the affirmative assent of the customer.”  Institutions may also determine that, depending on bank policy, other short-term loan extensions do not require underwriting and approval.  It is recommended that institutions review their internal underwriting and approval policy and processes to determine instances, if any, where this relief would be applicable.

The final ruling can be found here.

 By: Brad Washburn, CRCM, CAMS

On May 24, 2018, the Economic Growth, Regulatory Relief, and Consumer Protection Act (the Act) was enacted into law. Section 104(a) of the Act amends section 304(i) of the Home Mortgage Disclosure Act (HMDA) by adding partial exemptions from HMDA's requirements for certain insured depository institutions and insured credit unions. Specifically, a covered institution does not need to collect or report certain data with respect to closed-end mortgage loans if it originated fewer than 500 closed-end mortgage loans in each of the two preceding calendar years.  Similarly, the Act provides that a covered institution does not need to collect or report certain data with respect to open-end lines of credit if it originated fewer than 500 open-end lines of credit in each of the two preceding calendar years. 

Financial institutions have raised questions about the new partial HMDA exemptions and how the exemptions affect collection and reporting of data for transactions with final action taken in 2018 or subsequent years. On August 31, 2018, the Bureau issued an interpretive and procedural rule that implements and clarifies section 104(a) of the Act and effectuates the purposes of the Act and HMDA. 

Primarily, the rule:

1. Clarifies that insured depository institutions and insured credit unions covered by a partial exemption have the option of reporting exempt data fields as long as they report all data fields within any exempt data point for which they report data;
2. Clarifies that only loans and lines of credit that are otherwise HMDA reportable count toward the thresholds for the partial exemptions;
3. Clarifies which of the data points in Regulation C are covered by the partial exemptions;
4. Designates a non-universal loan identifier for partially exempt transactions for institutions that choose not to report a universal loan identifier; and
5. Clarifies the exception to the partial exemptions for negative Community Reinvestment Act examination history.

This rule is effective as of September 7, 2018.  The new rule can be reviewed in its entirety here.

In addition, an executive summary of the rule which includes some helpful tables can be viewed here. 

The Bureau has indicated it intends to initiate a notice-and-comment rulemaking to incorporate these interpretations and procedures into Regulation C and further implement the Act.  Stay tuned for additional details about these changes as they come available. 
​

 By: Kyle Davis, CRCM, CAMS

The CFPB issued its final rule amending Regulation P to align with its authorizing statute, the Gramm-Leach-Bliley Act (GLBA). On December 4, 2015, Congress amended the GLBA as part of a transportation bill known as the FAST Act. This amendment added a new GLBA section 503(f) which provides an exception under which financial institutions meeting certain conditions are not required to provide annual privacy notices to customers. 

To qualify for the annual notice exception the following two conditions must be met: (1) the institution only discloses consumer information under certain circumstances which do not trigger consumer opt-out rights (cannot share with unaffiliated third parties) and (2) the institution has not changed its policies and practices concerning disclosing consumer information since its most recent notice sent to consumers.   The CFPB is clear that the annual notice exemption has been available to institutions since passage in December 2015.

Most notably, the final rule amends Regulation P by implementing timing requirements for delivery of annual privacy notices in the event that a financial institution that previously qualified for the annual notice exception later changes its policies or practices in such a way that it no longer qualifies for the exception.  The CFPB proposed these re-disclosure amendments to Regulation P in July 2016 and is largely adopting the rule as proposed. 
​
We highly recommend reviewing the regulation if changes are made to privacy sharing as the requirements may vary based on the change, but the new rules provide essentially two options: the institution must  issue an annual privacy notice either: (1) before implementing the changes in the policy or practice which trigger the obligation to send a revised privacy notice or (2) within 100 days after adopting a policy or practice that eliminates the financial institution's notice exception but the changes did not trigger the obligation to send a revised privacy notice.
It is important to note that the regulation defines the phrase, “policy and practice” as those items disclosed under sections 1016.6(a)(2), 1016.6(a)(3), 1016.6(a)(4), 1016.6(a)(5), and 1016.6(a)(9).  T

​This means that the only privacy notice changes that will not trigger an annual disclosure requirement are relative to information collection as defined under 1016.6(a)(1) and confidentiality and security as defined under 1016.6(a)(8).

The CFPB is further removing the Regulation P provision that allows for use of the alternative delivery method for annual privacy notices.  The alternative delivery method was implemented in 2014 and allowed for delivery via the institution’s website. The CFPB believes the alternative delivery method will no longer be used in light of the annual notice exception. However, the final rule is clear to state that continuing alternative delivery methods such as notifying customers of the availability of the notice on the website is permitted. 

Again, the annual notice exemption has been available to institutions since passage of the FAST ACT in December 2015. The final rule implementing the re-disclosure requirements and removal of the alternative delivery method was published in the Federal Register on April 17, 2018 and will be effective September 18, 2018. 

The complete final rule may be found here. 

By Brad Washburn CRCM, CAMS​

The Protecting Tenants at Foreclosure Act of 2009 (PTFA), which expired on Dec. 31, 2014, contained protections intended to ensure that tenants facing eviction from a foreclosed property would have adequate time to find alternative housing.  The financial regulatory reform bill titled the Economic Growth, Regulatory Relief, and Consumer Protection Act (S. 2155) which was enacted May 24, 2018, in part, restores the PTFA.  Specifically, Section 304 of the Act repeals the previous sunset provision which effectively changes the PTFA into a permanent law. 
​
The restoration of the PTFA was effective on June 23, 2018.  As such, a Bank should take steps to ensure it has policies and procedures in place to comply with the provisions PTFA.  In addition, the Bank should monitor communications from its primary federal regulator for guidance and updates in examination materials regarding the PTFA to ensure future compliance.    

By: James Moore, CRCM
​
​As a reminder, the Regulation CC rule changes are effective July 1, 2018.  The bulk of the changes are to Subpart C and are a much-needed update by the Federal Reserve to acknowledge that the check collection process is virtually electronic.  There are no changes to the regulation’s availability schedules or disclosure requirements as the rule does not affect Subpart B. 

The rule extends coverage of Subpart C to electronic items and contains a new incentive for banks to process returned items electronically. The Federal Reserve believes this new expeditious return rule will incentivize depository banks to receive electronic returns to preserve their ability to make claims that certain checks were not returned expeditiously.  The rule amends the two-day test time frame to expire at 2:00 p.m. of the second business day (previously 4:00 p.m.) and increases the threshold for notice of nonpayment to $5,000 (previously $2,500).
​
The rule provides much needed clarity for instances where a check is deposited in both paper and electronic form.  A depository institution should pay close attention to the new rule even when it does not have a mobile or remote deposit capture service for its customers as there is potential liability for accepting a check that has already been deposited at another institution through a mobile deposit.  A depositary bank that receives a paper check is indemnified against loss if the check was previously paid through a remote deposit capture service or mobile deposit platform unless there is a restrictive endorsement, such as “for mobile deposit only.”  

Tellers and front-line staff should be aware of the restrictive endorsement requirement to ensure paper items deposited do not include the restrictive language.  Each check received for deposit should be reviewed to ensure the “for mobile deposit only” box is not checked.  A financial institution will lose its protection if it takes an item for deposit with the restrictive endorsement.  It is recommended that periodic internal audits are conducted of deposited checks at the teller line on an ongoing basis to ensure checks were not deposited with the restrictive endorsement. 
​
In addition, institutions offering mobile deposit or remote deposit capture should ensure agreements have been updated to include the restrictive endorsement at the time of deposit.  Internal audits of deposit activity from mobile deposit and remote deposit capture customers should be conducted on a regular basis to ensure the restrictive endorsement is made as required.  Some institutions will be conducting these internal audits at random or at a specific dollar threshold.