The Latest News from Federal Financial Regulatory Agencies

August 22, 2018August 22, 2018 ~ Mary Crotty ~ Leave a comment

Here is a quick rundown on the latest news from various federal financial regulatory agencies.

The FDIC

On August 20, the Federal Deposit Insurance Corporation (FDIC) announced that it was modifying its Statement of Policy for Section 19 of the Federal Deposit Insurance Act, which is explained in its financial institution letter, FIL-42-2018.

The OCC

On August 17, the Office of the Comptroller of the Currency (OCC) published its Enforcement Actions and Terminations for August 2018. Most notable were three actions against TCF National Bank in regard to violations of the Federal Trade Commission Act (FTCA) in connection with its ATM and one-time debit cards. The Cease and Desist Order, the Civil Money Penalty for $3 million, and the Restitution Order of $25 million were all the result of alleged deceptive acts or practices in the bank’s overdraft protection Opt-in process.

The NCUA

On August 17, the National Credit Union Administration (NCUA) named 26-year agency veteran, Matthew J. Bilouris, as the Director of its Office of Consumer Financial Protection.

The CFPB

On August 10, the Consumer Financial Protection Bureau (CFPB) published its final rule amending the Gramm-Leach-Bliley Act, which provides an exemption from sending annual privacy notices as per Regulation P. In order to qualify for the exemption, financial institutions must meet the following two criteria:

“Must not share nonpublic personal information about customers except as described in certain statutory exceptions.”
“Must not have changed its policies or procedures with regard to disclosing nonpublic personal information from those that the institution described in the most recent privacy notice it sent.”

The Federal Reserve

On August 10, the Federal Reserve imposed an $8.6 million fine on Citigroup for alleged unsafe and unsound practices stemming from the “improper execution of residential mortgage-related documents” at one of its subsidiaries.

FinCEN

On August 8, the Financial Crimes Enforcement Network (FinCEN) extended its limited exception from beneficial owner requirements on legal entity customers for another 30 days. FinCEN initially instated the exception in May, just five days after the beneficial ownership rule went into effect on May 11. This relieved financial institutions from having to collect beneficial ownership information on certain financial products that automatically renew, such as certificates of deposit, that were opened prior to May 11.

That 90-day exception expired on August 9, but this latest move extends it to September 8.

CFPB Issues Flurry of Settlement Actions

July 23, 2018 ~ Mary Crotty ~ Leave a comment

Since June 13, the Consumer Financial Protection Bureau (CFPB) has issued five settlement notices for a total of over $361 million in restitution or redress and over $16 million in civil money penalties (CMPs). Under the administration of former CFPB director Richard Cordray, that may not have come as a surprise. But considering that under acting director Mick Mulvaney, the CFPB had only issued one other settlement notice in 2018, that of Wells Fargo, this flurry of recent activity is somewhat unexpected.

CFPB Settlements in Last Six Weeks

A review of the five settlement notices indicates that violations of the unfair, deceptive or abusive acts and practices (UDAAP) section of the Consumer Financial Protection Act (CFPA) account for the majority of issues. Violations of the Truth in Lending Act (TILA) also appear in more than one settlement.

Here is a brief synopsis of the notices:

July 20 Settlement with TCF Financial

In early 2017, the CFPB alleged in a Complaint filed in court that this regional bank had violated Reg E and the CFPA. In September of the same year, the bank filed a Motion to Dismiss, which was only partially upheld by the court. While the Reg E claim was dismissed, the CFPA claim stood, although it was “limited to those claims to customers who opened their accounts on or after July 21, 2011.”

The CFPA claim stemmed from alleged deceptive and abusive conduct by the bank in regard to its overdraft services. Specifically, “Banks must first obtain a consumer’s consent before they can lawfully charge overdraft fees on one-time debit purchases and ATM withdrawals. When attempting to obtain this consent, TCF obscured the fees it charged and made consenting to overdraft fees seem mandatory for new customers to open an account.”

TCF was ordered to pay $25 million in restitution and a $5 million CMP, however, the CFPB agreed to accept a $3 million CMP in consideration of the correlating CMP issued by the Office of the Comptroller of the Currency (OCC).

July 19 Settlement with Triton Management Group

This small-dollar lender is alleged to have violated TILA and the CFPA by engaging in deceptive acts or practices when it misrepresented finance charges on auto loans in Mississippi. The judgment calls for equitable monetary relief in the amount of $1,522,298, which represents the amount customers paid in excess finance charges. The CFPB, however, indicated it would accept $500,000 to satisfy this obligation, in part because of the institution’s “lack of financial resources.” This was also noted as the reason for the $1 CMP imposed on Triton as part of the settlement.

July 13 Settlement with National Credit Adjusters and its CEO

The CFPB alleges that this firm engaged in “unlawful debt collection practices,” which violate the CFPA. The settlement notes that, the firm “engaged in unfair and deceptive acts or practices in the collection and sale of consumer debt.”

The firm and its former CEO were each fined $3 million, however, the CFPB said that, “full payment of those amounts is suspended” as long as National Credit Adjusters pays a $500,000 CMP and the former CEO pays a $300,000 CMP.

June 30 Settlement with Citibank

After conducting an internal review, Citibank self-identified and self-reported violations of TILA to the CFPB. Per the settlement, Citibank agreed to pay $335 million in restitution to affected customers. The CFPB did not assess a CMP because the bank discovered the violations on its own and voluntarily reported them.

June 13 Settlement with Security Group, Inc.

The settlement agreement alleges that Security Group, Inc., which provides consumer loans, “engaged in unfair acts or practices” in violation of the CFPA. The notice also alleges violations of the Fair Credit Reporting Act (FCRA).

Specifically, “Respondents visited consumers’ homes and places of employment, as well as the homes of their neighbors, to collect or attempt to collect delinquent debt.” This is alleged to have occurred over the course of 12 million visits to over 1.3 million customers. Security Group, Inc. was ordered to pay a $5 million CMP.

CFPB Settlements Do Include Some Leniency

It should be noted, that despite the unexpected flurry of settlements from the CFPB in the last six weeks, the Bureau does appear to be taking all circumstances into account and affording respondents with some leniency in terms of financial consequences. In all but the Security Group’s settlement, which reads as the most egregious, the CFPB either agreed to accept a lesser amount than originally stated or it chose to impose no CMP or only a nominal one. This likely reflects the philosophy of the current administration.

Federal Banking Regulators Mete Out $1.078 Billion in CMPs Since April

May 31, 2018May 31, 2018 ~ Mary Crotty ~ Leave a comment

On May 25, the Federal Deposit Insurance Corporation (FDIC) published its April enforcement actions, which included four orders to pay civil money penalties (CMPs), totaling $160,000. That’s not much of a story, but further digging reveals that between the FDIC, the Office of the Comptroller of the Currency (OCC), the Financial Crimes Enforcement Network (FinCEN), the Consumer Financial Protection Bureau (CFPB), and the Federal Reserve Board (FRB), federal banking regulators handed out $1,078,384,245 in CMPs from early April to early May.

(No enforcement actions were found for this time period on the National Credit Union Administration’s website.)

A closer look at these enforcement actions adds interesting context to the hefty fine total.

Both Individuals and Institutions Fined

In addition to the FDIC’s four orders to pay a CMP, the OCC issued seven such enforcement actions, while FinCEN and the CFPB issued one each, and the FRB issued two, for a total of 17 enforcement actions involving monetary fines. Those actions break down as follows:

Seven levied against institution-affiliated individuals: These current and former executives and/or directors were fined a total of $410,000, with CMPs ranging from $5,000 to $175,000.
Seven levied against traditional financial institutions: PNC Bank and Wells Fargo were each fined twice and three other banks were fined once by various agencies for a total of $1,069,974,245 in CMPs. The OCC and CFPB-combined $1 billion fine against Wells Fargo represents the majority of the bank fines. However, two other banks were still hit with significant fines: The OCC fined PNC $15 million and the FRB fined Goldman Sachs $54.75 million.
One levied against a casino: Per the USA PATRIOT Act’s broader definition of “financial institution,” FinCEN fined a casino (or card club) $8 million.

The Alleged and Admitted Violations

The seven institution-affiliated individuals were fined for a variety of reasons, including conducting unsafe and unsound practices, such as masking reporting losses; violating previous consent orders or failing to correct deficiencies cited in them; understating the allowance for loan and lease losses (ALLL) leading to a false or misleading CALL Report; and causing “the Bank to pay for personal expenditures without disclosure or authorization.”

The remaining CMPs levied against institutions involve the following laws or regulations:

Three institutions allegedly violated flood-related regulations: This includes a $5,000 fine from the FDIC, a $12,000 fine from the FRB, and a $207,245 fine from the OCC.
Two institutions allegedly violated the Federal Trade Commission Act (FTCA): The OCC fined PNC $15 million for deceptive acts or practices in violation of the FTCA, and it fined Wells Fargo $500 million for unsafe and unsound practices in violation of the same.
One institution allegedly violated the Consumer Financial Protection Act (CFPA): The CFPB fined Wells Fargo $1 billion for unfair and deceptive acts in violation of the CFPA, however it credited the OCC’s $500 million CMP towards the satisfaction of its own fine.
One institution admittedly violated the Bank Secrecy Act (BSA): FinCEN’s $8 million enforcement action against the above-referenced casino was due to its failure to establish and implement an effective anti-money laundering program as per the BSA.
One institution allegedly conducted unsafe and unsound practices in its Foreign Exchange Trading Business: The FRB fined Goldman Sachs “for deficiencies in Goldman’s internal controls and oversight of traders who buy and sell U.S. dollars and foreign currencies for the firm’s own accounts and for customers.”

The Million and Billion Dollar Fines

If you haven’t kept count, of the eight institutional fines, five of them exceeded a million dollars, three of them consisted of multi-million dollar CMPs, and Wells Fargo’s total fine hit the $1 billion mark.

Perhaps it is worth noting that the other three institutional fines ($5,000, $12,000 and $207,245) were the flood-related violations.

While the Trump administration’s deregulation stance is providing some much welcomed regulatory relief, this month’s worth of CMPs indicates that compliance with remaining laws and regulations is still a priority for federal banking regulators.

Wells Fargo Consent Orders Are Must-Reads for Bank Risk Management

April 30, 2018April 30, 2018 ~ Mary Crotty ~ Leave a comment

It has been 10 days since news broke that the Office of the Comptroller of the Currency (OCC) and the Consumer Financial Protection Bureau (CFPB) filed consent orders against Wells Fargo, resulting in a combined $1 billion civil money penalty (CMP). Many headlines about this story focused on the bank’s mortgage and auto lending practices. In reality, there is a more informative story here, especially for anyone involved in bank risk management or compliance.

Of course the 16-page OCC Consent Order for Civil Money Penalty, the 35-page OCC Cease and Desist Order, and the 35-page CFPB Consent Order are not as thrilling to read as a New York Times bestseller, but they are telling. And reading through the orders provides more details than the news blips about them, details that bank risk management and compliance officers can find useful in strengthening their own risk management and compliance practices.

5 Telling Facts in Consent Orders Against Wells Fargo

The Financial Hit Goes Beyond $1 Billion: Most TV and print outlets announced that Wells Fargo was fined $1 billion by the two regulatory agencies. That is true in that their net CMP was $1 billion. It is interesting to note, however, that the OCC fined the bank $500 million and the CFPB fined it $1 billion for a total of $1.5 billion in CMPs, although the CFPB agreed to accept the $500,000 collected by the OCC as part of its settlement. In addition, the orders call on the bank to develop remediation plans for customers it is alleged to have harmed, which will lead to additional costs for the bank.
The OCC Focus Is on Risk Management: While news stories ran with the mortgage and auto lending practice allegations, likely because that was the message in the CFPB order, the OCC focuses first and foremost on risk management before addressing the other two issues. The order’s opening paragraph states that, “The OCC has identified deficiencies in the Bank’s enterprise-wide compliance risk management program that constituted reckless unsafe or unsound practices and resulted in violations of the unfair acts or practices provision of Section 5 of the Federal Trade Commission Act…”
The Alleged Risk Management Deficiencies Extend in Time and Scope: The OCC claims that, “Since at least 2011, the Bank has failed to implement and maintain a compliance risk management program commensurate with the Bank’s size, complexity and risk profile.” The alleged deficiencies also impacted almost every aspect of the program, including the plan’s execution, the expertise of the personnel involved, the assessment and testing of the plan, the reporting to the Board, and its overall implementation.
UDAP and UDAAP Used by OCC and CFPB: As discussed before in this blog, unfair, deceptive or abusive acts or practices (UDAAP) and its cousin unfair and deceptive acts and practices (UDAP) are often handy regulations for regulatory agencies to cite because of their broad scope. In addition to the OCC’s unfair claim outlined in point #2, the CFPB alleges unfair acts and practices in violation of the Consumer Financial Protection Act (CFPA) in regard to Wells Fargo’s mortgage and auto lending practices. On the former, the CFPB claims that the bank “unfairly failed to follow the mortgage-interest-rate-lock process it explained to some prospective borrowers.” On the latter, it claims the bank “operated its Force-Placed Insurance program in an unfair manner.”
Vendor Management Comes into Play: Both the OCC and the CFPB orders indicate that the auto lending practices in question involved the bank’s vendor, reinforcing the fact that banks are ultimately responsible for the functions being performed by their vendors.

The moral of this story for banks and credit unions of all sizes: make sure that 1) your risk management practices are appropriate for your risk profile; 2) nothing you or your vendors are doing in word or deed can be deemed unfair, deceptive or abusive; and 3) you are routinely monitoring your vendors to ensure that they are fully and effectively complying with all the rules and regulations that apply to your institution and to them.

Inside CFPB Semi-annual Report: Final Rules Expected

April 12, 2018April 12, 2018 ~ Mary Crotty ~ 1 Comment

This week Bank Risk and Compliance Writer has been analyzing the CFPB’s Semi-annual Report, which was published on April 2. Monday’s post discussed the CFPB Acting Director’s call for remodeling the Bureau, which includes changing how it is funded and its level of independence. Tuesday’s post covered the CFPB’s plans for upcoming proposed rules, which leads us to today’s post–Final Rules Expected from the CFPB.

Upcoming Final Rules Per CFPB’s Semi-Annual Report

According to its report, there are three proposed rules that the CFPB anticipates finalizing in the near term.

Proposed Rule to Amend the Gramm-Leach-Bliley Act (GLBA): This rule was originally proposed by the CFPB on July 1, 2016 to correspond to Congress’ amended changes to GLBA in connection with passage of Fixing America’s Surface Transportation Act (FAST Act) in December 2015. As proposed, it would mirror the FAST Act in exempting financial institutions meeting certain conditions from sending annual privacy notices to customers as per GLBA. Financial institutions “can use the annual notice exemption if it limits its sharing of customer information so that the customer does not have the right to opt out and has not changed its privacy notice from the one previously delivered to its customers.” When finalized, this should provide some compliance relief for institutions that meet the exempting criteria.
Amendments Relating to Disclosure of Records and Information: Originally published in the Federal Register on August 24, 2016, this rule was proposed by the CFPB to revise its original 2011 rule protecting the confidentiality and disclosure of information. The CFPB’s stated purpose for the revision was “to clarify, correct, and amend certain provisions based on its experience over the last several years.” As proposed, the rule would revise and/or clarify these items: 1) rule’s definitions; 2) practices related to the Freedom of Information Act; 3) procedures for requests for information; 4) protection and disclosure of confidential information generated or received by the CFPB in its work; and 5) the Chief Privacy Officer’s authority.
Amendment to the Federal Mortgage Disclosure Requirements under TILA (Reg Z): The CFPB published this proposed amending rule on August 11, 2017. According to the proposal’s summary, this rule relates “to when a creditor may compare charges paid by or imposed on a consumer to amounts disclosed on a Closing Disclosure, instead of a Loan Estimate, to determine if an estimated closing cost was disclosed in good faith.” It goes on to indicate, “Specifically, the proposed amendments would permit creditors to do so regardless of when the Closing Disclosure is provided relative to consummation.” In its comment letter of October 10, 2017 the American Bankers Association expressed its general support of the amendment relieving unintended consequences of the TILA-RESPA Rule. It also summarized its understanding of the amendment for further clarification.

Tomorrow, in the final post of this series, look for an analysis of recent CFPB enforcement actions outlined in the Semi-annual Report.