The Latest News from Federal Financial Regulatory Agencies

Here is a quick rundown on the latest news from various federal financial regulatory agencies.

The FDIC

On August 20, the Federal Deposit Insurance Corporation (FDIC) announced that it was modifying its Statement of Policy for Section 19 of the Federal Deposit Insurance Act, which is explained in its financial institution letter, FIL-42-2018.

The OCC

On August 17, the Office of the Comptroller of the Currency (OCC) published its Enforcement Actions and Terminations for August 2018. Most notable were three actions against TCF National Bank in regard to violations of the Federal Trade Commission Act (FTCA) in connection with its ATM and one-time debit cards. The Cease and Desist Order, the Civil Money Penalty for $3 million, and the Restitution Order of $25 million were all the result of alleged deceptive acts or practices in the bank’s overdraft protection Opt-in process.

The NCUA

On August 17, the National Credit Union Administration (NCUA) named 26-year agency veteran, Matthew J. Bilouris, as the Director of its Office of Consumer Financial Protection.

The CFPB

On August 10, the Consumer Financial Protection Bureau (CFPB) published its final rule  amending the Gramm-Leach-Bliley Act, which provides an exemption from sending annual privacy notices as per Regulation P. In order to qualify for the exemption, financial institutions must meet the following two criteria:

  1. “Must not share nonpublic personal information about customers except as described in certain statutory exceptions.”
  2. “Must not have changed its policies or procedures with regard to disclosing nonpublic personal information from those that the institution described in the most recent privacy notice it sent.”

The Federal Reserve

On August 10, the Federal Reserve imposed an $8.6 million fine on Citigroup for alleged unsafe and unsound practices stemming from the “improper execution of residential mortgage-related documents” at one of its subsidiaries.

FinCEN

On August 8, the Financial Crimes Enforcement Network (FinCEN) extended its limited exception from beneficial owner requirements on legal entity customers for another 30 days. FinCEN initially instated the exception in May, just five days after the beneficial ownership rule went into effect on May 11. This relieved financial institutions from having to collect beneficial ownership information on certain financial products that automatically renew, such as certificates of deposit, that were opened prior to May 11.

That 90-day exception expired on August 9, but this latest move extends it to September 8.

 

Communication: The Oft Forgotten Component of Bank Compliance

green headphones near laptop and microphone
Photo by samer daboul on Pexels.com

Banks spend enormous sums of money each year to meet their federal and state regulatory compliance requirements. They hire professionals with the requisite experience to tackle things like their Bank Secrecy Act and Information Security programs; they invest significant budget dollars in today’s sophisticated compliance software tools; and they spend countless hours developing policies, processes, and procedures to stay compliant.

But despite all that time, money, and effort, the one thing that often gets overlooked when it comes to bank compliance is communicating about it often and to everyone in the organization.

A Steady Stream of Communication

Several years ago, the Financial Crimes Enforcement Network (FinCEN) issued an Advisory to U.S. Financial Institutions on Promoting a Culture of Compliance. While this publication was geared toward BSA programs in 2014, its logic still applies today to a bank’s enterprise approach to compliance. Just as FinCen suggested then, it still is today: “The culture of an organization is critical to its compliance.”

Building a culture of compliance requires a steady stream of communication.

Upstream Communication

Ever since the 2008 financial crisis, federal banking regulators have emphasized that bank boards are ultimately responsible for all business operations, including compliance. Often, board members come from a variety of industries. Even those with a background in financial services often do not have particular compliance expertise.

That’s why they rely on those within the Compliance or Risk Management Office with the requisite expertise to keep them abreast of changes to regulatory guidance and laws, as well as to internal or external environmental changes that could impact the bank’s ability to comply with existing or changing regulations.

Cross-stream Communication

The Compliance Office is an interdependent function of almost every other bank area, including individual business units, corporate communications, e-commerce, finance, information technology, legal, marketing, product development, operations, risk management, and even third-party service providers. An institution’s ability to effectively comply with their regulatory requirements demands an open and healthy back-and-forth line of communication between the Compliance Office and these other areas.

For instance, if marketing is working with product development to roll out a new product and its corresponding marketing collateral, the Compliance Office should be in the loop. Conversely, if a new regulation is going into effect, such as the General Data Protection Regulation did in May, then it is incumbent upon the Compliance Office to provide timely details and periodic updates to the managers of all directly and indirectly impacted functions.

Downstream Communication

The everyday task of complying with many banking regulations falls on the shoulders of employees in either customer-facing or operations roles. They cannot be expected to do a good job at such compliance if they do not have the support and information they need.

Support comes in the form of senior management emphasizing their dedication to a culture of compliance in every word and action they take. Employees only buy-in when they believe senior management is on board and leading the way.

Information should come from the Compliance Office on a timely and routine basis, so that employees understand their responsibility to specific regulations, the importance of complying with them to the overall health of the institution and its customers, and  where to go for help if they don’t understand either.

Don’t Let a Failure to Communicate Undermine Your Compliance Efforts

Sophisticated technology has certainly helped streamline bank compliance efforts, but it shouldn’t be considered a replacement for good, old-fashioned communication, which today, thanks to such technology, can be delivered in any number of ways to those who need it, so that it is at their fingertips at all times.

And by good, old-fashioned communication, I mean exactly what your sixth grade English teacher taught you. Explain the who, what, where, when, and why of the situation as concisely and yet comprehensively as possible.

The by-product of such communication is proof to bank examiners of your commitment to building a culture of compliance.

 

Federal Banking Regulators Mete Out $1.078 Billion in CMPs Since April

pexels-photo-164527.jpeg
Photo by Pixabay on Pexels.com

On May 25, the Federal Deposit Insurance Corporation (FDIC) published its April enforcement actions, which included four orders to pay civil money penalties (CMPs), totaling $160,000. That’s not much of a story, but further digging reveals that between the FDIC, the Office of the Comptroller of the Currency (OCC), the Financial Crimes Enforcement Network (FinCEN), the Consumer Financial Protection Bureau (CFPB), and the Federal Reserve Board (FRB), federal banking regulators handed out $1,078,384,245 in CMPs from early April to early May.

(No enforcement actions were found for this time period on the National Credit Union Administration’s website.)

A closer look at these enforcement actions adds interesting context to the hefty fine total.

Both Individuals and Institutions Fined

In addition to the FDIC’s four orders to pay a CMP, the OCC issued seven such enforcement actions, while FinCEN and the CFPB issued one each, and the FRB issued two, for a total of 17 enforcement actions involving monetary fines. Those actions break down as follows:

  • Seven levied against institution-affiliated individuals: These current and former executives and/or directors were fined a total of $410,000, with CMPs ranging from $5,000 to $175,000.
  • Seven levied against traditional financial institutions: PNC Bank and Wells Fargo were each fined twice and three other banks were fined once by various agencies for a total of $1,069,974,245 in CMPs. The OCC and CFPB-combined $1 billion fine against Wells Fargo represents the majority of the bank fines. However, two other banks were still hit with significant fines: The OCC fined PNC $15 million and the FRB fined Goldman Sachs $54.75 million.
  • One levied against a casino: Per the USA PATRIOT Act’s broader definition of “financial institution,” FinCEN fined a casino (or card club) $8 million.

The Alleged and Admitted Violations

The seven institution-affiliated individuals were fined for a variety of reasons, including conducting unsafe and unsound practices, such as masking reporting losses; violating previous consent orders or failing to correct deficiencies cited in them; understating the allowance for loan and lease losses (ALLL) leading to a false or misleading CALL Report; and causing “the Bank to pay for personal expenditures without disclosure or authorization.”

The remaining CMPs levied against institutions involve the following laws or regulations:

  • Three institutions allegedly violated flood-related regulations: This includes a $5,000 fine from the FDIC, a $12,000 fine from the FRB, and a $207,245 fine from the OCC.
  • Two institutions allegedly violated the Federal Trade Commission Act (FTCA): The OCC fined PNC $15 million for deceptive acts or practices in violation of the FTCA, and it fined Wells Fargo $500 million for unsafe and unsound practices in violation of the same.
  • One institution allegedly violated the Consumer Financial Protection Act (CFPA): The CFPB fined Wells Fargo $1 billion for unfair and deceptive acts in violation of the CFPA, however it credited the OCC’s $500 million CMP towards the satisfaction of its own fine.
  • One institution admittedly violated the Bank Secrecy Act (BSA): FinCEN’s $8 million enforcement action against the above-referenced casino was due to its failure to establish and implement an effective anti-money laundering program as per the BSA.
  • One institution allegedly conducted unsafe and unsound practices in its Foreign Exchange Trading Business: The FRB fined Goldman Sachs “for deficiencies in Goldman’s internal controls and oversight of traders who buy and sell U.S. dollars and foreign currencies for the firm’s own accounts and for customers.”

The Million and Billion Dollar Fines

If you haven’t kept count, of the eight institutional fines, five of them exceeded a million dollars, three of them consisted of multi-million dollar CMPs, and Wells Fargo’s total fine hit the $1 billion mark.

Perhaps it is worth noting that the other three institutional fines ($5,000, $12,000 and $207,245) were the flood-related violations.

While the Trump administration’s deregulation stance is providing some much welcomed regulatory relief, this month’s worth of CMPs indicates that compliance with remaining laws and regulations is still a priority for federal banking regulators.