Bank Lawyer's Blog

A Change of Policy, But Only in Two States

While the epic "Yo Mamma" wars between banks and credit unions have been well-documented (and often lamented) on this blog, I have no explanation for the recent activities of Chase Bank and Huntington Bank, as outlined in a recent article in Credit Union Times.

As many as 30 credit unions in West Virginia and Ohio have been scrambling to establish new correspondent vendors after a regional and national bank terminated their accounts over the past few weeks.

The $1.4 billion Volunteer Corporate CU and the $3.7 billion Corporate One FCU both reported the closed accounts, and in both cases said members reported the banks cited Bank Security Act and money laundering risk.

Charlie Thomas, VolCorp’s senior vice president of West Virginia operations, said the Nashville, Tenn.-based corporate first became aware of the terminated correspondent relationships in late March when a member called, asking for assistance. He said the two banks were the Columbus, Ohio-based Huntington Bank and New York-based Chase Bank.

[...]

Thomas said a letter he’d seen from Huntington to a credit union said the decision to terminate the business relationship was the result of regulatory requirements, “some of which may be new or been amended since the credit union opened its account.” The decision reflected a change in bank wide strategy, and was not a reflection on the credit union, the letter added.

The two banks aren't providing a more detailed explanation and the Fed refuses to comment to reporters on the matter, including indicating whether the banks were directed to close the accounts by their primary regulators because of BSA concerns. Speculation includes the theory that the banks are trying to reduce volatility of deposits, but other observers note that those banks are so large that the 30 banks would be but a blip on the radar screen. Also, why only banks in those two states? Is there some massive money laundering risk suddenly emerging from coal country? Are moonshiners now allied with Mexican drug cartels and laundering massive amounts of illicit cash through these credit unions?

This may be worth following. Or, it may not be. If anything interesting pops, I'll post.

The Same Old Song

While the focus of John Byrne, the EVP of ACAMS, is on BSA, money-laundering, and similar compliance issues, the question he poses in the title to a recent article in the ABA Banking Journal extends to all areas of bank compliance: "Why Are We Still Fixing The Same Things?"

Are we in a time warp?

 
Without pointing out what specific regulators have said, it is incredible to me that basic issues such as maintaining an effective program of compliance are deficient. We are told that bank management needs to determine if compliance reporting to the lines of business (lobs) is a good idea-it is not, not before and not now. And these other perennials still come up:
 
• Outsourcing the "function" is not outsourcing the responsibility.
• Affiliate work should reflect U.S. laws, not local standards.
• Audit oversight needs experience with U.S. law and OFAC requirements.
• The more thorough the audit, the better your examiners can rely on the report.
 
For exam problems, federal agencies are telling the industry that in 2011 we are still deficient in the following ways:
 
• Customer risk-rating methodology is inconsistently applied across the customer base
• Officer and directors are not being properly identified nor screened for PEPS (politically exposed persons) and negative news
• BSA training is clearly inadequate and there is no escalation to notify senior management of past-due employees who have not completed the required annual BSA training.
• Cost-cutting is resulting in a lack of AML oversight.

John has an idea why these same old compliance problems keep popping up.

What is interesting (or frustrating, depending on your point of view) is that some of the root causes have been stated many times before:
 
• Elevation of the business line over the compliance function
• Offering products without adequate controls in place
• New technologies such as prepaid access
• Compliance programs that are not commensurate with the risks

John calls these "gaps" in compliance "inexcusable in 2011." I'd have to agree. So, apparently, do the regulators. Otherwise healthy banks, and even banks that are in the death spiral because of assets quality and capital deficiencies, are being hammered by compliance examinations that not only add insult to injury, but pose the very real risk to the bank, and possibly its  management and directors, of civil money penalties. Just take a look at the list of civil money penalties imposed by the FDIC in April of this year for compliance failures.

With the enactment of Dodd-Frank and the advent of the CFPB, compliance will not get any easier, less expensive, or less risky. Banks need to be on top of their game in compliance. At least, those that want to continue to operate profitably need to be.

A decent place to check how your compliance programs stack up, and perhaps pick up some tips you hadn't considered, may be next month's webinar from Bankerstuff on Target Compliance Management, presented by former Federal Reserve Board Supervising Examiner and long-time bank compliance professional Mary Thorson. Whatever the approach, and wherever bank management and board members think compliance ought to rank on the list of their current concerns, rest assured that the subject remains at the top of the bank regulators' lists.

Bank Bashes Bad Barrister

Although banks that fail to adhere to BSA and anti-money laundering regulations and are fined for their failures seem to show up in press reports frequently, occasionally you'll find a story about a bank that is not only watching out for suspicious activity, it's taking action when it discovers it to nail the suspect. One such do-gooder is City National Bank of Florida, which was the first person or entity to file a complaint with the Florida state bar about an attorney who had been using his attorney's trust account at the bank "to pay expenses such as secretarial services, office cleaning, electric service, health insurance payments and mortgage payments." For those not familiar with the purpose of such a trust account, it's to hold funds of the client. An attorney is not permitted to pay personal living expenses out of the trust account. That's a "breach of trust" and an unethical practice.

Four days after two investors sued the attorney (who was apparently engaged in a type of Ponzi scheme), the bank filed its complaint. Acting on that complaint, the Florida Supreme Court recently disbarred the attorney. Like Mr. Pines in yesterday's post, he'll have to find another line of work where ethics are of little concern. Maybe he can rate subprime CDOs on Wall Street.

There are few more cases of punishment handed out by the Florida Supreme Court to other lawyers who've run afoul of the applicable ethical rules. While self-policing is essential to foster public trust in the profession (what little is left), it's discouraging to see so many members (now ex or suspended members) of this "honorable" profession give lawyer bashers such powerful ammunition.

In this case, the community bankers were on the ball and the lawyers were behind the eight ball.

Unrelated Ruminations

A couple of bank-related scattershots while wondering why I ever thought that the pace of life would slow down as I aged:

The recent imposition of $7 million in civil money penalties by the OCC and FinCEN against Pacific National Bank of Miami, Florida for BSA violations brought home to me once again the fact that while the rest of the nation might be preoccupied with finding a job, saving their homestead from foreclosure, or what exactly is the chemical composition of Charlie Sheen's "Tiger Blood," the bank regulators and FinCEN are preoccupied with the Bank Secrecy Act. When it comes to finding a spare regulatory violation or two (or more) to fatten the penalty coffers, BSA is the go-to regulation. I've seen the regulators beat dying banks--banks just a few short months away from meeting their maker--beaten to a bloody pulp for BSA violations. In case any bank hasn't yet gotten the word, be ever vigilant with BSA compliance, and let nothing distract you from your appointed task of doing law enforcement's job.

Another lesson to be taken from the Pacific National Bank beating is the fact that civil money penalties are usually (although not exclusively) based upon the fact that the miscreant bank ignored prior warnings to clean up its act. This important lesson extends far beyond BSA, into all phases of a bank's life here on earth and in its afterlife, as well. Read the complaints filed by the FDIC thus far against former officers and directors of failed banks. You'll notice that one of the common themes that runs through the FDIC narrative is that the officers and directors ignored previous warnings to stop doing something, in most cases to stop concentrating on commercial real estate loans and to improve and/or adhere to loan policies. Blowing off examination criticisms, or even worse, informal or formal enforcement action demands, is akin to lighting up a fine cigar while standing in the hold of an oil tanker. Every time I see it, I shake my head and wonder what is the most appropriate bouquet to send to the mortuary.

A completely unrelated thought popped into my head when I read a story today about the dismissal by a US District Court judge of a class action complaint filed on behalf of former shareholders of Freddie Mac against the mortgage giant. He said, according to the press report, that the plaintiffs simply hadn't proved that Freddie Mac's public disclosures were misleading regarding its exposure to subprime mortgages. The suit was filed in 2008, the same year that Uncle Freddie, along with Aunt Fannie, was placed into conservatorship, and has been slowly working its way to this point. I'm not surprised by the fact that the plaintiffs got the boot (although they can amend and refile). I suspect that many class action lawsuits are filed not with the expectation that if the lawsuit ever makes it to a decision on the merits that the plaintiffs will prevail, but with the expectation that the cost of paying lawyers and the crap shoot that litigation can sometimes become, will eventually induce defendants who have to worry about the bottom line to settle. In this case, it's the US taxpayer who's on the hook, represented by the executive branch of the federal government, so, naturally, there's less accountability for legal costs, and little fear that anyone's job is on the line if the defendant loses. That kind of defendant is likely to hang on to the bitter end. That's bad news for class action lawyers. In this case, it looks like they picked on the wrong "victim" to pursue.

On The Road Again

I'm traveling this week on business and will have little or no time to blog. I'll leave readers with some links to material to keep themselves occupied with actual worthwhile reading for a change, instead of the superficial snark you normally trip over here.

Rob Blackwell, Washington Bureau Chief of American Banker sent me a link to one of the paper's articles from Friday's edition in which reporter Cheyenne Hopkins sets readers straight to the fact that all the hoopla in the MSM about the "imminent" settlement between major loan servicers and state and federal regulatory and law enforcement agencies is a bit of smoke blowing. There are a lot of balls still in the air and anyone of them dropping could derail any "global" settlement. The article is outside the paper's firewall, so people who don't subscribe get a chance to sample the inside scoop presented daily to those who foot the bill.

The ABA Banking Journal had a recent excellent piece by Executive Editor Steve Cocheo entitled "Time to Reinvent the Community Bank?" The answer is "maybe." It's a great analysis of the problems that confront the traditional community bank today. You'll understand why many community bankers who've been in the game for years are starting to feel like the mouse who decides he no longer wants the cheese, he just wants out of the trap.

Finally, the analysis in a recent Banking Law Jouranal by King and Spaulding attorneys Jeffrey Telep and Jane Chen of FinCen's final rule on the confidentiality of SARs is definitely worth a read. All those SARs banks file that end up in the gullet of FinCen's pet goat are, nevertheless, extra special super secret under the law, and regardless of the fact that the vast majority of SARs result in a fit of inertia by law enforcement agencies, if a bank inadvertently leaks the mere existence of the SAR (much less any of its contents) to an unauthorized third party, the bank can end up "rendered" to a third world hell hole where water boarding is what people do for fun on spring break.

Peace, Out.

Parting Shot

I'm at the BAI Retail Delivery conference this week, so blogging for this week will be severely curtailed. However, I wanted to make sure you didn't miss the in-depth post by Kevin Sullivan at Anti-Money Laundering Training Academy blog for his hard-hitting exposé of the latest Vatican bank money laundering scandal entitiled "...And Then He Created the Moon and the SARS." As only an ex-cop (Kevin's the New York State Police official who first pursued the SAR that brought down Eliot Spitzer) and fellow Irish Catholic boy can, he puts that kerfuffle in proper perspective.

This has all the makings of a Dan Brown novel. Angels and Dollars? The Da Vinci Load? The Cash Symbol? Somebody stop me…!

You gotta love his picture, too:

No Rest For The Wicked

In a blog post yesterday, Linda McGlasson at The Agency Insider reminds bankers that Ponzi schemes didn't die when Bernie Madoff went to jail. While Bernie's scam might be the Platonic ideal of a Ponzi, compared to which those of would-be Bernies are mere pale reflections, there are still plenty of crooks milking the same old gullible public with the same basic game plan. And here's the problem that Linda sees:

These criminals are operating mostly under the cover of legitimate-looking businesses that might not be suspected until it's too late.

To shed a little light on this dark world, Linda decided to take a look at some of the more recently uncovered Ponzi schemes. She's trying to give bankers an idea of what they should be watching out for to keep from being used as part of such a scheme. Why? She's glad you asked that question.

Well, unless they're hiding their ill-gotten gains under a giant mattress or in a locked safe at their business, Ponzi schemers are depositing that money somewhere -- perhaps in your institution. Don't forget to consider maybe they're trying to launder their funds through your institution's line of investment services, too. That's something to consider the next time you have a new or even an established business customer throwing a lot of cash around in their accounts in short time periods.

She urges bankers to make certain that their BSA/AML personnel know what to look for in detecting one of those schemes. That's sound advice.

If the crooks stopped at Ponzi schemes, life for bankers would be tough enough. Unfortunately, Ponzis are only one of an array of schemes used by crooks to bilk bank customers. On the same day that Ms. McGlasson's post ran, Softpedia ran an article on an increasingly common criminal scheme employed to hammer banks and their online banking customers, through the use of "electronic money mules" and ACH fraud.

An ACH fraud operation starts with cybercriminals customizing a computer Trojan, which would give them the ability to hijack online banking credentials from an infected computer. Their goal is to infect key people with access to a company or organization's bank accounts and funds with it.

[...]

The trojan can be delivered to the intended target via e-mail or as drive-by download launched from a compromised website.

[...]

The gangs of fraudsters who launch these attacks generally operate from abroad, but since ACH transactions are only nation-wide, they can't get the stolen money directly and need to send it to U.S. bank accounts. This is where intermediaries known as money mules come into the equation. These are people who agree to use their personal account to receive funds and wire them out of the country in exchange for a commission.

Most of the time the "mules" are unwitting dupes who are offered a "work-from-home" job from an apparently legitimate company.

The never-ceasing efforts of increasingly sophisticated foreign and domestic criminal gangs to reach around the globe and pick banks and their customers clean requires that banks remain educated and aware of what's happening, how to recognize it, how to thwart it before it happens, or how to shut it down if does occur. Because criminals often look for smaller community banks to prey upon, where they expect that BSA/AML and security personnel may not be as sophisticated as they are at the larger banks, banks of all sizes and in all locales need to be on their toes.

Unlike during the Great Depression, when bank robbers burst through the front door with Tommy Guns in hand and scooped money out of cash drawers, forced bank managers to open the vault, and otherwise made a lot of noise, during the Great Recession the crooks are coming in through the Internet and looting accounts silently.

***************************************************************************************************************************

Bankers and service providers interested in learning more about current criminal schemes using online banking may wish to consider listening to an upcoming Bank Law Stuff webinar "Online Banking Security: Corporate Account Takeovers, Electronic Money Mules and How to Protect Your Customers."

Take My TARP...Please

TCF CEO Bill Cooper is mad as hell, and he's not going to take it anymore.

The man who recently told the Treasury Department that he's got a bad case of seller's remorse and wants to give back his bank's CPP investment, got everything that's been bugging him about the nation's financial mess off his chest. According to BankThink's Rebecca Sausner, who listened to Cooper rant at yesterday's SourceMedia’s Best Practices in Retail Financial Services Symposium in Florida, it was a rare glimpse into the utter honesty of man who's been around long enough that he's not afraid of anything other than running out of Viagra.

One of my personal favorites was his no-holds-barred take on the federal government's role in the meltdown.

“I believe at least 90 percent of this crisis was government driven, created by the government through bad monetary policy, the wrong kind of regulation, the whole impetus for managing economy, lending to the poor, encouraging what was in effect bad lending. All of this stuff was encouraged by the government, and a lot of honest bankers went along with it and didn’t make good judgments.”

Another two I loved, because I find the filing of Suspicious Activity Reports (SARs) to be, for the most part, an egregious waste of time, were these:

On the value of SARs to national defense in the hands of the BSA regulators:
“What the hell? These guys couldn’t find this loan problem when it sat in front of them; they’re going to find a terrorist?"

“Does anybody think there’s not enough regulation in the banking business?” Cooper asked, to a burst of laughter. But, he argues, the regulation is misfocused on issues like BSA instead of fundamental safety and soundness. “They come in and audit the living crap out of you on BSA. Have you guys lived through this? It’s a life/death experience if you flunk BSA. …The only terrorist the BSA program has caught is Spitzer with his pants down.”

And who could resist a Henny Youngman moment.

"I thought swaps were what guys did with their wives in California."

Read them all. They're priceless.

Another Great Leap Forward

Hard on the heels of its recent successful stint as the host of the Summer Olympic Games (at least, we understand that they were successful; we never watched anything other than women's beach volleyball), China offers further proof of its rise in the world, this time the world of international banking: it's being sued by Israeli victims of radical Muslim terrorists.

A lawsuit filed in Los Angeles Superior Court claims that one of China's biggest banks transferred millions of dollars for terrorist groups bent on attacking Israel, ignoring demands by Israeli counterterrorism officials to halt the practice.

The lawsuit, against Bank of China Ltd., was brought on behalf of more than 100 victims of terrorism in Israel and alleges that the money was transferred for the militant groups Hamas and Palestinian Islamic Jihad in Iran and Syria, and processed through Bank of China's branches in the U.S. and China. Bank of China, which is one of China's Big Four banks and is listed in both Hong Kong and Shanghai, has the widest overseas network of the nation's banks.

The suit alleges that the money helped fund attacks between 2004 and 2007, and calls on the bank to stop transferring money for terrorist groups. It claims that in April 2005, Israeli counterterrorism officials informed officials of China's public security ministry and its central bank, the People's Bank of China, of their concerns over the wire transfers.

"Most of the banks of the world are not doing business with terrorist organizations," said Federico Castelan Sayre, an attorney representing the plaintiffs. "They chose to do so willingly."

Naturally, the Chinese deny holding talks with any Israeli counterterrorism officials. They also make the implausible assertion that the Bank of China "always complies with the United Nations' anti-money-laundering regulations. Also, our New York branch and related representative offices always follow U.S. banking regulations." Unlike U.S. and European banks, when it comes to compliance with bank regulations, Chinese banks are, like the Pope when acting in concert with the bishops on matters of the Roman Catholic faith, infallible. They "always comply" with the law, never failing, even inadvertently, to hit it on the sweet spot.

On one level, you have to admire the utter cynicism of "The Big Lie." If you're going to tell a lie, at least make it laugh-worthy. US and European compliance officers are bent over double at that one.

However, don't expect the Israelis to find that assertion to be amusing. They tend to treat these matters with the utmost gravity. The Bank of China has now earned a place in the dock alongside such Western counterparts as Credit Lyonnais and NatWest, who have been in the crosshairs of the Israelis for the past few years, and not enjoying it one bit.

Congratulations, and welcome to the First World of Banking, B  of C!

More Accurate Identity Theft Reporting By Banks: The Opening Salvo

Last year, Chris Hoofnagle, Senior Staff Attorney, Samuelson Law, Technology & Public Policy Clinic and Senior Fellow, Berkeley Center for Law and Technology, University of California-Berkeley Boalt Hall School of Law, published an article in the Harvard Journal of Law & Technology entitled "Identity Theft: Making the Known Unknowns Known." Essentially, Chris argues that we have little public information available on the extent of the problem of identity theft crimes against bank customers, either in the form of "new account fraud" (where an impostor opens an account in the victim's name) or "account takeover" (where an impostor uses an existing account, such as a credit card, to commit fraud). Although the FTC maintains information concerning reports by victims of identity theft, Chris argues that "financial institutions are in a better position [than victims of identity theft] to report information on identity theft."

Why, you might ask, is it necessary to have more detailed and accurate reports of this crime? Chris is glad that you asked.

First, it would identify the business practices most vulnerable to fraud. Second, it would help to identify the consumer protections that work and those that do not, and thus assist regulators and law enforcement agencies in allocating resources to combat the crime. Third, improved reporting would help focus public attention on the root causes of the crime. In particular, it could provide a potential counterpoint to the conclusions of some victim surveys that have relied on questionable assumptions and asserted that the fault for identity theft lies with the victims.

Finally, providing more accurate, institution-level statistics on identity theft would make the security of personal information a new product differentiator, similar to low interest rates and fee-free accounts. It would enable benchmarking of financial institutions using that factor so that consumers could tell which institutions have the highest and lowest rates of fraud. Assuming that the market is competitive, it is likely that lenders that provide the safest financial products would be rewarded with consumer loyalty. This rubric would also pressure institutions bearing the ignominious mark of having the most identity theft to adapt or to be driven from the marketplace.

Chris proposes that financial institutions be required to report three principal categories of information: (1) the number of identity theft incidents suffered or avoided; (2) the forms of identity theft attempted and the financial products targeted (e.g., mortgage loan or credit card); and (3) the amount of loss suffered or avoided.

Chris lays out a detailed argument as to why current data (including that gleaned from SARs, which is not public information in any event) is not sufficient, and why more detailed reporting by financial institutions would give regulators, law enforcement agencies and regulatory authorities a better picture of the extent of identity theft, which financial institutions appear to be more vulnerable to the crime, where bank regulatory and law enforcement efforts should be directed, and, finally, which institutions ought to be avoided by customers who are concerned about this form of crime.

I concede the validity of Chris's arguments that reporting by banks would provide more accurate data. However, I question whether consumers, as a practical reality, will alter their behavior based upon the results. I suspect that the entire issue of personal privacy is a lot like Mark Twain's observation about the weather: everyone talks about it and no one does anything about it. When I listen to speeches or read articles such as those by Professor Fred Cate of the Indiana University School of Law, that recount instances of consumers selling their personal information for Starbucks vouchers, I question whether consumers will really punish those banks that seem to be doing a poor job of meeting the challenge of identity theft.

On the other hand, I have no doubt that regulators would find a failure to take effective measures to prevent this crime to be an unsafe and unsound banking practice. Therefore, I think that more detailed reporting by banks to bank regulators (state and federal, as appropriate) would be beneficial. I'm certain that a nasty argument would break out as to whether national banks and federal thrifts should also report this information to state law enforcement authorities so that the Marc Dann's and Andy Cuomo's of the world can make political hay with it. Finally, I expect that skeptics of the current federal bank regulatory regime won't take much comfort in the prospect of relying on federal bank regulators to punish banks that are "guilty" of excessive identity theft. Many critics of the federal bank regulators will want a private right of action against banks, or at least a right of action by state attorneys general, in addition to federal enforcement.

I expect that banks, already burdened with BSA/Anti-Money Laundering reporting, and disillusioned with the apparent fruitlessness of much of the suspicious activity reporting that they currently make (recent federal regulatory protestations to the contrary notwithstanding), would fight hard against such detailed reporting requirements. Given the current credit crisis and the resulting pressure on capital and the bottom lines of many banks, the howls from the banking industry will be long and loud.

Chris also points out the difficulty of tracking "synthetic identity theft," which, we have previously noted, is becoming the identity theft crime of choice. I don't find a practical solution to the difficulties he presents, and I don't see an impetus on the part of financial institutions to voluntarily come up with such a solution. That will be a tough nut to crack.

I have a number of other issues, but lack the time at present to discuss them. I hope to get to them in future posts.

For those who might tend to brush off Chris's article as impractical "law professor posturing," they'll need to rethink any such out-of-hand dismissal. To force the hand of financial institutions, on February 26, 2008, Chris released a paper (download it here) entitled "Measuring Identity Theft at Top Banks." He used a FOIA request to the FTC to obtain data on identity theft reported by victims and, using that data, has compared the largest banks. He admits the problems with the data and with his methodologies, yet asserts that it's the best information available and an appropriate methodology to use in light of the lack of self-reporting by institutions. Among the biggest banks, HSBC, Bank of America and Wamu fair poorly, ING Bank very well.

I suppose that banks can try to ignore Professor Hoofnagle and hope that he goes away or is ignored. Then again, if gadflies like bloggers publicize his studies, and more main stream publications pick up on the results, banks may find themselves forced to start reporting more information as a matter of self defense. The "beauty part" of that result would be that Chris wouldn't have any skin in the game as to the accuracy or inaccuracy of his initial rankings using the limited information available. His ultimate goal is to force the acquisition and reporting of more accurate information so that more accurate rankings might be obtained. That being his goal, this opening salvo is quite a clever gambit.

UPDATE 03/11/08: An anal attentive commenter has pointed out the grievous error I made in incorrectly referring to the "Indiana University School of Law" as the "University of Indiana Law School." I have corrected this misnomer and beg the forgiveness of Hoosiers everywhere.