Bank Lawyer's Blog

Gimme A Break! Nobody Actually Believed Us!

To answer a reader's question, yes, I did get a kick out of the argument by S&P's lawyers (paid subscription required) that statements by S&P "about independence and objectivity are 'puffery' and were never meant to be taken at face value by investors."

Standard & Poor's responded formally on Monday to the civil lawsuit that the Justice Department filed against the company on Feb. 4 in U.S. District Court in Los Angeles.

The federal government says that the rating firm committed fraud when it allegedly misrepresented its ratings as independent and objective.

In its formal defense filed Monday, S&P pointed to two earlier court decisions where judges ruled that such statements by the firm were puffery and therefore can't form the basis for a fraud claim.

[...]

"Even if it's a viable legal argument, it's a pretty unattractive argument for S&P to be putting forward since they're basically in the business of charging clients for their reputation," said Samuel Buell, a law professor at Duke University and a former federal prosecutor. "What they're saying here is, 'When we're talking to investors about our own reputation, we're engaging in meaningless puffery.' "

"That's the whole point of the rating agencies, their seal of approval," Mr. Buell said.

It's hard to argue with Professor Buell about that.

Predictably, this all drove Larry Doyle over the edge.

In conclusion, the statement made by S&P’s lawyer is the equivalent of throwing another log on the fire that is incinerating any sense of meaningful integrity within the Wall Street-Washington conspiracy.

Puff . . . puff . . . up in smoke!

You may want to do the same with any credit ratings that cross your desk from S&P and its industry brethren at Moody’s and Fitch.

As hard as this is to believe, I'm going to say that the provision of Dodd-Frank that requires the regulators to figure out an alternative to the rating agencies is justified, not merely by the facts, but by the damning words flowing from the rating agencies and their mouthpieces. The problem is, thus far, no one has figured out what that alternative might be.

One option on the table is a proposal by Sen. Al Franken (D., Minn.) to create a board that would assign rating firms to rate deals. "As this lawsuit unfolds, it only becomes more clear that the credit rating industry is in need of serious reform, and that the American people and our economy are still at risk as a result of the conflict of interest in the industry," Mr. Franken said in a statement.

Wait a minute: I just agreed with Al Franken. Don't tell anyone. This moment may pass.

Uh, oh. I think Hell just froze over.

Scapegoating 101

The 20/20 hindsight afforded members of Congress when judging the alleged failures of the independent foreclosure reviews that we discussed last night also graces the peepers of the Government Accountability Office.

The independent foreclosure reviews abruptly ended by regulators in January failed from a lack of objectivity, oversight and consistency in the loan sampling process, said Lawrance Evans, director of financial markets and community investment for the Government Accountability Office.

[...]

Despite having a large portion of the funds already in the mail to homeowners, Evans says GAO’s probe into how the IFR was handled is far from complete.

He told lawmakers GAO plans to conduct more studies on how regulators came up with the $8.5 billion settlement figure when there is no data to show how that number was chosen or exact calculations on how many homeowners were, in fact, harmed by foreclosures.

He pointed out that "regulators’ statistical sampling approach did not include mechanisms to allow the regulators to monitor consultants’ progress toward finding as many harmed borrowers as possible."

Without data on how many borrowers were actually harmed, the GAO representative says his office wants answers on how the compensation figures were determined by the OCC and Federal Reserve.

In other words, the beat(ing) will go on.

And On.

And on.

While that's going on, the regulators are going all passive-aggressive by asking Congress to clarify that the regulators have the power to take enforcement action directly against independent contractors for banks. Because, you know, if the regulators require banks, as part of related enforcement orders, to hire independent consultants to perform very expensive services in order to comply with the enforcement orders, and the lack of clear, or even consistent, instructions on what the criteria and processes should be to perform those services leads to later criticism of the regulators over those services, well, then, regulators must be able to blame somebody, and looking in the mirror is simply out of the question (vampires cannot see their own reflections). Thus, the regulators must be able to blame the independent contractors and pursue them via enforcement processes that give the regulators a leg up on the object of their (lack of ) affection. Just like banks.

The independent contractors are reacting badly to the regulators' reaction (paid subscription required).

"I'm not sure having the regulators regulate consultants would make them more independent," said Jon Winick, president of bank advisory firm Clark Street Capital. "A better idea is to have the regulators hire the consultant then."

That would be a good alternative, except then the regulators would be responsible for the consultants' performance (or lack thereof), and we can't have that. They must be able to blame either the banks, the consultants, or both. That's not possible if the regulators are in a position to bear any responsibility.

"To me, the whole thing about the consultants is just more scapegoating," said Walter Moeling 4th, a partner at the Bryan Cave law office.

Man, I'm glad I'm not as cynical as Walt. Personally, I think this is all just a legitimate disagreement among well-intentioned people who are not worried about covering their own backsides, deflecting blame, or promoting themselves at the expense of others, but only about trying to "do the right thing."

Second-Guessing the Second Guessers

Every once in awhile, the blustering blunderbuss known as Senator Liz ("She-Reams-For-Sport") Warren fires a scattershot salvo that strikes a worthy target. You know, like when Dick Cheney shot a lawyer in the face.

The other day, Princess Rides-Bankers-Like-A-Burro was grilling some representatives of the big-time independent foreclosure review firms at a hearing that only Democrats attended (so you know it wasn't going to be pro-banker) and, as related by Larry Doyle, she struck oil.

Senator Warren: I just want to take a look at the Independent Foreclosure Review Payment Agreement details. I think you’ve probably all seen this one page agreement that lists all of the things that the banks did wrong and then boxes for how many people fall into each category and how much money they’re going to be paid. Is that right? You’ve all seen this? [Panel indicates they have seen it.]

And this was put out – who put this out? I think this is put out by the OCC and Federal Reserve. Is that right? As part of the settlement details. So I just want to ask you about this.

It has some pretty amazing categories here. The first category is about service members who were protected by Federal law whose homes were unlawfully foreclosed. It’s got people who were current on their payments whose homes were foreclosed. It’s got people who were performing all of the requirements under a modification who lost their homes to foreclosure.

And it tells how many people fall into each category and how much money the people in that category will receive. And, it ultimately resolves what will happen to 3,949,896 families.

So the question I have is having resolved this nearly 4 million families, who put the people, the families, into each of these boxes. Is that what your firms did. Mr. Ryan?

Owen Ryan, Partner, Deloitte & Touche LLP: No, Senator, we did not.

Senator Warren: So who put them in.

Ryan: I’m not sure how that schedule is prepared. I saw it for the first time yesterday.

Senator Warren: Mr. Flanagan?

James Flanagan, Leader, U.S. Financial Services Practice, Pricewaterhouse Coopers LLP: Same response. We were not involved in the accumulation of that information.

Senator Warren: Mr. Alt?

Konrad Alt, Managing Director, Promontory Financial Group: Senator, I’ve seen the schedule but I’m not familiar with the basis for its preparation.

Senator Warren: So let me understand this. You ran the independent reviews, right. That’s what you got paid to do. And yet, I presume, the only one left is the banks must have put them in these boxes and you made no independent review of their going into these boxes. You were not asked to do that? Mr. Alt.

Alt: No Senator, we were not asked to do that.

Senator Warren: Mr. Flanagan. 

Flanagan: No we were not.

Senator Warren: Mr. Ryan.

Ryan: We were not Senator.

Senator Warren: So that leaves us with the banks that broke the law were then the banks that decided how many people lost their homes because of their lawbreaking. And, as a result, how many people would collect money in each of these categories. Is that right Mr. Alt?

Alt: Senator, I’m not familiar with the basis for the scheduling. 

Senator Warren: So far as you know, there’s no independent review of the banks’ analysis…you looked at 100,000 cases and the banks have now put 4 million people into categories and resolved finally how much they will get from this review by the OCC and the Federal Reserve.

Sweet!

As Mr. Doyle put it, "Bang up job on behalf of the American taxpayer from these individuals and their firms charged with an independent review of this settlement process. NOT!!"

But here's a word in defense of the consulting firms: when Mr. Alt said that it wasn't in the scope of their duties, he was not kidding. As one of my readers, a bank lawyer, advised me, the entire review process was FUBAR from the get-go.

I saw it up close and it was an absolute Rube Goldberg process with the scope, criteria and objectives changing constantly. Regulatory example 1001 of do as I say, not as I do.

It's always easy to use 20/20 hindsight to bash people, of course. However, since the regulators love to do it to bankers, I guess turnabout is fair play.

Disparate Impact On Ex-Cons A No-No

Credit Union consultant and pundit Marvin Umholz has been hammering on the Obama administration's use of "disparate impact" theory in not only the fair lending context, but in the equal opportunity employment context, as well (previously discussed here). In his latest email newsletter "CU Strategic Hot Topics" (you can email Marvin at marvin.umholtz@comcast.net to be added to the circulation list), Marvin discusses the use of disparate impact to undermine the use of by financial institutions of background checks on prospective employees. The following is the section of the newsletter that focuses on this problem.

The new U.S. Department of Housing and Urban Development (HUD) rule entitled, “Implementation of the Fair Housing Act – Disparate Impact Rule (FR 5508) was posted in the Federal Register February 15^th www.federalregister.gov/articles/2013/02/15/2013-03375/implementation-of-the-fair-housing-acts-discriminatory-effects-standard?utm_medium=section_news&utm_source=homepage.  However, HUD’s use of the disparate impact doctrine to statistically prove discrimination regardless of intent represents just the latest in the executive branch’s efforts to utilize the controversial effects test to enforce the Fair Housing Act, the Equal Credit Opportunity Act (ECOA), and other laws.  In addition to HUD, the CFPB, the U.S. Department of Justice www.justice.gov, and the Equal Employment Opportunity Commission (EEOC) http://www1.eeoc.gov//eeoc/newsroom/wysk/arrest_conviction_records.cfm are using the statistical disparate impact discrimination effects test in their regulatory enforcement actions.

A February 15^th opinion essay in The Wall Street Journal reminded this correspondent that the EEOC

http://online.wsj.com/article/SB10001424127887323701904578276491630786614.html?KEYWORDS=perform+criminal+background+checks+at+your+peril is also a disparate impact activist in the extreme.  The op-ed began, “Should it be a federal crime for businesses to refuse to hire ex-convicts?  Yes, according to the Equal Credit Opportunity Commission, which recently released 20,000 convoluted words of regulatory ‘guidance’ to direct businesses to hire more felons and other ex-offenders…Last April, the agency unveiled its ‘Enforcement Guidance on the Consideration of Arrest and Conviction Records in Employment Decisions,’ declaring that ‘criminal record exclusions have a disparate impact based on race and national origin’…These statistical disparities inspired the EEOC to rewrite the corporate hiring handbook to level the playing field between ‘protected groups’ and the rest of the workforce…Most businesses perform criminal background checks on job applicants, but the EEOC guidance frowns on such checks and creates new legal tripwires that could spark federal lawsuits…If a background check discloses a criminal offense, the EEOC expects a company to do an intricate ‘individualized assessment’ that will somehow prove that it has a ‘business necessity’ not to hire the ex-offender (or that his offense disqualifies him for a specific job).”  Ex-offenders were disproportionately represented in the “protected groups” setting the stage for the EEOC’s statistical disparate impact effects test to the hiring process.

The op-ed continued, “Former EEOC General Counsel Donald Livingston, in testimony in December to the U.S. Commission on Civil Rights, warned that employers could be considered guilty of ‘race discrimination if they choose law abiding applicants over applicants with criminal convictions’ unless they conduct a comprehensive analysis of the ex-offender’s recent life history.  It is difficult to overstate the EEOC’s zealotry on this issue.  The agency is demanding that one of Mr. Livingston’s clients – the Freeman Companies, a convention and corporate events planner – pay compensation to rejected job applicants who lied about their criminal records…The EEOC is confident that its guidance will boost minority hiring, but studies published in the University of Chicago Legal Forum and the Journal of Law and Economics have found that businesses are much less likely to hire minority applicants when background checks are banned.  As the majority of black and Hispanic job applicants have clean legal records, the new EEOC mandate may harm the very groups it purports to help…The EEOC’s new regulatory regime is likely to chill hiring across the board and decrease opportunities for minority applicants.”  Did the EEOC run a cost-benefit analysis on this dangerous legal contortionism before it dove into these ideologically-questionable waters?  Does the EEOC consider its mission as being to inhibit job creation by exacerbating workplace uncertainty?

As recently as February 20^th CFPB Director Richard Cordray reminded everyone that the CFPB is committed to the disparate impact doctrine in executing its rulemaking and enforcement mission www.consumerfinance.gov/speeches/prepared-remarks-by-richard-cordray-at-a-consumer-advisory-board-meeting.  In his prepared remarks for delivery to the CFPB’s Consumer Advisory Board, Director Cordray said, “A final and consistent problem that can hijack consumers on the pathway to opportunity is the evil of discrimination.  For some people, the greatest challenges they face do not come from deceptive materials, debt traps, or market structures, but rather are rooted in something much more basic – unequal, invidious treatment based on characteristics such as race or gender or other bases prohibited by law.  The statistics show very clearly that communities of color were hit especially hard during the financial crisis.  All Americans saw drops in their household wealth, but African-Americans and Hispanics experienced the steepest drops.  This inequity is compounded by unequal access to responsible credit, which makes it difficult or even impossible to achieve their financial goals…We made it clear last year that – like other banking regulators and the Justice Department – we will pursue discrimination in consumer financial markets based on disparate impact as well as on intentional violations.  From the perspective of a consumer disadvantaged by policies that have a discriminatory effect, it makes no practical difference whether a lender consciously intended to discriminate.  Every consumer, regardless of race, gender, or other characteristics protected by federal law, should have equal access to credit and an equal chance to pursue the pathway to opportunity.”  The disparate impact doctrine is unconstitutional at best and a collection of counter-productive left-wing class warfare victimization claptrap at worst.

It was quite obvious from his remarks that CFPB Director Cordray believed that the United States was a nation statistically overflowing with victims and some were more victimized than others.  That is a distorted concept of what a level playing field should be.  The zealous application of the disparate impact effects test is unlikely to assure anyone access to increased prosperity and instead could bring the financial services marketplace to a screeching halt – and subsequently trigger widespread non-discriminatory austerity as a result.  Would that be consistent with the disparate impact doctrine?  Talk of social responsibility needs to be realistic.  It is more dangerous to promise too much than too little.  Despite the real social and economic advancement that has been made by ethnic minorities and other “protected groups” in this country, the federal government is still stuck in the 1960s.  Hopefully contemporary Americans believe in equal opportunity, not statistically-driven equality-mongering.  When it comes to the disparate impact doctrine, one can certainly hope that the U.S. Supreme Court Justices are true believers in equal opportunity rather than statistical quotas.

This is scary stuff. A number of my financial institution clients deem it a matter of safety and soundness to include within their contracts with vendors a provision that requires the vendor to perform background checks on employees who will perform services for the institution, especially if the employees will be involved in the handling of funds or sensitive information. Does that contractual requirement provide the vendor a legitimate business reason for performing the checks notwithstanding the potential disparate impact upon members of a protected class that contains a high number of ex-cons? On the other hand, is the financial institution subjecting itself to potential liability by imposing such a requirement and, if so, is it inserting itself between the rock of disparate impact and the hard place of unsafe and unsound practices?

The ideologues that are running the funny farm are forcing all of us to jump through the looking glass, head first.

Vendor Management Is Still A Regulatory Hot Button

According to the FDIC, a common theme in IT examination downgrades is poor vendor management by banks.

Last year, in 46% of the FDIC IT examinations in which bank ratings were downgraded, inadequate vendor management was cited as a causal factor, says Donald Saxinger, senior examination specialist in FDIC's Technology Supervision Branch.

"I'm not saying it was the primal causal factor, but, in 46% of the downgrades, vendor management was cited," Saxinger says. He spoke during the recent ABA Telephone Briefing "Vendor management: Unlocking the value beyond regulatory compliance."

Although the most common “error” that FDIC examiners discovered was the failure by banks to ask their vendors for copies of regulatory examinations, that wasn’t the only nugget contained in the linked article from the ABA Banking Journal. Among the others:

• Vendor management needs to consider all service providers that hold sensitive customer information, not just IT vendors. These include loan workout consulting, appraisal review companies, outside attorneys, and others.

• Make sure to get the proper exam reports about individual vendors. Some banks just obtain reports for the host data center, but not for the specific application that the banks were using.

• Even the proper reports don't cover everything that a bank must consider in its security risk management efforts. For example, one service provider with an otherwise clean report did not have an internal audit program and its business continuity planning was poorly documented.

This is all sound advice, of course, but knowing what you need to ask for is only half the battle. You also need to make certain that the agreement with your vendor gives the bank the right to ask for, and the vendor the obligation to deliver to the bank, copies of the necessary reports. Relying on the goodwill of the vendor in coughing up examination and audit reports, especially when they may contain results that are less than flattering to the vendor, is "unwise."

Here's one more tip: if the report reveals problems, the agreement with the vendor should require the vendor to notify the bank of what action the vendor intends to take to remedy the defects, and should also require the vendor to give the bank periodic progress reports on its progress in correcting those problems.

I'll be doing a webinar on March 6, 2013 on the topic "Technology Service Agreements: Meeting Regulator’s Expectations." It covers regulatory guidance applicable to credit unions, banks, and thrifts, although the same essential principles apply to each. The goal is to discuss the provisions of a technology service agreement that regulators expect (and that sound business judgment requires) be included, and to give financial institutions guidance on how to approach the issues covered by each of those provisions so that the institution meets its regulator's expectations while also meeting the institution's business needs.

Cyberheists: Big Banks Increase Small Banks' Losses

Internet security guru Brian Krebs had an excellent post a few weeks ago about much of the attention on cyberheists may be focused on the security vulnerabilities of small banks and their business customers, the large banks are playing a large role in small banks' losses.

A $170,000 cyberheist last month against an Illinois nursing home provider starkly illustrates how large financial institutions are being leveraged to target security weaknesses at small to regional banks and credit unions.

I have written about more than 80 organizations that were victims of cyberheists, and a few recurring themes have emerged from nearly all of these breaches. First, a majority of the victim organizations banked at smaller institutions. Second, virtually all of the money mules — willing or unwitting individuals recruited to help launder the stolen funds — used accounts at the top five largest U.S. banks.

Krebs responds to a question often asked of him, whether it's safer for a business to bank with a large bank rather than a small bank, by asserting that it's a difficult question to answer "because banking online remains a legally and financially risky affair for any business, regardless of which bank it uses"

Businesses do not enjoy the same fraud protections as consumers; if a Trojan lets the bad guys siphon an organization’s online accounts, that victim organization is legally responsible for the loss. The financial institution may decide to reimburse the victim for some or all of the costs of the fraud, but that is entirely up to the bank.

That's right. Regulation E does not apply to business customers. That's something that sometimes comes as a shock to small business customers, especially those who were too cheap to hire legal counsel to review the account and other online banking agreements before they were signed. "Forewarned is forearmed" is an old adage with a lot of wisdom behind it. It's not that banks will negotiate the terms of their agreements (most of them will not, especially with small customers), but that customers who understand their legal position going into the relationship are more likely to be concerned about doing due diligence on the bank's security procedures and track record and considering other methods to lessen and cover their risks (I've seen a few who suddenly realize that having a PC dedicated solely to online banking transactions and no other activities is not such a waste of money, after all).

Krebs also points out that since larger banks are more likely to have the resources to settle even large losses to avoid the reputational risk of cyberheists, it may be difficult to know how many instances of loss occur. However, it's reasonable to assume that the large banks spend a lot more money and person-power on security measures than do small banks.

Wearing my cyberthief glasses, if I’m looking at a huge pile of data stolen from thousands of victims, I’m probably more apt to target victims at smaller banks based on one simple assumption: Because I’m going to have a much higher success rate than I would targeting customers of larger institutions.

Krebs takes a shot at technology service providers who service many of the smaller banks for not doing more to secure online banking transactions.

Case in point: Optimumbank’s service provider is Fiserv, one of the largest banking industry service providers. According to Fiserv’s site, at least 52 percent of the nation’s $19 billion in ACH payments are processed using Fiserv software. If this is true, one might think that Fiserv’s systems handled about half of the mule transfers that were sent from Niles Nursing’s hacked bank account.

But according to Murray Walton, Fiserv’s chief risk officer, the software that most of its customer banks run — called PEP+ – is a client solution that does not interact with the company’s data centers. He said while Fiserv does offer an antifraud solution called FraudNet, that tool is designed for online bill pay services that banks can use to detect fraud patterns on consumer accounts.

“There are vendors who can knit it all together for banks, but that isn’t what we do,” Walton said in an interview. “For various and sundry reasons we don’t offer an engine that does the same thing as [an anti-fraud provider like] Guardian Analytics. Realistically, the client and end-user have responsibilities that they can’t abdicate to us. Everyone in this needs to take it seriously and not think that someone else has their back.”

I understand Walton's point, but on the other hand, a small bank's takeaway from those three paragraphs might be "Fiserv doesn't have your back, so look elsewhere." A competing core platform and processing vendor that "does have your back" might have a tag line to use.

Large banks are also lambasted for allowing so many "mule accounts" to be established.

As it stands, the big banks don’t have an incentive to police new accounts for mule activity, because it’s generally not their customers who are getting robbed from this activity, said Avivah Litan, a fraud analyst with Gartner Inc.

“The bad guys shouldn’t be able to set up these mule accounts in the first place,” Litan said. “The bigger banks are not doing a good job of screening for this activity because they’re not the ones eating the fraud on these attacks on smaller bank customers. [The bank service providers] should be spending more money. And the regulators should be coming down on them harder.”

Krebs suggests that, perhaps, "small, regional and local banks can pool their clout and resources to extract more from service providers than what those companies are currently offering." Fat chance. Several years ago, some of the largest users of technology services in the country made a concerted effort to get giant service providers to take more contractual responsibility for the performance, and vulnerabilities, of their technology. It fell flat. Unless the bank regulatory agencies intervene directly with the service providers, they'll continue to do what they do best: collect fees and deny liability.

As for watching your own back as it applies to business customers, Krebs offers some good suggestions, among them:

• Shop around for banks until you find one that assures you that it uses layered security.
• Use "Positive Pay" if your bank offers it because it not only deters check fraud but other unauthorized transfers, online and off (I heartily concur).
• Use Live CD to temporarily covert your PC from Microsoft to Linux for doing online banking transactions.

Krebs also offers an online "best practices" guide for businesses. As with much of his material, it's good stuff.

Fauxcahontas Hits The Deck Running

Most spanking new US senators have respect for the seniority system that's been in effect in the US Senate since Daniel Webster was making speeches that were actually eloquent. Most new senators tread lightly, with a sense of relative humility ("relative" being the operative word in a joint where the average ego makes Achilles look like Saint Francis of Assisi)and a realization that by storming out of the gate at the sound of the bell they might stumble, break a leg, and be put down. Then again, most US senators aren't a direct descendant of warriors of the Great Plains.

Sen. Elizabeth Warren isn’t wasting time wading into banking policy.

Less than a month into her new job, the Massachusetts Democrat, a new member of the Senate Banking Committee, is seeking information from regulators on why federal bank regulators halted a detailed review of foreclosure files this month.

In a letter sent to the Office of the Comptroller of the Currency and Federal Reserve on Thursday, Ms. Warren and Rep. Elijah Cummings (D., Md.), requested a detailed set of documents related to a foreclosure- review launched by the bank regulators in 2011.

[...]

In their letter, Ms. Warren and Mr. Cummings urged the regulators to provide information on the reviews’ findings – including how much several consulting firms were paid, and any conclusions about how much consumers were harmed.

The review was designed to address banks’ use of so-called robo-signers, a term for employees who signed off on numerous foreclosures and falsely claimed to have reviewed each case. Banks and regulators concluded that it was becoming far too expensive and not compensating homeowners. In recent weeks, regulators have reached agreements with 13 banks, in a pact now worth $9.3 billion.

The lawmakers said they agreed with regulators’ goal of making sure consumers receive aid more quickly. However, they argued that far more information about the settlement agreements should be public.

“Public confidence in the banking system has been badly undermined by a widespread concern that large financial institutions are not held fully to account when they break the rules—and that consumers are not sufficiently compensated,” they wrote.

Although the OCC and Fed refused to publicly comment on the cheeky request of She-Who-Hunts-At-Walmart, my understanding is that, under their breath, the bank regulators were discussing "a pound of sand" or something similar. Perhaps I didn't quite hear them clearly.

I understand why everyone is upset with the robosigning shenanigans, and I've many times blathered on this blog that robosigners deserve to be punished, including being fined and, where perjury has been committed, imprisoned. On the other hand, I'm not sure how the "compensation" argument continues to preoccupy the minds of lovers of The Great Spirit like Liz. I realize that the settlement exacted from the large loan servicers by the bank regulators required "compensation," but that seemed to me to be more of a purely political sop than an attempt to render justice. In a just world, lenders ought to be punished for falsifying documents and borrowers ought to pay their debts. Apparently,  "The Greatest Senator From Massachusetts Since Scott Brown" agrees with many that because of documentation or ministerial deficiencies, borrowers who had defaulted on their loans were "unjustly" foreclosed upon and should have been allowed to stay in their homes without having to cure those defaults, and because they weren't allowed to stay in their homes with the loan terms modified as necessary to accomplish that result, they are entitled to be "compensated."

I predict that over the next six years, Lizzie will inspire much talk of "pounding" and of "sand", most of it in the same declarative sentence.

I knew there was going to be a silver lining to Liz in the Senate. I never expected it to pay off so quickly. I sure hope Barney Frank wins John Carey's vacant seat so whenever blogging topics are ebbing, I can always go to my sure fire daily double.

Loan Buybacks: The Next Hand

The "repurchase risk" for single family mortgage originators that we've discussed for, literally, years here on the blog was, for the most part, a risk faced by those who sold loans to (or serviced loans owned by) Freddie Mac and Fannie Mae. They are the 800-pound gorillas in that space.

Add a new gorilla to the jungle. He's a Texas banker we've discussed many times before.

In 2002 billionaire banker Andy Beal had his Beal Bank sue the Federal Deposit Insurance Corp. in a lawsuit that accused the FDIC of originating faulty subprime mortgages to unqualified borrowers. For six years Beal pursued this quest against his very own regulator, until the FDIC agreed to pay $90 million in 2008 to settle the case.

Now Beal has found another seemingly impossible mountain to climb: getting big banks like Bank of America, Citigroup, Goldman Sachs and JPMorgan Chase & Co., to repurchase potentially faulty loans that were sold during the housing boom. According to Katy Burne at The Wall Street Journal, Beal is working to bring bondholders together  to investigate potential misrepresentations and contract breaches by the banks that sold residential mortgage-backed securities.

[...]

Some of the soured assets Beal purchased at fire-sale prices were residential mortgage-backed securities that were sold in deals in which banks made representations and warranties about loan quality and promised to repurchase those loans if the representations were no good. But in order to investigate, potentially declare a default and maybe launch lawsuits, holders of the securities like Beal need at least 25% of the voting rights in a trust.

The Wall Street Journal reported on Wednesday that Beal Bank holds more than $1 billion of these bonds, has been in contact with more than 20 bondholders, and signed on enough investors in seven of the 93 mortgage-backed securities held by a Beal Bank unit to proceed. Beal has probably already made lots of money off these investments but through this strategy he hopes to make even more. He is not the first person to pursue this kind of thing. The biggest such effort has been led by Houston lawyer Kathy Patrick, who has worked for big institutional investors like BlackRock and Pimco to pursue put-back claims and famously struck an $8.5 billion settlement with Bank of America. But these kinds of claims have proven very difficult to pursue.

Still, Beal seems to relish taking on impossible tasks. He once walked into a Las Vegas casino and challenged some of the best poker players in the world to some of the highest-stakes games ever played. It’s unlikely he is bluffing over this mortgage move.

Well, he didn't just "walk into" a casino and challenge the world's best poker players. He set it up in advance. They knew he was coming. Moreover, although he took some of the world's best for seven figures over the first round, Phil Ivy won that back and then some in the final round. He's still a legend, but he doesn't need the embellishment. To say he's "not bluffing" is entirely accurate.

Following Andy Beal's beat down of the country's biggest banks is going to be a hell of a lot more fun than watching Aunt Fannie and Uncle Freddie grow gray and wither. Stay tuned.

PATCO Played Out: A Few Lessons Learned

The last time we discussed the PATCO decision, the appellate court had found that the bank's security procedures to defeat account takeover were not "commercially reasonable," but had sent the case back down to the trial court to determine what legal responsibility the customer might have to prevent account takeover. Following that action, the bank and PATCO settled the case, so that burning legal issue was not resolved.

Recently, PATCO co-owner Mark Patterson and counsel Dan Mitchell were interviewed by Bank Info Security's Tracy Kitten about the lessons they think they learned from the case. Among those (along with my observations) are:

• PATCO approached the bank within the first month of the incident with a settlement proposal that turned out to be a heck of a lot less than what the bank eventually paid in settlement after three years of litigation. Both sides ended up enriching their legal counsel needlessly. Sweet!
• Community banks seem more willing to settle quickly than do larger banks. Mitchell and Patterson think that's because community banks are more concerned about the reputational risk if the dispute hits the press. Might this be a potential competitive marketing advantage for community banks? "Bank with us! We'll pay for your negligence!"
• Most cases of corporate account takeover are settled quickly, and off the radar screen. That certainly appears to be accurate from our personal experience. While many lawyers live to engage in disputes, bankers live to make money the old fashioned way: by doing business. It's hard to do business when you're the defendant and your customer is the plaintiff.
• Prospective litigation costs and reputational risk can be as much of a deterrent to bank customers pursuing litigation as they can be to banks.
• There's not much case law on these issues. Until there is, there is likely to be much jockeying for position, blustering and posturing by lawyers for both sides, unless responsible business leaders on each side of the table seize control early in the game and keep their eyes on the prize: salvaging the relationship (if possible) without breaking either the bank or the customer.
• Patterson thinks ACH should not be done by businesses, no matter how allegedly "strong" the security devices or procedures used. He claims that his business will use ACH only for tax payments. The reasons for his revulsion: the one-sided nature of the agreements prepared by the banks, which place almost all liability on the customer. Hey, that's why banks pay us the big bucks, Mark!
• Patterson and Mitchell do believe that customers have "some responsibility" for protecting their accounts from takeover. However, they claim that banks bear more responsibility than customers because they are "in a better position" to prevent and detect takeovers. While I don't disagree that banks should be more sophisticated in this area than the average small business owner, I'm still not willing to go as far as Patterson and claim that using a dedicated separate PC solely for online banking (and not for cruising Internet porn sites) is cost prohibitive for most small businesses. That simply doesn't pass the smell test for me. On the other hand, I'm an alleged elitist, so perhaps my view is slanted toward my liege lords and masters, "The Banks." Perhaps a refurbished eMachine for $250 is simply beyond the reach of the average small business. If that's the case, how much money would they stand to lose from any of their corporate accounts? Wouldn't cybercrooks just enter, laugh, and leave?

Whether you represent banks or bank customers, Mitchell's final words ring true.

I would bet my bottom dollar that there will be more lawsuits in the future in this area. What types of questions will come up really will depend on the unique circumstances of each case. But given the prevalence of corporate account takeover, you can bet that there will be more cases.

A Deal Is A Deal

AIG's moment of temporary insanity has passed. It's decided not to join a shareholder lawsuit filed by a company controlled by former AIG CEO Hank Greenberg against the US Government for bailing AIG out in 2008. Actually, Hank's company didn't allege that fact of the bailout was itself wrongful, just that the bailout terms set by the government were wrongful. Everyone understands that when you're going down like a torpedoed garbage scow, you always sue the guys who threw you a life preserver because they didn't reel you in quickly enough and you caught a nasty cold.

AIG's board of directors was apparently worried about reputational risk. Given the bad taste left in the collective mouth of the American public by the Wall Street bailouts, that's probably a justified worry. Politicians of all stripes were publicly uttering variations on the theme of "WTF?" on a daily basis. On the other hand, David Boies (yes, THAT David Boies), the attorney for Greenberg's company (which is the plaintiff in the litigation), thinks that the board's decision was not in the best interests of the shareholders. I assume that's a vague threat of a lawsuit against the directors of AIG. It seems to me that if Greenberg goes that route, he'll first have to win the lawsuit against the government in order to prevail against the directors. I'd think he'd have his hands full on with the suit against the government, without taking on the additional defendants. Then again, I don't swim in that specific shark tank, so I assume my rube-like perceptions and opinions are of little interest to the masters of the universe.

There were some other interesting, and even amusing, observations on AIG's board's decision. The Cato Institute's Mark Calabria astutely observed that big financial institutions rarely sue the federal government "because if they did, the government might not bail them out next time." Rim Shot!

On the other hand, AIG's CEO Robert Benmosche told CNCB that AIG believed that "a deal is a deal." Really, Bob? You danced with the bear and you still said that to a reporter without cracking yourself up? "A deal is a deal" as long as you're not the US government, which believes in honoring its deals unless it's politically expedient to renege on them, in which case it just litigates the resulting lawsuits for a decade or more until the public's interest in the outcome has been long since diverted to one or more other shiny baubles.

I understand the public relations downside as a reason to back off suing the US government. However, the "a deal's a deal" rationale simply doesn't hold water, based upon the nature of the devil with whom the deal was made.