I ran across an interview recently that the FDIC's Elizabeth Khalil gave to InfoSecurity's Tracy Kitten about the FFIEC's proposed guidance on social media. Among my take-aways are the following:
The final guidance is expected to be out in the near future (the comment period closed March 25th), depending on the nature of the comments received.Interested bankers should keep their eyes peeled (although, don't hold your breath).
I'll be giving a breakout session on social media compliance on July 3, 2013 at CUNA’s America’s Credit Union Conference in New York City. If you're a reader and are attending that conference, say hello.
The 20/20 hindsight afforded members of Congress when judging the alleged failures of the independent foreclosure reviews that we discussed last night also graces the peepers of the Government Accountability Office.
The independent foreclosure reviews abruptly ended by regulators in January failed from a lack of objectivity, oversight and consistency in the loan sampling process, said Lawrance Evans, director of financial markets and community investment for the Government Accountability Office.
[...]
Despite having a large portion of the funds already in the mail to homeowners, Evans says GAO’s probe into how the IFR was handled is far from complete.
He told lawmakers GAO plans to conduct more studies on how regulators came up with the $8.5 billion settlement figure when there is no data to show how that number was chosen or exact calculations on how many homeowners were, in fact, harmed by foreclosures.
He pointed out that "regulators’ statistical sampling approach did not include mechanisms to allow the regulators to monitor consultants’ progress toward finding as many harmed borrowers as possible."
Without data on how many borrowers were actually harmed, the GAO representative says his office wants answers on how the compensation figures were determined by the OCC and Federal Reserve.
In other words, the beat(ing) will go on.
And On.
And on.
While that's going on, the regulators are going all passive-aggressive by asking Congress to clarify that the regulators have the power to take enforcement action directly against independent contractors for banks. Because, you know, if the regulators require banks, as part of related enforcement orders, to hire independent consultants to perform very expensive services in order to comply with the enforcement orders, and the lack of clear, or even consistent, instructions on what the criteria and processes should be to perform those services leads to later criticism of the regulators over those services, well, then, regulators must be able to blame somebody, and looking in the mirror is simply out of the question (vampires cannot see their own reflections). Thus, the regulators must be able to blame the independent contractors and pursue them via enforcement processes that give the regulators a leg up on the object of their (lack of ) affection. Just like banks.
The independent contractors are reacting badly to the regulators' reaction (paid subscription required).
"I'm not sure having the regulators regulate consultants would make them more independent," said Jon Winick, president of bank advisory firm Clark Street Capital. "A better idea is to have the regulators hire the consultant then."
That would be a good alternative, except then the regulators would be responsible for the consultants' performance (or lack thereof), and we can't have that. They must be able to blame either the banks, the consultants, or both. That's not possible if the regulators are in a position to bear any responsibility.
"To me, the whole thing about the consultants is just more scapegoating," said Walter Moeling 4th, a partner at the Bryan Cave law office.
Man, I'm glad I'm not as cynical as Walt. Personally, I think this is all just a legitimate disagreement among well-intentioned people who are not worried about covering their own backsides, deflecting blame, or promoting themselves at the expense of others, but only about trying to "do the right thing."
Every once in awhile, the blustering blunderbuss known as Senator Liz ("She-Reams-For-Sport") Warren fires a scattershot salvo that strikes a worthy target. You know, like when Dick Cheney shot a lawyer in the face.
The other day, Princess Rides-Bankers-Like-A-Burro was grilling some representatives of the big-time independent foreclosure review firms at a hearing that only Democrats attended (so you know it wasn't going to be pro-banker) and, as related by Larry Doyle, she struck oil.
Senator Warren: I just want to take a look at the Independent Foreclosure Review Payment Agreement details. I think you’ve probably all seen this one page agreement that lists all of the things that the banks did wrong and then boxes for how many people fall into each category and how much money they’re going to be paid. Is that right? You’ve all seen this? [Panel indicates they have seen it.]
And this was put out – who put this out? I think this is put out by the OCC and Federal Reserve. Is that right? As part of the settlement details. So I just want to ask you about this.
It has some pretty amazing categories here. The first category is about service members who were protected by Federal law whose homes were unlawfully foreclosed. It’s got people who were current on their payments whose homes were foreclosed. It’s got people who were performing all of the requirements under a modification who lost their homes to foreclosure.
And it tells how many people fall into each category and how much money the people in that category will receive. And, it ultimately resolves what will happen to 3,949,896 families.
So the question I have is having resolved this nearly 4 million families, who put the people, the families, into each of these boxes. Is that what your firms did. Mr. Ryan?
Owen Ryan, Partner, Deloitte & Touche LLP: No, Senator, we did not.
Senator Warren: So who put them in.
Ryan: I’m not sure how that schedule is prepared. I saw it for the first time yesterday.
Senator Warren: Mr. Flanagan?
James Flanagan, Leader, U.S. Financial Services Practice, Pricewaterhouse Coopers LLP: Same response. We were not involved in the accumulation of that information.
Senator Warren: Mr. Alt?
Konrad Alt, Managing Director, Promontory Financial Group: Senator, I’ve seen the schedule but I’m not familiar with the basis for its preparation.
Senator Warren: So let me understand this. You ran the independent reviews, right. That’s what you got paid to do. And yet, I presume, the only one left is the banks must have put them in these boxes and you made no independent review of their going into these boxes. You were not asked to do that? Mr. Alt.
Alt: No Senator, we were not asked to do that.
Senator Warren: Mr. Flanagan.
Flanagan: No we were not.
Senator Warren: Mr. Ryan.
Ryan: We were not Senator.
Senator Warren: So that leaves us with the banks that broke the law were then the banks that decided how many people lost their homes because of their lawbreaking. And, as a result, how many people would collect money in each of these categories. Is that right Mr. Alt?
Alt: Senator, I’m not familiar with the basis for the scheduling.
Senator Warren: So far as you know, there’s no independent review of the banks’ analysis…you looked at 100,000 cases and the banks have now put 4 million people into categories and resolved finally how much they will get from this review by the OCC and the Federal Reserve.
Sweet!
As Mr. Doyle put it, "Bang up job on behalf of the American taxpayer from these individuals and their firms charged with an independent review of this settlement process. NOT!!"
But here's a word in defense of the consulting firms: when Mr. Alt said that it wasn't in the scope of their duties, he was not kidding. As one of my readers, a bank lawyer, advised me, the entire review process was FUBAR from the get-go.
I saw it up close and it was an absolute Rube Goldberg process with the scope, criteria and objectives changing constantly. Regulatory example 1001 of do as I say, not as I do.
It's always easy to use 20/20 hindsight to bash people, of course. However, since the regulators love to do it to bankers, I guess turnabout is fair play.
My posts concerning former bank CEO Patrick Adams and his long, hard, expensive fight to clear his name encouraged one reader to send me a copy of a decision from a couple of months ago that involved another bank officer (actually, the Chairman of a bank) who has been slugging it out with the OCC (and in this case, the Fed) four the last four years over an attempt by the regulators to oust him from his position with the bank. The D.C. Circuit Court of Appeals held in his favor and sent the case back to the banking agencies with some pretty caustic comments.
The entire opinion is an interesting read, but here's a synopsis, paraphrased from one prepared by my correspondent.
Louis DeNaples, was a director and controlling shareholder of a national bank and two bank holding companies. In 2008, Pennsylvania state prosecutors charged him with perjury. But the charges were later withdrawn pursuant to an agreement in which Mr. DeNaples agreed, among other things, to release claims against the state based on irregularities in the underlying grand jury proceeding. Thereafter, the state court expunged the entire prosecution. The Comptroller of the Currency and the Federal Reserve Board, however, concluded that Mr. DeNaples had violated Section 19 of the Federal Deposit Insurance Act, which prohibits a person from participating in a regulated financial institution after entering into a “pretrial diversion or similar program” with respect to certain criminal offenses, including perjury. The agencies thus issued cease-and-desist orders directing Mr. DeNaples to resign from his positions, and to divest his shares, in the regulated institutions.
Mr. DeNaples appealed, arguing, among other things, that (1) his agreement for withdrawal of the perjury charges was not a “pretrial diversion or similar program,” and in any event (2) Section 19 does not apply to expunged convictions. A three-judge panel of the D.C. Circuit unanimously agreed on both counts.
First, the Court held that the banking agencies’ interpretations of Section 19 are not entitled to Chevron deference. The panel adopted DeNaples' argument that no deference is warranted for any part of the Federal Deposit Insurance Act because multiple agencies enforce it, creating the potential for inconsistent agency interpretations, as occurred in this case.
Next, the Court held that the agencies had applied inconsistent and overbroad definitions of the term “pretrial diversion or similar program,” essentially capturing any situation where a person supplies a “quid pro quo for the prosecutor’s withdrawal of charges.” The panel explained that pretrial diversion generally refers to a discrete program that seeks some offender- or community-oriented outcome such as treatment, rehabilitation, or restitution. The Court, moreover, adopted the argument of DeNaples' lawyers that the agencies on remand must consider the meaning of “pretrial diversion” under state law, which they adamantly refused to do in the earlier cease-and-desist proceedings.
Finally, the Court agreed with DeNaples that the OCC’s and the Board’s positions on the impact of expungement were both internally inconsistent and at odds with a published FDIC policy statement. In a stunning rebuke of the agencies, the panel criticized their positions as “bizarre,” “untenable,” “unpredictable,” and a “scattergun approach,” and said that reconciling their views “is like trying to draw a two-dimensional shape on the surface of a grapefruit.”
Trying to draw a two-dimensional shape on the surface of a grapefruit. For four years. A worthy endeavor, no?
Incidentally, the lead counsel for DeNaples (at leas, the lawyer named in the opinion) is Howard Cayne, a well-known D.C. banking law litigator who, like your trusty bloviator, has "danced with the bear" on previous occasions. The man must have a high tolerance for pain. As must Mr. DeNaples.
The Obama administration’s recent call for mortgage lenders
to loosen
underwriting standards on residential mortgage loans to less-than-“Qualified
Mortgagors” as long as the FHA (i.e., the American taxpayer) is taking most
of the risk of default, generated some pretty strong reaction from the usual
suspects.
"If that were to come to pass, that would open the flood-gates to highly excessive risk and would send us right back on the same path we were just trying to recover from," said Ed Pinto, a resident fellow at the American Enterprise Institute and former top executive at mortgage giant Fannie Mae.
[…]
"There's always a tension that you have to take seriously between providing clarity and rules of the road and not giving any opportunity to restart the kind of irresponsible lending that we saw in the mid-2000s," said a senior administration official who was not authorized to speak on the record.
Ya’ think?
The administration is also purportedly urging the Justice Department to ease up on lenders who make loans in accordance with the administration-encouraged looser and goosier FHA underwriting critera. The FHA also claims that it hopes to encourage "by example" Fannie Mae and Freddie Mac to follow along. It's as if the subprime meltdown never occurred and Dodd-Frank was never passed, except for the fact that the federal banking regulators, including the CFPB, are taking a directly contrary approach to mortgage underwriting. Moreover, loan originators live in mortal fear of Freddie and Fannie repurchase requests, which have been massive, since those two publicly-controlled giants are the conventional residential mortgage market.
This whip-saw of inconsistency evidences a major example of cognitive dissonance.
Private reaction from bankers and bank lawyers with whom I attended the recent Texas Bankers Association Annual Legal Conference in Austin, Texas, was even more derisive. Much time during that conference was spent parsing the nuances of “Qualified Mortgages” and “Qualified Residential Mortgages,” which will make qualifying for a residential mortgage loan much more difficult for many potential homeowners. In addition, the plethora of new regulations being spewed out by the CFPB makes consumer lending, including making single family mortgage loans, riskier and more expensive. The bottom line for a number of community bankers is that they will be making few, if any, residential mortgage loans, at least not directly. In addition, bankers who decide to make residential mortgage loans are definitely not crazy about making anything other than loans that will fall under the QM safe harbor.
I would say that it’s amazing that the administration could talk so glibly out of both sides of its mouth, except that it’s not at all amazing. It’s what these cynical, pandering clowns do as naturally as breathing in oxygen and exhaling carbon dioxide.
Community banks have been concerned that, although they might be exempt from direct supervision and enforcement by the CFPB, they would be recipients of a "trickle down" effect that would result when their primary federal bank regulator would attempt to demonstrate that it could stay abreast, or even ahead, of the CFPB when it comes to cracking down on unfair, deceptive, and "abusive" practices. Fraud, small banks understand, but they tend to fear zealots who may not be able to define an "abusive" practice with precision, but sure as shooting know it when they see it.
An article in the most recent issue of Bank Safety & Soundness Advisor (paid subscription required) indicates that community bankers' fears are not without some foundation.
In a recent Webcast, officials from the Fed along with the Federal Reserve Bank of San Francisco showcased a broadbased enforcement approach to UDAP rules and regulations, and some high expectations for how banks should be identifying and resolving complaints involving abusive or deceptive practices.
While some of the examples cited, including inflating borrower income on loan applications and charging "bogus points and origination fees" are clearly fraudulent, the net appears to be cast widely by the Fed.
Officials indicated they view as a kind of red flag banks pushing new or modified products and services to generate new revenue, especially if done in conjunction with third-party vendors where fees are shared.
“While searching for revenue is part of what a bank needs to do, there is also a need to make sure
there is compliance with UDAP and consideration of UDAP risk,” said Maureen Yap, the Federal
Reserve’s special counsel for fair lending.And the officials underscored the idea that an act or practice does not have to violate another law to be unfair or deceptive. A potentially tell-tale sign of that: cases where revenue growth depends on consumers making what regulators and examiners feel are poor financial choices.
There you go: what an examiner "feels is a poor financial choice" by a consumer is the acid test. That gives a whole boatload of precision and certainty to the determination of what is and is not "abusive." Every bank will have to have a Potter Stewart on staff to make the call, I guess.
The potential burden is not going to be light.
For individual institutions, the potential coverage is huge, including not only all products and services, but every phase of the life cycle, including development, marketing, and loss mitigation activities.
One bank's "bogus points" scam, perpetrated by rogue loan originators, led to a determination that it had a "disparate impact" on minorities, and earned that bank a referral to the Justice Department. So, there's that potential liability to look forward to, as well.
What's a small community bank to do? Fed officials tried to be helpful.
Officials declined to address specific fact situations bankers posed during the March 5 webcast. They suggested that banks use the same sort of analysis that regulators do in assessing potential misconduct.
Yap said the Fed tells examiners to focus on the “INN” in determining whether conduct is unfair under the law. There must be “injury” to the consumer or group of consumers, the injury is “not reasonably avoidable,” and there are “no countervailing benefits.”
She said Fed examiners focus on the “MRM” to judge whether behavior is deceptive. Does the representation or omission “mislead” the consumer? Is the consumer response “reasonable”
given the representation or omission? Is the misrepresentation or omission “material”?“The act or practice does not have to violate another law to be unfair or deceptive,” she said.
“If the prongs of the analysis are satisfi ed a UDAAP violation can be cited.” She said CA Letter 07-08 — a joint Federal Reserve/FDIC statement on consumer compliance exam procedures for UDAP — was “very instructive” in the types of questions bank should expect.
There's your heading on a course through the fog-bound waters of "abuse": think like an examiner.
And after you take that journey down a rabbit "warren" (pun intended), you can resurface and start walking like an Egyptian.
You've got your marching orders, folks. You can get with the program or you can get out of the business. Welcome to this brave new world.
I'm going to hold off on further comment on the United Western decision for the time being while other people work to track down the abusive troll who drove off the rails over last Wednesday night's post on that decision. His IP address is 68.100.237.36, which belongs to Cox Communications. They've been notified and verified that they're looking into it.
Interestingly, on Friday, I had two visits to the blog in the early morning hours (prior to 7 am) from the troll's IP address, and the troll spent over ten minutes reading the pages I linked to in Thursday's post, including my 2007 post on the criminal nature of his conduct. I hope that he learned something. He was back over the weekend several times. He uses both a Mac operating system and a Windows system, so I assume he has a Macbook or iPad and also a desktop PC. I also know, for each visit, his browser, monitor resolution and color depth, Javascript version, entry and exit time, pages visited, and other information that will come in handy when the time comes to nail his identity down.
Interestingly, on Friday I received 11 visits to the blog from the OCC, and only four from the FDIC and FRB combined. All OCC visits were from IP addresses 199.83.40.33 and 199.83.40.34. I say "interestingly," because the only hateful comments I've received from federal bank regulators over the past few years have come from people employed by the OCC, one of whom is an attorney and who advised me after the summary judgment hearings in the United Western case last November that I "should keep a spot next to your plate tomorrow for a big helping of crow. Mmmm…. Tasty." How did that guy know I was eating a raven for Thanksgiving?
The other contact from the OCC was by a person who posted a comment in January to another post using the IP address 199.83.40.34. He identified himself only as "Carl," but used the email address "cgoss@gmail.com." A quick Google search revealed the likely name of an OCC attorney. I made a reply comment that called him out, by that full first name, for using an OCC computer to leave immature comments on a blog during working hours, and I heard nothing further from him. Of course, I suppose someone at the OCC using his gmail address and first name could have been setting him up. Maybe it's that kind of place.
The last visit from the OCC on Friday came via a link on this page on Investor Hub, where investors in United Western stock have been following the trial for some time. Guess where the troll's first visit from home on Saturday morning originated? Yes, from that same page at Investor Hub.
All this may be coincidental. This coward may be holed up in the Air and Space Museum or working the cash register at a 7-11. Nevertheless, if this clown is, as he alleges, with one of the federal banking regulators, then I hope his conduct is considered to be an aberration by that agency.
By the way, visitors, especially those with a law degree, really need to read and pay attention to my Disclaimer and Comment Policy.
Barring further developments, I'll be back to other topics tomorrow.
UPDATE 03.11.13: A reader emailed me to ask whether I wasn't being too harsh on this troll, but that my correspondent might feel differently if the troll had threatened regulatory retaliation. I thought I had made that clear in my previous post. "Don't think that people in the banking agencies forget your gratuitous insults." How, exactly, would you interpret that? You think I'm irritated because of name-calling?
A reader sent me a copy of yesterday's decision of Federal District Court Judge Amy Berman Jackson in the United Western Bank lawsuit against the OCC that sought to set aside the January 2011 decision of the OTS to appoint the FDIC as receiver for the bank. To make a long story short, Judge Jackson ruled in favor of the OCC and refused to overturn the decision of the OTS (now defunct and subsumed by the OCC). I haven't had an opportunity to read the opinion or carefully consider it, and will not have an opportunity to do so until this weekend.
My initial reaction is that this is no surprise. From a couple of telephone calls I received today from other banking law attorneys who've been following the case, it appears to be no surprise to most banking attorneys. As I said when I first wrote about this case two years ago, the legal deck was stacked against the plaintiff from the start. As I also noted the following year, "no matter what my heart tells me, my head tells me not to bet against the OCC."
It may be disappointing to many that David failed to slay Goliath, but given the high legal bar to jump over, you'd need the helping hand of God to clear it, and, in this case, divine intervention was not forthcoming.
According to the FDIC, a common theme in IT examination
downgrades is poor vendor management by banks.
Last year, in 46% of the FDIC IT examinations in which bank ratings were downgraded, inadequate vendor management was cited as a causal factor, says Donald Saxinger, senior examination specialist in FDIC's Technology Supervision Branch.
"I'm not saying it was the primal causal factor, but, in 46% of the downgrades, vendor management was cited," Saxinger says. He spoke during the recent ABA Telephone Briefing "Vendor management: Unlocking the value beyond regulatory compliance."
Although the most common “error” that FDIC examiners discovered was the failure by banks to ask their vendors for copies of regulatory examinations, that wasn’t the only nugget contained in the linked article from the ABA Banking Journal. Among the others:
• Vendor management needs to consider all service providers that hold sensitive customer information, not just IT vendors. These include loan workout consulting, appraisal review companies, outside attorneys, and others.
• Make sure to get the proper exam reports about individual vendors. Some banks just obtain reports for the host data center, but not for the specific application that the banks were using.
• Even the proper reports don't cover everything that a bank must consider in its security risk management efforts. For example, one service provider with an otherwise clean report did not have an internal audit program and its business continuity planning was poorly documented.
This is all sound advice, of course, but knowing what you need to ask for is only half the battle. You also need to make certain that the agreement with your vendor gives the bank the right to ask for, and the vendor the obligation to deliver to the bank, copies of the necessary reports. Relying on the goodwill of the vendor in coughing up examination and audit reports, especially when they may contain results that are less than flattering to the vendor, is "unwise."
Here's one more tip: if the report reveals problems, the agreement with the vendor should require the vendor to notify the bank of what action the vendor intends to take to remedy the defects, and should also require the vendor to give the bank periodic progress reports on its progress in correcting those problems.
I'll be doing a webinar on March 6, 2013 on the topic "Technology Service Agreements: Meeting Regulator’s Expectations." It covers regulatory guidance applicable to credit unions, banks, and thrifts, although the same essential principles apply to each. The goal is to discuss the provisions of a technology service agreement that regulators expect (and that sound business judgment requires) be included, and to give financial institutions guidance on how to approach the issues covered by each of those provisions so that the institution meets its regulator's expectations while also meeting the institution's business needs.
