Bank Lawyer's Blog

New Developments in the Battle between Banks & Credit Unions

Banks have long been jealous of credit unions’ tax-exempt status.  The battle has intensified as credit unions attempt to expand their powers.  Banks believe credit unions have an unfair competitive edge due to their tax-exempt status (and their exemption from the Community Reinvestment Act, an often costly statute for banks and thrifts) and credit unions counter that banks have seen record profits and have no room to complain.  Even the Dallas Fed sees credit unions as one of the threats to community banks:

“Credit unions, aided by favorable legislation and regulation, have emerged as another particularly severe threat to small banks. Beginning in the early 1980s, rule changes gradually relaxed the “common bond” requirement for credit union membership, leading to legislation in 1998 allowing a federal credit union to serve multiple membership groups. The loosening of membership restrictions enhanced growth opportunities, especially when coupled with policies favoring credit unions over banks, such as credit unions’ exemption from both federal taxation and the regulatory requirements of the Community Reinvestment Act.”  (http://www.dallasfed.org/research/swe/2004/swe0401b.html)

Credit Unions in California were dealt a blow this week in their on-going effort to expand services to non-members, particularly minorities and low-income individuals.  California Senate Bill 1292 died in the Assembly Banking and Finance Committee.  It was designed to allow state chartered credit unions to provide certain services to anyone eligible for membership (i.e. they would not be required to have an account with the credit union to receive certain services).  The services included check cashing, issuing money orders, and transferring money to foreign countries. 

The California bill is just one of the many efforts by state and federally chartered credit unions to expand their services, in this instance by providing check cashing privileges to non-members.  Ohio has a bill pending that would permit credit unions to offer check cashing for non-members.    Wisconsin and Michigan permit check cashing for non-members (Michigan expanded the check cashing capabilities of its credit unions this month). 

The US House of Representatives passed the Financial Services Regulatory Relief Act of 2003 (H.R. 1375) in March and begins hearings this month on the Credit Union Regulatory Improvements Act (H.R. 3579).  Expanding the check cashing powers of federally chartered credit unions is a minor provision in these bills, which would greatly expand the powers of federal credit unions.    The battle between banks and credit unions is already acrimonious, but as the House and Senate consider these bills, we can expect the rhetoric to get even worse.
---Anna Dolak

More About FACTA

Finally! Congress and the regulators have finally figured out that sometimes financial institutions obtain confidential information regarding their “consumers” in addition to their “customers.”  The regulators issued the Interagency Guidelines Establishing Standards for Safeguarding Customer Information (Guidelines) pursuant to section 501(b) of the Gramm Leach Bliley Act (15 USC 6801(b)).  The Guidelines  “require each financial institution to protect the security, confidentiality, and integrity of customer information.”   The proposed regulations and Section 216 of the Fair and Accurate Credit Transactions Act of 2003  (FACTA) protect consumers by requiring that institutions safeguard and properly dispose of consumer information contained in consumer reports or compilations of consumer information derived from consumer reports for a business purpose (69 FR 31913).

Consumer Information will be defined under the proposed regulations as “any record about an individual, whether in paper, electronic, or other form, that is a consumer report or is derived from a consumer report and that is maintained or otherwise possessed by or on behalf of the [institution] for a business purpose.”  It also includes compilations of such records.    The Guidelines originally required that financial institutions safeguard only customer information, which covers nonpublic personal information about an individual who obtains a financial product or service to be used primarily for personal, family or household purposes and who has a continuing relationship with the financial institution.

Certain types of “consumers” were left with inadequate protection under the Guidelines. As pointed out in the discussion of the proposed rule in the Federal Register, customer information did not include consumer reports about an individual who was turned down for a loan, an individual who guaranteed a business loan, an employee or a prospective employee, or an individual in connection with a loan to his/her sole proprietorship. 

Of course, if financial institutions were prudent, long before the Guidelines were established they safeguarded both consumer and customer information.  But, we’ve all seen the occasional news story with a reporter standing in a dumpster outside a financial institution sorting through discarded customer financial records.   

Institutions should note that employees’ and prospective employees’ consumer reports are now included in the safeguards.  Institutions that use recruiters will need to ensure that their agreements with these recruiters include provisions regarding the safeguarding of consumer reports.  Human Resources Departments, previously unaffected by the Guidelines, now must be covered by the required safeguarding policies.

It is good to see one more step taken to protect all individuals from identity theft.
---Anna Dolak

Renting A Bank's Charter

There is a trend we’ve seen manifesting itself in the field of mortgage banking that smacks of financial institutions “renting their charters” to independent mortgage bankers. This is a practice that has been specifically condemned by the national banking regulators, most recently with respect to “payday lending.” The same objections are applicable to mortgage lending and other activities where the preemption granted to banks and other types of financial institutions, whether by state or federal law, attracts a third party lender to “hitch his wagon” to a bank or thrift, yet, in many important respects, to remain an independent business.

Here is a typical scenario: a state chartered “thrift and loan” located in a state with a less-than-restrictive state banking regulator recruits independent mortgage originators throughout the country by having them sign an agreement in which they will originate mortgage loans as a “licensee” or “agent” of the lender, in states other than where they have a license to do business. The loans are originated in the name of the lender, which, as “bank” as defined by state law, is exempt from state licensing under the laws of at least 37 states. The broker is given a web page provided by the bank, and solicits borrowers throughout the 37 states. In states where it is not licensed as a mortgage broker, it must rely upon the argument that it is performing only loan “processing” services for the bank and is not acting as a “broker” in the state of the borrower’s residence. The bank retains and pays the third party fees shown on the borrower’s settlement statement, and retains a fee for its “funding” services. The remaining fees earned on the loan are paid by the bank to the broker.

There are a host of issues raised b y this arrangement, not the least of which are the treatment of the various fees under RESPA. Are any of the fees paid for “referrals,” which may be illegal payments under RESPA (and, believe it or not, some of the agreements actually refer to the payment of “referral fees”), or are they only for actual services rendered? If the latter, are the fees “reasonable,” and do they otherwise comply with HUD standards for payment of fees to brokers, including their treatment on the HUD-1? Are “volume bonuses” paid by loan purchasers to the bank and then split with the broker proper fees paid in connection with a bona fide secondary market transaction? If the broker is not an employee (which many of the agreements we have reviewed clearly provide), then how are FHA loans made (in light of HUD’s prohibition on the use of other than employees of the lender)?

The fact that a state-chartered bank may not be required to be licensed as a mortgage lender or broker in a given state does not mean that other aspects of preemption of state apply to the loan process or the other activities of the broker or the bank. For example, some states specifically restrict certain loan terms, such as loan fees and prepayment penalties. A federal savings bank, for example, would be exempt from such state laws by virtue of specific regulatory preemption regulations. A state chartered “bank” would not have the benefit of similar federal law preemption principles. The broker and the bank would be responsible for knowing the specific restrictions of state law regarding the terms of the loans and other matters that are not preempted (disclosures, advertising, etc.).

Of even greater concern to banking regulators is the fact that the banks involved are touting this arrangement as a way for independent mortgage brokers to remain independent, yet use the bank’s preemption from state licensing laws to permit the broker to originate loans in states other than those in which it is licensed to do so as a mortgage broker or lender. Certainly, a federal savings bank regulated by the OTS or a national bank regulated by the OCC could expect scrutiny of such arrangements, to ensure that the bank or thrift actually exercised effective control over the operations of brokers who are originating loans in the bank’s or thrift’s name, through web sites that identify the bank as the lender. “Renting a charter” to a third party for the purpose of avoiding state laws that protect consumers is a “hot potato” at the current time. The FDIC’s apparent laxity with respect to “pay-day” lenders, and the fight over the OCC’s recently promulgated regulations on federal preemption of state law applicable to national banks, and on predatory lending practices, have brought the entire issue to the forefront.

Apparently, the state-chartered banks involved in this practice are counting on the continued lack of objection by the FDIC, and the continued sympathy of state banking regulators who are eager to increase the number of state-chartered institutions that they regulate. In my opinion, this is a risky course. The preemption from state licensing requirements for “banks” depends on the law of each state involved. Currently, at least 13 states do not preempt state-chartered banks from state licensing. The other 37 states each will permit such preemption to exist only so long as the issue does not appear on the radar screen of other state chartered banks, consumer advocacy groups or other interested parties with local political clout to force a change in state law or a change in the attitude of the FDIC.

There are ways to structure relationships between mortgage brokers and federally-chartered financial institutions that will allow mortgage originators to enjoy the benefits of preemption of state law licensing requirements in all 50 states, not merely 37, and without running afoul of the concerns of the federal banking regulators that the institution is “renting its charter.” Such arrangements should also provide broader and more stable preemption of state law restrictions on loan activities of mortgage originators than is provided by many of the arrangements we have reviewed.

As with all worthwhile endeavors undertaken in a heavily regulated environment, the devil is in the details.
---Kevin Funnell

FACTA: Model Notices of Furnishing Negative Information

Yesterday, the Federal Reserve Board (the “FRB”) adopted final regulations that adopt model notices that banks and other “financial institutions” (as defined by section 509 of the Gramm-Leach-Bliley Act) can use to satisfy the requirements of Section 217 of the Fair and Accurate Credit Transactions Act of 2003 (“FACTA”). The regulations that adopt the model forms become effective July 16, 2004.  Section 217 of FACTA becomes effective December 1, 2004.

Section 217 of FACTA requires that any financial institution that:
• extends credit and regularly and in the ordinary course of business furnishes information to a “nationwide consumer reporting agency” (currently, Equifax, TransUnion and Experian), and
• furnishes “negative information” to such an agency regarding credit to a customer,
must provide to the customer a “clear and conspicuous notice” about furnishing negative information. “Negative information” is information concerning the customer’s delinquencies, late payments, insolvency or any form of default. The notice must be provided to the customer prior to, or in no event later than 30 days after, furnishing the negative information to the nationwide consumer reporting agency.

After furnishing the notice, the institution is not required to actually furnish negative information, nor is it required to give the notice again if it later furnishes additional negative information to the agency with respect to the same transaction, extension of credit, account or customer. Although FACTA specifically prohibits including the notice in the initial disclosures required by the Truth-in-Lending Act and Regulation Z, the notice may be provided on or with any notice of default, any billing statement, or any other materials provided to the customer. So long as it is “clear and conspicuous.”

FACTA required the FRB to adopt a model notice form, not to exceed 30 words in length, that financial institutions are permitted, but not required, to use to comply with this notice requirement. Nevertheless, institutions that use the model notice form will be deemed to be in compliance with the notice requirement.

The FRB adopted two model forms, one to be used by institutions that give the notice prior to furnishing negative information and the other by institutions who give notice after furnishing negative information. Institutions may make changes to the format of the model forms and still have the benefit of this safe harbor, but not changes that are so extensive “as to affect the substance, clarity, or meaningful sequence of language in the model notices.” The FRB regulations that adopt the model forms list examples of acceptable changes; however, the safest course would be to give the model notices in the form adopted by the FRB without change.

We expect that most lenders will include Model Notice B-1, the form to be given prior to furnishing negative information, and will include it as part of the loan application documents (in a “clear and conspicuous” manner). In that manner, they will be assured that they will not have to monitor whether or not they have given negative information concerning a specific customer to a nationwide credit reporting agency.

FACTA provides that a financial institution shall not be liable for failure to adhere to the notice requirements in a particular case if, at the time of the failure, the institution maintained reasonable policies and procedures to comply with this requirement or the institution reasonably believed that it was prohibited by law from contacting the consumer. Here is a specific “safe harbor” from statutory violation that can be achieved by the adoption of appropriate policies and procedures by the institution. It may not guaranty that the institution will avoid regulatory criticism if it fails to follow those policies and procedures, but at least it will avoid statutory penalties.
---Kevin Funnell

Cybersecurity and The Fear of Regulators

An article in yesterday’s The Wall street Journal caught my eye. It concerned the following findings of a survey by Deloitte & Touche LLP on attacks on banks’ computer networks over the past year:
• 83% of the 100 largest global financial institutions had their networks “compromised” by external attackers last year, up from 39% in the previous year.
• 40% of those attacked suffered financial losses.
• One-third of senior information security officers surveyed said their banks aren’t effectively using the security technologies they have purchased.
• 87% stated that they have a “fully deployed” system of antivirus measures, down from 96% the previous year.
• Two-thirds have a program for managing data privacy, up from 56% in 2003. These programs have been required of US financial institutions, with respect to data privacy since 2000 and, with respect to data security since 2001.
• “Almost” 70% believe that their senior management “is committed to security projects needed for regulatory compliance.” Again, such programs have been mandated for several years for US financial institutions.

What to make of all of this? If these are the largest global financial institutions, and a substantial portion of them are (A) vulnerable to external cyber attacks, (B) suffering real financial losses due to such attacks, and (C) not fully committed to data privacy and security programs, what about the rest of the financial institutions in the US? Presumably, the largest institutions, while perhaps presenting more attractive “targets of opportunity” to computer hackers and thieves, have the most resources, financial and intellectual, to devote to data security. Yet, they’re not getting the job done. Moreover, a sizable majority do not appear to be committed to the task, notwithstanding the fact that the law requires that commitment.

The article does state that “[f]ear of regulators does appear to be sparking improved protections for consumer data coveted by identity thieves.” It’s cold comfort to know that “fear of regulators” is only “sparking” improved protections, when those protections were required to be in place by July 1, 2001. If this survey’s results are accurate, they should raise concerns throughout the banking system.

We assist banks in the area of data privacy and security, and we understand that no computer system is completely safe from external attack, nor is it reasonable to expect that it can be made so. Nevertheless, every financial institution needs to take this issue seriously. If it doesn’t, it faces not merely financial loss and loss of customer goodwill, but potential adverse regulatory action.

Several years ago, the owner of a small commercial bank approached us with an idea. He wanted to have a web page that trumpeted the fact that his bank did not do business over the Internet, and that its customers' data would not be put at risk to cyber theft. We asked him what type of bank customer he wanted to attract with that web page, and he said those who don’t use the Internet. We asked the obvious question: If the potential customer didn’t use the Internet, how would they ever see the web page?

We got a chuckle out of that at the time. Now, we think he may have been on to something.
---Kevin Funnell