Bank Lawyer's Blog

Patco and Experi-Metals: How Much Hope Do They Really Give Small Businesses?

The Wall Street Journal ran an article by Joe Palazzolo today that discussed the court decisions in the Patco and Exeri-Metal cases, in which a federal district court (Experi-Metal) and a federal appeals court (Patco) found that banks' online security measures were not commercially reasonable. Palazzolo's point of view is that these cases give some "hope" to small business owners that when their bank accounts are hijacked because the business owners' security was flawed, the business owners are not necessarily going to eat the entire loss. According to lawyers for the business owners involved, owners of small businesses "often lack an understanding of cyberthreats when they accept bank security procedures," and, therefore, the bank bears a higher responsibility for making sure those security procedures are effective.

I'm not reading that much into the two decisions. First, last year, I questioned the soundness of the reasoning behind the court's reasoning in the Experi-Metal case, and I haven't changed my view. The bank settled that case rather than appeal it, so while it provides some precedential value in an area of the law where there's not much precedent, I don't think banks should quake in their boots over Experi-Metal.

As to Patco, while (as noted in a post last week) it's an appeals court that rendered the decision and, therefore, the ruling carries more weight, the facts are fairly bad for the bank involved. The bank had in place a process for flagging high risk transactions, the flags were raised, and the bank ignored those flags for an extended period of time while the thieves made off with the loot. If you have procedures in place and you don't follow them, it's hard to argue that you shouldn't be held at least partially responsible for the loss. Also, the appeals court sent the case back to district court to determine (among other things) the extent to which the customer ought to be held responsible for lax security in permitting its online security identifiers to be compromised. That's an issue on which it might be good to have some case law that states that the customer can't be lax in protecting itself (in other words, ignorance will not be an excuse). The fact that the court suggested that this was a good case for settlement indicates that neither side had clean hands.

I do agree with a couple of other points made in the article. One is that banks ought not to simply rely upon the protective language contained in their online banking agreements as to the commercial reasonableness of their security procedures and then go to sleep. Those contractual protections are very important, but they're not the end of the story. If, in fact, those procedures don't pass a judge's smell test for reasonableness or, even if they do, if the bank doesn't implement and follow them effectively, the bank may be exposed to liability.

Another point that appears at the end of the article also strikes me as being valid.

...William T. Repasky, a Louisville, Ky., lawyer who represents financial institutions, says the First Circuit ruling could prompt some banks to view small businesses as higher risk customers.

As a result, banks might then begin to pass on to small business customers their own increased costs for added security and customer education, he predicts.

If the courts keep coming down on the side of small business borrowers that have their security credentials compromised, I agree with Repasky that it's going likely going to cost small business borrowers more money to do online banking business with banks.

I think it's important that banks educate their customers in online security, and not merely because such education is now mandated by FFIEC guidelines. Education can result in decreasing the chances of cybertheft with respect to those clients who take such education to heart, and provide an additional defense for the bank against those customers who don't and whose accounts are compromised.

A New World Order

Cultures fight wars with one another. They must do so because values can only be asserted or posited by overcoming others, not by reasoning with them. Cultures have different perceptions, which determine what the world is. They cannot come to terms. There is no communication about the highest things...Culture means a war against chaos and a war against other cultures.
---Alan Bloom, The Closing of the American Mind

Recess Richie Cordray was popping off to The Los Angeles Times (Motto: "We Make The New York Times Look Like A Reactionary Rag") and he assured the world that the CFPB was here to stay and that its opponents had better just adjust themselves to the "New Order." Yes, that's the term he used: "new order." Given the loaded import of that term among conspiracy groupies and the fact that Cordray's a former Jeopardy champ who surely understands the meaning of the words he uses, I assume he meant what he said.

When asked if he was surprised that the intensity of the animosity to the CFPB has not dissipated, Cordray claimed that he was not.

No, I'm not surprised. I think these things will dissipate over time.... And what happens over the course of time is people begin to reconcile themselves to a new order and the law of the land.

He seems much more sanguine than the nearly hysterical Adam Levin, former New Jersey Division of Consumer Affairs Director, who recently unleashed a dark rant that alluded to "Rise of the Dark Knight" movie scenes as depicting the designs of "evil" banks and their D.C. minions to bring down the sacred temple of the CFPB. It's an ironic read in light of the recent Wall Street Journal opinion piece that discusses the pro-free market, anti-Occupy theme of that movie.

Levin is not to be confused with Adam Levitin, Liz Warren's former running buddy at the Credit Slips blog, where they consistently bunched their panties in garment-rending paroxysms of rage at banks and their running dog lackeys and their nefarious plans to screw consumers, the elderly, field mice, and a Boy Named Sue. (I love being a running dog lackey, by the way, especially when my masters throw me a bone.) Levitin's been too busy pushing his plan to make lenders and mortgage securities investors eat their borrowers' negative equity through "strong regulatory and litigation pressure" to blow air kisses to Richie, but he may refocus once his plan runs aground on the shoals of political reality.

My view is that Levin's fears are well founded and that Cordray either suffers from a bad case of hubris, is whistling past a grave yard, or has been drinking from the same pitcher of Kool-Aid as Maxine Waters was when she thought she could outfox Ben Bernanke. There's a real move afoot by financial institutions and non-bank victims businesses regulated by the CFPB to crush the agency like a grape. This will be a formidable task. However, I think the opponents of the CFPB have decided that the days of politics being the art of the possible are gone forever and they aren't ever coming back. The country will never be brought together on this issue, so they'll fight it with the same vigor and tactics that the CFPB's proponents used to bring it into existence. The law of the land is only the law of the land until the law is repealed. It's a war. One side will lose, the other will win.

Whether that attitude is a good thing or a bad thing for the country over the long haul is a topic for another day.

CFPB delenda est!

UPDATED 07.31.12: Inserted a link to Levin's HuffPo piece and removed a clause that led to nowhere.

Clobbering The Complaint

While we've had some snide and snarky fun with the federal lawsuit that a West Texas bank (and other organizations) recently filed that challenges the constitutional legitimacy of the CFPB, Ballard Sphar's Keith Fisher has been dissecting the claims made by the plaintiffs in a more sober fashion. His conclusion: there ain't no there, there.

Fisher thinks that the case is hampered "— perhaps fatally — by the plaintiffs’ questionable standing to bring these claims; in particular, the asserted injury in fact mandated by the 'case or controversy' clause of the Constitution seems rather attenuated."  "Rather attenuated" is D.C. laywer-speak for "give me a frggin' break."

Fisher's analysis of the claims and their weaknesses is not long and I won't reiterate his discussion points here. Notwithstanding my unconcealed glee that the lawsuit's filing gave me blog-fodder and another chance to tweak the tail of Cordray & Co., I think Keith's skepticism of success by the plaintiffs is well founded. However, I also think that the ultimate success of this specific lawsuit is not really critically important to the plaintiffs.

While I haven't discussed the complaint with any of the parties, it seems obvious to me that the conservative trade association plaintiffs are trying to lay down a marker as part of a longer-running plan that hinges, in part, on what happens to the composition of Congress (and who's housed in the Oval Office) after the November national elections. A big dog is peeing on a fire hydrant to let another big dog know that he exists and that he's coming to claim the territory. This is merely one of many challenges to come. It's a war of attrition and it will be fought on a number of fronts.

Therefore, while Keith's legal analysis is correct, it's also not critical to the ultimate fate of the CFPB. No one who wants to see the USS CFPB torpedoed is staking their serious hopes on the outcome of this particular lawsuit. In many respects, it may be merely a rallying point for "The Adjustment Bureau's" opponents, until they get a chance to pull out the legislative shears and start some serious neutering in 2013, using talking points culled from the complaint.

Of course, that's just my opinion. I could be wrong.

CFPB delenda est!

Jimbo Throws A Bomb

A reader in Chicago sent me this link to a recent Chicago Tribune article that demonstrates that a character that keeps you cool in a collapsing pocket while you wait for a receiver to break free fifty yards down-field might be ill-suited to finessing a defense to an FDIC lawsuit.

Former Bears quarterback Jim McMahon downplayed federal claims against him for his role as a board member of Broadway Bank, a Chicago bank shut down in 2010.

“It doesn’t affect me at all. I didn’t do anything wrong,” McMahon said Thursday at a pro-am before the American Century Championship in Lake Tahoe. “I was on the board for three years maybe.

“All the loans we were doing were good. Real estate was a good investment back then. Then all of a sudden it goes in the tank and they’re blaming me for it? I’m not going to worry about it,” he said.

OK, so far, not-so-horrible. If Jim had stopped there, he might have been alright. But McMahon was never one to paint a picture when several thousands words would do.

“When the owner of the bank asked me to be on the board, that’s the first thing I asked him: ‘What happens if something goes wrong with the bank?’ He said, ‘Well, you’re not responsible for that. We have insurance,’ this and that.

“So I’m not even worried about it,” McMahon said.

If I was a defense attorney, I might have to reach for my angina pills at that point. An observer who was somewhat cynical might suggest that McMahon's understanding of bank director liability was that as long as the bank had a D&O policy in place, "What, Me Worry?" was the motto of the day for McMahon. Thankfully, I'm an optimist, so I'm sure Jim didn't mean it that way.

However, repeatedly saying that you're not worried about the fact that you've been sued by the FDIC for breach of your fiduciary duties doesn't add to an aura of conscientiousness, does it?

Asked how hands-on he was, McMahon said he attended, at most, one meeting a month.

“If I could make it,” he said, noting he’s based in Arizona. “But I traveled so much, I didn’t want to be on the board anymore.”

Besides, he added, the $1,500 a month he received for serving on the board wasn’t substantial enough.

“That wasn’t even worth a two-hour meeting,” he said.

Now, those statements could create the impression that Jim was phoning it in. Literally. For a measly $1500, he'd pay attention for all of two hours. Again, defense counsel might have just thrown up a little in his or her mouth when he or she read that.

All-in-all, such statements appear to me to be a big banana clip of ammo for the FDIC, whose allegations against McMahon are quoted in the linked article.

“Defendant McMahon’s conduct is a paradigm case for director negligence,” the feds allege. “He appears to have approved loans he was told to approve without questioning. He received critical regulatory reports but did nothing in response. He did not read bank status reports; he missed many meetings. There is no substitute for the disciplined work required to be a responsible bank director. This is something that McMahon does not acknowledge or appear to understand.”

I would think defense counsel for the directors might wish that when it comes to talking publicly about the FDIC's lawsuit, Jimbo would just Shut The Front Door.

PATCO Panic

The recent federal appeals court ruling that found that a bank's multifactor authentication security measures were not, under the facts of the case, "commercially reasonable," has thrown some commentators into a Chicken Little tizzy. Others are more measured, and one of those is managing partner of Duane Morris, Joe Burton. Interviewed recently by InfoSecurity's Tracy Kitten, Bruton gave some useful insights into the impact of the ruling. Among those insights are the following:

• The ruling is a "fairly significant" one, Burton points out, since it's the first appellate case of this type. "It's going to have precedential value because it's an appellate court case, and as you know there really are a small number of cases that have considered the question of apportioning responsibility between a customer and the bank." In other words, courst in other jurisdictions may refer to it for guidance. Judges, like nature, abhor a vacuum.
• The appellate court sent the case back to the trial court to determine the limits of the bank's customer's liability even if the bank's security procedures were not "commercially reasonable." "It opens the possibility that you have a circumstance where you had a commercially unreasonable procedure that was utilized by the bank, but the liability might not be on the bank because there may be responsibility [on] the customer," he says. To me, this is significant, because in just about every one of these cases, the root cause of the loss is the fact that someone purloined the customer's user name, password, or other unique identifiers because of poor online security practices by the customer.
• The problem for the lender in this case is that while it had in place procedures that identified that high-risk online transactions were taking place in the customer's account, the lender didn't act on that intelligence. According to Bruton, [i]t's not enough just to have a generally accepted security procedure in place if that procedure is not implemented in a way that makes sense," Burton says. "That's the conduct aspect that has to do with the actual security and not just the check-box [mentality]." The appellate court in this case didn't take into account conformance with the FFIEC guidelines, but whether the bank had implemented appropriate security.

The entire interview is well worth the time it takes to read it, whether of not you bill by the hour.

Ben Deflects A Loaded Question

When the subject is congressional hearings, what usually comes to any rational observer's mind is the necessity for a really tight gas mask and a super-sized bottle of Pepto Bismol. Nevertheless, once in a while, there's a moment of political theater that makes wading in the cesspool worth the slumming. One such moment was captured by CNBC last week when Moonbat Maxine Waters tried to worm some favorable comments out of Fed Chairman Ben Bernanke about the plans of San Bernardino and a few other bankrupt municipalities in Ms. Waters' home state of California to use the power of eminent domain to seize underwater mortgages for lenders and write down the principal balances to current market value.

Gentle Ben dodged Waters' clumsy attempt like a seventh degree black belt jiu jitsu master.

I don't know whether or Maxine, as comedian Dennis Miller alleges, actually sleeps at night hanging upside down from a barn rafter, but it's obvious that she has some "issues." The way she stops dead in her tracks when she has to conjure up the actual subject of her comments, and aides have to supply her with her actual thoughts makes you wonder. As does her follow up to Ben's stiff arm to her original question. She asks him another question and without a pause (other than an "Ummm") launches into a completely different topic entirely. "Confusing" or "confused"? You be the judge.

Yet, come November, her constituents will send Representative Waters back to Congress for more in-depth drilling of the depths of financial institution esoterica in a way that will provide blog fodder for, we hope, at least two more years.

City of Angels Sues "Slumlord"

The City of (Fallen) Angels is the latest municipality to hop on board the bandwagon of local governments that are concocting legal theories that attempt to hold lenders liable for the upkeep of property that the banks claim they don't own. The city attorney of Los Angeles filed a lawsuit recently against the normally grime-free US Bank, calling the bank "one of the largest slumlords in the City of Los Angeles." Anyone who knows Los Angeles knows that if there's one thing its city officials are likely to be experts about, it's a slumlord.

The bank begs to differ, however. It claims that the homes "are owned by trusts and by investors in those trusts. Only the companies to whom homeowners send their mortgage payments are responsible for the homes' upkeep." In other words, the bank isn't the servicer of the loans and isn't responsible for the condition of the property; rather, it's merely a trustee who holds title for the "real owners."

In an article in today's American Banker, the bank's CEO, Richard Davis, gave another blast of this particular brand of buckshot.

"It is a classic case of misinformation and the confusions created by the role of a trustee," Davis said when asked about the suit during an earnings conference call with analysts. "We don't have any rights to go in and touch the properties. And while that doesn't pass the test in the public jury it is accurate and it is the way the trustees were built."

[...]

"The weak economy caused the City of L.A. to have a city attorney looking for places to raise up revenue," he said.

The city attorney's office isn't impressed with that argument.

Frank Mateljan, spokesman for the city attorney's office, says he understands U.S. Bank's role just fine.

"They're named on the deed," Mateljan tells ABC News. "Much as the bank would like to blame gardeners and the pool man, it's the bank's responsibility to maintain these properties or to sell them to somebody who can."

That bit of snark was a bit misleading (albeit amusing). The bank isn't blaming the pool man or the gardner. It's blaming a host of other handy scapegoats.

In many of these cases, I sympathize more with the bank than the municipality, often because the theories of the cities are half-baked. In this case, however, if the bank is named as the owner of the proeprty on the trustee's deed, whether or not the record title includes the designation "as trustee" or something similar, the city may have a valid right to name the bank. Let the bank, the investors and the servicer sort out the third party responsibility. The city may have a valid argument that it can hold the record title-holder accountable. At the very least, by bringing in the bank, it will likely set in motion a finger-pointing frenzy that will clarify at last who is responsible.

Of course, these are my initial, off-the-cuff impressions, made without reviewing the complaint of researching the issues. Ignorance of the facts has never stopped past bloviations, so why should I start now?

I sure hope Dick Davis doesn't accuse me of spreading "misinformation."

Loan Repurchase Liability Balloons For BofA

About a year ago, we discussed how much Bank of America appeared to be flailing about in its attempts to get its rams around its total exposure to loan repurchase demands by Fannie Mae. According to a recent Housing Wire article by Jon Prior, the "bid-asked gap" between Fannie Mae and BofA on the total amount of repurchase liability is pretty large. So large, it appears, that BofA is telling Aunt Fannie, "Sue Me!"

The bank and the government-sponsored enterprise disagree over $7.9 billion in mortgages Fannie claims BofA should buy back because of faulty origination practices, up from $3.7 billion at the end of last year. The bank said it should not have to buy back the loans because borrowers made at least 25 monthly payments on them.

The claims stem from mortgages originated in 2006 and 2007, BofA Chief Financial Officer Bruce Thompson told investors Wednesday.

"We clearly have a disagreement," Thompson said. "Either they bring an action or there would be a settlement. Those would be the two ways this would get resolved."

Throw Freddie Mac into the mix, and repurchase claims rise to $11.1 billion. That's a chunk of change, even if BofA has already reserved $15.9 billion for repurchase claims. Moreover, private label investor claims are also growing, nearly doubling to $8.6 billion. Working through this mess has been painful (costing the bank $2.6 billion in the last quarter) and it's obvious that the pain for BofA will continue for some time to come.

Several years ago, Francine McKenna was berating the large audit firms for not raising the red flag regarding loan repurchase risks. I'd been raising the red flag on this blog as far back as 2005. Maybe we were both more lucky than smart (certainly that's true in my case). On the other hand, if even a quarter-wit like the author of this blog saw this iceberg looming in the distance, you have to wonder how the Masters of the Universe who ran one of the world's largest financial insitutions acted like the crew of the Titanic and ran headlong into it.

Slowly But Surely

Not long ago, the Wall Street Journal confirmed what those of us in the trenches have been noting (with dismay) for some time: the crushing regulatory burden of the past few years, especially, albeit not exclusively, as a the result of the Chris-Barney Act, is motivating many smaller community banks to call it a day.

Edward McKeon, chief executive of Western Reserve Bank in Medina, Ohio, was so fed up with new regulations that he jumped at the chance to sell the two-branch lender when a local rival recently made a lucrative offer.

"When I hand them the keys and walk out, I'm going to be on the beach with a margarita," says Mr. McKeon, who this month announced the sale of Western Reserve to Westfield Bancorp., a unit of Ohio Farmers Insurance Co.

I hope that margarita is frozen, because it looks like it will be a cold day in hell before Ed returns to the banking biz.

Reporter Robin Sidel observes that in addition to the regulatory burden, the difficulty of making money in the current environment is also a factor in motivating small bank owners to cash in their chips.

Small banks received an unexpected blow this month that could drive more transactions. The Federal Reserve approved a proposal ordering even the smallest lenders to comply with comprehensive international capital requirements known as Basel III. Many bankers had expected regulators to exempt some small lenders from the new rules, which are aimed at shoring up the biggest global banks whose troubles fueled the financial crisis.

Banks also are under pressure from new overdraft rules that are eating into profits. And bank executives grumble that regulators are getting tougher about rules that have long been on the books, such as avoiding too much concentration in a particular type of loan.

The potential consequences for communities across the country of this consolidation are disconcerting.

...the flurry of activity is likely to eliminate some small-town banks that have been in communities for decades. That could mean fewer choices for customers and, some bankers say, fewer loans because the buyers might not have deep roots in those communities.

 While investment bankers quoted in the article think the reduction in the total number of banks from around 7500 to 5,000 will take awhile, the trend seems to be inexorable. According to one expert, Mitchell Sacks, community banks realize that the little guy is being squeezed out of the game.

"The smallest banks very much realize that the deck is stacked against them because their ability to earn reasonable rates of return is impaired and that is a permanent impairment," said Mr. Sacks, who has been meeting with executives from community banks.

If someone can find a silver lining in this black cloud, more power to you.

Another Whistleblower Bites B of A

We don't mean to harp on the subject of what a lousy acquisition Countrywide was for Bank of America...ok, that was lie...we do intend to harp on it. A few days ago, Reuters ran a story of yet another example of how B of A shareholders are taking another blow to the solar plexus because of allegedly nefarious activities of Countrywide affiliates. This story dealt with an honest appraiser (no, that's not an oxymoron, although "honest lawyer" might be), Kyle Lagow, who was "coincidentally" fired by Countrywide not too long after he complained internally that a Countrywide affiliate was committing appraisal fraud. Oh, yeah: he was also fired while undergoing treatment for thyroid cancer, to add to the despicability factor of Countrywide's conduct.

What Lagow learned was that Countrywide wanted to make loans whatever the collateral was worth. LandSafe executives routinely pressed staff appraisers and independent appraisers to boost home values to ensure sales went through, according to a suit he filed in 2009.

Lagow also spotted trouble with a joint venture Countrywide had with homebuilder KB Home, according to his suit. The builder would only work with select appraisers, who were inflating home values to make sure sales went through, according to his suit. KB Home declined to comment.

[...]

In January 2008, after supervisors had repeatedly ignored his warnings, Lagow sent an email to Countrywide Chief Executive Officer Angelo Mozilo, according to the complaint. Mozilo responded that someone from his staff would get in touch, and Lagow later talked with Countrywide's chief operations officer, Jack Schakett, and its chief compliance officer, Richard Wentz.

Two weeks later, Lagow received an email from Wentz stating that his complaints had been investigated and there were no issues that needed to be addressed, according to the complaint.

[...]

In January 2008, Bank of America agreed to buy Countrywide as it verged on collapse. That November, Lagow was fired. At the time, he was undergoing treatment for thyroid cancer; he has since recovered.

Bank of America declined to comment on Lagow's case. "We have a strategy to put Countrywide and other legacy issues behind us as quickly as we can," bank spokesman Rick Simon said.

Putting a $40 billion "legacy issue" behind you is like Kim Kardashian putting on a skin-tight dress. There's absolutely no doubt that no matter how hard you try to cover it up, you've got a whale-load of junk in the trunk. Nice try by B of A's PR flacks, though.

Kyle later filed a whistle-blower lawsuit, but had to keep mum about it for three years, even from his family, so as not to impede ongoing government criminal and civil investigations of the "legacy issues" presented by Countrywide's pristine behavior in residential lending. Eventually, his suit was wrapped up in the global settlement with B of A and other large lenders and when the dust settled, Kyle walked off with $14.5 million. That almost makes up for the four years of emotional distress inflicted on him because...GASP...he tried to do the right thing.

He has bought a new home and has treated his family to a trip to Disney World, but he plans to leave most of the award to his kids.

"They are the ones," he said, "who suffered through this."

While some, like Kyle and his family, have "suffered through this" to a greater extent than other folks, the pain and misery of the most recent meltdown have been fairly widespread. Unless, of course, your name's Mazilo. That particular apex to a pyramid of greed walked away with a slap on the wrist of $47.5 million out-of-pocket out of over a half-billion dollars in income received from 2000 to 2008. Or, for that matter, unless you were a friend of Mazilio's and a member of the US House or Senate, in which case absolutely nothing bad will happen to you at all.