Bank Lawyer's Blog

Read My Lips: "No Targeted Businesses"

Apparently suffering from an attack of sudden-onset common sense, the FDIC issued revised guidance last week on payment processor relationships that eliminated the concept of "targeted businesses" that the FDIC considers to present a heightened risk of consumer fraud. As we disccussed in January, among the "targeted" companies were not only the usual suspects, like payday lenders and telemarketers, but such head scratchers as online dating services. We assume that the FDIC was shining a spotlight on illegal "escort services" that often act as a front for prostitution, but in its customary "why use a jeweler's awl when a sledgehammer will do" approach, it cast a wide net around otherwise legal businesses.

In its press release accompanying the revised guidance, the FDIC accused the rest of the world of failing to grasp its nuanced approach to making the world safer through social engineering.

The lists of examples of merchant categories have led to misunderstandings regarding the FDIC's supervisory approach to TPPPs, creating the misperception that the listed examples of merchant categories were prohibited or discouraged. In fact, it is FDIC's policy that insured institutions that properly manage customer relationships are neither prohibited nor discouraged from providing services to any customer operating in compliance with applicable law. Accordingly, the FDIC is clarifying its guidance to reinforce this approach, and as part of this clarification, the FDIC is removing the lists of examples of merchant categories from its official guidance and informational article.

Apparently, bankers are too dense to understand the FDIC's guidance's "original intent," and so, like Antonin Scalia does with US Constitution, the FDIC issued "Payment Processor Relationships For Dummies" so that the Alfred E. Neumans among the proletariat would finally get it through their thick skulls that the FDIC will not, ever, tell you in advance that a line of business is problematic. Instead, they'll wait until your next examination and then bitch-slap you for serving any members of the "non-targeted" group. That way, Jeb Hensarling can't smack them on the behind like a non-housebroken puppy with a rolled-up copy of their written "guidance" (which, as the FDIC repeatedly asserts, is "not binding like an actual regulation"). It's the way of the regulatory world in the era of "All Fired Up! Ready to Go!"

We're sure that the fact the previous version of the guidance that listed targeted businesses provided one of the bases for the lawsuit filed against the FDIC, OCC, and FRB in June by payday lenders and a trade group had absolutely nothing to do with this recent "clarification." Perish the thought!

In response to to all of this, I echo the immortal sneeze of John "Bluto" Blutarsky.

The Art of the Deal

Having empurpled with rage the kisser of a regulatory agency, I'd like to turn now to offending attorneys for various bank vendors who seem to take to personify the quality of some lawyers that business clients love to hate: we're "deal killers."

Actually, some of us are.

A case in point: a large financial institution sends out an RFP to solicit vendors to sell their services to the bank related toi a line of business that the bank is pursuing. There's a great deal of money to be made, so you would expect that the vendors who want to bid on the work would put on their best "smiley face" and also put their best foot forward. You would also think that they'd want to avoid offending the object of their affection by committing a faux pas akin to, while curtsying to the Queen of England, breaking wind with the force and sound of a watermelon hitting the sidewalk after a 10-story drop.

The initial contract that's customarily involved in a bank's RFP process is a mutual nondisclosure and confidentiality agreement, almost always drafted on the bank's standard form. Most vendors who are serious about bidding either merely review the agreement to ensure that they're not selling their children to an Eastern European white slave ring, then sign it, or request changes where there is a critical legitimate concern with a provision. Seldom will a bidder who seriously wishes to make a good first impression turn the nondisclosure agreement over to the equivalent of a first-year law student who's intent on spotting issues in order to make his contracts professor proud.

Then, you have the bidder who's counsel revised an entire paragraph on the first page of the nondisclosure agreement to change nothing of substance, only to re-designate clauses labeled "(i)", "(ii)," and "(iii)" to "(a)," "(b)," and "(c)." This is correct from a formatting standpoint, but in the grand scheme of things, so unimportant an issue to raise that it rings a bell as loud as Big Ben at the stoke of midnight.

The responsible bank officer ponders, "If this is how they act when they are romancing me, how will they behave like when they have had their way with me? How long will it take, and what will it cost me, to negotiate the vendor agreement if I select this navel gazer and picker of sub-atomic nits?"

Snatching defeat from the jaws of victory: it's a talent.

"[T]here are millions of people out there, just like you and me, with their thumb on the self-destruct button."--Etienne de L'Amour.

BancSouth Wins Big

A recent Eighth Circuit Court of Appeals decision in favor of BankSouth bodes well for financial institutions who understand their obligations under UCC Article 4A and take those obligations seriously. Unlike consumer customers, who are pretty much protected against unauthorized funds transfers by Regulation E if they examine their monthly bank statements and promptly inform their banks of any unauthorized transactions, business customers whose bank accounts are compromised by cybercrooks have much less protection. As the 8th Circuit points out, the inquiry in such instances is focused on whether the bank and customer had agreed upon commercially reasonable security procedures that the bank would use to determine whether or not a purported funds transfer was authorized by the customer and, if so, whether or not the bank employed those security procedures in good faith. If the bank meets that two-pronged test, the business customer is stuck with liability for any unauthorized transfer.

The controversy usually arises when an employee of the business customer has fallen for a "phishing" scheme, clicking on link in an email that causes malware to be downloaded that allows the crooks to learn the user name and password that the employee uses to log in to the online banking system of the bank. In the BancSouth case, that apparently occurred. However, regardless of how access to the password and user name was obtained, the focus of the court was, as it should have been, whether the agreed upon security procedures used by the bank were commercially reasonable and employed by the bank in good faith. In this instance, the court (and the trial court) found that they were.

While the customer's attorneys argued that the use of a user name and password was "one-factor authentication" that is contrary to FFIEC guidance that advises that "multi-factor authentication" processes should be used, the court countered that argument by finding that the bank offered "dual controls" for wire transfer (separate persons must authorize the initial funds transfer request and the confirmation of that transfer order), the customer opted not to use such a procedure on the grounds that it was "inconvenient." More cautious banks not only offer dual controls, they require it unless the customer signs a separate agreement or waiver under which it indemnifies the bank from any claims, loss, or liability arising out of unauthorized transfers from the account under a single-control authorization process. BancSouth had such a waiver and the customer signed it.

BancSouth's online banking agreement also contained an indemnification provision that is common in online banking agreements in one form or another, pursuant to which the customer agreed to indemnify and hold the bank harmless from claims, losses, liabilities, costs and expenses, including reasonable attorneys' fees, arising out of the bank's provision of services, as long as the bank fulfilled its obligations. The appellate court ruled that this provision provided a sufficient basis for the bank to pursue a claim against its customer for payment of attorneys' fees, and overturned the trial court's denial of a counterclaim by the bank for such fees. Again, well-drafted online banking agreements ought to contain a similar provision.

Dan Mitchell, an attorney who has been involved in other high-profile litigation on this subject, and another commenter, had some cogent observations on the implications of this decision.

Perhaps most significantly, Mitchell said, the decision could be a blow to companies trying to recover cyberheist losses from their banks. Bancorp South had asserted at the trial court level that its contract with Choice Escrow indemnified it against paying legal fees in such a dispute. The trial court dismissed that claim, but the appeals court said in its decision that the bank could recover the costs from the escrow firm.

"The bank had asserted a counterclaim that the customer should pay the bank’s legal fees," said Mitchell, who battled similar claims in which Patco — a Maine construction firm — successfully sued its bank over a $588,000 cyberheist. "There’s no other federal circuit court case other than Patco that has gotten up to that level. The appeals court said the bank can now pursue its legal fees against the customer. And that may end up being the important part of this opinion in the long run if [plaintiffs are] looking at not only have to pay their lawyers to pursue a loss but also those of the bank."

Charisse Castagnoli, an adjunct professor of law at the John Marshall Law School, said the appeals court decision means that indemnification is now the ‘law of the land’ in the 8th Circuit.

Castagnoli said she expects two results from this decision: that banks which don’t already have these clauses in their online banking agreements will add them; and that cyberheist victims will think more cautiously about bringing a lawsuit.

"This is the first time a court has ruled on fee shifting, and that will certainly have a chilling effect on litigation," Castagnoli said.

The opinion contains other nuances that are worth considering. The linked article from Brian Krebs' excellent blog contains a link to the opinion.

A Distinct Lack of Interest

In a think piece in yesterday's American Banker, attorney Michael Reyen discusses that fact the City of Richmond, California's "Seize The Mortgage" plan through the use of eminent domain has been stymied by the failure of the plan's supporters to obtain the supermajority approval necessary to obtain City Council approval to move forward with the half-baked scheme. As a result, its supporters are trying Plan B: partnering "with another community to form a joint powers authority and carry out the plan."

To date, it has not had any takers.

Why not? According to Reyen, because other municipalities fear (rightly, in my opinion) the costs and risks of litigation, and because the FHFA has threatened to pull Uncle Freddie and Aunt Fannie out of any municipality that starts seizing mortgages through such a means. As to litigation, although a federal court dismissed a lawsuit filed by mortgage loan securities trustees, the court did so "without prejudice." In other words, the issue was not yet "ripe," but if Richmond proceeds to actually implement the plan, "ripeness" will permeate the air like the scent of a thousand dead armadillos in the middle of an Amarillo blacktop in mid-August.

The negative reaction of the FHFA and mortgage securities investors would be even more consequential over the long haul.

The FHFA has stated that it may initiate legal challenges against any local or state government that sanctions the use of eminent domain to restructure mortgage loan contracts in a way that affects FHFA’s regulated entities, Fannie Mae and Freddie Mac. It has also said that it may act by order or regulation to “direct the regulated entities to limit, restrict or cease business activities within the jurisdiction of any state or local authority employing eminent domain to restructure mortgage loan contracts.” This amounts to a death sentence for residential mortgage lending in any municipality in which the FHFA limits, restricts or ceases business activities.

Notwithstanding these "strong headwinds," Reyen thinks that the idea is not yet dead, and cites the interest of Irvington, New Jersey, in pursuing the scheme. In my view, the headwinds will only become stronger if these plans move forward. In addition, as the economy continues to improve and real estate values eventually recover, the "need" for such "creative" measures to assist underwater borrowers will be harder to justify. That won't stop true believers from believing in it, but it may finally crater any practical chance of any such plan being seriously pursued to the point of "ripeness."

Another Non-Problem Not Resolved

New York State Superintendent of Financial Services, Gentle Ben Lawsky, recently issued a press release that announced a solution to a "major" problem that did not exist.

"In discussions with our Department, Ocwen has agreed to no longer seek gag rules as part of settlement agreements or loan modifications with borrowers,” Benjamin Lawsky, superintendent of Financial Services, said.

“Additionally, the company has stated it will not enforce gag rule provisions in existing agreements. We are gratified that Ocwen worked constructively with us to resolve this matter, and our Department intends to review this issue at other financial institutions,” Lawsky added.

The Chief Investment Officer of Ocwen, John Britti, shed some light on how pervasive this instance of consumer abuse had become.

“Ocwen does not require non-disparagement clauses in mortgage loan modifications in the absence of any borrower legal claims, which is the case in the overwhelming majority of our modifications.”

Britti did note, “In the rare occasion where there is a legal dispute – and these represent only a fraction of one percent of the loans in our portfolio – more often than not we are able to work out an amicable resolution with the borrower.  In those cases, we generally request the settling party to agree to refrain from publicly disparaging the company in the future.”

And it is this point that Ocwen is fixing. 

“To clarify, Ocwen has never required non-disparagement clauses for mortgage modifications. Our agreement with the DFS deals with the highly unusual situation where there is a legal settlement agreement with a borrower, representing a fraction of one percent of our portfolio," Britti said in a statement on the matter.

Anyone with a shred of understanding of civil business litigation in the United States, and with a scintilla of intellectual honesty, would acknowledge that non-disparagement provisions are common in litigation settlement agreements generally, not merely in litigation that involves residential mortgage loans. I guess that "anyone" would not include Gentle Ben Lawsky. That's not surprising, since, as we've previously noted, his hands-on business and private practice litigation experience is severely lacking. On the other hand, he's got plenty of political and bureaucratic experience, and it's self-evident that he knows as much as his role model, Eliot Spitzer, about issuing press releases full of preening self-promotion.

Unless Ocwen is flat-out lying, Ocwen required non-disparagement provisions only in connection with litigation settlement agreements, where the servicer had been sued by the borrowers and the parties were settling that litigation, a settlement that may involve a loan modification. Again, this is not an unusual provision to include in the settlement of any litigation. Moreover, loan modifications where litigation was involved included only a small percentage of all loan modifications. In all other loan modifications, a non-disparagement provision was not required by Ocwen.

Apparently, Lawsky has succeeded in having Ocwen agree to cease doing something that it was not doing in connection with the overhelming number of loan modifications, and to agree not to enforce existing non-disparagement provisions in the small fraction of loan modifications that involved the settlement of civil litigation, which Ocwen is willing to do because the number of affected loans is inconsequential and it's got bigger problems with Lawsky to address.

Great job, Ben! Of course, to use the term "or" in the phrase "Ocwen has agreed to no longer seek gag rules as part of settlement agreements or loan modifications with borrowers” is more than a tad misleading, since Ocwen wasn't seeking "gag rules" (whatever that means in the context of an agreement between two private parties) in connection with loan modifications unless a settlement agreement was involved. Where's UDAAP when you need it? Oh yes, it doesn't apply to regulators, only to the regulated.

A Two-Front War

The opponents of Operation Choke Point (a group also known as "The Heimlich Maneuverers") have recently decided to proceed against touch points within the Executive Branch through the other two branches of the federal government. On the judicial front, the payday lending industry filed a lawsuit against the Gang of Three (OCC, FDIC, and FRB) for "illegally" forcing banks that they regulate to choke off access to the financial system to "disfavored" businesses (including, apparently E-Harmony.com, inasmuch as the FDIC has determined that online dating services are "high risk." According to friends that use online dating services, there may or may not be a high risk of illegal activity associated with them, but there sure is plenty of bald-faced lying).

I hope the payday lenders enjoy dancing with a bear.

In the US Congress, House Financial Services Committee Chairman Jeb Hensarling (with a name like "Jeb," you simply know he's from Texas) wrote to Janet Yellen to express his "concern" about the use by the federal bank regulators of the nebulously defined concept of "reputation risk" as a pretext for forcing banks to stop serving legitimate business (for example, payday lending businesses) that the regulators, subjectively, determine pose "undue reputation risk." Hensarling's questions to Yellen are an obviously transparent attempt to set the stage for an argument that the regulators can't define "reputation risk" any better than they can define "obscenity," except they know it when they see it.

While Hensarling harasses Yellen, his running buddy at the House Oversight and Government Reform Committee, Chairman Darrell Issa, decided to poke a stick in the eye of the FDIC (paid subscription required).

Issa sent a letter Monday to FDIC Chairman Martin Gruenberg charging that the agency has been working closely with the Department of Justice as part of its law enforcement effort to root out fraud through the payments processing system.

The California Republican says he doubts testimony by Richard Osterman, acting general counsel at the FDIC, during a House Financial Services Committee hearing last month, in which Osterman repeatedly downplays the FDIC's role, referring to the initiative as a Justice Department program.

"Documents produced to the Committee by the Department of Justice call into question the sincerity and truthfulness of Mr. Osterman's testimony. In fact, the FDIC has been intimately involved in Operation Choke Point since its inception," the letter says.

Calling the FDIC's Acting General Counsel, in effect, a liar might actually prod a tart response from the FDIC. We'll see. Issa wants requested documents delivered to his office by a week from next Monday.

In case people were confused about what Issa's concern about a love match between the DOJ and the FDIC might be, he explained.

"The committee has obtained substantial evidence suggesting that as a result of coordinated actions by the FDIC and the Department of Justice, banks are terminating relationships with entirely legitimate and licensed businesses," the letter adds.

In other words, he'd like the FDIC to hand over a smoking gun that proves his point and also supports his allegation that Mr. Osterman's testimony was less than "sincere" and "truthful." What are the odds the FDIC will produce such documents?

There is little doubt to a cynic that the fact that these serial counter punches are coming in such a short sequence is not coincidental. The opponents of Operation Choke Point, especially of the role of the federal banking regulators in picking winners and losers in the game of gaining access to financial services, without affording any of the parties, banks or their customers, with due process, are pushing back. This is only the early stages of what promises to be a nasty tussle.

Stay tuned.

Martha Makes Good On Her Threat

Well, Martha Coakley gave Mel Watt only a couple of weeks to fold, and when he didn't, she made good on her threat to sue the FHFA.

Coakley followed up on her threat of litigation and filed a lawsuit against the FHFA and the GSEs in Suffolk Superior Court. The complaint alleges that Fannie and Freddie, currently under FHFA conservatorship, are refusing to comply with the Massachusetts law called “An Act to Prevent Unnecessary and Unreasonable Foreclosures.”

[...]

One of the provisions of the law, which was passed in August 2012, prohibits creditors from blocking home sales to non-profits simply because the non-profit intends to resell the property back to the former homeowner. Coakley says these foreclosure buybacks are exactly what the GSEs are preventing.

[...]

In the complaint, Coakley alleges that two of the FHFA’s policies violate state law. The suit alleges that Fannie and Freddie’s “arm’s-length transaction” policy prohibits property sales to non-profits who resell to the original homeowner.

The suit also alleges that the GSEs “make whole” policy has the same effect, as it prevents Fannie and Freddie from accepting anything less than the outstanding loan amount from the former homeowner or anyone seeking to resell or rent to the former homeowner.

Fannie and Freddie are in conservatorship because too many borrowers haven't repaid mortgage loans that Fannie and Freddie bought and packaged into mortgage backed securities that they then sold to investors, including, among other types of entities, pension funds that thought they were buying a safe, "government-backed" investment. The FHFA, which regulates those two entities, has a duty to the investors (and to Fannie Mae's shareholders, who've been shafted by the government's refusal to stop sucking up all of Fannie's profits, even though all of the government bailout money spent on Fannie and Freddie has been repaid in full) to try to recoup the maximum amount possible from the mortgages that it holds. Not letting defaulting homeowners benefit from a less-than-full-repayment liquidation of a loan makes sense from that policy standpoint.

Coakley believes that state legislation that pushes local economic recovery goals (or homeowner relief social policy goals, depending on your perspective) should be able to trump the policies of the a federal regulator regarding two wards of the federal government. This will be an interesting piece of litigation from the perspective of whether or not the FHFA must amend its policies to comply with such a state law. I don't see any upside for Watt to compromise on the current policies until a court tells him he has to back off and comply with Masschusetts law. At that point, he can tell the investors and shareholders that he had no choice: the judge made him do it.

It's also interesting from the standpoint that Watt and Coakley appear to be on the same side of the fence when it comes to social policy. Watt was a liberal Democrat when he was in the House of Representatives. Moreover, he recently gave a speech that indicated that Fannie and Freddie were going to expand their efforts to provide financing to borrowers with less-than-pristine credit. That was a move that caused a blinding flash of "deja vu all over again" to appear before the eyes of critics of the federal government's housing finance policies that many allege led to the subprime housing bubble and the resulting 2008 economic collapse. However, it was also an indication that rather than winding down Fannie and Freddie and creating a different sort of national residential finance market (which was where we seemed to be heading under Watts predecessor, Ed DeMarco), we may be back on the road to officially re-establishing the two mortgage finance giants as the only game in town, something they've unofficially been since the collapse occurred (and prior to that time, to be honest).

Regardless of the way Coakley's lawsuit plays out, we have the sneaking suspicion that the brave new world of residential mortgage finance may look like the brave old world.

Martha Tries A Carrot And A Stick On Mel

I'm not sure what Massachusetts Attorney General Martha Coakley thinks she's going to accomplish by simultaneously sweet-talking and threatening Mel Watt, but I doubt she's doing much more than engaging in political theater. Maybe she's setting herself up for a run for higher office and wants to make sure that the next time around, she doesn't get a butt-kicking like Scott Brown unleashed on her four years ago.

Massachusetts Attorney General Martha Coakley reiterated calls Wednesday for the Federal Housing Finance Agency to allow Fannie Mae and Freddie Mac to offer principal reductions to distressed borrowers and to participate in nonprofit home buyback programs.

Coakley sent a three-page letter to FHFA Director Mel Watt trying to persuade him that principal reductions could be crafted in such a way to prevent abuses, including what she called "the abstract fear of waves of strategic defaulters."

"Abstract fear"? You'd think that folks like Coakley, adherents to utopian progessivism that denies the reality of human nature and proposes that through the exercise of centralized state power, human beings can be perfected and justice achieved, here on Earth, would know all about "abstract fears," as well as "abstract joys," "abstract hope," and "abstract abstractions."

Nevertheless, in case the risk of strategic defaults might actually be grounded in reality, Coakley had an answer for Watt.

Coakley said one way to reduce strategic defaults would be to adopt clear modification underwriting standards, require a showing of hardship by the borrower and allow lenders to share in the home price appreciation.

Watts' predecessor, Ed DeMarco, adamantly opposed principal reductions. He felt that whole-sale principal write-downs would hurt mortgage bond investors which, in turn, would hurt Fannie Mae and Freddie Mac, which, in turn, would hurt the mortgage market. Coakley apparently thinks Mel is more sympathetic to a state chief law enforcement officer's sojourn into social policy, especially in the area of mortgage markets, where everyone knows a state attorney general is uniquely qualified to offer business-savvy solutions to thorny problems.

In case Mel is inclined to turn a DeMarco-like deaf ear to her entreaties to do the right thing, Martha whipped a big stick out from behind her back and threatened Mel with a beating if he didn't fall in line.

In the letter, Coakley even threatened to take legal action because the FHFA has refused to take part in buyback programs that allow nonprofits to purchase distressed homes at current market value and immediately resell them to the former homeowner.

"Our office also is considering all available legal avenues—including litigation—to ensure compliance with Massachusetts law, should FHFA fail to promptly amend its policies to allow the GSEs to participate in credible buyback programs," Coakley wrote.

Coakley is using as the basis of her threats the alleged violation by Aunt Fannie and Uncle Freddie of a 2012 Massachusetts law that forbids lenders from refusing to consider buyback offers at "fair market value" solely because the home will eventually be returned to the defaulting homeowner. I assume that DeMarco and Watt believe that a law that vague is likely to be held to be unenforceable against Fannie Mae and Freddie Mac, or perhaps they've just decided to become renegades and ignore the law because they take some perverse pleasure in lawlessness. I'm betting on the former, but I might be wrong.

At any rate, Watt hasn't publicly responded to Coakley (or if he has, the main stream press hasn't reported it). I wouldn't hold my breath waiting for the FHFA to cave on this one, although Watt is relatively new in the saddle, and you can't be sure which way he might ride. My guess is that Coakley will have to push her social engineering agenda in court. Pursuing it against a cash cow like the FHFA, which, with its charges in federal conservatorship, is not likely to be scared by the prospect to spending money on trial lawyers.

Porn Stars Held To Be "Un-accountable"

Operation Choke Point, and the general attitude of the federal banking regulators toward businesses that they've picked (for reasons best known to themselves) as worthy of being branded with a Scarlet Letter, are causing cautious banks to drop customers who might be engaged in perfectly legal activities. Apparently, the latest victims are porn stars (paid subscription required).

A new war is brewing between banks and their customers, and the fight is going public.

PR black eyes of the past would have come from ATM surcharges or foreclosure injustices. Now, news reports are stacking up about angry customers — payday lenders, check cashers, telemarketers, gun dealers and even adult entertainers — who are complaining that their accounts have been, or could be, unfairly terminated.

[...]

The pornography sweep in particular only strengthens bankers' suspicions that regulators are forcing them to play the role of morality police. And it raises more practical questions for bankers: How do they balance public perception and compliance? What industry will they feel compelled to shut out next?

Look, porn stars ought to be banned from access to money due primarily to their utter lack of acting chops.

"Hi, I'm Eva. I'm from the maid service. I'm here to clean your house."

"Hey, Eva, would you start with cleaning...THIS?!?"

"Oh, baby! Yeah...yeah...oh...oh..uhh..uhhhh...OHHHHHHHHHHH!!!"

Yet, in this great country we call "The Land of the Free and the Home of the Horny," the "adult entertainment business" is legal. As is payday lending (in many states), check cashing, renting-to-own, deposit advances, tax anticipation refund lending, and being a "Pawn Star." However, all of those businesses have a "common taint": the DOJ and federal bank regulators don't like them. While the ostensible rationale for that dislike may be that they pose higher risks of money laundering or other illegal activities by some of their members than do other business (like insidre trading investment advisers to members of Congress), I've not seen the evidence that Teagen Presley is a crook, albeit you might argue, with some support, that she's a "bad actor."

Reporter Andy Peters points to a problematic FDIC report from 2011 that listed the current crop of the disfavored, and that may be a guide to "who's next."

Pornography is one of several potentially problematic industries listed in an FDIC report in June 2011 that warns banks about managing third-party payment processor relationships. Ties between banks and processors that handle transactions for the problematic industry sectors can expose banks to "greater strategic, credit, compliance, transaction, legal and reputation risk," the FDIC said.

[...]

In addition to pornography, the other high-risk industries the FDIC identified included ammunition and firearms sales, credit-repair services, drug paraphernalia, fireworks sales, dating services, racist materials and tobacco sales.

Dating services?

Peters quotes Bill Isaacs, the former FDIC Chairman who's been a fierce critic of Operation Choke Point: "Banks are left to guess who deserves access to the banking system and who doesn’t."

I'd say "deserve" has nothing to do with it. "Whim" appears to be the criteria being applied.

When Curry Speaks, All Banks Should Listen

The Comptroller of the Currency Thomas Curry gave a speech the other day (paid subscription required), and emphasized a couple of points that vendor management folks at financial institutions with various charters--state and federal, bank and credit union--and the lawyers who represent them,  would be wise to heed.

Comptroller of the Currency Thomas Curry said his agency is increasingly concerned about the cybersecurity risks from banks relying too much on certain vendors and using service providers in foreign countries.

Banks can end up becoming dependent on certain vendors because of consolidation in the service provider industry, Curry said in his prepared remarks for the Consumer Electronics Show's Government Summit in Washington. They can also be exposed to risks when they assign critical functions to outside vendors, including those that use foreign-based subcontractors.

"Banks need to consider the legal and regulatory implications of where their data is stored or transmitted, and make a determination as to whether geographic limitations are needed in their contracts," Curry said. "Finally — and perhaps most importantly — we are concerned about the access third parties have to large amounts of sensitive bank or customer data."

Here are a few take-aways:

First, cybersecurity due diligence of your vendor assumes critical importance when that vendor has access to customer data and other sensitive information of the institution. Access to sensitive information ought to make that vendor a "critical" vendor regardless of the dollar "value" of the contract. The institution needs to be able to document that it examined the information security procedures and systems and found that they met industry standards.

Second, the provisions of the agreement between the institution and such vendors on confidentiality and information security need to be "robust." This is especially critical when one or a couple of vendors of the institution have access to a lion's share of sensitive data. Read OCC Bulletin 2013-29, FFIEC's handbooks on the outsourcing of technology services, and other regulatory guidance. Make sure you know what contractual assurances you need and then make sure they're in the agreement.

Third, the financial institution needs to monitor the compliance of these vendors with information security safeguards throughout the life of the relationship. If a critical vendor's not providing an annual SASE 16 audit report of an appropriate type (SOC 1 vs. SOC 2), and not addressing problems raised by such annual reviews, you've got a problem.

"We expect the board and management to ensure that appropriate risk management practices are in place, that clear accountability for day-to-day management of these relationships is established, and that independent reviews of these relationships will be conducted periodically," Curry said in his remarks Wednesday.

That's a red flag, no?

Fourth, you need to read between the lines of what Curry's saying about "certain vendors." Pay attention to what's happening in the marketplace. If an article appears in the press that notes problems with a critical vendor, investigate and assure your self that any problems are being addressed. Review the web sites of the regulators for enforcement actions, and pay attention to what you find if a vendor is the subject. Pay attention to your own due diligence. If you gather necessary information but don't act upon it appropriately, your regulator will not be pleased.

Fifth, foreign subcontractors have become a "hot button" concern. I would recommend that in your vendor agreements with critical vendors you have adequate restrictions on the use of subcontractors. Among those restrictions ought to be that the use of a non-US based subcontractor requires your prior written consent. I represent banks that would never consent, but that's a story for another day.

If the vendor pushes back, that vendor ought to be a cause for grave concern. They're not doing you a favor by selling you their technology, although a few of the larger ones act that way, especially if you're a smaller institution. These concerns are regulatory concerns, matters of safety and soundness. If the vendor is large and representing a number of financial institutions, none of these issues should come as surprise to them. If you have concerns about a vendor, give your federal regulator a call and tell him or her about those concerns. As Curry makes clear, your regulator will be interested. Very interested.