InfoBytes
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
U.S. issues warning on North Korean hackers targeting banks worldwide
On August 26, a joint alert was issued by the Cybersecurity and Infrastructure Security Agency (CISA), the U.S. Treasury Department, the FBI, and U.S. Cyber Command warning that since February 2020, North Korean hackers have resumed targeting banks worldwide through the use of fraudulent international money transfers and ATM cash-outs. The alert provides an “overview of North Korea’s extensive, global cyber-enabled bank robbery scheme, a short profile of the group responsible for this activity, in-depth technical analysis, and detection and mitigation recommendations to counter this ongoing threat to the Financial Services sector.” The North Korean hackers, the alert notes, were responsible for stealing $81 million from a Bangladeshi bank in 2016, and have engaged in fraudulent ATM cash-outs affecting upwards of 30 countries in a single incident. According to the alert, the hackers’ “international robbery scheme” poses “severe operational risk” for individual banks beyond reputational harm and financial losses. A robbery directed at one bank may implicate multiple banks “in both the theft and the flow of illicit funds back to North Korea,” the alert warns. The hackers “initially targeted switch applications at individual banks with FASTCash malware but, more recently, have targeted at least two regional interbank payment processors,” the alert states, cautioning that this suggests the hackers “are exploring upstream opportunities in the payments ecosystem.”
FDIC proposes revisions to its supervisory appeals process
On August 21, the FDIC announced a proposal to amend the agency’s Guidelines for Appeals of Material Supervisory Determinations (Guidelines) and establish a new, independent Office of Supervisory Appeals (Office) that would replace the current Supervision Appeals Review Committee. The new Office, which will have final authority to resolve appeals, would be independent from other divisions within the FDIC that have authority to issue material supervisory determinations. According to the release, to promote the Office’s independence, the FDIC intends to recruit externally and employ reviewing officials on a part-time or intermittent, time-limited basis. The proposal also includes modifications to the procedures and timeframes regarding when determinations underlying formal enforcement-related actions may be appealed.
Among other things, the proposal would update the Guidelines to clarify that for purposes of the supervisory appeals process, a formal enforcement-related action begins, and appeal rights are temporarily unavailable, when the FDIC: (i) initiates a formal investigation; (ii) issues a notice of charges or notice of assessment, as applicable; (iii) provides an institution with a draft consent order; or (iv) provides written notice stating “that the FDIC is reviewing the relevant facts and circumstances to determine whether a formal enforcement action is merited.” Under the proposal, should the FDIC provide written notice that it is determining whether a formal enforcement action is merited, the agency would be required to provide the institution with a draft consent order within 120 days, as well as an opportunity to engage in settlement negotiations. If the FDIC fails to provide the institution with a draft consent order within the initial 120-day period, supervisory appeal rights would become available to the institution. If a settlement is not reached, the FDIC would have 90 days to issue a notice of charges or assessment or open an order of investigation, or the institution’s supervisory appeal rights would be made available. In either case, once supervisory appeal rights are made available, the institution would have 60 days to file an appeal, which is consistent with the standard timeline for appealing a material supervisory determination. If the institution agrees to the consent order, “then the matter would be resolved and the need for an appeal would be obviated.”
If the proposal is adopted, institutions “would continue to be encouraged to make good-faith efforts to resolve disagreements with examiners or the appropriate regional office or division director.” However, if an institution is unable to resolve a disagreement regarding a material supervisory determination through such efforts, it would be able to appeal that determination to the Office.
Chairman Jelena McWilliams commented that the while the proposal retains several aspects of the existing appeals process—for example, the burden of proof on appeal will continue to rest with the institution—the “proposal seeks to establish a fair, independent process for a bank to appeal material supervisory decisions,” which is “key to promoting consistency among examiners across the country, ensuring accountability at the agency, and, ultimately, maintaining stability and public confidence in the nation’s financial system.” McWilliams added that she does not expect the proposed changes to result “in an avalanche of appeals.”
Comments on the proposal will be accepted until October 20.
Kansas extends remote work guidance for certain licensees
On August 27, the Kansas Office of the State Bank Commissioner extended its remote work guidance, previously covered here and here, for mortgage companies, mortgage loan originators, supervised loan licensees, credit services organizations, money transmitters, and credit notification registrants. Licensed or registered individuals and entities are permitted to work from their residences or a company designated location, provided certain requirements are met, through December 31, 2020.
Agencies extend foreclosure moratorium and other Covid-19 flexibilities
On August 27, Federal Housing Finance Agency (FHFA) announced that Fannie Mae and Freddie Mac will extend their moratorium on single-family foreclosures and real estate owned (REO) evictions until at least December 31 (which was set to expire on August 31, previously covered here). The foreclosure moratorium applies to homeowners with an Enterprise-backed, single-family mortgage and the REO eviction moratorium applies to properties that were acquired by the GSEs through foreclosure or deed-in-lieu of foreclosure transactions.
FHA also further extended its foreclosure and eviction moratorium through December 31 (also set to expire on August 31 and previously covered here). The moratorium applies to homeowners with FHA-insured Title II Single Family forward and Home Equity Conversion (reverse) mortgages, excluding legally vacant or abandoned properties (previously discussed here and here). Additional details can be found in Mortgagee Letter 2020-27.
Additionally, on August 26, FHFA announced an extension of a temporary policy that allows Fannie Mae and Freddie Mac (GSEs) to purchase qualified single-family mortgages in forbearance that meet specific eligibility criteria due to the Covid-19 pandemic. The policy is now extended for loans originated through September 30. As previously covered by InfoBytes, in an effort to provide liquidity to ensure continued lending during the Covid-19 pandemic, FHFA is allowing the GSEs to buy certain mortgages that enter forbearance within the first month after loan closing, prior to delivery to the GSEs.
FHFA also extended several loan origination flexibilities put in place to assist borrowers during the Covid-19 pandemic. Specifically, FHFA has further extended until September 30, the following provisions: “(i) alternative appraisals on purchase and rate term refinance loans; (ii) alternative methods for documenting income and verifying employment before loan closing; and (iii) expanding the use of power of attorney to assist with loan closings.”
OCC says banks affected by wildfires and storms can close
On August 24 and 25, the OCC issued two proclamations (available here and here) permitting OCC-regulated institutions, at their discretion, to close offices affected by the California and Colorado wildfires and the severe weather along the U.S. Gulf Coast “for as long as deemed necessary for bank operation or public safety.” The proclamation directs institutions to OCC Bulletin 2012-28 for further guidance on actions they should take in response to natural disasters and other emergency conditions. According to the 2012 Bulletin, only bank offices directly affected by potentially unsafe conditions should close and institutions should make every effort to reopen as quickly as possible to address customers’ banking needs.
Find continuing InfoBytes coverage on disaster relief here.
SBA clarifies PPP forgiveness for certain business owners, non-payroll costs
On August 27, the Small Business Administration (SBA) issued a new interim final rule (IFR), which provides additional guidance for Paycheck Protection Program (PPP) lenders on the treatment of business owners and the forgiveness of certain non-payroll costs. The new IFR specifies that “owner-employees with less than a 5 percent ownership stake in a C- or S- Corporation are not subject to the owner-employee compensation rule.” The SBA explained that the exemption, which was decided upon in consultation with the Secretary of Treasury, is intended to cover owner-employees who “have no meaningful ability to influence decisions over how loan proceeds are allocated.” With respect to the forgiveness of certain non-payroll costs, the SBA clarified that costs attributable to the business operations of tenants or sub-tenants of a PPP borrower or, for household expenses of home-based businesses, do not qualify for forgiveness. However, rent payments to a related third party are eligible for loan forgiveness under certain conditions. The IFR takes effect upon publication in the Federal Register. Comments on the provisions are due within 30 days.
CFPB issues CARD Act RFI
On August 25, the CFPB announced a Request for Information (RFI) on the Credit Card Accountability Responsibility and Disclosure Act of 2009 (CARD Act), consistent with the requirements of Section 610 of the Regulatory Flexibility Act (RFA), which specifies that agencies should review certain rules within 10 years of their publication to consider the rules’ effect on small businesses. Specifically, the Bureau is seeking comments from stakeholders on the economic impact of the CARD Act on small entities and whether regulations should be adjusted to address those impacts. Additionally, the RFI seeks information, pursuant to section 502(a) of the CARD Act, related to the consumer credit card market. Among other things, the Bureau requests stakeholders comment on (i) the terms of credit card agreements; (ii) the effectiveness of credit card disclosures; (iii) the cost and availability of credit cards; and (iv) credit card product innovation.
Comments on the RFI will be due 60 days after publication in the Federal Register.
FHFA delays implementation of new refinance fee
On August 25, FHFA announced that it will delay implementation of Fannie Mae and Freddie Mac’s new adverse market refinance fee until December 1. As previously covered by InfoBytes, the adverse market refinance fee of 50 basis points, or 0.5 percent, was originally slated to apply to certain refinance mortgages with settlement dates on or after September 1. FHFA received significant pushback regarding the fee, including concerns about its expedited implementation period, and lack of information regarding the market conditions that would be addressed by the change (see InfoBytes coverage here). In the new announcement, FHFA states that the fee is “necessary to cover projected COVID-19 losses of at least $6 billion at the Enterprises,” noting that $6 billion is the “conservatively projected” cost of actions taken to protect renters and borrowers based on (i) “$4 billion in loan losses due to projected forbearance defaults”; (ii) “$1 billion in foreclosure moratorium losses”; and (iii) “$1 billion in servicer compensation and other forbearance expenses.”
FDIC, HUD announce disaster relief guidance for Iowa, California borrowers
On August 26, the FDIC issued FIL-81-2020 to provide regulatory relief to financial institutions and help facilitate recovery in areas of Iowa affected by severe storms. In the guidance, the FDIC notes that, in supervising institutions affected by the severe weather, the FDIC will consider the unusual circumstances those institutions face. The guidance suggests that institutions work with impacted borrowers to, among other things, (i) extend repayment terms; (ii) restructure existing loans; or (iii) ease terms for new loans to those affected by the severe weather, provided the measures are “done in a manner consistent with sound banking practices, can contribute to the health of the local community and serve the long-term interests of the lending institution.” Additionally, the FDIC notes that institutions may receive Community Reinvestment Act consideration for community development loans, investments, and services in support of disaster recovery. The FDIC states it will also consider relief from certain filing and publishing requirements.
Separately, on August 25, HUD announced it will expedite disaster assistance to certain counties impacted by the California wildfires, which will provide foreclosure relief and other assistance to homeowners living in the counties. Specifically, HUD is providing an automatic 90-day moratorium on foreclosures of FHA-insured home mortgages for covered properties and is further making FHA insurance available to those victims whose homes were destroyed or severely damaged. Additionally, HUD’s Section 203(k) loan program will allow victims to finance the purchase or refinance of a house along with the costs of repair through a single mortgage, and will also allow homeowners with damaged property to finance the rehabilitation of their existing single-family homes.
Find continuing InfoBytes coverage on disaster relief guidance here.
FTC proposes to amend five FCRA rules to apply only to auto dealers
On August 24, the FTC announced several Notices of Proposed Rulemaking (NPRM) intended to clarify that five Fair Credit Reporting Act (FCRA) rules promulgated by the FTC will now apply only to motor vehicle dealers. The NPRMs also propose non-substantive amendments to correspond to changes made to the FCRA by the Dodd-Frank Act, and will apply to the following rules:
- Address Discrepancy Rule. This rule requires users of consumer reports to implement policies and procedures for, among other things, handling notices of address discrepancy received from a nationwide consumer reporting agency (CRA) and furnishing an address for a consumer that a “user has reasonably confirmed as accurate to the CRA from whom it received the notice.” The proposed amendments narrow the scope of the rule to motor vehicle dealers excluded from CFPB jurisdiction.
- Affiliate Marketing Rule. This rule provides consumers the right to restrict a person from using certain information obtained from an affiliate to make solicitations to the consumer. While the proposed amendments narrow the scope of the rule to “motor vehicle dealers” excluded from CFPB jurisdiction, they retain the substantive provisions of the rule because they “addresses the relationship between covered motor vehicle dealers and their affiliates, which may not be motor vehicle dealers.”
- Furnisher Rule. Under this rule, furnishers are required to implement policies and procedures regarding the accuracy and integrity of the consumer information they provide to a CRA. The amendments propose changes including narrowing the rule’s scope to entities set forth in Dodd-Frank “that are predominantly engaged in the sale and servicing of motor vehicles, excluding those dealers that directly extend credit to consumers and do not routinely assign the extensions of credit to an unaffiliated third party.”
- Prescreen Opt-Out Notice Rule. This rule outlines requirements for those who use consumer reports to make unsolicited credit or insurance offers to consumers. The proposed amendments will narrow the scope of the rule to cover only motor vehicle dealers. The model form is unchanged from the previous model notice and is identical to the model notice used by the CFPB.
- Risk-Based Pricing Rule. Under this rule persons that use information from a consumer report to offer less favorable terms are required to provide a risk-based pricing notice to consumers about the use of such data. Under the proposed amendments, only motor vehicle dealers will be required to comply.
The FTC seeks feedback on the effectiveness of the five rules, including (i) whether there exists a continuing need for each rule’s specific provisions; (ii) what benefits have been provided to consumers under each rule; and (iii) should modifications be made to each rule in order to benefit consumers and businesses or to account for changes in relevant technology or economic conditions.
Comments are due 75 days after the NPRMs are published in the Federal Register.