InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
Ginnie Mae now requires issuers to disclose cybersecurity incidents within 48 hours
On March 4, the President of Ginnie Mae released All Participants Memorandum (APM) 24-02, which set forth a new requirement applicable to all issuers, including issuers that subservice loans for others. The memo mandated that all approved issuers must notify Ginnie Mae of any significant cybersecurity incident within 48 hours of detection. Ginnie Mae defined a “Cyber Incident” as “an event that actually or potentially jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system; or constituted a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies and has the potential to directly or indirectly impact the Issuer’s ability to meet its obligations under the terms of the Guaranty Agreement.” If a Cyber Incident has occurred, issuers must it report to Ginnie Mae via a specified email address and must include (i) the date and time of the incident, (ii) a summary of the incident, and (iii) points of contact responsible for coordinating any follow-up questions regarding the incident. These requirements are also now reflected in Chapter 03, Part 18 of the Mortgage-Backed Securities Guide, 5500.3, REV-1.
FHFA announces updates for implementation of GSE credit score requirements
On February 29, FHFA announced updates related to the implementation of new credit score requirements for single-family loans acquired by Freddie Mac and Fannie Mae (GSEs). As previously covered by InfoBytes, FHFA released a two-phase plan for soliciting stakeholder input on the agency’s proposed process for updating credit score requirements. The new process, called the FICO 10T model, will, among other things, require two credit reports (a “bi-merge” credit report) from the national consumer reporting agencies, rather than the traditional three (covered by InfoBytes here). After considering stakeholder input, FHFA expects to transition from the Classic FICO credit score model to the bi-merge credit reporting requirement in Q1 2025. The GSEs will also move up the publication of VantageScore 4.0 historical data to Q3 2024 “to better support market participants” and provide pertinent historical data before the transition. FHFA will provide more details on the timing for FICO 10T implementation once this initial process is complete.
FTC proposes two actions to combat AI impersonation fraud
On February 15, the FTC announced its supplemental notice of proposed rulemaking relating to the protection of consumers from impersonation fraud, especially from any impersonations of government entities. The first action from the FTC was a final rule that prohibited the impersonation of government, business, and their officials or agents in interstate commerce. The second action was a notice seeking public comment on a supplemental proposed rulemaking that would revise the first action and add a prohibition on, and penalties for, the impersonation of individuals for entities who provide goods and services (with the knowledge or reason to know that those goods or services will be used in impersonations) that are unlawful. In tandem, these actions sought to prohibit the impersonation of government and business officials.
The FTC notes that these two actions come from “surging complaints” on impersonation fraud, specifically from artificial intelligence-generated deep fakes. The final rule will expand the remedies and provide monetary relief, whereas the FTC stated this rule will provide a “shorter, faster and more efficient path” for injured consumers to recover money. The rule would enable the FTC to seek monetary relief from scammers that use government seals or business logos, spoof government and business emails, and impersonate a government official or falsely imply a business affiliation.
FCC adopts rule on robocalls and robotexts, includes NPR on TCPA applicability
On February 15, the FCC adopted a rule to protect consumers from robocalls and robotexts. According to the rule, robocallers and robotexters must honor do-not-call and consent revocation requests within 10 business days from receipt. In addition, the rule will allow consumers to revoke consent under the TCPA through any unreasonable means and will clarify that the TCPA would not be violated when a one-time text message is sent confirming a consumer’s request that no further text messages be sent if the confirmation text only confirms the opt-out request and does not include marketing information.
The new rule clarified that revocation of consent can be made via automated methods such as interactive voice responses, key press activation on robocalls, responding with “stop” or similar messages to text messages, or using designated website or phone numbers provided by the caller all will constitute reasonable means to revoke consent. If a called party uses any of these designated methods to revoke consent, it will be considered definitively revoked, and future robocalls and robotexts from that caller must cease. The caller cannot claim that the use of such a mechanism by the called party is unreasonable. Any revocation request made through these specified means will be considered “absolute proof” of the called party's reasonable intent to revoke consent. Furthermore, when a consumer uses a method other than those discussed in the rule to revoke consent, “doing so creates a rebuttable presumption that the consumer has revoked consent when the called party satisfies their obligation to produce evidence that such a request has been made, absent evidence to the contrary.”
The Commission also included a notice of proposed rulemaking, seeking comment on “whether the TCPA applies to robocalls and robotexts from wireless providers to their own subscribers and whether consumers should have the ability to revoke consent and stop such communications.” The rule will go into effect 30 days after publication in the Federal Register, except for certain amendments that will not be effective until six months following OMB review.
FCC ruling determines AI calls are subject to TCPA regulations
On February 8, the FCC announced the unanimous adoption of a declaratory ruling that recognizes calls made with AI-generated voices are “artificial” under the Telephone Consumer Protection Act (TCPA). The declaratory ruling notes that the TCPA prohibits initiating “any telephone call to any residential telephone line using an artificial or prerecorded voice to deliver a message without the prior express consent of the called party” unless certain exceptions apply. The TCPA also prohibited “any non-emergency call made using an automatic telephone dialing system or an artificial or prerecorded voice to certain specified categories of telephone numbers including emergency lines and wireless numbers.”
The ruling, effective immediately, deemed voice cloning and similar AI technologies to be artificial voice messages under the TCPA, subject to its regulations. Therefore, prior express consent from the called party is required before making such calls. Additionally, callers using AI technology must provide identification and disclosure information and offer opt-out methods for telemarketing calls.
This ruling provided State Attorneys General nationwide with additional resources to pursue perpetrators responsible for these robocalls. This action followed the Commission’s November proposed inquiry for how AI could impact unwanted robocalls and texts (announcement covered by InfoBytes here).
Federal Reserve releases January SLOOS report on bank lending practices from Q4 2023
On February 5, the Federal Reserve Board released the results from their January 2024 Senior Loan Officer Opinion Survey (SLOOS) on bank lending practices. The SLOOS addressed changes in standards, terms, and the demand over bank loans over the past three months (i.e., Q4 of 2023). The SLOOS’s topics included commercial and industrial lending, commercial and residential real estate lending, and consumer lending. The SLOOS included questions on banks’ expectations for changes in lending standards, borrower demand and asset quality over 2024.
The SLOOS provided specific findings for each of its topics. On loans to businesses, banks generally reported tighter standards and weaker demand for commercial and industrial loans, as well as all commercial real estate loan categories. Demand weakened for all residential real estate loans. On loans to households, banks generally reported tighter lending standards for residential real estate loans, but the standards were unchanged for government-sponsored enterprise-eligible residential mortgages. For home equity lines of credit, banks reported tighter standards and weaker demand; this falls in line with credit card, auto, and other consumer loans, generally. Last, on the banks’ 2024 expectations, they expect lending standards to remain unchanged for commercial and industrial loans, and residential real estate loans, but to tighten further for commercial real estate, credit card, and auto loans. Banks also reported that they expect demands for loans to strengthen, but loan quality to weaken, across all categories. The SLOOS includes 67 pages of data gleaned from its questions.
FCC Chairwoman proposes making all AI-generated robocalls “illegal” to help State Attorneys General
On January 31, FCC Chairwoman, Jessica Rosenworcel, released a statement proposing that the FCC “recognize calls made with AI-generated voices are ‘artificial’ voices under the Telephone Consumer Protection Act (TCPA), which would make voice cloning technology used in common robocalls scams targeting consumers illegal.” Specifically, the FCC’s proposal would make voice cloning technology used in robocall scams illegal, which has been used to impersonate celebrities, political candidates, and even close family members. Chairwoman Rosenworcel stated, “No matter what celebrity or politician you favor… it is possible we could all be a target of these faked calls… That’s why the FCC is taking steps to recognize this emerging technology as illegal… giving our partners at State Attorneys General offices… new tools they can use to crack down on these scams and protect customers.”
This action comes after the FCC released a Notice of Inquiry last month where the FCC received comments from 26 State Attorneys General to understand how the FCC can better protect consumers from AI-generated telemarking, as covered by InfoBytes here. This is not the first time the FCC has targeted robocallers: as previously covered by InfoBytes in October 2023, the FCC proposed an inquiry into how AI is used to create unwanted robocalls and texts; in September 2023, the FCC updated its rules to curb robocalls under the Voice over Internet Protocol, covered here.
OCC issues proposed rule for bank merger approvals
On January 29, the OCC announced a proposed rule for bank merger approvals under the Bank Merger Act (BMA). The OCC proposed changes to 12 CFR 5.33 to reflect its view that a business combination is a significant corporate transaction.
The OCC suggested two key changes to its business combination regulation (12 CFR 5.33). First, it proposed removing the expedited review procedures outlined in § 5.33(i). Currently, this provision automatically approves certain filings after the 15th day following the close of the comment period, but the OCC believes that no business combinations subject to § 5.33 should be approved solely based on elapsed time. Additionally, the OCC suggests removing paragraph (d)(3), as it pertains to defining applications eligible for expedited review. Second, the OCC proposes the removal of § 5.33(j), which outlines four scenarios allowing an applicant to use the OCC's streamlined business combination application instead of the full Interagency Bank Merger Act Application. The streamlined application seeks information on similar topics, but only requires detailed information if the applicant answers affirmatively to specific yes-or-no questions. Currently, a transaction eligible for the streamlined application also qualifies for expedited review, a feature the OCC is proposing to eliminate. Additionally, a new policy statement (proposed as Appendix A to 12 CFR part 5, subpart C) is introduced to provide clarity and guidance on general principles used by the OCC in reviewing applications under the BMA. The policy statement also covers considerations for financial stability, resources, prospects, and convenience and needs factors. Criteria for deciding whether to hold a public meeting on a BMA application were also outlined.
Comments from the public are due 60 days from the date of publication in the Federal Register.
FFIEC publishes proposed extension of reporting obligations
On January 26, the Federal Financial Institutions Examination Council (FFIEC) approved the OCC, Fed, and FDIC’s publication for public comment of a proposal to extend several information collection items for three years. As previously covered by InfoBytes, the FFIEC last month put forth a similar three-year proposal on FFIEC 002 which affected the three Call Reports (FFIEC 031, 041, and 051). While this proposal includes those same four items, it adds two more: the Regulatory Capital Reporting for Institutions Subject to the Advanced Capital Adequacy Framework (FFIEC 101), and the Market Risk Regulatory Report for Institutions Subject to the Market Risk Capital Rule (FFIEC 102). The proposed changes include a new confidential report (FFIEC 102a) titled the Market Risk Regulatory Report that would “collect information necessary for the agencies to evaluate [an]… institution’s implementation of the market risk rule and validate a [bank’s] internal models used in preparing the FFIEC 102.” The revisions are related to the agencies’ capital rule proposal published on September 18, 2023. Comments are requested by March 25, 2024, and the revisions are planned to be effective as of September 30, 2025.
FTC hosts tech summit on artificial intelligence; CFPB weighs in
On January 25, the FTC hosted a virtual tech summit focused on artificial intelligence (AI). The summit featured speakers from the FTC––including all three commissioners––software engineers, lawyers, technologists, entrepreneurs, journalists, and researchers, among others. First, Commissioner Slaughter spoke on how there are three main acts that led to where we are today in creating guardrails for AI use: first, the emergence of social media; second, industry groups and whistleblowers rang the alarm on data privacy and forced regulators to play catch-up; third, regulators must now urgently grapple with difficult social externalities such as impacts on society and political elections.
The first panel discussed the various business models at play in the AI space. One journalist spoke on the recent Hollywood writers’ strike, opining that copyright law is a poor legal framework by which to regulate AI, and suggested labor and employment law as a better model. An analyst at a venture capital firm discussed how her firm finds investment opportunities by reviewing which companies use a language-learning model, as opposed to the transformer model, which is more attractive to that firm.
Before the second panel, Commissioner Bedoya discussed the need for fair and safe AI, and said that in order for the FTC to be successful, it must execute policy with two topics in mind: first, people need to be in control of technology and decision making, not the other way around; and second, competition must be safeguarded so that the most popular technology is the one that works the best, not just the one created by the largest companies.
During the second panel, a lawyer from the CFPB spoke on how the CFPB is doing “a lot” with regards to AI, and that the CFPB gives AI technology no exceptions in the laws it oversees. The CFPB recently issued releases on how the “black box” model in credit decision making needs to be fair and free from bias. When discussing future AI enforcement actions, the CFPB lawyer said in a “high-level” way that AI enforcement is currently “capacity building”; they are building out their resources to be more intellectually diverse, including having recently created their technologist program.