InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
Special Alert: NYDFS fines trading platform for BSA/AML, transaction monitoring, and cybersecurity lapses
The New York Department of Financial Services and a trading platform on Aug. 1 entered into a consent order to resolve deficiencies identified during a 2019 examination and a subsequent investigation by the department’s enforcement section. The consent order focused on deficiencies related to Bank Secrecy Act and anti-money-laundering compliance, transaction monitoring, cybersecurity, and related New York certifications of compliance. The company will pay a $30 million civil monetary penalty and retain an independent consultant that will assist with remediating the issues highlighted in the order and report to NYDFS on remediation progress.
The consent order has far-reaching implications for all financial services companies that come under the jurisdiction of the NYDFS.
The trading platform is a wholly owned subsidiary of a financial services company that offers U.S.-based retail investors the ability to trade stocks, options, and crypto currency on a commission-free basis through its broker-dealer subsidiary. The trading platform is licensed by the NYDFS to engage in virtual currency and money transmitter businesses in New York. Of primary concern for the NYDFS was the platform’s alleged reliance on its parent company’s compliance and cybersecurity programs through enterprisewide systems that the NYDFS found to be inadequate. Additionally, according to NYDFS, the platform allegedly had few to no qualified personnel or management involved in overseeing those programs, which NYDFS has implicitly indicated cannot be outsourced.
NYDFS imposes $30 million fine against trading platform for cybersecurity, BSA/AML violations
On August 2, NYDFS announced a consent order imposing a $30 million fine against a trading platform for alleged violations of the Department’s Virtual Currency Regulation (23 NYCRR Part 200), Money Transmitter Regulation (3 NYCRR Part 417), Transaction Monitoring Regulation (3 NYCRR Part 504), Cybersecurity Regulation (23 NYCRR Part 500), and for failing to maintain adequate Bank Secrecy Act/anti-money laundering (BSA/AML) obligations. According to a Department investigation, the platform’s BSA/AML compliance program contained significant deficiencies, including an inadequate transaction monitoring system. Among other things, the platform failed to timely transition its manual system to an automated transaction monitoring system, which was unacceptable for a program of its size, customer profiles, and transaction volumes, and did not devote sufficient resources to adequately address risks. The Department also found “critical failures” in the platform’s cybersecurity program, which failed to address operational risks, and that specific policies within the program did not fully comply with several provisions of the Department’s cybersecurity and virtual currency regulations. According to the press release, pursuant to NYDFS’s Transaction Monitoring Regulation and Cybersecurity Regulation, companies should only file a Certificate of Compliance with the Department if their programs are fully compliant with the applicable regulation.
In light of the program’s deficiencies, NYDFS stated that the platform’s 2019 certifications to the Department attesting to compliance with these regulations should not have been made and thus violated the law. The platform also “failed to comply with the Supervisory Agreement by failing to promptly notify the Department of (a) actual or material potential actions, proceedings, or similar process that were or may have been instituted against [the platform] or any affiliated entity by any regulatory body or governmental agency; and (b) of the receipt by [the platform], or any affiliated entity, of any subpoena from any regulatory body or governmental agency in which [the platform], or any affiliated entity, was the target of the investigation.” NYDFS determined that in addition to the penalty, the platform will be required to retain an independent consultant that will perform a comprehensive evaluation of its compliance with the Department’s regulations and the platform’s remediation efforts with respect to the identified deficiencies and violations.
A Buckley Special Alert is forthcoming.
Connecticut issues money transmitter advisory
Recently, the Connecticut Department of Banking (Department) issued an advisory on money transmission, providing general guidance on what types of activities and entities must be licensed. According to the advisory, transmission can occur whenever “a person takes possession or control of monetary value belonging to another person” and holds it for a period of time, or transmits it to a third party. The Department noted that “[t]he increased use of technology to enable immediate payment mechanisms, as well as the explosion of virtual currency, has caused significant disruption to traditional money transmission systems.” The Department also acknowledged that many consumers do “not realize or understand the regulatory landscape that applies” to using money transmitters. Among other things, the advisory listed entities that traditionally provide transmission services like bill payers, payroll processors, and issuers and sellers of prepaid cards and money orders. The advisory also discussed Connecticut’s license application and penalties for unlicensed transmission, explaining that licensure goes through the Nationwide Multistate Licensing System and involves disclosing pertinent information concerning all “control persons.”
FTC sues national retailer for allegedly facilitating money transfer fraud
On June 28, the FTC filed a complaint against a national retailer for allegedly allowing its money-transfer services to facilitate fraud. The complaint alleges the retailer knew about the role money transfer services play in scams but failed to properly secure the services offered at its stores, thus allowing money to be sent to “domestic and international fraud rings.” According to the FTC, at least 226,679 complaints totaling more than $197 million were received by several money transfer services companies about fraud-induced money transfers that were sent from or received at one of the retailer’s stores between January 1, 2013 and December 31, 2018. An investigation by the FTC purportedly revealed that the retailer’s practices allegedly harmed consumers by, among other things, (i) allowing the payout of suspicious money transfers, which allowed scammers to retrieve fraud proceeds at one of the retailer’s stores; (ii) failing to have in place a written anti-fraud policy or consumer protection program until November 2014; (iii) allowing cash pickups for large payments, often through the use of fake IDs; (iv) failing to display or provide materials warning consumers about potential frauds; (v) failing to effectively train or retrain employees; and (vi) allowing money transfers to be used for telemarketing purchases, which are prohibited under the Telemarketing Sales Rule (TSR) due to the high risk of fraud.
According to the complaint, the retailer “is well aware that telemarketing and other mass marketing frauds, such as ‘grandparent’ scams, lottery scams, and government agent impersonator scams, induce people to use [the retailer’s] money transfer services to send money to domestic and international fraud rings. Nevertheless, [the retailer] has continued processing fraud-induced money transfers at its stores—funding telemarketing and other scams—without adopting policies and practices that effectively detect and prevent these transfers.”
The complaint seeks a permanent injunction, monetary relief, civil penalties, restitution, and other relief for each violation of the FTC Act and the TSR. The FTC also requests the “rescission or reformation of contracts, the refund of money, the return of property, the payment of damages, public notification, or other relief necessary to redress injury to consumers damages.”
The retailer issued a press release following the FTC’s announcement, stating that it considers the agency’s claims to be “misguided and legally flawed,” and that the civil lawsuit “was approved by the FTC by the narrowest of margins after Chair Lina Khan refused [the retailer] the due process of hearing directly from the company.” The retailer noted that the FTC’s decision comes after DOJ declined to pursue the case in court. Among other thing, the retailer contended that because it maintains robust anti-fraud measures there is no need for injunctive relief requiring the retailer to change its practices. The retailer pointed to the U.S. Supreme Court’s ruling in AMG Capital Management LLC v. FTC, which limited the FTC’s ability to obtain monetary relief in federal court (covered by InfoBytes here), to argue that the FTC “pivoted their focus in this case after AMG to a distorted interpretation of the TSR to effectively try and hold [the retailer] strictly liable for money transfers that third-party criminals reportedly persuaded some consumers to send.” The retailer added that “[s]witching their main legal theory to the TSR is an obvious attempt to get around the Supreme Court’s ruling in AMG.”
Hawaii enacts licensing legislation
On June 17, the Hawaii governor signed two bills into law. HB 2113 permits money transmitter license applicants to submit to either a state or federal criminal history record check, rather than both, upon application. SB 1105 establishes that, in addition to application fees, and any fees required by NMLS, a mortgage loan originator licensee must pay a mortgage loan recovery fund fee of $200, and upon application for renewal of a license, a mortgage loan originator licensee must pay $100. The bill also permits a person aggrieved by the fraud, misrepresentation, or deceit of a mortgage loan originator company licensee to receive restitution payment upon a final court order. The bills are effective July 1.
Florida amends money service businesses provisions to define “control persons”
On May 26, the Florida governor signed HB 389, which amends provisions related to money service businesses and related licensing requirements. The bill, among other things, replaces the term “officers” with “control person” and expands the definition of “control person” to designate the type of individuals that may be considered to control a licensee. As a result of this amendment, the bill sets forth and clarifies various requirements related to the vetting and reporting of control persons, as opposed to officers generally, going forward. The law is effective October 1.
Arizona passes money transmitter licensure legislation
On May 20, the Arizona governor signed SB 1580, which revises provisions related to money transmitters. The bill, among other things, provides that “a person may not engage in the business of money transmission or advertise, solicit or hold itself out as providing money transmission unless the person is licensed." The provision does not apply to “a person that is an authorized delegate of a person licensed under this article that is acting within the scope of authority conferred by a written contract with the licensee,” and to exempt persons provided the person “does not engage in money transmission outside the scope of the exemption.” The bill also creates provisions related to consistent licensure, application for licensure, and information requirements for certain individuals.
Connecticut amends banking statutes
On May 17, the Connecticut governor signed S.B. 268, which makes various revisions to state banking statutes. Among other things, the bill establishes that a money transmission license is not transferable or assignable, but a licensee may be acquired under certain circumstances. The bill also establishes that the commissioner cannot approve a state-bank’s loan production office to be established unless the commissioner has considered the out-of-state bank's record of compliance. Additionally, the bill establishes certain definitions, including the meaning of “control”, “control person,” “key individual,” and “passive investor.” The bill is effective October 1.
Florida amends MSB provisions to define “control persons”
On May 12, the Florida governor signed HB 273, which amends provisions related to money services business activities. The bill, among other things, revises provisions related to prohibited activities without a license and other requirements for written contracts between a money transmitter or payment instrument seller and an authorized vendor, and provides requirements for a money transmitter that receives virtual currency, among other things. The bill also establishes that “each money transmitter that receives virtual currency, either directly or through an authorized vendor, for the purpose of transmitting such virtual currency from one person to another location or person must at all times, until the transmission obligation is completed, hold virtual currency of the same type and amount owed or obligated to the other location or person.” The bill is effective January 1, 2023.
California reinstates single commercial loan licensing exemption under the CFL
On April 28, the California governor signed SB 577, which amends provisions relating to certain financial institutions, including California Financing Law (CFL), Escrow Agent, and Money Transmitter licensees.
The bill reinstates a licensing exemption available to commercial lenders in California. Specifically, the bill reenacted a provision that formerly expired on January 1, 2022. This reinstated provision permits a lender to make a single loan within a 12-month period, if the loan is a commercial loan as defined by the CFL, without having to obtain a CFL license.
The bill also updates contact information to be included on notices posted by California Money Transmitter licensees. Specifically, the bill establishes that California Money Transmitter licensees are required to prominently post, in English and in the same language used by the licensee to conduct business, on the premises of each branch office that conducts money transmission activities a certain notice, including specific contact information for the California Department of Financial Protection and Innovation.
Finally, the bill removes obsolete language from provisions governing criminal and civil background requirements for Escrow Agent licensees.
The bill is effective immediately.