InfoBytes
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
FINRA supplements guidance on enforcement credit for “extraordinary cooperation”
On July 11, the Financial Industry Regulatory Authority (FINRA) issued Regulatory Notice 19-23, which provides clarifying guidance on enforcement credit for firms or individuals that provide “extraordinary cooperation” in investigations that exceed FINRA’s rule requirements. Specifically, FINRA defines “extraordinary cooperation” as including (i) self-reporting violations prior to regulator detection and intervention; (ii) taking voluntary, extraordinary steps to correct problems; (iii) making voluntary remediation to customers prior to detection; and (iv) providing a substantial amount of assistance to FINRA’s investigation. The notice, which supplements prior guidance issued in 2008, also clarifies the difference between required cooperation and extraordinary efforts, and outlines the types of credit firms or individuals may receive.
FTC seeks permanent injunction against student loan debt relief operation
On July 11, the FTC announced it was charging a student loan debt relief operation with violations of the FTC Act and the Telemarketing Sales Rule for allegedly engaging in deceptive practices when marketing and selling their debt relief services. The complaint alleges the operators of the scheme allegedly, among other things, (i) charged borrowers illegal advance fees; (ii) falsely claimed they would service and pay down their student loans; and (iii) obtained borrowers’ credentials in order to change consumers’ contact information and prevent communications from loan servicers. According to the FTC, the defendants allegedly collected more than $23 million from consumers, and when asked why their payments were not being applied to their loans, the defendants “informed consumers that their entire payments had been collected as ‘handling’ or ‘management’ fees.” On July 10, the U.S. District Court for the Central District of California issued a temporary restraining order and asset freeze at the FTC’s request. The FTC seeks a permanent injunction against the defendants to prevent future violations, as well as redress for injured consumers through “rescission or reformation of contracts, restitution, the refund of monies paid, and the disgorgement of ill-gotten monies.”
OCC allows institutions affected by severe flooding in Gulf Coast to temporarily close
On July 12, the OCC issued a proclamation permitting OCC-regulated institutions, at their discretion, to close offices affected by severe weather along the Gulf Coast “for as long as deemed necessary for bank operation or public safety.” In issuing the proclamation, the OCC noted that only bank offices directly affected by potentially unsafe conditions should close and that institutions should make every effort to reopen as quickly as possible to address customers’ banking needs. The proclamation directs institutions to OCC Bulletin 2012-28 for further guidance on actions they should take in response to natural disasters and other emergency conditions.
Find continuing InfoBytes coverage on disaster relief here.
U.K.’s ICO announces two GDPR data breach actions
On July 8 and 9, the United Kingdom’s Information Commissioner’s Office (ICO) issued two notices of its intention to fine companies for infringements of the General Data Protection Regulation (GDPR). On July 8, the ICO announced it intended to fine a U.K.-based airline £183.39M for a September 2018 cyber incident, which, due to “poor security arrangements,” allowed attackers to divert user traffic on the airline’s website to a fraudulent site, making consumer details accessible. The airline notified the ICO about the incident, which compromised the data of approximately 500,000 consumers, and has cooperated with the ICO in the investigation and made improvements to its security arrangements. Additionally, on July 9, the ICO announced it intended to fine a multinational hotel chain £99,200,396 for failing to undertake sufficient due diligence when the chain purchased a hotel group in 2016, which had previously exposed 339 million guest records globally in 2014. The exposure was discovered in 2018, and the hotel chain thereafter reported the incident to the ICO, and has cooperated with the investigation and made improvements to its security arrangements. In both announcements, the ICO notes that it will, “consider carefully the representations made by the company and the other concerned data protection authorities” before issuing the final decision.
Delaware authorizes participation in multi-state automated licensing system
On June 27, the Delaware Governor signed HB 199, which, among other provisions, authorizes the Delaware State Bank Commissioner to participate in a multi-state automated licensing system that will assist in the facilitation of the application and licensing process for mortgage loan brokers, licensed lenders, mortgage loan originators, money transmitters, check cashers, and motor vehicle sales finance companies. The new legislation also permits the State Bank Commissioner to share information collected and maintained with other participating states “for the purpose of licensing, regulating, or supervising that same applicant or licensee under a statute similar to this chapter, if that state could have obtained that same information directly from the applicant or licensee under its own law.” The amendments become effective immediately.
Alaska amends provisions regarding mortgage licensing exemptions
On June 28, the Alaska governor signed HB 104, which provides limited exemptions from the state’s licensing requirements for qualifying mortgage lenders, mortgage brokers, and mortgage loan originators. Specifically, the amended exemptions include (i) bona fide nonprofit organizations, as well as employees acting as mortgage loan originators for public or charitable purposes; (ii) individuals operating as registered mortgage loan originators on behalf of exempt depository institutions and their subsidiaries, or institutions regulated by the Farm Credit Administration; (iii) certain sellers who self-finance five or fewer sales and are in compliance with the Act’s requirements; and (iv) employees of exempt federal, state, or local government agencies. Section AS 06.60.015(b)(4) is retroactively effective July 1, 2008. Sections 2, 6, and 7 are effective immediately, with the remainder of HB 104 taking effect January 1, 2020.
OFAC sanctions Iranian-backed Hizballah officials
On July 9, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced sanctions pursuant to Executive Order 13224 against three Iranian-backed Hizballah political and security figures for “exploit[ing] Lebanon’s financial and security elements” in furtherance of Hizballah’s and Iran’s activities in support of terrorists and acts of terrorism. As a result of the sanctions, “all property and interests in property of these targets that are in the United States or in the possession or control of U.S. persons must be blocked and reported to OFAC.” OFAC notes that its regulations “generally prohibit” U.S. persons from participating in transactions with the designated individuals. The designated individuals are also subject to secondary sanctions pursuant to the Hizballah Financial Sanctions Regulations, which implement the Hizballah International Financing Prevention Act of 2015, and allow OFAC the authority to “prohibit or impose strict conditions on the opening or maintaining in the United States of a correspondent account or a payable-through account by a foreign financial institution that knowingly facilitates a significant transaction for Hizballah, or a person acting on behalf of or at the direction of, or owned or controlled by, Hizballah.”
FCC Chairman proposes rules addressing spoofed texts and international robocalls
On July 8, FCC Chairman Ajit Pai proposed rules supported by a bipartisan group of more than 40 state attorneys general that would extend prohibitions against robocalls to caller ID spoofing of text messages and international calls, implementing measures passed last year in the RAY BAUM’s Act. Previously, anti-spoofing prohibitions applied only to domestic robocalls. According to Pai, “Scammers often robocall us from overseas, and when they do, they typically spoof their numbers to try and trick consumers. . . . With these new rules, we’ll close the loopholes that hamstring law enforcement when they try to pursue international scammers and scammers using text messaging.” The FCC will vote on the proposed rules at its August 1 meeting.
As previously covered by InfoBytes, the FCC authorized voice service providers last month to automatically identify and block unwanted robocalls “based on reasonable call analytics, as long as their customers are informed and have the opportunity to opt out of the blocking.”
3rd Circuit: Collection letter failed to properly identify creditor in violation of FDCPA
On July 10, the U.S. Court of Appeals for the 3rd Circuit reversed the dismissal of a FDCPA action against a debt collector, holding that the collection letter failed to apprise the least sophisticated debtor of the creditor’s identity. The complaint alleges that the debt collector “failed to identify ‘the name of the creditor to whom the debt is owed’” as required by the FDCPA because the letter listed “at least four entities” that were connected in some way to the debt. The district court dismissed the complaint, concluding the debt collector sufficiently identified the creditor.
On appeal, the 3rd Circuit concluded that the letter failed to notify the least sophisticated debtor of the creditor’s identity for three reasons: (i) the letter did not expressly state that the bank was the creditor or the owner of the debt; (ii) the letter identified the bank as the “assignee of” three other financial entities and “assignee” is a legal term that does not assist a debtor in understanding the relationships between the parties; and (iii) the letter as a whole failed to sufficiently identify the bank as the creditor, as the reference to three other entities “‘overshadowed’ the creditor’s identity.” The appellate court concluded that the letter failed to properly disclose the creditor and therefore, violated the FDCPA, reversing the district court’s dismissal of the complaint.
Hawaii approves temporary authority to act as a registered mortgage loan originator
On June 7, the Hawaii governor signed HB 988, which provides 120-day temporary authority for certain mortgage loan originators to originate loans in Hawaii without a state license. Pursuant to Section 106 of the Economic Growth, Regulatory Relief, and Consumer Protection Act, the bill allows a federally-registered mortgage loan originator (MLO) holding an MLO license in another state while employed by a Hawaii-licensed mortgage company, to have temporary authority to act as a state-licensed MLO for a period not to exceed 120 days while the MLO’s Hawaii license application is pending. MLOs with temporary authority are subject to the applicable laws of Hawaii to the same extent as persons licensed by Hawaii. The bill is effective on November 24.