InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
OFAC announces new Sudan E.O., issues and amends several sanctions general licenses and FAQs
The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) recently announced several sanctions-related actions, including President Biden’s new Executive Order (E.O.) Imposing Sanctions on Certain Persons Destabilizing Sudan and Undermining the Goal of a Democratic Transition. The E.O. expands the scope of a 2006 Executive Order following the determination that recent events in Sudan “constitute[] an unusual and extraordinary threat to the national security and foreign policy of the United States.” The E.O. outlines specific prohibitions and provides that all property and interests in property that are in the U.S. or that later come in the U.S., or that are in the possession or control of any of the identified U.S. persons must be blocked and may not be transferred, paid, exported, withdrawn, or otherwise dealt in. Concurrently, OFAC issued a new FAQ clarifying which sanctions authorities are applicable to Sudan and the Sudanese government.
OFAC also issued Venezuela-related General License (GL) 42, which authorizes certain transactions related to the negotiation of settlement agreements with the IV Venezuelan National Assembly and certain other entities. The authorized transactions must relate to debt owed by the Venezuelan government, Petróleos de Venezuela, S.A., or any entity owned, directly or indirectly, 50 percent or more. GL 42 does not authorizes transactions involving the Venezuelan National Constituent Assembly convened by Nicolas Maduro or the National Assembly seated on January 5, 2021. OFAC also released three new related FAQs and one amended FAQ.
Additionally, OFAC released cyber-related GL 1C, which authorizes certain transactions with Russia’s Federal Security Service that would normally be prohibited by the Weapons of Mass Destruction Proliferators Sanctions Regulations, and issued three amended cyber-related FAQs. A few days later, OFAC issued Russia-related GL 8G, which authorizes certain transactions related to energy that would otherwise be prohibited by E.O. 14024, involving certain entities, including Russia’s central bank. OFAC clarified that GL 8G does not authorize prohibited transactions related to (i) certain sovereign debt of the Russian Federation; (ii) the “opening or maintaining of a correspondent account or payable-through account for or on behalf of any entity subject to Directive 2 under E.O. 14024, Prohibitions Related to Correspondent or Payable-Through Accounts and Processing of Transactions Involving Certain Foreign Financial Institutions”; and (iii) or “[a]ny debit to an account on the books of a U.S. financial institution of the Central Bank of the Russian Federation,” among others.
OFAC announces drug cartel sanctions
On May 9, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced sanctions, pursuant to Executive Order 14059, against four individuals involved in the fentanyl trade, along with two related Mexico-based entities. According to OFAC, the sanctioned persons are part of a Sinaloa Cartel network responsible for trafficking a significant portion of fentanyl and other drugs into the United States. OFAC coordinated with the Mexican government, the FBI, the DEA, and Homeland Security to take this action. As a result of the sanctions, all property and interests in property belonging to the sanctioned individuals and entities subject to U.S. jurisdiction are blocked and must be reported to OFAC. U.S. persons are also generally prohibited from engaging in any dealings involving the property or interests in property of blocked or designated persons. Additionally, OFAC warned that “persons that engage in certain transactions with the individuals and entities designated today may themselves be exposed to sanctions or subject to an enforcement action.”
FDIC announces Florida disaster relief
On May 5, the FDIC issued FIL-22-2023 to provide regulatory relief to financial institutions and help facilitate recovery in areas of Florida affected by severe storms, tornados, and flooding from April 12 to 14. The FDIC acknowledged the unusual circumstances faced by affected institutions and encouraged those institutions to work with impacted borrowers to, among other things: (i) extend repayment terms; (ii) restructure existing loans; or (iii) ease terms for new loans, provided the measures are done “in a manner consistent with sound banking practices.” Additionally, the FDIC noted that institutions “may receive favorable Community Reinvestment Act consideration for community development loans, investments, and services in support of disaster recovery.” The FDIC will also consider regulatory relief from certain filing and publishing requirements and instructed institutions to contact the Atlanta Regional Office if they expect delays in making filings or are experiencing difficulties in complying with publishing or other requirements.
Colorado establishes medical debt collection requirements
On May 4, the Colorado governor signed SB 23-093 to cap the interest rate on medical debt at three percent per year. The Act outlines numerous provisions, including that entities collecting on a medical debt must provide a consumer with a written copy of a payment plan within seven days for medical debt that is payable in four or more installments. The Act also outlines requirements for accelerating or declaring a payment plan longer operative, and lays out prohibited actions (such as collecting on a debt or reporting a debt to a consumer reporting agency within a certain timeframe) relating to medical debt that an entity knows, or reasonably should know, is under review or being appealed. An entity that files a legal action to collect a medical debt must provide to a consumer (upon written request) an itemized statement concerning the debt and must allow a consumer to dispute the debt’s validity after receiving the statement. Entities are prohibited from engaging in collection activities until the itemized statement is delivered. The Act outlines self-pay requirements and estimates, and further provides that it is a deceptive trade practice to violate outlined provisions relating to billing practices, surprise billing, and balance billing laws. The Act takes effect immediately and applies to contracts entered into after the effective date.
Oklahoma ties maximum interest on loans to fed funds rate
The Oklahoma governor recently signed SB 794, which increases the maximum loan finance charge for certain loans (i.e., supervised loans under applicable Oklahoma law) by additionally including the federal funds rate published by the Federal Reserve Board. Specifically, a loan finance charge may not exceed the equivalent of the greater of either of the following: the total of (i) 32 percent plus the federal funds rate per year on the part of the unpaid balances of the principal which is $7,000 or less; (ii) 23 percent plus the federal funds rate per year on the part of the unpaid balances of the principal which greater than $7,000 but less than $11,000; and (iii) 20 percent plus the federal funds rate per year on the part of the unpaid balances of the principal which exceeds $11,000; or 25 percent plus the federal funds rate per year on the unpaid balances of the principal. The federal funds rate is defined as the rate published by the Fed that is “in effect as of the first day of each month immediately preceding the month during which the loan is consummated.” Supervised lenders may contract for and receive a loan finance charge not exceeding what is allowed by the Act. The Act is effective November 1.
SEC’s $279 million whistleblower award is largest ever
On May 5, the SEC announced the Commission’s largest-ever award—nearly $279 million—awarded to a whistleblower for providing information and assistance leading to the successful enforcement of SEC and related actions. The SEC noted that this award is more than double the previous record-holding $114 award issued in October 2020. According to the redacted order, the whistleblower voluntarily provided original information, which caused enforcement staff to expand the scope of the investigation and saved the SEC significant time and resources. The whistleblower also provided substantial ongoing assistance, including providing multiple written submissions, communications, and interviews, the SEC said, finding also that the whistleblower satisfied the requirements under Rules 21-F-3(b)(1) for related actions awards as the related successful enforcement actions were partly based on the same information provided to the Commission. However, in the same order, the SEC affirmed denial of two other claimants’ award claims after determining, among other things, that the individuals did not submit information leading to the successful enforcement of the covered action.
CFPB examines high-cost financings that cover medical expenses
On May 4, the CFPB released a report examining high-cost alternative financing products targeted to patients as a way to cover medical expenses. Products offered by a growing number of financial institutions and fintech companies include medical credit cards and installment loans, which typically carry significantly higher interest rates than those associated with traditional consumer credit cards (26.99 percent annual percentage rate as compared to 16 percent), the Bureau found, adding that these products also often have deferred interest plans which can create significant financial burdens for patients. The report found that between 2018 and 2020, consumers used alternative financing products to pay for nearly $23 billion in healthcare expenses and paid $1 billion in deferred interest. The report further found that companies are primarily marketing their products directly to healthcare providers with promised incentives. While the companies service the credit cards and loans, the Bureau explained that the healthcare providers are responsible for offering the products to patients and disclosing terms and risks. Many of these healthcare providers are unable to adequately explain complex terms, such as deferred interest plans, leaving patients facing ballooned deferred interests and lawsuits, the Bureau warned. According to the Bureau’s announcement, “financing medical debt on a credit card may increase patients’ exposure to extraordinary credit actions that healthcare providers would typically not pursue,” as “there can be a greater incentive for creditors to pursue lawsuits because unlike many healthcare providers, creditors can pursue a debt’s principal plus interest and fees.”
FHA implements provisions for transitioning LIBOR-based ARMs
On May 2, FHA published Mortgagee Letter (ML) 2023-09 to implement provisions of the Adjustable Rate Mortgages (ARM): Transitioning from LIBOR to Alternative Indices final rule that was published in the Federal Register at the beginning of March. (Covered by InfoBytes here.) The final rule replaces LIBOR with the Secured Overnight Financing Rate (SOFR) as the approved index for newly-originated forward ARMs, codifies HUD’s approval of SOFR as an index for newly-originated home equity conversion mortgages (HECM) ARMs, and establishes “a spread-adjusted SOFR index as the Secretary-approved replacement index to transition existing forward and HECM ARMs off LIBOR.” The ML provides interest rate transition directions for mortgagees and announces the availability of updated HECM model loan documents, which have been revised to be consistent with the final rule and the ML. The provisions in the ML have various effective dates.
Indiana becomes seventh state to enact comprehensive privacy legislation
On May 1, the Indiana governor signed SB 5 to establish a framework for controlling and processing consumers’ personal data in the state. Indiana is now the seventh state in the nation to enact comprehensive consumer privacy measures, following California, Colorado, Connecticut, Virginia, Utah, and Iowa (covered by Special Alerts here and here and InfoBytes here, here, here, and here). The Act applies to any person that conducts business in the state or produces products or services targeted to residents and, during a calendar year, (i) controls or processes personal data of at least 100,000 Indiana residents or (ii) controls or processes personal data of at least 25,000 Indiana residents and derives more than 50 percent of gross revenue from the sale of personal data. The Act outlines exemptions, including financial institutions and data subject to the Gramm-Leach-Bliley Act, as well as covered entities governed by the Health Insurance Portability and Accountability Act.
Indiana consumers will have the right to, among other things, (i) confirm whether their personal data is being processed and access their data; (ii) correct inaccuracies; (iii) delete their data; (iv) obtain a copy of personal data processed by a controller; and (v) opt out of the processing of their data for targeted advertising, the sale of their data, or certain profiling. The Act outlines data controller responsibilities, including a requirement that controllers must respond to consumers’ requests within 45 days unless extenuating circumstances arise. The Act also limits the collection of personal data “to what is adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed, as disclosed to the consumer,” and requires controllers to implement data security protection practices “appropriate to the volume and nature of the personal data at issue” and conduct data protection assessments for processing activities created on or generated after December 31, 2025, that present a heightened risk of harm to consumers. Under the Act, controllers may not process consumers’ personal data without first obtaining consent, or in the case of a minor, without processing such data in accordance with the Children’s Online Privacy Protection Act. Additionally, the Act sets forth obligations relating to contracts between a controller and a processor.
While the Act explicitly prohibits its use as a basis for a private right of action, it does grant the state attorney general exclusive authority to enforce the law. Additionally, upon discovering a potential violation of the Act, the attorney general must give the controller or processor written notice and 30 days to cure the alleged violation before the attorney general can file suit. The attorney general may seek injunctive relief and civil penalties not to exceed $7,500 for each violation.
The Act takes effect January 1, 2026.
FDIC releases March enforcement actions
On April 28, the FDIC released a list of administrative enforcement actions taken against banks and individuals in March. The FDIC made public 11 orders including “four prohibition orders, three orders terminating deposit insurance, two consent orders, one order to pay civil money penalty (CMP), and one order terminating consent order.” Included is a civil money order issued against a Missouri-based bank related to alleged violations of the Flood Disaster Protection Act (FDPA). The FDIC determined that the bank had engaged in a pattern or practice of violating the FDPA by increasing, extending, or renewing a loan secured by property located or to be located in a special flood hazard area without timely notifying the borrower and/or the servicer as to whether flood insurance was available for the collateral.