InfoBytes Blog

Buckley Sandler Insights: Fed's LFI Risk Management Principles Open for Comments

On January 4, the Federal Reserve (Fed) issued for public comment proposed guidance setting forth core principles of effective risk management for Large Financial Institutions (“LFI”s) (“Risk Management proposal”). Given that it is increasingly likely that Congress will release financial institutions with assets below $250 billion from “SIFI” designation, the Fed’s guidance yesterday is a further effort to ensure that risk at LFIs will continue to be managed well even after many of them are no longer subject to other SIFI obligations. The proposal would apply to domestic bank holding companies and savings and loan holding companies with total consolidated assets of $50 billion or more; the U.S. operations of foreign banking organizations (“FBOs”) with combined U.S. assets of $50 billion or more; and any state member bank subsidiary of these institutions. The proposal would also apply to any systemically important nonbank financial company designated by the Financial Stability Oversight Council (“FSOC”) for Fed supervision. The proposed guidance clarifies the Fed’s supervisory expectations of these institutions’ core principals with respect to effective senior management; the management of business lines; and independent risk management (“IRM”) and controls.

The Risk Management proposal is part of the Fed’s broader initiative to develop a supervisory rating system and related guidance that would align its consolidated supervisory framework for LFIs. Last August, the Fed issued for public comment two related proposals: a new rating system for LFIs (“proposed LFI rating system”) and guidance addressing supervisory expectations for board directors (“Board Expectations proposal”). (See previous InfoBytes coverage on the proposals.) The proposed LFI rating system is designed to evaluate LFIs on whether they possess sufficient financial and operational strength and resilience to maintain safe and sound operations through a range of conditions. With regard to the Board Expectations proposal, the January 4 proposal establishes supervisory expectations relevant to the assessment of a firm’s governance and controls, which consists of three chief components: (i) effectiveness of a firm’s board of directors, (ii) management of business lines, independent risk management and controls, and (iii) recovery planning. This guidance sets forth the Fed’s expectations for LFIs with respect to the second component—the management of business lines and IRM and controls, and builds on previous supervisory guidance. In general, the proposal “is intended to consolidate and clarify the [Fed’s] existing supervisory expectations regarding risk management.”

The January 4 release delineates the roles and responsibilities for individuals and functions related to risk management. Accordingly, it is organized in three parts: (i) core principals of effective senior management; (ii) core principals of the management of business lines; and (iii) core principles of IRM and controls.

Senior Management

The Risk Management proposal defines senior management as “the core group of individuals directly accountable to the board of directors for the sound and prudent day-to-day management of the firm.” Two key responsibilities of senior management are overseeing the activities of the firm’s business lines and the firm’s IRM and system of internal control. The proposed guidance highlights the principle that: Senior management is responsible for managing the day-to-day operations of the firm and ensuring safety and soundness and compliance with internal policies and procedures, laws and regulations, including those related to consumer protection.

Management of Business Lines

The proposal refers to “business line management” as the core group of individuals responsible for prudent day-to-day management of a business line and accountable to senior management for that responsibility. For LFIs that are not subject to supervision by the Large Institution Supervision Coordinating Committee (“LISCC”) these expectations would apply to any business line where a significant control disruption, failure, or loss event could result in a material loss of revenue, profit, or franchise value, or result in significant consumer harm.

A firm’s business line management should:

• Execute business line activities consistent with the firm’s strategy and risk tolerance.
• Identify, measure, and manage the risks associated with the business activities under a broad range of conditions, incorporating input from IRM.
• Provide a business line with the resources and infrastructure sufficient to manage the business line’s activities in a safe and sound manner, and in compliance with applicable laws and regulations, including those related to consumer protection, as well as policies, procedures, and limits.
• Ensure that the internal control system is effective for the business line operations.
• Be held accountable, with business line staff, for operating within established policies and guidelines, and acting in accordance with applicable laws, regulations, and supervisory guidance, including those related to consumer protection.

Independent Risk Management and Controls

The Risk Management proposal describes core principles of a firm’s independent risk management function, system of internal control, and internal audit function. The guidance does not prescribe in detail the governance structure for a firm’s IRM and controls. While the guidance does not dictate specifics regarding governance structure, it does set forth requirements with respect to the roles of the Chief Risk Officer and Chief Audit Executive:

• The CRO should establish and maintain IRM that is appropriate for the size, complexity, and risk profile of the firm.
• The Chief Audit Executive should have clear roles and responsibilities to establish and maintain an internal audit function that is appropriate for the size, complexity and risk profile of the firm.

The proposal requires that a firm’s IRM function be sufficient to provide an objective, critical assessment of risks and evaluates whether a firm remains aligned with its stated risk tolerance. Specifically, a firm’s IRM function should:

• Evaluate whether the firm’s risk tolerance appropriately captures the firm’s material risks and confirm that the risk tolerance is consistent with the capacity of the risk management framework.
• Establish enterprise-wide risk limits consistent with the firm’s risk tolerance and monitor adherence to such limits.
• Identify and measure the firm’s risks.
• Aggregate risks and provide an independent assessment of the firm’s risk profile.
• Provide the board and senior management with risk reports that accurately and concisely convey relevant, material risk data and assessments in a timely manner.

With regard to internal controls, the proposed guidance builds upon the expectations described in the Fed’s Supervisory Letter 12-17. A firm should have a system of internal control to guide practices, provide appropriate checks and balances, and confirm quality of operations. In particular, the guidance states that a firm should:

• Identify its system of internal control and demonstrate that it is commensurate with the firm’s size, scope of operations, activities, risk profile, strategy, and risk tolerance, and consistent with all applicable laws and regulations, including those related to consumer protection.
• Regularly evaluate and test the effectiveness of internal controls, and monitor functioning of controls so that deficiencies are identified and communicated in a timely manner.

With respect to internal audit, the proposed guidance does not expand upon the Fed’s expectations; rather it references existing supervisory expectations. The proposed guidance highlights that a firm should adhere to the underlying principle that its internal audit function should examine, evaluate, and perform independent assessments of the firm’s risk management and internal control systems and report findings to senior management and the firm’s audit committee.

Comments on the Fed’s proposed guidance are due by March 15.

Agency Rule-Making & Guidance Federal Reserve Risk Management LFI SIFIs Bank Regulatory Bank Supervision

VA Clarifies Third-Party Verification Requirements

On December 29, the Department of Veterans Affairs (VA) issued Circular 26-17-43 to clarify its policy that lenders may use third-party vendors to verify borrower income, employment, and asset information subject to the following caveats: (i) lenders must retain full responsibility for verifying the accuracy of information provided in the borrower’s loan application; (ii) lenders must initiate and receive all verifications related to employment and deposits, credit report requests, and credit information; (iii) lenders must assume responsibility for the quality and accuracy of information provided to the VA collected from third-parties; (iv) lenders must disclose the third party vendor relationships on VA form 26-1820, Report and Certification of Loan Disbursement, and (v) lenders must not charge veterans for the cost of obtaining third-party verification of borrower income, employment, or asset information. Where a real estate broker/agent or any other party requests borrower income, employment, or asset information, lenders must (i) identify the parties as their agents, (ii) ensure that report(s) are returned directly to them, and (iii) ensure completion of the required certification on the loan application. 

Agency Rule-Making & Guidance Department of Veterans Affairs Third-Party Underwriting

Buckley Sandler Insights: OMB releases updated and possibly outdated CFPB rulemaking agenda

OMB has released the CFPB’s Fall 2017 rulemaking agenda. Although this is the first update to the agenda since Richard Cordray left the agency in November 2017, delays in the publication of rulemaking agendas are common so the updated agenda may not reflect the views of new CFPB leadership. The updated agenda does not appear on the Bureau’s website. Further:

• HMDA & ECOA Amendments: The updated agenda states that the Bureau planned to determine by December 2018 whether to make permanent adjustments to the threshold for reporting open-end lines of credit. However, as discussed in greater detail here, the CFPB stated on December 21 that it intended to engage in a broader rulemaking to (i) re-examine the criteria determining whether institutions are required to report data; (ii) adjust the requirements related to reporting certain types of transactions; and (iii) re-evaluate the required reporting of additional information beyond the data points required by the Dodd-Frank Act.

• Prepaid Cards: The updated agenda states that the CFPB expected to finalize amendments to its rule on prepaid cards in November 2017, but no final amendments have been issued. Instead, on December 21, the CFPB announced its intent to adopt final amendments “soon after the new year” and stated that it expects to extend the April 1, 2018 effective date to allow more time for implementation.

• Debt Collection: The updated agenda states that the CFPB expects to issue a proposed rule in February 2018 “concerning FDCPA collectors’ communications practices and consumer disclosures.” However, on December 14, OMB announced that the CFPB had withdrawn its planned survey regarding debt collection disclosures because “Bureau leadership would like to reconsider the information collection in connection with its review of the ongoing related rulemaking.”

See previous InfoBytes coverage on the HMDA, Prepaid, and Debt Collection rulemaking updates.

Other noteworthy aspects of the updated agenda include:

• Regulation Reviews: The updated agenda reiterates the Bureau’s intent to review the regulations inherited from other agencies and “clarify ambiguities, address developments in the marketplace, and modernize or streamline regulatory provisions.” The updated agenda lists “pre-rule activities” as continuing through February 2018, rather than September 2017 under the prior agenda.

• “Larger Participants” in Installment Lending: Consistent with the prior agenda, the CFPB states that it is preparing a proposed rule to define the “larger participants” in the personal loan market (including consumer installment loans and vehicle title loans) that will be subject to Bureau examinations. The updated agenda also states that the Bureau is still considering “whether rules to require registration of these or other non-depository lenders would facilitate supervision, as has been suggested to the Bureau by both consumer advocates and industry groups.” However, while the prior agenda indicated that a proposal was expected in September 2017, the new agenda lists May 2018.

• Overdrafts: The updated agenda states only that the CFPB is “continuing to engage in additional research and consumer testing initiatives relating to the opt-in process” for overdraft protection and that “pre-rule activities” will continue through this month.  Under the prior agenda, pre-rule activities were scheduled to continue through June 2017.

• Small Business Lending: The agenda indicates that the long-delayed implementation of the small business data reporting provisions of the Dodd-Frank Act will be delayed even longer. The last agenda listed “pre-rule activities” as continuing through June 2017, stating that the CFPB “is focusing on outreach and research to develop its understanding of the players, products, and practices in the small business lending market and of the potential ways to implement section 1071.” The new agenda states that these activities will continue until May 2018, after which the Bureau “expects to begin developing proposed regulations concerning the data to be collected, potential ways to minimize burdens on lenders, and appropriate procedures and privacy protections needed for information-gathering and public disclosure.”

• TRID/Know Before You Owe Amendments: The updated agenda lists April 2018 as the expected release date for finalization of the July 2017 proposed rule addressing the “black hole” issue, which is discussed in a Buckley Sandler Special Alert. The prior agenda listed March 2018.

• Mortgage Servicing Amendments: In October 2017, the CFPB issued proposed amendments to the mortgage periodic statement requirements to further address circumstances in which servicers transition between modified and unmodified statements in connection with a consumer’s bankruptcy case. The updated agenda does not provide an expected release date for final amendments.

• Credit Card Agreement Submission: The agenda continues to state that the Bureau is considering rules to modernize its database of credit card agreements to reduce the submission burden on issuers and to make the database more useful for consumers and the general public. The agenda lists “pre-rule activities” as continuing through February 2018. Under the prior agenda, pre-rule activities were scheduled to continue through October 2017.

Agency Rule-Making & Guidance CFPB HMDA ECOA Prepaid Cards Debt Collection Installment Loans Overdraft Small Business Lending TRID Mortgage Servicing Credit Cards

Agencies Release CRA Asset-Size Threshold Adjustments

On December 21, the Federal Reserve, the OCC, and the FDIC (collectively, the “Agencies”) jointly announced the adjusted thresholds for asset-size used to define “small” and “intermediate small” banks and savings associations under the Community Reinvestment Act (CRA). Effective January 1, 2018, a small bank or savings association will be defined as an institution that, as of December 31 of either of the past two calendar years, had assets of less than $1.252 billion. Additionally, an “intermediate small” bank or “intermediate small” savings association will be defined as an institution with at least $313 million and less than $1.252 billion in assets as of December 31 of either of the past two calendar years. The agencies published the annual adjustments in the Federal Register on December 27.

Agency Rule-Making & Guidance CRA OCC Federal Reserve FDIC Federal Register

Federal Reserve Issues Final Rules Reflecting Credit and Interest Rate Increases

On December 20, the Federal Reserve Board (Fed) issued a final rule amending Regulation A (Extensions of Credit by Federal Reserve Banks) to reflect its December 13 approval of a one-quarter percent increase in the primary credit rate at each Federal Reserve Bank. Additionally, because the formula for the secondary credit rate references the primary rate, the secondary credit rate also increased by one-quarter percentage point. The rate changes took effect on December 14, and the final rule became effective on December 20.

The same day, the Fed also issued a final rule amending Regulation D (Reserve Requirements of Depository Institutions) to reflect its December 13 approval of a one-quarter percent increase to the “rate of interest paid on balances maintained to satisfy reserve balance requirements (“IORR”) and the rate of interest paid on excess balances (“IOER”) maintained at Federal Reserve Banks by or on behalf of eligible institutions.” The rate changes took effect on December 14, and the final rule became effective on December 20.

Agency Rule-Making & Guidance Federal Reserve Regulation A Regulation D Federal Register

Federal Reserve Repeals Reg C and Amends Reg M to Reflect CFPB Rulemaking Authority

The Federal Reserve Board (Fed) issued a final rule on December 22 to repeal Regulation C, Home Mortgage Disclosure (HMDA), and a proposed rule to amend Regulation M, Consumer Leasing Act (CLA) to reflect the transfer of certain rulemaking authority to the CFPB. Regulation C is being repealed because the CFPB has issued its own final HMDA rules (previously covered by InfoBytes here) that supersede the Fed’s version. The proposed amendments to Regulation M implement the Dodd-Frank Act’s provisions on transferring CLA rulemaking authority to the CFPB, with the exception of retaining the Fed’s authority to issue rules for motor vehicle dealers that are predominantly engaged in the sale/leasing and servicing of motor vehicles and are not otherwise subject to the CFPB’s regulatory authority.

The repeal of Regulation C is effective 30 days after publication in the Federal Register. Comments on the proposed amendments to Regulation M are due by March 5, 2018.

Agency Rule-Making & Guidance Federal Reserve Regulation C Consumer Leasing Act

FCC Votes to Overturn Net Neutrality Rules

On December 14, the FCC voted 3-2 to overturn the 2015 Open Internet Order rules (known as, “Net Neutrality” rules) which mandate that internet service providers (ISPs) treat all web content equally. The FCC released a draft order in November, which outlined the new framework for ISPs, including removing the restrictions barring the providers from slowing down or speeding up web traffic based on business relationships. ISPs are now required to publicly disclose information about their practices including any paid or affiliated prioritization of web content. The FCC places the enforcement authority of the new regulatory framework with the FTC. The order is effective upon OMB approval of the new requirements for ISP public disclosures.

Agency Rule-Making & Guidance FCC Privacy/Cyber Risk & Data Security FTC Net Neutrality

Department of Defense Updates MLA Interpretive Guidance; Addresses Timing for Safe Harbor Qualification

The Department of Defense (DoD) published a new interpretive rule (rule) under the Military Lending Act (MLA) on December 14.  This interpretive rule takes effect immediately, and it both amends and adds to the interpretive rule issued by DoD in August 2016 (previously covered by a Buckley Special Alert). In general, the rule contains the following updated interpretations:

• Exemption of Credit Secured by a Motor Vehicle or Personal Property. The rule provides additional guidance on the exemption covering purchase money-secured motor vehicle and personal property loans. Specifically, the rule states that additional costs may be added to an extension of credit so long as these costs relate to the object securing the credit, and not the extension of credit itself. For example, the rule explains that credit used to finance “optional leather seats,” “an extended warranty,” or “negative equity” in connection with the purchase of a motor vehicle will not cause the loan to be subject to the MLA.  However, the rule also states that, if credit is extended to cover “Guaranteed Auto Protection insurance or a credit insurance premium” or additional “cashout,” the loan is not eligible for the MLA exception.

• Security Interests in Covered Borrowers’ Accounts.  The rule addresses the ability of a creditor to take a security interest in a covered borrower’s account. Specifically, the rule states that a covered borrower may “convey security interest for all types of consumer credit” to a creditor, so long as the creditor complies with all other laws and the MLA rule.  Similarly, the rule notes that the MLA does not prohibit a creditor from exercising rights to take an otherwise-valid statutory lien on funds that have been deposited into a covered borrower’s account “at any time.”  However, the rule also emphasizes methods a creditor may not use to obtain payment from a covered borrower’s account, such as a “remotely created check.”

• Timing for Safe Harbor Qualification.  The rule provides additional clarity on when a creditor must check an applicant’s active duty status to obtain the MLA’s safe harbor. The rule states that an applicant’s covered borrower status should be determined when the applicant (i) initiates the transaction, (ii) submits an application to establish an account or during the processing of that application, or (iii) anytime during a 30-day period of time prior to such action.  In addition, the rule states that a covered borrower check can qualify for the safe harbor if it is performed “during the course of the creditor’s processing of that application for consumer credit.”

Agency Rule-Making & Guidance Department of Defense Military Lending Act Auto Finance

Federal Reserve Requests Comments on Proposals Seeking Transparency Increases in Stress Testing Programs

The Federal Reserve Board (Fed) issued a request for comments on three proposals designed to increase stress testing transparency while also testing the resiliency of large, complex banks. Earlier in June, Fed Chair Janet Yellen underscored the Fed’s understanding of the need to provide transparency in its Comprehensive Capital Analysis and Review (CCAR) process and stress test scenarios. (See previous InfoBytes coverage here.) The first December 7 proposal, “Enhanced Disclosure of the Models Used in the Federal Reserve’s Supervisory Stress Test,” announces the Fed’s plans to publicly release, for the first time, information concerning the models and methodologies used during supervisory stress tests, including those applied in the CCAR, including:

• “enhanced descriptions of supervisory models, including key variables;”
• “modeled loss rates on loans grouped by important risk characteristics and summary statistics associated with the loans in each group;” and,
• “portfolios of hypothetical loans and the estimated loss rates associated with the loans in each portfolio.”

The information will offer banks expanded details as to how the Fed’s models treat different types of loans under stress, along with insight into the determination of annual stress test results.

The second request for comments concerns the “Stress Testing Policy Statement,” which elaborates on prior disclosures and outlines details on the principles and policies that govern the Fed’s development, implementation, and validation of its stress testing models.

Finally, the Fed issued a proposed policy statement to request comments on introduced amendments to the design of its annual hypothetical economic scenarios framework. The “Amendments to Policy Statement on the Scenario Design Framework for Stress Testing” is intended to enhance transparency and provide clarification on hypothetical economic scenarios, including the direction of housing prices, as well as the Fed’s commitment to exploring additional variables to test for funding risks.

All comments must be received by January 22, 2018.

Agency Rule-Making & Guidance Federal Issues Federal Reserve Stress Test CCAR

CFPB Updates Guide to TRID Forms

On December 6, the CFPB published an updated version of the TILA-RESPA Integrated Disclosure Guide to the Loan Estimate and Closing Disclosure Forms. The updated guide reflects the amendments issued by the CFPB on July 7 of this year (previously covered by a Buckley Sandler Special Alert). These include changes resolving a number of significant ambiguities that generated concerns about the liability of lenders and purchasers of mortgage loans.

Agency Rule-Making & Guidance CFPB TRID TILA RESPA