Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
Federal and state financial regulatory agencies issue joint statement on the effects of Hurricane Idalia on supervisory practices
On September 1, the FDIC, Fed, NCUA, OCC and CSBS issued a joint statement recognizing the serious impact of Hurricane Idalia on the customers and operations of many financial institutions in the effected area.
The guidance discusses the following aspects of financial institution operations:
- Lending: The agencies encourage financial institutions to work constructively with borrowers in affected communities, including prudent efforts to adjust existing loan terms, and declares that the agencies will not subject such efforts to examiner criticism. “The agencies recognize that efforts to work with borrowers in communities under stress can be consistent with safe-and-sound practices as well as in the public interest.”
- Temporary Facilities: The agencies understand that many financial institutions face staffing, power, telecommunications, and other challenges in re-opening facilities and will expedite, as appropriate, any request to operate in temporary facilities.
- Publishing Requirements: The agencies understand that the damage that the hurricane caused may affect compliance with publishing and other requirements for branch closings, relocations, and temporary facilities. Impacted institutions should contact their primary federal and/or state regulator.
- Regulatory Reporting Requirements: Impacted institutions that expect to encounter difficulty meeting the agencies' reporting requirements should contact their primary federal and/or state regulator to discuss their situation.
- Community Reinvestment Act: Financial institutions may receive CRA consideration for community development loans, investments or services that revitalize or stabilize federally designated disaster areas.
- Investments: The agencies encourage financial institutions to monitor municipal securities and loans affected by the hurricane, including those related to local government projects.
The Conference of State Bank Supervisors (CSBS) recently released a comprehensive framework for safeguarding sensitive information held at nonbank financial institutions. CSBS’s Nonbank Model Data Security Law is largely based on the FTC’s updated Safeguards Rule, which added specific criteria for financial institutions and other entities, such as mortgage brokers, motor vehicle dealers, and payday lenders, to undertake when conducting risk assessments and implementing information security programs. (Covered by InfoBytes here.) Adopting the Nonbank Model Data Security Law allows for a streamlined and efficient approach to data security regulations for nonbank financial institutions, CSBS explained, adding that by leveraging the existing Safeguards Rule’s applicability to state covered nonbanks, the model law imposes minimal additional compliance burdens and ensures smoother implementation for financial institutions. States can also choose an alternative approach by requiring nonbank financial institutions to conform to the Safeguards Rule, CSBS said.
The Nonbank Model Data Security Law outlines numerous provisions, which are intended to protect customer information, mitigate cyber threats, and foster a secure financial ecosystem. These include standards for safeguarding customer information, required elements that must be included in a nonbank financial institution’s information security program, and an optional section that requires entities to notify the commissioner in the wake of a security event. CSBS noted that because “the proposed rule on notification requirements for the FTC Safeguards Rule is still pending, the model law allows each state to establish their own customer threshold number, providing flexibility in determining the extent of impact that triggers the notification obligation.” CSBS also provided a list of resources for adopting the Nonbank Model Data Security Law.
On May 29, the Texas governor signed SB 895 (the “Act”) to enact the Money Services Modernization Act, the money transmitter model law created by industry and state experts. The goal of the Act is to create a set of consistent and coordinated standards relating to the regulation of money service businesses. Among other things, the Act outlines networked supervision criteria to allow the commissioner to participate in multistate supervisory processes coordinated through the Conference of State Bank Supervisors, the Money Transmitter Regulators Association, and other related affiliates and successors for all money services licenses that hold licenses in Texas and other states. To efficiently minimize regulatory burden, the commissioner may, among other things, coordinate and share information with other state and federal regulators, enter into information-sharing contracts or agreements, conduct joint examinations or investigations, and accept examination or investigation reports made by other states. Texas now joins several other states in adopting common licensing and regulatory standards to add efficiencies to the multi-state process (continuing InfoBytes coverage here).
Additionally, the commissioner has enforcement, examination, and supervision authority, may adopt implementing regulations, and may recover costs and fees associated with applications, examinations, investigations, and other related actions. The Act also includes additional consumer protection provisions. The Act includes in the definition of “money” or “monetary value” a stablecoin that “(i) is pegged to a sovereign currency; (ii) is fully backed by assets held in reserve; and (iii) grants a holder of the stablecoin the right to redeem the stablecoin for sovereign currency from the issuer.” Among the various exemptions, the Act provides for an exemption for an agent of the payee to collect and process a payment from a payor to the payee for goods or services, other than money transmission services. The amendments also outline numerous licensing application and renewal procedures including net worth, surety bond, and permissible investment requirements. The Act is effective September 1.
On April 4, the Tennessee governor signed HB 316 / SB 268 to enact the Money Transmission Modernization Act, the money transmitter model law created by industry and state experts. Provisions under the Act amend Tennessee Code Annotated, Title 45, and are intended to (i) reduce regulatory burden by promoting coordination among the states in areas of regulation, licensing, and supervision; (ii) protect the public from financial crime; (iii) standardize activities that are subject to, or otherwise exempt from, licensure; and (iv) modernize safety and soundness requirements to protect customer funds while supporting innovative and competitive business practices. Under the Act, persons may not engage in the business of money transmission, or advertise, solicit, or hold themselves out as providing money transmission without being licensed. In addition to exempting federal and state agencies and financial institutions organized under the laws of any state or the United States, the Act now exempts “authorized delegates”—persons designated by a licensee to engage in money transmission on behalf of the licensee, and persons that fall within an outlined exemption, including persons appointed as an agent of the payee.
The Act also provides the commissioner of financial institutions with the authority to exercise various powers, including the use of the Nationwide Multistate Licensing System and Registry, and the ability to participate in multistate supervisory processes coordinated through the Conference of State Bank Supervisors, Money Transmitter Regulator Association, and others for all licensees that hold licenses in Tennessee and other states. While retaining the ability to conduct examinations of licensees, the commissioner may now examine or investigate an authorized delegate. The Act also updates licensee liability requirements related to net worth assets and surety bonds and make various other changes related to audit reports and disclosure permissions. The Act further provides that “[a] person shall not engage in the business of money transmission on behalf of a person not licensed under this chapter or not exempt pursuant to § 45-7-104,” and stipulates that “[a] person that engages in such activity provides money transmission to the same extent as if the person were a licensee, and is jointly and severally liable with the unlicensed or nonexempt person.” The Act takes effect January 1, 2024.
On March 16, the Conference of State Bank Supervisors (CSBS), on behalf of the NMLS Policy Committee, issued a request for public comments on proposed uniform state licensing standards for mortgage companies. The Proposal: Mortgage Business-Specific Requirements would create a national standard for mortgage industry licensing to help improve uniformity within the state system and streamline the licensing process for mortgagees seeking licensure in multiple states.
The proposal is broken down into eight components:
- Contacts. All licensees will be required to provide contacts within the company for accounting, legal, licensing, data breach/cybersecurity, exam billing, exam delivery, and mortgage call reports, in addition to a primary company contact and a primary consumer complaint contact. If a licensee chooses to list a third-party contact, “the company will be deemed to have expressly authorized a state agency to contact the third party without further approval from the company” and “the company is ultimately responsible for the area of responsibility.”
- Periodic reporting. All licensees will be required to complete periodic reports covering mortgage call reports, audited financial statements, and reportable incidents.
- Data requirements. All licensees will be required to “provide numbers for any approvals or designations the company holds[,]” as well as business bank account information for accounts held in the name of the applicant and used for mortgage activities.
- Document requirements. Required documentation includes financial statements; policies and certifications; current Bank Secrecy Act/anti-money laundering and Gramm-Leach Bliley Privacy Act policies; current disaster recovery or business continuity plans; a current consumer grievance/complaint policy (as well as the required certification); and documents used in the regular course of business such as operating agreements, consumer complaint notices, customer agreements, and third-party contracts.
- Required functionality. All licensees must abide by a three-party electronic surety bond agreement in order to guarantee “the surety’s performance or monetary compensation to the obligee should there be a failure by the principal to perform specified acts within a stated time period.” The surety bond will be electronically managed by NMLS.
- Location reporting. All licenses will be required to provide locations where licensed activity will be performed, where records will be stored, or where support staff for licensed activities will be located. Licensees must also provide the primary location for accounting services, regardless of whether they are provided in house or by a third-party accounting firm, cloud storage services (including services used to collect data from customers), and the primary location for legal services, regardless of whether they are provided in house or by a third-party law firm.
- Company operated work locations’ information. The proposal outlines information required for each company operated work location, including business activities, licensing authorities, addresses, books and records information, and “doing business as” names.
- Key individual requirements. Licensees will be required to identify key individuals in the areas of management, ownership, functional risk areas, and industry specific roles. The proposal explains that the key individual inquiry focuses on key risk and functional areas (operations, finance, compliance, and information security), rather than titles. Key individuals for mortgages must also submit credit reports and complete an FBI criminal background check. Key individuals who have lived outside the United States at any time in the past 10 years must also provide an investigative background report.
Comments on the proposal are due May 15.
On February 14, the Conference of State Bank Supervisors commented that FinCEN should be more explicit in its inclusion of state regulators as agencies that can request access to FinCEN’s forthcoming secure, non-public beneficial ownership information database. (See comment letter here.) As previously covered by InfoBytes, last December FinCEN issued a notice of proposed rulemaking (NPRM) to implement provisions of the Corporate Transparency Act (CTA) that govern the access to and protection of beneficial ownership information (BOI). The NPRM proposed regulations for establishing who may request beneficial ownership information, how the information must be secured, and non-compliance penalties, and also addressed aspects of the database that are currently in development. Agreeing that the new database would help enhance anti-money laundering and countering the financing of terrorism standards and help prevent the use of privacy to hide illicit activity from law enforcement and government authorities, CSBS asked that the final rule “explicitly define state regulators so that there is no confusion about their ability to access BOI when examining state-chartered banks and non-depository trust companies for compliance with customer due diligence requirements under the Bank Secrecy Act (BSA).” According to CSBS, state regulators conducted over 1,200 BSA exams in 2021. CSBS further pointed out that being able request BOI on an as needed basis would aid investigative and enforcement responsibilities for both state-chartered banks and state-licensed nonbank financial services providers.
On December 13, the Conference of State Bank Supervisors (CSBS) announced that NYDFS Superintendent Adrienne A. Harris will serve as the state banking representative on the Financial Stability Oversight Council (FSOC). According to the announcement, in 2013, Superintendent Harris joined the Obama Administration as a Senior Advisor in the U.S. Department of Treasury prior to being appointed as the Special Assistant to the President for Economic Policy. In this role, she managed the financial services portfolio, focusing on the implementation of Dodd-Frank, and developed strategies for financial reform, consumer protections, cybersecurity and housing finance reform. According to James M. Cooper, president and CEO of CSBS, Harris’s “background and experience at both the federal and state level will be an asset for the council as it manages emerging risk during a time of economic uncertainty.”
On November 29, the Conference of State Bank Supervisors sent a letter to Senator Sherrod Brown (D-OH), Chairman of the Senate Banking Committee, and Rep. Pat Toomey (R-PA), Ranking Member of the House Financial Services Committee, to express their disappointment that none of the nominees to the FDIC Board of Directors have state bank supervisory experience. Last month, President Biden nominated Martin Gruenberg, who has been serving as acting chairman, to serve as chair and member of the board, and in September, Travis Hill and Jonathan McKernan were nominated to fill the board’s two vacant seats (covered by InfoBytes here and here). At the time of the announcement, CSBS President and CEO James M. Cooper issued a statement encouraging the U.S. Senate to ask nominees how they intend to work with state bank regulators. Cooper reiterated in his follow-up letter that the FDI Act requires that at least one board member have state bank supervisory experience, especially since having the Comptroller of the Currency seated on the board represents the interest of national banks. According to Cooper, fulfilling this statutory requirement “can only be met by a person who has worked in state government as a supervisor of state-chartered banks, and as the legislative history notes, [is] someone with ‘state bank regulatory expertise and sensitivity to the issues confronting the dual banking system.’” Cooper asked that the slate of nominees confirmed by the Senate includes at least one individual who fulfills this requirement.
The following day, during the Senate Banking Committee’s nomination hearing, Republican senators questioned Gruenberg’s role in a dispute between Democratic board members and former Chairwoman Jelena McWilliams related to a joint request for information seeking public comment on revisions to the FDIC’s framework for vetting proposed bank mergers. McWilliams eventually announced her resignation at the end of last year (covered by InfoBytes here). Senator Pat Toomey (R-PA) called Gruenberg’s participation in the dispute “very disturbing,” and expressed concerns that his actions, along with some of his colleagues, “really undermines the  FDIC and could have lasting implications.” Gruenberg countered that under the FDI Act, “the authority of the agency explicitly is vested in the board of directors, and the majority of the board has the authority to place items before the board.”
Some Republican senators also raised concerns with Gruenberg’s past involvement in Operation Choke Point, with Senator Steve Daines (R-MT) requesting that Gruenberg commit to actively preventing FDIC employees from “criticizing, discouraging or prohibiting banks from lending or doing business with any industries or customers that are operating in accordance with the law.” Gruenberg agreed to do so, saying this has been the FDIC’s policy. The FDIC’s current approach to cryptocurrency was also addressed, while Senator Cynthia Lummis (R-WY) took issue with the fact that none of the board nominees fulfill the Biden administration’s push for diversity and inclusion.
On November 14, President Biden announced his intention to nominate Martin Gruenberg to serve as chair and member of the FDIC Board of Directors. Following the resignation of the FDIC’s former chair, Jelena McWilliams (covered by InfoBytes here), Gruenberg has been acting chairman. Since joining the FDIC Board of Directors in 2005, Gruenberg has served as vice chairman, chairman, and acting chairman. Prior to joining the FDIC, Gruenberg served on the staff of the Senate Banking Housing and Urban Affairs Committee as Senior Counsel of the full Committee, and as staff director of the Subcommittee on International Finance and Monetary Policy.
CSBS President and CEO James M. Cooper issued a statement following the announcement: “Today’s announcement from the White House means that none of the nominees to the FDIC Board will meet the requirement for state bank supervisory experience. This requirement is not only the law but also a great benefit for consumers and the banking sector when the dual-banking system is fully represented on the FDIC Board. We encourage Senators, in their role in the confirmation process, to ask nominees how they will work with state bank regulators to benefit from their experience sitting closer to citizens and local economies.”
On October 20, the Conference of State Bank Supervisors (CSBS) announced that individuals and businesses in the mortgage, money transmission, debt collection, and consumer financial services industry are encouraged by state regulators to prepare for November 1, which is the beginning of the Nationwide Multistate Licensing System (NMLS) annual license renewal. The announcement noted the number of individual state licenses eligible for renewal is 13 percent higher than the same time last year, while the number of company licenses eligible for renewal is up 16 percent compared to this time last year. CSBS provided five tips for licensees to prepare for NMLS renewal, which include, among other things, resetting NMLS passwords to conform with new requirements that went into effect this past March and to review state-specific renewal requirements. CSBS also noted that the renewal period in most states runs from November 1 to December 31.