InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
OCC warns of key cybersecurity and climate-related banking risks
On December 6, the OCC reported in its Semiannual Risk Perspective for Fall 2021 the key issues facing national banks and federal savings associations and the effects of Covid-19 on the federal banking industry. The agency reported that although banks showed resilience in the current environment with satisfactory credit quality and strong earnings, weak loan demand and low net interest margins continue to affect performance.
The OCC identified elevated operational risk as banks continue to face increasingly complex cyberattacks, pointing to an increase in ransomware attacks across financial services. While innovation and technological advances can help counter such risks, the OCC warned they also come with additional concerns given the expansion of remote financial services offered through personally owned computers and mobile devices, remote work options due to the Covid-19 pandemic, and the reliance on third-party providers and cloud-based environments. “The adoption of innovative technologies to facilitate financial services can offer many benefits to both banks and their customers,” the report stated. “However, innovation may present risks. Risk management and control environments should keep pace with innovation and emerging trends and a comprehensive understanding of risk should be achieved to preserve effective controls. Examiners will continue to assess how banks are managing risks related to changes in operating environments driven by innovative products, services, and delivery channels.”
The report calls on banks to “adopt robust threat and vulnerability monitoring processes and implement stringent and adaptive security measures such as multi-factor authentication or equivalent controls” to mitigate against cyber risks, adding that critical systems and records must be backed up and stored in “immutable formats that are isolated from ransomware or other destructive malware attacks.”
The report further highlighted heightened compliance risks associated with the changing environment where banks serve consumers in the end stages of various assistance programs, such as the CARES Act’s PPP program and federal, state, and bank-initiated forbearance and deferred payment programs, which create “increased compliance responsibilities, high transaction volumes, and new types of fraud.”
The report also discussed credit risks, strategic risk challenges facing community banks, and climate-related financial risks. The OCC stated it intends to request comments on its yet-to-be-published climate risk management framework for large banks (covered by InfoBytes here) and will “develop more detailed expectations by risk area” in 2022.
FHA extends partial waiver of face-to-face borrower interviews
On December 2, FHA announced an extension to its temporary partial waiver of the face-to-face borrower interviews with borrowers as part of FHA’s early default intervention requirements under 24 C.F.R. § 203.604. The waiver was first published in March 2020 in response to the Covid-19 pandemic (covered by InfoBytes here). The temporary waiver, now effective through December 31, 2022, allows mortgagees to establish contact with borrowers by alternative methods, such as phone, email, or video calling services.
District Court says bank’s arbitration clauses apply to PPP loans
On November 23, the U.S. District Court for the District of New Jersey granted a national bank’s motion to compel arbitration in an action concerning the bank’s alleged mishandling of Paycheck Protection Plan (PPP) loan applications. The plaintiff filed a lawsuit claiming the bank’s PPP loan disbursement process allegedly favored wealthy clients over smaller, less wealthy clients to maximize the bank’s origination fees. The plaintiff alleged that because the bank did not process applications on a “first-come, first-served” basis, the plaintiff did not receive its PPP loan in a timely manner. The bank moved to compel arbitration, “arguing that questions of arbitrability are for the arbitrator to decide in the first instance.” The plaintiff argued that the arbitration clauses in the bank’s agreements applied only to disputes regarding bank deposit accounts, and not to other financial products such as PPP loans. The court stayed the case and granted the bank’s motion to compel arbitration, noting that the bank’s deposit account agreement and online services agreement both include arbitration clauses. These clauses, the court stated, are “clear evidence” that the bank intended an arbitrator to decide questions related to scope. “Accordingly, Plaintiff must bring its claim before the arbitrator in the first instance, even if it contests the scope of arbitrability,” the court wrote.
District Court dismisses PPP putative class action against nonbank
On November 24, the U.S. District Court for the Central District of California dismissed, with prejudice, a putative class action alleging that a nonbank lender prioritized high-dollar Paycheck Protection Program (PPP) loan applicants. The plaintiff’s complaint—which alleged claims of fraudulent concealment, fraudulent deceit, unfair business practices, and false advertising—claimed, among other things, that the lender (i) was not licensed to make loans in California when she applied; (ii) did not have adequate funding to make the loans; and (iii) advertised it would process loan requests on a first-come, first-served basis, but actually prioritized favored customers and higher-value loans that yielded higher lending fees. The court granted the lender’s motion to dismiss. According to the court, the plaintiff’s allegation that the parties were “transacting business in order to enter into a contractual, borrower-lender relationship” was not supported by any facts, and that while the plaintiff claimed she submitted a PPP loan application to the lender, a confirmation e-mail from the lender did not mention a submitted application—only a loan request. “This court cannot, therefore, assume the truth of Plaintiff’s allegation that she submitted a loan application, let alone her conclusory allegation that the parties entered into a borrower-lender relationship or engaged in any other transaction,” the court stated. The court also determined that the plaintiff’s fraudulent deceit claim failed because her allegation, made on information and belief, that the lender prioritized large loans had no factual foundation, and the plaintiff failed to plead the elements of that claim.
CFPB releases draft strategic plan for FY 2022-26
On December 2, the CFPB released for public feedback its draft strategic plan for fiscal years 2022-2026, which outlines and communicates its mission, strategic goals, and objectives for the next five years.
External Factors Impacting the Bureau’s Strategic Goals and Objectives:
The Bureau identified four key external factors that may affect its strategic goals and objectives: (i) the continued effect of the Covid-19 pandemic on regulated markets; (ii) the increase of data security threats and resulting consumer harm as the role of data and technology in the consumer financial system continues to grow; (iii) rapid developments in the consumer financial marketplace technology; and (iv) executive, legislative, judicial, and state actions, including actions by other financial regulators, which may impact the financial regulatory environment and, in turn, the Bureau’s policy strategies.
Cross-Bureau Priorities:
With its “cross-functional, cross-Bureau approach,” the CFPB intends to address a number of outcomes for households and communities, “many of which reference the concept of equity.” To achieve the outcomes below, the Bureau will “embed a racial equity lens and focus [its] attention on these communities, recognizing that work to protect and empower underserved people benefits all people.”
- Equitable recovery from the COVID-19 pandemic: Continuing monitoring of pandemic recovery, with a focus on minority and traditionally underserved communities, including rising housing insecurity.
- Equitable access to and engagement with consumer finance infrastructure: Addressing obstacles that restrict access to credit or push consumers to higher cost products, in addition to “promoting transformation of financial marketplaces to serve all people.”
- Equitable wealth creation from home and small business ownership: Promoting equitable wealth creation in housing and small business markets, with a focus on minority and underserved communities. Specifically, the Bureau notes that (i) home ownership as a “key building block of wealth,” has become out of reach for young people and underserved communities due to record high home prices and tightened credit underwriting during the pandemic; and (ii) small businesses, especially women- and minority-owned, have faced more serve economic consequences from the pandemic.
- Fair, transparent, and competitive markets for consumer financial products and services: Promoting competition for the benefit of consumers and businesses, where “[t]he personal touch previously provided by local financial institutions has, in many instances, been replaced with institutions that take advantage of consumers without concern for their well-being.” The Bureau identified weakened competition in many markets as a contributing factor in the widening of racial, income, and wealth inequality, and noted that consolidations over the last several decades have “denied consumers the benefits of an open economy.”
- Privacy, access, and fairness in a new data-driven economy: Prioritizing its work to ensure consumer privacy and security remains at the forefront of the evolving data economy. The Bureau expressed specific concern with how consumer financial account data is accessed, transmitted, and stored, in addition to the potential racial equity impact from the increased use of algorithms in the decision-making process.
The Strategic Goals:
The Bureau identified four strategic goals, which are articulated by specific function within the agency:
- “Implement and enforce the law to ensure consumers have access to fair, transparent, and competitive markets that serve consumers’ needs and protect consumers from unfair, deceptive, and abusive practices, and from discrimination.” Objectives include issuing rules and guidance, supervising institutions, and enforcing federal consumer financial laws.
- “Empower consumers to live better financial lives, focusing on traditionally underserved people.” Objectives include engaging with consumers, creating and offering educational resources, handling complaints, and expanding relationships with stakeholders and government partners.
- “Inform public policy with data-driven analysis on consumers’ experiences with financial institutions, products, and services.” Objectives include monitoring markets and producing research reports.
- “Foster operational excellence and further commitment to workforce equity to advance the CFPB’s mission.” Objectives include cultivating a workforce aligned with the Bureau’s mission, implementing a forward-leaning workplace model, and utilizing innovative and optimized operational support.
The Bureau is requesting comments by January 3, 2022.
SBA updates Covid-19 EIDL guidance
On November 19, the Small Business Administration (SBA) announced updated guidance for Covid-19 Economic Injury Disaster Loan (EIDL) program applicants while funding remains available. The updated guidance provided that (i) the deadline to submit EIDL loans and targeted advance applications will be December 31 (loans will continued to be processed after this date until funds are depleted); (ii) supplemental targeted advance applications will also be accepted through December 31, however SBA noted that it may not be able to process applications submitted near the deadline due to legal requirements (SBA encouraged applicants to apply by December 10 to allow for adequate processing time); (iii) borrowers may request increases “up to their maximum eligible loan amount for up to two years after their loan origination date, or until the funds are exhausted, whichever is soonest”; and (iv) appeal requests for Covid-19 EIDL applications that are received on or before December 31 will be accepted and reviewed provided they are received within the regulation’s timeframes (i.e., “six months from the date of decline for reconsiderations and 30 days from the date of reconsideration decline for appeals—unless funding is no longer available”). SBA further directed applicants to review enhancements made to the EIDL program in September.
Fannie updates Covid-19 payment deferral provisions
On November 17, Fannie Mae reissued LL-2021-07 to provide updated requirements for servicers when evaluating a borrower for a Covid-19 payment deferral offer. The updated lender letter was originally published in November 2020 and updated in February 2021 (covered by InfoBytes here). Specifically, the revisions update requirements related to performing an escrow analysis, and require single-family servicers to: (i) perform an escrow analysis when evaluating borrower for Covid-19 payment deferrals; (ii) “inform the borrower of the full monthly contractual payment based on repayment of any escrow shortage amount over a term of 60 months before the borrower can accept the COVID-19 payment deferral offer”; and (iii) “spread any escrow shortage repayment amount in equal monthly payments over a period of 60 months, unless the borrower decides to pay the escrow shortage amount in a lump sum up-front or over a shorter period (not less than 12 months) for a COVID-19 payment deferral or a Flex Modification for COVID-19 impacted borrowers.” Changes apply to a Fannie Mae Flex Modification and a Disaster Payment Deferral and will be incorporated into the Servicing Guide in February 2022. The provisions in the lender letter are effective until further notice. Fannie Mae encourages servicers to implement these policy changes immediately but no later than March 1, 2022.
5th Circuit stays OSHA mandate
On November 12, the U.S. Court of Appeals for the Fifth Circuit issued a nationwide stay on the emergency temporary standard (ETS), which mandates that all employers with 100 or more employees require employees to be fully vaccinated or be subject to a weekly Covid-19 test. As previously covered by InfoBytes, the U.S. Department of Labor’s Occupational Safety and Health Administration (OSHA) published a rule in the Federal Register requiring employers to develop, implement, and enforce a mandatory Covid-19 vaccination policy, unless they adopt a policy requiring employees to choose between vaccination or regular testing for Covid-19 and wearing a face covering at work. The 5th Circuit stay, which was in response to a legal challenge filed by several states along with private entities and individuals, affirmed the court’s initial stay. According to the appellate opinion, OSHA’s enforcement of this ETS is illegitimate, calling it “unlawful” and “likely unconstitutional.” Furthermore, the 5th Circuit ordered OSHA to “take no steps to implement or enforce the Mandate until further court order.”
Agencies end Covid mortgage servicing flexibility
On November 10, the OCC, Federal Reserve Board, CFPB, FDIC, NCUA, and state financial regulators issued a joint statement announcing the end to temporary supervisory and enforcement flexibility provided to mortgage servicers due to the Covid-19 pandemic by the agencies’ April 3, 2020 joint statement. As previously covered by InfoBytes, the April 2020 joint statement provided mortgage servicers greater flexibility to provide CARES Act forbearance of up to 180 days and other short-term options upon the request of borrowers with federally backed mortgages without having to adhere to otherwise applicable rules. The April 2020 joint statement also announced that agencies would not take supervisory or enforcement action against mortgage servicers for failing to meet certain timing requirements under the mortgage servicing rules provided that servicers made good faith efforts to provide required notices or disclosures and took related actions within a reasonable time period.
The agencies noted in their announcement that while the pandemic continues to affect consumers and mortgage servicers, servicers have had sufficient time to take measures to assist impacted consumers and develop more robust business continuity and remote work capabilities. Accordingly, the agencies “will apply their respective supervisory and enforcement authorities, when appropriate, to address any noncompliance or violations of the Regulation X mortgage servicing rules that occur after the date of this statement.” However, the agencies will take into consideration, when appropriate, “the specific impact of servicers’ challenges that arise due to the COVID-19 pandemic and take those issues in account when considering any supervisory and enforcement actions,” including factoring in the time it may take “to make operational adjustments in connection with this joint statement.”
The same day, the Bureau released a report titled Mortgage Servicing Efforts in Response to the Covid-19 Pandemic, summarizing efforts taken by the Bureau since the start of the pandemic to respond to the evolving needs of homeowners and CFPB-supervised entities. These responses include: (i) conducting prioritized assessments and targeted supervisory reviews; (ii) issuing reminders to servicers that being “unprepared is unacceptable”; (iii) implementing temporary procedural safeguards to allow borrowers time to explore options before foreclosure; (vi) analyzing consumer complaint data and conducting targeted reviews of high-risk complaints related to pandemic forbearances; (v) analyzing and releasing information relating to mortgage servicers’ pandemic responses; (vi) documenting research on the pandemic’s disproportionate impact on Black, Hispanic, and low-income communities; and (vii) partnering with other federal agencies to create online tools to provide information on CARES Act assistance and protections, as well as providing homeowner outreach materials. The Bureau noted it “will continue to monitor closely the performance of mortgage servicers to prevent avoidable foreclosures to the maximum extent possible and will not hesitate to take supervisory or enforcement action if warranted.”
Dept. of Labor issues ETS on employer vaccinations
On November 5, the U.S. Department of Labor’s Occupational Safety and Health Administration (OSHA) published a rule in the Federal Register requiring employers to develop, implement and enforce a mandatory Covid-19 vaccination policy, unless they adopt a policy requiring employees to choose between vaccination or regular testing for Covid-19 and wearing a face covering at work. The emergency temporary standard (ETS) is for “employers with 100 or more employees—firm or company-wide,” which covers two-thirds of the nation's private-sector workforce. According to OSHA’s press release, the ETS requires employers to: (i) give paid time to workers to get vaccinated; (ii) permit paid leave for employees recovering from side effects; (iii) determine the vaccination status of each employee; (iv) acquire proof of vaccination from each vaccinated employee; (v) maintain records on each employee’s vaccination status; (vi) ensure each employee who is not fully vaccinated is tested for Covid-19 at least once a week, in certain circumstance; (vii) require employees to provide prompt notice after receiving a positive Covid-19 test or diagnosis; and (viii) ensure that each employee who has not been fully vaccinated working indoors or when occupying a vehicle with another person, for work purposes, wears a face covering. The ETS is effective immediately and “employers must comply with most requirements within 30 days of publication and with testing requirements within 60 days of publication.”
The same day, the Biden administration released a fact sheet clarifying the details of OSHA’s mandate. Specifically, the fact sheet noted that though the testing requirement will not take effect until January 4, 2022, employers must be in compliance with all other requirements, such as “providing paid-time for employees to get vaccinated and masking for unvaccinated workers,” by December 5.