Trending publication
Nutter Bank Report, December 2017
Print PDFHeadlines
- Federal Banking Agencies Issue New Guidance for Banks Affected by a Major Disaster
- NIST Proposes Revised Draft of Updates to Cybersecurity Framework
- FDIC Publishes a History of the 2008 Financial Crisis and the Agency’s Response
- FinCEN Updates Answers to Frequently Asked Questions about BSA Compliance
- Other Developments: Fed HMDA Rule and Debt Collection Disclosures
Full Reports
1. Federal Banking Agencies Issue New Guidance for Banks Affected by a Major Disaster
The federal banking agencies have jointly issued new guidance on the supervisory practices to be followed in assessing the financial condition of banks affected by a disaster that results in the President declaring an area a major disaster with individual assistance. The guidance, issued on December 15 in consultation with the Conference of State Bank Supervisors, clarifies that the agencies will work with banks affected by a major disaster, including banks that may be located outside the disaster area but that have loans or investments located in the disaster area, to determine their needs, reschedule any examinations, consider extensions for filing quarterly Call Reports or other reports, and address capital declines due to temporary deposit growth, as needed. According to the guidance, examiners will consider the extent to which weaknesses in a bank’s financial condition are caused by external problems related to the major disaster and its aftermath. The guidance explains that areas declared a major disaster with individual assistance by the President generally experience extensive damage that will continue to affect the business activities of the institutions serving that area for an extended period of time. Click here for a copy of the new supervisory guidance.
Nutter Notes: The new supervisory guidance directs bank examiners to be flexible in carrying out their supervisory role after considering the unique and potential long-term nature of the issues confronting banks affected by a major disaster. According to the guidance, when evaluating the composite and component ratings for the Uniform Financial Institutions Rating System (commonly referred to as the CAMELS rating) at a bank affected by a major disaster, examiners will review management’s response plans and assess the reasonableness of those plans given the bank’s business strategy and operational capacity in the distressed economic and business environment. When assessing the management component in particular, the guidance directs examiners to consider management’s effectiveness in responding to the changes in the bank’s business markets and whether the bank has addressed these issues in its longer-term business strategy and future response plans. The guidance also directs examiners to give appropriate recognition to the extent to which weaknesses are caused by external problems related to the major disaster and its aftermath when a bank is accorded a lower component rating. Highlighting the importance of business continuity planning, the guidance provides that formal or informal administrative action that would ordinarily be considered for a lower-rated bank may not be necessary for a bank affected by a major disaster if the bank’s management has appropriately planned for continuity of operations, implemented prudent policies, and is pursuing realistic resolution of the issues confronting the bank.
2. NIST Proposes Revised Draft of Updates to Cybersecurity Framework
The National Institute of Standards and Technology (“NIST”) has issued a draft update to its Framework for Improving Critical Infrastructure Cybersecurity (also known as the Cybersecurity Framework), which is one of the resources that the Division of Banks recommends banks consider to develop and strengthen their cybersecurity programs. The revised NIST Cybersecurity Framework released on December 5 is designed to help industry and individual companies, including banks, consider cyber risks as part of their overall risk management processes and align cybersecurity resources appropriately. The Cybersecurity Framework sets voluntary standards for information security measures and controls to help organizations manage cybersecurity risk. The revised draft provides new details on managing technology supply chain risks, clarifying key terms, and introducing measurement methods for cybersecurity. Public comments on the revised draft will be accepted through January 19, 2018. Click here to access the updated draft of the Cybersecurity Framework.
Nutter Notes: The addition of technology supply chain risk management (referred to in the Cybersecurity Framework as Cyber SCRM) to the Cybersecurity Framework is particularly relevant to community banks, which outsource significant product and service technologies, such as core processing and internet banking platforms, to third party service providers. According to the updated Cybersecurity Framework, a primary objective of Cyber SCRM is to identify, assess, and mitigate risk from products and services that may contain potentially malicious functionality, are counterfeit, or are vulnerable due to poor manufacturing and development practices within the cyber supply chain. Under the framework, Cyber SCRM activities include determining cybersecurity requirements for suppliers, enacting contractual cybersecurity requirements, communicating to suppliers how those cybersecurity requirements will be verified and validated, and verifying that cybersecurity requirements are met through a variety of assessment methodologies. The updated framework also includes a new section on self-assessment of cybersecurity risk that addresses measuring and assigning values to risk along with the cost and benefits of steps taken to reduce risk to acceptable levels.
3. FDIC Publishes a History of the 2008 Financial Crisis and the Agency’s Response
The FDIC has published a report on the history of the most recent financial crisis, which focuses on the agency’s response and lessons learned from its experience. The report released on December 18, Crisis and Response: An FDIC History, 2008–2013, reviews the experience of the FDIC in the context of two interconnected and overlapping crises: the financial crisis in 2008 and 2009 and the banking crisis that began in 2008 and continued until 2013. The first three chapters of the report contain an account of the origins of the crisis and the FDIC’s use of emergency authorities to respond to financial market illiquidity and the problems of systemically important financial institutions. The next three chapters describe the FDIC’s responses to the challenges the agency faced in carrying out its core missions of bank supervision, deposit insurance, and failed-bank resolution. In its report, the FDIC concludes that the factors contributing to cause the financial crisis were the housing boom and bust of the mid-2000s, the degree to which the U.S. and global financial systems had become highly concentrated, interconnected and opaque, and the innovative products and mechanisms that combined to link homebuyers in the U.S. with financial firms and investors across the world. Click here to access the report.
Nutter Notes: The report notes that the financial crisis that followed the collapse of the housing market was so severe that, for the first time, the U.S. government relied on statutory authority that had been put in place as part of the Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”) to help the FDIC deal with systemic risks. A provision of FDICIA prohibited assistance to failing banks if FDIC funds would be used to protect uninsured depositors and other creditors—but the act also contained a provision allowing an exception to the prohibition when the failure of an institution would pose a systemic risk. Relying on the provision that allowed a systemic risk exception, the FDIC in 2008 took two extraordinary actions that maintained financial institutions’ access to funding: the FDIC guaranteed bank debt and, for certain types of transaction accounts, provided an unlimited deposit insurance guarantee, according to the report. In addition, the report states that the FDIC and the other federal banking agencies used the systemic risk exception to extend extraordinary support to some of the largest financial institutions in the country in order to prevent their disorderly failure.
4. FinCEN Updates Answers to Frequently Asked Questions about BSA Compliance
The U.S. Treasury Department’s Financial Crimes Enforcement Network (“FinCEN”) has updated its Bank Secrecy Act (“BSA”) guidance to banks in the form of answers to frequently asked questions. The updated guidance released earlier this month addresses questions about the use of the Designation of Exempt Person form (FinCEN 110), which is used by banks to identify certain customers who are exempt from currency transaction reporting in accordance with the FinCEN rules implementing the BSA. Specifically, the new guidance clarifies that Banks are not required to file a Designation of Exempt Person form with respect to the transfer of currency to or from any of the 12 Federal Reserve Banks in accordance with an interim rule published by FinCEN on July 28, 2000. That interim rule, which amends the CTR exemption regulation, became effective on July 31, 2000. The guidance also explains that the Designation of Exempt Person form must be filed electronically with FinCEN through the BSA E-Filing system, and that FinCEN will provide an acknowledgement that the report has been received for each filing. Click here to access the updated BSA Guidance.
Nutter Notes: FinCEN’s rule that implements the currency transaction reporting requirements defines “exempt persons” to include a bank, to the extent of the bank’s domestic operations, a federal, state or local government department or agency, and any federal, state, interstate or local government quasi-governmental entity that exercises governmental authority on behalf of such government. The definition of exempt persons also includes certain business entities, other than a bank, listed on a major stock exchange, and certain non-listed businesses that maintain a transaction account at a bank for at least two months, frequently engage in transactions in currency with the bank in excess of $10,000, and are incorporated or organized under the laws of the U.S. or a state, or are registered as and eligible to do business within the U.S. or a state. Finally, the definition includes a limited exemption for certain payroll customers of a bank. The rule generally exempts a person that maintains a transaction account at a bank for at least two months, operates a firm that frequently withdraws more than $10,000 in order to pay its U.S. employees in currency, and is incorporated or organized under the laws of the U.S. or a state, or is registered and eligible to do business within the U.S. or a state.
5. Other Developments: Fed HMDA Rule and Debt Collection Disclosures
- Fed Repeals Reg. C and Proposes Amendments to Reg. M to Conform to Dodd-Frank Act
The Federal Reserve announced on December 18 the repeal of its Regulation C (Home Mortgage Disclosure), which has been superseded by final rules issued by the CFPB, and a proposal to revise Regulation M (Consumer Leasing) to reflect changes in the coverage of the rule under the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”). Comments on the proposed revisions to Regulation M are due within 60 days after it is published in the Federal Register, which is expected shortly.
Nutter Notes: The Dodd-Frank Act granted rulemaking authority for the Consumer Leasing Act (“CLA”) to the CFPB, with the exception of rules applicable to certain motor vehicle dealers. The proposed amendments to Regulation M would clarify the scope of the Federal Reserve’s CLA rule, which applies only to lessors that are excluded from coverage by the CFPB’s leasing regulation. Click here for a copy of the Federal Reserve’s announcement of both regulatory developments.
- CFPB Withdraws Proposal to Study Consumer Understanding of Debt Collection Disclosures
The CFPB withdrew on December 14 its request for approval by the Office of Management and Budget of a planned survey on consumer understanding of debt collection disclosures, which was widely considered to be a precursor to rulemaking on mandatory debt collection disclosures. The CFPB stated that its leadership would like to reconsider the information collection in connection with its review of ongoing related rulemaking.
Nutter Notes: The CFPB had originally planned to conduct a web survey of 8,000 individuals as part of the CFPB’s research on debt collection disclosures. The survey would have explored consumer comprehension and decision making in response to debt collection disclosure forms. Click here for a copy of the original survey proposal.
Nutter Bank Report
Nutter Bank Report is a monthly electronic publication of the Banking and Financial Services Group of the law firm of Nutter McClennen & Fish LLP. Chambers and Partners, the international law firm rating service, after interviewing our clients and our peers in the profession, has ranked Nutter’s Banking and Financial Services practice among the top banking practices in the nation. Visit the U.S. rankings at ChambersandPartners.com. The Nutter Bank Report is edited by Matthew D. Hanaghan. Assistance in the preparation of this issue was provided by Heather F. Merton. The information in this publication is not legal advice. For further information, contact:
Thomas J. Curry Kenneth F. Ehrlich Michael K. Krebs
tcurry@nutter.com kehrlich@nutter.com mkrebs@nutter.com
Tel: (617) 439-2087 Tel: (617) 439-2989 Tel: (617) 439-2288
This update is for information purposes only and should not be construed as legal advice on any specific facts or circumstances. Under the rules of the Supreme Judicial Court of Massachusetts, this material may be considered as advertising.
