Social Media Compliance: Frequently Asked Questions

Last month, I discussed some of the salient compliance requirements associated with using Social Media.* Then, a few days later, I offered to you my article, entitled Social Media and Networking Compliance. This month, on March 6th, I was one of three presenters who gave a webinar for American Banker on Social Media, with special reference to the new rules of the Federal Financial Institutions Examination Council (FFIEC). The proposed rule, issued January 23rd, is entitled "Social Media: Consumer Compliance Risk Management Guidance."

My webinar topic: Social Media – Employee Manual. 

The webinar was very well attended by a diverse cross-section of financial institutions. I found it quite interesting that, when polled during the webinar, by a factor of two to one these companies did not have an Employee Manual, even if about a third of them have policies and procedures relating to Social Media.

I have harped on a certain point regarding policy statements, so here it goes again: policies and procedures are a rather abstract concept to employees; employee manuals, however, for certain rules and regulations, are the most effective means to ensure compliance. Training is an important and an ancillary tool, but employees do not always mentally retain training information. Keep this in mind: an employee manual is a constant reminder of a company's expectations and policies.

One aspect of social media that deserves considerable attention is trolling, using anonymity, and general blogging guidelines. Everybody knows that, for the most part, blogging is electronically available to the public. However, with regard to an individual's employment with a financial institution, what restrictions should be placed on an employee who blogs? From my own research and experience, it would seem that many employees actually have no idea of the implications, requirements, and, in some cases, the potential to easily cross over into violations of federal law or state law.

Here are the risks at stake in social media networking and blogging - though by no means less so for forms of advertising through and use of social media: financial risk, regulatory risk, sales risk, reputation risk, legal risk, strategic risk, and operational risk, such as adverse consequences to business plans, projects, Internet Technology and Information Security protections, and many core departmental functions.

In this article, I will offer a high level FAQs about the use of Social Media (SM), with some additional emphasis on blogging. I will also provide bulleted guidelines to give to employees.

________________________________________________

What is Social Media?

SM is a form of interactive online communication in which users can generate and share content through text, images, audio and/or video.

________________________________________________

Do companies use Social Media?

HubSpot found that by November 2012 companies that blog incurred an average of 55% more visitors to their sites than companies that did not blog. Statistically, blogging companies may generate 97% more external website links and 434% more indexed pages, both of which are critical to a company’s search rank. And a global survey by McKinsey of approximately 1,700 corporate executives finds that 69% of respondents claim measurable advantages from social media, including a lower cost of doing business, better access to knowledge, increased marketing effectiveness, insight for developing more innovative products and services, and higher revenues.

________________________________________________

Does SM cover micro-blogging?

SM includes, but is not limited to, micro-blogging sites (i.e., Facebook, Google Plus, MySpace, and Twitter); forums, blogs, customer review websites and bulletin boards (i.e., Yelp); photo and video sites (i.e., Flickr and YouTube); sites that enable professional networking (i.e., LinkedIn); virtual worlds (i.e., Second Life); and social games (i.e., FarmVille and CityVille).

________________________________________________

How do some financial institutions use SM?

SM has been used to receive and respond to complaints, provide loan pricing, and offer generic information about products and services.

________________________________________________

Social Media and Networking Compliance

When you think of advertising, do you include social media? These days, most of you do!

However, social media compliance - which I shall call "SMC" - is a considerable undertaking, far more involved than just issuing a policy and procedure. Often, implementing SMC includes working with internet technology and information security professionals, collaborating with sales, compliance, legal, marketing, and human resources personnel, and ensuring that virtually all employees understand their own obligations with respect to using internet communications.

We have drafted SMC policy statements that call for constant vigilance by management and appointed staff to monitor for and find the appropriate remedies to transgressions relating to use of a company's name, logo, products, and services, in casual and even formal social media interactions.

Recently, Federal Financial Institutions Examination Council (FFIEC) issued a request for comments, entitled Social Media: Consumer Compliance Risk Management Guidance ("Notice"). FFIEC issued this notice on behalf of its six members, Office of the Comptroller of the Currency (OCC); the Board of Governors of the Federal Reserve System (Board); the Federal Deposit Insurance Corporation (FDIC); the National Credit Union Administration (NCUA); the CFPB (collectively, the "Agencies"); and the State Liaison Committee (SLC). Succinctly put, whatever the federal agencies eventually adopt, the states will issue the final guidance as a supervisory guidance not only to the institutions that are, by extension, under its supervision but also through the State Liaison Committee, thereby encouraging state regulators to adopt the guidance.

This means that institutions will be expected to use the forthcoming guidance in their efforts to ensure that their policies and procedures provide oversight and controls commensurate with the risks posed by their social media activities. State agencies that adopt the guidance will expect the entities that they regulate to use the guidance in their efforts to ensure that their risk management and consumer protection practices adequately address the compliance and reputation risks raised by activities conducted via social media.

In this article, I will consider certain features of FFIEC's social media Notice as well as some important subjects to be addressed in constructing an SMC policy and procedure.*

_______________________________________________________

IN THIS ARTICLE

Defining Social Media

Use of Social Media

Risks of Social Media

Risk Management

Risk Areas

Laws and Regulations

Major Risks

Policy and Procedures

_______________________________________________________

Defining Social Media

Social media has been defined in a number of ways. For purposes of the proposed guidance, the Agencies consider social media to be a form of interactive online communication in which users can generate and share content through text, images, audio, and/or video.

Social media can take many forms, including, but not limited to, micro-blogging sites (i.e., Facebook, Google Plus, MySpace, and Twitter); forums, blogs, customer review Websites and bulletin boards (i.e., Yelp); photo and video sites (i.e., Flickr and YouTube); sites that enable professional networking (i.e., LinkedIn); virtual worlds (i.e., Second Life); and social games (i.e., FarmVille and CityVille).

A simple test to distinguish social media from other online media in that the social media communication tends to be more interactive.

_______________________________________________________

Use of Social Media

Financial institutions use social media in a variety of ways, including marketing, providing incentives, facilitating applications for new accounts, inviting feedback from the public, and engaging with existing and potential customers.

For instance, social media has been used to receive and respond to complaints. They have been used to provide loan pricing. Since this form of customer interaction tends to be informal and occurs in a less secure environment, it presents some unique challenges to financial institutions.

CFPB Issues Supervision and Examination Manual

On October 13, 2011, the Consumer Financial Protection Bureau (CFPB) issued its Supervision and Examination Manual - Version 1.0 (Manual). This is the first edition of a guide devoted to how the CFPB will supervise and examine consumer financial service providers under its jurisdiction for compliance with Federal consumer financial law.

The Manual is divided into three parts:

Part 1: Describes the supervision and examination process.

Part 2: Contains examination procedures, including both the general instructions and the procedures for determining compliance with specific regulations.

Part 3: Provides templates for documenting information related to supervised entities and the examination process, including examination reports.

Unfortunately, at this time Part 1 and Part 2 are only available as website pages. Part 3 is available in PDF.

However, we have created a Directory and Compendium.

At this time, Part 1 and Part 2 are only available as website pages.

Part 3 is available in PDF.

In preparing our Audit and Due Diligence procedures for our clients, we have combined all three parts into a single Directory with links to each section's text and website links. There are over 700 pages in this compendium.

Our compendium provides:

• Directory: All Sections
• Contents: Links to Compendium Text
• Contents: Links to CFPB Website Text

We are pleased to share this compilation with you for free.

Due to the huge size of the compendium - over 13 MBs - it must be downloaded from our secure Extranet. If you are interested in obtaining this compendium, please request it and we'll send you the download instructions.

Supervision and Examination Manual - Version 1.0

OUTLINE

Part I - Compliance Supervision and Examination

Supervision and Examination Process
    Overview
    Examinations

Part II - Examinations Procedures
Compliance Management Review

Unfair, Deceptive or Abusive Acts or Practices
    Narrative
    Examination Procedures

Equal Credit Opportunity Act
    Narrative
    Examination Program
    Interagency Fair Lending Examination Procedures
    Interagency Fair Lending Examination Procedures – Appendix

Home Mortgage Disclosure Act
    Narrative
    Examination Procedures
    Home Mortgage Disclosure Act Checklist

Truth in Lending Act
    Narrative
    Examination Procedures
    Appendix A: High-Cost Mortgage (§ 226.32) Worksheet

Real Estate Settlement Procedures Act
    Narrative
    Examination Procedures
    Checklist

Homeowners Protection Act
    Narrative
    Examination Procedures

Consumer Leasing Act
    Narrative
    Consumer Leasing Act Examination Procedures
    Consumer Leasing Act Checklist

Fair Credit Reporting Act
    Narrative
    Examination Procedures

Fair Debt Collection Practices Act
    Narrative
    Examination Procedures

Electronic Fund Transfer Act
    Narrative
    Examination Procedures
    Checklist

Truth in Savings Act
    Narrative
    Examination Procedures
    Checklist

Privacy of Consumer Financial Information (GLBA)
    Narrative
    Examination Procedures
    Examination Procedures Attachment
    Checklist

Mortgage Servicing Examination Procedures

Part III - Examination Process Templates
    Templates
    Entity Profile
    Risk Assessment
    Supervision Plan
    Examination Scope Summary
    Examination Report
    Examination Report cover
    Examination Report cover letter

LIBRARY

Consumer Financial Protection Bureau

Supervision and Examination Manual
Version 1.0
Announcement

October 13, 2011

Adverse Action and Risk-Based Disclosures (Final Rules)

On July 6, 2011, the Federal Reserve Board (FRB) and the Federal Trade Commission (FTC) jointly issued final rules (Rules) to implement the credit score disclosure requirements of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank).

Our previous notification relating to this rule was on 7/7/11, on 3-2-11, and 1-3-11.

The Rules amend certain model notices in Regulation B (Equal Credit Opportunity), which combine the adverse action notice requirements for Regulation B and the FCRA, to reflect the new credit score disclosure requirements. 

If a credit score is used in setting material terms of credit or in taking adverse action, the statute requires creditors to disclose credit scores and related information to consumers in notices under the Fair Credit Reporting Act (FCRA).

The Rules amend Regulation V (Fair Credit Reporting) to revise the content requirements for risk-based pricing notices, and to add related model forms that reflect the new credit score disclosure requirements.

REGULATION B (ECOA)

Adverse Action Notice

Section 701 of the Equal Credit Opportunity Act (ECOA) requires a creditor to notify a credit applicant when it has taken adverse action against the applicant. The ECOA adverse action requirements are implemented in the FRB's Regulation B.

Section 615(a) of the Fair Credit Reporting Act (FCRA) also requires a person to provide a notice when the person takes an adverse action against a consumer based in whole or in part on information in a consumer report.

Certain model notices in Regulation B include the content required by both the ECOA and the FCRA adverse action provisions, so that creditors can use the model notices to comply with the adverse action requirements of both statutes.

The FRB is amending these model notices in Regulation B to include the disclosure of credit scores and related information if a credit score is used in taking adverse action.

The revised model notices reflect the new content requirements in section 615(a) of the FCRA as amended by section 1100F of the Dodd-Frank Wall Street Reform and Consumer Protection Act.

Effective: August 15, 2011

REGULATION V (FCRA)

Fair Credit Reporting Risk-Based Pricing Regulations 

On January 15, 2010, the Board and the Commission published final rules to implement the risk-based pricing provisions in section 311 of the Fair and Accurate Credit Transactions Act of 2003 (FACT Act), which amended the Fair Credit Reporting Act (FCRA).

The final rules generally require a creditor to provide a risk-based pricing notice to a consumer when the creditor uses a consumer report to grant or extend credit to the consumer on material terms that are materially less favorable than the most favorable terms available to a substantial proportion of consumers from or through that creditor.

The FRB and the Commission are amending their respective risk-based pricing rules to require disclosure of credit scores and information relating to credit scores in risk-based pricing notices if a credit score of the consumer is used in setting the material terms of credit.

These final rules reflect the new requirements in section 615(h) of the FCRA that were added by section 1100F of the Dodd-Frank Wall Street Reform and Consumer Protection Act.

Effective: August 15, 2011

LIBRARY

Equal Credit Opportunity
Regulation B
Adverse Action Notice
FRB: 12 CFR Part 202
Final Rule
July 15, 2011

Fair Credit Reporting
Regulation V
Fair Credit Reporting Risk-Based Pricing Regulations
FRB: 12 CFR Part 222
FTC: 16 CFR Parts 640 and 698
Final Rules
July 15, 2011

FRB and FTC: Credit Score Disclosure - Final Rules

On July 6, 2011, the Federal Reserve Board (FRB) and the Federal Trade Commission (FTC) jointly issued final rules (Rules) to implement the credit score disclosure requirements of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank).

Our previous notifications relating to this rule were on 1-3-11, and 3-2-11.

If a credit score is used in setting material terms of credit or in taking adverse action, the statute requires creditors to disclose credit scores and related information to consumers in notices under the Fair Credit Reporting Act (FCRA).

The Rules amend Regulation V (Fair Credit Reporting) to revise the content requirements for risk-based pricing notices, and to add related model forms that reflect the new credit score disclosure requirements.

The Rules also amend certain model notices in Regulation B (Equal Credit Opportunity), which combine the adverse action notice requirements for Regulation B and the FCRA, to reflect the new credit score disclosure requirements.

The rules under Regulations V and B are effective 30 days after the date of publication in the Federal Register, which is expected soon.

Effective Date: July 21, 2011

 REGULATION V

The Rules amend Regulation V (Fair Credit Reporting) to revise the content requirements for risk-based pricing notices, and to add related model forms that reflect the new credit score disclosure requirements.

Section 1100F of the Dodd-Frank Act (Dodd-Frank) amends section 615(h) of the FCRA to require that additional content be disclosed to consumers in risk-based pricing notices; specifically, if a credit score is used in making the credit decision, the creditor must disclose that score and certain information relating to the credit score.

Rulemaking authority for the risk-based pricing provisions of the FCRA, including the amendments prescribed by section 1100F of the Dodd-Frank, will not be vested in the Consumer Financial Protection Bureau until the date that the section 1100F amendments become effective.

 REGULATION B

The Rules also amend certain model notices in Regulation B (Equal Credit Opportunity), which combine the adverse action notice requirements for Regulation B and the FCRA, to reflect the new credit score disclosure requirements.

Section 1100F of the Dodd-Frank Act amends section 615(a) of the FCRA to require creditors to disclose on FCRA adverse action notices a credit score used in taking any adverse action and information relating to that score.

The FRB is issuing revised model adverse action notices substantially as proposed, and revised to the extent necessary for the adverse action model notices in Regulation B to be consistent with the requirements of section 1100F of the Dodd-Frank.

 LIBRARY

 

 FRB: 12 CFR Part 222, Regulation V and
FTC: 16 CFR Parts 640 and 698
Fair Credit Reporting Risk-Based Pricing Regulations
July 6, 2011

 FRB: 12 CFR Part 202, Regulation B
Equal Credit Opportunity
Final Rule
July 6, 2011

NEW Risk-Based Pricing Rules - January 1, 2011

MAGAZINE ARTICLE: by JONATHAN FOXX

Jonathan Foxx is a former Chief Compliance Officer of two publicly traded financial institutions, and the President & Managing Director of Lenders Compliance Group, the nation’s first full-service, mortgage risk management firm in the country.

I think you will be interested in reading my newest article in the National Mortgage Professional Magazine, the national publication that is considered the premier mortgage industry magazine for residential mortgage originators.

In this month's Regulatory Compliance Outlook, I discuss Risk-Based Pricing, which refers to the practice of using a consumer's credit report, reflecting his or her risk of nonpayment, in setting or adjusting the price and other terms of credit offered or extended to a particular consumer.

I consider the use of credit reports or scores in connection with a credit decision, notice requirements, and the disclosure requirements when a lender grants credit on material terms that are not the most favorable terms offered to a substantial proportion of consumers.

TOPICS

• What are Material Terms?
• Who provides the RBP Disclosures?
• Who receives the RBP Disclosures?
• When are the RBP Disclosures sent?
• What are the model forms?
• Are there exceptions?

EXCERPT

WHO PROVIDES THE RBP DISCLOSURES?

Two-Prong Test

There is a two-prong test to determine the RBP compliance requirement, and both conditions must be met:

(1) determine that a consumer report is being used in connection with an application for, or a grant, extension, or other provision of, credit (for personal, household, and family - not business - purposes) to a consumer; and

(2) based in whole or in part on the consumer report, determine if credit is granted, extended, or otherwise provided to that consumer on "material terms" that are materially less favorable than the most favorable terms available to a substantial proportion of consumers from or through the credit grantor.

I am pleased to share this article with you. I hope you will share it with your colleagues.

We provide expert guidance in all areas of residential mortgage compliance.

If you are not yet a client, shouldn't you become one?

If you have questions about this matter or would like assistance or guidance, please contact me at any time.

Jonathan Foxx
President & Managing Director
(516) 442-3456 X 100

New Risk Based-Pricing Rules

Risk-based pricing refers to the practice of using a consumer's credit report, which reflects his or her risk of nonpayment, in setting or adjusting the price and other terms of credit offered or extended to a particular consumer.

The risk-based pricing rules implement section 311 of the Fair and Accurate Credit Transactions Act of 2003 (FACTA), which amends the Fair Credit Reporting Act (FCRA).

The Federal Reserve Board (FRB) and the Federal Trade Commission (FTC) proposed regulations in May 2008 that generally would require a creditor to provide a consumer with a risk-based pricing notice when, based in whole or in part on the consumer's credit report, the creditor offers or provides credit to the consumer on terms less favorable than the terms it offers or provides to other consumers.

On December 28, 2009, the FRB and FTC announced the final risk-based pricing rules, with the effective compliance date of January 1, 2011. Publication in the Federal Register of the final rules took place on January 15, 2010.

The new rules apply to all mortgage brokers, correspondents and lenders and impacts all consumers that have credit data and/or scores accessed for a risk-based pricing decision, regardless of loan approval status.

Indeed, risk-based pricing rules apply, with certain exceptions, to all creditors that engage in risk-based pricing. A risk-based pricing notice would generally be provided to the consumer after the terms of credit have been set, but before the consumer becomes contractually obligated on the credit transaction.

The rules provide a number of different approaches that creditors may use to identify the consumers to whom they must provide risk-based pricing notices.

In addition, the rules include certain exceptions to the notice requirement, the most significant being an exception that permits creditors, in lieu of providing a risk-based pricing notice to those consumers who receive less favorable terms, to provide all of their consumers with their credit scores and explanatory information.

As an alternative to providing risk-based pricing notices, the final rules permit creditors to provide consumers who apply for credit with a free credit score and information about their score. Today, most consumers must pay a fee to obtain their credit score.

Companies that use a credit report or score in connection with a credit decision must send notice, containing specified information, to a consumer when, based on a credit report or score, the company grants credit on material terms that are not the most favorable terms offered to a substantial proportion of consumers. For instance, in most cases, the rule defines "material terms" as the loan's Annual Percentage Rate.

Effective: January 1, 2011

Highlights

The new rule differs from the current FACTA required Notice to Home Loan Applicant and Consumer Score Disclosure requirements in several important ways:

1) Each risk based pricing disclosure must include the decisioning credit score and a comparative study showing how each consumer's credit score relates to others using that specific scoring model.

2) Whereas the previous FACTA notices allowed for combining of joint applicants, the new disclosures are required to be sent individually and separately. (These disclosures cannot be combined with any other non-FACTA documents and/or required disclosures.)

3) A unique disclosure is required in instances where a credit score is not available.

Visit Library for Issuance

Fair Credit Reporting Risk-Based Pricing

Fair Credit Reporting Risk-Based Pricing Regulations, Final Rule, FR 75/10, January 15, 2010
Fair Credit Reporting Risk-Based Pricing Regulations - Agency Notice, December 28, 2009
Model Forms - Risk-Based Pricing, Agency Notice, December 28, 2009
Fair Credit Reporting Risk-Based Pricing Regulations: Correction, FR 73/104, May 29, 2008
Fair Credit Reporting Risk-Based Pricing Regulations, Proposed Rule, FR 73/97, May 19, 2008

LENDERS COMPLIANCE GROUP is the first full-service, mortgage risk management firm in the country, specializing exclusively in mortgage compliance and offering a full suite of hands-on and automated services in residential mortgage banking.

OTS: Updates FCRA Compliance Exam

On August 31, 2010, the OTS updated Section 1300 of the OTS Handbook, which outlines FCRA compliance requirements reviewed in examinations. The OTS, the Office of the Comptroller of the Currency, the Federal Reserve Board, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Federal Trade Commission implemented the FACT Act changes through final rules that were effective July 1, 2009.

Section 623 of the Fair Credit Reporting Act (FCRA) was amended by the Fair and Accurate Credit Transactions Act of 2003 (FACT Act) to improve the way that institutions furnish information to consumer reporting agencies (CRAs) and handle direct disputes from consumers.

Section 1300 of the OTS's Examination Handbook contains procedures used by OTS examiners to assess compliance with the FCRA. The module on financial institutions as being "furnishers of information" (Module 4) has been revised to include the requirements of the new rules.

Furnishing information to CRAs is voluntary. However, under the new rules, institutions that do so must have policies and procedures for furnishing information with accuracy and integrity.

The rules also lay out the duties of institutions that receive disputes directly from consumers. The attached examination procedures address both of these areas.

If you have any questions about this matter, please contact Jonathan Foxx.

Highlights

Summary of Key Regulatory Provisions

Policies and Procedures

In developing the required policies and procedures, furnishers must:

• consider the guidelines that are in Appendix E to the rule

• develop policies and procedures that fit the institution's activities

• provide for reasonable investigations of disputes

• use standard data reporting formats

• maintain records for enough time to respond to direct disputes

• review procedures upon transfers of accounts to prevent re-aging of information

• periodically review and update practices and procedures for investigating and correcting information

• review and update their procedures periodically

Direct Disputes

• When a consumer disputes information reported to a CRA directly with an institution, the institution must conduct a reasonable investigation of a direct dispute if it relates to consumer liability on the account, the terms of the account, the consumer's performance, or other information in a credit report regarding the account with the furnisher that bears on the consumer's creditworthiness and reputation.

• When an institution receives a direct dispute, it must review all relevant information that the consumer provided and report investigation results to the consumer.

• If the institution finds that it provided incorrect information to a CRA, it must provide the correct information to each affected CRA.

• An investigation is not required if the institution determines that the dispute is frivolous or irrelevant and sends the consumer a notice within five days of making that determination.

• The notice may be on a standard form and must include the reasons for the determination and identify information that the institution needs to investigate the dispute.

Visit Library for Issuances

• Furnishing Information to Consumer Reporting Agencies and Direct Disputes Regulation: FCRA Examination Procedures, OTS Letter 363 (8/31/10)

• Regulatory Bulletin, RB 37-60, Handbook: Examination, Subject: Fair Credit Reporting Act, Section 1300 (8/31/10)

• Final Rule/Guidelines on Furnishing Consumer Information to Credit Reporting Agencies and Direct Disputes; and Advance Notice of Proposed Rulemaking (ANPR) Seeking Comment on Additions to Guidelines, OTS Letter 313, (7/17/09) .

• Guidelines for Furnishers of Information to Consumer Reporting Agencies, Proposed rule, Federal Register, Vol. 74, No. 125, pp 31529-31533 (7/1/09)

• Procedures To Enhance the Accuracy and Integrity of Information Furnished to Consumer Reporting Agencies Under Section 312 of the Fair and Accurate Credit Transactions Act, Final rules, Federal Register, Vol. 74, No. 125, pp 31484-31528 (7/1/09)

_________________________________