Social Media: Consumer Compliance Risk Management Guidance

On December 11, 2013, the Federal Financial Institutions Examination Council (FFIEC) released final guidance (“Guidance”) on the applicability of consumer protection and compliance laws, regulations, and policies to activities conducted via social media by banks, savings associations, and credit unions, as well as nonbank entities supervised by the Consumer Financial Protection Bureau (collectively, “financial institutions”). The Guidance was issued final on behalf of the Office of the Comptroller of the Currency (OCC), Board of Governors of the Federal Reserve (Board), Federal Deposit Insurance Corporation (FDIC), National Credit Union Administration (NCUA), the Consumer Financial Protection Bureau (CFPB) (collectively, the “Agencies”), and the State Liaison Committee (SLC).

The Guidance is intended to help financial institutions understand potential consumer compliance and legal risks, as well as related risks, such as reputation and operational risks associated with the use of social media, along with expectations for managing those risks. It also provides considerations that financial institutions may find useful in conducting risk assessments and crafting and evaluating policies and procedures regarding social media. Although this Guidance does not impose any new requirements on financial institutions, as with any process or product channel, financial institutions are expected to manage potential risks associated with social media usage and access.

The Final Rule is meant to highlight and manage potential risks to financial institutions and consumers; however, financial institutions should ensure their risk management programs provide oversight and controls commensurate with the risks presented by the types of social media in which the financial institution is engaged, including, but not limited to, the risks outlined within the Guidance.

In this article, I will set forth an outline of the Guidance along with suggestions to manage the risks associated with the use of social media.* I have also published a helpful article on this topic, entitled Social Media and Networking Compliance, which may be downloaded from our Library. 

WHAT IS SOCIAL MEDIA?

For purposes of the Guidance, messages sent via traditional email or text message, standing alone, do not constitute social media, although such communications may be subject to a number of laws and regulations discussed in the Guidance. However, messages sent through social media channels are social media. According to the Guidance, social media is considered to be a form of interactive online communication in which users can generate and share content through text, images, audio, and/or video. Social media can take many forms, including, but not limited to, micro-blogging sites; forums, blogs, customer review web sites and bulletin boards; photo and video sites; sites that enable professional networking; virtual worlds; and social games. Social media can be distinguished from other online media in that the communication tends to be more interactive. 

RISK MANAGEMENT PROGRAM

The Guidance suggests that a financial institution should have a risk management program that allows it to identify, measure, monitor, and control the risks related to social media. The size and complexity of the risk management program should be commensurate with the breadth of the financial institution’s involvement in this medium.

For instance, a financial institution that relies heavily on social media to attract and acquire new customers should have a more detailed program than one using social media only to a very limited extent. An observation made in the Guidance, and worth noting, is though a financial institution’s own risk assessment indicates that it has chosen not to use social media, nevertheless, it should “still consider the potential for negative comments or complaints that may arise within the many social media platforms”, and, when appropriate, evaluate what, if any, action it will take to monitor for such comments and determine if a response is needed. 

FEATURES OF A RISK MANAGEMENT PROGRAM

The risk management program should be designed with participation from specialists in compliance, technology, information security, legal, human resources, and marketing. Financial institutions should also provide guidance and training for employee official use of social media.

The Guidance stipulates at least seven components of a risk management program. These include, but are not limited to:

1. A governance structure with clear roles and responsibilities whereby the board of directors or senior management direct how using social media contributes to the strategic goals of the institution (for instance, through increasing brand awareness, product advertising, or researching new customer bases) and establishes controls and ongoing assessment of risk in social media activities;

2. Policies and procedures (either stand-alone or incorporated into other policies and procedures) regarding the use and monitoring of social media and compliance with all applicable consumer protection laws and regulations, and incorporation of guidance as appropriate. Further, policies and procedures should incorporate methodologies to address risks from online postings, edits, replies, and retention;

3. A risk management process for selecting and managing third-party relationships in connection with social media;

4. An employee training program that incorporates the institution’s policies and procedures for official, work-related use of social media, and potentially for other uses of social media, including defining impermissible activities;

5. An oversight process for monitoring information posted to proprietary social media sites administered by the financial institution or a contracted third party;

6. Audit and compliance functions to ensure ongoing compliance with internal policies and all applicable laws and regulations, and incorporation of guidance as appropriate; and

7. Parameters for providing appropriate reporting to the financial institution’s board of directors or senior management that enable periodic evaluation of the effectiveness of the social media program and whether the program is achieving its stated objectives. 

WHAT ARE THE RISKS?

The use of social media to attract and interact with customers can impact a financial institution’s risk profile, including:

· Risk of harm to consumers
· Compliance and legal risks
· Operational risks, and
· Reputation risks.

In our own reviews on behalf of our clients, we have found that the foregoing risks are increased due to poor due diligence, oversight, or control on the part of the financial institution.

Let us now give consideration to each of the Risk Areas, with respect to the risks posed by Social Media. Suggestions are emboldened in each synopsis.

OCC - Correcting Foreclosure Practices

On December 20, 2011, the Office of the Comptroller of the Currency (OCC) updated its announcement regarding correcting foreclosure practices. We have previously issued newsletters here, here, and here on this subject and also related matters regarding foreclosure processing.

Earlier in 2011, on April 13, 2011, the OCC, the Board of Governors of the Federal Reserve System (FRB), and the Office of Thrift Supervision (OTS) announced enforcement actions against 14 large residential mortgage servicers and two third-party vendors for unsafe and unsound practices related to residential mortgage servicing and foreclosure processing. The enforcement actions were based on interagency examinations conducted in the fourth quarter of 2010.

Through those enforcement actions (consent orders), federal regulators required servicers to engage independent firms to conduct a multi-faceted review of foreclosure actions in process in 2009 and 2010.

On January 4, 2012, the OCC announced that it was promoting public service advertisements about the Independent Foreclosure Review.

In this newsletter, we will consider several aspects with respect to implementation of the consent orders.

• Independent Foreclosure Review
• Mailings to Consumers
• Deadline for Review Requests
• Independent Foreclosure Auditor
• Eligibility for Review
• Notifying the Public
• Engagement Letters
• Interim Report
• Library

Independent Foreclosure Review

Under the consent orders, independent consultants are charged with evaluating whether borrowers suffered financial injury through errors, misrepresentations, or other deficiencies in foreclosure practices and determining appropriate remediation for those customers.

Where a borrower suffered financial injury as a result of such practices, the agencies' orders require financial remediation to be provided.

Mailings to Consumers 

As part of that program, the 14 mortgage servicers covered by the enforcement actions were required to begin mailings to consumers on November 1, 2011, continuing to December 31, 2011.

The mailings are intended to provide information to potentially eligible borrowers on how to request a review of their case if they believe they suffered financial injury as a result of errors, misrepresentations, or other deficiencies in foreclosure proceedings related to their primary residence between January 1, 2009 and December 31, 2010. The mailings will include a request for review form.

Borrowers may also visit the special Independent Foreclosure Review website for more information about the review and claim process. Telephonic assistance is given at this website.

Deadline for Review Requests

 Review requests must be received by April 30, 2012.

Independent Foreclosure Auditor

An independent foreclosure auditor must be a third-party. The independent foreclosure auditor will assess whether any errors, misrepresentations, or other deficiencies resulted in financial injury to borrowers.

Where a borrower suffered financial injury as a result of such practices, the consent orders require remediation to be provided. 

During the review, customers may be contacted by mortgage servicers for additional information at the direction of the independent consultant.

OCC: Fixing Deficient Foreclosure Practices

Jonathan Foxx
President & Managing Director
Lenders Compliance Group

The Office of the Comptroller of the Currency (OCC) issued a report on November 22, 2011 on the actions by 12 national bank and federal savings association mortgage servicers to comply with consent orders issued in April 2011 to correct deficient and unsafe or unsound foreclosure practices.

The report, entitled Interim Status Report: Foreclosure-Related Consent Orders, summarizes progress on activities related to the independent foreclosure review announced November 1, 2011, as well as other activities to enhance mortgage servicing operations, strengthen oversight of third-party service providers and activities related to Mortgage Electronic Registration Systems (MERS), improve management information systems, assess and manage risk, and ensure compliance with applicable laws and regulations.

Based on information in the relevant OCC issuances, much of the work to correct identified weaknesses in policies, operating procedures, various control functions, and audit processes would be substantially complete in the first part of 2012, but other, longer term initiatives will continue through the balance of 2012.

In addition to the interim report, please note that the OCC also released engagement letters that describe how the independent consultants, retained by the servicers, will conduct their file reviews and claims processes to identify borrowers who suffered financial injury as a result of deficiencies identified in the OCC's consent orders.

For those of you who have not had to respond to and implement a consent order, I would say that the engagement letters are generally pro forma and consistent with similar terms and conditions we require in our own commitments and proposals for such audits and due diligence reviews. As a general proposition, the review process being implemented at some companies may differ from that described in the engagement letters because of subsequent coordination with the OCC to ensure a consistent process among the servicers.   

The engagement letters identify the names of the independent consultants conducting the reviews and include language stipulating that consultants would take direction from the OCC throughout the reviews. In fact, the terms of engagement specifically prohibit servicers from overseeing, directing, or supervising any of the reviews. Limited proprietary and personal information has been redacted.

Newsletter Sections
Interim Report
Engagement Letters
Correcting Foreclosure Deficiencies
Professional Assistance
Library

Interim Report

The interim report summarizes actions taken by national banks and federal savings associations to correct deficiencies in mortgage servicing and foreclosure processing identified in consent orders issued on April 13, 2011, by the Office of the Comptroller of the Currency (OCC) and the Office of Thrift Supervision (OTS) against 12 mortgage servicers.

The OCC took action against eight national bank servicers: Bank of America, Citibank, HSBC, JPMorgan Chase, MetLife Bank, PNC, U.S. Bank, and Wells Fargo. The OTS took action against four federal savings association servicers and two holding companies: Aurora Bank, FSB; EverBank (and the thrift holding company, EverBank Financial Corp.); OneWest Bank, FSB (and its holding company IMB HoldCo LLC); and Sovereign Bank.

The consent orders were based on examiner findings during an interagency review of major residential mortgage servicers conducted in the fourth quarter of 2010.

A summary of the findings of the interagency review is available in the "Interagency Review of Foreclosure Policies and Practices," produced by the OCC, Board of Governors of the Federal Reserve Board (FRB), and OTS.

Engagement Letters
Pursuant to 12 C.F.R. § 4.12(c), the listing order of the engagement letters at the OCC's election has no precedential significance.

The engagement letters were submitted by the independent consultants that were retained by servicers regulated by the OCC. These independent consultants will be conducting foreclosure reviews pursuant to the requirements of the April 13, 2011 consent orders. 

The engagement letters describe how the independent consultants will conduct their file reviews and claims processes to identify borrowers who suffered financial injury as a result of servicer deficiencies identified in the OCC's consent orders.  
Limited proprietary and personal information has been redacted from the engagement letters.

Since the acceptance of the engagement letters in September of this year, the independent consultants have further refined and made adjustments to the processes, procedures, and methodologies outlined in the engagement letters in consultation with OCC supervision staff.

For instance, there were a number of changes made to integrated claims processes to ensure a single, uniform process among the servicers.

Correcting Foreclosure Deficiencies

Independent Foreclosure Review

As part of those consent orders, federal regulators required servicers to engage independent firms to conduct a multi-faceted review of foreclosure actions in process in 2009 and 2010.

Under the orders, independent consultants are charged with evaluating whether borrowers suffered financial injury through errors, misrepresentations, or other deficiencies in foreclosure practices and determining appropriate remediation for those customers. Where a borrower suffered financial injury as a result of such practices, the agencies' orders require financial remediation to be provided.

As part of that program, 14 mortgage servicers covered by the enforcement actions will begin mailings November 1, 2011 that will continue through the end of the year. The mailings are intended to provide information to potentially eligible borrowers on how to request a review of their case if they believe they suffered financial injury as a result of errors, misrepresentations, or other deficiencies in foreclosure proceedings related to their primary residence between January 1, 2009 and December 31, 2010. The mailings will include a request for review form.

Borrowers may also visit the Independent Foreclosure Review for more information about the review and claim process. Furthermore, assistance with the form and answers to questions about the process are available at 1-888-952-9105, Monday through Friday from 8 a.m. to 10 p.m. (ET) and Saturday from 8 a.m. to 5 p.m. (ET).
Requests for review must be received by April 30, 2012.

The third-party consultant will assess whether any errors, misrepresentations, or other deficiencies resulted in financial injury to borrowers. Where a borrower suffered financial injury as a result of such practices, the consent orders require remediation to be provided. 

During the review, customers may be contacted by mortgage servicers for additional information at the direction of the independent consultant.

Professional Assistance

Library

Interim Status Report: Foreclosure-Related Consent Orders
November 2011

Interagency Review of Foreclosure Policies and Practices
April 2011

FRB Issues Flood Insurance FAQs and Proposed Revisions

The federal agencies that supervise banks, thrifts, and credit unions, and the Farm Credit System, on October 14, 2011 announced that it published guidance that updates the Interagency Questions and Answers Regarding Flood Insurance that were most recently published on July 21, 2009 (see 74 FR 35914-35947).

On October 17, 2011, the Federal Register published the guidance concerning the Loans in Areas Having Special Flood Hazards, Interagency Questions and Answers Regarding Flood Insurance.

The federal agencies participating in this guidance are the Office of the Comptroller of the Currency, Treasury (OCC), Board of Governors of the Federal Reserve System (Board), Federal Deposit Insurance Corporation (FDIC), Farm Credit Administration (FCA), and the National Credit Union Administration (NCUA), (collectively, the Agencies).

The guidance finalizes two questions and answers that had been previously proposed. The first relates to insurable value. The second relates to force placement of flood insurance. The Agencies withdrew another question regarding insurable value.

The two final questions and answers supplement the Interagency Questions and Answers Regarding Flood Insurance (Interagency Questions and Answers), which were published on July 21, 2009 (74 FR 35914).

• Effective Date - Final questions and answers: October 17, 2011.
• Effective Date for Comments: December 1, 2011.

REVISIONS

It is the intention of the Agencies that, after public comment has been received and considered and the guidance has been adopted in final form, the Agencies will issue a final update to the 2009 Interagency Questions and Answers Regarding Flood Insurance. The final update will continue to supplement other guidance or interpretations issued by the Agencies and the Federal Emergency Management Agency.

The Agencies request comment on three additional proposed updates to questions and answers relating to force placement of flood insurance. Two answers have been significantly and substantively changed. The third change, regarding force placement of flood insurance, revises a previously finalized Question and Answer for consistency with the proposed changes.

The Agencies are requesting comment on the proposed changes to the Interagency Questions and Answers Regarding Flood Insurance and, more generally, on other issues and concerns regarding compliance with the federal flood insurance statutes and regulations. Comments are due 45 days after publication in the Federal Register.

Based on comments received, the Agencies also have significantly revised two questions and answers regarding force placement of flood insurance that were initially proposed on July 21, 2009, and are now proposing revision to a previously finalized question and answer. These three revised questions and answers are being proposed for comment.

LIBRARY

Federal Reserve System - Interagency    
 
Loans in Areas Having Special Flood Hazards
Interagency Questions and Answers Regarding Flood 
 
Federal Register - 76/200
  
October 17, 2011

Agencies: Commence NMLS Registration

The federal bank, thrift and credit union regulatory agencies, along with the Farm Credit Administration, announced today that the Nationwide Mortgage Licensing System and Registry (Federal Registration) will begin accepting federal registrations, effective immediately.

Under the Secure and Fair Enforcement for Mortgage Licensing Act (SAFE Act) and the agencies' final rules, residential mortgage loan originators employed by banks, savings associations, credit unions, or Farm Credit System institutions must register with the registry, obtain a unique identifier from the registry, and maintain their registrations. 

Agencies

Farm Credit Administration

Federal Deposit Insurance Corporation

National Credit Union Administration

Office of the Comptroller of the Currency

Office of Thrift Supervision 

Following expiration of the 180-day initial registration period on July 29, 2011, any employee of an agency-regulated institution who is subject to the registration requirements will be prohibited from originating residential mortgage loans without first meeting these requirements.

(The registration rules exclude mortgage loan originators that originated five or fewer mortgage loans during the previous 12 months and who have never been registered.) 

Initial registration: January 31, 2011 to July 29, 2011.

Visit Library for Issuance

Registration of Mortgage Loan Originators
Interagency Announcement
January 31, 2011

Privacy & GLBA: Model Forms

On January 12, 2011, the Office of Thrift Supervision (OTS) published information intended to help small thrifts comply with the obligation to send initial and annual privacy notices to their customers. The agency's Small Entity Compliance Guide for the Model Privacy Notice is aimed at helping small thrifts use the model privacy notice form established by the bank and thrift regulatory agencies in December 2009. Proper use of the model forms provides a safe harbor for compliance with the privacy notice duties.

On December 1, 2009, the agencies published the final rule relating to the model privacy notice. Financial institutions that elect to use the model privacy form may rely on the model privacy form as a safe harbor to comply with the GLBA disclosure requirements.

The effective date of the amendments was December 31, 2009, except for the amendments eliminating the sample clauses and associated guidance, which become effective for notices sent after December 31, 2010.

Timing and Safe Harbor

A model privacy form that meets the privacy regulations' notice content requirements, which institutions may voluntarily rely on as a safe harbor in providing privacy notices as of December 31, 2009, appears in Appendix A to the regulations.

[Sample clauses also relating to the privacy regulations' notice content requirements, applicable in connection with privacy notices provided on or before December 31, 2010, appear in Appendix B to the regulation through December 31, 2011 (and thereafter will be deleted).]

The regulatory agencies have created an on-line form builder that thrifts can use to develop customized versions of the model notices. Although all financial institutions may model forms, they are not required to do so. Other forms, including those that rely on the sample clauses that will be replaced by the model forms, can be used if they comply with the notice requirements. However, only using the model forms will provide a safe harbor after December 31, 2010.

Privacy Notice - Form Requirements

The model privacy form has several versions:

1. If opt out is provided and include affiliate marketing.

2. If opt out is provided and do not include affiliate marketing.

3. If opt out is not provided and include affiliate marketing.

4. If opt out is not provided and do not include affiliate marketing.

5. If opt out is provided and include affiliate marketing, and mail-back form.

6. If opt out is provided and do not include affiliate marketing, and mail-back form.

To prevent identity theft, institutions should use a truncated form of an account number other than a Social Security Number on privacy notices.

Specific disclosure requirements are mandatory, if a financial institution wants to customize the privacy notice. However, the following features are permitted:

• Print the form on both sides of a single sheet of paper (or on two pages)

• Incorporate the form in another document or with other notices, and include additional documents or information so long as the form is presented in a clear and conspicuous manner

• Provide a single form jointly with other affiliated institutions (including affiliated institutions regulated by different agencies), as long as each institution is clearly identified in the correct space of the form

• Include color and logos to create visual interest, provided they do not interfere with the readability of the form

• Use different sizes of paper, provided the paper is large enough to meet the minimum 10-point font size and provide sufficient white space around the model form text

• Include certain information on state and international privacy law in the blank spaces provided

• Include a mail-in version of the opt-out form as described in the rule

• Translate the form into languages other than English

Online Form Builder - Quick Links

On April 15, 2010, the Agencies released an Online Form Builder that financial institutions can download and use to develop and print customized versions of the model consumer privacy notice.

The Online Form Builder, based on the model form regulation published in the Federal Register on December 1, 2009, under the GLB Act, is available with several options. Easy-to-follow instructions for the form builder guide an institution to select the version of the model form that fits its practices.

QUICK LINKS

Online Form Builder

Model Form in PDF

Model Form in HTML

Visit Library Small Entity Compliance Guide for the Model Privacy Notice - OTS January 12, 2011

New Appraisal and Evaluation Guidelines

On December 2, 2010, the federal financial regulatory agencies issued new Appraisal and Evaluation Guidelines, the purpose of which is to reflect changes in appraisal and evaluation practices.

The Guidelines replace the 1994 guidelines and explain the agencies' minimum regulatory standards for appraisals, incorporating the agencies' recent supervisory issuances on appraisal practices, addressing advancements in information technology used in collateral valuation practices, and clarifying standards for the industry's appropriate use of analytical methods and technological tools in developing evaluations.

The Guidelines clarify that:

(1) an analytical method or technological tool, such as an automated valuation model, cannot be substituted for an appraisal when the transaction requires an appraisal, and (2) there are "enhanced" requirements for collateral valuation methods for transactions that permit the use of an evaluation.

Review appraisal and evaluation programs to ensure they are consistent with the Guidelines.

GUIDELINES

• Recognize that while borrowers' ability to repay real estate loans according to reasonable terms remains the primary consideration in a lending decision, sound collateral valuation practices are an integral part of the loan underwriting process.

• Update and replace existing supervisory guidance to reflect developments regarding appraisals and evaluations as well as changes in appraisal standards and advancements in regulated institutions' collateral valuation methods.

• Clarify that collateral valuation methods that use an analytical method or technological tool, such as an automated valuation model, cannot be substituted for an appraisal when the transaction requires an appraisal.

• Enhance the requirements for collateral valuation methods for transactions that permit the use of an evaluation and specify that valuation methods that do not provide a property's market value, such as a broker price opinion, are not acceptable as an evaluation.

• Instruct institutions to file a complaint with the appropriate state appraiser regulatory officials when they suspect that a state certified or licensed appraiser fails to comply with the Uniform Standards of Professional Appraisal Practices, applicable laws, or engages in other unethical or unprofessional conduct, and to file a suspicious activity report (SAR) with the Financial Crimes Enforcement Network when the suspicious activity meets the SAR filing criteria.

APPENDICES

The appendices are particularly interesting and relevant to appraisal and evaluation practices. It is important to become familiar with the guidelines and implement them accordingly.

Appendix A
Appraisal Exemptions

1. Appraisal Threshold

2. Abundance of Caution

3. Loans Not Secured by Real Estate

4. Liens for Purposes Other Than the Real Estate's Value

5. Real Estate-Secured Business Loans

6. Leases

7. Renewals, Refinancings, and Other Subsequent Transactions Loan Workouts or Restructurings.

8. Transactions Involving Real Estate Notes

9. Transactions Insured or Guaranteed by a U.S. Government Agency or U.S. Government-sponsored Agency

10. Transactions that Qualify for Sale to, or Meet the Appraisal Standards of, a U.S. Government Agency or U.S. Government-sponsored Agency

11. Transactions by Regulated Institutions as Fiduciaries

12. Appraisals Not Necessary to Protect Federal Financial and Public Policy Interests or the Safety and Soundness of Financial Institutions

Appendix B
Evaluations Based on Analytical Methods or Technological Tools

Automated Valuation Models (AVMs)
Selecting an AVM(s)
Determining AVM Use
Validating AVM Results
Tax Assessment Valuations (TAVs)

Appendix C
Deductions and Discounts

Proposed Construction or Renovation
Partially Leased Buildings
Non-market Lease Terms
Tract Developments with Unsold Units: Raw Land, Developed Lots, Attached or Detached Single-family Homes, Condominiums

Appendix D
Glossary of Terms

Visit Library for Issuance

Appraisal and Evaluation Guidelines
Interagency
December 2, 2010

LENDERS COMPLIANCE GROUP is the first full-service, mortgage risk management firm in the country, specializing exclusively in mortgage compliance and offering a full suite of hands-on and automated services in residential mortgage banking.