Monthly Mortgage Compliance - Semi-Annual Opportunity

Message from Jonathan Foxx, Ph.D., MBA 
Chairman & Managing Director
Lenders Compliance Group.

________________________________

Twice each year, we open our doors to new clients to join our family of clientele that use our monthly mortgage compliance support. 

During this discount enrollment period, we discount our already low monthly flat fee. The timeframe to take advantage of this offer ends on March 31st. 

We offer the discount as an expression of our mission. Let me explain.

When I started Lenders Compliance Group in 2006, there were virtually no other mortgage compliance and risk management companies around. My idea was to offer a team of the top compliance experts at a fraction of the cost it would be to retain any of them individually. At first, it was rough going, because companies had become grudgingly dependent on high fees and high payroll costs. One by one, they joined us and in time Lenders Compliance Group became the preeminent compliance firm in the country.

Of course, soon the copycats popped up, jumping onto what they thought was a big money-making bandwagon. But I said then, as I say now, 'I welcome competition.' The hybridization of compliance firms mystified me at first, such as firms that offered boilerplate policies and procedures for next to nothing but slammed lenders with excessive monthly fees, law firms that previously had no mortgage compliance departments all of a sudden sprung up with their various "compliance divisions," and quality control firms that had no real mortgage compliance experience except for providing QC auditing yet parleyed their client list. Unfortunately, and inevitably, many lenders were chiseled, chastened, but happily came to us. 

Believe it or not - and I have said this many times - we choose our clients as much as they choose us. Not every client is a good fit, and just because they have a lot of money or clout does not mean they are right for us. We seek lenders that are serious about implementing compliance, not trying to find a way to twist a regulation into an unrecognizable shape. We'll sometimes modestly push the compliance envelope, but only so much! If you conduct compliance on the basis of a cost/benefit ratio, you're probably not a good fit for us.

I'm proud of what we've accomplished, and it all began with monthly compliance support. In effect, we become an extension of your office!

We now provide the largest range of compliance services - all of it hands-on, personal, and direct! But we will always stick by our vision to provide a safe and sound approach to monthly compliance.

So, what do you get as a monthly mortgage compliance client? This -

Low Monthly Flat Fee

On-going Compliance Support

Supervised by Directors

Subject Matter Experts

Unlimited Questions

Most Policy Documents

Secure Record Storage

Dedicated Team

If you are a lender that needs cost-effective regulatory compliance guidance relating to mortgage acts, rules, regulations, and Best Practices, and you are committed to safety and soundness, you should contact us. We'll provide independent, reliable, low cost, on-going support to your compliance team!

If you miss out on this opportunity for a reduced fee, we'll be providing the offer again later this year. The deadline is March 31st. But why wait? 

Just contact us and we'll send you a one-page presentation, and you can also speak with me or one of our Directors to discuss your compliance needs. 

If you're interested, we'll give you a simple form to complete that lets us know a little about your organization, so that we can send you an engagement proposal with appropriate pricing, staffing, and scope. We're usually able to get started immediately!

Click the sidebar button or feel free to contact us at your convenience via email, phone, or even leaving a voicemail. 

Email: Compliance@LendersComplianceGroup.com
Phone: 866-602-6660
Voicemail: 866-255-6466

Wishing you all the best!

Social Media: Consumer Compliance Risk Management Guidance

On December 11, 2013, the Federal Financial Institutions Examination Council (FFIEC) released final guidance (“Guidance”) on the applicability of consumer protection and compliance laws, regulations, and policies to activities conducted via social media by banks, savings associations, and credit unions, as well as nonbank entities supervised by the Consumer Financial Protection Bureau (collectively, “financial institutions”). The Guidance was issued final on behalf of the Office of the Comptroller of the Currency (OCC), Board of Governors of the Federal Reserve (Board), Federal Deposit Insurance Corporation (FDIC), National Credit Union Administration (NCUA), the Consumer Financial Protection Bureau (CFPB) (collectively, the “Agencies”), and the State Liaison Committee (SLC).

The Guidance is intended to help financial institutions understand potential consumer compliance and legal risks, as well as related risks, such as reputation and operational risks associated with the use of social media, along with expectations for managing those risks. It also provides considerations that financial institutions may find useful in conducting risk assessments and crafting and evaluating policies and procedures regarding social media. Although this Guidance does not impose any new requirements on financial institutions, as with any process or product channel, financial institutions are expected to manage potential risks associated with social media usage and access.

The Final Rule is meant to highlight and manage potential risks to financial institutions and consumers; however, financial institutions should ensure their risk management programs provide oversight and controls commensurate with the risks presented by the types of social media in which the financial institution is engaged, including, but not limited to, the risks outlined within the Guidance.

In this article, I will set forth an outline of the Guidance along with suggestions to manage the risks associated with the use of social media.* I have also published a helpful article on this topic, entitled Social Media and Networking Compliance, which may be downloaded from our Library. 

WHAT IS SOCIAL MEDIA?

For purposes of the Guidance, messages sent via traditional email or text message, standing alone, do not constitute social media, although such communications may be subject to a number of laws and regulations discussed in the Guidance. However, messages sent through social media channels are social media. According to the Guidance, social media is considered to be a form of interactive online communication in which users can generate and share content through text, images, audio, and/or video. Social media can take many forms, including, but not limited to, micro-blogging sites; forums, blogs, customer review web sites and bulletin boards; photo and video sites; sites that enable professional networking; virtual worlds; and social games. Social media can be distinguished from other online media in that the communication tends to be more interactive. 

RISK MANAGEMENT PROGRAM

The Guidance suggests that a financial institution should have a risk management program that allows it to identify, measure, monitor, and control the risks related to social media. The size and complexity of the risk management program should be commensurate with the breadth of the financial institution’s involvement in this medium.

For instance, a financial institution that relies heavily on social media to attract and acquire new customers should have a more detailed program than one using social media only to a very limited extent. An observation made in the Guidance, and worth noting, is though a financial institution’s own risk assessment indicates that it has chosen not to use social media, nevertheless, it should “still consider the potential for negative comments or complaints that may arise within the many social media platforms”, and, when appropriate, evaluate what, if any, action it will take to monitor for such comments and determine if a response is needed. 

FEATURES OF A RISK MANAGEMENT PROGRAM

The risk management program should be designed with participation from specialists in compliance, technology, information security, legal, human resources, and marketing. Financial institutions should also provide guidance and training for employee official use of social media.

The Guidance stipulates at least seven components of a risk management program. These include, but are not limited to:

1. A governance structure with clear roles and responsibilities whereby the board of directors or senior management direct how using social media contributes to the strategic goals of the institution (for instance, through increasing brand awareness, product advertising, or researching new customer bases) and establishes controls and ongoing assessment of risk in social media activities;

2. Policies and procedures (either stand-alone or incorporated into other policies and procedures) regarding the use and monitoring of social media and compliance with all applicable consumer protection laws and regulations, and incorporation of guidance as appropriate. Further, policies and procedures should incorporate methodologies to address risks from online postings, edits, replies, and retention;

3. A risk management process for selecting and managing third-party relationships in connection with social media;

4. An employee training program that incorporates the institution’s policies and procedures for official, work-related use of social media, and potentially for other uses of social media, including defining impermissible activities;

5. An oversight process for monitoring information posted to proprietary social media sites administered by the financial institution or a contracted third party;

6. Audit and compliance functions to ensure ongoing compliance with internal policies and all applicable laws and regulations, and incorporation of guidance as appropriate; and

7. Parameters for providing appropriate reporting to the financial institution’s board of directors or senior management that enable periodic evaluation of the effectiveness of the social media program and whether the program is achieving its stated objectives. 

WHAT ARE THE RISKS?

The use of social media to attract and interact with customers can impact a financial institution’s risk profile, including:

· Risk of harm to consumers
· Compliance and legal risks
· Operational risks, and
· Reputation risks.

In our own reviews on behalf of our clients, we have found that the foregoing risks are increased due to poor due diligence, oversight, or control on the part of the financial institution.

Let us now give consideration to each of the Risk Areas, with respect to the risks posed by Social Media. Suggestions are emboldened in each synopsis.

The Rules of Operational Risk

Recently, I spoke with several clients who had attended mortgage industry conferences. Each one of them pointed out the very same fact: operational risk and regulatory compliance are the most prominent subjects being discussed. Thinking of learning more about new loan products and services, they left these conferences wondering about how they would ever be able to implement all the regulatory requirements being placed on them. As an old friend who runs a mid-tier, mortgage banking company said to me, "I came as a mortgage company and left as a compliance company!"

One of them said, "you know, Jonathan, you're sort of in the 'cat-bird seat' now, since you were among the first to predict that mortgage compliance would oneday dominate how we originate loans." I'm not sure if that was a back-handed compliment, but I appreciate the sentiment, nonetheless. At least LCG tries to lift some of the regulatory burden borne by our clients and free up their time to do what they do best: originate loans.

That said, let's acquaint ourselves with operational risk and how to put some structure into risk management.*

IN THIS ARTICLE

Framework
Controlling Credit Risk
Four Basic Rules
Six Even More Basic Rules
Articles and Newsletters

_______________________________________

Framework

First and foremost, compliance decisions should be made not only on the basis of sound policy and regulatory mandates but also on the basis of how compliance procedures are viewed by regulators. Examiners want to see a financial institution enforcing existing regulatory requirements. However, they also are not antagonists on a witch hunt. They honestly want to product the kind of findings - good or bad - that will help a company to thrive. They do not get a thrill out of putting forth adverse findings.

Building a solid framework begins with cataloging the company's people, processes and technology, and continues on into deriving the means by which a stable policy is designed to formalize the way the company tracks operational risk and identifies those risks within the organization's personnel and departments. Tasking, tracking, and managing risk are central features of governance.

Companies large and small should implement operational risk frameworks that formalize their operational risk management. There really is no excuse, in this day and age - especially with ready access to information and guidance - that any size financial institution cannot position operational risk practices into the loan flow process.

Risk can't be managed if there is no framework through which to manage it.

Reviewing and formalizing an operational risk framework does not need to be a complicated exercise. The size, complexity, and risk profile of the financial institution will dictate the ways and means by which risk is managed.

Controlling Credit Risk

At the start of this year, I published an article about Controlling Credit Risk [PDF]. In the article I pointed out that risk is identifiable and measurable - and it can be controlled. To get a sense of how my firm goes about evaluating credit risk and the concurrent role played by risk management, I outlined two features of managing risk: Quantity of Risk and Quality of Risk Management.

And I concluded with a section, entitled Implementing Risk Management, in which I offered some guidance about how to use credit risk information effectively to fortify a financial institution.

I urge you to download and read it. [PDF] In formalizing a framework to manage operational risk, you need to get some idea of how firms like mine work with clients to ensure appropriate risk management strategies.

Four Basic Rules

(1) Analyze Processes. This requires creating a catalogue of the company's operational processes. This is always the first step. It can be presented like a flow chart or nested folders or in any form that makes sense to management, so long as it makes logistical and experiential sense. In effect, the analysis must reflect the way that the company actually conducts its business.

(2) Identify Risks. Now that processes have been analyzed, each process should be considered on the basis of efficiency, data integrity, and potential risks. This is accomplished through an internal audit, external audit, or designating a competent employee to conduct a generic self-assessment. Whatever the choice, be sure to standardize the evaluation method.

(3) Centralize Policies. Bring together all the company's policies and procedures. Take inventory and determine which policy statements are missing, which ones are outdated, and which ones may be redundant. The requirements of disparate policy statements may conflict with one another, so gather them all together and assess them as a group.

(4) Establish a Master Policy. At this point - having analyzed processes, identified risks, and centralized policies - we are able to draft a master policy. Such an approach is reflective of 'best practices' governance. The master policy sets forth the overarching set of policies and rules that govern the company's management of operational risk. It is the "map" that serves as a guide to the operational risk framework. Be sure that the master policy also provides 'track-back' features and identifies the "owners" of each risk area.

Six Even More Basic Rules

I mentioned above that the master policy is the "map" to the operational risk framework. But, as the philosopher Alfred Korzybski noted, the map is not the territory. Working through the four basic rules takes time and resources. Sometimes we can't even get to the Four Basic Rules, because we have not taken into consideration the Six Even More Basic Rules.

Here follows those six rules, without which an operational risk framework is not really attainable.

(1) Assemble the Management Team. Bring together the company's executive and senior management. Start a conversation about operational risk and how to create a top-down approach toward risk management. Do this at least annually.

(2) Make Lists. Before the management meeting, each member of the management team should draft a list - long or short - of not only the known operational risks but the potential or unexpected risks. Assume that "Black Swans" do happen! Managers should offer insights relating to their own operational area as well as any other areas of the company. An unaccounted for risk, actual or potential, could cause massive financial, strategic, legal, and regulatory damage.

(3) Detail the Risk. Specify the risk in as much detail as possible. State the consequences of risk failure. And, where possible, always provide a solution. If a risk is perceived, seek a way to mitigate or remove it. Don't waste time on solutions seeking a risk; concentrate on risks seeking a solution.

(4) Discuss Risk. In an open and conversational way, discuss the lists. Determine if there are coinciding or divergent perceptions of risk. Identify where there are gaps in knowledge or implementation. And encourage a discussion regarding perceived risk, to be sure that there is some general understanding about the levels of risk tolerance.

(5) Draft a Master List. Now build a consensus amongst the assembled management team. Create priorities to the various lists of risks provided by each participant. Determine the mitigation strategies that are acceptable, given the company's risk profile and risk tolerance.

(6) Work the List. Implement the Master List, which may include the Four Basic Rules outlined above, but may just form sufficient guidelines and directives to establish appropriate means to manage operational risk. Appoint a member of the management team to monitor the Master List and update the list for those risks that have been resolved or mitigated.

Articles and Newsletters

_______________________________________

* Jonathan Foxx is the President & Managing Director of Lenders Compliance Group

The Cost of Consumer Financial Protection

Recently, I met with several accomplished compliance professionals for lunch. There was considerable discussion about the continuing growth of the regulatory frameworks, the bureaucracies to maintain them, and economic burden on financial institutions. *

One individual expressed the importance of financial protection of the consumer, while recognizing that such protection causes incremental compliance requirements; another individual agreed that such protection was needed, but worried that the costs to provide that protection would ultimately be borne by the consumer through increased pricing. 

In a way, these views reflect an ethical dilemma, and I would like to explore this seeming conundrum and offer a resolution.

IN THIS ARTICLE

An Unfettered Market
Pricing
Framework
Regulations
Protecting the Consumer
"Remember that credit is money."
Ethical Dilemma
Discussion Forum

An Unfettered Market

There is no political economy that we know of, since the dawn of recorded history, in which an unfettered market has existed.

Theories abound about how such a market might function. Whether we term such markets as "unfettered" or use the more emotionally appealing word "free," these markets are nonetheless only theories, howsoever popular in the public mind, and have virtually no extrapolation into economic reality. Better to call such theoretical legerdemain "utopian markets" and leave them to their rightful place in speculative philosophy and treatises on metaphysics.

Of course, utopias are attractive and always will be, even if we instinctively know that their viability is inherently unsupported by human experience and their imagined structure is ultimately dissolved in the unsentimental crucible of human history.

Pricing

All markets are a remunerative way of exchanging information, which we call goods and services. Pricing is that information means by which markets communicate value relative to goods and services. And pricing is communicated through the conveyance of planning.

Markets contain an element of planning - some in extreme, others much less so. The plan, or the framework, is often in control of market participants by virtue of the very act of pricing. It is not possible to remove pricing from a market. Even a market predicated on bartering utilizes the "quid pro quo" as its informational pricing signal.

Framework

In the absence of a framework there is no market. It is not the framework that encourages commerce; rather, it is the commerce itself that encourages the formation of the framework. Innovative commerce often bleeds through and beyond an old framework, thus creating the need for a new framework.

And there is often reactionary resistance to the new framework. Those market participants who are paying attention to the informational signals of a new market are already finding ways and means to act in the new framework, while those whose commerce has not kept pace with innovation tend to resist the change mightily, hopelessly trying to preserve what they have by "fighting the tape."

Regulations

Over the years I have found that the word "regulations" has become a euphemism for all manner of mischief perpetrated by politicians and market participants. Notice I differentiate the two: while some politicians may be market participants, most market participants are not politicians. Yet politicians spend quite a bit of their time crafting regulations! The mischief takes the form of viewing regulations as not only coercive (which they are) but also capricious (which they are not).

Both the politicians and the market participants rail on and on between and amongst each other about the coercion and the capriciousness of regulations, yet none of them ever really defines what actually is an efficient regulation. That is because, often, neither side has any idea how best to define such a thing.

But I'll define an "efficient regulation" right here and now:

An efficient regulation is the means by which the framework is preserved. Nothing more.

An inefficient regulation is the means by which the framework is destroyed. QED.