All in Regulatory Update

On 1/29/2021, the CFPB issued a final rule that exempts certain insured depository institutions and insured credit unions from the requirement to establish escrow accounts for certain higher-priced mortgage loans (HPMLs). This final rule implements a requirement of the Economic Growth, Regulatory Relief, and Consumer Protection Act (EGRRCPA).

According to the CFPB’s release, the final rule takes effect upon publication in the Federal Register and exempts from the HPML escrow requirement any loan made by an insured depository institution or insured credit union and secured by a first lien on the principal dwelling of a consumer if (1) the institution has assets of $10 billion or less; (2) the institution and its affiliates originated 1,000 or fewer loans secured by a first lien on a principal dwelling during the preceding calendar year; and (3) certain of the existing HPML escrow exemption criteria are met.

On 1/15/2021, FinCEN issued a “Notice of Proposed Rulemaking; Reopening of Comment Period” to allow more time for comments to be received from their December 23, 2020 Notice of Proposed Rulemaking which requested feedback for potential new rules on certain transactions involving convertible virtual currency or digital assets with legal tender status. The comment period is reopened for 15 days for comments on the proposed reporting requirements and for 45 days for comments on the proposed requirements to report counterparty information and the proposed recordkeeping requirements. Written comments are now therefore due with respect to the proposed reporting requirements (except with respect to reporting of counterparty information) on February 1, 2021, and with respect to all other aspects of the proposed rule on March 1, 2021.

On 1/15/21, the Financial Crimes Enforcement Network (FinCEN) announced that Capital One was assessed a $390,000,000 civil money penalty for engaging in both “willful and negligent violations of the Bank Secrecy Act (BSA) and its implementing regulations.” According to their release, FinCEN determined and Capital One admitted to willfully failing to implement and maintain an effective Anti-Money Laundering (AML) program to guard against money laundering. Capital One also admitted that it willfully failed to file thousands of suspicious activity reports (SARs), and negligently failed to file thousands of Currency Transaction Reports (CTRs), with respect to a particular business unit known as the Check Cashing Group.

On 1/14/21, the OCC issued a final rule to ensure fair access to banking services provided by large national banks, federal savings associations, and federal branches and agencies of foreign bank organizations. In their release, the OCC explains that the rule codifies more than a decade of OCC guidance stating that banks should conduct risk assessment of individual customers, rather than make broad-based decisions affecting whole categories or classes of customers, when provisioning access to services, capital, and credit. The rule applies to the largest banks with more than $100 billion in assets that may exert significant pricing power or influence over sectors of the national economy. Under the rule, banks still determine their product lines and geographic markets and are free to make legitimate business decisions about what and whom to serve. The rule requires covered banks to make those products and services they choose to offer available to all customers in the communities they serve, based on consideration of quantitative, impartial, risk-based standards established by the bank. Under the rule, a covered bank's decision to deny services based on such objective assessment would not violate the bank's obligation to provide fair access. However, a covered bank's decision not to offer a specific kind of financial product or service or not to compete in a geographic market is unaffected.

On 1/12/21, the joint regulators (OCC, Fed, & FDIC) published a proposal in the Federal Register that would require banks to provide their primary federal regulator with prompt notification of any “computer-security incident” that rises to the level of a “notification incident.” The proposed rule would require such notification upon the occurrence of a notification incident as soon as possible and no later than 36 hours after the banking organization believes in good faith that the incident occurred. This notification requirement is intended to serve as an early alert to a banking organization's primary federal regulator and is not intended to provide an assessment of the incident.

On 1/5/2021, the CFPB’s Taskforce on Federal Consumer Financial Law released a report with recommendations on how to improve financial consumer protection. The Taskforce Report uses five interrelated principles that serve as the foundation for proposed systematic changes to the current legal and regulatory framework: consumer protection, information and education, competition and innovation, regulatory modernization and flexibility, and inclusion and access.

In early January of 2020, the OCC issued their annual report to Congress which provides an an overview of the condition of the federal banking system. The annual report can be beneficial to compliance professionals as it discusses the OCC's strategic priorities and details agency regulatory and policy initiatives.