B/A Access Magazine for December 2020

Sunset Valley ParkwayACCESS December 2020 The Magazine for Banking Professionals Fair Lending, UDAAP, and Technology – How Do We Comply? by Julia A. Guঞerrez Oltorf Street

TABLE OF CONTENTS ACCESS 2 TABLE OF CONTENTS | MASTHEAD December 2020 Welcome to ACCESS Magazine The Magazine for Banking Professionals by John Berteau, Editor, ACCESS Magazine MAGAZINE STAFF 3 BOARD OF DIRECTORS Thank you for your continued guidance and support from the Bankers Alliance staff 4 FEATURE ARTICLE MAGAZINE MAGAZINE Fair Lending, UDAAP, and Technology – STAFF WRITERS How Do We Comply? Julia A. Gutierrez by Julia A. Gutierrez, Compliance Officer Editor-In-Chief Darlia Fogarty John Berteau Ilya Kotlyanskiy Tim Dominguez Associate Editor Traci Cavaness Chance Williams 6 DIRECTOR'S ARTICLE Who is Responsible? Art Director by Darlia Fogarty, President, Compliance Alliance Stevie Black President 8 HOTLINE FAQS Darlia Fogarty Membership-driven Q&A from our Hotline by C/A Staff 10 REGULATORY ARTICLE FINE PRINT Don't be StrongARMed by Discount and Reward Programs ACCESS is a monthly magazine produced by the staff of Bankers Alliance, a family of bank compliance services by Ilya Kotlyanskiy, Associate General Counsel for community banks of all sizes across the United States. Our purpose is to educate our membership on current bank 11 SECURITY ARTICLE compliance issues and to promote the benefits of membership, FinCEN Guidance on Detecting COVID-19 as well as showcase our services, tools, products, trainings and Unemployment Insurance Fraud webinars. Contact Bankers Alliance at: 203 W. 10th Street, by Tim Dominguez, Associate General Counsel Austin TX 78701 or by calling: (833) 683-0701 or at: [email protected] ACCESS magazine and the articles herein do not nor are 12 BOOKMARK & SAVE they intended to create an attorney-client relationship A list of our most helpful tools based on member or a representation regarding any potential engagement. inquiries The comments are not intended as legal, accounting, or by C/A Hotline Staff other professional advice. If such advice is required, you should consult with your own professional advisor. Articles may not be reproduced or reprinted without the 13 R/A FIELD NOTES expressed written permission of Bankers Alliance. Flood Rules and Tools Bankers Alliance does not discriminate on the basis of by Traci Cavaness, Bank Reviewer race, color, national origin, gender, age, religion, disability, political beliefs, sexual orientation, or marital/familial status. 15 NEW AND UPDATED TOOLS & PRODUCTS Survey of most recent additions and updates Copyright © 2020 by C/A's Product Team Find us here at: www.bankersalliance.org 2 | A C C E S S | December 2020

BOARD OF DIRECTORS Bankers Alliance is proud to recognize our partnership with these great State Bankers Associations as we work to guide and suppport our members and theirs. Scott Latham Paul Hickman Lorrie Trogden Don Childears Alex Sanchez Ballard Cassady ABA BARAKANNSAKS ERS ASSOCIATION ALABAMA BANKERS ASSOCIATION Trent Wright Tom Mongellow Chris Pinkham Kathleen Murphy Rann Paynter Cary Hegreberg Richard Baier Kristy Merrill John Anderson Peter Gwaltney Rick Clayburgh Mike Adelman Roger Beverage Linda Navarro Duncan Campbell Curt Everson Colin Barrett Chris Furlow Howard Headlee Bruce Whitehurst Glen Simecek Steve Andrews Sally Cline December 2020 | A C C E S S | 3

FEATURE ARTICLE Fair Lending, UDAAP, and Technology - How Do We Comply? by Julia A. Gutierrez, Compliance Officer One of the biggest challenges when it comes to Fair Lending and UDAAP is the broad and expansive cover- Fair Lending and UDAAP are vital areas of focus for finan- age. The broad range coupled with the use of technol- cial institutions of all sizes and complexities across the ogy and banking services means that financial institu- country. Many banks have found themselves in hot water tions really need to evaluate their program for any hint for failure to comply with the requirements or simply or risk of a potential violation. It is important to break unintentionally violating the very purpose of the rules down the definitions and requirements of each of the and regulations. When you add the use of technology to rules and regulations to ensure a strong foundation of support and enable banking and financial services, there understanding as financial institutions evaluate and can be an increased risk of violating the requirements monitor their own policies, procedures and practices. or prohibitions of these regulations. As Fair Lending and UDAAP continue to be regulatory priorities, it is critical Fair Lending that financial institutions not only understand the regu- Consumers are protected by the Fair Housing Act (FHA) latory expectations for each of these hot topics, but that and the Equal Credit Opportunity Act (ECOA) which they are aware of the risks associated and actually comply implement the prohibition of unfair and discriminatory with the requirements. Financial institutions who fail to practices. The FHA prohibits discrimination based on do so could be hit with stiff penalties. 4 | A C C E S S | December 2020

six main factors – race or color, national origin, religion, actions against a protected class or prohibited factor. sex, familial status, and handicap, in residential real This includes the bank’s practices, whether intentional estate related transactions. The ECOA, with similar or unintentional, which may cause a disadvantage to a prohibitions of discrimination, extend beyond resi- protected class. dential real estate transactions and include all credit transactions. The ECOA prohibits discrimination based So, what type of discrimination should a financial insti- on eight factors – race or color, national origin, religion, tution consider when implementing technology options sex, marital status, age (provided the applicant has the or banking and financial services? Financial institutions capacity to enter into a contract), an applicant’s receipt should consider all levels and types of discrimination. of income from a public assistance program and an If a bank has a lending policy in place which is intended applicant’s exercise of any right under the Consumer to be equal across the board, this could have a nega- Credit Protection Act. tive impact on certain applicants, meaning a disparate impact. For example, a financial institution may have By title alone, Fair Lending is often thought to be lim- a policy in place that prohibits extending credit for ited to pricing or underwriting; however, Fair Lending less than $50,000 for single family homes. This policy covers so much more than just the lending phase. It could unintentionally exclude a group of applicants who should be thought of from a “full circle” perspective, have lower home values or a lower income than other meaning every step of a transaction from start to finish. applicants. A financial institution may have implement- Basically, from advertisement to payoff. Fair Lending is ed such a policy to ensure equal treatment or lending a collection of rules and regulation with an overall goal which is fair, however, the neutral policy had unin- of providing exactly what it says, fair – lending. One of the first steps in ensuring Fair Lending is prohibiting dis- Fair Lending, UDAAP, and Technology — continued Pg. 7 crimination on all levels. This goes beyond purposeful December 2020 | A C C E S S | 5

DIRECTOR'S ARTICLE Who is Responsible? For the regulators to support ratings that reflect a lack of oversight claim, they must show the following: 1) direc- by Darlia Fogarty, President, Compliance Alliance tors knew or should have known that violations of law or improper conduct were occurring, 2) directors did not Often in board meetings, when describing the root cause take any steps to prevent or remedy the misconduct, and of an audit or exam finding, the question of responsibility 3) that their failure to be informed caused the violations. arises. Determining who is responsible for the oversight While that may seem like a tall order to fill, we see more of that area is as important as determining the action and more that regulators are asserting a lack of oversight that caused the issue. However, to a regulator, ultimate claim against bank’s boards. responsibility always falls directly in the lap of the board of directors. To prevent a lack of oversight claim, the board should have documentation supporting their involvement in In fact, board and management oversight is always at the fundamental functions such as the monitoring of bank top of the list when regulators or auditors visit a bank be- management and how they are staying informed of the cause the decisions coming from the board directly impact bank’s activities. Not only should the board be aware that the overall rating and condition of the bank. Remember, oversight has regulatory implications, but also that there the board is tasked with hiring competent management could be legal ramifications in this area. and since the condition of the bank is a direct result of management of staff as well as products and services the If a legal claim is made for lack of oversight, a judge will buck stops with the board. evaluate the issue under the business judgment rule and/ or the duty of oversight. The law provides a distinction The statement used by Dr. Albert Schweitzer, “Example between these two scenarios: 1) the business judgment is not the main thing in influencing others, it is the only rule, where the board decides there is no problem, and thing,” sums it up in one sentence. 2) the duty of oversight, where the board knows about a problem but chooses to ignore it. In the first case, when If regulators have any inkling the board is not being the board is faced with a situation and makes an informed informed or not giving proper attention to all areas of a decision, even if the decision results in a monetary loss, bank’s operation, there will be concern. The expectation the business judgment rule will protect the board, be- of the regulators is for the bank’s board to establish a cause they made a decision on an informed basis. The tone at the top of the organization to include high ethical protection provided by the business judgment rule is not standards that not only represent the bank’s commitment to the service of their communities and customers, but to WhUosiinsgRCeospmomnistitbelee?s —— ccoonnttiinnuueedd PPgg.. 1144 stay compliant with all laws and regulations. This takes us back to the reference of Schweitzer, as the board sets the tone by being the example for senior management who in turn sets the example for the rest of the staff. 6 | A C C E S S | December 2020

FFaairirLLeennddiningg, ,UUDDAAAAPP, aanndd TTeecchhnnoollooggyy ——cforonmtinPuge.d5from Pg. 5 tending consequences. Other discriminatory examples The Consumer Financial Protection Bureau (CFPB) has may include redlining, a type of disparate treatment, the authority of these acts or practices, as required whereby a financial institution provides unequal access by the Dodd Frank Act. Despite the CFPB having the to terms of credit. Another example of discrimination authority, a regulation has not been created to replace would be a financial institution offering a credit card the Federal Reserve Board’s repealed Regulation AA. limits up to $3,000 for applicants under the age of 60, Therefore, financial institutions should still rely on the but only offering a $1,500 for applicants over the age guidance within the repealed Regulation AA as well as of 60. It is imperative that financial institutions con- issued in the FTC Act Section 5, the Dodd Frank Act sider not only overt or blatant discrimination, but that §1031 & §1026, 2014 Interagency Guidance Regarding they consider discrimination based on impact. An area Unfair and Deceptive Practices and the CFPB’s exam in which regulators are placing a great deal of focus is manual which in combination define UDAAP, set the digital marketing to prevent redlining risk. Fair lending standards for compliance, define, provide, and include risks will exist in any advertising platform examples of prohibited acts and practices, that allows for targeting based on geogra- and provide financial institutions with regu- phy, demographics, or any other prohibited Our review group lator expectations. basis characteristic. If a financial institution is now offering uses digital marketing or is considering stand-alone One of the biggest challenges as is relates using this type of marketing, Fair Lending Pre-Closing to UDAAP is its broad scope, but also hav- should be at the forefront of their risk TRID Reviews. ing a clear understanding of what is defined considerations. Financial institutions using as unfair, deceptive, and abusive acts and or considering digital marketing should be practices. For purpose of UDAAP, unfair addressing questions such as: will include activity that causes substantial injury, which cannot be reasonably avoided, • How does the bank and/or the program and it not outweighed by countervailing target your digital advertisements? —— benefits to the consumer or competition. • Is the bank actively documenting its Deceptive is the act or practice of repre- risks? Call the B/A Team senting, omitting or an act that is likely mis- • Does the bank know all its social media leading to a consumer and is likely to affect vendors and digital advertisers? Do they directly at a consumer’s choice. And finally, abusive is understand Fair Lending and the poten- an action that materially interferes with the tial risks? 833-683-0701 ability of a consumer to understand a term • Does the bank or will the bank analyze or condition of a product or service, takes its ad campaigns after the campaign unreasonable advantage of a consumer’s finishes to identify any potential risks? lack of understanding about material risks, Financial institutions should consider all areas of the costs or conditions or service. Because these defini- lending function to determine whether Fair Lending tions are so broad, it is imperative that lenders have a practices are implemented throughout each step of the clear understanding of the UDAAP, its pertinent defini- process. tions and regulator expectations. UDAAP Managing the Risks UDAAP is often thought to be a catch-all since it is so When it comes to technology or banking and financial broadly applied. UDAAP basically prohibits financial services, financial institutions need to be sure they institutions from engaging in unfair, deceptive, and/ clearly understand the definitions, the purpose and the or abusive acts and practices. Activities which violate expectations of the rules and regulations as they relate UDAAP expectations often violate other laws or regula- tions as well. Julia A. Gutierrez, Compliance Officer Fair Lending, UDAAuAthPo, ranpdroTfeilcehhneorleogy — continued Pg. 14 December 2020 | A C C E S S | 7

HOTLINE FAQs QUESTION #1 Q: Are personnel required to do annual training if they are a mortgage loan originators? A. Under the SAFE Act, there are no specific annual training requirement; however, MLOs are required to satisfy an- nual continuing education requirements. Regulation Z requires periodic training for loan originators (which oftentimes is used interchangeably with MLOs, although the two are defined differently), so while annual training is not required, periodic training is required. Since the term “periodically” is not defined in Regulation Z, and because many other train- ings are given annually, it is common for banks to train loan originators annually. To satisfy annual continuing education requirements, which must include at least 8 hours of education approved by the NML- SR. The 8 hours of annual continuing education must include at least: (i) 3 hours of Federal law and regulations; (ii) 2 hours of ethics (including instruction on fraud, consumer protection, and fair lending issues); and (iii) 2 hours of training related to lending standards for the nontraditional mortgage product marketplace. 12 CFR § 1008.107(a)(2): https://www.ecfr.gov/cgi-bin/text-idx?SID=dc103ebf9e4d2048a35228719da72320&mc=tr ue&node=pt12.8.1008&rgn=div5#se12.8.1008_1107 (iii) Provide periodic training covering Federal and State law requirements that apply to the individual loan originator's loan origination activities. 12 CFR § 1026.36(f)(3)(iii) https://www.consumerfinance.gov/rules-policy/regulations/1026/36/#f-3-iii QUESTION #2 Q: If a promissory note is styled in the name of John and Jane Doe, each Individually and as Trustees under the John and Jane Doe Living Trust, will TRID apply? A: Assuming that the loan would otherwise be subject to TRID, the fact that it is made to a living trust will not matter, and TRID will apply Under Regulation Z, credit extended to a trust for tax or estate planning purposes is considered extended to a consumer rather than a non-natural person. Credit extended for consumer purposes to certain trusts is considered to be credit extended to a natural person rather than credit extended to an organization. Specifically: i. Trusts for tax or estate planning purposes. In some instances, a creditor may extend credit for consumer purposes to a trust that a consumer has created for tax or estate planning purposes (or both). Consumers sometimes place their assets in trust, with themselves or themselves and their families or other prospective heirs as beneficiaries, to obtain certain tax benefits and to facilitate the future administration of their estates. During their lifetimes, however, such consumers may continue to use the assets and/or income of such trusts as their property. A creditor extending credit to finance the acquisition of, for exam- ple, a consumer's dwelling that is held in such a trust, or to refinance existing debt secured by such a dwelling, may prepare the note, security instrument, and similar loan documents for execution by a trustee, rather than the beneficiaries of the trust. Regardless of the capacity or capacities in which the loan documents are executed, assuming the transaction is primarily for personal, family, or household purposes, the transaction is subject to the regulation because in substance (if not form) con- sumer credit is being extended. Commentary to 12 CFR §1026.3(a)-10: https://www.consumerfinance.gov/rules-policy/regulations/1026/Interp- 3/#3-a-Interp-10 QUESTION #3 Q: Q: Our bank has a loan closing today that is putting the property in an LLC’s name. The property is in a flood zone and flood insurance is already on file. However, the individual owner of the LLC is the named insured on the policy, 8 | A C C E S S | December 2020

QUESTION #3 –continued rather than the LLC. We advised the customer that the insurance policy needs to be changed so that the LLC is the named insured. The customer is working on getting this done, but it won’t be done in time for the loan closing. Is it a problem if the loan closes with the incorrect named insured? A: The owner of the building needs to be named as insured on the policy. While the flood regulation itself does not specify who must be the named insured, the NFIP manual indicates that the building owner must be named as insured. Tenants may purchase building coverage if required by the lease agreement, and the policy must include the building owner as a named insured. However, tenants may not purchase building coverage if the owner or another party has purchased NFIP coverage on the same building. Residential condominium buildings are an exception to this condition. April 2020 NFIP Flood Insurance Manual, p. 3.32, Section H(2): https://www.fema.gov/media-library-data/1585322 431240-91a0a8dd65609d0afb712669f1b07701/3_how_to_write_508_apr2020.pdf QUESTION #4 Q: Are OCC banks still required to provide physical copies of the CRA public file? A: The recent OCC CRA final rule included a change to the public file requirements such that banks are required to make the public file available through any means, and the bank is no longer required to specifically provide a physical copy in the bank, as long as the public file is available through some other means. Additionally, under the proposal, banks would no longer have been limited to providing public notice or the public file through physical means...The final rule, like the proposal, allows banks to make the public file available to the public through any means. The agency encourages banks to make the public file as accessible as possible and consider not charging fees for physical copies. Final Rule, pp. 189-90 at: https://www.occ.treas.gov/news-issuances/federal-register/2020/nr-occ-2020-63a.pdf QUESTION #5 Q: We have a flood determination that was ordered prior to receiving the customer’s intent to proceed. Once we receive the intent to proceed, is it a problem that the flood determination has an earlier date? If we do not receive the intent to proceed, we will not charge the customer for the flood determination. A: If you do it in that order, then it would be acceptable. The prohibition is on imposing a fee on the customer prior to receiving an intent to proceed, so if you're going to incur a fee prior to intent to proceed, the bank needs to pay for it, and then if the loan proceeds you can be reimbursed by the customer after the fact. As mentioned, if the loan does not end up proceeding, the bank would not be able to charge the customer. (i) Imposition of fees on consumer — (A) Fee restriction. Except as provided in paragraph (e)(2)(i)(B) of this section, neither a creditor nor any other person may impose a fee on a consumer in connection with the consumer's application for a mortgage transaction subject to paragraph (e)(1)(i) of this section before the consumer has received the disclosures required under paragraph (e)(1)(i) of this section and indicated to the creditor an intent to proceed with the transaction described by those disclosures. A consumer may indicate an intent to proceed with a transaction in any manner the consumer chooses, unless a particular manner of communication is required by the creditor. The creditor must document this communication to satisfy the requirements of § 1026.25. 12 CFR § 1026.19(e)(2)(i): https://www.consumerfinance.gov/policy-compliance/rulemaking/regula- tions/1026/19/#e-2-i December 2020 | A C C E S S | 9

. Post-Closing: Initial Rate Adjustment and Rate Adjust- ments with a Change in Payment Disclosures REGULATORY ARTICLE In the event that these preferred-rate ARM loans ex- Don't be StrongARMed by perience a change in rate and/or a change in payment, Discount and Reward Programs banks would still send the appropriate post-consumma- tion ARM notices required by Regulation Z. For instance, by Ilya Kotlyanskiy, Associate General Counsel when the rate adjusts initially, the Initial Rate Adjust- ment notice is required to be sent at least 210 days, but Providing rate discounts to mortgage customers offers no more than 240 days before the first payment at the a competitive advantage as well as presents the poten- adjusted level is due, just like it would be for a regular tial of expanding customer relationships, for example, ARM loan. Likewise, if there is a subsequent rate adjust- rate discounts tied to customers opening a deposit ment and corresponding change in payment, the notice account and enrolling into automatic payments. Addi- is required to be sent at least 60 days but not more than tionally, some lenders reward bank employees through 120 days before the first payment at the adjusted level providing preferential rates on mortgage products for is due (subject to conditions described in the regulation), the duration of the employee’s service with the bank. just like it would be for a regular ARM loan. Under these discount and reward programs, lenders will generally revoke the discount or reward upon the However, not all loans involved with discount or reward occurrence of some event after consummation, for programs become ARM loans. For example, if a borrower example, the discontinuance of automatic payments. enrolled in a discount program after consummation, such Upon revocation, the rate increases to the original an- that the discount was not part of the transaction, the nual percentage rate (APR), prior to the application of possibility of the rate increasing back to the initial rate the discount. Loans carrying these types of discounts after the discount was revoked, would not make this an are often referred to as preferred-rate loans, but de- ARM loan. Another example would be if the bank did not pending on the specific features of the programs, these revoke the discount or reward despite the borrower’s arrangements may result in the entire loan also being discontinued eligibility. considered an adjustable-rate mortgage (ARM). Despite the clear benefits of these programs, implement- At Application: ARM Disclosures ing such arrangements must be carefully considered in light of the requirements under Regulation Z, and Under Regulation Z a loan is an ARM if the APR may in- banks will want to ensure compliance with all regulatory crease after consummation. Importantly, the definition requirements. in Regulation Z only requires the possibility of the rate to increase after consummation, not an actual increase. Ilya Kotlyanskiy, Associate General Counsel If the rate may increase, limited ARM disclosures are Visit our Staff Page required to be provided to the borrower at the time of application. These preferred-rate ARM loans do not require all of the disclosures of a regular ARM loan, as the Consumer Handbook on Adjustable Rate Mortgag- es (CHARM) booklet is not required for preferred-rate ARM loans. Further, the ARM program disclosures do not need to include 1) a statement that the consum- er should ask about the amount of the interest rate discount, 2) a historical example or initial and maximum interest rates and payments, 3) an explanation of how to calculate the payments based on either the historical example or initial interest rate, or 4) a statement that disclosure forms are available for the creditor's other variable-rate loan programs. 10 | A C C E S S | December 2020

SECURITY ARTICLE FinCEN Guidance on Detecting • Customers that withdraw disbursed unemployment COVID-19 Unemployment insurance funds in lump sum by cashier’s checks; Insurance Fraud • When the customer receives or sends unemploy- ment insurance funds via a peer-to-peer application by Tim Dominguez, Associate General Counsel which are then wired to an overseas account incon- sistent with spending patterns of similar customers; Once the COVID-19 pandemic entered our sense of nor- and malcy, it did not take long for fraudsters to take advantage • IP addresses associated with logins for an account of the financially uncertain situation. As a result of the pandemic, millions of Americans have been impacted do not map to the location of the address where the unemployment insurance payment originated monetarily with unemployment insurance claims on the Under normal BSA procedures, when filing a Suspi- rise in almost every state. Both law enforce- cious Activity Report (SAR), a bank must ment and banks have detected fraud related provide all relevant information in the to unemployment insurance culminating in Virtual SAR. In these unemployment insurance the Financial Crimes Enforcement Network fraud situations, you should include the (FinCEN) releasing advisory FIN-2020-A007 Compliance key term “COVID19 UNEMPLOYMENT to alert financial institutions on this very INSURANCE FRAUD FIN-2020-A007” issue. Banks can get roped into this type of Officers - in field 2. You should also include the fraud in different ways. For example, some- keyword “unemployment fraud” when one could create a fictitious company and remote experts selecting SAR field 34(z) (Fraud-other). If produce false documents and wage records possible, you should also provide informa- to apply for unemployment insurance pay- guiding you & tion such as email and IP addresses with ments. Further, an individual could receive your program detailed timestamps, and related cyber unemployment insurance payments while his information. employer still pays the individual a reduced every day. The COVID-19 pandemic has proven for or unreported wage as a result of collusion between the two. banks, at the very least, to be incredibly unpredictable. In a world of progressively Find out more - Broadly speaking, the Bank Secrecy Act (833) 683-0701 evolving technology, scammers have the (BSA) places obligations on banks to report potential to take advantage of the instabil- suspicious activity to not only protect their ity in a growing number of ways. This no- own operations but also national security. tion only makes it increasingly significant COVID-19 related crimes and activities only for banks to heighten their vigilance to enhance a bank’s BSA obligations. Banks should look out be consistent with the spirit of BSA. Fraudulent claims for red flags regarding unemployment insurance fraud, for unemployment insurance benefits is only the latest consistent with the bank’s BSA program. While a single scam into which a bank can get roped. As more situa- red flag may not be indicative of illegal or suspicious tions come about in which fraudulent activity comes activity, FinCEN has published a list of red flags that could out of this pandemic, expect more advisories from indicate unemployment insurance fraud. These red flags FinCEN as to how to move forward. In the meantime, include but are not limited to the following: remain true to BSA’s general obligations of knowing and • Bank accounts that receive unemployment insurance understanding whom your customers. from a state other than the state where the customer resides; Tim Dominguez, Associate General Counsel Visit our Staff Page December 2020 | A C C E S S | 11

BOOKMARK & SAVE Bookmark & Save is back by popular demand for December 2020! – We surveyed our attorneys and these are the tools that bank compliance professionals find the most helpful; for themselves and for their staff. Characteristics of a Loan Request Matrix A matrix that indicates which disclosures are required by various regulations (B, C, V, X, Z, etc.) for consumer loans: primary dwelling, secondary dwelling, first liens, subordinate liens, secure by real estate, not secured by real estate, undeveloped land, and timeshares. Bookmark and save the link here: Characteristics of a Loan Request Matrix Sole Proprietor Account Opening Cheat Sheet A cheatsheet that indicates who owns the funds, how to style the account, whether to use SSN or EIN, what the CIP requirements are, POD beneficiaries, FDIC insurance, and more. Bookmark and save the link here: Sole Proprietor Account Opening Cheat Sheet Real Estate Checklists Checklists for auditing loan files which contain not only which disclosures must be given, but also the timing requirements of each disclosure, and whether the disclosures must be given at application, within three business days of application, prior to closing, at closing or after closing. Bookmark and save the links here: HMDA Banks Non-HMDA Banks Regulation O Flowchart A tool that allows banks to identify those individuals and entities subject to Regulation O and distinguish between them. This flowchart lists the different requirements for loans to insiders, directors and executive officers. Bookmark and save the link here: Regulation O Flowchart Funds Availability Reference Guide A summary of the different holds allowed by Regulation CC, the amounts required to be made available, and the number of days funds may be held. Bookmark and save the link here: Funds Availability Reference Guide 12 | A C C E S S | December 2020

R/A FIELD NOTES Flood Rules and Tools requirements do not apply? The first is for any state- owned property covered under a policy of self-insur- by Traci Cavaness, Bank Reviewer ance satisfactory to the FEMA Administrator (who publishes and revises the list of states falling under this Who is ready to talk about Flood Insurance? Bueller… exemption). The second circumstance in which flood Bueller… I know, it’s not a topic that many find exciting insurance requirements do not apply are for loans to talk about, but it is an area while conducting a lending secured by improved property which have an original audit in which we typically find banks struggling. Between principal balance of $5,000 or less and a repayment trying to keep up with which loans require flood insur- term of one year or less. Finally, detached structures (a ance, how much flood coverage is required, what consti- structure that is a part of any residential property but tutes a “reasonable time” for the notice to be sent, and is detached from the primary residential structure and trying to avoid violations and penalties, it can all be a little does not, itself, serve as a residence) are not required to overwhelming. But, have no fear! We are going to talk maintain flood insurance. Keep in mind, this exemption about each of these areas in a little more detail to help you applies only to residential purpose structures and does feel more comfortable with flood loans and I’ll even share not include agricultural, commercial, industrial, or other some great tools that we auditors use in the field. business purpose structures. So, let’s start with which loans require flood insurance. Now it’s time to determine how much coverage is suf- And before you skip over this part thinking, “any loan ficient. The required amount of flood insurance is the secured by property in a flood zone requires flood insur- lesser of 1) the loan’s outstanding principal balance, ance”, let me share with you the three (3) factors that must 2) the maximum coverage available under the NFIP, or be present for flood insurance to be required, as well as 3) the insurable value of the structures within a SFHA. three (3) areas where flood insurance requirements do not A great tool that we use in the field to determine if apply. appropriate amounts of coverage are in place is C/A’s Flood Insurance Minimum Coverage Calculation & Doc- Flood insurance is required for the term of the loan when umentation Calculator. three (3) factors are met: 1) the financial institution origi- nates, increases, extends, or renews any loan (commercial When financial institutions make, increase, renew, or or consumer) secured by improved real estate or a mobile extend designated loan (a so-called “MIRE event”), the home that is, or will be, affixed to a permanent founda- lender must mail or deliver a written notice to the bor- tion; 2) the improved property securing the loan is located, rower. Did you know this requirement also applies even or will be located, in a special flood hazard area (SFHA); if flood insurance is not available for the collateral? The and 3) the community in which the improved property is, notice should alert the borrower that the building or or will be, located participates in the National Flood Insur- ance Program (NFIP). Flood Rules and Tools — continued Pg. 14 So, what are the circumstances in which flood insurance December 2020 | A C C E S S | 13

Fair Lending, UDAAP, and Technology — continued from Pg. 5 to Fair Lending and UDAAP. Financial institutions should review what could have or should have been done differently, their lending programs, including advertising, lending practices, and adjust areas as needed to effectively manage your and lending goals. This may mean taking a closer look at bank banks risk. And remember, Fair Lending and UDAAP policies and procedures and evaluating the bank’s approach to violations can be both intentional and unintentional acts achieving not only their goals, but also compliance. Financial or practices. institutions need to evaluate their program, consider subjectivity when it comes to violations/compliance, consider the perception Julia A. Gutierrez, Compliance Officer of consumers, evaluate practices/procedures in hindsight to see Visit our Staff Page Who is Responsible? — continued from Pg. 6 determined by the results of the decision, but by the quality of member that regulators and auditors are reviewing or the process the board used to arrive at the decision. For in- examining these situations in hindsight, and we all know stance, when the board conducts an internal investigation into hindsight is 20/20. a matter and either takes action or consciously determines that action is not necessary, that decision, even if it ultimately turned Strong leadership from an informed and engaged board is out to be the wrong decision, will be protected by the business essential in maintaining a strong, stable bank. Oversight judgment rule. from the board of directors must be openly demonstrated to not only satisfy legal and regulatory requirements, but However, when a loss occurs from the board's failure to consider also to influence others throughout the bank and estab- a problem, whether, because there was no process in place or lish a culture of high ethical standards through leadership because there is no decision documented, the business judgment by setting the tone at the top. In short, the answer to the rule will not apply. Instead, directors may face liability for breach question, “who is responsible?” will always ultimately be of the duty of oversight, which means that directors should be the board of directors. aware of improper conduct, violations of law, or other actions that could result in harm to the bank. Darlia Fogarty, President, Compliance Alliance Visit our Staff Page When the board is faced with a situation and trying to decide if the situation is one that would warrant extra attention, re- Flood Rules and Tools — continued from Pg. 11 mobile home is, or will be, located in a SFHA; encourage the bor- Another tool that we use in the field that is helpful in rower to compare flood insurance coverages; and state whether monitoring or completing an internal review of the banks federal disaster relief assistance may be available. The rule states flood loans, is Compliance Alliance’s Flood Audit Work- the notice should be provided within a “reasonable time” before sheet. completion of the transaction. While there is no current defi- nition for what a “reasonable time” prior to close would be, the While this article does not contain a complete list of ways federal agencies generally regard ten days as a reasonable time to avoid violations and penalties, it is a good start in help- interval. We recommend as a best practice to send the notice as ing the bank become more comfortable with flood loans. promptly as practicable after learning of the flood status. A record Ultimately, the best way to avoid violations and penalties of receipt of the notice sent to the borrower must be retained as is simply to following the regulatory requirements. long as the bank owns the loan. Traci Cavaness, Bank Reviewer 14 | A C C E S S | December 2020 Visit R/A's Staff Page

C/A’s New and Updated Tools and Products We've created many new tools of late and updated a lot of others, so it's time to note the changes and call-out these important new additions. Solar Winds Data Breach Action Plan New tool which provides insight into the SolarWinds Orion platform cyberattack and including rele- vant resources for financial institutions to track and monitor, as well as a detailed action plan tailor- able to your specific institutions. To be used in conjunction with the Questionnaire (below) to assess the level of vulnerabilities posed to the bank and any third-party vendors. Third-Party Solar Winds Orion Platform Questionnaire New tool to assist in gathering information and potential exposure of vulnerabilities to third party pro- viders and the institution at large as a result of the SolarWinds Orion platform cyberattack. To be used in conjunction with the Action Plan (above) to assess vulnerabilities and begin mitigation efforts. 2021 Holiday Closing Signs Revised lobby signs for each holiday closing in 2021, to notify customers of holiday closings. COVID-19 Employee Prescreening Questionnaire Revised questionnaires to be completed by employees. Stay tuned for more updates through the end of the year into 2021! Make sure you’re prepared for your closings. Review Alliance is now offering reviews of your LEs and CDs prior to closing or delivery; all done remotely. Talk to us at (833) 683-0701 or [email protected] December 2020 | A C C E S S | 15

Strategies become successful decisions with proper guidance. Bankers Alliance – We’re now a family of services We’ve expanded to support and guide community banks of all sizes across the U.S. Virtual Compliance Officer A remote-based service that links up your bank with experienced compliance officers who are ready to help how, when and where you need it. Review Alliance Our bank review service starts with transacঞonal look-backs, but keeps right on going by idenঞfying best pracঞces and root causes. Compliance Alliance Our banks rely on guidance from our a‚orneys and compliance officers; whether it’s on our highly-regarded hotline, in our document reviews, or with the library of tools and training videos. Talk to our team today at (833) 683-0701 or [email protected] Holding Company of Compliance Alliance compliancealliance.com reviewalliance.com and Review Alliance bankersalliance.org