LAS VEGAS–Credit unions and CUSOs are being told there are some terrific new opportunities for growth now available—such as generating new loan volume by partnering with companies such as Tesla and with numerous fintechs—but those opportunities come with risks and other issues CUs may not realize, according to a panel of experts here.
Speaking to the NACUSO Network Conference here on “Hot Topics for CUs & CUSOs in 2021,” five attorneys with the firm Messick Lauer Smith covered a broad spectrum of new and changing laws, the upsides/downsides of new loan sources, the temptations and risks in social media, how to “get more bang for the buck,” and more.
The panel included Brian Lauer, Michael Mulvey, Mike Heller, Amanda Smith and Jennifer Winston. Here’s a look at how each of the attorneys addressed the various “hot issues” in CUSOs and what they said credit unions need to watch out for.
A ‘Really Good Rule’
Lauer hailed the recent approval by NCUA of the new CUSO rule, which essentially allows a CUSO to now make any type of loan approved for federal credit unions directly to members.
“What this does is give credit unions more access to national lending operations,” said Lauer. “There are a lot of fintech disrupters in the space looking to bring unsecured loans to credit unions. With this new rule you can collaborate together in a CUSO and get better access to certain providers, such as Tesla, because they only have to deal with one lender. The CUSO can then use that leverage to bring the loans to the credit unions. It’s a really good rule.”
While interest in investments and partnerships with fintechs has been hot for several years now, Lauer said what’s taking place is credit unions are now rethinking their strategic approaches to fintech investments, especially related to questions around making “good knowledgeable” decisions on where to put their money.
He noted that’s one reason Curql has just finished raising $252 million from credit unions in Curql Fund I.
Safeguards, Encryption, ‘Finders’ & More
Smith covered a handful of hot issues she said every credit union and CUSO needs to be giving their attention.
“As CUSOs plan to move into newer lending spaces, there are going to be more regulations and laws to be aware of,” said Smith.
Among those rule changes: tweaks to the Safeguards Rule that went into effect on Oct. 27 with a goal of strengthening protections around covered consumer financial information.
“Just as a reminder, the Safeguards Rule came about because of Gramm Leach Bliley (Act),” she explained. “So, non-public personal, information to be protected. The new rule includes very specific standards and criteria to comply with.”
That includes coverage as it applies to financial institutions, even though “financial institutions” in this case does not necessarily mean a credit union or a bank. Instead, it’s the type of financial institution over which the Federal Trade Commission would have jurisdiction, such as mortgage lenders, payday lenders, mortgage brokers and investment advisors.
“So, if you’re dealing in a financial service and you are not otherwise regulated by a federal regulator--and contrary to what it feels like, CUSOs are not regulated by NCUA--you need to find out if you might be covered by this new rule,” said Smith. “The rule also expands the definition of financial institutions to ‘finders,’ which is where you bring together parties for financial services. It does narrow the scope a bit, because it’s just for personal, family or household purposes and does not get into realm of consumer transactions.
“Also, the rule is just concerned with nonpublic personal information of consumers with whom you have an ongoing financial relationship,” Smith continued. “So, if you are servicing a loan, it’s not concerned with a product or service obtained in conjunction with an isolated event.”
Also Deserving Attention
Other aspects of the new rule that deserve attention, said Smith:
- A written security program has always been required but the new rule has several new requirements.
- One of the criteria is the appointment of a “qualified” individual to oversee and implement an organization's information security program. “What ‘qualified’ means is going to depend on the size and complexity of your credit union based on the volume of the non-public personal information and its sensitivity. It can be an employee of an affiliate or a service provider.” This individual has to report to the board of directors at least annually and provide a report.
- An organization must perform a written risk assessment designed to meet certain risks. “There is no specific methodology in the new rule,” said Smith. “The new rule requires you to perform annual penetration testing and vulnerabilities testing every six months. You must encrypt consumer information when it’s in transit and while it’s at rest. That’s a significant change.”
- The new rule requires not just oversight of service providers, but also an assessment of those providers.
- The new rule also requires financial institutions to develop secure disposal of consumer information no later than two years after the last date that information was used. Who has access to that information in both electronic and paper form must also be logged.
Vaccines, the CFPB, COVID & More
Winston gave her NACUSO audience an overview of several developments, some of which are still ongoing.
For example, Winston noted that when it comes to vaccinations for COVID, any credit union or CUSO that is a federal contractor in any way now has until Jan. 4, 2022 to identify and implement their vaccine and/or testing policies. A new, related OSHA rule has already been temporarily stayed by circuit court and a ruling is expected pretty quickly.
Separately, Winston said it’s apparent the CFPB intends to become a bigger presence in financial institutions’ lives under its new chairman, Rohit Chopra, who was very active in his former role on the Federal Trade Commission board and who is “expected to be very active now.”
Winston noted the CFPB has already rescinded a number of rule rollbacks implemented under the Trump Administration, including some aspects of rules such as UDAAP. “We’re going to see a return of regulation through enforcement,” said Winston.
Winston further noted the CFPB will be focusing on fair lending, COVID and COVID recovery, redlining, and fintechs, where there are concerns consumer protection loopholes are being taken advantage of.
One Bank Feels Crackdown
When it comes to fair lending, she noted the CFPB has recently cracked down on one bank in Houston—a diverse market—that was found to have an all-white marketing department, had branches in mostly white neighborhoods, and which had mortgage originators that were mostly white.
“They were penalized for redlining,” said Winston. “You are going to want to make sure where your branches are, that in your marketing you are using diverse photos and that you are not turning away potential borrowers just by what they are seeing.”
When it comes to COVID, Winston said the CFPB is looking at how lenders are handling servicing and loss mitigation. “That is going to be an issue going forward for everybody.”
#SocialMediaRisks
Meanwhile, risks related to social media usage have “become much more prevalent now that people are not coming into branches.” Among the social media issues Winston urged credit unions to be “mindful” of:
- “Social media is a great way to reach out but every time you send anything out it’s an advertisement. So, if there are any trigger terms, you need to follow Reg Z, Truth in Lending, NCUA’s official advertising statements” and more.
- If doing Instagram, Twitter or Facebook, CUs/CUSOs must take into account all those platforms have rules and regs to be aware of.
- “I see a lot of sweepstakes and promotions,” said Winston. “Make sure you don’t have an illegal lottery. There has to be a free way to enter. That’s going to be a criminal charge and that’s every state.”
- Winston said one of the most important issues to be giving attention is “privacy. You cannot identify who it is you’re actually talking to. Don’t share any information. Get that conversation off-line. Get them on the phone or into the branch. The best way to make sure this doesn’t happen is to have a very robust social media policy. We see a lot of issues in mortgage lending. We see things being posted that don’t have disclosures. Your policy should be that nothing is posted without being approved.”
- Any credit union/CUSO that is advertising something that leads to any conversation that continues online must be aware of disclosures, said Winston. “Move the conversation somewhere else.”
- Credit unions should not reach out via direct messages. “That’s where you open yourself to fair lending risk.”
- The Fair Debt Collections Practices Act went into effect Nov. 30. “That does allow you to communicate online and in social media, but there are still disclosure rules. The conversations must be private. You cannot try to trick them into friending you. You can reach out to their friends, but it’s the same as reaching out to a family member now. You can’t say why you are reaching out, just that you are trying to contact that person.”
Loan Participations & Eligible Obligations
While acknowledging it’s a “heavier issue,” Mike Heller urged CUSOs and credit unions to be giving special attention to rules around loan participations and eligible obligations, especially as fintechs present a tempting source of new loan volume.
“Credit unions can’t buy loan participations or eligible obligations from CUSOs unless they are in accordance with the two rules,” Heller said, reminding that credit unions can buy loan participations from CUSOs, other credit unions, federally insured financial institutions and even state and federal agencies.
“Eligible obligations can be purchased from any source as long as the purchase is in accordance with the eligible obligations rule and the credit union’s own policy,” he said.
With loan participations, any kind of loan can be participated as long as the credit union itself can make the type of loan.
Heller noted that when it comes to retention, the loan participation rule requires FCUs to retain at least 10% of the outstanding loan balance for life. For all other eligible organizations, it’s 5%.
For eligible obligations, typically those are whole loan purchases, but if that is not the case there is no minimum retention requirement,” he said before outlining a number of other specifics around both types of investment.
Creating a Holding Company
There is another issue credit unions and CUSOs should consider, and that is utilizing a holding company structure to make CUSO investments, according to Mulvey.
“We advise new clients to do this so as to have a dedicated board to vet and facilitate a credit union’s CUSO investments,” said Mulvey. “In operational CUSOs you can use your employees with expertise in these areas and then they just report to the holding company you set up. It helps with the cap on those investments. If you have some collaborative efforts that are really picking up steam you can use that to invest in some other areas and get some more bang for your buck.”