Don’t Forget About These Federal Consumer Protection Laws and Regulations
Various federal consumer protection laws and regulations compete for finite consumer compliance attention and resources. Understandably, financial institutions will normally focus the lion’s share of their attention on compliance with the highest-profile statutes and regulations, which are frequently associated with greater inherent risk. Consequently, certain consumer protection laws and regulations that don’t regularly attract headlines may be at risk of receiving insufficient attention or even of being overlooked altogether. This could potentially lead to supervisory violations and in some cases possibly enforcement action and civil money penalties. Here, we provide an illustrative overview of some of these consumer protection laws and regulations, providing information that should aid institutions’ corresponding compliance efforts.
Section 42 of the Federal Deposit Insurance Act1– Branch Closings
Does the institution plan on closing a branch?
Section 42 of the Federal Deposit Insurance Act (FDIA) requires an insured depository institution to notify the appropriate federal banking agency and its customers about a proposed branch closing2 at least 90 days before the proposed closing. The institution is also required to conspicuously post a notice on the branch premises at least 30 days before the proposed closing. Customers can be notified at least 90 days before a proposed branch closing via a regular account statement mailed to customers or a separate mailing.3
For interstate banks, if the branch being closed is in a low- or moderate-income census tract, the notice mailed to customers must include the mailing address of the institution’s appropriate federal banking agency and a statement that comments on the proposed closing may be mailed to that agency.4 Federal banking agencies do not have the authority to prevent an institution from closing a branch, providing that the notice requirements have been met5; however, if customer comments include nonfrivolous, specific reasons why a closure could adversely affect a community, the applicable agency is required to schedule a meeting. At the meeting, relevant individuals, organizations, depository institutions, and regulatory agencies can determine if the adverse effects from the closure can be mitigated.6
An insured depository institution is required to adopt policies for branch closings.7 Additional information to help an institution comply with this and other branch closing requirements is available in the Interagency Branch Closings Joint Policy Statement.8 As a final note, an institution should also be aware that in addition to FDIA requirements, branch closures can raise Community Reinvestment Act and fair lending considerations.
The Children’s Online Privacy Protection Act9
Does the institution operate a website or other online service directed at children or have knowledge that it is collecting or maintaining personal information from children?
The Children’s Online Privacy Protection Act (COPPA) regulates how online services and websites can collect, use, and disclose personally identifiable information from children under the age of 13. COPPA and its implementing regulation10 apply to “operators” (including banks and other financial institutions) of websites and online services that collect and maintain personal information of users and visitors or on whose behalf such information is collected or maintained for a commercial purpose.
Operators of websites and online services that are directed at children, or know that they are collecting or maintaining personal information from children, must do the following:
- provide written notice on their platforms of their practices relating to children for collecting, using, or disclosing information related to children11
- obtain verifiable parental consent prior to collecting, using, or disclosing personal information from children12
- provide parents with means by which to review the personal information collected from their children and direct that it no longer be maintained or used13
- establish and maintain reasonable data security standards to protect the personal information collected from children,14 and
- retain personal information collected from children only for as long as is reasonably necessary and thereafter delete such information while safeguarding against unauthorized access to or use of deleted information.15
In addition, COPPA prohibits conditioning a child’s participation in a game, prize offering, or other activity on the disclosure of more personal information than is reasonably required to participate.16
The Federal Trade Commission’s COPPA website provides detailed guidance and resources, including a six-step compliance plan that can help an institution determine if its website or online services are subject to COPPA.17
Regulation G18 — Disclosure and Reporting of Community Reinvestment Act-Related Agreements
Has the institution or its affiliates entered into any Community Reinvestment Act (CRA)-related covered agreements, and, if so, have those been appropriately disclosed and reported?
Regulation G, which implements Section 48 of the FDIA,19 applies when insured depository institutions and their affiliates enter into covered agreements with nongovernmental entities and persons (NGEPs) to fulfill their CRA obligations. This triggers a requirement that the institution “promptly” make those agreements available to the public, upon request,20 and to the appropriate federal banking agency within 30 days of a request or otherwise within 60 days of the calendar quarter in which a covered agreement is entered into.21 Institutions must also submit annual reports on such agreements to the appropriate federal banking agency.22 Regulation G also includes corresponding disclosure and reporting requirements applicable to NGEPs.
Covered agreements are written contracts, understandings, and agreements between insured depository institutions or their affiliates and NGEPs, where:
- the agreement is with an NGEP that has had a CRA communication23 before entering into the agreement
- the agreement is made in connection with fulfillment of the CRA;24 and
- the agreement relates to an insured depository institution or an affiliate
- providing to one or more individuals or entities (whether or not parties to the agreement) cash payments, grants, or other consideration (not loans) that have an aggregate value of more than $10,000 in any calendar year or
- making loans to one or more individuals or entities (whether or not parties to the agreement) in an aggregate principal amount of more than $50,000 in any calendar year.25
Regulation G includes examples of covered agreements and loan agreements that are not covered agreements.26
Homeownership Counseling Act27
Does the institution identify homeowners eligible for homeownership counseling and provide appropriate notice of the availability of homeownership counseling programs?
The Homeownership Counseling Act (HCA) requires creditors, including banks, that service loans secured by liens on single-family residences (regardless of the loan’s purpose) to provide notification of the availability of homeownership counseling to an eligible borrower who fails to pay any amount on the loan by the due date.28 The notice must inform the homeowner of the availability of any homeownership counseling services offered by the creditor29 and provide a list of U.S. Department of Housing and Urban Development (HUD) approved nonprofit counseling organizations or HUD’s toll-free number to obtain a list of such organizations.30
The HCA was amended in 200631 to require creditors to issue a HUD notice explaining the mortgage and foreclosure rights of servicemembers, and their dependents, under the Servicemembers Civil Relief Act.32 In addition, creditors are required to provide the toll-free Military OneSource number to call if servicemembers, or the dependents of such servicemembers, require further assistance.33 The notice, form HUD-92070, must be sent within 45 days from the date that a missed payment was due, unless the borrower pays the overdue amount before the expiration of the 45-day period.34
The HCA also requires prospective creditors to provide notice that completing a homeownership counseling program is required for otherwise eligible mortgage applicants to qualify for insurance pursuant to Section 2013 of the National Housing Act.35
These requirements are separate from homeownership counseling provisions in Regulation X, which requires that lenders provide applicants for federally related mortgages with a list of local homeownership counseling organizations.36
Regulation D37 — Reserve Requirements
Does the institution comply with requirements regarding the use of deposit accounts?
Among other monetary policy-related depository institution reserve requirements, Regulation D defines various categories of deposit accounts and includes rules regarding transaction limits, customer withdrawal notice requirements, and early withdrawal penalties.
Regulation D divides deposit accounts into two main categories: transaction accounts and nontransaction accounts. Under Regulation D, transaction accounts are limited to demand deposit, negotiable order of withdrawal (NOW), and automatic transfer service (ATS) accounts.38 Transaction accounts allow account holders/depositors to make unlimited internal (between accounts of the same party at the same institution) and external transfers. NOW accounts are limited to individuals, sole proprietorships, governmental units, and nonprofit organizations,39 and ATS accounts are limited to individuals and sole proprietorships.40
Nontransaction accounts include time deposit accounts,41 savings deposit accounts,42 and money market demand accounts (MMDAs).43 Because time deposit accounts are subject to early withdrawal penalties, if an institution failsto impose these as required, the account is no longer a time deposit (and must transition to a savings deposit account, if eligible, or to a transaction account).44 Savings deposit accounts and MMDAs are subject to limits on the number of transfers or withdrawals per calendar month or statement cycle.45 If these limits are exceeded, an institution is expected:
- to either prevent transfers and withdrawals that would violate the limits or monitor any such accounts;
- to contact customers who violate the limits more than occasionally; and
- for customers who continue to exceed the limits, either close the account and move the funds to a transaction account or discontinue the customers’ transfer and draft capabilities.46
The Federal Reserve’s Regulation D Compliance Guide to Small Entities47 and the Consumer Compliance Handbook48 provide additional background information on deposit account classification and related requirements.
Conclusion
Properly managing risk is key to promoting compliance with consumer protection laws and regulations. Generally, whether in connection with headline-grabbing topics or otherwise, the greater the associated inherent risk, the stronger an institution’s risk controls must be to effectively manage that risk. Accordingly, pursuant to an effective risk-focused consumer compliance management program, an institution is well advised to identify the full range of consumer compliance laws and regulations applicable, and related inherent risks, to its products, services, and practices. In turn, the institution’s risk management practices should correspond to the amount of associated residual risk identified. Specific questions regarding facilitating compliance with the list of potentially overlooked federal consumer protection laws and regulations in this article and others should be discussed with your institution’s primary regulator.
Endnotes
2 The notice requirement is subject to certain exception. Notice is not required for an automated teller machine (ATM) or other nonbranch facility that is closed or moved, for emergency acquisitions, and for branch relocations in the immediate area that do not substantially affect customers or the nature of the bank’s business 12 U.S.C. §1831r–1(e).
3 See 12 U.S.C. §1831r–1(b)(2)(B).
4 See 12 U.S.C. §1831r–1(d)(1).
5 See 12 U.S.C. §1831r–1(d)(3).
6 See 12 U.S.C. §1831r–1(d)(2).
7 See 12 U.S.C. §1831r–1(c).
8 See Interagency Branch Closings Joint Policy Statement, 64 Fed. Reg. 34844 (July 7, 1999).
9 See 15 U.S.C. §6501 et seq.
10 See 16 C.F.R. §312.
11 See 16 C.F.R. §312.4.
12 See 16 C.F.R. §312.5.
13 See 16 C.F.R. §312.6.
14 See 16 C.F.R. §312.8.
15 See 16 C.F.R. §312.10.
16 See 16 C.F.R. §312.7.
17 See Federal Trade Commission, Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business.
18 See 12 C.F.R. §207.
19 See 12 U.S.C. §1831y.
20 See 12 C.F.R. §207.6(b).
21 See 12 C.F.R. §207.6(b).
22 See 12 C.F.R. §207.7.
23 See 12 C.F.R. §207.3.
24 See 12 C.F.R. §207.4.
25 See 12 C.F.R. §207.2(a).
26 See 12 C.F.R. §207.2(b) and (d).
27 See Section 106(c)(5) of the Housing and Urban Development Act of 1968 (12 U.S.C. §1701x(c)(5)).
28 See 12 U.S.C. §1701x(c)(5)(A)(i).
29 See 12 U.S.C. §1701x(c)(5)(A)(ii)(I).
30 See 12 U.S.C. §1701x(c)(5)(A)(ii)(III).
31 See Section 688 of the National Defense Authorization Act for Fiscal Year 2006 (Pub. L. 109–163).
32 See 50 U.S.C. §3901 et seq.
33 See 12 U.S.C. §1701x(c)(5)(a)(ii)(IV).
34 See 72 Fed. Reg. 14130, 14131 (March 6, 2007).
35 See 12 U.S.C. §1701x(c)(5)(A)(ii)(II).
36 See 12 C.F.R. §1024.20(a).
37 See 12 C.F.R. §204.
38 See 12 C.F.R. §204.2(e).
39 See 12 U.S.C. §1832(a).
40 See 12 U.S.C. §371a.
41 See 12 C.F.R. §204.2(c).
42 See 12 C.F.R. §204.2(d).
43 See 12 C.F.R. §204.2(f)(1).
44 See 12 C.F.R. §204.2(c)(1).
45 See 12 C.F.R. §204.2(d)(2).
46 See 12 C.F.R. §204.2(d)(2).
47 See Board of Governors of the Federal Reserve System, Compliance Guide to Small Entities, .
48 See Federal Reserve Board, “Regulation D Reserve Requirements,” Consumer Compliance Handbook, .