6 Compliance Tips For Loan Estimate Revisions

By Sue Burt, Senior Compliance Consulting Specialist, Wolters Kluwer Financial Services

wk7When it comes to issuing a Loan Estimate under the TILA-RESPA Integrated Disclosure (TRID) rule, revisions are not permitted due to mistakes, miscalculations, and underestimation of charges caught after the fact.  However, the law does recognize that some situations can arise beyond lender errors that cause the original loan estimate to become inaccurate.

The Justifying Events

The law sets out six events that justify a revised Loan Estimate for purposes of re-setting fees and performing one’s good-faith analysis.  Those six events include:

  1. Changed circumstances that cause an increase to settlement charges
  2. Changed circumstances that affect the consumer’s eligibility for the loan or affect the value of the property securing the loan
  3. Consumer-requested changes
  4. Interest rate locks
  5. Expiration of the original Loan Estimate
  6. Construction loan settlement delays

Before considering each of these, it is important to review the definition of “changed circumstance” as this term impacts the first two triggering events.  Download the full whitepaper to explore specific case examples of the six justifying events, the timing for providing such revisions, and a review of the following few compliance tips.

Compliance Tips

wk1Collect all application information before issuing a Loan Estimate.  Revised Loan Estimates are not permitted simply because the lender failed to collect all six pieces of information required in the application prior to issuing the Loan Estimate.  For example, the failure to obtain the property address prior to issuing the Loan Estimate cannot be used as a reason to issue a revision if that address is later collected and impacts fees.

Collect complete, accurate application information.  Lenders should consider sequencing the application information requests to have sufficient information to issue an accurate Loan wk2Estimate the first time around.  In fact, they may request information above and beyond the six items that make up the definition of an “application.” For example, they may want to collect the consumer’s mailing address or the product the consumer is interested in prior to collecting the six pieces of required regulatory application information.  However, keep in mind, once the lender receives those six items, a Loan Estimate is triggered.

Also, recognize that it is important to collect as much information as possible from the consumer during the application stage so that the Loan Estimate disclosures are accurate.  Remember, lender errors and oversights will not justify a revised loan.  Put another way, a “bad” application is not a change in circumstances.

wk3Only fees affected by a triggering event can be re-set.  For good-faith purposes, only those fees impacted by the triggering event can be re-set.  The triggering events are not a license to issue a completely revised Loan Estimate and address other changes not affected by the event being relied upon.

wk4Courtesy loan estimate revisions.  The law does not prohibit issuing updates to a Loan Estimate to reflect changes not based on one of the six triggering events.  Many refer to these revisions as “‘courtesy” revised Loan Estimates.  The purpose of such revisions is more customer service oriented in nature and intended to keep the consumer updated on fee changes to avoid surprises at consummation.  However, courtesy Loan Estimate revisions cannot be used for purposes of re-setting fees to establish good faith.

wk5Record retention.  The TRID rule recordkeeping provisions require that documentation be maintained to support the reason for issuing a revised Loan Estimate.  Presumably, examiners will look for this supporting documentation when they review loan files and see revised Loan Estimates.  Lenders should keep records documenting the reason for revision, the original Loan Estimate, and the revised Loan Estimate.  This evidence of compliance should be retained for three years.

wk6Manage Revisions.  Lenders should implement some type of system to track and mange revised Loan Estimates.  This will be important for purposes of conducting one’s good-faith analyses.  It’s also important for purposes of tracking multiple revisions and determining at what point fee increases exceed the 10% cumulative tolerance threshold.

For more information, download “The Revised Loan Estimate: Changed Circumstances and Other Triggering Events.”  The whitepaper highlights when a Loan Estimate revision is permitted, the timing for providing such revisions, and a few compliance tips to consider regarding the revision process.

wolterskluwerlogoWolters Kluwer is NAFCU Services Preferred Partner for Consumer and Member Business Lending and Deposit Services for credit unions.  More education resources and contact information are available at nafcu.org/wolterskluwer.

 

Combat Social Engineering Fraud

Produced by Jay Slagel, VP of Risk Management at Allied Solutions

Due to a general lack of awareness, fraudsters are often successful in obtaining your account holders’ private information using various social engineering methods.  Because of this, it is essential that you raise awareness among your employees about the causes of social engineering fraud and the prevention measures your financial institution has in place to combat these attacks.

Social engineering fraud occurs in a variety of ways:

  • Social Engineering FraudPhishing attacks via email or phone, where the fraudster claims to be a person of authority to obtain confidential and personal information.
  • Impersonation of a fellow employee, friend, or vendor to gather personal and confidential account information.
  • Obtaining personal and confidential information from digital storage devices (such as thumb drives, phones, or CDs) or paper documents that were not discarded properly.
  • Offering prizes or gifts via phony emails or calls in exchange for private information and/or money.
  • Baiting is when a person leaves an infected storage device, like a thumb drive or CD, at a location where someone would likely find it to entice the individual to load the infected device onto their computer.
  • Phone phishing where the fraudster uses an interactive voice response system (IVR) to duplicate a message from the person’s financial institution, directing the account holder to input their confidential and personal information.

Credit unions can defend against social engineering fraud by changing their corporate culture through education and training. Employees should know how to recognize methods of social engineering and how to combat those attacks.

Actions your financial institution should take to combat social engineering include:

  1. Determine which employees have access to sensitive information, and may be targeted.
  2. Educate employees about ongoing threats.
  3. Verify that deposited checks clear before permitting a withdrawal or transfer.
  4. Establish a multi-level authentication process for financial transactions or account change requests that are not performed in person.
  5. Never open attachments or links in emails received from untrusted sources and do not forward these emails.
  6. Tell employees to be wary of any prizes or offers made over the phone or through email, especially those that offer to update, correct, or solve a computer issue or problem.
  7. Protect private information on documents or storage devices no longer needed before shredding or destroying.
  8. Conduct tests to determine where system vulnerabilities exist and promptly address those areas of weakness.
  9. Monitor social media outlets to reduce the chance of sensitive information being posted.

It is likely that one or more of your employees will be the target of a social engineering scheme, but taking proactive steps early and often will help your financial institution to remain protected from these fraud attempts.

Allied Solutions Logo

Allied Solutions is the NAFCU Services Preferred Partner for Insurance – Bond, Creditor Placed (CPI), Guaranteed Asset Protection (GAP), and Mechanical Breakdown (MBP); and rateGenius.  More educational resources and contact information are available at www.nafcu.org/allied

 

Cybersecurity Ratings: The Third Party Cyber Risk Management Solution

BitSight Cyber Lock

So, you have identified your top partners.  You have thoroughly evaluated their cybersecurity services in order to keep your members’ financial data safe and secure. But before you sit back and relax, you have to ask yourself “what about tomorrow?”

The Pitfalls of Traditional Evaluation Methods for Cybersecurity

Traditional methods of evaluating your partners may include detailed questionnaires and conversations, audits, and maybe you have even conducted some vulnerability scans. These are all sound methods for establishing whether your partners are on the right track, but they are only a start.

  • One-time snapshot. The problem with this type of evaluation method is it only gives you a snapshot of the organization at one small point in time. It would be the equivalent of checking the locks on your doors once and then not doing it again in the future.
  • Expensive. Numerous questionnaires and audits can become very costly very quickly. If you are a small credit union, it may not seem practical to spend the cash or the manpower on these efforts.
  • Regulation struggle. In addition to an ethical obligation to your members, regulators are creating new legal obligations aimed at third party risk management plans. The sooner you can get in front of this issue, the easier it will be.

Vendors, especially high priority ones that have direct access to your network or your most sensitive data, really need to be monitored for their security practices all the time. This may seem daunting or even impossible, but it doesn’t have to be. The key to locking up holes in your partners’ security is through security rating and monitoring solutions.

How Cybersecurity Ratings Work

Cybersecurity ratings work essentially like a credit rating company issuing a FICO score, but instead it issues a security rating. For example, companies can be rated on a scale from 250 to 900. A high number indicates a strong security performance and a lower security risk.

A security rating platform gathers and analyzes publicly available information and noted incidents to create its security rating. It considers things like spam propagation, malware propagation, botnet infections, and then calculates a rating. You will also be able to see where the infections and incidents relating to a company’s security are occurring.

Utilizing Ratings as a Resource

BitSightRatings2Cybersecurity ratings can be a very useful tool in prioritizing which vendors require the most attention from your credit union. A company with a consistently high score probably doesn’t need a tremendous amount of your effort, so you can allocate your time and budget to the vendors that are creating greater risks for you and your members.

In addition, this rating can be a valuable resource when having a more sophisticated conversation with your vendors about cybersecurity. If you are grappling with what questions to ask or what risk vectors you should be focused on, the security rating information can give you a road map to do that.

web logo.bitsightNAFCU Services and BitSight Technologies have partnered to provide an independent security monitoring service that provides continuous data on outside vendors’ security practices. If you would like to learn more about BitSight’s solutions for credit unions, or formulating a third party risk management plan, you can check out our webinar here.

Cybersecurity Awareness Month: Confronting the Scariest Threats to Your Credit Union

CyberSecurity_KCG

October is National Cybersecurity Awareness Month which means it’s an excellent time to make sure there aren’t any unseen forces within your credit union that have nefarious plans for your members’ money.

Earlier this year, Wired Magazine wrote about the biggest cybersecurity threats for 2015. Three of these are indeed scary prospects for the credit union industry, but the key is to make sure you are doing everything you can to prevent these scenarios:

  • Data Destruction: Malware exists that erases data and boot records, so it is vitally important to make sure you have an excellent data backup plan.
  • Bank Card Breaches: This is a threat that isn’t going away any time soon, so it is important to be moving towards tokenization technologies to prevent this. NAFCU has partnered with MasterCard to help credit unions move towards this. For more information you can check out this webinar from earlier this year here.
  • Third Party Breaches: The data breach at Target stores is an excellent example of why you need a strong Third Party Risk Management Plan. For more information on this, check our recent webinar or blog posts here or here.

The costs of cyber threats are no joke to financial institutions big or small. According to the National Small Business Association, 44 percent of small businesses have been the victims of a cyber-attack. Clearly, it is worth the investment to review how sound your security is. The following tips from the Department of Homeland Security are an excellent place to start.

Cyberattack Prevention Tips and Practices

  • Have a plan. According to staysafeonline.org, 59% of small and medium size businesses in the United States do not have a plan that outlines procedures for responding and reporting data breach losses.  A number of these plans are covered in various compliance frameworks that may already exist, but as shelf ware.  If this describes you, now is the time to formulate both short and long term plans.
  • Utilize the latest software. Make sure you have antivirus and antispywear and update it regularly.
  • Educate. Make sure that all of your employees are aware Cybersecurity_KCGof cyber threats and educate them on the steps they must take to help combat these attacks.
  • Invest in data loss protection software, use encryption technologies to protect data in transit, and use two-factor authentication where possible.
  • Passwords. Use strong passwords throughout your organization and have employees change them regularly.

Who Should You Call?

What should you do if you’re unsure if your organization is prepared to navigate this threat landscape? If you are not sure where your cyber security threats may lie or even where you should be looking, consider going to an outside vendor. NAFCU and Knowledge Consulting Group (KCG) have partnered to provide comprehensive cybersecurity solutions.

KCG provides expert services in penetration testing and cybersecurity advisory services. Their tests offer simulation of potential attack vectors and scenarios most likely to impact the overall credit union environment, from IT systems to social engineering. They provide risk management, governance, operations, and compliance services to help credit unions navigate the complexities of the evolving cybersecurity landscape.

So take an inventory of your practices, make a plan, and evaluate where your weak spots are.

Knowledge Consulting Group is a subsidiary of ManTech International. For more detailed information on penetration testing or cybersecurity advisory services, visit KCG’s preferred partner page.

Cyber Security Awareness Month: Third Party Cyber Risk Management

By: Jacob Olcott, VP of Business Development, BitSight Technologies

How not to become a “Target”
Thirdparty_cyberrisk_woman
October is cyber security awareness month, and there are few things more haunting to financial or retail institutions than the security breach that affected Target stores a few years back. The attack resulted in more than $40 million in debit and credit card numbers being stolen, and more than likely affected at least some of your members.

The scariest part of the security breach may be where it originated: its HVAC supplier. The attack highlights how important it is for financial organizations to have a well thought-out program to mitigate third party cyber risk.

Regulators are taking a closer look at third party risk management so the importance of employing best practices is not just practical, but legal as well.

Five Key Steps to Develop a Third Party Risk Management Program

Developing a risk management program doesn’t have to be difficult. There are five key points to consider for a plan, and several vendors and services that can help you to do so.

  1. Organize Internally. This means bringing together all teams that have an impact on, or are impacted by your cybersecurity or dealings with third party vendors. This would most likely include your legal, compliance, IT, and procurement teams.
  2. Identify and Prioritize Key Parties. It is important for credit unions to consider any third BitSight_identify_critical_vendorsparty that has either direct network connections to your organization or has access to sensitive data. This would include, but is not limited to, looking at your primary payment processor, largest software vendor, law firms, consulting firms, and benefits administrator. When prioritizing vendors, approach this from the position of your most sensitive data, likely your members’ financial data, and the level of access a third party has to that data.
  3. Evaluate your vendors’ security. This is traditionally done a number of ways such as using questionnaires, vulnerability scans, and audits. If you are not sure where to start, Shared Assessments is a good source that charges a fee for common questionnaires to send your partners regarding their cyber security efforts. If you are interested in developing your own questionnaire, the NIST cybersecurity framework is a good place to start. You can also do your own audits of your partners, but often companies will share their own documentation of audits they have done.
  4. Communicate. The importance of clearly communicating your expectations to your partners should not be overlooked. This should be done not only in writing in forms such as contracts, but verbally as well. It is important to develop a strong dialogue regarding your security concerns that is not just once, when you launch a partnership, but ongoing. The cybersecurity landscape changes on a daily basis so it is important for you and your partners to discuss where you are headed and how to stay ahead of the curve.
  5. Continuously Monitor Vendor Performance. This is another point not to be overlooked. Questionnaires and audits can only give you snapshots of a company’s security profile at one point in time. Actual security is much more fluid than that. NAFCU has partnered with BitSight Technologies as a preferred provider of monitoring services. BitSight essentially works like credit rating service for cybersecurity. They provide a number that indicates how strong a company’s security practices are on a continuous basis. BitSight calculates Security Ratings using a continuous process that gathers, processes, and assigns security data to arrive at the top-level security ratings.

For more dBitSightLogoetailed information on developing a third party cyber risk management plan you can check out NAFCU’s webinar with BitSight Technologies here or  download BitSight’s white paper on the topic.