Banks may want to review processes, risks and controls related to regulations impacted by operationalizing the CARES Act.
As large-scale events like the global health crisis impacting the United States and the global economy evolve, certain actions and outcomes are becoming more likely to occur, including increased requests for consumer support and relief, temporary easing of regulatory and compliance requirements, and new government backed programs to shore-up bank lending capabilities. As the government rolls out the Coronavirus Aid, Relief, and Economic Security (CARES) Act, which has many implications, including providing small businesses funding to maintain employee payroll and temporary protections for homeowners under financial hardship, banks should be looking at processes, risks and controls related to regulations impacted by operationalizing the CARES Act and responding to the current economic environment.
Key components of the CARES Act that impact consumer rights and protections include:
- Foreclosure Moratorium and Right to Forbearance – Prohibits foreclosures on all federally-backed mortgage loans for a 60-day (single) and 90-day (multi) period and provides up to 180 days of forbearance (beginning March 18, 2020). Further, under the CARES Act, landlords with federally backed mortgages (including bank-owned properties) cannot initiate legal action to recover the property, fees or penalties for 120 days.1
- Consumer Credit Protection – Requires that any account that receives forbearance under the CARES Act be reported to the credit bureau reporting agencies as “current” or as the status reported prior to receiving forbearance. This is retroactively available to January 31, 2020 for 120 days (or until the end of a national emergency).2
Regulatory and other considerations
While the regulatory change activities of the CARES Act may bring significant changes to a bank’s Small Business Administration (SBA) Lending program, during economic hardships or crisis, consumer and commercial client banking behaviors are likely to change. These changes can impact other regulations and ultimately the risk and compliance functions used to measure, monitor and manage the associated risks. Ordered by potential impact, below are related regulatory and other considerations:
- Electronic Banking – When physical access is restricted to traditional banking access points (e.g., brick and mortar branches, ATM access, lockbox) virtual and digital banking activities and usage tend to rise. With the expected increase of volume, stress placed on certain controls to manage compliance risks should also increase. Consumers generally are expected to seek to use online and digital banking products they may not have traditionally used before (e.g., Automated Clearing House (ACH), direct deposit, mobile banking, on-line bill pay, peer-to-peer transfers). Banks should prioritize reviews of their Regulation E (Electronic Funds Transfer Act) products, controls and risk management capabilities to proactively identify potential weaknesses in the control framework as it relates to matters including account access devices, unauthorized transfers, disclosures, overdrafts and pre-paid products. Further, with the Consumer Financial Protection Bureau (CFPB) issuing interpretive rules to allow economic stimulus checks to be paid via direct deposit or pre-paid cards,3 where account information is not readily available to the government, banks should monitor their processes and controls for direct and in-direct account opening and direct deposits.
- Privacy – Privacy has been at the forefront of banking regulation in the last few years and new realities of “working-from-home” has only placed heightened value in protecting consumer privacy and data security. To further this point, despite recent events, California’s Attorney General declined to delay the California Consumer Privacy Act (CCPA) compliance requirements implemented January 1, 2020 and set for enforcement to commence from July 2020.4 For companies who traditionally have not utilized a remote workforce, making sure employees understand their responsibilities related to data protection and privacy is paramount. Many large data breaches and misuses of data have occurred in scenarios where employees used their personal computers, email accounts and unsecured messages. Customer facing employees taking calls remotely should be conscious of the nature of the information they are obtaining and providing to customers and should be maintaining that data only on secured devices and transferred only through secure means.
- Fair Lending – Put simply, non-discrimination and open and available credit applies to ALL lending transactions and doesn’t change during times of economic hardship or crisis (Equal Credit Opportunity Act, Regulation B5). As banks consider implementing loan modification programs to mitigate portfolio losses and provide relief to consumers, or implement the Payroll Protection Program (PPP), fair lending controls should be closely monitored to prevent inadvertent discrimination based on the covered characteristics under the regulation. Banks should consider calibrating the big data sets used to conduct linear regression and other models to monitor compliance with the fair lending requirements.
- Loan Modification Programs – To shore up their loan portfolios and to provide customers some financial relief to those hardest hit during recent events, banks can look to “dust off” loan modification programs launched through the Dodd-Frank Act, and used during the 2008 financial crisis (e.g., Home Affordable Refinance Program (HARP), Home Affordable Modification Program (HAMP), Cash For Keys program) as credit workout activities to keep consumers in their homes. Specifically, banks would be well advised to review their Truth in Lending Act (TILA) (Reg Z) and Unfair, Deceptive, and Abusive Acts and Practices (UDAAP) program controls to assess whether customer facing materials such as marketing campaigns and disclosures properly reflect modified terms, and functions like customer care centers are properly educated on the eligibility and compliance requirements. Additionally, banks should consider if there are alternatives to loan modifications (e.g., another borrower assuming the loan under the Garn-St. Germain Depository Institutions Act). Banks should rigorously review any temporary or permanent modifications in underwriting criteria as a result of recent events and assess downstream impacts to their portfolios.
- Account Closures and Settlements (Bankruptcy, Credit Card Accountability Responsibility and Disclosure (CARD) Act, TILA, Fair Credit Reporting Act (FCRA)) – Account closures typically rise during economic downturns or crisis, either by the consumer or by the financial institution, and often due to non-payment and default. With the CARES Act allowing customers to utilize forbearance as a means of loan workout, banks would be well advised to review controls related to payment adjustments, partial payments, and deferred payments for impacts to accruals, statements, fees, and other potential customer harm scenarios, while monitoring the impact to their portfolios. Actions taken by the bank to close a customer’s account during a widespread economic downturn to pursue property (e.g., foreclosure, repossession) should be made with the utmost care, as reputation risks are heightened and repercussions (both regulatory and socially) can be extremely damaging. As a result, banks should consider allocating greater effort (e.g., workforce, control monitoring) to high risk areas that are likely to see a spike in volume.
- Loans to Insiders and Affiliates (Regulation O and W) – Bank employees and affiliate companies are not immune to economic, social or environmental crisis and can also experience economic hardship. With the anticipated rise in loan modification programs and the CARES Act lending program for SBA qualified borrowers, banks should make sure that the loans extended to potential officers and directors of the bank do not include any favorable terms, rates or discounts. Further, banks should conduct rigorous due diligence to identify any companies seeking funding under CARES or any other lending program that is an affiliate of the bank, in order to capture the appropriate compliance and reporting requirements.
- Protecting Service Members – Service members have unique protections under the federal Servicemembers Civil Relief Act (SCRA), including members of the National Guard, Reserve, and their families. Additionally, over the years, many states have adopted their own SCRA versions with provisions to provide additional or alternative protections for state guards and other servicemembers not currently covered by the federal regulation, thus adding a greater level of compliance complexity. With a potential increase in military, national and state guards, banks should be prepared to handle an equal growth in volume of relief requests, such as interest rate reductions and fees, and measure and plan for the short and long-term impacts to their portfolios. Customer facing teams across deposit and lending products, particularly credit cards and mortgages, should make sure their teams are educated in the SCRA requirements to advise customers on their options and rights, as well as any additional programs the bank may offer.
While not a comprehensive list of all the potential impacts and regulatory considerations arising from the promulgation of the CARES Act or socio-economic behavior changes as a result of recent events, these areas represent heighted risks banks should consider when managing, monitoring, and assessing risk and compliance across their functions.
To help our clients better respond to the challenges created by the global health crisis, Accenture has created a hub of all our latest thinking on a variety of COVID-19 topics, including a document on how banks can manage the business impact of the pandemic.
- “H.R.748 – CARES Act,” Congress.gov, March 27, 2020. Access at: https://www.congress.gov/bill/116th-congress/house-bill/748/text?loclr=bloglaw
- “Fair Credit Reporting (Regulation V), Consumer Financial Protection Bureau, November 14, 2012. Access at: https://www.congress.gov/bill/116th-congress/house-bill/748/text?loclr=bloglaw; https://www.consumerfinance.gov/policy-compliance/rulemaking/final-rules/fair-credit-reporting-regulation-v/
- “Consumer Financial Protection Bureau Paves Way for Consumers to Receive Economic Impact Payments Quicker,” Consumer Financial Protection Bureau, April 13, 2020. Access at: https://www.consumerfinance.gov/about-us/newsroom/cfpb-paves-way-consumers-receive-economic-impact-payments-quicker/
- “COVID-19 Will Apparently Not Delay CCPA Enforcement,” The National Law Review, March 26, 2020. Access at: https://www.natlawreview.com/article/covid-19-will-apparently-not-delay-ccpa-enforcement
- “12 CFR Part 1002 – Equal Credit Opportunity Act (Regulation B), January 1, 2018. Access at: https://www.consumerfinance.gov/policy-compliance/rulemaking/regulations/1002/