|
ABA Banking Journal: In 11th hour move, CFPB finalizes effective cap on overdraft fees
December 12, 2024
With a little over a month left in the Biden administration, the CFPB today finalized a controversial rule on overdraft protection.
Under the final rule, covered institutions may choose one of three options to comply with its requirements: capping their overdraft fee at a flat $5, which is what the bureau asserts would cover costs at “most banks”; selecting a cap that covers their actual costs and losses; or treating overdraft protection as a loan covered by the Truth in Lending Act, which will require compliance with Regulation Z’s account opening disclosures, sending periodic statements, and prohibiting the compulsory use of automatic funds transfers to repay the overdraft, among other requirements. The rule covers banks and credit unions with more than $10 billion in assets.
The CFPB first proposed to limit overdraft fees earlier this year as part of a broader push against so-called “junk fees” by the Biden administration. The rule finalized today would not take effect until Oct. 1, 2025.
ABA President and CEO Rob Nichols slammed the CFPB’s decision to “finalize this misguided rule at a time when every other federal bank regulator has stopped issuing new regulations” and noted that the rule will “make it significantly harder for banks to offer this valuable service to their customers, including those who have few other options to cover essential payments.
“In finalizing the rule, the CFPB is ignoring the strong majority of Americans who have indicated time and again in national surveys that they value and appreciate overdraft protection, and they don’t want it to go away,” Nichols added. In ABA’s comments on the proposed rule, the association made clear that it would lead many banks to cease offering overdraft protection entirely.
“In addition to the consumer harm this rule will cause, it‘s yet another example of the CFPB’s willingness under Director Chopra to exceed its congressionally mandated guardrails,” Nichols said. “The bureau has no legal authority to subject overdraft services offered by any financial institution to Regulation Z, much less implement a price cap on overdraft protection. We will closely review the final rule with our members and consider all options going forward. It should not be allowed to go into effect.”
Full Article
Abrigo: What is elder financial exploitation? FinCEN guidance for financial institutions
The increasing threat of elder fraud
On December 4, 2024, FinCEN, along with the supervisory agencies, issued a statement on elder financial exploitation, or elder fraud. The statement provided examples of risk management and other practices that may be effective in combatting this often-underreported crime.
December 3, 2024
Less than a month before a Jan. 1 deadline for businesses to report their beneficial owners to the Financial Crimes Enforcement Network, a federal judge in Texas has issued a preliminary injunction blocking enforcement of the requirement. The order states that covered companies nationwide do not need to comply with the Jan. 1 reporting deadline, unless the judge or a higher court reverses the order in the meantime.
The lawsuit, brought by the National Federation of Independent Business and several of its members, challenged the constitutionality of the Corporate Transparency Act, the 2021 bill that established a beneficial ownership information, or BOI, registry and the requirement for businesses to report. The plaintiffs argued that the CTA exceeded Congress’s authority to regulate interstate commerce, that it violates the First Amendment by compelling speech and infringing freedom of association and that it violates the Fourth Amendment by forcing the disclosure of private information.
By mid-November, as the initial Jan. 1 reporting deadline approached, only about a quarter of the estimated 32.5 million covered businesses had registered. According to newly released poll data from Wolters Kluwer, 37% of firms were waiting until closer to the deadline and 12% said they had insufficient resources to do the filing. Meanwhile, 9% of businesses believed they were not covered by the rule, and 32% were unsure whether the rule applied to them.
Full Article
CISA News: FBI Warns iPhone And Android Users—Stop Sending Texts
December 8, 2024 | Zak Doffman
Timing is everything. Just as Apple’s adoption of RCS had seemed to signal a return to text messaging versus the unstoppable growth of WhatsApp, then along comes a surprising new hurdle to stop that in its tracks. While messaging Android to Android or iPhone to iPhone is secure, messaging from one to the other is not.
Now even the FBI and CISA, the U. S. cyber defense agency, are warning Americans to use responsibly encrypted messaging and phone calls where they can. The backdrop is the Chinese hacking of U. S. networks that is reportedly “ongoing and likely larger in scale than previously understood.” Fully encrypted comms is the best defense against this compromise, and Americans are urged to use that wherever possible.
The network cyberattacks, attributed to Salt Typhoon, a group associated with China’s Ministry of Public Security, has generated heightened concern as to the vulnerabilities within critical U.S. communication networks. The reality is different. Without fully end-to-end encrypted messaging and calls, there has always been a potential for content to be intercepted. That’s the entire reason Apple, Google and Meta advise its use, highlighting the fact that even they can’t see content.
According to a senior FBI official, “within the investigative activity, especially one this significant and this large, the facts will evolve over time… The continued investigation into the PRC targeting commercial telecom infrastructure has revealed a broad and significant cyber espionage campaign.” This campaign, he warned, “identified that PRC affiliated cyber actors have compromised networks of multiple telecom companies to enable multiple activities,” confirming that “the FBI began investigating this activity in late spring and early summer of this year.”
The FBI official warned that citizens should be “using a cell phone that automatically receives timely operating system updates, responsibly managed encryption and phishing resistant MFA for email, social media and collaboration tool accounts.”
As reported by Politico, CISA’s Jeff Greene added to this, “strongly urging Americans to ‘use your encrypted communications where you have it… we definitely need to do that, kind of look at what it means long-term, how we secure our networks’.”
If any good has come from this viral storm, it’s the light now shining on the lack of security across SMS and basic RCS messaging. That millions of users are now better informed as to the risks such that they can make informed decisions is welcome.
ESET’s Jake Moore says “it is well documented that SMS messages are not encrypted and any non encrypted forms of communication can be surveilled by law enforcement or anyone with the right tools, knowledge and software due to the concept of SS7.”
In terms of what is known about the Salt Typhoon attacks thus far, while the FBI official warned that widespread call and text metadata was stolen in the attack, expansive call and text content was not. But “the actors compromised private communications of a limited number of individuals who are primarily involved in the government or political activities. This would have contained call and text contents.”
The scale of the hacking campaign and the implications for U.S. critical infrastructure and the security of its networks has created an unsurprising political storm. As reported by Reuters, “U.S. government agencies held a classified briefing for all senators on Wednesday on China's alleged efforts known as Salt Typhoon to burrow deep into American telecommunications companies and steal data about U.S. calls.” Following the briefing, “U.S. senators vow[ed] action.”
Reuters also reported that “a Senate Commerce subcommittee will hold a Dec. 11 hearing on Salt Typhoon and how ‘‘security threats pose risks to our communications networks, and review best practices. There is growing concern about the size and scope of the reported Chinese hacking into U.S. telecommunications networks and questions about when companies and the government can assure Americans over the matter.”
During Tuesday’s original media briefing, CISA’s Greene reportedly suggested “that Americans should use encrypted apps for all their communications,” (1,2). That means stop sending texts iPhone to Android, albeit iMessages and Google Messages are fully encrypted while on those platforms.
Greene added that “our suggestion, what we have told folks internally, is not new here: encryption is your friend, whether it's on text messaging or if you have the capacity to use encrypted voice communication. Even if the adversary is able to intercept the data, if it is encrypted, it will make it impossible.”
An alert into the ongoing telco network hacks jointly issued by FBI, CISA and NSA—as well as other Five Eyes agencies—was released on Tuesday.
The lack of end-to-end encryption to protect cross-platform RCS, the successor to SMS, is a glaring omission. It was highlighted in Samsung’s recent celebratory PR release on the success of RCS, which included the caveat that only Android to Android messaging is secured. It remains a stark irony that while Google and Apple separately advise Android and iPhone users to rely on end-to-end encryption, when it comes to RCS it’s still missing, with no timeline in sight for a fix.
The mobile standard setter, GSMA, and Google have said encryption will be coming to RCS, but there’s no firm date yet. That assurance seemed a response to the backlash post Apple’s update with the media pickup on the security issue. Apple, whose iPhone ecosystem includes ever more fully encryption, has not commented.
There is an ironic twist to these warnings. As PC Mag commented, “this push to use end-to-end encryption is ironic since the FBI has long complained that the same technology can stymie their investigations into seized smartphones and online accounts belonging to criminal suspects.”
According to additional Reuters reporting, “U.S. Federal Communications Commission Chairwoman Jessica Rosenworcel is proposing that communications service providers be required to submit an annual certification attesting that they have a plan in place to protect against cyberattacks, the agency said in a statement on Thursday. The proposal is in part in response to efforts by an allegedly Beijing-sponsored group of hackers, dubbed ‘Salt Typhoon,’ to burrow deep into American telecommunications companies to steal data about U.S. calls.”
Meanwhile, CISA has assured that an independent review of the Chinese hacking campaign will begin in short order. Per The Record, a review board “will launch its investigation of an unprecedented Chinese hack of global telecommunications systems later this week, the head of the Cybersecurity and Infrastructure Security Agency said on Wednesday. Speaking to reporters after a classified briefing for all senators on Wednesday about the breach by the state-sponsored group known as Salt Typhoon, CISA Director Jen Easterly said the first meeting of the Cyber Safety Review Board (CSRB) focused on the ongoing breach will take place on Friday.”
Easterly told the media “we wanted to make sure that we had a good understanding of what was happening, in terms of the scope and scale, and, quite frankly, most of the agencies who would be involved in the Cyber Safety Review Board are still involved in the incident response… We wanted to make sure we did it before the holidays, so we could start writing out how we think about the problem, and then ultimately, what are the key recommendations that we need to bring forward to enable us to strengthen the security of the telco networks going forward.”
Ahead of any recommendations being made, the FBI’s precise wording is critical, with its emphasis on responsible encryption that has been mostly overlooked in reports. Responsible in this context means providing access to user data through lawful requests, including—potentially—content. While this may come across as a subtlety, it is anything but. This rules out many of the largest, best known messaging platforms—such as WhatsApp and Signal, as they cannot provide access to any content absent an endpoint (device) compromise, accessing the data at one end of the end-to-end encryption.
One can expect recommendations to linger on the right balance between full encryption to protect contents from network vulnerabilities and lawful access. That risks revisiting the debate between big tech and lawmakers around how to breach the encryption enclave without fatally weakening it. It will be heavily resisted, albeit there is a lack of clarity as to which way the new Trump administration will swing on this.
With ironic timing, Europe’s so-called chat control is back on the table this week. This seeks to solve the unsolvable problem of pushing big tech to monitor content on their platforms for child sexual abuse material (CSAM) in the first instance, albeit once that is enabled, the fears are that other content can be screened as well.
Privacy experts have railed heavily against this political campaign and European lawmakers and regulators are divided on the issue. Should Europe manage to fuel a collation with enough power to drive this into some form of policy setting, and the US jump onboard post Salt Typhoon with an “end-to-end encrypted, kind of” approach, we will be set for an almighty battle through 2025 and beyond.
Notwithstanding that, my advice remains to use the fully encrypted WhatsApp over RCS for any cross-platform messaging, at least until such a time as RCS adds its own full encryption between iPhones and Androids. Once you step outside Apple’s or Google’s walled gardens, this security protections falls away. With many good secured platforms now readily available, it’s not worth taking the risk. The need for full security has never been greater given the ongoing cyber threat landscape.
ESET’s Moore cautions that “it is important to treat any non privacy focused messaging platform with care and they should not be used for private communication or to transfer sensitive data. Encrypted channels offer privacy and security but although Meta-owned WhatsApp may not be everyone’s choice, at least it offers end-to-end encryption as standard. There are lots of other options such as Signal and iMessage but it’s about choices and understanding what level of security is right for individuals.”
There are other fully encrypted platforms as well—notably Signal, the best of the bunch, albeit with a much smaller install base. Even Facebook Messenger now fully encrypts messaging, making standard SMS/RCS texting even more an outlier. Signal and WhatsApp also enable fully encrypted voice and video calls cross platform, and so they should also be your default choices given this FBI/CISA warning.
Moore, a former police forensics expert, describes end-to-end encryption as “more than a fundamental right—it is a vital necessity for all communication tools and any messaging service that is not secured with this layer of protection must be treated with caution.” Perhaps now such messaging will be seen differently by its users.
Ironically, Apple’s iOS 18.2, due this month, will enable iPhone users to change the default messenger on their devices from iMessage. Timing really is everything.
Full Article
ABA Banking Journal: Prepare your bank for the FDIC’s new signage rule
November 25, 2024
The use of the FDIC logo at teller windows, on bank doors and in other places — not to mention the disclosure of “Member FDIC” in advertising — is a staple of how banks present the deposit insurance guarantee to their customers and the public. On May 1, these practices will receive a major update, and banks need to figure out how to comply.
The rule changes how banks display the FDIC logo online, on apps and at branches and ATMs. It also bars the logo’s use in advertising and marketing that misrepresent deposit insurance coverage. The ambiguity in the rule’s language is a headache for banks as they work on implementation, according to Ashtyn Landen, senior director of prudential regulation at ABA.
“One of the confusing terms was ‘continuously,’” Landen says. “What does it mean to have the FDIC sign continuously on your website? Does that mean when you scroll, the sign follows you down the screen? Does it mean it pops up in different places?”
Take advantage of FDIC resources
Despite the time crunch and lack of clarity, industry experts say banks must do everything they can to proactively prepare for implementation.
Landen suggests rereading the rule, looking at the FDIC’s questions and answers, and attending the agency’s webinar series about rule requirements. At these webinars, the FDIC will “discuss additional questions regarding the rule” and could “clear up any confusion around what exactly is required for the website and mobile apps,” she says.
The session on May 30 reviewed subparts A and B, including the major requirements and objectives, and answered common questions. The second, on July 31, discussed requirements and offered details on FDIC signage on websites — including when signage is not required — and examples of violations. (Visit the FDIC’s site to view the earlier presentation slide decks and for updates.)
Not one size fits all
Questions about integrating the new rule will differ depending on the bank, according to Leslie Callaway, senior director for compliance, outreach and development at ABA and the team lead for ABA’s members-only Compliance Hotline.
“The bigger banks are looking at this and have been since day one. Smaller banks that don’t have the resources are struggling a little bit more. It really depends on the size of the bank [and] the resources they have,” she says. “There’s a lot of rules around ATMs, so how many ATMs do you have? How many new ATMs are you going to have? There’s a lot of moving parts.”
Since implementation challenges will vary, it’s important for banks to communicate with their examiner for help with the changes and to ensure readiness for May 1, says Therese Kieffer, specialized consulting manager at Wolters Kluwer.
“Where you’ve got the non-deposit product that you’re also offering in your branch and you want to put it up on digital display, it might be worthwhile having a conversation with your examiner as to what they would recommend [in terms of appropriate disclosure] in that kind of situation,” Kieffer says. “You might want to run some of your drafts of your mobile app page or some of your designs past your examiner.”
Full Article
Order your 2025 South Dakota Bank Directory
 The South Dakota Bank Directory provides detailed information on all South Dakota banks including addresses, telephone numbers, important contact names and additional pertinent information. The directory also contains information on the SDBA, banking associations, regulatory agencies, endorsed vendors, associate members and South Dakota officials.
Place your order for your 2025 SD Bank Directory!
All member branches and endorsed vendors receive one complimentary copy. Associate members also receive a complimentary copy once they pay their 2025 dues.
National Tax Security Awareness
National Tax Security Awareness Week took place last week on December 2-6, 2024. This annual event emphasizes the importance of protecting sensitive financial information from identity theft and tax scams, especially as the holidays and the 2025 tax season approach.
We need your help! You can: · Use ready-to-use articles on your website and in your newsletters. · Share e-Posters that include useful information and links. · Post information to your social media accounts. The IRS social media accounts will share messages throughout National Tax Security Awareness Week.
· Partner with us for an event to share tax security information.
The IRS plans to add more resources to the National Tax Security Awareness Week 2024 webpage, so please check back throughout the week.
If you have any questions or would like to plan an event, please contact Alan Gregerson, IRS, Senior Stakeholder Liaison, Bloomington, MN 55425. Contact information: [email protected]
ABA Washington Summit
March 17-19, 2025 | Washington DC
Join the biggest annual gathering of bank leaders in Washington to push for a bank policy framework that lets your bank stay focused on serving your customers, clients and communities. Hear directly from the key players in the 119th Congress and the new administration on what the future holds for banks of all sizes.
The SDBA is currently planning to attend the Summit and would like to invite you and your staff to participate as well. Registration is free and you can learn more and sign up here. Join us as we hear from top-notch speakers, connect with our congressional delegations' offices and dine with our friends at the NDBA. You won’t want to miss this opportunity to engage on multiple levels.
If you or one of your staff would like to attend, the SDBA will provide a $500 stipend (1 per member bank) to help defray the costs of any banker attending from a member bank not currently represented on the SDBA Board. There will also be an Emerging Leaders’ Forum and a Women’s Leadership Forum held in conjunction with the Summit.
Information and Registration
GSB Digital Banking School
March 3, 2025 | Virtual
GSB is offering their 2025 Digital Banking School virtually starting March 3, 2025. This opportunity is limited to only 40 banks and offers one fee per bank rather than per person registration.
Competition for growth in a digitally disrupted banking ecosystem demands a reallocation of resources and stronger investment in technology, talent, skillset development, and marketing. Simply digitizing existing processes, products, and services is not enough. The Digital Banking School is uniquely positioned to provide your organization with the tools to address the key challenges that community banks face that can impede growth. Registration allows the bank to extend participation in the program throughout the organization, allowing key decision-makers to participate in one, or all, of the learning sessions for maximum organizational impact.
Information and Registration
SDBA State Legislative Day
February 12, 2025 | Pierre
 SDBA’s Legislative Day is your opportunity to stay informed on both state and federal legislation which could impact the banking industry. This is your opportunity to actively participate in shaping the future of banking in our state. This gathering promises insightful conversations, networking, and direct engagement with key policymakers.
Information & Registration
Breaking Into Banking 101 & 201
101: February 26, 2025 | 201: March 26, 2025
 Breaking Into Banking 101: Commercial banking can be intimidating because of its complexity and the risk-oriented nature of the work. This course is a clear and thorough introduction to the key concepts, terminology, and processes involved in credit and lending. It doesn’t assume much prior knowledge of the topic, so it’s ideal for those in their first year in the industry. Learners will walk away with a clear understanding of their job and how their specific role fits into the bank’s overall profitability goals.
101 Information & Registration
Breaking Into Banking 201: This 9-module online course is a “sequel” to the 101 course and is best taken after completion of that course, though it is not a prerequisite. The 201 course includes a case study and dives deeper into topics covered in modules 4, 6, and 8 of the 101 course: analyzing a borrower’s balance sheet, income statement, collateral, and risk ratings.
201 Information & Registration
Question of the Week
Q: Under the final rule amending 12 CFR part 328, are we permitted to use a sign at a teller window that doesn’t have the gold background?
A: While the FDIC’s Q&As on the Part 328 Final Rule do confirm that the final rule does not modify color requirements for the physical FDIC official sign, they don’t go out of their way to make the existing rule any less confusing! In general, under 12 CFR 328.3(b)(1)(i), at each teller window or station where insured deposits are usually and normally received, a bank must display the official sign described in 12 CFR 328.2(a); that is, 7” by 3” in size, with black lettering and gold background. However, under 12 CFR 328.3(b)(4), a bank is also permitted to display signs that vary from the official sign in size, color, or material at any location where display of the official sign is required or permitted. Hold on though – the very next sentence states that any such “varied” sign displayed where the official sign is normally required must not be smaller in size than the official sign (easy enough), must include the same content (makes sense), and must also “have the same color for the text and graphics.” (?!?)
While at first glance this seems to directly conflict with the ability to use a varied sign, the most straightforward interpretation of this would be that if your bank uses a “varied sign” where it is required to use the official sign (such as a teller window), then that sign can’t be smaller than the official sign, must contain the same content as the official sign, and must have the graphics and text match in color within the sign (so, black text and black graphics, or blue text and blue graphics, etc.)
Learn how to put compliance management solutions from Compliance Alliance to work for your bank, by contacting (888) 353-3933 or [email protected] and ask for our Membership Team. For timely compliance updates, subscribe to Bankers Alliance’s email newsletters.
SDBA eNews Archive
View past issues of the SDBA eNews
Advertising Opportunity
Learn more about sponsoring the SDBA eNews
Questions/Comments
Contact the SDBA at 605.224.1653 or via email
|
