FFIEC and HUD Release HMDA Filing Guides; CFPB Updates Resources for HMDA Filers Page

On July 13, the CFPB announced that the FFIEC and HUD had published new resources for financial institutions required to file data pursuant to the Home Mortgage Disclosure Act (HMDA) and Regulation C, as amended by the CFPB’s October 2015 final rule, which revised and expanded the scope of HMDA reporting requirements. Accordingly, the CFPB updated its “Resources for HMDA filers” page to include the following new FFIEC and HUD resources: (i) a Technology Preview, which provides an initial summary for how HMDA filers will interact with the HMDA Platform, a web-based data submission and edit-check system that filers will use to submit HMDA data collected in or after 2017; (ii) Filing Instructions Guide (FIG) for HMDA data collected in 2017, which outlines changes to the submission process for data collected in 2017, 2017 file specifications, and 2017 edit specifications; and (iii) FIG for HMDA data collected in 2018. The 2018 FIG includes field definitions for the many additional or modified data points required for data collected in 2018 and 2018 file format and edit specifications. The technical specifications in the FIG will allow lenders and vendors of HMDA data-preparation software to begin making the systems changes needed to collect data in 2018 for submission in 2019. The CFPB’s HMDA resource page also includes FFIEC HMDA FAQs and reminds financial institutions to visit the FFIEC website for resources to submit data collected in or before 2016.

COMMENTS: Comments Off
TAGS: , , ,
POSTED IN: Federal Issues, Mortgages

FFIEC Issues Cybersecurity Statement, Comments on Recent Attacks on Interbank Messaging and Payment Networks

On June 7, the FFIEC issued a statement on behalf of its members (the OCC, Federal Reserve, FDIC, NCUA, CFPB, and State Liaison Committee) advising financial institutions to “actively manage the risks associated with interbank messaging and wholesale payment networks.” According to the statement, recent cyber attacks against interbank networks and wholesale payment systems have demonstrated the ability to: (i) bypass information security controls and compromise a financial institution’s wholesale payment origination environment; (ii) “obtain and use valid operator credentials with the authority to create, approve, and submit messages”; (iii) make use of sophisticated understanding of funds transfer operations and operational controls; (iv) disable security logging and reporting by using highly customized malware, as well as conceal and delay detection of fraudulent transactions with the use of other operational controls; and (v) quickly transfer stolen funds across multiple jurisdictions. Read more…


FFIEC Updates IT Examination Handbook

On April 29, the FFIEC updated its IT Examination Handbook, revising its Retail Payment Systems booklet to include an Appendix E, Mobile Financial Services. The Retail Payment Systems booklet consists of guidance intended to help examiners evaluate financial institutions’ and third-party providers’ management of risks associated with retail payment systems. Appendix E is designed to address risk management associated with mobile financial services (MFS): “Appendix E contains guidance pertaining to [MFS] risks that supplements existing booklet guidance on other retail payment topics, such as electronic payments related to credit cards and debit cards, remote deposit capture and changes in technology or retail payment systems.” Appendix E outlines risk management practices for the following MFS technologies: (i) short message service/text messaging; (ii) mobile-enabled web sites and browsers; (iii) mobile applications; and (iv) wireless payment technologies. In addition to MFS technologies, Appendix E also addresses management strategies related to (i) risk identification; (ii) risk measurement; (iii) risk mitigation; and (iv) monitoring and reporting.


FFIEC Releases Revised Management Booklet with Emphasis on Sound IT Governance

On November 10, the FFIEC issued a revised Management booklet, which outlines the principles of overall sound governance and, more specifically, IT governance. The booklet is one of 11 that makes up the FFIEC’s Information Technology Examination Handbook, and explains how risk management, including IT risk management, is a component of governance. The handbook emphasizes that the board of directors sets the tone and the direction of an institution’s IT program. Specifically, the board’s responsibilities include (i) reviewing and approving an IT strategic plan that aligns with the overall business strategy and includes an information security strategy to protect the institution from ongoing and emerging threats, including those related to cybersecurity; (ii) overseeing an institution’s process for approving third-party vendors; (iii) approving policies to report significant security issues to the board, steering committee, government agencies, and law enforcement, as necessary; (iv) holding management accountable for identifying, measuring, and mitigating IT risks; and (v) providing independent, comprehensive, and effective audit coverage of IT controls. The revised handbook incorporates cybersecurity concepts as an integral part of maintaining effective IT policies and procedures, noting that, “[a]lthough an institution is not required to have a separate cybersecurity program, its information security program should identify, measure, mitigate, monitor, and report on the heightened risks associated with cybersecurity.”


FFIEC Issues Joint Statement Regarding Cyber Attacks Involving Extortion

On November 3, the FFIEC issued a statement notifying financial institutions of the increasing frequency and severity of cyber attacks involving extortion. The joint statement urges financial institutions to take steps to ensure effective risk management programs, including but not limited to the following: (i) conducting ongoing information security risk assessments; (ii) performing security monitoring, prevention, and risk mitigation; (iii) implementing and regularly testing controls around critical systems; and (iv) participating in industry information-sharing forums. The statement identifies resources financial institutions can refer to for assistance in mitigating cyber attacks involving extortion.

The OCC also published a bulletin alerting all OCC-supervised institutions of the FFIEC’s joint statement.