On August 5, the FFIEC announced that the OCC, the FDIC, and the Federal Reserve are seeking public comment on a proposal for a new Consolidated Reports of Condition and Income for Eligible Small Institutions (FFIEC 051/Call Report). The proposed Call Report is a streamlined version of the Consolidated Reports of Condition and Income for a Bank with Domestic Offices Only (FFIEC 041), and would be applicable to financial institutions with domestic offices only and total assets of less than $1 billion. Intended to ease the reporting requirements for smaller institutions, the proposed Call Report would remove approximately 40% of about 2,400 data items in FFIEC 041. FFIEC 041 would remain applicable to institutions with domestic offices only that do not file the proposed Call Report. The banking agencies are also seeking public comment on proposed revisions to the FFIEC 041 and the Consolidated Reports of Condition and Income for a Bank with Domestic and Foreign Offices (FFIEC 031). Comments are due 60 days after Federal Register publication, which has not yet occurred.
On September 9, the FFIEC updated its Information Security booklet, a key element of its Information Technology Examination Handbook. The booklet is intended to provide examiners with guidance on assessing a financial institution’s information security operations, and is divided into the following four main sections: (i) Governance of the Information Security Program; (ii) Information Security Program Management; (iii) Security Operations; and (iv) Information Security Program Effectiveness. In addition to offering technology-centric recommendations such as encryption, the booklet advises firms to create security processes and risk assessment “commensurate with their operational complexities.” It also advises financial institutions to “have strong board and senior management support, promote integration of security activities and controls throughout the institution’s business processes, and establish clear accountability for carrying out security responsibilities.” As expected, the booklet highlights the importance of implementing effective oversight of third-party service providers. Pursuant to sub-section II.C.20, in order to ensure effective oversight of third-party service providers, management should, among other things, determine when third-parties identify, measure, mitigate, monitor, and report cyber risks so as to “facilitate a comprehensive understanding of the institution’s exposure to third-party cyber threats.”
On July 13, the CFPB announced that the FFIEC and HUD had published new resources for financial institutions required to file data pursuant to the Home Mortgage Disclosure Act (HMDA) and Regulation C, as amended by the CFPB’s October 2015 final rule, which revised and expanded the scope of HMDA reporting requirements. Accordingly, the CFPB updated its “Resources for HMDA filers” page to include the following new FFIEC and HUD resources: (i) a Technology Preview, which provides an initial summary for how HMDA filers will interact with the HMDA Platform, a web-based data submission and edit-check system that filers will use to submit HMDA data collected in or after 2017; (ii) Filing Instructions Guide (FIG) for HMDA data collected in 2017, which outlines changes to the submission process for data collected in 2017, 2017 file specifications, and 2017 edit specifications; and (iii) FIG for HMDA data collected in 2018. The 2018 FIG includes field definitions for the many additional or modified data points required for data collected in 2018 and 2018 file format and edit specifications. The technical specifications in the FIG will allow lenders and vendors of HMDA data-preparation software to begin making the systems changes needed to collect data in 2018 for submission in 2019. The CFPB’s HMDA resource page also includes FFIEC HMDA FAQs and reminds financial institutions to visit the FFIEC website for resources to submit data collected in or before 2016.
FFIEC Issues Cybersecurity Statement, Comments on Recent Attacks on Interbank Messaging and Payment Networks
On June 7, the FFIEC issued a statement on behalf of its members (the OCC, Federal Reserve, FDIC, NCUA, CFPB, and State Liaison Committee) advising financial institutions to “actively manage the risks associated with interbank messaging and wholesale payment networks.” According to the statement, recent cyber attacks against interbank networks and wholesale payment systems have demonstrated the ability to: (i) bypass information security controls and compromise a financial institution’s wholesale payment origination environment; (ii) “obtain and use valid operator credentials with the authority to create, approve, and submit messages”; (iii) make use of sophisticated understanding of funds transfer operations and operational controls; (iv) disable security logging and reporting by using highly customized malware, as well as conceal and delay detection of fraudulent transactions with the use of other operational controls; and (v) quickly transfer stolen funds across multiple jurisdictions. Read more…
On April 29, the FFIEC updated its IT Examination Handbook, revising its Retail Payment Systems booklet to include an Appendix E, Mobile Financial Services. The Retail Payment Systems booklet consists of guidance intended to help examiners evaluate financial institutions’ and third-party providers’ management of risks associated with retail payment systems. Appendix E is designed to address risk management associated with mobile financial services (MFS): “Appendix E contains guidance pertaining to [MFS] risks that supplements existing booklet guidance on other retail payment topics, such as electronic payments related to credit cards and debit cards, remote deposit capture and changes in technology or retail payment systems.” Appendix E outlines risk management practices for the following MFS technologies: (i) short message service/text messaging; (ii) mobile-enabled web sites and browsers; (iii) mobile applications; and (iv) wireless payment technologies. In addition to MFS technologies, Appendix E also addresses management strategies related to (i) risk identification; (ii) risk measurement; (iii) risk mitigation; and (iv) monitoring and reporting.