As published in ABA Bank Compliance (now ABA Risk and Compliance) by Mollie Sudhoff, July/August 2020

With the COVID-19 pandemic (COVID), we saw some early warning signals, but few anticipated the widespread sudden effects on the health, economic stability and all-round wellbeing of every aspect of our country. Even though Compliance is constantly monitoring changes and working to ensure Compliance Management System (CMS) components are adequate, when change happens suddenly, there can be stress and sometimes panic.

Business as usual may be indefinable in the near-term, so the role of compliance must remain steady. Exceptions to regulatory requirements prompted by the pandemic need to be tracked and changes that become the new norm need to be embedded in the CMS. The respective risk assessment components should be updated appropriately.

The general principles of change management are to decide, document, and execute consistently. Following these tenets will help banks achieve efficiency and fairness. Proactive institutions provide guidance for staff to meet regulatory and customer needs. Such guidance should be shared with affected areas so they can understand how and by what standards decisions are being made. These practices help ensure consistency during stressful situations.

Now that we are beyond the first wave of these issues, there are opportunities for compliance to monitor the outcomes and adjust going forward.

Monitoring is Key

Compliance professionals should be keeping a log of regulatory, audit, and compliance monitoring findings. Responsibilities for who, what, when, and how issues are addressed, are key to making the log effective. Maintaining a similar log of COVID-related issuances will provide a roadmap for analysis and planning. These should include impact points, who is responsible for implementation, and a comment field for any challenges and other required actions.

Make sure each required action has a timeline, a person responsible, and a method for assessing implementation and follow up. Discuss how and when to monitor operations while considering changes that have likely taken place. Make sure all 2020 compliance monitoring/testing and audit schedules are properly updated to capture any new risk factors.

Be sure to monitor each business line or product that responded to customer requests made due to COVID (e.g., loan modifications or fee waivers), once data becomes available. You will want to ensure each request was documented appropriately and that requests were handled in a fair and equitable manner.

Also, you’ll want to compare quarterly monitoring results to show what impact the pandemic responses had on each area. Try to be specific with comments on reports to the Board. Comments like “that was COVID” may not be adequate. Robust monitoring reports will identify the exceptions and specify the root cause to show how and/or why decisions were made that may have different outcomes from the usual. For example, if your call center employees found themselves working from home, perhaps errors occurred because online access was not complete. The Board will also likely want an overview on the Small Business Administration (SBA) Paycheck Protection Program (more commonly known as PPP) loans. Be sure to determine:

• Were there requests for emergency funds that the bank was not able to fulfill?
• Did the loan officers keep adequate records of the applications and disbursement activities related to any SBA facility lending?
• Did the bank receive many customer complaints?

As we move through the pandemic impacts, numerous other consumer and commercial compliance requirements will continue to need attention such as flood insurance, garnishments, Truth in Lending and Real Estate Settlement Procedures Act Integrated Disclosures (TRID), and Regulations B, C (HMDA), CC, D, and E, to name a few.

It is important to monitor and/or document files. Make records of what did and did not go well, and why. While regulators have promised understanding, it is incumbent on banks to document activities in a manner that offers a clear roadmap for:

• Evaluating the observations;
• Causes of any deviations from policy or law;
• Consequences if any; and
• Corrective action that was or is being taken.

While banks have been encouraged by regulators to work with customers, there is an equal need to balance safety and soundness with fairness. Implicit in the guidance, if not specified in the language, is that these requests be handled with fairness at the forefront.

Loan Servicing

Nearly all banks are working with customers affected by the pandemic, but the specific loan forbearance provisions of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) are not applicable to the non-federally insured loans held in portfolio.

Whether all loans serviced by the bank are subject to the forbearance requirements of the CARES Act, it is a best practice to maintain consistent credit reporting practices for federally backed and non-federally insured loans. This means you’ll need to ensure that your customers who were current on their loans before the pandemic, abide by any change in terms so that their credit will not suffer. You should have a plan in place to report credit in a fair and equitable manner consistent with bank regulations, credit reporting agency requirements, government sponsored enterprise (GSE) guidance, customer agreements and fairness to the customer.

Also, related to how any accommodations affect the life of the loan, banks need to be extra cautious with customer communications. Be specific about the impact any payment alterations have on future due dates, final balances, loan term, and future responsibilities. This is a key area to monitor going forward.

The CFPB issued guidance on April 1, 2020 that stated regulators will be lenient during exams related to furnishers’ delayed investigations of credit report disputes beyond regulatory requirements because of the pandemic. If affected by this, your bank may want to clearly document the reasons for the delay at the time it happens. Remember that exams, audits, etc., may not occur for quite some time.

Guidance does not replace law; even though regulators may be lenient on delays in reporting, consumers still have a private right of action. This right only applies to the investigation of the dispute, not the accuracy of reporting. And courts are split on how they rule on claims so how a defendant furnisher may fare in a civil suit is a moving target. Facts and circumstances are easier to prove when documentation is clear.

Bank Secrecy Act/Anti-Money Laundering

It may be more difficult to compare notes on suspicious transactions detected, since personnel have been working remotely. Compliance should have monitoring protocols in place to compare activity before, during, and after the peak of the pandemic. If history is our prelude, we know that money laundering, COVID-19 relief scams, and everyday fraud will continue.

Beneficial Ownership Requirements (BOR) is one of the principal requirements of BSA compliance. While new customers must be evaluated under the BOR, existing customers are grandfathered in until the bank renews, modifies, restructures or extends their loans. In April 2020, the Financial Crimes Enforcement Network (FinCEN) confirmed that banks can take a reasonable risk-based approach to obtaining beneficial ownership information when they make emergency loans to current customers that may not have yet been subject to BOR. Banks are still required to follow their own internal risk procedures related to all customers. (See https://www.fincen.gov/news/news-releases/financial-crimes-enforcementnetwork-provides-further-information-financial.) Now is a good time to test the documentation for any new customers and update any BOR documentation that may have been deferred.

Community Reinvestment Act

If your bank has not done so already, make sure to document how your bank is helping small businesses and the community. Regulatory guidance has encouraged banks to identify and track the Paycheck Protection Program (PPP) loans made to small business borrowers that have annual revenues of $1 million or less and are located in low- to moderate-income (LMI) areas. Take credit for serving your community; it may factor favorably into your CRA rating. For more information, see the article, CRA in the Coronavirus, in the May–June issue of ABA Bank Compliance, page 6.

Regulation O Community bank directors are often small business owners. Near the end of the first PPP window, the Federal Reserve announced a temporary rule change that allowed banks to make these loans to directors’ businesses outside of the limitations of Regulation O. The bank should be tracking these loan extensions to document and maintain records to ensure that lending does not extend beyond the exceptions allowed by the April 17, 2020 pronouncement and the normal Regulation O requirements.

Privacy

Privacy concerns, especially related to remote workers, rapid changes in processes, and possible medical information captured deserves review and documentation. While this article will not delve into the intricacies of data security and customer data privacy protocols, Compliance should be testing its own practices for retrieval and use of confidential information and making records of any conditions or exceptions noted during the time of the pandemic and ongoing. For more information, see the article, The Crusade for Privacy Rights: Are You Ready? on page 12 of this issue.

Other Impacted Areas

Areas such as vendor management, business continuity planning (including pandemic response) and information technology have bank-wide compliance impacts and need to be handled in a manner that is consistent with the key CMS protocols and best practices. Another key component of the CMS that should receive heightened attention during the time of COVID is consumer complaint responses. Review, respond, track, and trend.

Conclusion

Compliance in the time of COVID demands that we keep all compliance policies and procedures updated, and training schedules current. Monitoring and auditing plans may suffer some delays, but proper diligence will require updated risk weighting of any schedule changes beyond a few weeks or months.

While banks have faced challenges during the pandemic, the compliance role is one that offers stability and discipline. As a compliance professional. you may wear many hats, but keep your COVID mask handy. Compliance is more important now than ever.