Regulatory Compliance
By: Wendy Greenawalt The final provisions included in The Credit Card Act will go into effect on August 22, 2010. Most lenders began preparing for these changes some time ago, and may have already begun adhering to the guidelines. However, I would like to talk about the provisions included and discuss the implications they will have on credit card lenders. The first provision is the implementation of penalty fee guidelines. This clause prohibits card issuers from charging fees that exceed the consumer’s violation of the account terms. For example, if a consumer’s minimum monthly payment on a credit card account was $15, and the lender charges a $39 late fee, this would be considered excessive as the penalty is greater than the consumers’ obligation on that account. Going forward, the maximum fee a lender could charge in this example would be $15 or equal to the consumers obligation. In addition to late fee limitations, lenders can no longer charge multiple penalty fees based on a single late payment, other account term violations or fees for account inactivity. These limitations will have a dramatic impact on portfolio profitability, and lenders will need to account for this with all accounts going forward. The second major provision mandates that if a lender increased a consumer’s annual interest rate after January 1, 2009 due to credit risk, market conditions, or other factors, then the lender must maintain reasonable methodologies and perform account reviews no less than every 6 months. If during the account review, the credit risk, market conditions or other factors that resulted in the interest rate increase have changed, the lender must adjust the interest rate down if warranted. This provision only affects interest rate increases and does not supply specific terms on the amount of the interest rate reduction required; so lenders must assess this independently to determine their individual compliance requirements on covered accounts. The Credit Card Act was a measure to create better policies for consumers related to credit card accounts and overall will provide greater visibility and fair account practices for all consumers. However, The Credit Card Act places more pressure on lenders to find other revenue streams to make up for revenue that was previously received when accounts were not paid by the due date, fees and additional interest rate income were generated. Over the next few years, lenders will have to find ways to make up this shortcoming and generate revenue through acquisition strategies and/or new business channels in order to maintain a profitable portfolio. http://www.federalreserve.gov/newsevents/press/bcreg/20100303a.htm
By: Wendy Greenawalt In my last blog, I discussed the Risk-Based Pricing Rule and provided an overview of the risk based pricing notice compliance option. In this blog, I will provide a re-cap of the compliance Risk-Based Pricing notice and talk about the Credit Score Disclosure exception compliance option in more detail. When the Risk-Based Pricing Rule went into effect in January 2010, the Federal Reserve Board and Federal Trade Commission outlined two distinct compliance options available to lenders. The first option is a risk based pricing notice, which must be provided to a specific segment of consumers who “receive terms that are materially less favorable than the terms available to a substantial portion of consumers”. The notice also provides consumers with general information about credit reports, how lenders use them to make lending decisions and how to obtain a copy of their credit report. The second compliance option is a credit score disclosure exception. This option requires lenders to provide a disclosure to all consumers associated with a new account and must be in a written format that can be retained by the consumer for reference. The credit score disclosure provides consumers with the credit score that was used in conjunction with the lending decision, the range of scores for the credit score used and a national score distribution that enables consumers to compare their score to the scores of other consumers. The disclosure also contains key factors that adversely affected the consumers’ credit score and information about how to obtain a copy of their credit report. Some lenders who want to streamline compliance or those who have a concerned with the messaging contained in the Risk-Based Pricing notice may prefer this option. Either way, both compliance options should be carefully evaluated by lenders to ensure an effective compliance program is implemented. Model forms have been provided for both compliance options, which will assist lenders in complying, but implementing the new forms into existing processes and systems will require time, effort and cost for most lenders.
Well, in my last blog, I was half right and half wrong. I said that individual trade associations and advocacy groups would continue to seek relief from Red Flag Rules ‘coverage’ and resultant FTC enforcement. That was right. I also said that I thought the June 1 enforcement date would ‘stick’. That was wrong. Said FTC Chairman Jon Leibowitz, “Congress needs to fix the unintended consequences of the legislation establishing the Red Flag Rule – and to fix this problem quickly. We appreciate the efforts of Congressmen Barney Frank and John Adler for getting a clarifying measure passed in the House, and hope action in the Senate will be swift. As an agency we’re charged with enforcing the law, and endless extensions delay enforcement.” I think the key words here are ‘unintended consequences’. It seems to me that the unintended consequences of the Red Flag Rules reach far beyond just which industries are covered or not covered (healthcare, legal firms, retailers, etc). Certainly, the fight was always going to be brought on by non-financial institutions that generally may not have had a robust identity authentication practice in place as a general baseline practice. What continues to be lost on the FTC is the fact that here we are a few years down the road, and I still hear so much confusion from our clients as to what they have to do when a Red Flag compliance condition is detected. It’s easy to be critical in hindsight, yes, but I must argue that if a bit more collaboration with large institutions and authentication service providers in all markets had occurred, creating a more detailed and unambiguous Rule, we may have seen the original enforcement date (or at least one of the first or second postponement dates) ‘stick’. At the end of the day, the idea of mandating effective and market defined identity theft protection programs makes a lot of sense. A bit more intelligence gathering on the front end of drafting the Rule may, however, have saved time and energy in the long run. Here’s hoping that December 31st ‘sticks’…I’m done predicting.
--By Wendy Greenawalt Recently the Federal Reserve Board and Federal Trade Commission issued a new rule requiring any lender who utilizes a credit report or score when making a credit decision to provide consumers with a risk-based pricing notice. The new regulation goes into effect on January 1, 2011, but lenders must begin the planning process now--as compliance will require potential changes to their current lending practices. The regulation is another evolution in an attempt to provide consumers with more visibility to their credit history and the impact a blemished record may have on their finances. The ruling is good for consumers, but will require lenders to modify existing lending processes and add another consumer disclosure, as well as additional costs to the lending process. The risk-based pricing rule provides lenders with two compliance options--the risk-based pricing notice or a credit score disclosure exception. In this blog, I will discuss the primary compliance option, the risk-based pricing notice. The risk-based pricing notice is a document that notifies consumers that the terms of their new credit account are materially less favorable than the most favorable terms. The notice will not be provided to all consumers, but rather just those that receive account terms that are worse than what is offered to the most credit worthy consumers. Determining who will receive the notice has been outlined in the rule, and lenders can use several options including the direct comparison, credit score proxy or tiered pricing method. For lenders that perform regular validation of their portfolio, determining which consumers to issue a notice to should not be difficult. However, for those lenders who do not perform regular scorecard performance monitoring, this is another reminder of the importance of on-going validations and monitoring. As the economy continues to recover and lenders begin to re-enter the market, it will be more important than ever to validate that scores are performing as expected to manage risk and revenue goals. In my next blog, I will discuss the credit score disclosure exception.
By: Kari Michel The Federal Reserve’s decision to permit card issuers to use income estimation models to meet the Accountability, Responsibility, and Disclosure (CARD) Act requirements to assess a borrower’s ability to repay a loan makes good sense. But are income estimation models useful for anything other than supporting compliance with this new regulation? Yes; in fact these types of models offer many advantages and uses for the financial industry. They provide a range of benefits including better fraud mitigation, stronger risk management, and responsible provision of credit. Using income estimation models to understand your customers’ complete financial picture is valuable in all phases of the customer lifecycle, including: • Loan Origination – use as a best practice for determining income capacity • Prospecting – target customers within a specific income range • Acquisitions – set line assignments for approved customers • Account Management – assess repayment ability before approving line increases • Collections – optimize valuation and recovery efforts One of the key benefits of income estimation models is they validate consumer income in real time and can be easily integrated into current processes to reduce expensive manual verification procedures and increase your ROI. But not all scoring models are created equal. When considering an income estimation model, it’s important to consider the source of the income data upon which the model was developed. The best models rely on verified income data and cover all income sources, including wages, rent, alimony, and Social Security. To lean more about how income estimation models can help with risk management strategies, please join the following webinar: Ability to pay: Going beyond the Credit CARD on June 8, 2010. http://www.bulldogsolutions.net/ExperianConsumerInfo/EXC1001/frmRegistration.aspx?bdls=24143
By: Kari Michel What is Basel II? Basel II is the international convergence of Capital Measurement and Capital Standards. It is a revised framework and is the second iteration of an international standard of laws. The purpose of Basel II is to create an international standard that banking regulators can use when creating regulations about how much capital banks need to put aside to guard against the types of financial and operations risk banks face. Basel II ultimately implements standards to assist in maintaining a healthy financial system. The business challenge The framework for Basel II compels the supervisors to ensure that banks implement credit rating techniques that represent their particular risk profile. Besides the risk inputs (Probability of Default (PD), Loss Given Default (LGD) and Exposure at Default (EAD)) calculation, the final Basel accord includes the “use test” requirement which is the requirement for a firm to use an advanced approach more widely in its business and met merely for calculation of regulatory capital. Therefore many financial institutions are required to make considerable changes in their approach to risk management (i.e. infrastructure, systems, processes, data requirements). Experian is a leading provider of risk management solutions -- products and services for the new Basel Capital Accord (Basel II). Experian’s approach includes consultancy, software, and analytics tailored to meet the lender’s Basel II requirements.
A recent New York Times (1) article outlined the latest release of credit borrowing by the Federal Reserve, indicating that American’s borrowed less for the ninth-straight month in October. Nested within the statistics released by the Federal Reserve were metrics around reduced revolving credit demand and comments about how “Americans are borrowing less as they try to replenish depleted investments.” While this may be true, I tend to believe that macro-level statements are not fully explaining the differences between consumer experiences that influence relationship management choices in the current economic environment. To expand on this, I think a closer look at consumers at opposite ends of the credit risk spectrum tells a very interesting story. In fact, recent bank card usage and delinquency data suggests that there are at least a couple of distinct patterns within the overall trend of reducing revolving credit demand: • First, although it is true that overall revolving credit balances are decreasing, this is a macro-level trend that is not consistent with the detail we see at the consumer level. In fact, despite a reduction of open credit card accounts and overall industry balances, at the consumer-level, individual balances are up – that’s to say that although there are fewer cards out there, those that do have them are carrying higher balances. • Secondly, there are significant differences between the most and least-risky consumers when it comes to changes in balances. For instance, consumers who fall into the least-risky VantageScore® tiers, Tier A and B, show only 12 percent and 4 percent year-over-year balance increases in Q3 2009, respectively. Contrast that to the increase in average balance for VantageScore F consumers, who are the most risky, whose average balances increased more than 28 percent for the same time period. So, although the industry-level trend holds true, the challenges facing the “average” consumer in America are not average at all – they are unique and specific to each consumer and continue to illustrate the challenge in assessing consumers' credit card risk in the current credit environment. 1 http://www.nytimes.com/2009/12/08/business/economy/08econ.html
By: Amanda Roth During the past few months, we have been hearing from our clients that there is a renewed focus from the regulators/examiners on risk-based pricing strategies. Many are requesting a validation of the strategies to ensure acceptable management of risk through proper loan pricing and profitability. The question we often receive is “what exactly are they requiring?” In some cases, a simple validation of the scoring models used in the strategies will be sufficient. However, many require a deeper dive into where the risk bands are set and how pricing is determined. They are looking to see if applicants of the same risk level are being priced the same, and when the price is increased from tier A to B, for example. Also, they're checking that the change in rate is in line with the change in risk. Some are even requiring a profitability analysis to show the expected impact of delinquency, loss and operating expense on net revenue for the product, tier and total portfolio. We'll address each of these analyses in more detail over the next few weeks. In the meantime, what are you hearing from your regulators/examiners?
Many compliance regulations such the Red Flags Rule, USA Patriot Act, and ESIGN require specific identity elements to be verified and specific high risk conditions to be detected. However, there is still much variance in how individual institutions reconcile referrals generated from the detection of high risk conditions and/or the absence of identity element verification. With this in mind, risk-based authentication, (defined in this context as the “holistic assessment of a consumer and transaction with the end goal of applying the right authentication and decisioning treatment at the right time") offers institutions a viable strategy for balancing the following competing forces and pressures: • Compliance – the need to ensure each transaction is approved only when compliance requirements are met; • Approval rates – the need to meet business goals in the booking of new accounts and the facilitation of existing account transactions; • Risk mitigation – the need to minimize fraud exposure at the account and transaction level. A flexibly-designed risk-based authentication strategy incorporates a robust breadth of data assets, detailed results, granular information, targeted analytics and automated decisioning. This allows an institution to strike a harmonious balance (or at least something close to that) between the needs to remain compliant, while approving the vast majority of applications or customer transactions and, oh yeah, minimizing fraud and credit risk exposure and credit risk modeling. Sole reliance on binary assessment of the presence or absence of high risk conditions and identity element verifications will, more often than not, create an operational process that is overburdened by manual referral queues. There is also an unnecessary proportion of viable consumers unable to be serviced by your business. Use of analytically sound risk assessments and objective and consistent decisioning strategies will provide opportunities to calibrate your process to meet today’s pressures and adjust to tomorrow’s as well.
As I wrote in my previous posting, a key Red Flags Rule challenge facing many institutions is one that manages the number of referrals generated from the detection of Red Flags conditions. The big ticket item in referral generation is the address mismatch condition. Identity Theft Prevention Program I’ve blogged previously on the subject of risk-based authentication and risk-based pricing, so I won’t rehash that information. What I will suggest, however, is that those institutions who now have an operational Identity Theft Prevention Program (if you don’t, I’d hurry up) should continue to explore the use of alternate data sources, analytics and additional authentication tools (such as knowledge-based authentication) as a way to detect Red Flags conditions and reconcile them all within the same real-time transaction. Referral rates Referral rates stemming from address mismatches (a key component of the Red Flags Rule high risk conditions) can approach or even surpass 30 percent. That is a lot. The good news is that there are tools which employ additional data sources beyond a credit profile to “find” that positive address match. The use of alternate data sources can often clear the majority of these initial mismatches, leaving the remaining transactions for treatment with analytics and knowledge-based authentication and Identity Theft Prevention Program. Whatever “referral management” process you have in place today, I’d suggest exploring risk-based authentication tools that allow you to keep the vast majority of those referrals out of the hands of live agents, and distanced from the need to put your customers through the authentication wringer. In the current marketplace, there are many services that allow you to avoid high referral costs and risks to customer experience. Of course, we think ours are pretty good.
While the FACT Act’s Red Flags Rule seems to capture all of the headlines these days, it’s just one of a number of compliance challenges that banks, credit unions, and a myriad of other institutions face on a daily basis. And meeting today’s regulatory requirements is more complicated than ever. Risk managers and compliance officers are asked to consider many questions, including: 1. Do FACTA Sections 114 and 315 apply to me? 2. What do I have to do to comply? 3. What impact does this have on the customer’s experience? 4. What is this going to cost me in terms of people and process? Interpretation of the law or guideline – including who it applies to and to whom it does not - varies widely. Which types of businesses are subject to the Red Flags Rule? What is a “covered account?” If you’re not sure, you’re not alone - it’s a primary reason why the Federal Trade Commission (FTC) continues to postpone enforcement of the rule, while this healthy debate continues. And by the way, FTC – it’s almost November 1st…aren’t we about due for another delay? But we’re not talking about just protecting consumers from identity theft and reducing fraud and protecting themselves using the Identity Theft Prevention Program. The USA Patriot Act and “Know Your Customer” requirements have been around much longer, but there are current challenges of interpretation and practical application when it comes to identifying customers and performing due diligence to deter fraud and money laundering. Since Customer Identification Programs require procedures based on the bank’s own “assessment of the relevant risks,” including types of accounts opened, methods of opening, and even the bank’s “size, location, and customer base,” it’s safe to say that each program will differ slightly – or even greatly. So it’s clear there’s a lack of specificity in the regulations of the Red Flags Rule which cause heartburn for those tasked with compliance…but are there some common themes and requirements across the two? The short answer is Yes. In my next post, I’ll talk about the elements in common and how authentication products can play a part in addressing both.
There were always questions around the likelihood that the August 1, 2009 deadline would stick. Well, the FTC has pushed out the Red Flag Rules compliance deadline to November 1, 2009 (from the previously extended August 1, 2009 deadline). This extension is in response to pressures from Congress – and, likely, "lower risk" businesses questioning their being covered under the Red Flag Rule to begin with (businesses such as those related to healthcare, retailers, small businesses, etc). Keep in mind that the FTC extension on enforcement of Red Flag Guidelines does not apply to address discrepancies on credit profiles, and that those discrepancies are expected to be worked TODAY. Risk management strategies are key to your success. To view the entire press release, visit: http://www.ftc.gov/opa/2009/07/redflag.shtm
In recent months, the topics of stress-testing and loss forecasting have been at the forefront of the international media and, more importantly, at the forefront of the minds of American banking executives. The increased involvement of the federal government in managing the balance sheets of the country’s largest banks has mixed implications for financial institutions in this country. On one hand, some banks have been in the practice of building macroeconomic scenarios for years and have tried and tested methods for risk management and loss forecasting. On the other hand, in financial institutions where these practices were conducted in a less methodical manner, if at all, the scrutiny placed on capital adequacy forecasting has left many looking to quickly implement standards that will address regulatory concerns when their number is called. For those clients to whom this process is new, or for those who do not possess a methodology that would withstand the examination of federal inspectors, the question seems to be – where do we begin? I think that before you can understand where you’re going, you must first understand where you are and where you have been. In this case, it means having a detailed understanding of key industry and peer benchmarks and your relative position to those benchmarks. Even simple benchmarking exercises provide answers to some very important questions. • What is my risk profile versus that of the industry? • How does the composition of my portfolio differ from that of my peers? • How do my delinquencies compare to those of my peers? How has this position been changing? By having a thorough understanding of one’s position in these challenging circumstances, it allows for a more educated foundation upon which to build assessments of the future.
We at Experian have been conducting a survey of visitors to our Red Flag guidelines microsite (www.experian.com/redflags). Some initial findings show that approximately 40 percent of those surveyed were "ready" by the original November 1, 2008 deadline. However, nearly 50 percent of the respondents found the Identity Theft Red Flag deadline extension(s) helpful. For those of you that have not taken the survey, please do so. We welcome your feedback.
One of the handful of mandatory elements in the Red Flag guidelines, which focus on FACTA Sections 114 and 315, is the implementation of Section 315. Section 315 provides guidance regarding reasonable policies and procedures that a user of consumer reports must employ when a consumer reporting agency sends the user a notice of address discrepancy. A couple of common questions and answers to get us started: 1. How do the credit reporting agencies display an address discrepancy? Each credit reporting agency displays an “address discrepancy indicator,” which typically is simply a code in a specified field. Each credit reporting agency uses a different indicator. Experian, for example, supplies an indicator for each displayable address that denotes a match or mismatch to the address supplied upon inquiry. 2. How do I “form a reasonable belief” that a credit report relates to the consumer for whom it was requested? Following procedures that you have implemented as a part of your Customer Identification Program (CIP) under the USA PATRIOT Act can and should satisfy this requirement. You also may compare the credit report with information in your own records or information from a third-party source, or you may verify information in the credit report with the consumer directly. In my last posting, I discussed the value of a risk-based approach to Red Flag compliance. Foundational to that value is the ability to efficiently and effectively reconcile Red Flag conditions…including addressing discrepancies on a consumer credit report. Arguably, the biggest Red Flag problem we solve for our clients these days is in responding to identified and detected Red Flag conditions as part of their Identity Theft Prevention Program. There are many tools available that can detect Red Flag conditions. The best-in-class solutions, however, are those that not only detect these conditions, but allow for cost-effective and accurate reconciliation of high risk conditions. Remember, a Red Flag compliant program is one that identifies and detects high risk conditions, responds to the presence of those conditions, and is updated over time as risk and business processes change. A recent Experian analysis of records containing an address discrepancy on the credit profile showed that the vast majority of these could be positively reconciled (a.k.a. authenticated) via the use of alternate data sources and scores. Layer on top of a solid decisioning strategy using these elements, the use of consumer-facing knowledge-based authentication questions, and nearly all of that potential referral volume can be passed through automated checks without ever landing in a manual referral queue or call center. Now that address discrepancies can no longer be ignored, this approach can save your operations team from having to add headcount to respond to this initially detected condition.
Learn More Image
