Compliance Update with Amy K

​Cybersecurity is a year-round task; resources are available to help educate your members about how to be smart online. Plus, CFPB guidance on Junk Fees, and new content on InfoSight. 

by Amy Kleinschmit, Chief Compliance Officer

Cybersecurity – Year Round Task
As October winds to an end, along with Cybersecurity Awareness Month, it is important to continue to remind members that they need to remain vigilant year-round and protect their personal information – just as credit unions are continually tasked with ensuring your systems remain protected from cybersecurity attacks.

There are numerous resources available that credit unions that use to help educate your membership on how to be smart online and keep their information protected.

This printable poster from the IRS lists basic steps people can take to protection personal and financial information, such as:

• Use security software for computers and mobile phones – and keep it updated.
• Avoid phishing scams, especially those related to tax refunds and COVID-19, Economic Impact Payments and other tax law changes.
• Use strong and unique passwords for all accounts.
• Use multi-factor authentication whenever possible.
• Shop only secure websites by looking for the “https” in web addresses.
• Avoid shopping on unsecured and public Wi-Fi.

Some additional tips from the IRS for staying safe online – especially to help protect children and other vulnerable groups from potential dangers to their personal data are:

• Recognize and avoid scams. Phishing emails, fake social media profiles, threatening phone calls and texts from thieves posing as the IRS or legitimate organizations, especially government programs, present ongoing risks. Learn what a scam call sounds like, and do not click on links or download attachments from unsolicited suspicious emails from unknown senders and verify contact/content/context with trusted senders.
• Never overshare. Providing only what is necessary will minimize online exposure to scammers and criminals. Do not share too much personal information like birthdates, addresses, age, financial information such as bank account and Social Security numbers.
• Public Wi-Fi networks. Connection to Wi-Fi in a mall or coffee shop is convenient but it may not be safe. Cybercriminals can easily intercept personal information on public networks so always use a virtual private network when connecting to public Wi-Fi.
• Use security software and anti-virus protections. Make sure electronic devices have security software that is always turned on and can automatically update. Encrypt sensitive files such as tax records stored on computers. Ensure all family members have comprehensive protection, especially if devices are being shared. Use strong, unique passwords for each account. Consider a password manager, enable two-factor or multi-factor authentication for business, personal and online accounts.

In addition to the resources discussed in prior Memo articles, here is more information from South Dakota – including quizzes for kids to learn online safety, cybersecurity education, and videos – including a video of Senator Rounds discusses the importance of cyber hygiene.
​
FREE Webinar: The Crossroads of Cybersecurity & Fraud
Speaking of cybersecurity, there’s no better time than now to join Alloya for this jam-packed, 90-minute free webinar covering a series of cybersecurity and fraud prevention topics, hosted by two of Alloya’s risk-management experts! Part I: Protecting Your Credit Union From Cyber Threats will demonstrate how taking proactive steps to protect both your credit union and members is essential. Part II of this webinar will cover recent payment fraud trends and how to mitigate payment fraud losses at your credit union. For more information or to register for this session, click here.
 
InfoSight – New Content
Person-to-Person (P2P) Transactions - With the increased popularity of person-to-person (P2P) transactions, a new topic, Person-to-Person (P2P) Transactions, was added to the ACH/Electronic Payments channel. This topic was created to highlight and assist credit unions with the application of Regulation E; specifically, unauthorized transactions and the error resolution process the credit union must conduct.

Remember - InfoSight provides immediate access to current compliance topics​ which explain: What is the issue (in laymen’s terms)​; How it affects credit unions​; What credit unions need to do — the action steps needed​. InfoSight also provides helpful tools, such as frequently asked questions and checklists.

This is NOT just for the Compliance Officer! Compliance touches every area of the credit union and InfoSight can provide information for front line staff, HR, Loan Officer, Board & Volunteers, Executive Staff, Marketing, Collections, and more. InfoSight is provided as a FREE benefit of membership for affiliated credit unions. If you haven’t already, request your account here.
 
IRS – 401k and IRA limits increase
The IRS recently issued IR-2022-188 announced today that the amount individuals can contribute to their 401(k) plans in 2023 has increased to $22,500, up from $20,500 for 2022. 

Additionally, the limit on annual contributions to an IRA increased to $6,500, up from $6,000. The IRA catch‑up contribution limit for individuals aged 50 and over is not subject to an annual cost‑of‑living adjustment and remains $1,000.

Be sure to review IR-2022-188 at the link above for additional information on the 2023 changes, including information on catch-up 401(k) contribution limits for employees aged 50 and over.
 
CFPB Guidance – Junk Fees on Deposit Accounts
The Consumer Financial Protection Bureau (CFPB) recently issued Guidance to Help Banks Avoid Charging Illegal Junk Fees on Deposit Accounts which can be found here.

The CFPB also issued Consumer Financial Protection Circular 2022-06 that discusses whether “the assessment of overdraft fees constitute an unfair act or practice under the Consumer Financial Protection Act(CFPA), even if the entity complies with the Truth in Lending Act (TILA) and Regulation Z, and the Electronic Fund Transfer Act (EFTA) and Regulation E?” The answer is YES, per the CFPB. As discussed in more detail in the Circular, an unanticipated overdraft fee occurs when financial institutions assess overdraft fees on transactions that a consumer would not reasonably expect would give rise to such fees.

This Circular highlights potentially unlawful patterns of financial institution practices regarding unanticipated overdraft fees and provides some examples of practices that might trigger liability under the CFPA. One of these examples is “authorize positive, settle negative” or APSN transactions, when financial institutions assess an overdraft fee for a debit card transaction where the consumer had sufficient available balance in their account to cover the transaction at the time the consumer initiated the transaction and the financial institution authorized it, but due to intervening authorizations, settlement of other transactions (including the ordering in which transactions are settled), or other complex processes, the financial institution determined that the consumer’s balance was insufficient at the time of settlement.

The CFPB also issued Bulletin 2022-06: Unfair Returned Deposited Item Fee Assessment Practices, which can be found here. This Bulletin discusses Returned Deposited Items - checks that a consumer deposits into their checking account returned to the consumer because the check could not be processed against the check originator’s account. The CPFB finds that blanket policies of charging Returned Deposited Item fees to consumers for all returned transactions irrespective of the circumstances or patterns of behavior on the account are likely unfair under the Consumer Financial Protection Act (CFPA).

Per the CFPB, “In many of the instances in which Returned Deposited Item fees are charged, consumers would not be able to reasonably avoid the substantial monetary injury imposed by the fees. An injury is not reasonably avoidable unless consumers are fully informed of the risk and have practical means to avoid it.”

As always, DakCU members may contact Amy Kleinschmit with any compliance related questions. 

---