QUESTION
Your newsletters and papers on elder abuse really resonate with us. Our bank is located in an area in Florida where there is a high percentage of retired people. We also own a non-bank subsidiary that our retired customers use for various real estate financing needs.
So, we have considerable experience in looking out for potential elder financial abuse. That said, our non-bank subsidiary is branching to other states, and we would like to know more about the mandatory reporting requirements in states.
Our compliance department personnel know you have written a lot about this subject, so we feel you could help us identify some of these states and maybe even some laws that we can consider to include in our policies and procedures.
What states mandate reporting of elder financial abuse? What states have voluntary reporting? Are there a few tips you could give us about monitoring for such abuse? And, are there helpful Best Practices you would suggest?
ANSWER
Yes. I have written extensively about elder financial exploitation. Go to my article that provides numerous links to my articles and papers on this subject, Elder Financial Exploitation: Prevention and Filing SARs. It seems every time we identify a scam against senior citizens, another one pops up.
Elders are taken advantage of by scam artists, financial advisors, family members, friends, acquaintances, caregivers, home repair contractors, real estate firms, residential mortgage loan originators, credit repair companies, stockbrokers, accountants, lawyers, collection agents, appraisers, fiduciaries, guardians, unscrupulous professionals and business people (or those posing as such), pastors, annuity salespersons, and doctors.
A majority of the states now mandate financial institutions and or persons tied to the financial institution to report suspected financial exploitation against seniors and other vulnerable customers to law enforcement and social service agencies.
Depending upon the state, the applicable law will limit the definition of persons to a subset of persons such as “officers and employees” or cover “any person.”
Here is the list of the states with mandatory reporting requirements.
States with Mandatory Reporting Requirements
As of this writing, the 27 states include:
1. Arizona
2. Arkansas
3. California
4. Colorado
5. Delaware
6. Florida
7. Georgia
8. Hawaii
9. Indiana
10. Kansas
11. Kentucky
12. Louisiana
13. Maryland
14. Michigan[i]
15. Mississippi
16. Nevada
17. New Hampshire
18. New Mexico
19. North Carolina
20. Ohio
21. Oklahoma
22. Rhode Island
23. South Carolina
24. Tennessee
25. Texas
26. Utah
27. Wyoming
In July 2019, Appendix A of the CFPB’s 2019 Revised Advisory and Recommendations for Financial Institutions on “Reporting of Suspected Elder Financial Exploitation” (“CFPB 2019 Revised Advisory”). The CFPB 2019 Revised Advisory is available HERE.
We should discuss the variations on qualifications for covered entities. Uniformly, the financial institution must be chartered and supervised under federal or state banking law. Note a financial institution may be required to hold a state charter where the financial institution is located – not just any state. In Nevada, for example, the financial institution must be regulated pursuant to Nevada law and not just the law of any state.[ii]
Whether or not the financial institution is a depository institution can trigger mandatory reporting requirements. The Kansas statute sweeps broadly by covering “finance companies” (non-depository institutions) “chartered and supervised under federal or state law.”[iii] In Maryland, the statute places reporting requirements on “any other organization,” provided the organization is formed under the banking laws of “this state” and supervised by Maryland’s banking commissioner.[iv]
Appendix A of the CFPB 2019 Revised Advisory shows the many variations, state by state, where applicable. Given the number of qualifiers and combinations, it is important to draw the necessary distinctions carefully. The mandatory reporting statutes may place the reporting burden on:
(a) only the financial institution,
(b) any person or a subset of individuals tied to the financial institution and not the financial institution, or
(c) the financial institution and any person or a subset of individuals tied to the financial institution.
Mississippi’s statute includes “any officer or employee of a bank, savings and loan, credit union” along with “any other financial provider.”[v] Florida includes a “trustee of a bank, savings and loan, or credit union.”[vi]
Let me suggest a term for a standard that should be used in your policies and procedures: the “knowledge standard.” By the knowledge standard, I mean the triggering standards which can be framed in terms of “actual knowledge” or “reasonable cause to suspect” as in Florida (“Bank, savings and loan, or credit union officer, trustee, or employee . . . knows, or has reasonable cause to suspect”).[vii] Whereas Georgia only requires “reasonable cause to believe” (“any employee of a financial institution . . . having reasonable cause to believe . . .”).[viii] That is a distinction with a significant difference!
The fact is, concerning mandatory reporting by persons, proof is not typically required. However, some states require the production of financial records or access to financial records upon written request from law enforcement.
In those states with mandatory reporting requirements, financial institutions must report suspected financial exploitation of older adults to all appropriate local, state, or federal responders. The CFPB strongly urges all financial service providers – banks and non-bank organizations – to report regardless of whether reporting is mandatory or voluntary under state law.
All reporting financial institutions can rely on several federal laws for immunity from prosecution, whether doing so voluntarily or pursuant to state law. The CFPB 2019 Revised Advisory clarifies that reporting the financial abuse of older adults to appropriate authorities does not violate, in general, the Gramm-Leach-Bliley Act's (GLBA) privacy protection provisions citing interagency guidance from eight federal regulators.[ix]
You may not have heard of a related law, the Senior Safe Act. The Senior Safe Act provides institutional safe harbors to depository institutions and credit unions, although its primary focus is on investment advisers, broker-dealers, insurance companies, insurance agencies, insurance advisers, and transfer agents.[x] To qualify for the safe harbor, “the report must be made in good faith and with reasonable care, and the employee must have received appropriate training on how to identify and report elder exploitation.”[xi]
The Senior Safe Act itself does not mandate reporting or training.[xii] However, it does make the safe harbor for the financial institution contingent on the institution providing training, and reporting individuals must have received appropriate training. I would like to see the Senior Safe Act broadened to include bank and non-bank residential mortgage lenders and originators or a comparable act to apply to such entities.
In addition to institutional immunity, the Senior Safe Act provides individual safe harbors to these specific categories of individuals:
(a) individuals who served as a supervisor or in a compliance or legal function (including as a Bank Secrecy Act officer) for a financial institution, or
(b) individuals who are affiliated or associated with a covered financial institution, in the case of a registered representative, investment adviser representative, or insurance producer.
There are states where reporting is voluntary.
States with Voluntary Reporting Requirements
As of this writing, these are 24 states that do not require mandatory reporting.
1. Alabama
2. Alaska
3. Connecticut
4. Delaware
5. Idaho
6. Illinois
7. Iowa
8. Maine
9. Massachusetts
10. Missouri
11. Mississippi
12. Nebraska
13. New Jersey
14. New York
15. North Dakota
16. Oregon
17. Pennsylvania
18. South Dakota
19. Vermont
20. Virginia
21. West Virginia
22. Wisconsin
Generally, these statutes permit financial institutions to report elder financial abuse (or abuse of senior or vulnerable customers) but do not require the institution or individuals tied to the financial institution to investigate or report suspected elderly financial exploitation. Instead, the statutes are focused on protecting banks from litigation alleging violation of the customer’s right of privacy.
For instance, New Jersey’s statute is an example. In the case Lucca v. Wells Fargo (Lucca),[xiii] the court concluded that the
"...statute was enacted for the special benefit of financial institutions – to give financial institutions guidance in how much information may be released and the entities to which they may release such information. It provides a safe harbor against lawsuits based upon the institution's actions."
The court continued:
"One final point. [The statute] gives a bank a safe harbor when it decides 'in good faith not to disclose information that it is permitted to disclose under this act regarding the account relationship of a senior or vulnerable customer. . ..' If the bank acts in good faith, it 'shall not be liable under any law or regulation or common law of this State for the decision.' This creates an affirmative defense for the bank, not a cause of action for the bank's customer."[xiv]
There are some tools under state laws that authorize the delaying of disbursement of funds where elder financial abuse is suspected. Several states allow depository institutions and qualified individuals to delay disbursement of funds when the financial institution or qualified individual believes financial exploitation of an "eligible adult" may occur. Generally, these statutes require reporting suspected abuse to specified law enforcement authorities. The CFPB 2019 Revised Advisory includes the following states as having laws authorizing delays in disbursement of funds: Delaware, Kentucky, Tennessee, Texas, and Washington.[xv]
Filing Suspicious Activity Reports (SARs) is voluntary but encouraged. SARs are another avenue authorizing a financial institution with SARS requirements to report suspected elderly financial exploitation. A research study conducted by the CFPB published in 2019 reports that elderly financial exploitation “is widespread and damaging, with an average loss of $41,800 among adults over age 70 who sustained a loss.” Is this statistic not atrocious?
And, keep in mind, the filing of SARs does not automatically register these reports with law enforcement and social service agencies. Separate measures to alert these responders are necessary.[xvi]
Status Quo
So, here is my summary of the status quo relating to elder financial exploitation:
· A slim majority of states require mandatory reporting by financial institutions to law enforcement and social service agencies of suspected elder financial exploitation.
· Read applicable state law closely to ascertain whether the mandatory reporting requirements are applicable.
· The mandatory reporting requirements can extend to the financial institution itself, the financial institution, and a subset of individuals tied to the financial institution or just the subset of individuals.
· Read applicable state law closely to ascertain whether a law in effect applies to elder financial exploitation, but the reporting requirements are voluntary.
· Both mandate and voluntary reporting requirements under state law often contain immunity and safe harbor provisions.
· Safe harbor provisions under federal law, the Senior Safe Act, provide a safe harbor to covered financial institutions and eligible individuals, but the safe harbor is conditioned on established training requirements having been fulfilled by the individual reporting source. As I mentioned above, I would like to see the Senior Safe Act broadened to include bank and non-bank residential mortgage lenders and originators or a comparable act to apply to such entities.
Just because reporting may be voluntary rather than mandated does not mean there are reliable Best Practices for voluntary reporting. In 2016, the CFPB published an advisory for financial institutions establishing six categories of voluntary best practices to help financial institutions prevent elder financial abuse and intervene effectively when suspicious activity occurs.[xvii] These categories are:
1. Developing and implementing internal protocols and procedures for protecting account holders from elder financial exploitation.
2. Training management and staff to prevent, detect, and respond to suspicious events.
3. Detecting elder financial exploitation by harnessing technology.
4. Reporting all cases of suspected exploitation to relevant federal, state, and local authorities.
5. Protecting older account holders by complying with the Electronic Fund Transfer Act (EFTA) and Regulation E and by offering age-friendly services that can enhance protections against financial exploitation.
6. Collaborating with other stakeholders such as law enforcement, adult protective services, and service organizations.
The CFPB 2019 Revised Advisory is a more in-depth discussion of category No. 4 above (viz., the “reporting of all cases of suspected exploitation to relevant federal, state, and local authorities.”). The foregoing Best Practices should be applied to a financial institution’s customer relationship policies and procedures, among other things.
In addition, applicable state laws are not uniform. They require close analysis. Nonetheless, covered financial institutions and covered financial service organizations are prudent to be guided by the CFPB’s original 2016 Advisory and 2019 elaboration as a baseline.
One parting note, beware of the litigation risk for not reporting! In many instances, proactive reporting is protected by safe harbor and immunity provisions under state and federal law. But not reporting creates exposure to litigation risk from the elderly and other stakeholders harmed by financial exploitation.
Jonathan Foxx, Ph.D., MBAChairman & Managing Director
[i] Michigan is
the most recent state to enact a financial exploitation prevention act.
Michigan’s law was effective on September 27, 2021
[ii] Nev. Rev.
Stat. § 657.160
[iii] Kan. Stat.
Ann. §39-401(q)
[iv] Md. Fin.
Inst. Code §1-301(b)
[v] Miss. Code Ann. §43-47
[vi] Fla. Stat. §
415.1034(1)(a)
[vii] Fla. Stat. §
415.1034(1)(a)
[viii] Ga. Code
Ann. § 30-5-4(a)(1)(B). Also see CFPB 2019 Revised Advisory at footnote 53.
[ix] See Fed.
Reserve, CFTC, CFPB, FDIC, FTC, NCUA, OCC & SEC, “Interagency Guidance on
Privacy Laws and Reporting Financial Abuse of Older Adults” (Sept. 23, 2013)
[Interagency Guidance]. The Interagency Guidance is available at https://files.consumerfinance.gov/f/201309_cfpb_elder-abuse-guidance.pdf. The Senior
Safe Act, also a federal statute, provides immunity in certain situations. See
12 U.S.C. §3423 (2018).
[x] 12 U.S.C. §
3423 (2018) Also see the Senior Safe Act Fact Sheet at
[xi] Idem at 7-8
[xii] CFPB 2019
Revised Advisory at 7
[xiii] Lucca v.
Wells Fargo, N.A., 441 N.J. Super. 301, 117 A.3d 1267 (Super. Ct. 2015)
[xiv] Lucca, 441
N.J. Super. 301, 314-15, 117 A.3d 1267, 1275
[xv] CFPB 2019 Revised Advisory at 6
[xvi] CFPB 2019 Revised Advisory at 9
[xvii] Advisory for
financial institutions on preventing and responding to elder financial
exploitation (March 23, 2016), available at https://files.consumerfinance.gov/f/201603_cfpb_advisory-for-financial-institutions-on-preventing-and-responding-to-elder-financial-exploitation.pdf
