AI Credit Score Underwriting

QUESTION 

Thank you for your recent columns on artificial intelligence in mortgage banking. I want to know how to handle credit scores using AI. I am the SVP Operations of a large wholesale lender. We want to include AI in our underwriting. In particular, we want to use it to evaluate a borrower's creditworthiness. However, our legal department has advised us that there are huge privacy issues. 

We do not want to be dependent on the credit reporting agencies for AI information. And we do not want to outsource AI in our credit score underwriting. The AI evaluation methods we discussed with legal have been shut down due to potential privacy violations. 

What are the privacy risks in using AI to determine a borrower's credit score? 

COMPLIANCE SOLUTION 

AI Policy Program for Mortgage Banking 

A well-constructed AI Policy Program is a proactive means designed to avoid and mitigate risks associated with Artificial Intelligence (AI). AI risk management is a key component of responsible development and use of AI systems. Responsible AI practices can help align the decisions about AI system design, development, and use with intended aims and values.

RESPONSE 

The privacy challenges associated with artificial intelligence are enormous, and the risks will only become more and more difficult to mitigate. In our recently issued AI Policy Program for Mortgage Banking, we sought to provide a comprehensive policy framework for using AI in mortgage banking. Indeed, one of the policies in the Policy Program is titled "Artificial Intelligence Credit Underwriting Policy." 

If you need a policy framework for AI, please request information about our Policy Program. 

AI credit score underwriting is an uncharted legal and regulatory territory! 

You will find that most of your legal department's concerns about AI in mortgage lending involve the collection and potential misuse of vast amounts of sensitive personal data, heightened cybersecurity vulnerabilities, and a lack of transparency that can lead to a loss of consumer trust and potential regulatory non-compliance. 

Broadening this out, AI in credit score underwriting stems from the extensive collection of sensitive, alternative data, the potential for unauthorized access and data breaches, and the difficulty in ensuring transparency and consumer control over how personal information is used. 

Whatever you do, you will need to be in lockstep with your legal advisors. This "territory" is dotted with legal minefields! Let's consider these risks. 

AI models require vast amounts of data, often going beyond traditional financial information to include "alternative data" such as geolocation, social media activity, online behavior, transaction histories, and even biometric data. The sheer volume and sensitive nature of this extensive data collection increase the overall risk to consumer privacy. 

Zero in on that data! It can be collected for one purpose but might be used for other, unforeseen purposes without the user's explicit consent. This lack of control over how personal data is processed raises significant privacy issues. From the legal perspective, this amounts to unauthorized use and repurposing. 

The large datasets used to train AI models are attractive targets for cyber attackers. Inadequate security measures or vulnerabilities in third-party vendor systems can lead to data breaches, exposing sensitive personal and financial information and increasing the risk of identity theft or fraud. Data security must be failsafe. 

AI algorithms can analyze seemingly innocuous data to infer highly personal attributes, such as health status, political views, or ethnic origin (a "predictive harm"). From a regulatory perspective, this risk arises from the inference of sensitive Information. In other words, this capability to derive sensitive insights can lead to potential discrimination and privacy infringements. 

Complex AI algorithms can be difficult to explain, even for their developers, creating a Black Box where it is unclear exactly how a specific credit decision was reached. This opacity, its lack of transparency, deprives consumers of understanding why they were denied credit and of exercising their right to an explanation or an appeal. I have written here about the Black Box "model" or "problem". 

Do not assume that so-called "anonymized" data effectively mitigates risk. Even when data is "anonymized," AI can sometimes de-anonymize individuals by cross-referencing various data points, compromising individual privacy.

Mortgage Fraud: Basic Categories

QUESTION 

We are reviewing our branch and home office procedures for identifying mortgage fraud. As the Compliance Officer, I receive all allegations of mortgage fraud for review. However, I can't be at all the branches all the time, and I want to be able to categorize some basic areas related to mortgage fraud. 

Each branch has a Branch Manager who works with a senior underwriter to identify potential mortgage fraud. The senior underwriter conducts a second review, and the Branch Manager provides oversight. Even with the training we do, there is no standardization for a categorical approach. What I am looking for is a list of the most likely areas of mortgage fraud. We would like to distribute the list so that it can be used throughout the company. It will help us to set basic standards. 

What are some of the basic categories of mortgage fraud? 

COMPLIANCE SOLUTION 

QC Tune-up® 

Forensic Mortgage Audit®

RESPONSE 

Mortgage fraud prevention is an area in which we have extensive expertise. Indeed, we invented the Forensic Mortgage Audit®, which uses loan-level reviews to detect mortgage fraud. I've provided expert witness representation and given testimony in cases related to mortgage fraud. Our clients regularly discuss potential cases of it with us. We've written policies and procedures to prevent it. I've spoken about it at conferences and written extensively on the topic, for instance, here. 

Here's my published article, with linked sections, entitled Mortgage Fraud Challenges: How to Catch a Crook. 

And I can tell you, based on my experience, crooks continue to find new ways to commit mortgage fraud all the time. To identify the means and methods of these crooks requires staying one step ahead of them – and, even then, they devise new plans to scam, deceive, rip off, con, double-deal, cheat, and skunk their way toward new contrivances of chicanery. 

For instance, request information about our Identity Theft Prevention Program – a program which, by the way, is a statutory requirement. Our policy provides an extensive list of the various nefarious methods by which thieves commit mortgage fraud. 

If you are a subscriber to our newsletters, we will be happy to provide our checklist of Common Red Flags for Mortgage Fraud. Just request it here! 

BASIC CATEGORIES

The basic features of mortgage fraud revolve around intentional deception or misrepresentation to obtain a mortgage loan or to profit from the lending process. 

If you're looking for a basic set of mortgage fraud categories, it is possible to group them into a few areas, with the proviso that this construct is a very high-level outline. The outline should not be taken as comprehensive. But if you want to offer it to the affected personnel, it might help to streamline the review process. 

I think you should still be notified that a mortgage fraud review is taking place, even if the second review clears it. Be aware of potential false positives! 

In my opinion, mortgage fraud can be categorized into fraud for housing, fraud against homeowners, and fraud for profit. Unfortunately, industry professionals are often involved in mortgage fraud activities in pursuit of profits. 

So, let's outline these categories. 

Fraud for Housing 

This illicit activity happens when a borrower provides false information to acquire or maintain ownership of a home. A borrower commits this type of fraud to obtain or maintain ownership of a home in an illegal manner. They may misrepresent their financial standing to qualify for a loan they would not otherwise be able to get. 

Categories of Fraud For Housing 

Income and Employment Fraud 

Falsifying or inflating income, fabricating employment history, or creating forged documents like W-2s, tax returns, and bank statements to qualify for a larger loan or a better interest rate.

Elder Theft and Elder Scams

QUESTION 

Our bank formed a group to prevent elder financial exploitation. Most of our clients are seniors and elderly, so we want to be sure our customers are protected from being exploited. They revised a number of screening procedures to catch fraud. They report directly to our Chief Compliance Officer. 

In the last year, we have seen a substantial increase in elder financial exploitation. What bothers me is that most of the crooks seem to get away with financially exploiting older people because we sometimes catch the crooks after the fraud happens. This means we are constantly revising the filters, and we are continually having to update our training. 

As a member of the group, I have been asked to contact you to help us further develop our policy and procedures involving the prevention of elder financial exploitation. In particular, we are interested in outlining the difference between Elder Theft and Elder Scams because we plan to separate the policy into those two primary parts. We have read your articles on elder financial exploitation and have heard you speak on this subject. We need some assistance in developing better filters. 

What is the difference between Elder Theft and Elder Scams? 

COMPLIANCE SOLUTIONS 

EFE TUNE-UP®

Elder Financial Exploitation - Prevention 

POLICIES AND PROCEDURES 

ANSWER 

I have published extensively on the financial abuse and scams referred to as Elder Financial Exploitation (EFE). My efforts have included numerous articles and published White Papers, lectures, and webinars, being a panelist in organizational conferences, and, of course, working with clients who needed to file a Strategic Activity Report (SAR) or notify the FBI with respect to EFE concerns. 

Here are a few of my writings on this subject: 

Suspicious Activity and Elder Financial Abuse 

Elder Financial Abuse: Disclosure, Schemes, and “Red Flags” 

Elder Financial Exploitation 

Elder Financial Exploitation: Prevention and Filing SARs 

Elder Financial Abuse Epidemic 

Elder Financial Abuse: Prevention and Remedies (PDF) 

Elder Financial Abuse (PDF) 

The Articles section of our website has several articles that directly and indirectly relate to Elder Financial Exploitation. Use them to help build your policy and procedures document. 

My firm even provides a free checklist of Behavioral and Financial Red Flags – Elder Financial Abuse! Contact us for a copy! 

I will tell you straight out: EFE seems to keep happening relentlessly – and growing rapidly. 

My answer here is going to be in the form of a “preamble” to your policy. Consider using these preambles as a base for the further formulation of your policies and procedures relating to Elder Theft and Elder Scams. 

For many years, amid rampant fraud and abuse targeting older adults, FinCEN has urged financial institutions to detect, prevent, and report suspicious financial transactions. Every year since 2006, FinCEN has issued an advisory in support of World Elder Abuse Awareness Day[i], commemorated on June 15^th. The statistics are not getting better. They are worsening. 

For instance, depository institutions filed 46,888 EFE-related BSA reports from March 2023 to May 2023, accounting for nearly 30 percent of the total EFE-related reports filed in the review period. This pace appears to be continuing, as FinCEN received an average of 15,993 EFE BSA reports per month between 15 June 2023 and 15 January 2024.[ii] You do the math! 

Before we get too far into my response, let me put down a working definition of EFE: 

Elder Financial Exploitation (EFE) is the illegal or improper use of an older adult’s funds, property, or assets. Older adults are typically considered individuals aged 60 or older. EFE consists of two primary subcategories: elder theft and elder scams. 

Elder theft consists of schemes involving the theft of an older adult’s assets, funds, or income by a trusted person. Elder scams involve the transfer of money to a stranger or imposter for a promised benefit or good that the older adult did not receive. EFE is one type of elder abuse, which includes physical, emotional, and financial abuse. Elder abuse and EFE definitions vary statutorily by state.[iii] 

Elder theft often occurs when persons known and trusted by older adults steal victim funds, while elder scams involve fraudsters with no known relationship to their victims. Indeed, some scammers are located outside the United States.[iv] Sadly, elder theft is likely to be underreported and can go undetected because the perpetrators are typically individuals whom the victim trusts.[v] 

FinCEN analysis of Bank Secrecy Act (BSA) information indicates that elder scams mostly rely on less sophisticated scam typologies. However, some scammers make their scams more complex by blending multiple scam types into one victimization and using victims both as a source of funds and to launder illicit gains.[vi] 

Scammers are often organized, with fraud rings ranging from small groups of individuals to organizations with hundreds of members. There are violent criminal organizations known to carry out fraud schemes, including EFE-related fraud. 

Unfortunately, perpetrators of EFE schemes often do not stop after first exploiting their victims. In both elder theft and elder scams, older adults are frequently re-victimized[vii] and subject to potentially further financial loss, isolation, and emotional or physical abuse long after the initial exploitation due to the significant illicit gains at stake. Scammers may also sell victims’ Personally Identifiable Information (PII) on the black market to other criminals who continue to target the victims using new and emerging scam typologies.[viii] 

ELDER THEFT 

Elder theft is so insidious because the family of the victim is often the perpetrator. Another form of elder theft is where a non-family caregiver financially abuses the relationship from t a position of trust. In 2019, FinCEN analyzed SARs based on elder theft narratives.[ix] The analysis found that a family member was involved in the theft of assets from older adults in 46 percent of elder theft cases reported between 2013 and 2019. 

Who were these perpetrators? Family members, familiar associates, acquaintances such as neighbors, friends, financial services providers, business associates, or those in routine close proximity to the victims. 

Considerable studies have been undertaken by senior citizen organizations, FinCEN, DOJ, and many state governmental authorities to find a pattern to this criminality. It turns out elder theft often follows a similar methodology in which trusted persons may use deception, intimidation, and coercion against older adults in order to access, control, and misuse their finances. Criminals frequently exploit victims’ reliance on support and services and will take advantage of any cognitive and physical disabilities.[x] Environmental factors such as social isolation lead to elder theft. 

The criminal’s goal is to establish control over the victims’ accounts, assets, or identity.[xi] Here are just a few of the ways in which financial exploration takes place. The elder may be financially abused by the exploitation of legal guardianships[xii] and power of attorney arrangements[xiii] or the use of fraudulent investments such as Ponzi schemes[xiv] to defraud older adults of their income and retirement savings. These relationships lead to repeated abuse, as the trusted person repeatedly abuses the victims by liquidating their savings and retirement accounts, stealing Social Security benefit checks and other income, transferring property and other assets, or maxing out credit cards in the name of the victims until most of their assets are stolen.[xv] 

ELDER SCAMS 

Criminals involved in elder scams defraud victims into sending payments and disclosing PII under false pretenses or for a promised benefit or good the victims will never receive. These scammers are often located outside of the United States and have no known previous relationship with the victims. 

Like Elder Theft, a pattern of criminality can be identified. Elder scams often follow a similar methodology in which scammers contact older adults under a fictitious persona via phone call, robocall, text message, email, mail, in-person communication, online dating apps and websites, or social media platforms. In order to appear legitimate and establish trust with older adults, scammers commonly impersonate government officials, law enforcement agencies, technical and customer support representatives, social media connections, or family, friends, and other trusted persons. 

There are several typical types of elder scams. To name but a few: 

·       Government Imposter Scams; 

·       Romance Scams;[xvi] 

·       Emergency or Person-in-Need Scams; 

·       Lottery and Sweepstakes Scams; 

·       Tech and Customer Support Scams. 

This set-up is a con that evokes stress in the victim. Perpetrators often create high-pressure situations by appealing to their victims’ emotions and taking advantage of their trust or by instilling fear to solicit payments and PII. This is, in effect, an Imposter Scam.[xvii] Scammers often request victims to make payments through wire transfers at money services businesses (MSBs) but are increasingly requesting payments via prepaid access cards, gift cards, money orders, tracked delivery of cash and high-valued personal items through the U.S. Postal Service, ATM deposits, cash pick-up at the victims’ houses, and convertible virtual currency (CVC).[xviii] 

Money Mules are a particularly deceitful way to trap victims into an elder scam.[xix] A money mule is a person who, wittingly or unwittingly, transfers or moves illicit funds at the direction of or on behalf of another, in this case, transfers or moves illicit funds at the direction of the scammers. The victim of an elder scam can also serve as a money mule: the scammer convinces the victim to set up a bank account or Limited Liability Corporation (LLC) in the victim’s name to receive, withdraw, deposit, or transfer multiple third-party payments from other victimized older adults to accounts controlled by the scammer under the illusion of a “business opportunity.” In some circumstances, victims of EFE acting as money mules may be prosecuted for this illegal activity and are liable for repaying the other victims. They may also be subject to damaged credit and further victimized through their stolen PII.[xx] 

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director
Lenders Compliance Group

---

[i] World Elder Abuse Awareness Day, Administration for Community Living, launched by the International Network for the Prevention of Elder Abuse and the World Health Organization at the United Nations.

[ii] Financial Trend Analysis, Elder Financial Exploitation: Threat Pattern & Trend Information, June 2022 to June 2023, April 2024, Financial Crimes Enforcement Network.

[iii] Memorandum on Financial Institution and Law Enforcement Efforts to Combat Elder Financial Exploitation, Consumer Financial Protection Bureau (CFPB) and FinCEN, August 30, 2017; see also, Elder Abuse and Elder Financial Exploitation Statutes, U.S. Department of Justice (DOJ).

[iv] Advisory on Elder Financial Exploitation, FinCEN Advisory, FIN-2022-A002, June 15, 2022

[v] Recovering from Elder Financial Exploitation, A Framework for Policy and Research, September 2022, Consumer Financial Protection Bureau

[vi] Phantom Hacker Scams Target Senior Citizens and Result in Victims Losing their Life Savings, Alert Number I-091223-PSA, September 29, 2023, Federal Bureau of Investigations Internet Crime Complaint Center

[vii] For additional information on re-victimization in EFE schemes, see Addressing the Challenge of Chronic Fraud Victimization, March 2021, FINRA Investor Education Foundation (FINRA Foundation), American Association of Retired Persons (AARP), and Heart+Mind Strategies.

[viii] List Brokerage Firm Pleads Guilty to Facilitating Elder Fraud Schemes, September 28, 2020, Department of Justice

[ix] Elders Face Increased Financial Threat from Domestic and Foreign Actors, December 2019, FinCEN Financial Trend Analysis

[x] Idem

[xi] Associate Deputy Attorney General Paul R. Perkins Delivers Remarks at the ABA/ABA Financial Crimes Enforcement Conference, December 9, 2020, Department of Justice

[xii] Court-Appointed Pennsylvania Guardian and Virginia Co-Conspirators Indicted for Stealing Over $1 Million from Elderly Wards, June 30, 2021, Department of Justice

[xiii] Franklin, Tennessee Couple Charged With Defrauding Elderly Widow of $1.7 Million, May 12, 2021, Department of Justice; and Former Waterloo Medicaid Provider Sentenced to More than Five Years in Federal Prison for Defrauding Elderly Victim, June 28, 2021, Department of Justice

[xiv] Arizona Man Sentenced for Multimillion-Dollar Nationwide Investment Fraud Scheme, March 15, 2021, Department of Justice

[xv] Annual Report to Congress on Department of Justice Activities to Combat Elder Fraud and Abuse, October 18, 2021, Department of Justice

[xvi] In Romance Gone Awry: A Tale of AML and Negligence, April 14, 2022, I outline litigation involving a Romance Scam. Visit https://mortgage-faqs.blogspot.com/2022/04/romance-gone-awry-tale-of-aml-and.html. See O’Rourke v. PNC Bank, 2022 Del. Super. (Del. Sup. Ct. February 15, 2022)

[xvii] The Federal Trade Commission provides extensive information about Imposter Scams. Visit its webpage How To Avoid Imposter Scams, https://consumer.ftc.gov/features/how-avoid-imposter-scams. See my articles, such as Imposter Robocalls, February 9, 2023, https://mortgage-faqs.blogspot.com/2023/02/imposter-robocalls.html and COVID-19: Imposters and Money Mules, August 6, 2020, https://mortgage-faqs.blogspot.com/2020/08/covid-19-imposters-and-money-mules.html.

[xviii] FBI Warns of a Grandparent Fraud Scheme Using Couriers, Alert Number I-072921-PSAJuly 29, 2021, FBI; New Twist to Grandparent Scam: Mail Cash, December 3, 2018, Federal Trade Commission

[xix] See my article Op. cit. xvi COVID-19: Imposters and Money Mules.

[xx] The FBI maintains a website to increase public awareness of money mules. Visit Money Mules at https://www.fbi.gov/how-we-can-help-you/scams-and-safety/common-scams-and-crimes/money-mules

Online Data Collection Challenge

QUESTION 

Most of our business is from originating mortgages. Recently, we started originating Buy-Now-Pay-Later loans. I know you specialize in mortgage banking. And these are not mortgage loans. However, they are available online just like we offer our mortgages online. 

Our attorney told us that getting a customer's social security number for online Buy-Now-Pay-Later loans poses consumer privacy and information security risks. She says we could collect partial SSN information directly from the customer and then use a third party source to obtain the full SSN before opening the account. 

This is not a practical solution. As the sales manager, I am trying to find some kind of workaround. We need the SSN when the loan comes in online. Processing begins immediately and includes our CIP filters. However, if we use a third party to handle the BSA requirement, there could be a processing delay. 

Hopefully, you can shed some light on how to resolve this situation. Our attorney reads your articles and often sends them to us. So, I'm sure she will read your view on getting online SSN information. 

Can you explain why our attorney is concerned about our online CIP data collection involving Buy-Now-Pay-Later loans? 

COMPLIANCE SOLUTION 

Website Compliance Review 

Policies and Procedures

ANSWER 

Since 2006, Lenders Compliance Group has offered mortgage banking compliance. We do not provide compliance guidance for Buy-Now-Pay-Later (BNPL) loans. The BNPL loan is an installment loan that typically allows a customer to purchase something immediately with little or no initial payment and pay off the balance over four or fewer payments.[i] 

I will answer your question because you have an online origination platform that is used to originate mortgage loan products, where you have now introduced the origination of BNPL loans. 

You do not state if your company is contemplating partnering with a nonbank third party service provider to facilitate BNPL loan originations. 

Read on to find out why that information is a critical compliance element. 

I think there are more reasons for your attorney's directive than is described in your question. Given that you are marketing mortgage and non-mortgage products online, the online platform should be evaluated for its overall compliance with CIP requirements, among other things. Depending on the online consumer disclosures, product and service array, origination technology, and other factors, I think her concern is warranted. 

Please ask your attorney to contact me here. We'll discuss and resolve the situation. 

Your question comes as FinCEN is evaluating, via a Request for Information (RFI), existing requirements for banks under the Customer Identification Program Rule ("CIP Rule") to collect a taxpayer identification number (TIN) from a customer before opening an account. I'll provide a bird's-eye view of the anticipated plans, which may be responsive to your attorney's concerns. 

Generally, banks and nonbanks ("financial institution(s)" or "institution(s)") must collect a full Social Security Number (SSN) from a customer who is an individual and a U.S. person. The RFI, mentioned above, is being issued in consultation with staff at the OCC, FDIC, NCUA, and the Federal Reserve System (collectively, the "Agencies"). 

FinCEN is looking for feedback to understand the potential risks, benefits, and safeguards that could be established if financial institutions were permitted to collect partial SSN information directly from the customer for U.S. individuals and subsequently use reputable third party sources to obtain the full SSN before account opening. So, FinCEN's inquiry seems to align with your attorney's suggestion. Agencies usually issue an RFI because they want certain information to evaluate practices and, in this case, a better understanding of current industry practices and perspectives related to the CIP Rule's TIN collection requirement. So, their inquiry is based on wanting to assess the potential risks and benefits associated with a change to that requirement. 

From the start of anti-money laundering compliance, financial institutions have collected identifying information from a customer before opening an account. FinCEN, in consultation with staff at the Agencies, seeks information and comments from interested parties regarding the CIP Rule requirement for financial institutions to collect a taxpayer identification number (TIN) and other information from a customer who is a U.S. person before opening an account. 

There are minimum standards[ii] for such information collection, including, among other things, reasonable procedures[iii] for 

(1) verifying the identity of any person seeking to open an account to the extent reasonable and practicable; and 

(2) maintaining records of the information used to verify a person's identity, including name, address, and other identifying information.  

It is, therefore, a given that, to satisfy the CIP Rule's TIN collection requirement for a U.S. individual, a financial institution must collect the full SSN from the customer before opening an account. While an institution's procedures for verifying a customer's identity may be risk-based and may vary among institutions, the CIP Rule makes clear that the collection of certain identifying information is a minimum requirement, and such information must be collected directly from the customer before opening an account, except concerning credit card accounts. 

That said, the CIP Rule generally does not allow a financial institution to collect an individual's SSN from a person other than the customer (i.e., a third party service provider). 

When the CIP Rule was adopted, institutions were exempted from the requirement for credit card accounts to collect identifying information directly from the customer, including an identification number. Rather, financial institutions may collect the customer's identifying information, such as the SSN, for credit card accounts, from a third party source before extending credit to the customer. The agency saw at that time that without this exception, the CIP Rule would change an institution's business practices by mandating information beyond what was already obtained directly from a customer who opened a credit card account at the point of sale or by phone. 

Concerns were raised during the proposed CIP Rule's comment period that, for instance, a person applying for a credit card account would be hesitant to provide their SSN, especially through non-face-to-face means, because of consumer privacy and security concerns. 

It seems clear that FinCEN saw requiring a bank to collect a customer's identifying information from the customer in every case, including over the phone, would likely alter how they do business. Consequently, credit card accounts were exempted from the CIP Rule's information collection requirements, allowing banks and nonbanks to obtain, for these purposes, a customer's identifying information from a third party source, such as a credit bureau, before an extension of credit. In its issuances, FinCEN considered this practice an efficient and effective means of extending credit with little risk that an institution did not know the borrower's identity. 

Since the CIP Rule was adopted in 2003, FinCEN has become aware that there has been significant innovation in how customers interact with financial institutions and receive financial services, and in CIP data collection and verification tools available to financial institutions. 

So, here's the crux of the matter: some banks partner with nonbank third party service providers to facilitate new financial products and services. A Buy-Now-Pay-Later loan product is an example of a nonbank financial institution, a third party service provider, that enables such financial products and services by extending credit to customers at the point of sale. 

These products and services operate in a similar manner to credit cards but may be offered by nonbank financial institutions that may or may not be subject to the Bank Secrecy Act (BSA) and its implementing regulations or other comparable regulatory requirements.[iv] Even so, institutions that do not comply with the CIP Rule may face supervisory action, particularly if a nonbank with which a bank has partnered does not collect the customer's identifying information directly from the customer, as required by the CIP Rule. 

The RFI[v] will presumably inform FinCEN's understanding in this area and help the agency evaluate the risks, benefits, and potential safeguards related to certain CIP Rule requirements applicable to financial institutions. Specifically, FinCEN is seeking input from institutions and other interested parties regarding the Rule's SSN collection requirement. The results may allow financial institutions to collect partial SSN information from the customer and use a third party source to collect the full SSN. Partial SSN collection is when a bank collects a certain part of the SSN from individuals who are customers (i.e., the last four digits of an individual's SSN) and then obtains the full SSN from a reputable third party service provider. 

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

---

[i] What is a Buy Now, Pay Later (BNPL) Loan?, Consumer Financial Protection Bureau, Issuance (Last Reviewed: December 2, 2021), https://www.consumerfinance.gov/ask-cfpb/what-is-a-buy-now-pay-later-bnpl-loan-en-2119/ 

[ii] Section 326 of the USA Patriot Act amended the BSA to require, inter alia, the Secretary to prescribe regulations "setting forth the minimum standards for financial institutions and their customers regarding the identity of the customer that shall apply in connection with the opening of an account at a financial institution." 

[iii] 13 CFR Part 103, Financial Crimes Enforcement Network; Customer Identification Programs for Certain Banks (Credit Unions, Private Banks and Trust Companies, That do not Have a Federal Functional Regulator, Department of the Treasury

[iv] An example of a nonbank financial institution that is a third-party service provider used to facilitate new financial products and services would be one that provides BNPL loans that extend credit at the point of sale to customers.

[v] The RFI supports FinCEN's ongoing efforts to implement Section 6216 of the Anti-Money Laundering Act of 2020, which requires the agency to, inter alia, identify regulations and guidance that may be outdated, redundant, or otherwise do not promote risk-based AML’s requirements for CFT, the acronym for combating the financing of terrorism.

AML Compliance: Violations Bait and Land Mines

QUESTION 

I am updating our Anti-Money Laundering Program. It was last updated three years ago. We had an AML test last year, and the report showed problems with the written program, yet we did not update it even then. This delay has happened because of staff turnover. 

My concern is what areas I should emphasize in this new update. I would like to know what kinds of issues and challenges are critical, so I can identify them in the program and provide procedures for resolving them. Since your firm is known for conducting AML tests for mortgage companies, I thought you would list important AML issues. 

What challenges do you see occurring in your AML audit tests? 

ANSWER 

If you do not review your Anti-Money Laundering Program (Program) for updates, as needed, and at least annually, you are not complying with Bank Secrecy Act (BSA) guidelines. You are violating the applicable statute if you are not conducting an Anti-Money Laundering (AML) test annually but no later than eighteen months from the previous test. 

If you are not implementing AML training annually, including, when needed, for new hires, you have caused a statutory violation. 

And, if you do not have a responsible, designated, and ratified AML Officer, you have not complied with the BSA mandates. 

The Program is the written structure on which the four pillars of AML compliance rest. Those pillars are (1) ratifying the Program itself, (2) establishing an AML Officer, (3) conducting the AML test, and (4) implementing AML training. 

Lenders Compliance Group was the first compliance firm in the country to provide AML audit tests for Residential Mortgage Lenders and Originators (RMLOs), the specific term used in the BSA. RMLOs were required to develop and implement a Program and begin filing Suspicious Activity Reports (SARs) by August 13, 2012. If you want LCG to conduct an AML test or provide other AML Compliance support, please contact us. 

The test may be conducted internally, following FinCEN guidelines, or by an external auditor entirely independent of the AML Officer. If the findings report recommends that you go further by conducting an AML Risk Assessment, do it. 

In using the term RMLOs, I am referring to two types of entities that are considered loan or finance companies: the mortgage lender, the entity that is explicitly stated in the note as being the initial payee in connection with a mortgage transaction, and the mortgage originator, the party that accepts a mortgage loan application or offers or negotiates the terms of a residential mortgage loan. 

Each RMLO must adopt a policy and procedure for AML compliance in recognition of its obligations under BSA, other related money laundering regulations, the Financial Crimes Enforcement Network requirements, and federal and state licensing agencies. 

That you are not revising policies and procedures pursuant to a competent AML test may put your firm at considerable regulatory risk. The audit results must be reported to the audit committee of the RMLO's management and the BSA/AML Officer. It is the responsibility of the AML Officer to take appropriate action to correct any problems found as a result of the audit and promptly respond to the RMLO's audit committee or appropriate senior management. 

Crooks and bandits continue changing tactics, and your organization must adjust your AML program accordingly. Several "land mines" can be anticipated in BSA/AML examinations. 

We keep a record of evolving money laundering schemes. At this point, our due diligence auditors avail themselves of an extensive database that keeps us alert to the nefarious money laundering tactics the crooks have developed and, unfortunately, continue to develop. 

I will provide several actions and non-actions – what some organizations do or don't do – that trigger regulatory violations. My focus is on RMLOs. 

Violations Bait and Land Mines 

1.     314(a) searches aren't completed promptly. RMLOs should make certain that the U.S. Patriot Act contacts listed in their online profiles are current and that they certify these profiles when contacts are updated. Moreover, companies must ensure that their policies and procedures name a point of contact. 

They should also provide the following: 

 a.     steps for when the primary contact is unavailable; 

 b.     ways to ensure information confidentiality; 

 c.     how to respond to FinCEN requests; 

 d.     how to determine if and when to file a SAR; and 

 e.     the process for independent testing of 314(a) compliance. 

2.     Inadequate AML training for appropriate personnel. Board members and the AML Officer do not always receive the appropriate BSA/AML training for their roles. Failure to educate staff on illicit financial activities to keep members safe and the organization compliant. We believe financial institutions should train new staff as soon as possible. 

To prevent staff-related issues, AML functions and responsibilities should encompass adequate resources, a sufficient level of aggregate AML expertise, and an appropriate allocation of time to AML tasks. 

3.     An AML Officer must be designated to own the system and ensure that processes are followed and updated, reports are filed, training is robust, and the entire system is running effectively. The board should grant the AML Officer the duties and authority to implement AML processes and policies. 

4.     AML training should include examples of money laundering and suspicious activity monitoring relevant to each operational area. This training also should provide officials with a sufficient understanding of the institution's risk profile and BSA/AML regulatory requirements. 

Additionally, companies must document all training, including the following: 

 a.     testing materials; 

 b.     attendance records; 

 c.     employees that fail to participate; and 

 d.     corrective actions taken concerning employees who fail to attend training. 

5.     A lack of independent testing. Avoid utilizing in-house staff that does not satisfy the "qualified" and "independent" criteria for independent testing. If staff is not qualified and independent, the work product is worthless and will likely be rejected by regulators. Not using an external resource to conduct the independent review causes delays in the required testing. 

6.     No written and approved Program. BSA/AML compliance programs must be in writing, approved by the board, and documented in board meeting minutes. It should be comprehensive. Off-the-shelf AML policies are notoriously defective. 

Additionally, the Program must set forth requirements for internal controls, independent testing, a designated AML Officer, training for appropriate personnel, member due diligence, and customer identification data. AML policies and procedures should be documented, comprehensive, consistent with best practices, approved by stakeholders, and regularly updated. 

7.     Stay alert to sanctions issued by the Office of Foreign Assets Control (OFAC). To be compliant with OFAC-governed sanctions regulations, your firm must ensure it is not engaging in trade or transaction activities that violate the rules behind OFAC's country-based sanctions programs or engaging in trade or transaction activities with sanctions targets named on OFAC's list of Specially Designated Nationals and Blocked Persons. 

The linkage to AML compliance requires an organization's policies and procedures to address aspects of OFAC compliance and controls, including customer onboarding, screening, and even specialized training. 

Customer Identification Program (CIP) requirements should be applied to all customers opening a new account as that term is defined in the Bank Secrecy Act and implementing regulations. The CIP must include procedures for making and maintaining a record of all information obtained to verify a customer's identity. At a minimum, the record must include all the identifying information gathered by the firm about a customer. 

8.     Noncompliant SARs. SARs are not filed within 30 or 60 days and are not complete or accurate, particularly SAR narratives. Failure to promptly detect, escalate, investigate, and file SARs. Include appropriate risk-based procedures for conducting ongoing customer due diligence, including (i) understanding the nature and purpose of customer relationships to develop a customer risk profile and (ii) conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information. 

9.     Know Your Customer (KYC) practices do not clearly define and align with customer attributes and risks (i.e., customer identification programs, customer due diligence, enhanced due diligence, and special circumstances due diligence). 

10.  Certain loan products pose a higher risk of criminal activity than others and attract money laundering criminality. You must document processes for monitoring your high-risk products and services for potential money-laundering activity. A "best practice" is to ensure that the AML Officer and compliance department are part of product plans at your institution.

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

Customer Identification Procedures

QUESTION 

We submitted our CIP policy to our regulator in an examination.

In the exit interview, we were told the CIP policy does not have a set of core procedures required under the USA Patriot Act. We’ve provided this policy before, and they never said anything. Now they want us to revise it by including a checklist, but they are not telling us what goes into the checklist! 

We could use an outline of some basic checklist items to update the checklist. 

What should we provide as some checklist areas to implement our CIP policy? 

ANSWER 

Remember that whatever you put into a policy document with respect to procedures must be monitored and tested periodically. How do you know any checklist works if you are not monitoring and testing its effectiveness? 

The USA Patriot Act is a foundational Act for Customer Identification Procedures (CIP), and any checklist must conform with the Act’s mandates. 

In my view, your checklist should contain at least four procedural features: verifying identity, recordkeeping, list-checking, and customer notice. 

Let’s consider each of them in a checklist format. 

Verifying Identity 

The identity of every mortgage loan applicant should be screened for the following information (at minimum):

·       Name 

·       Date of birth 

·       Residential or business street address 

·       Citizenship:

o   For a U.S. person, use a taxpayer identification number.

o   For a non-U.S. person, one or more of the following:

§  a taxpayer identification number; passport number, and country of issuance;

§  alien identification card number, or number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard.

o   Instead of obtaining a taxpayer identification number from a customer before opening the account, you may open an account for a customer who has applied for a taxpayer identification number but has not yet received one. In this case, however, you should confirm the application for the number was filed before the customer applied for the loan, and you should obtain the taxpayer identification number within a reasonable period of time after the account is opened.

One warning: Documents used to verify identity may include any unexpired government-issued identification evidencing nationality or residence and bearing a photograph or similar safeguards, such as a driver’s license or passport. But be very careful in utilizing this method! 

Recordkeeping 

It is essential to maintain records of the information used to verify a person’s identity, including, but not limited to: 

·       All identifying information about a customer; 

·       A description of any document relied on, noting the type of document; 

·       Any identification number contained in the document, the place of issuance, and, if any, the date of issuance and expiration date; 

·       A description of the methods and the results of any measures undertaken to verify the identity of the customer; and, 

·       A description of the resolution of any substantive discrepancy discovered when verifying the identifying information obtained. 

Record of the foregoing information should be kept for at least five years after the mortgage loan is paid off or transferred to a loan purchaser. 

List-Checking 

Checking certain lists is a critical aspect of the CIP process. You should determine whether the person appears on any lists of known or suspected terrorists or terrorist organizations available to your financial institution or provided to your financial institution by any government agency. 

·     Designate a person or department responsible for determining whether each new customer appears on any list of known or suspected terrorists or terrorist organizations issued by any federal government agency and designated as such by the Treasury Department in consultation with the federal functional regulators. 

·     The designated person should make a determination within a reasonable period of time after a loan closes, or earlier, if required by another federal law or regulation or federal directive issued in connection with the applicable list. 

·     Follow all federal directives issued in connection with the lists. 

Customer Notice 

Be sure to provide customers with adequate, written notice that you request information to verify identities as required by the USA Patriot Act.

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group