Safeguards Rule: Information Security Program

QUESTION 

We are a mortgage broker in the Midwest. In our last state audit, the examiner told us that we did not comply with the Safeguards Rule. It's my understanding that it's required by the GLBA, which behooves us to have an information security program. 

Well, we have one! Never had a problem before with it, yet now we've got an examiner saying that our information security plan is no good. I got it from a reputable manual company – at least I thought they were reputable until the banking department told me it was not in compliance. 

Now we've got to figure out what this Safeguards Rule is all about! I hope you can enlighten me. My office manager tried to find something on it, but it reads like a bunch of legal mumbo-jumbo. And, anyway, I don't know how to change the information security plan. I will contact your company to get help. Here's my question!

What does the Safeguards Rule cover? 

SOLUTION 

PRIVACY TUNE-UP®

INFORMATION SECURITY PLAN 

PRIVACY POLICY

RESPONSE 

Thanks for writing me. I will try to get you past the legalese. I'll provide citations in case you or your office manager wants them. That said, you can contact me and we'll get you back on track! 

Keep in mind that regularly assessing the Information Security Program, Plan, or Policy (ISP) is a function of the Second Line of Defense. A self-assessment or self-evaluation should be conducted at least once a year. If you have not already done so, you should conduct a risk assessment immediately. Alternatively, you can contact us for our Privacy Tune-up®, an audit that meets regulatory scrutiny. Or ask for our comprehensive Information Security Plan or the Privacy Policy.

The Federal Trade Commission's (FTC) Safeguards Rule, implemented under the Gramm-Leach-Bliley Act (GLBA), requires financial institutions to establish and maintain a comprehensive Information Security Program (ISP) to protect customer data. This includes developing written security plans with administrative, technical, and physical safeguards. The rule requires financial institutions to safeguard customer information against threats and unauthorized access. 

A few years ago, a mortgage broker contacted us to find out if her company was required to comply with the GLBA. The short answer is yes, indeed. A wide range of financial institutions is covered. A "financial institution,"[i] for our purposes, means an entity that provides real estate settlement services (because providing real estate settlement services is a financial activity)[ii], and the statute specifically denotes a mortgage broker as a financial institution.[iii] 

I'll get to your compliance responsibilities shortly. But first, you need to know what constitutes the Safeguards Rule ("Rule"). If your ISP does not have these key components textualized in some way, an examiner may find it defective. 

Five Key Components 

There are five Safeguards, as follows: 

1. Administrative Safeguards 

These involve policies and procedures for managing and overseeing the information security program. 

2. Technical Safeguards 

These include measures like firewalls, encryption, and access controls to protect data. 

3. Physical Safeguards 

These involve physical security measures to protect data storage locations and access to sensitive information. 

4. Oversight of Affiliates and Service Providers 

The Rule also mandates that financial institutions ensure their affiliates and service providers safeguard customer information.

Cryptocurrency Dilemma

QUESTION 

Our compliance department notified us that the government has stopped criminal, regulatory, anti-money laundering enforcement of the crypto sector. We are a bank that accepts cryptocurrency transactions. For instance, we accept cryptoassets such as Bitcoin. 

One of my tasks is to monitor the cryptocurrency exchange platforms. I want to know the extent to which it is necessary to monitor these platforms if there is not going to be any enforcement. Are we wasting our time? I realize that government officials want to deregulate crypto, but it seems a stretch to allow the exchange platforms to bear no accountability. I hope you can shed some light on this subject. 

If there is not going to be enforcement of regulations involving cryptocurrency, to what extent is it necessary to monitor exchange platforms? 

SOLUTION 

- AML TESTING
- AML TRAINING
- AML RISK ASSESSMENT 
- AML PROGRAM [Written Policy]

RESPONSE 

On April 7, 2025, Todd Blanche, the Deputy Attorney General in the DOJ, issued a memorandum containing the following statement: 

''The Department of Justice is not a digital assets regulator.''[i] 

The memorandum was issued a couple of weeks after President Donald Trump pardoned several cryptocurrency executives and a company that had pleaded guilty to anti-money laundering compliance violations.[ii] 

The Justice Department has decided to stop pursuing those cases altogether. That means, in substance, that the DOJ will no longer pursue litigation or enforcement actions that effectively superimpose regulatory frameworks on the digital assets sector. 

In other words, there is a focus on deregulating the cryptocurrency industry. The Justice Department will no longer target virtual currency exchanges, "mixing and tumbling" services, and offline wallets for the acts of their end users and unwitting violations of regulations. 

Furthermore, the memorandum makes clear that prosecutors are directed not to charge regulatory violations in cases involving digital assets, including unlicensed money transmitting, violations of the Bank Secrecy Act, unregistered securities offering violations, and other registration requirements under the Commodity Exchange Act. When there are cases involving digital assets, prosecutors are now directed to pursue illicit financing by the culpable individuals and enterprises themselves – but not against the platforms they use to conduct the illegal activity. 

DISBANDED OVERSIGHT

Mr. Blanche also disbanded the Justice Department's National Cryptocurrency Enforcement Team, effective immediately, and directed the Market Integrity and Major Frauds Unit to cease cryptocurrency enforcement and instead focus on other priorities, such as immigration and procurement frauds. 

You mention that your task is to monitor the cryptocurrency exchange platforms. It appears the DOJ has changed its focus away from regulating the platforms themselves, seemingly interested in only the illicit transactions of bad actors who use the platforms. To me, this seems like going after bad drivers while doing nothing to put stop signs on the road itself to protect pedestrians. 

Cryptoasset exchange platforms are subject to certain regulatory oversight, but the level and nature of that oversight vary depending on the specific jurisdiction and the nature of the cryptoassets being traded. In the US, platforms that trade cryptoassets that are securities are subject to registration and regulation as national securities exchanges. Additionally, platforms may need to register as Money Services Businesses (MSBs) with the Financial Crimes Enforcement Network (FinCEN). The Commodity Futures Trading Commission (CFTC) also regulates crypto derivatives. A regulatory referral about an cryptocurrency exchange platform to the DOJ may now not be prosecuted with respect to illicit activity conducted by the platform itself.

Business Continuity Plan: Insufficient Recovery

QUESTION 

According to the bank examiner, our Business Continuity Plan does not provide “sufficient recovery and resolution planning requirements” to manage stresses caused by system failures during a disaster. The problem is that they did not give us guidelines to determine what constitutes sufficient recovery procedures. 

As a result, I am not sure we will satisfy their expectations. I have had our compliance department and lawyers come up with an outline of procedures, but they keep giving me scenarios, and I am not convinced that just listing scenarios is the way to go. I am our company’s founder and president. I will tell you we have never had a catastrophic system failure caused by a disaster. That’s not to say it can’t happen. And I get it! We need to be ready at all times. 

But I don’t want to go out with only scenarios. I am concerned that this approach is not comprehensive, and, more to the point, I think it will annoy the examiner. I need something that the whole company can integrate into operations. 

I hope you can provide a management approach I can implement in all our departments and divisions. Each department will then work to comply with management’s requirements. I will ask our compliance people to ensure companywide oversight of those requirements. 

What are some steps, an outline, toward managing business continuity during disasters? 

COMPLIANCE SOLUTION 

Business Continuity and Disaster Recovery Plan 

BCP Tune-up

ANSWER 

A credible Business Continuity Plan[i] must consider market and companywide stresses and idiosyncratic risks that can imperil the continuity of a financial institution’s critical operations and core business lines. Indeed, proper planning can reduce the adverse broader impact on the financial system. 

With our BCP Tune-up, we have reviewed the Business Continuity Plans of many companies, So, I believe we have a unique perspective on regulatory expectations. Many clients use the BCP Tune-up as a self-assessment tool. Self-assessment is an essential Best Practice encouraged by most banking departments. Our review is cost-effective and we provide a report that describes current risks as well as recommendations that help to meet regulatory scrutiny.

Business continuity is inherently linked to disaster recovery. Your company must develop the ability to prepare for, adapt to, and withstand or recover from disruptions. Disruptions may result from external events like natural disasters, malicious actors, pandemics, global conflicts, or weak internal systems, controls, or risk management. Adapting is essential. For instance, we revised our Business Continuity Plan during the pandemic to add an entire section for Pandemic and Epidemic Response. 

Obviously, disruptions may impede the provision of services, such as payments and clearing and settlement, or adversely impact systems or corrupt data. 

However, the current focus of many banking departments is on exploring baseline “operational resilience” requirements with respect to critical operations, including third-party service providers. 

Such baseline requirements often include the following: 

·       Establishing clear definitions for identifying critical activities and core business lines. 

·       Defining tolerances for disruption, such as caused by cyber-attacks.[ii] 

·       Requiring testing and validation of “resilience” capabilities. 

·       Incorporating third-party risk management expectations.[iii] 

·       Stipulating clear communication expectations among stakeholders and counterparties. 

·       Addressing expectations for critical service providers, emphasizing governance and risk management expectations. 

A company subject to recovery or resolution planning requirements can leverage the information I’m providing in an outline form. You can send it to your departments and divisions for feedback and implementation. In my view, the outline conforms to existing regulations and guidance, the results of which should promote sound business continuity management.[iv] 

In your question, you mentioned the term “recovery” was used by the bank examiner. I use that term, in accordance with regulatory guidance, to refer to the restoration of clearing and settlement activities after a wide-scale disruption. I use the term “resumption” to refer to the capacity to accept and process new transactions and payments after a wide-scale disruption.[v] 

I make no claim that the following nine practices are comprehensive. However, the outline may be considered “sufficient” for deriving an overall plan for business continuity and disaster recovery. 

Business Continuity Management 

1)    Business Impact Analysis 

The company’s business continuity management incorporates business impact analysis,[vi] testing, training, awareness programs, and communication and crisis management policies. 

2)    Contingency 

The company periodically reviews its business continuity plan to ensure contingency strategies remain consistent with current operations, risks and threats, its tolerance for disruption, and recovery priorities.[vii] Containment strategies must align with existing guidance for a company that performs payment, clearing, and settlement activities in critical financial markets.[viii] 

3)    Testing 

The company tests business continuity plans, reviews the execution of tests, and improves plans by incorporating lessons learned. Business continuity tests and exercises incorporate dependencies of critical operations and core business lines on third parties. The company participates in disaster recovery and business continuity testing with third parties associated with critical operations and core business lines. 

4)    Scenarios 

The company confirms that functional testing procedures for assessing the ability of a company’s IT systems to deliver minimum service capacity to critical operations and core business lines are consistent with its business continuity objectives. Business continuity management incorporates scenarios where service capacity and business continuity objectives cannot be met. 

5)    Personnel 

The company identifies and manages the availability of personnel essential to executing its critical operations and core business lines.[ix] The company has (an) alternate site(s) that has sufficient resources (including personnel), technology capabilities, and functionality to execute the company’s critical operations and core business lines in the event of a disruption.[x] The alternate site(s) is (are) located at a sufficient geographical distance from the primary site and has (have) a distinct risk profile. 

6)    Remote Access 

Business continuity management includes remote access contingencies that allow personnel to continue delivering the company’s critical operations and core business lines during the disrupting event.[xi] The management of contingencies prioritizes critical operations and core business lines and provides personnel with adequate connectivity, communication, collaboration tools, essential technology resources, and access to network systems. These contingencies incorporate transitioning personnel back to normal operations following the resolution of a disruption.[xii] 

7)    Training 

The company trains essential personnel responsible for executing critical operations and core business lines and performing backup roles should a disruption occur. The company implements an operational resilience training and awareness program to evaluate the effectiveness of personnel-related business continuity arrangements, and the program is continually improved as shortcomings are identified. 

8)    Implementation 

The company’s recovery or resolution planning is integrated into its governance and operating processes and is part of business-as-usual activities, including companywide risk management processes. To ensure sufficient implementation, recovery or resolution planning is understood as complementary to, and linked with, existing risk management and business continuity management processes. 

9)    Interconnections 

The company harvests and leverages information in its recovery or resolution plans to identify options to respond to a wide range of severe but plausible internal and external stress scenarios. The company similarly leverages the identification of interconnections and interdependencies among critical operations and core business lines affiliates, subsidiaries, and third parties. 

While sound practices prioritize business continuity and disaster recovery of critical operations and core business lines of a financial institution and its material entities,[xiii] it also should identify and address the resilience of other operations, services, and functions for which a disrupting event could have a significant adverse impact on the company or its customers.

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

_______________________________

[i] For more information, consider the Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbook, which includes the booklet Business Continuity Management (November 2019). This booklet describes principles and practices for IT and operations to ensure safety and soundness, consumer financial protection, and compliance with applicable laws and regulations.
[ii] In 2021, the federal banking agencies adopted the Computer-Security Incident Notification Rule to bolster cyber defenses.
[iii] The federal banking agencies have issued interagency guidance on third-party risk management, building off of the Office of the Comptroller of the Currency’s (OCC) longstanding guidance on the topic.
[iv] Guidance includes SR letter 03-9 and OCC Bulletin 2003-14 Interagency White Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System (April 8, 2003), which outline practices for geographic diversity and resiliency of data centers and operations, as well as recovery and resumption time objectives and related testing standards for firms that perform payment, clearing, and settlement activities in critical financial markets.
[v] Idem
[vi] Op. cit. i, Section III.A. Business Impact Analysis of the FFIEC Information Technology Examination Handbook booklet Business Continuity Management describes the business impact analysis process.
[vii] Ibid, Section II.A. Board and Senior Management Responsibilities
[viii] Op. cit. iv
[ix] Op. cit. i, Section IV.A.4 Personnel
[x] Op. cit. i, Section V.C Facilities and Infrastructure
[xi] Operational risk management and independent internal (or external) audit functions should also consider remote access and any other related conditions.
[xii] Op. cit. ix
[xiii] For purposes of this article, I define a material entity as one that is significant to the activities of an identified critical operation or core business line or is financially or operationally significant to the company's recovery from a disrupting event.

Artificial Intelligence: Benefits and Risks

QUESTION 

There has been a lot of news about artificial intelligence. I have to admit, I do not know anything about it. Yet my company has just announced that it is linking up with an artificial intelligence provider. 

Now, we are scrambling to understand how artificial intelligence will impact our jobs, loan process, and compliance requirements. Last year, nobody cared about AI. This year, it’s all they can talk about! 

I would like you to tell us some ways that AI is used by banks and nonbanks, since providing compliance to us is your specialty. We need some basic understanding of how AI will be a part of originating and servicing loans. 

What are some ways that financial institutions are using AI? 

ANSWER 

I sense your frustration, and you are not alone. Whenever a new technology or innovation enters the marketplace, there is a perfectly normal tendency to be a bit suspicious and even worried about its implications. In time, these concerns often become resolved, sometimes with less than optimum impact on society, sometimes with far-reaching positive impact. The challenge is anticipating change and preparing proactively to mitigate unwanted outcomes. 

I don’t think financial institutions should rush into Artificial Intelligence (“AI”) without first considering compliance. But, there are good reasons to implement AI as a tool in the quest for a strong compliance program. When planning to partner with an AI vendor, it is important to bring in a firm such as ours to provide reliable due diligence to ensure the compliance component is integral to the plan. This creates a “baseline” that serves to enhance policies and procedures, training, and ongoing improvements in the technological application. 

Many banking agencies have been vetting AI for a few years. They're still in the early stages of drafting the rulemaking, but there has been an increase in regulatory guidance issuances. As a provider of customized compliance libraries, we are updating our clients’ policies for such guidance. And when rulemaking is determined, we will provide an AI policy, specific to a client's needs, and prior to a promulgated effective compliance date. 

Five banking agencies (OCC, FRB, FDIC, CFPB, and NCUA) have sought information and comments on the use of AI, including machine learning, by financial institutions. The caveat thus far is that they support responsible innovation as long as it includes identifying and managing associated risks. 

We can glean the areas of scrutiny being reviewed for supervision, examination, and enforcement by taking note of the following ways financial institutions use or may use AI. Though not meant to be a comprehensive outline, based on our interactions with regulators and published issuances, I’m sure these areas are under review for AI compliance. 

ARTIFICAL INTELLIGENCE: BENEFITS

Flagging Unusual Transactions 

Many institutions use AI to identify potentially suspicious, anomalous, or outlier transactions (for instance, fraud detection and financial crime monitoring). This involves using different forms of data (i.e., email, texts, audio data – both structured and unstructured)[i] to identify fraud or anomalous transactions with greater accuracy and timeliness. It also includes identifying transactions for Bank Secrecy Act/Anti-Money Laundering activities, monitoring employees for improper practices, and detecting data anomalies. 

Personalization of Customer Services 

Institutions use AI technologies, such as voice recognition and Natural Language Processing (NLP),[ii] to improve the customer experience and increase efficiency in allocating financial institution resources. 

One example is using chatbots[iii] to automate routine customer interactions, including account opening activities and general customer inquiries. AI is leveraged at call centers to process and triage customer calls to provide customized service. Institutions also use these technologies to target marketing better and customize trade recommendations. 

Credit Decisions 

Some institutions use AI to inform credit decisions to enhance or supplement existing techniques. This application of AI may use traditional data or employ “alternative data”[iv] (such as cash flow transactional information from a bank account). 

Risk Management 

Institutions may use AI to augment risk management and control practices. For example, an AI approach might be used to complement and provide a check on another, more traditional credit model. Financial institutions may also use AI to enhance credit monitoring (including through early warning alerts), payment collections, loan restructuring and recovery, and loss forecasting. 

AI can assist internal audit and independent risk management to increase sample size (such as for testing), evaluate risk, and refer higher-risk issues to human analysts. Indeed, AI may also be used in liquidity risk management, for example, to enhance monitoring of market conditions or collateral management. 

Textual Analysis 

Textual analysis refers to using NLP for handling unstructured data (generally text) and obtaining insights from that data or improving the efficiency of existing processes. Applications include analysis of regulations, news flow, earnings reports, consumer complaints, analyst ratings changes, and legal documents. 

Cybersecurity 

Institutions may use AI to detect threats and malicious activity, reveal attackers, identify compromised systems, and support threat mitigation. Examples abound, including real-time investigation of potential attacks, the use of behavior-based detection to collect network metadata, flagging and blocking of new ransomware and other malicious attacks, identifying compromised accounts and files involved in exfiltration, and deep forensic analysis of malicious files. 

There are risks, too, which I’ll explain shortly. But, it should be obvious that the agencies recognize that AI has the potential to offer improved efficiency, enhanced performance, and cost reduction for financial institutions, as well as benefits to consumers and businesses. AI can identify relationships among variables that are not intuitive or not revealed by more traditional techniques. And it can better process certain forms of information, such as text, that may be impractical or difficult to process using traditional methods. 

AI also facilitates processing significantly large and detailed datasets, both structured and unstructured, by identifying patterns or correlations that would be impracticable to ascertain otherwise.

In general, other potential AI benefits include more accurate, lower-cost, and faster underwriting and expanded credit access for consumers and small businesses that may not have obtained credit under traditional credit underwriting approaches. AI applications may also enhance an institution’s ability to provide products and services with greater customization. 

ARTIFICAL INTELLIGENCE: RISKS

But there are risks. The agencies have emphasized that financial institutions should have processes to identify and manage the potential risks associated with AI. Many of the risks associated with using AI are not unique to AI. For example, using AI could result in operational vulnerabilities, such as internal process or control breakdowns, cyber threats, information technology lapses, risk associated with using third parties, and model risks, all of which could affect an institution’s safety and soundness. 

Furthermore, the use of AI could also create or increase consumer protection risks, such as risks of unlawful discrimination, unfair, deceptive, or abusive acts or practices (UDAAP) under the Dodd-Frank Act, unfair or deceptive acts or practices regulation (UDAP) under the FTC Act, or privacy concerns.

The agencies have identified three risks particular to AI: 

• Explainability, 
• Data Usage, and 
• Dynamic Updating. 

Here’s a brief explanation of each risk. 

Explainability 

“Explainability” refers to how an AI approach uses inputs to produce outputs. In other words, some AI approaches can exhibit a “lack of explainability” for their overall functioning (sometimes known as global explainability) or how they arrive at an individual outcome in a given situation (sometimes referred to as local explainability). 

Lack of explainability can pose different challenges in different contexts. Lack of explainability can also inhibit a management’s understanding of the conceptual soundness of an AI approach (that is, the quality of the theory, design, methodology, data, developmental testing, and confirmation that an approach is appropriate for the intended use) which, then, can increase uncertainty around the AI approach’s reliability, and increase risk when used in new contexts. 

Lack of explainability can also inhibit independent review and audit and make compliance with laws and regulations, including consumer protection requirements, more challenging. 

Data Usage 

Broader or more intensive data usage plays a particularly important role in AI. In many cases, AI algorithms identify patterns and correlations in training data without human context or intervention and then use that information to generate predictions or categorizations. 

Because the AI algorithm depends on the training data, an AI system generally reflects any dataset limitations. As a result, as with other systems, AI may perpetuate or even amplify bias or inaccuracies inherent in the training data or make incorrect predictions if that data set is incomplete or non-representative. 

Dynamic Updating 

Some AI approaches have the capacity to update on their own, sometimes without human interaction, often known as dynamic updating. Monitoring and tracking an AI approach that evolves on its own can present challenges in review and validation, particularly when a change in external circumstances (i.e., economic downturns and financial crises) may cause inputs to vary materially from the original training data. 

Dynamic updating techniques can produce changes that range from minor adjustments to existing elements of a model to the introduction of entirely new elements. 

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

---

[i] The term “structured data” generally refers to a set of data that has been systematically organized or arranged.

[ii] “Natural Language Processing” or “NLP” generally refers to the use of computers to understand or analyze natural language text or speech.

[iii] The term “chatbot” generally refers to a software application used to conduct an on-line chat conversation via text or text-to-speech, in lieu of providing direct contact with a live human agent.

[iv] “Alternative data” means information not typically found in the consumer’s credit files of the nationwide consumer reporting agencies or customarily provided by consumers as part of applications for credit.

Mitigating Cyberattacks

QUESTION 

Well, it finally happened! We were hit with a cyberattack. We’re a small bank but have handled our cybersecurity carefully and passed safety and soundness exams. Yet, we were attacked. It seems nobody is safe! 

We don’t know where the attack came from, but a new computer consultant thinks our cybersecurity will need to be improved. She is especially concerned about internal threats by employees who do not follow our system rules. 

We would like you to suggest the types of proactive measures we should take to protect ourselves from cyberattacks. 

In what ways can we mitigate cyberattacks? 

ANSWER 

Your organization must be vigilant in protecting your data and operations from all threats, including ransomware, phishing, social engineering leading to business email compromises, and distributed denial-of-service (DDoS) attacks. The attacks include incidents directly related to critical vulnerabilities. 

All financial institutions and associated entities should take immediate and comprehensive action to protect their systems, sensitive data, and the financial well-being of their members. 

I will recommend certain primary mitigation steps and best practices. Monitoring, testing, and training must be ongoing to safeguard against evolving cyber threats. 

Here are nine proactive measures you can take to mitigate cyber threats. 

MITIGATING CYBER THREATS

1. Multifactor authentication 

Implement multifactor authentication for all sensitive accounts and systems, including email accounts and remote access portals. This measure adds an extra layer of protection against unauthorized access and phishing attempts. 

2. Employee cybersecurity awareness training 

Conduct regular cybersecurity training for all employees to raise awareness about phishing, social engineering, and other common attacks. Educate employees about the risks and implications of clicking suspicious links or opening malicious attachments. 

3. Email security and anti-phishing measures 

Deploy advanced email security solutions with phishing detection and blocking capabilities. Here are a few that come to mind: Slender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Authentication, Reporting, and Conformance (DMARC) protocols to prevent email spoofing and enhance email authenticity. If you’re unfamiliar with these terms, speak to your consultant about them. 

4. Incident response plan 

Develop and regularly test an incident response plan to ensure a swift and coordinated response in the event of a cyberattack. Assign specific roles and responsibilities to designated personnel and rehearse various attack scenarios. Be sure to have a robust Disaster Recovery and Business Continuity Plan. Also, establish a Crisis Command Structure. 

Learn about our Disaster Recovery and Business Continuity Plan. 

 5. Vendor risk management 

Review and assess the cybersecurity practices of all third-party vendors that provide financial services and products. Verify that vendors use sound risk management principles, have robust security measures, and regularly review their security posture. 

6. Network segmentation and DDoS protection 

Implement network segmentation to contain the impact of a potential compromise. Deploy DDoS protection measures, such as traffic filtering and rate limiting, to defend against DDoS attacks. Speak to your consultant about how best to implement this process. 

7. Regular data backups and recovery testing 

Maintain frequent data backups and test the data recovery process regularly. In a ransomware attack, backups can prevent data loss and reduce the need to pay the ransom. 

8. Threat intelligence sharing 

Participate in threat intelligence-sharing communities to stay informed about emerging threats and attack trends. Sharing information can help strengthen the industry’s collective defense. 

9. Continuous monitoring and security updates 

Monitor network traffic, logs, and systems continuously to detect and respond promptly to suspicious activities. Stay informed about the latest security updates and apply patches promptly. 

Proactive cybersecurity measures safeguard systems and data integrity and confidentiality. Consider adopting these mitigation steps and best practices, as they can enhance your security posture and protect against cyberattacks.

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

Artificial Intelligence Benefits and Risks

QUESTION

There has been a lot of news these days about AI. Recently, a Fintech firm pitched us on using their AI platform to enhance our customer services. They also offer many other AI services. Frankly, I am “old school.” I am suspicious of all this technology coming in and taking the place of humans. 

Our president, however, is very into tech and gadgets. He wants to use AI for credit decisions, risk management, and even cybersecurity. Our AML officer has climbed aboard the AI bandwagon and wants to use AI to flag potential SAR filings. 

I head up customer services. The human factor is what I know, and it works well. I need somebody to ease my aching mind about all these AI services. And that “somebody” is going to be you. A lot of people in the company read your newsletter. We like your straightforward approach. 

Here are our questions: 

How is AI used in mortgage banking operations? 

What are the risks of using AI in banks and nonbanks? 

ANSWER

Thank you for your kind words. I will always have a soft spot for the people in customer service, the unit you head. That’s because customer service is often the first contact a consumer has with a company. How communication is handled can make a big difference between a friendly business relationship and a consumer complaint. Consumer complaints risk damaging reputation and loss of business and can cause a lot of legal and regulatory havoc. 

Artificial Intelligence, known by its acronym “AI,” is with us to stay. I’m going to provide a few of the ways that financial institutions are using AI. The five banking agencies (viz., OCC, FRB, FDIC, CFPB, and NCUA) have reviewed AI use for a few years, including machine learning. My sense is that the agencies are receptive to AI innovation, with the caveat that companies ensure that the AI identifies and manages risks associated with AI use. 

I count at least six areas where banks and nonbanks are using AI. 

Using Artificial Intelligence

1. Flagging Unusual Transactions 

Many institutions use AI to identify potentially suspicious, anomalous, or outlier transactions (i.e., fraud detection and financial crime monitoring). This involves using different forms of data (i.e., email text, audio data), both structured, systematically organized or arranged,  and unstructured). The aim is to identify fraud or anomalous transactions with greater accuracy and timeliness. It also includes identifying transactions for Bank Secrecy Act/Anti-Money Laundering investigations, monitoring employees for improper practices, and detecting data anomalies. 

2. Personalization of Customer Services 

Institutions are using AI technologies to improve the customer experience and to gain efficiencies, thereby better managing the allocation of financial resources. An example would be voice recognition and Natural Language Processing (NLP), which generally refers to the use of computers to understand or analyze natural language text or speech. 

Another example is the use of chatbots. The term “chatbot” may be new to you. Generally, it refers to a software application used to conduct an online chat conversation via text or text-to-speech instead of providing direct contact with a live human agent. The chatbot automates routine customer interactions, including account opening activities and general customer inquiries. Chatbots are used in call centers to process and triage customer calls to provide customized service. In fact, some institutions are using chatbot technology to target marketing better and customize certain responses and recommendations. 

3. Credit Decisions 

Some institutions use AI to inform credit decisions to enhance or supplement existing techniques. This implementation of AI uses traditional data or “alternative data,” which is information not typically found in the consumer’s credit files of the nationwide consumer reporting agencies or customarily provided by consumers as part of credit applications. AI can enhance alternative data by providing cash flow transactional information from a bank account. 

4. Risk Management 

We have clients that use AI to augment risk management and control practices. For example, it can be used in credit analytics, where an AI program can complement and provide a check on another, more traditional credit model. Financial institutions may also use AI to enhance credit monitoring (including through early warning alerts), payment collections, loan restructuring and recovery, and loss forecasting. 

Sometimes, AI assists internal audit and independent risk management to increase the sample size (such as for testing), evaluate risk, and refer higher-risk issues to human analysts. AI may also be used in liquidity risk management. We have a client that uses AI for just such a purpose, seeking to enhance monitoring of market conditions or collateral management. 

5. Textual Analysis 

Textual analysis refers to using NLP (viz., natural language processing, supra) for handling unstructured data (generally text) and obtaining insights from that data or improving the efficiency of existing processes. Various applications include analysis of regulations, news flow, earnings reports, consumer complaints, analyst rating changes, and legal documents. 

6. Cybersecurity 

AI is being implemented in cybersecurity because financial institutions use it to detect threats and malicious activity, reveal attackers, identify compromised systems, and support threat mitigation. There are many examples worth noting, like real-time investigation of potential attacks, the use of behavior-based detection to collect network metadata, flagging and blocking of new ransomware and other malicious attacks, identifying compromised accounts and files involved in exfiltration, and deep forensic analysis of malicious files. 

So, it seems obvious that AI has the potential to provide more accurate, lower-cost, and faster underwriting, as well as expanded credit access for consumers who may not have obtained credit under traditional credit underwriting approaches. 

Risks of Artificial Intelligence

Notwithstanding the foregoing benefits, there are risks associated with AI, although it bears stating that many of the risks associated with using AI are not unique to AI. For instance, using AI could result in operational vulnerabilities, such as internal process or control breakdowns, cyber threats, and information technology lapses; nevertheless, these risks are also associated with the use of third parties, and various modeling risks, all of which could affect an institution’s safety and soundness. 

AI could create or increase consumer protection risks, such as risks of unlawful discrimination, violations relating to Unfair, Deceptive, or Abusive Acts or Practices (UDAAP) under the Dodd-Frank Act, FTC’s UDAP rule (viz., unfair or deceptive acts or practices under the  FTC Act), or privacy concerns.

Cybersecurity Rule – Proposed Updates

QUESTION

Our Cybersecurity Policy is a good one. I know this because we have had an examination, and the regulator approved it. 

Although we are a mid-west company, I notice that New York requires an update to its cybersecurity rule. That makes me nervous since New York’s cybersecurity requirements influence many states. 

I want to update our Cybersecurity Policy to reflect New York’s requirements. Sooner or later (probably sooner), our state is going to adopt the same requirements. 

What are the new Cybersecurity Policy requirements in New York? 

ANSWER

New York’s Department of Financial Services (DFS) has been quite active in requiring its licensees to comply with its Cybersecurity Rule (“Rule”). Effective March 1, 2017, the DFS promulgated a regulation[i] implementing the Rule. 

I published a White Paper about the Rule in advance of its effective compliance date, entitled 

Cybersecurity Guidelines – "First-in-the-Nation" Regulation. 

You’re welcome to download it HERE. 

From its inception, the DFS requires individuals and entities to comply with the Rule. These are called “Covered Entities.” A Covered Entities include, but are not limited to, partnerships, corporations, branches, agencies, and associations operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation, or similar authorization under the banking law, the insurance law, or the financial services law. 

I agree that the DFS influences other state banking departments vis-à-vis cybersecurity regulations. Now, the DFS is proposing to update the Rule.[ii] So, it’s a good time to anticipate policy and procedure revisions. Even if the proposed Amendments (“Amendments”) are not adopted in full or at all, given the rapidly evolving cyber threat landscape and, in particular, the growing prevalence of ransomware incidents, many aspects of the Amendments reflect Best Practices. 

Some of the proposed changes are rather significant. For instance, the updated Rule will have such requirements as a mandatory 24-hour notification for cyber ransom payments, heightened cyber expertise requirements for board members, and new access restrictions to privileged accounts. 

I will provide a brief summary of the proposed updates. Covered entities should monitor whether the DFS formally proposes amendments to ensure they are equipped technically, organizationally, and financially to meet the heightened governance, technical, and notification obligations. 

Notification Obligations 

The Amendments will create new requirements to notify the DFS of certain incidents. Specifically, there will be a requirement to notify the DFS within 72 hours of any unauthorized access to privileged accounts or deployment of ransomware within a material part of the covered entity’s information systems. 

Furthermore, covered entities will be required to notify the DFS within 24 hours of a covered financial institution making a ransomware payment connected to a cybersecurity event; additionally, there will be a requirement to provide the DFS within 30 days with an explanation of (a) why the payment was necessary, (b) whether alternatives were considered, and (c) what sanctions diligence was conducted. 

Risk Assessments 

There are risk assessment requirements under the current Cybersecurity Rule. Under the Rule, a covered entity must conduct a periodic risk assessment of its information systems “sufficient to inform the design of” its cybersecurity program required by the Rule and must update the risk assessment to address various changes, developments, and threats. The Amendments will expand upon the Rule’s definition of a “Risk Assessment” and more clearly articulate that an assessment must “take into account the specific circumstances of the covered entity.” And the Amendments also would clarify that a covered entity’s risk assessment must be updated at least annually or whenever a change in business or technology “causes a material change to the covered entity’s cyber risk.” 

Heightened Monitoring 

The Amendments will add several new monitoring requirements to the Rule, including:

 

·     Completion of an asset inventory that tracks information (e.g., owner, location, classification or sensitivity, support expiration date, and recovery time requirements) for each technology asset (e.g., hardware, operating systems, applications, infrastructure devices, APIs, and cloud services), and requirements for updating and validating the asset inventory;

 

·     Heightened access controls for privileged accounts, such as limiting access to a need-to-know basis, implementing multifactor authentication, and securely configuring or disabling protocols that permit remote control of devices;

 

·     Regular phishing training and exercises for all personnel; and

 

·     Monitoring and filtering of emails to block malicious content.

Governance 

Governance will be updated in the Amendments to include new obligations, including:

 

·     CISO independence and authority to ensure that cyber risks are appropriately managed;

 

·     Additional CISO reporting obligations to the board of directors  include plans for remediating inadequacies and timely reporting on material cybersecurity issues or major cybersecurity events (which are not defined);

 

·     Expertise and knowledge thresholds for board members (or requirements that persons with such expertise and knowledge advise them) such that they can exercise effective oversight of cyber risk;

 

·     Cybersecurity policy approval by the board (i.e., not senior management);

 

·     Annual certification of compliance with the Cybersecurity Rule by CEO and CISO, as differentiated from a senior officer;

 

·     Required business continuity and disaster recovery (“BCDR”) plans, which would be necessary to include certain prescribed content, such as identification of essential data, personnel, and infrastructure, a communications plan in the event of a disruption, and procedures for the maintenance of backup infrastructure;

 

·     Periodic testing of incident response and BCDR plans, and ability to restore systems from backups, including to address ransomware incidents and the ability to recover from backups; and

 

·     Annual review by CISO of the feasibility of encryption and effectiveness of the compensating controls, as well as a requirement to implement a written policy requiring industry-standard encryption to protect nonpublic information held at rest or transmitted over external networks by the covered entity. 

Larger (Class A) Companies 

The Amendments will impose additional cybersecurity obligations on a new category of covered entities, so-called “Class A Companies.” Under the Amendments, a “Class A Company” would be a covered entity with: (1) over 2,000 employees; or (2) over $1 billion in gross annual revenues averaged over the last three years from all of its business operations and those of its affiliates.  

These Class A Companies would be subject to additional cybersecurity obligations, including: 

·     Annual independent audits of the company’s cybersecurity program; 

·     Weekly vulnerability assessments will be conducted, including systematic vulnerability scans and reviews of information systems, and documentation and reporting to the board and senior management of material gaps identified by these assessments; 

·     Password controls, including a “vaulting solution” for privileged accounts and an automated method for blocking commonly used passwords; 

·     Monitor anomalous activity by way of endpoint detection and response solution, with a centralized solution for logging and security event alerting; and 

·     Risk assessments by external experts at least once every three years. 

Even if a covered entity is not a large company, smaller companies should consider implementing at least some of the Class A obligations.

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

---

[i] 23 NYCRR Part 500

[ii] Announced by the DFS on July 29, 2022