Top Story Security Related

OFAC has released an SDN List Update adding an individual and an entity, and updating an individual listing. See our OFAC Update for related identity information.

The members of the Federal Financial Institutions Examination Council (FFIEC) have announced an update on the FFIEC's Examination Modernization Project, undertaken as a follow-up to the review of regulations under the Economic Growth and Regulatory Paperwork Reduction Act (EGRPRA). The agencies plan to focus initial efforts on four areas that have the potential for the most meaningful supervisory burden reduction:

• Highlight and reinforce regulator communication objectives before, during, and after examinations;
• Leverage technology and shift, as appropriate, examination work from onsite to offsite;
• Continue to tailor examinations based on risk; and
• Improve electronic file transfer systems to facilitate the secure exchange of information between institutions and supervisory offices or examiners.

The Examination Modernization Project is expected to be a long-term endeavor and other areas of improvement may emerge. As a first step, and to address the first theme, the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency, and the State Liaison Committee have each committed to issue reinforcing and clarifying guidance to examination staff about the importance of being clear and transparent to community bankers during examination processes.

The Financial Action Task Force has issued reports on Spain’s and Norway’s progress in strengthening measures to tackle money laundering and terrorist financing.

The Secure Payments Task Force has announced its publication of Payment Lifecycles and Security Profiles, educational materials regarding the lifecycles, security characteristics and relevant laws and regs for most common payments. The materials were developed through the collaborative efforts of 200+ task force participants with diverse payments background and security expertise. Payment Lifecycles and Security Profiles provide perspectives related to:

• The lifecycles of the most common payment types, covering enrollment, transaction flow and reconciliation
• Security methods, identity management controls and sensitive data occurring at each step in the payment lifecycle
• Relevant laws and regulations, and other references, as well as challenges and improvement opportunities related to each payment type

Consumers and organizations have a variety of options for making and receiving payments, and while these payment types share the ultimate goal of transferring funds from payer to payee, the path those funds travel can vary. Payment Lifecycles and Security Profiles can help financial institutions better understand the lifecycle of various payment types and potential improvement opportunities to help strengthen their payment security practices.

On Monday, The Treasury Department announced that OFAC has designated four current or former Venezuelan government officials pursuant to Executive Order 13692, as part of Treasury’s ongoing efforts to highlight the economic mismanagement and endemic corruption that have been the defining features of the Maduro regime. The Venezuelan government’s actions have rendered Venezuela’s currency essentially worthless through hyperinflation, made food and medicine rare commodities through price controls, and triggered a humanitarian crisis that the Venezuelan government refuses to alleviate by changing policy or accepting international assistance.

Treasury also announced that the president signed a new Executive Order prohibiting U.S. persons and others subject to U.S. jurisdiction from engaging in all transactions related to, provision of financing for, and other dealings in any digital currency, digital coin, or digital token that was issued by, for, or on behalf of the Government of Venezuela after January 9, 2018.

As a result of Monday’s actions, all assets of the designated current or former officials of the Government of Venezuela that are subject to U.S. jurisdiction are frozen, and U.S. persons are generally prohibited from dealing with them. For their identity information and a link to the new Executive Order and new FAQs, see our OFAC Update.

The U.S. Court of Appeals for the District of Columbia Circuit on Friday overturned two controversial portions of the FCC's 2015 Telephone Consumer Protect Act Order. Ruling in ACA International, et al. v. Federal Communications Commission and United States of America, the court reviewed four issues:

• which devices constitute an automatic dialing system (ATDS or autodialer)
• whether a call to a reassigned phone number violates the TCPA
• whether the FCC's approach to revocation of a consumer's authorization to call was too broad
• whether the FCC's exemption for certain healthcare-related calls was proper

Two of these provisions—the definition of an automatic dialing system and the provision on calls to reassigned numbers—were of particular concern to bankers, who argued that they stood in the way of their ability to send time-critical, non-marketing messages to customers, including alerts of suspicious activity, data security breach warnings, etc., using cell phone calls or text messages. And on those provisions, banks see relief in the court's ruling.

The court set aside the FCC's definition of an ATDS because of its “unchallenged assumption that a call made with a device having the capacity to function as an autodialer can violate the statute even if autodialer features are not used to make the call.” The court found that the Commission's interpretation that all smartphones qualify as autodialers is unreasonably and impermissibly expansive.

On the question of reassigned (or "ported") numbers and consent, the FCC's 2015 order provided a one-call "safe harbor" from liability. The court set aside the FCC’s treatment of reassigned numbers in its entirety, finding it could not, without consequence, void the one-call safe harbor, but leave in place the FCC’s interpretation that the “called party” refers to the current subscriber, and not the intended recipient.

The FCC order provisions relating to revocation of consent and exemptions for certain healthcare-related calls were allowed to stand.

• Appeals court ruling

The Financial Action Task Force (FATF) has issued a report to G20 finance ministers and central bank governors regarding its recent and ongoing work to fight money laundering and terrorist financing. It also released a FATF Business Bulletin that provides a brief update on outcomes from the February 2018 FATF plenary meeting that are relevant for the private sector.

A federal court, in response to a complaint filed by the Federal Trade Commission, has halted the activities of four individuals who allegedly promoted deceptive money-making schemes involving cryptocurrencies. These schemes falsely promised that participants could earn large returns by paying with cryptocurrency such as bitcoin or Litecoin to enroll in the schemes. In the complaint, the FTC alleges that three defendants – Thomas Dluca, Louis Gatto, and Eric Pinkston – promoted chain referral schemes known as Bitcoin Funding Team and My7Network. Using websites, YouTube videos, social media and conference calls, the defendants promised big rewards for a small payment of bitcoin or Litecoin.The defendants claimed that Bitcoin Funding Team could turn a payment of the equivalent of just over $100 into $80,000 in monthly income. The FTC alleges, however, that the structure of the schemes ensured that few would benefit. In fact, the majority of participants would fail to recoup their initial investments. According to the FTC, Bitcoin Funding Team and My7Network participants could only generate revenue by recruiting new participants and convincing them to also pay cryptocurrency. For example, Bitcoin Funding Team participants were required to make an initial bitcoin payment to an earlier participant and pay a fee to Bitcoin Funding Team. With these payments, participants were eligible to recruit new members and receive payments from them. Promoters claimed participants could earn bigger rewards if they paid additional bitcoins.

• FTC press release

The Department of the Treasury has published a final rule at 83 FR 11876 in today's Federal Register to adjust its civil monetary penalties ("CMPs") for inflation as mandated by the Federal Civil Penalties Inflation Adjustment Act of 1990, as amended. This rule adjusts CMPs within the jurisdiction of certain components (Terrorism Risk Program, OFAC, FinCEN) of the Department to the maximum amount required by the Act.

The OCC has announced it will host two workshops at the Holiday Inn Fort Walton Beach, Fort Walton Beach, Florida, April 24-25, for directors of national community banks and federal savings associations supervised by the OCC.

• The Risk Governance workshop on April 24 combines lectures, discussion, and exercises to provide practical information for directors to effectively measure and manage risks.
• The Credit Risk workshop on April 25 focuses on credit risk within the loan portfolio, such as identifying trends and recognizing problems. The workshop also covers the roles of the board and management, how to stay informed of changes in credit risk, and how to effect change.