One of the benefits of your credit union's League membership is access to InfoSight--a valuable online compliance resource. This newsletter contains some timely highlights, and access to InfoSight is a benefit of League affiliation, so it is password-protected. If you have a specific compliance issue or concern, contact our Consulting Department at (800) 285-5300. Replies to this email will be directed to SVP, League Services & Regulatory Analysis
Joe Guilfoy
.
|
|
In 2016, NACHA and the Federal Reserve Board amended their operating rules to support Same Day ACH payments.
The rule will enable ACH originating depository financial institutions (ODFIs) that want to utilize same-day processing the option to send same-day ACH transactions to accounts at any receiving depository financial institution (RDFI). Offering same-day ACH products and services will be optional for ODFIs, but receipt of same-day entries will be required for RDFIs.
Besides requiring mandatory participation by RDFIs, the rule requires an interbank fee paid by the ODFI to the RDFI for each same-day ACH forward transaction. The fee will allow RDFIs to recover some of their costs for enabling and supporting mandatory receipt of same-day ACH transactions. The interbank fee is set at $0.052 cents per transaction.
ODFIs will be able to submit files of same-day ACH payments through two new clearing windows provided by the ACH Operators:
- A morning submission deadline at 10:30 a.m. (ET), with settlement occurring at 1 p.m. (ET); and
- An afternoon submission deadline at 2:45 p.m. (ET), with settlement occurring at 5 p.m. (ET)
Virtually all types of ACH payments, including both credits and debits, will be eligible for same-day processing. Only international ACH transactions (IATs) and high-value transactions above $25,000 will not be eligible.
|
|
Compliance Outlook for Q4 2017
|
|
Caution on prospective Venezuelan digital currency
|
|
OFAC has posted a new
Frequently Asked Question
relating to a December 2017 announcement by Venezuelan President Nicolas Maduro of plans for the Venezuelan government to launch a digital currency. Because the proposed currency would reportedly carry rights to receive commodities in specified quantities at a later date, OFAC has determined that the currency would appear to be an extension of credit to the Venezuelan government, and U.S. persons that deal in the prospective Venezuelan digital currency may be exposed to U.S. sanctions risk.
Source:
Treasury.gov
|
|
Detecting and Preventing Ransomware Starts with Four Key Steps
|
|
Ransomware is a type of trojan—malware designed to provide unauthorized, remote access to a user’s computer—that was first seen in 1989 and dubbed the AIDS Trojan. The original infection was found on floppy disks that were handed out at a conference. Once the user’s machine was infected, the trojan laid in wait counting the number of times the machine rebooted. Once the machine hit 90 reboots, malware hid the directories and encrypted the names of the files. The ransom demand for a “licensing fee” of $189 was to be paid using the twentieth century, black-box equivalent of bitcoin—by sending money to a Panamanian P.O. Box.
With the proliferation of the internet, ransomware has expanded. However, the method of infection today remains the same as it did in the original AIDS Trojan of the late 1980s. After encrypting files or directories following a phishing attack, the perpetrator seeks a ransom usually in the form of a virtual currency like bitcoin. Increasingly, however, ransomware perpetrators only partially unlock files in an effort to extract an even larger payment, or simply keep the money and never provide the key.
Recent changes to the ransomware model have incorporated a worm that allows the infection to spread through peer-to-peer computer networks, as in the case with the recent WannaCry virus. Here, attackers used exploits exposed by the ShadowBrockers hacker network to infect even larger numbers of machines.
What hasn’t changed though is that it is still possible to detect and prevent an attack using the following methods. Here are four ways you can better protect your credit union from ransomware:
- Monitoring—Researchers have found that when ransomware attacks, there is a significant amount of changes to the file system. By monitoring the system-file logs, you can detect the creation, encryption or deletion of files.
- Behavior Analytics—Endpoint solutions, like virus protection, can’t block unknown ransomware variants so it is best to move to user behavior analytics. Baseline normal user activity and setting up a tripwire to find variances will enable you to catch the infection in near real time.
- Honeypots—Create honeypots. Since it is quicker and, often more cost effective, to encrypt recently accessed files in a ransomware attack, creating a fake file repository will often lure the ransomware into encrypting those files and allow you to enact your security measures. This can also help if you don’t have the resources to monitor file access activity.
- Access controls—Getting rid of global access groups from your IT network’s access controls can greatly reduce the ability of the virus to spread. These access groups are known as “open shares,” and open to misuse.
Additionally, if you find yourself a victim of ransomware, the first thing is to go to law enforcement. You will often find that you are not alone, and there may be a known decryption system available for the specific ransomware that you are facing. Also, there are many decryption tools on the market, and often these are built into your security software suite or available online for free.
Credit unions can find additional information and resources on NCUA’s Cybersecurity Resource Center to help them be better protected against ransomware and other cyber threats. Go to NCUA’s
Cybersecurity Resource Center
for additional information.
Source: NCUA
|
|
CUNA Advocacy Related to ADA Threats
|
|
Credit unions have been facing increasing legal threats due to uncertainty over the ADA’s application to websites. One potential solution is for credit unions to ensure their websites are in compliance with Web Content Accessibility Guidelines (WCAG) 2.0.
“We’re working hard to get the government to provide a resolution that helps all credit unions, but it’s important to know, and this can’t be over-emphasized, that the best thing a credit union can today to protect itself is to update your website to the WCAG 2.0 standards,” said Ryan Donovan, CUNA’s chief advocacy officer. “Frankly, a government solution may take a long time, but we believe if a credit union’s website is WCAG 2.0 compliant the risk of being sued is reduced.”
Leah Dempsey, CUNA senior director of advocacy and counsel, said credit unions are facing more than threats, as law firms have moved on to seeking litigation against credit unions they say are not in compliance.
“If you settle with one law firm, nothing precludes you from getting hit with another threat, from a different or even the same law firm,” she said. “CUNA is looking for opportunities for our legal advocacy team to get involved, and we need to hear from you if those opportunities arise.”
Jared Ihrig, CUNA’s chief compliance officer, recommended credit unions conduct an ADA compliance audit of their websites and other digital content, post an accessibility statement on their websites and implement a long-term accessibility strategy among other strategies.
He pointed members to CUNA’s
FAQ document
on ADA accessibility, eGuide on the ADA, and CUNA’s Compliance Community.
Going forward, Donovan said this has become a top advocacy priority for CUNA, and it will continue its work with the House Judiciary Committee, Department of Justice and individual members of Congress to come up with a solution.
To date, CUNA has:
- Launched an ADA advocacy page earlier last week;
- Outlined concerns with the ADA lawsuits in several meetings with DOJ officials;
- Followed up with a letter highlighting those concerns;
- Backed a bill that would address these threats;
- Written to the House and Senate Judiciary Committees;
- Spearheaded efforts that resulted in 61 members of Congress raising ADA concerns in a letter to DOJ; and
- Scheduled a breakout session at this year’s CUNA Governmental Affairs Conference with the latest developments, scheduled for Monday, Feb. 26 from 2:45 to 4 p.m. (ET).
Source: CUNA
|
|
Weekly Regulatory Advocacy Report
|
The Weekly Advocacy Report provides links to information about a number of recent League, CUNA and NCUA regulatory and advocacy activities.
|
|
Upcoming Education Sessions
|
The League has several education sessions coming up. Several focus on compliance issues. They are listed in calendar format on the League website.
|
|
League Consulting Department Staff
(800) 285-5300
|
|
January
- January 28, 2018: 5300 Call Report Due to NCUA
February
- February 19, 2018: President's Day - Federal Holiday
March
- March 16, 2018: Same-day ACH (NACHA) – Phase 3 of the implementation period for the rule.
April
- April 1, 2018: Prepaid Accounts under the Electronic Fund Transfer Act/Regulation E and the Truth In Lending Act/Regulation Z (Date Extended)
- April 29, 2018: 5300 Call Report Due to NCUA
May
- May 11, 2018: Customer Due Diligence – CDD (FinCEN) – Effective date
- May 28, 2018: Memorial Day - Federal Holiday
July
- July 4, 2018: Independence Day - Federal Holiday
- July 29, 2018: 5300 Call Report Due to NCUA
September
- September 3, 2018: Labor Day - Federal Holiday
October
- October 8, 2018: Columbus Day - Federal Holiday
November
- November 12, 2018: Veterans Day (observed) - Federal Holiday
|
|
There's more available from InfoSight
|
|
InfoSight content is available from the
League's website
. Visit anytime to get sample policies, links to federal regulations and summaries of issues that are hot-topics at your credit union.
Access to InfoSight is a benefit of League affiliation, so it is password-protected. If you don't have a password or if you have forgotten yours, click on the tan "Log In" button in upper right corner of the site; a box will open. Click on the blue wording to get your password.
|
|
|
|
|
|
|
