Exam 4

Question 1

How long do mortgage servicers have to make contact with delinquent members?

Answer 1

By the 45th day of delinquency, the servicer must provide delinquent members a written notice about loss mitigation options.

Question 2

What are the requirements for credit unions to use coupon books instead of periodic statements?

Answer 2

• The loan must be a fixed rate loan. Each coupon must include the amount due, the amount of any late fees, the date late fees will be charged, and the due date. The coupon book itself must also include:
  i. The contact information for home ownership counseling, including HUD’s toll-free phone number
  ii. The principal balance as of the beginning of the time period covered by the coupon book
  iii. A statement regarding how a member can obtain information such as an explanation of the amount due or a past payment breakdown
  iv. The current interest rate
  v. Any prepayment penalty
  vi. Contact information for how members can receive more information about their loans

Question 2

Are there any types of loans exempt from the periodic statement requirement? If so, what types of loans are exempt?

Answer 2

• Reverse mortgages
• Timeshare loans
• Certain charged–off loans

Question 3

What is the timing of the notice requirements for force-placed insurance?

Answer 3

• First notice must be sent at least 45 days before charging the member for force-placed insurance
• Reminder notice must be sent at least 30 days after the first notic

Question 4

When is a credit union considered a “small servicer?” What are some of the provisions that would still apply to “small servicers?” What are some provisions that do NOT apply to “small servicers?

Answer 4

• A credit union is a small servicer if, together with any affiliates, services 5,000 or fewer mortgage loans and the credit union (or an affiliate) is the creditor or assignee for all of them.
• Small servicers must still comply with the following service requirements:
  i. Adjustable rate mortgage notices
  ii. Prompt crediting of payments
  iii. Responding to qualified written requests (the error resolution and information request requirements)
  iv. Escrow account servicing requirements
  v. The remainder of the force-based insurance requirements
  vi. Two provisions of the loss mitigation requirements:
  1. Small servicers must not make the first notice or filing for foreclosure unless a member’s mortgage is more than 120 days delinquent
  2. Small servicers must not proceed to foreclosure judgment if the member is performing under the terms of a loss mitigation agreement
  vii. Payoff statements requirements
  viii. Service transfer requirements

Question 5

What is the difference between an information request and an error notice?

Answer 5

• They both should include the member’s name and information that allows the servicer to identify the member’s mortgage loan account. But an error request must also include a description of the error that is believed to have occurred, whereas an information request must detail the information requested by the member.

Question 5

What is an error for the purposes of the error resolution rule?

Answer 5

• Failure to accept a payment that conforms to the servicer’s written requirements
• Failure to apply an accepted payment to principal, interest, escrow, or other charges under the terms of the loan and applicable law
• Failure to credit a payment to a member’s mortgage loan as of the date of receipt
• Failure to pay taxes, insurance premiums, or other charges or to refund an escrow account balance
• Failure to provide an accurate payoff balance amount upon a member’s request
• Failure to provide accurate information to the member regarding loss mitigation options and foreclosure
• Failure to transfer accurately and timely information relating to the transfer of servicing of a member’s mortgage loan to another servicer
• Imposition of a fee or charge that the service lacks a reasonable basis to impose
• Moving for foreclosure judgment or order of sale or conducting a foreclosure sale in violation of RESPA loss mitigation procedures

Question 6

What is a periodic payment? How must servicers handle these payments?

Answer 6

• …A periodic payment is defined as one that includes the amount necessary to pay principal, interest, and any applicable escrow.
• Credit unions must credit periodic payments as of the day the payment was received.
  i. Staff commentary clarifies that date of receipt means the day payment reaches the credit union, not when the funds are actually collected.

Question 7

How are partial payments treated? Can the credit union charge a late payment fee for a partial payment?

Answer 7

• The credit union has a few options for handling partial payments under the servicing rules:
  i. Credit the payment upon receipt
  ii. Return the payment to the member
  iii. Place the partial payment into a suspense account until the funds are sufficient to cover a periodic payment
• Based on inference, it appears that a credit union can charge a late fee on a partial payment. Verify in presentations, if possible

Question 8

How do Regulations X and Regulation Z determine which persons might be successors in interest that are covered by some of the mortgage servicing rules?

Answer 8

• Generally, a successor in interest is a person who is transferred “an ownership interest in a dwelling securing a closed-end consumer credit transaction,” if that transfer occurs under specific circumstances. These circumstances include, but are not limited to:
  i. A transfer due to a heath of the member
  ii. Where a member’s spouse or children become owners of the property
  iii. A transfer resulting from a divorce or similar agreement where a spouse becomes an owner of the property
  iv. A transfer by operation of law upon the death of certain owners

Question 8

What constitutes prohibited pyramiding of late fees?

Answer 8

• Pyramiding of late fees occurs when a member pays the current amount due without the prior month’s late fee, and the payment is applied to the late fee first, leaving an overdue balance on the current month and resulting in another late fee.
  i. In other words, if a member makes a periodic payment on time without paying a past due late fee, the credit union may not charge an additional late fee.

Question 8

What is dual tracking under the loss mitigation rule? How can credit unions avoid this?

Answer 8

• Dual tracking occurs when a servicer moves forward with foreclosure while simultaneously working with the member to avoid foreclosure.
  i. To prohibit this, a servicer is prohibited from making the first notice or filing required for a foreclosure process until a member is more than 120 days delinquent.

Question 9

How should a credit union treat a shortage in an escrow account? How should a credit union treat a deficiency in an escrow account?

Answer 9

• Shortages less than one month’s escrow payment:
  i. The servicer may allow the shortage to exist and do nothing to change it
  ii. The servicer may require the member to repay the shortage amount within 30 days
  iii. The servicer may require the member to repay the shortage amount in equal monthly payments over at least a 12-month period
• Shortages more than or equal to one month’s escrow payment:
  i. The servicer may allow the shortage to exist and do nothing to change it
  ii. The servicer may allow the member to repay the shortage in equal monthly payments over at least a 12-month period

Question 10

What is considered a “designated loan?” What are the exceptions?

Answer 10

a. A loan secured by a building or mobile home (including manufactured homes) that is located on or will be located in a special flood hazard area (SHFA) within a community that participates in the National Flood Insurance Program (NFIP).
b. Exceptions include:
i. Any state-owned property covered under a policy of self-insurance satisfactory to the administrator of FEMA (the administrator publishes and periodically revises the list of states falling within this exemption)
ii. Property securing any loan with an original principal balance of $5,000 or less and a repayment term of one year or less
iii. Any structure that is part of any residential property but is detached from the primary structure and does not serve as a residence

Question 10

Under what circumstances is a credit union required to escrow for flood insurance premiums and fees?

Answer 10

a. A credit union must require the escrow of all premiums and fees for flood insurance that is required in connection with loans made, increased, extended, or renewed on or after January 1, 2016.
b. For loans made before January 1, 2016, a credit union is required to escrow for flood insurance premiums and fees if it also escrows for taxes, insurance premiums, fees, or other charges.
c. Credit unions must offer borrowers the option to escrow premiums and fees for flood insurance for loans made before January 1, 2016 that are not subject to mandatory escrow.
d. There are six exceptions to the escrow requirement based on the type of loan or whether flood insurance is offered to borrowers under a group policy:
i. The loan is an extension of credit primarily for business, commercial, or agricultural purposes
ii. The loan is in a subordinate position to a senior lien secured by the same residential improved real estate or mobile home
iii. Flood coverage is provided under a group policy
iv. The loan is a HELOC
v. The loan is a nonperforming loan (90 days or more past due) and remains nonperforming
vi. The loan has a term of 12 months or less

Question 11

Under which circumstances is a credit union required to provide the flood notice to borrowers? Be familiar with the exceptions.

Answer 11

a. Notice is required to be provided when a credit union makes, increases, extends, or renews a loan secured by a building or a mobile home located or to be located in an SFHA.
i. Notice is required regardless of whether the building or mobile home securing the loan is located in a community that participates in the NFIP.
b. The notice must include:
i. A warning, in a form approved by the administrator of FEMA, that the property is located in an SFHA
ii. A description of the flood insurance purchase requirements
iii. A statement that flood insurance coverage is available under the NFIP (if applicable) and may also be available for private insurers
iv. A statement that flood insurance that provides the same level of coverage as a standard flood insurance policy under the NFI{ may also be available from a private insurance company
v. A statement that the borrower is encouraged to compare flood insurance coverage, deductibles, exclusions, conditions, and premiums associated with flood insurance issued on behalf of the NFIP with coverage offered by private insurance companies
vi. A statement on whether federal disaster relief assistance may be available in the event of damage to the building or mobile home caused by flooding in a federally-declared disaster
c. Exception to requirement of credit union providing flood notice:
i. A credit union may obtain written assurances from a seller for the seller to provide the notice to the purchaser within a reasonable time before completion of the sale.
1. If this method is chosen, the credit union must maintain a record of the written assurance for as long as they own the loan.

Question 12

When may a credit union rely on a past Standard Flood Hazard Determination form?

Answer 12

• If the determination is not more than seven years old
• The basis for the determination was set forth on the SFHDH
• There have not been any map revisions or updates since that determination was made.

Question 13

What steps should a credit union’s BSA risk assessment follow?

Answer 13

a. Identify the specific risk categories unique to the credit union
i. Including specific products and services, members, and geographic locations
b. Analyze the data identified in step 1 above to better assign risk within the categories

Question 13

What are the five pillars of a credit union BSA compliance program? What are the components or requirements of each pillar?

Answer 13

a. A system of internal controls to ensure compliance should address the following items:
i. Identifying the person responsible for BSA compliance
ii. Implementing risk-based Customer Due Diligence (CDD) policies, procedures, and processes
iii. Providing sufficient systems for filing SARs and CTRs
iv. Requiring the board and senior management to be informed of any compliance deficiencies
b. A system of independent testing – Conducted to evaluate the compliance program, assess a credit union’s BSA compliance, and to test systems.
i. Should be conducted by an internal audit department or outside auditors or consultants
ii. Should be based on the credit union’s risk profile
iii. Should be conducted every 12-18 months
c. An individual designated with the responsibility for day-to-day compliance – Designated by the board
i. Responsible for overseeing the day-to-day implementation of the compliance program and managing compliance with all regulations and internal procedures
ii. The regulatory requirement is not met by merely appointing someone as a BSA compliance officer. They must have the requisite expertise, knowledge, authority, and time to satisfactorily complete the job.
d. Training for appropriate personnel – Should be tailored to the employee’s responsibilities, be ongoing, and cover regulatory requirements and developments, as well as the credit union’s internal policies and procedures.
e. Risk-based procedures for ongoing customer due diligence – Requires credit unions to implement and maintain risk-based procedures for conducting identification and verification at account opening and performing ongoing maintenance.

Question 14

What is the difference between acceptable identification documents for customers and for beneficial owners?

Answer 14

• The credit union may rely on photocopies or other reproductions of identification documents. The credit union can rely on another financial institution’s CIP with respect to a legal entity customer that is opening an account under certain conditions.

Question 15

What minimum pieces of identifying information must be collected for CIP purposes?

Answer 15

• Name
• Date of birth (for an individual)
• Address (residential for an individual, business address for an entity)
• Identification number (SSN for an individual, taxpayer identification number for an entity)

Question 16

Explain the requirement to notify the board of directors of a SAR filing. Must the credit union provide a copy of the SAR to its board?

Answer 16

a. NCUA regulations require a credit union to notify the board of directors or an appropriate board committee that SARs have been filed.
i. The regulations do not mandate a particular notification format, and the credit union has flexibility in structuring its format.

Question 16

What are the reporting and timing requirements for CTRs? When are transactions aggregated together?

Answer 16

a. A completed CTR must be filed with FinCEN within 15 days after the date of the transaction. The credit union must have copies of CTR filings for five years from the date of the report.
b. A credit union must file a CTR for each transaction in currency (deposit, withdrawal, exchange, or other payment or transfer) of more than $10,000 by, through, or to the credit union.
i. Multiple currency transactions totaling more than $10,000 during any one business day are treated as a single transaction if the credit union has knowledge that it is by or on behalf of the same person.

Question 17

What are the dollar thresholds and timing requirements for filing SARs?

Answer 17

a. Credit unions are required to file a SAR in regards to
i. Criminal violations involving insider abuse in any dollar amount
ii. Criminal violations aggregating $5,000 or more when a suspect can be identified
iii. Criminal violations aggregating $25,000 or more regardless of whether or not the credit union can identify the suspect
iv. Transactions conducted or attempted by, at or through the credit union (or an affiliate) and aggregating $5,000 or more, if the credit union or affiliate knows, suspects, or has reason to suspect that the transaction
1. May involve potential money laundering or other illegal activity (i.e., terrorism financing)
2. Is designed to evade the BSA or its implementing regulations
3. Has no business or apparent lawful purpose, or is not the type of transaction that the particular member would normally be expected to engage in, and the credit union knows of no reasonable explanation for the transaction after examining the available facts, including the background and possible purpose of the transaction
b. A SAR is required to be filed no later than 30 calendar days from the date of the initial detection of facts that may constitute a basis for filing a SAR.
i. If no suspect can be identified, the time period for filing a SAR is extended to 60 days

Question 18

What is the difference between the purpose of 314(a) and 314(b) information sharing? What must a credit union do when it receives a 314(a) request? What does a credit union have to do to share under 314(b)?

Answer 18

a. 314(a) – Through a 314(a) request, FinCEN solicits, on behalf of the law enforcement agency, certain information from the financial institutions, including credit unions.
i. The law enforcement agency must provide written certification to FinCEN attesting that there is credible evidence of engagement or reasonable suspected engagement in terrorist activity or money laundering for each individual, entity, or organization about which the law enforcement agency is seeking information.
1. Upon receiving an information request, a credit union must perform a one-time search of its records to identify accounts or transactions of a named suspect. Unless otherwise instructed to by an information request, a credit union must search its records for current accounts, accounts maintained during the preceding 12 months, and transactions conducted outside of an account by or on behalf of a named suspect during the preceding six months
2. The financial institution must search its records and report any positive matched to FinCEN within 14 days, unless otherwise specified in the information request.
b. 314(b) – Encourages financial institutions and associations of financial institutions located in the United States to share information in order to identify and report activities that may involve terrorist activity or money laundering.
i. To share under this program, a credit union must policies, procedures, and processes should be developed and implemented for sharing and receiving of information.
1. A notice to share information is good for one year
2. A credit union should designate a point of contact and establish a process for sending and responding to information sharing requests
3. A credit union must take reasonable steps to verify that the other financial institution or association of financial institutions with which it intends to share information has also submitted the required notice to FinCEN.

Question 18

How should a credit union verify the identity of a consumer during a sale of monetary instruments? Does this change if the consumer is a non-member?

Answer 18

a. Credit unions may either certify that the purchaser of monetary instruments is an accountholder with identifying information on record with the credit union, or it may verify the identity of the purchaser by viewing a form of identification that contains the member’s name and address, and that the financial institution accepts as a means of identification.
b. Credit unions must obtain additional information for purchasers who are not members, but are within the credit union’s field of membership.
i. The method used to verify these identities must be recorded in some way

Question 19

What are the record retention requirements for BSA-related documents?

Answer 19

a. In general, the BSA requires that a credit union maintain most records for at least five years.
i. They can be maintained in many forms including the original, microfilm, electronic, copy, or reproduction.
ii. Must be kept in a way that makes them accessible in a reasonable period of time

Question 20

What does a risk-based OFAC program look like in general terms? Must it apply to both members and nonmembers?

Answer 20

a. The credit union’s policies, procedures, and processes should address how the credit union will identify and review transactions and accounts for possible OFAC violations, whether conducted manually or through interdiction software, or a combination of both.
i. These requirements apply to both members and nonmembers alike.

Question 21

What are the three main OFAC regulatory requirements? How do they differ from NCUA expectations?

Answer 21

a. Three main OFAC regulatory requirements:
i. Block accounts and other property of specified countries, entities, and individuals
ii. Prohibit or reject unlicensed trade and financial transactions with specified countries, entities, and individuals
iii. The reporting of blocked assets and the recordkeeping of blocked transactions
b. NCUA expects that a credit union will establish and maintain an effective, written OFAC compliance program commensurate with its OFAC risk profile (based on products, services, members, and geographic locations).

Question 22

What must be addressed in the written information security program? When must it be updated?

Answer 22

a. A federally-insured credit union must have a security program designed to:
i. Protect the credit union from robberies, burglaries, larcenies, and embezzlement
ii. Ensure the confidentiality and security of member information
iii. Respond to incidents of unauthorized access to member information
iv. Assist in the identification of persons responsible for physical threats to the credit union as well as attempts to access unauthorized member information
v. Prevent destruction of vital credit union records

Question 23

What does NCUA require from credit unions in the event of a catastrophic act?

Answer 23

a. NCUA requires that a federally-insured credit union notify its regional director within five business days of any catastrophic act that occurs at the credit union.
b. As soon as reasonably possible, the credit union should make a record of the incident
i. Information where the catastrophic act occurred
ii. When it took place
iii. Amount of loss
iv. Whether any operational, mechanical, or technical deficiencies contributed to the incident
v. What steps the credit union is taking to correct any deficiencies
c. The credit union should also establish business continuity plans (BCP) to ensure the credit union is prepared for potential disruptions that could impact service to its members.

Question 24

How should a credit union certify compliance with NCUA’s security program requirements?

Question 24

What is the role of the credit union’s board in the information security program? What is their role with regard to IT oversight?

Answer 24

• The board of directors and senior management will need to analyze potential risks and formulate appropriate risk management techniques to mitigate those risks, as well as determine action steps to be taken if the credit union’s security is compromised.
• The credit union should provide a report to the board of directors at least annually. The report should describe the overall status of the program and its compliance with Part 748. Specifically the report should discuss:
  i. Risk assessments
  ii. Risk management and control decisions
  iii. Third party relationships
  iv. Testing results
  v. Security breaches
  vi. The credit union’s responses and recommendations for changes to the program going forward

Question 25

When must a credit union report a cyber incident to NCUA? What info must be reported?

Answer 25

• CU must send a catastrophic act report to its regional director within 5 business days of any catastrophic act impacting the CU
  o Catastrophic act – any disaster, natural or otherwise, resulting in physical destruction or damage to the credit union or causing an interruption in vital member services projected to last more than two consecutive business days.
   Info reported includes: where the catastrophic act occurred, when it took place, the amount of loss (if any); whether any operational, mechanical, or technical deficiencies contributed to the incident; and what steps the credit union is taking to correct any deficiencies.
• CU must notify NCUA within 72 hours of determining the CU has experienced a “reportable cyber incident”

Question 25

What must be addressed in the response program for unauthorized access to member information? When does the response program apply? Is member notice required? If so, what must be included in the notice?

Answer 25

a. The response program needs to address how the credit union will assess the nature and scope of an incident in order to identify what member information has been accessed and the extent of the breach. The response will need to take appropriate steps to contain and control the incident to prevent further unauthorized access. Steps preventing further access may include:
i. Monitoring accounts
ii. Freezing or closing affected accounts
iii. Preserving records and other evidence related to the unauthorized access or attempted access
b. Member notification is a key component of the credit union’s response program. By providing timely notification to members, the credit union can manage its reputation risk, as well as reduce compliance and legal risks.
i. If the credit union can pinpoint the specific member(s) whose information has been compromised, it can narrow notification to just those members.
ii. If the credit union cannot narrow down the specific member(s) whose information has been compromised, notice should be sent to all members.

Question 26

Are IT audits required? What is necessary for an IT audit to be valid?

Answer 26

a. A well-planned, properly structured audit program is essential to evaluate risk management practices, internal control systems, and compliance with corporate policies concerning IT-related risks at institutions of every size and complexity.
b. An effective IT audit program:
i. Identifies the greatest areas of risk exposure
ii. Promotes confidentiality, integrity, and availability of IT systems
iii. Determines the effectiveness of planning and oversight
iv. Evaluates the adequacy of current procedures, controls, and compliance efforts
v. Requires corrective action of deficiencies

Question 27

What is the structure and purpose of the FFIEC Cybersecurity Assessment Tool?

Answer 27

a. The Cybersecurity Assessment Tool (CAT) is used to identify cybersecurity risks and gauge the maturity of its cybersecurity controls.
b. The CAT consists of two parts:
i. Inherent Risk Profile – Identifies the inherent risk (before any controls or mitigations are in place) to the credit union’s operations by looking at its types of technologies and connections, delivery channels, online and mobile product offerings, organizational characteristics , and the external threats experienced by the credit union.
1. Risk levels to select from are least, minimal, moderate, significant, and most
ii. Cybersecurity Maturity – Assesses the credit union’s controls and risk mitigations across five domains:
1. Cyber Risk Management and Oversight
2. Threat Intelligence and Collaboration
3. Cybersecurity Controls
4. External Dependence Management
5. Cyber Incident Response and Resilience
iii. In each domain, the credit union has answer choices:
1. Yes
2. Yes with compensating controls – Indicates that there is a management, operational, or technical safeguard or countermeasure employed by the credit union, rather than the specific recommended security control listed in the question.
3. No
iv. Maturity statements range from “baseline” maturity, to “innovative” maturity, and the credit union’s maturity for each domain is the highest maturity level where it answered all “yes” or “yes with compensating controls.”

Question 28

How does the criticality of a third-party relationship affect the level of oversight required for the vendor?

Answer 28

The more critical a vendor is deemed to be, the more risk the relationship poses to the credit union. Therefore, the more critical the vendor, the more planning, due diligence, and monitoring is required.

Question 29

What due diligence practices are recommended by NCUA regarding a potential vendor?

Answer 29

a. Before entering into a third-party relationship, the NCUA expects the credit union to determine whether using a third party complements its overall mission and philosophy.
i. Credit union officials should weigh the costs and benefits of outsourcing the business function.
1. Credit unions should consider the following:
a. Expectations for outsourced functions
b. Credit union staff expertise
c. The criticality or importance of the outsourced activity
d. Insurance considerations
e. The impact on membership should the credit union use a third party
f. An exit strategy for the relationship
g. The use of financial projections to gauge the credit union’s return on its investment and whether the benefits of the proposed relationship outweigh the potential risks and costs

Question 30

Do vendor relationships alleviate a credit union’s liability when there is a member complaint or compliance violation? Is this still true if the credit union includes certain contractual provisions?

Answer 30

a. No, vendor relationships do not alleviate the credit union from liability when there is a member complaint or compliance violation.
i. Even where a contract provision provides that the vendor is responsible for compliance with regulatory requirements, this does not alleviate the credit union from liability if the vendor fails to comply with applicable regulatory requirements.

Question 31

Should vendor contracts be reviewed by anyone in particular before a credit union enters into a contractual agreement with a third party?

Answer 31

Legal counsel with the appropriate experience and expertise should review contracts with vendors.

Question 32

What due diligence areas does the FFIEC indicate are important to cover for technology service providers?

Answer 32

a. In addition to the areas discussed by the BCUA, the FFEIC also specifies that due diligence on technology service providers should also look at the vendor’s:
i. Service delivery capability, status and effectiveness
ii. Technology and system architecture
iii. Internal controls environment, security history, and audit coverage
iv. Insurance coverage
v. Ability to meet disaster recovery and business continuity requirements
vi. Philosophy, quality, initiatives, culture, and values

Question 33

When does the vendor management process end?

Answer 33

Vendor management is an ongoing process. It does not end after vendor selection and signing of the contact

Question 34

What does “express written consent” mean?

Answer 34

a. Express written consent must be demonstrated in a written agreement that must clearly and conspicuously disclose to the consumer that:
i. By signing the agreement, they authorize the seller to deliver, to a designated phone number, telemarketing calls using an autodialer or an artificial or prerecorded voice
ii. The consumer is not required to sign the agreement, or agree to enter into it, as a condition of purchasing property, goods, or services

Question 34

When is express written consent required prior to making a call? What type of calls? What type of equipment?

Answer 34

a. Express written consent is required for all telemarketing calls to cell phones using an autodialer (defined as equipment which has the capacity to store or produce telephone numbers to be called, using a random or sequential number generator, and to dial such numbers) or by robocall (calls made using an artificial or prerecorded voice), and for all robocall telemarketing calls to residential lines.
i. Telemarketing is defined as the “initiation of a telephone call or message for the purpose of encouraging the purchase or rental of, or investment in, property, goods, or services, which is transmitted to any person.”
ii. As a general rule any dual-purpose calls (calls that have both a telemarketing and informational purpose) are considered to be telemarketing calls.
b. Express written consent is also required for informational calls to cell phones using an autodialer or by robocall. Examples of this type of call includes
i. Debt collection calls
ii. Calls made by loan servicers regarding the servicing of a consumer loan or home loan modification
iii. Providing a credit card balance
iv. Research and survey calls

Question 35

How do the requirements change when a credit union uses an autodialer or prerecorded message?

Answer 35

a. Use of an autodialer or prerecorded message requires prior express written consent.
i. The credit union must have a signed written agreement that clearly and conspicuously discloses
1. The telephone number to which the consumer is consenting to be called
2. An authorization for the caller to contact the consumer using an autodialer for telemarketing purposes
3. That the agreement is not a condition of purchasing goods or services

Question 36

What are the restrictions on telephone solicitations? Under what circumstances is a credit union shielded from liability for making solicitations to someone on the national do-not call database?

Answer 36

a. A credit union may not:
i. Make telephone solicitations to any residential telephone subscriber before 8 AM or after 9 PM local time at the called party’s location
ii. Call any residential telephone subscriber who has registered his or her telephone number on the national do-not-call list.
b. Credit unions will not be liable for calling a member who is on the national do-not-call list if they can demonstrate that the violation was a result of an error and that in their routine business practices they meet the following standards:
i. Written Procedures – The credit union has established and implemented written procedures to comply with the national do-not-call rules
ii. Training of Personnel – The credit union has trained its personnel, and an entity assisting in its compliance, in procedures established pursuant to the nation do-not-call rules
iii. Recording – The credit un ion has maintained and recorded a list of telephone numbers that the credit union or its vendors may not contact
iv. Accessing the National Do-No-Call Database – The credit union uses a process to prevent telephone solicitations to any telephone number on any list established pursuant to the do-not-call rules, employing a version of the do-not-call registry obtained no more than 31 days prior to the date any call is made, and maintains records documenting this process
v. Purchasing the National Do-Not-Call List – The credit union purchases access to the database from the administrator of the national database and does not enter into a cost-sharing arrangement with others. The credit union also employs a process to ensure that it uses the database to comply with the TCPA and does not sell, rent, lease, purchase, or use the database in a manner inconsistent with applicable law

Question 36

What are the requirements with respect to a credit union’s company-specific do-not-call registry?

Answer 36

a. A credit union making telemarketing calls, or who contracts with someone to make telemarketing calls on behalf of the credit union, must have a written policy for maintaining the do-not-call registry and train personnel engaged in telemarketing regarding the existence and use of the do-not-call list.
b. The credit union (or its vendor) must also provide the called party with the name of the caller, the name of the credit union on whose behalf the call is being made (if applicable, and a telephone number or address at which the credit union may be contacted.