Overview of Remote Deposit Capture and Advance Deposit in The

Overview of Remote Deposit Capture, Advance Deposit and Overdraft in the Prepaid Context

Chris Daniel Partner; Co-Chair, Payment Systems Group ACI National Forum on Prepaid Card Compliance Paul Hastings LLP January 31, 2014 Washington D.C.

. Remote Deposit Capture (“RDC”) – Background – Current Regulatory Landscape

. Advance Deposit and Payday Lending – Background – Current Regulatory Landscape

. Overdraft – Background – Current Regulatory Landscape

. Looking Ahead

RDC – BACKGROUND

. RDC enables customers of financial institutions to deposit items electronically from remote locations by taking a picture of the front and back of a check and sending that picture to their bank via their smartphone’s internet connection. – This is most often accomplished by using RDC functionality imbedded in a bank’s smartphone application. – Preliminary research has suggested that this functionality is tremendously popular among consumers.

. Benefits of RDC: – Decrease processing costs by driving customers away from the branch. – Improve customers’ access to their deposits.

. A number of prepaid providers now offer RDC functionality allowing consumers to deposit payment instruments directly on their prepaid card using their smartphone camera.

Example:

– Ingo Money recently partnered with Visa to offer its mobile remote capture service to a number of Visa prepaid card providers: BankingUp (formerly Plastyc), AccountNow, RushCard, etc.

. Concerns: – Duplicate check presentment (especially for prepaid); – Check alteration; and – More difficult to detect counterfeit items. . January 2009: FFIEC issues “Guidance Regarding Risk Management of RDC” – Legal and Compliance Risks: Prepaid providers must ensure compliance with the Bank Secrecy Act (“BSA”) as well as applicable state laws. – Operational Risks: Must assess risks associated with how and where non- public personal information is captured, transmitted, retained and destroyed. • Federal Financial Institutions Examination Council (“FFIEC”) Guidance considers single-factor authentication to be inadequate when used as the only control mechanism for high-risk transactions that involve access to customer information or transmission of funds to third parties. • Ineffective controls at the customer location may lead to the intentional or unintentional alteration of deposit item information, resubmission of an electronic file, or re-deposit of physical items. – Information Security: access controls on consumer information systems; encryption of electronic customer information; monitoring systems to detect attempted attacks.

Enforcement Actions . In March 2010, the Financial Crimes Enforcement Network (“FinCEN”) assessed a civil money penalty against Wachovia Bank in part for violations pertaining to RDC. – According to FinCEN, during a two-year period, the bank failed to adequately monitor approximately six million checks valued at nearly $47 billion received through RDC. – FinCEN argued that Wachovia “failed to consider whether, and to what extent, it could be exposed to the risk of money laundering and non-compliance with AML laws and regulations. In particular, the bank failed to recognize and respond to the growing use and accompanying risk of RDC by foreign correspondent financial institutions and foreign money services businesses.” . Similar enforcement actions against Zions Bank and Saddle River Valley Bank (New Jersey).

RDC Best Practices: . To mitigate money laundering risk: – Additional due diligence needed when the RDC capture device is in a foreign location. – Identify high-risk customers as such and conduct additional customer screening.

. To mitigate privacy risks: – Consider the confidentiality, integrity, and availability of data afforded by the provider’s own IT systems AND by the systems used by its service providers and RDC customers.

. To prevent duplicate check presentment: – Banks: duplicate detection features in RDC software; process all items captured through RDC through existing deposit fraud filters. – Prepaid providers should utilize locational controls on RDC (i.e. cannot deposit via mobile within 500 feet of a check cashing location).

. Advance deposit is an account feature offered by some depository institutions to certain of their account holders who have recurring electronic deposits into their accounts. – A loan is extended by the institution and repaid automatically out of the borrower’s next electronic deposit. – Recently, several large banks have announced plans to discontinue this service under pressure from regulators and consumer advocacy groups.

. Payday loans are offered by non-depository institutions. – Repaid at the storefront or can be initiated by the lender who either presents the borrower’s personal check on the due date or initiates a pre-authorized electronic debit of the borrower’s deposit account.

. Advance deposit and payday loans offer ready access to funds for a short period of time with very limited underwriting.

. Rather than charge a periodic interest rate and link the cost of the loan to the length of time the debt is outstanding, payday and deposit advance lenders charge a set fee that is based upon the amount borrowed and does not vary with loan duration. This can result in a very high APR for these services.

Advance Deposit Payday Lending

Sample • Wells Fargo: The Direct Deposit Advance service offers a • What is a cash advance or payday loan? It’s a short term loan Product temporary source of credit when you need help managing that helps give you some extra cash when you need it before unexpected or emergency expenses. payday! The amount is usually between $100 and $999, however Terms • How does it work? some lenders may go above that. • You can get advanced access to your next electronically deposited paycheck or other recurring direct deposit of $200 or • Can I qualify for a payday loan or cash advance? Yes, it’s easy! more. To be approved for a payday loan, you only need: • Your advance is automatically deposited into your checking • To have had your current job for at least 90 days account. • To have a take home pay of at least $1000/month after taxes • Your advance will be automatically repaid when your account • Have a current home and work phone number and valid email receives any direct deposit of $100 or more. address Source: www.wellsfargo.com/checking/direct-

deposit-advance • How do I get the money? After your cash advance is approved,

the money is electronically deposited directly into your checking • US Bancorp: If you're a checking account customer with an account. unexpected expense, you can immediately advance funds from

your next Direct Deposit into your U.S. Bank Checking account. • How and when do I repay the loan? The loan amount and loan • No application or approval process necessary if you are an eligible checking account customer. fees are withdrawn from your checking account automatically on • Advance funds are deposited directly into your checking account the due date of your loan. You don’t even need to think about it! and available for your immediate use. You don’t need to make any payments or visit any store. You can • Advance limit is up to $500. The fee charged is $2.00 for every also request an extension if you need it by contacting your lender $20.00 borrowed. before the due date. Additional fees do apply to loan extensions. • Outstanding advances are automatically paid with your next Direct Deposit of $100 or more. • The APR on a short term loan can range from 200% to 2,290% • Advances must be paid in full within 35 days of each advance. depending on how the APR is calculated (nominal vs. effective), Source: www.usbank.com/checking/caa the duration of the loan, loan fees incurred, late payment fees, non-payment fees, loan renewal actions, and other factors. Keep • January 2014: Wells Fargo, U.S. Bancorp, Fifth Third in mind that the APR range is not your finance charge and your Bancorp., and Regions Financial Corp. all announced finance charge will be disclosed later on. plans to discontinue offering advance deposit as an Source: www.cashadvance.com account feature due to new regulatory guidance.

Advance Deposit Payday Lending

Applicable Law • Section 5 of the Federal Trade Commission Act, governing unfair • Subject to state payday lending and usury laws: or deceptive acts or practices (“UDAP”). • In New York, for example, the criminal law sets the usury • The Truth in Lending Act and Regulation Z. cap at 25%. N.Y. Penal Code 190.40. • The Electronic Fund Transfer Act and Regulation E. • “No licensee shall at any time cash or advance any moneys on a post-dated check or draft . . . provided however that a • The Truth in Savings Act and Regulation DD. licensee may cash a check payable on the first banking • The Equal Credit Opportunity Act and Regulation B. business day following the date of cashing . . . if such check is a payroll check .” N.Y. Banking Law 373. Regulatory • April 2013: The Consumer Financial Protection Bureau (“CFPB”) • November 2000: The OCC issues an Advisory Letter on Guidance issues a white paper entitled Payday Loans and Deposit Advance payday lending to all of its constituent banks. The Products that contains current data and findings on the use of Advisory Letter outlines the specific risks inherent in the these products by depository and non-depository institutions. practice of payday lending and the particular risks banks • Key finding: current repayment structure, coupled with the undertake when they partner with a third party to provide absence of significant underwriting, contributes to the risk that payday lending services. some borrowers will find themselves caught in a cycle of high • Banks must follow sound lending practices, manage cost borrowing over an extended period of time. their lending risks, and be mindful of the burden payday • April 2013: Federal Reserve Board issues Statement on Deposit loans may place on their customers. Advance Products highlighting the risks to consumers and • A bank must establish policies and procedures to compliance risks to its member banks who choose to offer identify, routinely monitor and control the credit, deposit advance products. transaction, reputation, compliance, and legal risks • November 2013: The Office of the Comptroller of the Currency associated with payday lending programs. (“OCC”), and Federal Deposit Insurance Corporation (“FDIC”) • Banks must closely monitor the lending and collection issue joint guidance that is binding on their constituent banks and activities of any third party that purports to offer payday applies to any prepaid access products issued by loans on its behalf. constituent banks. Supervisory expectations include: • Stronger underwriting criteria, including written underwriting • April 2013: CFPB white paper entitled Payday Loans and policies; Deposit Advance Products finds that payday lenders face • Cooling off period of at least one month after repayment of higher credit risk and loss rates than banks that offer advance deposit loan; and advance deposit products. • Every six months, the bank should reevaluate the customer’s eligibility and capacity for the product.

. Recent enforcement actions demonstrate increased regulatory scrutiny of credit features coupled with prepaid access: – October 2010: The Office of Thrift Supervision (“OTS”) issued a Supervisory Directive to MetaBank directing it to end two of the consumer loan programs associated with its prepaid cards – refund anticipation loans and lines of credit. • The i-Advance program offered MetaBank card holders with a direct deposit feature an option to withdraw or spend funds when their account had insufficient funds, with the shortage to be covered by an advance deposit secured by their next direct deposit. The loans had a maximum term of 35 days and a transaction fee of $2.50 for each $20 increment of the advance.

– The OTS Directive said that MetaBank “engaged in unfair or deceptive acts or practices in violation of Section 5 of the Federal Trade Commission Act and the OTS Advertising Regulation in connection with the Bank’s operation of the i- Advance program.” • This directive delayed the NetSpend IPO. NetSpend marketed cards issued by MetaBank. • MetaBank later reported that compliance with the Supervisory Directive resulted in an after-tax loss of $3.4 million.

. Recent enforcement actions (cont.): – September 2012: The OCC entered into a consent agreement with Urban Trust Bank because it found “violations of law and regulations and unsafe and unsound banking practices” in connection with Urban Trust’s Partnership with CheckSmart, a payday lender, to offer lines of credit on prepaid cards. • The OCC was urged to act by the National Consumer Law Center (“NCLC”) in a letter dated May 2012 that urged the agency to stop Urban Trust from partnering with CheckSmart and Insight Card Services to facilitate payday loans on prepaid cards. • CheckSmart, a payday loan operator, used Insight prepaid cards issued by Urban Trust to offer lines of credit. The NCLC accused CheckSmart, Insight, and Urban Trust of using these cards to evade state payday lending laws that limit the annual percentage rate that can be charged on consumer loans.

– Under the terms of the consent agreement, Urban Trust agreed to additional supervision and monitoring by the OCC. • In February 2013, Urban Trust announced that it had stopped permitting its prepaid cards to be used by CheckSmart and it had removed all overdraft fees and credit features from its cards.

. Recent enforcement actions (cont.): – January 2014: Four Oaks Bank agreed to pay $1.2 million to settle claims brought by the Department of Justice (“DOJ”) as part of the DOJ’s new initiative, “Operation Choke Point,” which is aimed at curbing bank facilitation of online payday lending. • As part of this initiative, the DOJ is scrutinizing national, regional, and community banks to determine whether they, in exchange for fee revenue, partnered with online payday lenders who engage in illegal lending practices. • To date, the DOJ has issued subpoenas to more than 50 payment processors and the banks that do business with them as part of the new initiative. It plans to take criminal and civil action against more banks. • In the complaint filed January 8, 2014 DOJ officials accused Four Oaks of being “deliberately ignorant” that it was processing payments on behalf of payday lenders who fraudulently debited customers’ deposit accounts. • The consent order between Four Oaks and the DOJ stipulated that going forward, the bank must ensure that its third party payment processors do not engage in deceptive business practices.

– Rep. Darrell Issa (R-CA) has begun an investigation into Operation Choke Point and has accused the DOJ of trying to “eliminate legal financial services to which the department objects.”

. The overall growth in fees, and the cost they impose on the relatively small number of heavy overdraft users, have contributed to increased scrutiny of overdraft programs by regulators.

. In 2005, the FDIC, OCC, Federal Reserve Board (the “FRB”), and the National Credit Union Administration published “Joint Guidance on Overdraft Protection Programs,” which recommended changes to constituent institutions’ overdraft practices, including the following: • Alert customers before a transaction triggers any fees; • Clearly disclose program fees; • Clarify that fees count against the disclosed overdraft protection dollar limit; • Provide election or opt-out of service; • Consider daily fee limits to cap customers’ costs; and • Monitor client accounts for excessive overdraft protection program usage.

www.paulhastings.com ©2014 Paul Hastings LLP Confidential – not for redistribution OVERDRAFT – CURRENT REGULATORY LANDSCAPE (CONT.) . FRB regulations: . In May 2005 the FRB published amendments to Regulation DD (effective July 2006), which required institutions that promote overdraft services in an advertisement to disclose on periodic statements, total fees imposed for paying overdrafts and total fees imposed for returning items unpaid on periodic statements, both for the statement period and the calendar year to date, and to include certain other disclosures in advertisements of overdraft services. . In November 2009, the FRB amended Regulation E to address overdraft for automated teller machine (“ATM”) and point-of-sale debit transactions: – Beginning on July 1, 2010, (or August 15, 2010 for existing accountholders), institutions must obtain affirmative consent from consumers before providing fee-based overdraft coverage of ATM withdrawals and point-of-sale debit transactions. – A financial institution can still authorize ATM and point-of-sale transactions that result in a negative balance on an account for customers that have not opted in but cannot assess overdraft fees for paying these transactions. – Regulation E does not currently apply to GPR prepaid cards. – Regulation E generally applies to electronic fund transfers authorizing a financial institution to debit or credit a consumer’s account. • Currently the definition of “account” does not include GPR prepaid cards. – In August 2006, the FRB published a final rule amending Regulation E to address payroll card accounts, but did not include GPR prepaid cards. – In May 2012, the CFPB issued an Advanced Notice of Proposed Rulemaking, announcing that it intended to issue a rule to extend Regulation E (and by implication, the opt-in requirement for overdraft programs) to GPR prepaid cards. • The proposed rule is expected in May 2014.

. In November 2010, the FDIC issued guidance regarding overdraft fees. – This is currently the only extant supervisory guidance on overdraft fees and applies only to institutions that are under the purview of the FDIC. – Under the FDIC Guidance, financial institutions must take several steps regarding their overdraft accounts: • Promptly honor customers’ requests to decline coverage of overdrafts (i.e., opt-out) resulting from non-electronic transactions; • Give consumers the opportunity to affirmatively choose the overdraft payment product that overall best meets their needs; • Monitor accounts and take meaningful and effective action to limit use by customers as a form of short-term, high-cost credit, including, for example, giving customers who overdraw their accounts on more than six occasions where a fee is charged in a rolling twelve-month period a reasonable opportunity to choose a less costly alternative and decide whether to continue with fee-based overdraft coverage; • Institute appropriate daily limits on overdraft fees; and consider eliminating overdraft fees for transactions that overdraw an account by a de minimis amount; and • Not process transactions in a manner designed to maximize the cost to consumers.

. In June 2011, the OCC issued proposed guidance on “Deposit-Related Credit Products,” including overdraft protection. – The guidance describes several principles that the OCC expects its constituent banks to follow in connection with any deposit-related consumer credit product, and specifically automated overdraft protection programs and deposit advance products: • The guidance requires disclosure not only of the terms of the overdraft protection program offered but also of any alternative deposit-related credit products offered by the bank. Banks must also provide customers with clear disclosure about the order of processing transactions and how that order can affect the total amount of fees incurred. • The guidance urges banks to adopt an opt-in approach for all overdraft protection products, including checks, automated clearing house (“ACH”), and recurring debit transactions. • Pursuant to safety and soundness requirements, the guidance requires the bank to conduct sufficient analysis to ensure that the customer will be able to manage and repay the credit obligations arising from the product. • The guidance requires banks to adopt “prudent programmatic limitations” on the usage of overdraft protection in terms of the number of overdrafts and the total amount of fees that may be imposed per day and per month and any de minimis levels. – In April 2013, the OCC withdrew this proposed guidance in favor of new proposed guidance on deposit advance products. That guidance was subsequently finalized and issued in November 2013 in collaboration with the FDIC. www.paulhastings.com ©2014 Paul Hastings LLP Confidential – not for redistribution

OVERDRAFT – CURRENT REGULATORY LANDSCAPE (CONT.)

. The Durbin Amendments (“Durbin”) – Entitled “Reasonable Fees and Rules for Payment Card Transactions,” these are part of the Dodd- Frank Wall Street Reform and Consumer Protection Act of 2010. – Durbin restricts interchange fees for certain debit card issuers and limits the ability of networks and issuers to restrict debit card transaction routing. – In June 2011, the FRB issued a final rule to implement Durbin. • The final rule capped interchange fees for debit card transactions at 21 cents plus 5 basis points of the transaction value. • An additional 1 cent per transaction “fraud prevention adjustment” to the interchange fee is available to issuers who comply with certain standards outlined by the FRB. – The interchange fee limitations apply unless one of three specific exemptions is met: • Small issuer: exempts debit card issuers with total worldwide assets (including assets of affiliates) of less than $10 billion as of the end of the previous calendar year; – Full exemption (exception applies to general-use prepaid cards issued by a small issuer). – The term “issuer” for the purposes of this exemption is limited to “the person holding the asset account that is debited through an electronic debit transaction.” • Government programs: exempts debit card transactions made pursuant to a government- administered payment program, even if the administration of the program is outsourced to a private third-party contractor; or • Certain general-use prepaid cards (cont.)

. The Durbin Amendments (cont.) – general-use prepaid card exemption – To qualify, the card must meet the definition of a general-use prepaid card and also: • Must be reloadable; • Must not be marketed by any party as a gift card or gift certificate; and • May not access the cardholder’s separate account held by the issuer (other than a sub-account identified for accounting purposes). – To be considered reloadable, the cardholder terms and conditions must specify that reloading is permitted. – Further, this exemption applies only if the general-use prepaid card is the sole means of accessing the funds underlying the card for a payment transaction. • Any reloadable general-use prepaid card that might otherwise be exempt is subject to the interchange fee limitations if it allows consumers to access the funds by ACH, wire transfer, or check. . Finally, the exemption from the interchange fee limitations for general-use prepaid cards is not applicable if the issuer of such cards charges either: – An overdraft fee; or – A withdrawal fee on the first withdrawal in any given month at an ATM in the issuer’s designated ATM network.

• Products in the news: Remote Deposit Capture • October 2013: Ingo Money Announces Commercialization of its Mobile Remote Deposit Capture Service with Visa

• The recent regulatory guidance on advance deposit has led several national and regional banks to announce plans to discontinue offering advance deposit as an account feature.

• The CFPB is expected to issue a Proposed Rule on extending Regulation E to GPR prepaid cards in May 2014. This rule is expected to address overdraft protection programs and other credit features currently available to GPR prepaid card holders. • Several sources have reported that the Proposed Rule will cover prepaid products beyond GPR prepaid cards, even though the Advance Notice of Proposed Rulemaking was limited to GPR.