Content Detail

• Content META

  Title	Financial Regulatory Roundup- December 2024 prev next
  ID	5208739
  External ID	7400981371
  Author	Unknown
  Published Date	Dec. 18, 2024, 7:05 a.m.
  Summary	TABLE OF CONTENTS: CFPB Finalizes Rule to Bring Larger Payment Providers Under Federal Supervision Federal Reserve Vice Chair Michael Barr Signals Hold on Basel III Endgame SEC Division of Examinat
  Tags	None
  URL	https://www.lexology.com/library/detail.aspx?g=b2a2224c-86ae-4c7b-92f2-6db2920ddd89
  Sentiment	Negative: 0.05439    Neutral: 0.90618    Positive: 0.03943
  Relevance	0.00398

• Content Details

  Content ID	3139472
  Key	82e2c889-aa39-4063-9271-aedb437dbe29
  Content	TABLE OF CONTENTS: CFPB Finalizes Rule to Bring Larger Payment Providers Under Federal Supervision Federal Reserve Vice Chair Michael Barr Signals Hold on Basel III Endgame SEC Division of Examinations Announces 2025 Priorities NYDFS Releases Cybersecurity Advisory Industry Letter on Threats Posed by Remote Technology Workers With Ties to North Korea CFPB Finalizes Rule to Bring Larger Payment Providers Under Federal Supervision On Nov. 21, 2024, the Consumer Financial Protection Bureau ("CFPB") released its final rule establishing supervisory authority over large nonbank entities offering general-use digital consumer payment applications, such as digital wallets, payment applications and peer-to-peer payment systems. The rule targets nonbank companies facilitating transactions for personal, household or family purposes. It excludes, however, transactions in digital assets (such as cryptocurrencies and stablecoins), commercial payments between businesses and certain donation-focused platforms. The rule sets a two-pronged test for determining "larger-participant" status: 1. Volume: Companies processing at least $50 million in U.S.-denominated consumer payment transactions annually meet the threshold for supervision. This threshold is a significant increase from the initially proposed $5 million in U.S.-denominated transactions. 2. Small Business Exclusion: Entities qualifying as small businesses under U.S. Small Business Administration standards are excluded. The CFPB shifted its focus from consumers' physical location during transactions to their residency, aligning with industry comments. Excluded from the rule are marketplaces conducting payments through their own platforms and merchants embedding payment buttons on their checkout pages. Nevertheless, associated payment applications remain subject to the rule. In the preamble to its final rule, the CFPB estimates that seven nonbank firms, which are responsible for approximately 98 percent of the $13.5 billion annual consumer payment transactions, will fall under its supervision. These companies will be subject to: Examinations: Regular reviews for compliance with federal consumer protection laws, including safeguards against unfair, deceptive or abusive acts and practices ("UDAAP"), privacy violations, errors, fraud and debanking risks. Regular reviews for compliance with federal consumer protection laws, including safeguards against unfair, deceptive or abusive acts and practices ("UDAAP"), privacy violations, errors, fraud and debanking risks. Data Requests: Obligations to provide records, documents and compliance information, even outside formal examinations. Companies notified of supervisory action can dispute their classification as larger participants by submitting evidence and written arguments. As a significant shift from the proposed rule, the CFPB excluded digital-asset transactions, such as those involving cryptocurrencies and stablecoins, from the scope of "consumer payment transactions." While this decision removes immediate CFPB oversight of digital assets, the agency signaled plans to gather data and potentially regulate these markets in the future, particularly as the regulatory landscape evolves. The rule does not introduce new consumer protection requirements but extends the CFPB's ability to oversee compliance in a growing digital payment market. Nonbank firms remain subject to the CFPB's regulatory and enforcement powers regardless of whether they are "larger participants." Read the Final Rule here. Federal Reserve Vice Chair Michael Barr Signals Hold on Basel III Endgame The House Financial Services Committee held an oversight hearing on Nov. 20, which included testimony from Federal Reserve Vice Chair for Supervision Michael Barr, Acting Comptroller of the Currency Michael Hsu, FDIC Chairman Marty Gruenberg and NCUA Chairman Todd Harper. The hearing covered regulatory and supervisory matters, with a focus on delays in implementing significant proposals until new leadership is in place at the OCC and FDIC. Vice Chair Barr stated that the Federal Reserve would defer action on the so-called Basel III Endgame proposal, in addition to bank liquidity and long-term debt requirements until the arrival of the Trump administration. However, Barr affirmed that routine activities of the Federal Reserve would continue. Acting Comptroller Hsu also indicated that the OCC would pause actions on similar proposals for the remainder of the Biden administration. FDIC Chairman Gruenberg noted that several rulemakings, including corporate governance guidelines and brokered deposits proposals, would not see progress before the arrival of the Trump administration. Whether any of the outstanding federal bank regulatory proposals move forward in their current state under the Trump administration remains to be seen, however, industry doubt abounds. Watch the Hearing here. SEC Division of Examinations Announces 2025 Priorities On Oct. 21, 2024, the Division of Examinations (the "Division") of the Securities and Exchange Commission (the "SEC") released its 2025 examination priorities. The Division's examination priorities are released annually and are intended to inform investors and registrants of potential risks in the U.S. capital markets and to make them aware of the examination topics that the Division plans to focus on in the upcoming fiscal year. For fiscal year 2025, examinations will prioritize perennial and emerging risk areas, such as fiduciary duty, standards of conduct, cybersecurity and artificial intelligence. As it concerns investment advisers, the Division will focus on fiduciary duties and compliance programs, ensuring that investments are aligned with the best interests of clients and that effective compliance policies are in place to mitigate conflicts of interest. Additionally, private fund advisers will be examined for their disclosure practices, fee calculations and compliance with new Form PF and marketing rules. The 2025 examination priorities cover a broad landscape of potential risks to investors that firms should consider as they review and strengthen their compliance programs. Read the Report here. NYDFS Releases Cybersecurity Advisory Industry Letter on Threats Posed by Remote Technology Workers with Ties to North Korea On Nov. 1, 2024, New York Department of Financial Services ("NYDFS") released a cybersecurity advisory industry letter (the "Industry Letter") to all NYDFS regulated entities regarding any remote technology-related positions for which they may be hiring. The Industry Letter explains background information on combating activity of "threat actors"-- individuals who work to insert themselves within American businesses and illicitly aid North Korea. Similar advisories have been issued by the Federal Bureau of Investigations and the United States Department of State. Specifically, the Industry Letter provides information on "common methods used by threat actors and how to identify applicants and employees who may have ties to a foreign threat actor" and recommended steps companies should take to protect against these threats meant to generate revenue for North Korea. Recently, the industry has seen an increase in reports of threats originating from North Korea. Specifically, there were repeated attempts by threat actors to apply for remote Information Technology positions at U.S. companies "to access company systems and illicitly generate revenue for North Korea." Regulated entities should be aware of several tactics North Korean threat actors use to obtain employment with U.S. companies: Use of virtual private networks ("VPN") "to appear as though they originate from and reside in U.S.-based locations when applying for [remote] positions." "Prior to commencing employment, a threat actor may ask for company devices to be shipped to an alternative location, where the device may be accessed by a U.S.based co-conspirator." "Declining to participate in any in-person or video conferences, opting instead to communicate via messaging or phone." "Downloading remote access protocols to remotely access work device and ultimately the targeted systems." The Industry Letter urges companies to exercise diligence to protect information systems and nonpublic information by taking affirmative measures: Raise awareness with executives and management, information security personnel, HR and third-party services providers by disseminating information about the rise in threats. Companies should assess whether personnel would benefit from a targeted training about this threat. Companies should conduct stringent background checks and identity verification procedures during the hiring process: "Require more than just one official government document to verify identity, such as passports and national IDs." "Scrutinize social media accounts carefully." "Confirm applicants' physical and IP address locations." "Detect VPN and proxy server usage at all times, but especially during the interview process." "Verify employment references." "Review applicant's phone number for the use of Voice over Internet Protocol ("VOIP") numbers." Companies should also consider technical controls to mitigate the risks of applicants and insider threats: "Tracking and geolocating corporate laptops and cell phones to ensure they are delivered and remain at the initially reported residence." "Flag as suspicious any change of address, use of mail forwarding or atypical working patterns." "Monitor and restrict suspicious IP address locations, unusual network traffic and any unapproved use of remote access tools." Regulated entities should narrowly limit remote employee system and data access, cautiously increase access levels over time and enhance monitoring of internet activity. In addition, regulated entities should consider whether employees should have the ability to install or use remote access tools. Depending on risk profile, the Industry Letter notes that engaging a cybersecurity vendor that specializes in detecting and monitoring threats could be beneficial. Lastly, the Industry Letter suggests investigating suspicions of remote worker schemes and report it to the FBI's Internet Crime Complaint Center. Regulated entities should ensure they are fulfilling NYDFS's reporting obligations under 23 NYCRR Section 500.17. Read the Industry Letter here.
  Content Reference URL	None

• Publisher

  Publisher Name	Lexology (#2656)
  Publisher URL	https://www.lexology.com/
  Description	None
  Trust Flow Score	30
  Citation Flow Score	48

• Data Source

  Data Source Name	Quantexa News (#5)
  Data Source Type	news
  Data Source URL	https://app.aylien.com/dashboard
  Description	Welcome to Quantexa News API — the most powerful way to aggregate, filter, and integrate global news data into your apps and models.
  Weight	10