Best Practices in Vendor Management Mortgage Servicer and Subservicer Oversight. Scott D. Samlin, Partner

Transcription

1 Best Practices in Vendor Management Mortgage Servicer and Subservicer Oversight Scott D. Samlin, Partner November 29, 2017

2 Presenter Scott Samlin is a partner in the Financial Services Practice Group and leader of the Consumer Financial Services and Bank Regulatory Practice of Pepper Hamilton LLP, resident in New York. Mr. Samlin s practice focuses on representing financial institutions, corporations and other entities in mortgage banking and consumer financial services issues. He regularly counsels clients on compliance with state and federal laws affecting mortgage lending and servicing activities, including the Real Estate Settlement Procedures Act (RESPA), Truth in Lending Act (TILA), Equal Credit Opportunity Act (ECOA) and Fair Debt Collection Practices Act (FDCPA). Mr. Samlin is experienced in myriad consumer lending, servicing and mortgage compliance challenges. Prior to Pepper, Mr. Samlin was the former executive director and compliance counsel for the residential mortgage and lending businesses at Morgan Stanley, where he helped oversee the operations of Morgan s whole loan trading desk and its affiliated mortgage loan servicer, Saxon. Before this, he was the executive vice president, general counsel and chief compliance officer for EMC Mortgage, Bear Stearns s primary mortgage loan conduit and servicer. Mr. Samlin has additionally held several senior in-house positions at large corporations, including vice president and assistant general counsel at Superior Bank FSB; vice president, senior staff attorney and compliance officer at Carteret Federal Savings Bank; and assistant counsel at the New York State Banking Department. Mr. Samlin is a nationally recognized speaker on banking, regulatory compliance and securitization/secondary market issues.

3 Introduction Regulator guidance regarding third-party oversight is: (1) numerous, and (2) substantially similar Effective risk assessment is the first expectation for an effective oversight program irrespective of regulator No agency guidance focuses exclusively on the Vendor contract or required Reprensentation and Warranties Federal banking agency guidance distinguishes between the outsourcing of operations, and use of a third party to offer products and services the bank does not originate An effective oversight program should have the following attributes: Structure Execution Policy-Driven Risk-Based Comprehensive Meaningful Responsive Dynamic

4 Relevant Guidance OCC Bulletin (Risk Management Guidance Third-Party Relationships) - Supplemental Examination Procedures for Risk Management of Third- Party Relationships OCC Bulletin (Supplemental Examination Procedures for Risk Management of Third-Party Relationships) OCC Bulletin (Frequently Asked Questions for Risk Management of Third-Party Relationships) FDIC: FIL (Third-Party Risk) - Proposed Examination Guidance for Third-Party Lending - Winter 2015 Supervisory Highlights Marketplace Lending FRB: Guidance on Managing Outsourcing Risks CFPB Bulletin (Service Providers)

5 OCC Guidance OCC Bulletin replaced OCC Bulletin Bulletin places greater emphasis on the bank s third-party oversight program, and sets expectations for the board and senior management National banks are expected to identify any relationships involving critical activities as defined in Bulletin relationships involving such activities must be approved by the board and are subject to heightened expectations for ongoing monitoring Bulletin provides robust guidance regarding enterprise-wide risk management, including with respect to issue escalation (to the board if necessary) and the termination of relationships The need to reassess the continued effectiveness of particular relationships and the third-party oversight program itself is stressed throughout

6 OCC Guidance OCC Bulletin Risk Management Life Cycle

7 OCC Guidance (continued) OCC Bulletin (Supplemental Examination Procedures for Risk Management of Third-Party Relationships) was issued in January 2017 Speaks to relationships with FINTECH companies Implements Bulletin by identifying specific practices that should exist at every bank regardless of size, including: methodologies for assigning a risk ranking to every third-party relationships ongoing monitoring that addresses specified minimum risk factors processes for holding applicable bank employees personally accountable for identified material weaknesses in third-party oversight reviews of online activity, publicity, public reports and social media for adverse events involving third parties or their subcontractors.

8 OCC Guidance (continued) OCC Bulletin ( (Frequently Asked Questions to Supplement Bulletin ) was issued in June 2017 Consists of fourteen (14) questions and answers, many of which address relationships with Fintech companies FAQ 7 clarifies that a relationship is not critical merely because a Fintech is involved No matter where accountability resides, each applicable business line can provide valuable input into the third-party risk management process, for example, by completing risk assessments, reviewing due diligence questionnaires and documents, and evaluating the controls over the third-party relationship. Personnel in control functions such as audit, risk management, and compliance programs should be involved in the management of third-party relationships. FAQ 3.

9 FDIC Guidance FIL is substantially similar to OCC Bulletin but is neither as robust nor as prescriptive The board should initially approve, oversee, and review at least annually significant third-party arrangements, and review these arrangements and written agreements whenever there is a material change to the program. The risk management process includes four key elements: 1. Risk Assessment 2. Due Diligence 3. Contract Structure and Review 4. Oversight

10 Federal Reserve Guidance The Federal Reserve s Guidance on Managing Outsourcing Risk was last updated in December 2013 about a month and a half after OCC Bulletin was issued This Guidance highlights concentration risk, which arises when outsourced services are provided by a limited number of service providers or are concentrated in limited geographic locations The Guidance takes into account the size of the institution: a community bank s risk management program may be simpler and use less elements and considerations than what is expected at a larger bank.

11 CFPB Guidance CFPB Bulletin is barely over five pages long and addresses service providers A service provider is defined in Section 1002(26) of the Dodd- Frank Act as: any person that provides a material service to a covered person in connection with the offering or provision by such covered person of a consumer financial product or service.

12 CFPB Guidance CFPB Bulletin was originally issued as Bulletin and was revised in order to clarify that: [T]he depth and formality of the risk management program for service providers may vary depending upon the service being performed its size, scope, complexity, importance and potential for consumer harm - and the performance of the service provider in carrying out its activities in compliance with Federal consumer financial laws and regulations.

13 Consequences of Ineffective Oversight Enforcement actions concerning sales of add-on credit card products resulted in enormous customer restitution and civil penalties: CFPB Orders Bank of America to Pay $727 Million in consumer relief for illegal credit card practices (April 2014) Citibank to pay $700 Million in consumer relief for illegal credit card Practices (July 2015) CFPB Orders JPMorgan Chase to pay $309 million refund for illegal credit card practices (September 2013) Federal Deposit Insurance Corporation and Consumer Financial Protection Bureau Order Discover to Pay $200 million refund for Deceptive Marketing (September 2012) CFPB Probe into Capital One credit card marketing results in $140 million refund (2012)

14 Ø Effective Contract Management. What should the process be for vetting/solicializing contracts involving the significant outsourcing of services? Is feedback solicited from all interested stakeholders to ensure appropriate oversight/audit rights exist? Does the vendor oversight team understand the details of the contract well enough to ensure close ongoing monitoring will exist for all important requirements? How do you get comfortable without knowing what s in the black box for fintech providers? Ø Applicable Laws. Should service providers be contractually responsible for legal compliance? For example, what if the contract involves a third-party operating platform for a consumer loan program (e.g. FDR or TYSYS)? Is the answer the same if the contract involves third-party loan servicer? To what extent should the bank or lender place reliance on the service provider s compliance efforts (e.g. the provider has specialized expertise that the bank or lender is lacking)? Ø Oversight Responsibility. Who within the bank or lender s should be primarily responsible for vendor oversight? Should it be the first line of defense? Should it be a separate vendor management group? Should the people who are responsible for managing the vendor be the same persons who have day-to-day responsibility for the service being outsourced? Ø Subcontractors. To what extent, and in what manner, should banks or lenders oversee a service provider s use of subcontractors? Should subcontracting always be subject to prior approval by the bank or lender? Are expectations different if the function in question is critical versus non-critical in nature?

15 Top 10 Draft MSA Define Critical Vendors and Criteria Risk Assessments Material Litigation Definition CFPB Complaint Portal BBB Websites Financials Cyber Security and Insurance-Additional Insured Disaster Recovery-Business Continuity SOC Testing Multi-Discipline Audit Team of Legal, Compliance, IT, Financial and Business Unit + Procurement/Vendor Management

16 Mortgage Servicer Oversight FDCPA + Pay By Phone Fees Successors in Interest Periodic Statement Requirements Definition of Delinquency Information Requests Early Intervention Payment Processing Force-Placed Insurance Loss Mitigation Procedures (including transfers of servicing) Small Servicers