As financial institutions look ahead to 2025, there are several important compliance updates to be aware of which affect areas like Section 1071 of the Equal Credit Opportunity Act (ECOA), artificial intelligence, FDIC signage, and the Bank Secrecy Act (BSA).
These updates will impact how institutions collect data, use technology, display signage, and handle reporting. In this blog, Pinion advisors break down the changes and share essential takeaways to help your institution stay on track and meet upcoming deadlines.
Updates to Section 1071 – Small Business Lending under the Equal Credit Opportunity Act (ECOA)
ECOA went into effect on August 29, 2023, with a different mandatory compliance date for each of the three tiers; however, following litigation, all deadlines were extended. Be prepared for the first approaching deadline of July 18, 2025, and note the following:
- Data collection prior to the mandatory compliance date is permitted beginning 12 months prior to your applicable compliance date.
- If you’re unable to determine the number of covered credit transactions originated for small businesses, which determines your tier and compliance date, you are permitted to use any reasonable method to estimate the originations.
- The Consumer Financial Protection Bureau (CFPB) intends to provide a 12-month grace period for the initial data submission.
- Be aware of the covered transactions for Home Mortgage Disclosure Act (HMDA). These reportable transactions are excluded from ECOA, even if you are not a HMDA reportable institution.
“Pay attention to what information is being collected and what it’s collected for (ex: HMDA vs. Section 1071 or Section 1071 vs. BSA for Beneficial Ownership),” says Heather Campbell, Pinion’s financial institutions advisor.
“Note that 1071 information must be collected directly from the applicant. It should not be an observation, and multiple attempts at collecting the data are not required.”
- Section 1071 loans are reported individually, even if an application includes multiple products/loans.
- A withdrawn application is considered incomplete for Section 1071 but is a denial for HMDA.
- An adverse action notice is not the same for Section 1071, and only 1071 codes can be used for denial reasons.
- Demographic information for each beneficial owner must be provided; however, no names are allowed. Use the Section 1071 unique identifier on the form.
- Loan officers can collect the required information but should not have access to review or maintain this information beyond collection.
See BCC’s Free Resources for additional information on Section 1071 applications.
Tips to Strengthen Artificial Intelligence (AI) Operations in Finance
“It’s essential to stay updated on how AI is utilized in your operations and create a clear AI governance framework, or “rule book” to guide its use,” says Pinion IT advisor, Melissa DeDonder.
“Make sure that regulatory obligations are being followed, such as those regarding Fair Lending, unfair, deceptive, or abusive acts or practices (UDAAP), Bank Secrecy Act (BSA), and privacy.”
Identify and document AI tools utilized and associated vendors and assess associated risk. Clearly communicate with your customers about AI usage and their rights to opt-out. This protects both your institution and your customers and is crucial for maintaining trust and transparency.
Moving forward, be prepared to explain your AI strategy in detail to your next examiner, including who makes the rules for the AI systems utilized, who can make changes to the rules, and how your institution validates the rules, inputs, and outputs.
A good resource on the use and challenges of utilizing AI is Forbes: The Rise of Artificial Intelligence In Finance.
FDIC Signage Updates
Updates have been made for FDIC signage, and you have until May 1, 2025, to adhere to the related policies and procedures. [Part 328.8(a)].
While the official gold FDIC signage is not changing, the placement [Part 328.3(b)] and digital sign and symbol have changed. The digital versions must be used on designated pages of your website[Part328.5(b)] such as the homepage, landing or login pages, and pages where the customer may transact with deposits. ATM and like devices that receive deposits for an insured depository institution must display the digital sign if the device is placed into service on May 1, 2025, or after.
New rules are also in place regarding the display of non-deposit signage in-person and digitally. [Part 328.5(g)(1). Be sure to continually and clearly display this signage, not just during certain times.
Check out the FDIC website for free signage and additional details on these updates.
Proposed Rulemaking for the Bank Secrecy Act (BSA)
The Bank Secrecy Act (BSA) name changed to the Anti-Money Laundering / Countering Financing of Terrorism (AML/CFT), and while some agencies have adopted the change, others still refer to it as the Bank Secrecy Act / Anti-Money Laundering (BSA/AML). See the interagency statement on proposed rulemaking and make note of the following:
- Look for the following words within your policies, determine if they are being used correctly, and ensure your institution follows through on doing what it says.
- “Must” or “will” – these words should only be used if it is a regulatory requirement or if your board has decided it is required.
- “Should” – this word implies an expectation.
- “Could” or “may” – these words imply a best practice, and examples of instances or scenarios could be added into your procedures.
- Keep up to date with the various FinCEN Enforcement Actions, Red Flags, Alerts, and Advisories and consider utilizing in your training tools.
- FinCEN’s Eight National Priorities have not been finalized; however, it is important to monitor the priorities, incorporate them into your risk assessment and Board BSA reports and programs, and keep compliance aware of updates.
- Update your BSA Risk Assessment to tell your institution’s story and make it a living document.
- Have a contingency plan in place for the succession and/or back up of your BSA compliance officer.
- Beneficial ownership rules have not changed for banks- keep doing what you’re doing.
- Remind your customers about Beneficial Ownership Information reporting requirements and direct them to FinCEN’s Small Business Resources page.
Regulatory compliance includes several aspects but is an important part of the success of your institution. Reach out to a Pinion advisor with any questions or for assistance navigating these changes.
