 |
 |
 |
 |
 |
|
National Credit Union Administration (NCUA) Vice Chairman Rodney E. Hood participated in a Small Credit Union Workshop hosted by the National Credit Union Administration’s Office of Small Credit Union Initiatives in Charlotte, NC. This forum served as an opportunity for a frank discussion about current issues and challenges facing small credit unions and the impact of credit unions on the communities they serve.
FinCEN has issued a SAR Activity Review report for financial institutions to use. Click to read the ”“SAR Activity Review: Trends, Tips and Issues Update.”
FINANCIAL MARKET PREPAREDNESS Significant Progress Has Been Made, but Pandemic Planning and Other Challenges Remain Highlights of GAO-07-399, a report to congressional requesters This is GAO’s third report since the September 11 terrorist attacks that assesses progress that market participants and regulators have made to ensure the security and resiliency of our securities markets. This report examined (1) actions taken to improve the markets’ capabilities to prevent and recover from attacks; (2) actions taken to improve disaster response and increase telecommunications resiliency; and (3) financial regulators’ efforts to ensure market resiliency. GAO inspected physical and electronic security measures and business continuity capabilities using regulatory, government, and industry-established criteria and discussed improvement efforts with broker dealers, banks, regulators, telecommunications carriers, and trade associations. What GAO Recommends To improve the readiness of the securities markets to withstand potential disease pandemics, securities and banking regulators should consider taking additional actions, including providing formal expectations that market participants’ plans address even severe pandemic outbreaks and setting a date by which such plans should be completed. Banking and securities regulators indicated they believe organizations are adequately addressing this risk, but will consider taking the recommended actions if progress lags. GAO believes that giving greater consideration now would better assure market readiness.
The Financial Crimes Enforcement Network (FinCEN) today filed a Federal Register notice announcing the delayed implementation of certain revised Suspicious Activity Report (SAR) forms that were scheduled to become effective on June 30, 2007. The agency is withdrawing this effective date for the revised SAR forms for depository institutions, casinos and card clubs, insurance companies, and the securities and futures industries. FinCEN will establish new effective and mandatory compliance dates for these revised forms in a future notice. The delay does not impact ongoing suspicious activity reporting, which will continue using the current forms.
NCUA proposes to amend its regulations to address a federally-insured credit union’s obligation to maintain a records preservation program. The proposed rule draws from existing guidance to clarify requirements for preserving vital records and to suggest important items for consideration in restoring vital member services. NCUA believes the revised language and new appendix will facilitate the recovery of essential operations after a catastrophic act resulting in continued member confidence in the credit union system. The agency also proposes to amend its regulations to clarify the meaning of catastrophic act.
Because of the integration of voice and data in a single network, establishing a secure VOIP and data network is a complex process that requires greater effort than that required for data-only networks. In particular, start with these general guidelines, recognizing that practical considerations, such as cost or legal requirements, may require adjustments for the organization: 1. Develop appropriate network architecture. • Separate voice and data on logically different networks if feasible. Different subnets with separate RFC 1918 address blocks should be used for voice and data traffic, with separate DHCP servers for each, to ease the incorporation of intrusion detection and VOIP firewall protection
The government’s interest in using technology to detect terrorism and other threats has led to increased use of data mining. A technique for extracting useful information from large volumes of data, data mining offers potential benefits but also raises privacy concerns when the data include personal information. GAO was asked to review the development by the Department of Homeland Security (DHS) of a data mining tool known as ADVISE (Analysis, Dissemination, Visualization, Insight, and Semantic Enhancement). Specifically, GAO was asked to determine (1) the tool’s planned capabilities, uses, and associated benefits and (2) whether potential privacy issues could arise from using it to process personal information and how DHS has addressed any such issues. GAO reviewed program documentation and discussed these issues with DHS officials.
The Financial Crimes Enforcement Network (FinCEN) and the federal banking agencies announced Thursday that the format for the Suspicious Activity Report by Depository Institutions (SAR-DI) has been revised to support a new joint filing initiative, which will reduce the number of duplicate SARs filed for a single suspicious transaction. The revisions are the result of a joint effort by FinCEN and the federal banking agencies.
Kmart Corporation has agreed to settle Federal Trade Commission charges that it engaged in deceptive practices in advertising and selling its Kmart gift card. As part of the settlement, Kmart will implement a refund program and publicize it on its Web site. This is the agency’s first law enforcement action involving gift cards. “Consumers have a right to know when gift cards come with strings attached,” FTC Chairman Deborah Platt Majoras said. “If fees or restrictions apply, gift card issuers must fully and clearly disclose them.”
National Credit Union Administration (NCUA) JoAnn Johnson has issued a Letter to Credit Unions regarding the upcoming change in schedule for Daylight Savings Time (DST), which in the United States will begin three weeks earlier and end one week later than in previous years. Credit unions may be exposed to a variety of risks if they do not prepare their systems to reflect this change. The Letter to Credit Unions recommends that credit union management should consider the following actions to ensure readiness for the new start of DST...
This Letter to Credit Unions reminds credit unions of the upcoming change in the schedule for Daylight Saving Time (DST). DST in the United States will begin three weeks earlier and end one week later than in previous years. Credit unions may be exposed to a variety of risks if they do not prepare their systems to reflect this change. BACKGROUND
Hurricanes Katrina and Rita destroyed homes and displaced millions of individuals. While federal and state governments continue to respond to this disaster, GAO has identified significant control weaknesses-specifically in the Federal Emergency Management Agency (FEMA)'s Individuals and Households Program (IHP) and in Department of Homeland Security (DHS)'s purchase card program—resulting in significant fraud, waste, and abuse. In response to the numerous recommendations GAO made, DHS and FEMA have reported on numerous actions taken to address our recommendations. Lessons learned from GAO's prior work can serve as a framework for an effective fraud prevention system for federal and state governments as they consider spending billions more on disaster recovery. These lessons are particularly important because funding that is lost to fraud, waste, and abuse reduces the amount of money that could be delivered to victims in need.
The Federal Reserve Board on Friday approved changes to its Policy on Payments System Risk that revise the Board's expectations for systemically important payments and settlement systems subject to its authority and update and clarify the policy with regard to central counterparties. Under the revised policy, systemically important payments and settlement systems subject to the Board's authority are expected to complete and disclose publicly self-assessments against the principles and minimum standards in the policy. The self-assessment should be reviewed and approved by the system's senior management and board of directors upon completion and made readily available to the public. In addition, a self-assessment should be updated following material changes to the system or its environment and, at a minimum, reviewed by the system every two years.
As use of the Internet continues to expand, more credit unions are using it to offer products and services or otherwise enhance communications with members. The Internet offers the potential for safe, convenient new ways to shop for financial services and conduct credit union business, any day, any time. However, members need to make good on-line choices—decisions that may help avoid costly surprises or scams.
The Agencies are adopting an Interagency Statement on Sound Practices Concerning Elevated Risk Complex Structured Finance Activities ("Final Statement"). The Final Statement pertains to national banks, state banks, bank holding companies (other than foreign banks), federal and state savings associations, savings and loan holding companies, U.S. branches and agencies of foreign banks, and SEC-registered broker-dealers and investment advisers (collectively, "financial institutions" or ("institutions") engaged in complex structured finance transactions ("CSFTs"). In May 2004, the Agencies issued and requested comment on a proposed interagency statement ("Initial Proposed Statement"). After reviewing the comments received on the Initial Proposed Statement, the Agencies in May 2006 issued and requested comment on a revised proposed interagency statement ("Revised Proposed Statement").
Unauthorized access to sensitive customer information threatens to undermine customer confidence and the reputations of both individual financial institutions and the financial services industry. This threat is aggravated by the patchwork of state laws and federal regulations that govern unauthorized access or breach response incidents. Despite these challenges, financial institutions are strengthening data security programs and developing or improving customer notification programs. The “BITS/ABA Key Considerations for Responding to Unauthorized Access to Sensitive Customer Information” is a tool that may assist some financial institutions in developing and executing response programs when sensitive information is accessed and misused by unauthorized individuals.
This BITS Consumer Confidence Toolkit provides information to support consumer confidence in the safety, soundness and security of financial services. Originally published in September 2005, this is a revised and updated edition. This is intended to be an educational resource—whether for use by consumers, policy makers, financial institutions or others with interest in the subject matter. Special attention is placed on information security as well as online financial services transacted through the Internet. Data in support of the safety of online financial transactions is provided. Information about the proactive leadership of the financial services industry is included, as well as a description of the current environment and tips for consumers to help protect their financial security, including in the online environment. Recommendations for government agencies are also provided.
Why GAO Did This Study
This Regulatory Alert is to inform you about revisions to Part 748 of the NCUA Rules and Regulations. The revised rule describes in greater detail Suspicious Activity Report (SAR) reporting and filing requirements. The rule became effective November 27, 2006. There are six changes to Part 748 which are summarized below. 1. Notification to board of directors
Computer security incident response has become an important component of information technology (IT) programs. Security-related threats have become not only more numerous and diverse but also more damaging and disruptive. New types of security-related incidents emerge frequently. Preventative activities based on the results of risk assessments can lower the number of incidents, but not all incidents can be prevented. An incident response capability is therefore necessary for rapidly detecting incidents, minimizing loss and destruction, mitigating the weaknesses that were exploited, and restoring computing services. To that end, this publication provides guidelines for incident handling, particularly for analyzing incident-related data and determining the appropriate response to each incident. The guidelines can be followed independently of particular hardware platforms, operating systems, protocols, or applications.
Why GAO Did This Study
Today's testimony will address whether FEMA provided improper and potentially fraudulent (1) rental assistance payments to registrants at the same time it was providing free housing via trailers and apartments; (2) duplicate assistance payments to individuals who claimed damages to the same property for both hurricanes Katrina and Rita; and (3) IHP payments to non-U.S. residents who did not qualify for IHP. This testimony will also discuss (1) the importance of fraud identification and prevention, and (2) the results of our investigation into property FEMA bought using DHS purchase cards.
The Federal Reserve Board on Tuesday released a draft interagency notice of proposed rulemaking that would revise the existing risk-based capital framework by giving the vast majority of banks, bank holding companies, and savings associations the option of either continuing to use the existing Basel I-based capital rule or adopting a more risk sensitive rule, known as Basel IA. However, as proposed, Basel IA would not be available to large, complex international banking organizations subject to the proposed Basel II advanced capital framework. "Basel IA is intended as an option for the wide range of institutions that will not be adopting the advanced approaches of Basel II," said Governor Susan S. Bies. "The goal is to improve the Basel I standards by making them somewhat more risk sensitive while at the same time retaining a relatively simple and straightforward approach suitable for all but the largest and most complex institutions."
Every organization has a mission. In this digital era, as organizations use automated information technology (IT) systems1 to process their information for better support of their missions, risk management plays a critical role in protecting an organization's information assets, and therefore its mission, from IT-related risk. An effective risk management process is an important component of a successful IT security program. The principal goal of an organization's risk management process should be to protect the organization and its ability to perform their mission, not just its IT assets. Therefore, the risk management process should not be treated primarily as a technical function carried out by the IT experts who operate and manage the IT system, but as an essential management function of the organization.
NCUA is issuing a final rule to describe in greater detail the requirements for reporting and filing a Suspicious Activity Report (SAR) and to address prompt notification of the board of directors of SAR filings, the confidentiality of reports, and liability protection. NCUA also is changing the heading for this part so it more accurately describes its scope. NCUA seeks to enhance credit union compliance with SAR reporting requirements by providing greater detail in its rule on the thresholds and procedures for filing a SAR. DATES: This rule is effective [insert date 30 days after published in the FEDERAL REGISTER]. FOR FURTHER INFORMATION CONTACT: Linda K. Dent, Staff Attorney, Office of General Counsel, at (703) 518-6540.
Organizations have information technology (IT) plans in place, such as contingency and computer security incident response plans, so that they can respond to and manage adverse situations involving IT. These plans should be maintained in a state of readiness, which should include having personnel trained to fulfill their roles and responsibilities within a plan, having plans exercised to validate their content, and having systems and system components tested to ensure their operability in an operational environment specified in a plan. These three types of events can be carried out efficiently and effectively through the development and implementation of a test, training, and exercise (TT&E) program. Organizations should consider having such a program in place because tests, training, and exercises are so closely related. For example, exercises and tests offer different ways of identifying deficiencies in IT plans, procedures, and training. This document provides guidance on designing, developing, conducting, and evaluating TT&E events so that organizations can improve their ability to prepare for, respond to, manage, and recover from adverse events that may affect their missions. The scope of this document is limited to TT&E events for single organizations, as opposed to large-scale events involving multiple organizations, involving internal IT operational procedures for emergencies.
A log is a record of the events occurring within an organization’s systems and networks. Logs are composed of log entries; each entry contains information related to a specific event that has occurred within a system or network. Many logs within an organization contain records related to computer security. These computer security logs are generated by many sources, including security software, such as antivirus software, firewalls, and intrusion detection and prevention systems; operating systems on servers, workstations, and networking equipment; and applications. The number, volume, and variety of computer security logs have increased greatly, which has created the need for computer security log management—the process for generating, transmitting, storing, analyzing, and disposing of computer security log data. Log management is essential to ensuring that computer security records are stored in sufficient detail for an appropriate period of time. Routine log analysis is beneficial for identifying security incidents, policy violations, fraudulent activity, and operational problems.
Adequate security of information and information systems is a fundamental management responsibility. Nearly all applications that deal with financial, privacy, safety, or defense include some form of access control. Access control is concerned with determining the allowed activities of legitimate users, mediating every attempt by a user to access a resource in the system. In some systems, complete access is granted after successful authentication of the user, but most systems require more sophisticated and complex control. In addition to the authentication mechanism (such as a password), access control is concerned with how authorizations are structured. In some cases, authorization may mirror the structure of the organization, while in others it may be based on the sensitivity level of various documents and the clearance level of the user accessing those documents. This publication explains some of the commonly used access control services available in information technology systems.
Why GAO Did This Study In the wake of the 2005 hurricanes in the Gulf Region, GAO and the Department of Homeland Security Office of Inspector General (DHS OIG) initiated a number of audits and investigations addressing the federal government's response to those events. On July 19, 2006, GAO testified on the results of its purchase card work. This report summarizes the testimony and provides recommendations. Department of Homeland Security (DHS) cardholders made thousands of transactions related to hurricane relief operations. GAO analyzed transactions between June and November of 2005 to determine if (1) DHS's control environment and management of purchase card usage were effective; (2) DHS's key internal control activities operated effectively and provided reasonable assurance that purchase cards were used appropriately; and (3) potentially fraudulent, improper, and abusive purchase card activity existed at DHS.
Why GAO Did This Study In 2005, Hurricanes Katrina and Rita caused unprecedented damage. FEMA’s Individuals and Households Program (IHP), provides direct assistance (temporary housing units) and financial assistance (grant funding for temporary housing and other disaster-related needs) to eligible individuals affected by disasters. Our objectives were to (1) compare the types and amounts of IHP assistance provided to Hurricanes Katrina and Rita victims to other recent hurricanes, (2) describe the challenges FEMA faced by the magnitude of the requests for assistance following Hurricanes Katrina and Rita, and (3) determine the vulnerability of the IHP program to fraud and abuse. GAO determined the extent to which the program was vulnerability to fraud and abuse, by conducting statistical sampling, data mining and undercover operations.
1.1 Background Federal agencies and organizations cannot protect the integrity, confidentiality, and availability of information in today's highly networked systems environment without ensuring that each person involved understands their roles and responsibilities and is adequately trained to perform them. The human factor is so critical to success that the Computer Security Act of 1987 (Public Law [P.L.] 100-235) required that, "Each agency shall provide for the mandatory periodic training in computer security awareness and accepted computer practices of all employees who are involved with the management, use, or operation of each Federal computer system within or under the supervision of that agency." In accordance with P.L. 100-235, the National Institute of Standards and Technology (NIST), working with the U.S. Office of Personnel Management (OPM), was charged with developing and issuing guidelines for Federal computer security training. This requirement was satisfied by NIST's issuance of "Computer Security Training Guidelines" (Special Publication [SP] 500¬172) in November 1989. In January 1992, OPM issued a revision to the Federal personnel regulations which made these voluntary guidelines mandatory. This regulation, 5 CFR Part 930, is entitled "Employees Responsible for the Management or Use of Federal Computer Systems" and requires Federal agencies to provide training as set forth in NIST guidelines.
The mandatory dissemination of certain information by financial institutions is a key aspect of consumer protection law. It offers two significant advantages for consumer protection in the financial area over the alternative of direct government intervention into product pricing and content. First, information disclosure is compatible with competition, a significant market force already at work to protect consumers by keeping price rises in check. Because of competition, institutions already have incentives to make their products known, to reveal favorable pricing and product features, and to treat consumers fairly by keeping them generally informed about what they want and need to know. When a financial institution employs these strategies, it generates a good business reputation that will produce referrals and repeat customers. Actions that firms use to accomplish these goals include advertising their prices and supplying clients and potential customers with useful information about product prices and features. The requirements for disclosures assist in the dissemination of financial information by standardizing concepts and terminology, such as the finance charge and annual percentage rate under the Truth in Lending Act and the annual percentage yield under the Truth in Savings Act. Such standardization advances consumers; knowledge about pricing and features of the financial products and institutions and lowers consumers; transactions costs by making shopping easier. The standard format of required disclosures helps highlight the performance of the best institutions and exposes the inadequacies of the poorer ones. Well-informed shoppers help keep markets competitive, which benefits buyers of products and services by minimizing the spread between
producers’ production costs and market price.
NIST is pleased to announce the release of draft Special Publication 800-69, Guidance for Securing Microsoft Windows XP Home Edition: A NIST Security Configuration Checklist. SP 800-69 provides guidance to home users, such as telecommuting Federal employees, on improving the security of their home computers that run Windows XP Home Edition. Home computers face many threats from people wanting to cause mischief and disruption, commit fraud, and perform identity theft. The publication explains the need to use a combination of security protections, such as antivirus software, antispyware software, a personal firewall, limited user accounts, and automatic software updates, to secure a computer against threats and maintain its security. It also emphasizes the importance of performing regular backups to ensure that user data is available after an adverse event such as an attack against the computer, a hardware failure, or human error. The publication contains detailed step-by-step directions for securing Windows XP Home Edition computers that can be performed by experienced Windows XP Home Edition users. NIST requests comments on NIST SP 800-69 by August 31, 2006. Please submit comments to itsec@nist.gov with "Comments SP800-69/XPHome" in the subject line.
THE NEED FOR SECURITY CONTROLS TO PROTECT INFORMATION SYSTEMS The selection and employment of appropriate security controls for an information system are important tasks that can have major implications on the operations and assets of an IT organization as well as the welfare of individuals. Security controls are the management, operational, and technical safeguards or countermeasures prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information. There are several important questions that should be answered by organizational officials when addressing the security considerations for their information systems: - What security controls are needed to adequately protect the information systems that support the operations and assets of the organization in order for that organization to accomplish its assigned mission, protect its assets, fulfill its legal responsibilities, maintain its day-to-day functions, and protect individuals?
The Federal Financial Institutions Examination Council (FFIEC) today released the revised Bank Secrecy Act/Anti-Money Laundering (BSA/AML) Examination Manual (manual). The revised manual reflects the ongoing commitment of the federal banking agencies and the Financial Crimes Enforcement Network (FinCEN) to provide current and consistent guidance on risk-based policies, procedures, and processes for banking organizations to comply with the BSA and safeguard operations from money laundering and terrorist financing. The manual has been updated to further clarify supervisory expectations and incorporate regulatory changes since the manual's 2005 release. The revisions also draw upon feedback from the banking industry and examination staff.
The Federal Financial Institutions Examination Council today issued revised guidance for examiners and financial institutions to use in identifying information security risks and evaluating the adequacy of controls and applicable risk management practices of financial institutions. The Information Security Booklet is one of twelve that, in total, comprise the FFIEC IT Examination Handbook. In addition to the revised Information Security Booklet, the agencies also released an Executive Summary that contains high level synopses of each of the twelve booklets and describes the handbook development and maintenance processes. The security of financial institutions' systems and information is essential to maintaining the privacy of customer information and safe and sound operations. The Information Security Booklet describes how an institution should protect and secure the systems and facilities that process and maintain information. The booklet calls for financial institutions and technology service providers (TSPs) to maintain effective security programs tailored to the complexity of their operations.
Why GAO Did This Study Federal regulation is one of the basic tools of government used to implement public policy. In 1980, the Regulatory Flexibility Act (RFA) was enacted in response to concerns about the effect that regulations can have on small entities, including small businesses, small governmental jurisdictions, and certain small not-for-profit organizations. Congress amended RFA in 1996, and the President issued Executive Order 13272 in 2002, to strengthen requirements for agencies to consider the impact of their proposed rules on small entities. However, concerns about the regulatory burden on small entities persist, prompting legislative proposals such as H.R. 682, the Regulatory Flexibility Improvements Act, which would amend RFA. At the request of Congress, GAO has prepared many reports and testimonies reviewing the implementation of RFA and related policies. On the basis of that body of work, this testimony (1) provides an overview of the basic purpose and requirements of RFA, (2) highlights the main impediments to the Act’s implementation that GAO's reports identified, and (3) suggests elements of RFA that Congress might consider amending to improve the effectiveness of the Act. GAO's prior reports and testimonies contain recommendations to improve the implementation of RFA and related regulatory process requirements.
FinCEN's primary function is to support and strengthen domestic and international anti-money laundering efforts through coordination and partnerships. Since its creation in 1990, FinCEN has been responsible for overseeing the management, processing, storage and dissemination of Bank Secrecy Act (BSA) data. In 2004, FinCEN embarked on a major initiative intended to improve the sharing of information reported under the Bank Secrecy Act. BSA Direct is an umbrella project intended to provide secure, user-friendly, web-based tools for accessing, analyzing, and filing BSA data. It is part of a broad effort to reengineer data management responsibilities and transition them from the IRS. During the early spring of 2006, it became clear to FinCEN that the Retrieval and Sharing component of the BSA Direct project (BSA Direct R&S) was not going to meet the critical implementation deadline of June 30, 2006. Objectives Because FinCEN has experienced problems with development and implementation of the BSA Direct R&S, you asked us about the project's current status and to provide observations on FinCEN's IT investment management practices. Our objectives were to (1) describe BSA Direct R&S and the project's current status; (2) examine FinCEN's application of information technology (IT) investment management processes to the BSA Direct R&S project; and (3) describe, at a high level, the range of options FinCEN may consider as it reexamines the BSA Direct R&S project.
Before the U.S. House of Representatives Committee on Financial Services Subcommittee on Oversight and Investigations Thank you Chairwoman Kelly, Ranking Member Gutierrez, and Members of the Subcommittee. I appreciate the opportunity to speak to you about the Treasury Department's contribution to pandemic planning within the financial services sector. Though the Treasury's efforts are just a small part of the enormous Federal effort, we have been very active. President Bush stated, "Together we will confront this emerging threat and together, as Americans, we will be prepared to protect our families, our communities, this great Nation, and our world." I would like to begin my remarks by telling you about the sector's general state of preparedness and then tell you about the Treasury's leadership on pandemic planning within the financial services sector.
Please note that the following rule is the version that was approved by the NCUA Board. The official version is published in the Federal Register approximately one week after Board approval. There may be some minor numbering or format differences between the two versions. The proposed rule describes in greater detail the requirements for reporting and filing a Suspicious Activity Report (SAR) and addresses prompt notification of the board of directors of SAR filings, the confidentiality of reports, and liability protection. NCUA also proposes to change the heading for this part so it more accurately describes its scope. While retaining cross-references in the rule to the SAR form and instructions, these changes will enhance credit union compliance by providing greater detail in the rule on the thresholds and procedures for filing a SAR.
The Treasury Department in cooperation with the FloridaFIRST regional financial coalition will sponsor the first U.S. pandemic flu response exercise focused on the financial sector Thursday, June 22 in Miami, Fl. Treasury Deputy Assistant Secretary for Critical Infrastructure Protection and Compliance Policy Scott Parsons and will join 70 participants from Florida financial services firms and health, police and fire officials from local, state and federal agencies to test the local industry's preparedness for such a crisis.
The Federal Reserve Board announced Wednesday the consolidation of two internal advisory committees on payments system matters. The duties of the Payments System Policy Advisory Committee will be expanded to encompass the responsibilities and activities of the Payments System Development Committee, including its public outreach efforts. The Payments System Development Committee will be discontinued. The Payments System Policy Advisory Committee was formed in July 1986 to advise the Board on a range of issues, including risk-management issues, primarily in wholesale payment and settlement systems, and the relationship between wholesale payment systems and financial markets. The Payments System Development Committee was formed in July 1999 to advise on medium- and long-term public policy issues surrounding innovation in the retail payments system. The expanded Payments System Policy Advisory Committee will provide the Board with a coordinated view of developments in both wholesale and retail payments at a time of significant overall change in the U.S. payments system and help coordinate Federal Reserve work involving domestic and international payments and settlement systems.
The purpose of this risk alert is to emphasize to all federally insured credit unions the necessity of taking steps to prepare for the next potential disaster. Recent events have highlighted the importance for credit unions to perform ongoing reviews of their plans for disaster preparedness and response. These plans should be commensurate with a credit union’s complexity of operations and focus on minimizing interruptions of service to members and maintaining member confidence in times of emergency. Over the past year, we have accumulated many "lessons learned" in working through a major disaster. It is our intention that we build on these lessons and make long-term improvements in the area of disaster preparedness and response.
Federal regulators today released Evolution of a Prototype Financial Privacy Notice, a report by Kleimann Communication Group summarizing consumer research commissioned by the regulators as part of their ongoing efforts to develop improved financial privacy notices.
The report's release concludes the first phase of an interagency project by the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the Federal Trade Commission, the National Credit Union Administration, the Office of the Comptroller of the Currency, and the Securities and Exchange Commission to explore alternatives for financial privacy notices that would be easier for consumers to read, understand, and use than many of the notices consumers currently receive from financial institutions. These six agencies were among those that jointly issued regulations in 2000 implementing the financial privacy provisions of the Gramm-Leach-Bliley Act, but survey data indicate that many consumers neither read nor understand the notices financial institutions provide under those regulations.
An interagency notice of proposed rulemaking (NPR) that would implement Basel II risk-based capital requirements in the United States for large, internationally active banking organizations was made public Thursday by the Federal Reserve Board. The proposed rule would require the largest internationally active banks to enhance the measurement and management of their risks, including credit risk and operational risk. It also would require these banks to have rigorous processes for assessing overall capital adequacy in relation to their total risk profile and to publicly disclose information regarding their risk profile and capital adequacy.
"Given the increasing complexity of the activities at our largest banks, and the related risks of those activities, I fully support efforts to develop a more appropriately risk-sensitive capital framework for those institutions," said Board Chairman Ben S. Bernanke. "The current Basel I framework has become increasingly inadequate for capturing the risks at large, complex U.S. banking organizations."
The purpose of this Letter to Credit Unions (LTCU) is intended to raise awareness regarding the threat of a pandemic influenza outbreak and its potential impact on the delivery of critical financial services. It further advises credit unions and their service providers to consider this and similar threats in their event response and contingency strategies (business continuity and disaster recovery plans). This LTCU discusses the National Strategy for Pandemic Influenza (National Strategy) and the roles and responsibilities it outlines for financial institutions.
On November 1, 2005, the White House issued the National Strategy, which discusses the threat and potential impact of a pandemic influenza event. It also identifies the roles and responsibilities for the federal government, the private sector, and others.
The Federal Reserve and the other financial institutions regulatory agencies published on February 9, 2006, the attached Advisory to address safety and soundness concerns that may arise when financial institutions enter into external audit contracts (typically referred to as "engagement letters") that limit the auditors' liability for audit services. The Advisory informs financial institutions that it is unsafe and unsound to enter into engagement letters for audits of financial statements, audits of internal control over financial reporting, or attestations on management's assessment of internal control over financial reporting which include provisions that (1) indemnify the external auditor against all claims made by third parties, (2) hold harmless or release the external auditor from liability for claims or potential claims that might be asserted by the client financial institution (other than claims for punitive damages), or (3) limit the remedies available to the client financial institution (other than punitive damages).
The Federal Financial Institution Examinations Council (FFIEC) Task Force on Consumer Compliance has approved the attached revised Fair Credit Reporting Act (FCRA) examination procedures, which incorporate the new requirements created by the Fair and Accurate Credit Transactions Act of 2003 (FACT Act). The revised FCRA examination procedures have been reorganized into a new format in which similar requirements are grouped into modules for use in risk-focused compliance examinations. This modular format is also designed to assist financial institutions in organizing compliance programs and internal reviews. The revised procedures separate background information from the examination steps, contained in Appendix A. Appendix B lists the statutory and regulatory requirements in the order in which they are addressed in the examination procedures, according to a financial institution's primary federal regulator.
The federal financial regulatory agencies today announced the issuance of a final advisory that addresses safety and soundness concerns that may arise when financial institutions agree to limit their external auditors' liability. The agencies' primary concern is that limiting the liability of external auditors in engagement letters may reduce the reliability of audits. The Interagency Advisory on the Unsafe and Unsound Use of Limitation of Liability Provisions in External Audit Engagement Letters informs financial institutions that they should not enter into external audit engagement letters that incorporate unsafe and unsound limitation of liability provisions with respect to audits of financial statements and internal control over financial reporting.
The federal bank and thrift regulatory agencies today announced that they will be hosting a forum in New Orleans for banks and thrifts on March 2 and 3, 2006. The forum, titled “The Future of Banking on the Gulf Coast: Helping Banks and Thrifts Rebuild Communities,” will focus on the short-term and long-term challenges facing banks and thrifts operating in the areas affected by Hurricanes Katrina and Rita and on ways of helping meet the needs of the local communities. Principals from each of the four federal banking agencies will participate in the forum, which will convene at the New Orleans Marriott, 555 Canal Street, New Orleans, Louisiana, at 8:00 a.m. CST on Thursday, March 2, 2006, and close at noon on Friday, March 3, 2006. The FDIC and NeighborWorks of New Orleans will conduct optional bus tours of devastated areas nearby on the afternoons of Wednesday, March 1, and Friday, March 3.
For the security of any system to be strong, the system's owners must consider three fundamental security areas: management controls, operational controls, and technical controls. While technical controls, such as encryption, digital signatures, or firewalls, receive the most attention, inadequate operational controls and the day-to-day administration of technical controls often create the most vulnerabilities. Strong management controls are needed to tie all the aspects of security together into a sensible protection strategy. NIST Special Publication 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, helps organizations to improve their operational and management controls. This CSL Bulletin explains some of the needs which GSSPs can solve and presents a set of generally accepted system security principles developed by NIST.
Whatever direction the cyberthreat takes, the United States Government will be confronting an increasingly interconnected world in the years ahead. This is the core message of GT2015. We will have to develop, in response, greater communications and collaboration across the agencies of our own Government, with other governments, and with the corporate world. Interagency cooperation will be essential to understanding the cyberthreat, as well as other transnational threats that will crowd our agenda, and to responding effectively with interdisciplinary strategies. Consequence management of a major attack on a critical US infrastructure would involve virtually all agencies of the Federal Government, State, and local governments, foreign governments, law enforcement, the military, the medical community, and the media. NSTISSC and the Intelligence Community clearly have a lot of work to do if we are to understand this evolving threat and to be prepared to deal with it.
At the request of the Assistant to the President and Chief of Staff, we have prepared this memorandum to provide guidance for reviewing Government information regarding weapons of mass destruction, as well as other information that could be misused to harm the security of our nation or threaten public safety. It is appropriate that all federal departments and agencies consider the need to safeguard such information on an ongoing basis and also upon receipt of any request for records containing such information that is made under the Freedom of Information Act (FOIA), 5 U.S.C. § 552 (2000). Consistent with existing law and policy, the appropriate steps for safeguarding such information will vary according to the sensitivity of the information involved and whether the information currently is classified.
You are receiving this information because you have notified a consumer reporting agency that you believe that you are a victim of identity theft. Identity theft occurs when someone uses your name, Social Security number, date of birth, or other identifying information, without authority, to commit fraud. For example, someone may have committed identity theft by using your personal information to open a credit card account or get a loan in your name. For more information, visit www.consumer.gov/idtheft or write to: FTC, Consumer Response Center, Room 130-B, 600 Pennsylvania Avenue, N.W. Washington, D.C., 20580. The Fair Credit Reporting Act (FCRA) gives you specific rights when you are, or believe that you are, the victim of identity theft. Here is a brief summary of the rights designed to help you recover from identity theft.
Following a public comment period, the Federal Trade Commission has issued final summaries of identity theft and general consumer rights and revised furnisher and user notices under the Fair Credit Reporting Act (FCRA) and the Fair and Accurate Credit Transactions Act of 2003 (FACTA). Consumer reporting companies are required to notify consumers of their rights under FACTA and steps they can take to protect themselves against identity theft and difficulties resulting from identity theft.
The identity theft rights summary includes the major new identity theft rights granted to consumers by FACTA, including the right to place fraud alerts on their credit reports, to block businesses and credit bureaus from reporting information in their credit files that is a result of identity theft, and to obtain from businesses information about accounts or transactions in their name that result from identity theft. The identity theft rights summary will be provided by consumer reporting companies to consumers who contact the agencies because they believe they are victims of fraud or identity theft.
The Federal Trade Commission today said that provisions of the recently enacted Fair and Accurate Credit Transactions Act will help reduce identity theft and help victims recover. In testimony to the House Ways and Means Committee’s Subcommittee on Social Security, Howard Beales, Director of the FTC’s Bureau of Consumer Protection, said that many of the provisions will go into effect over the course of this year.
The testimony says one of the newly enacted provisions requires the three major credit reporting agencies to provide consumers with a free copy of their own credit report every 12 months. The requirement will become effective in December but will be phased in over nine months from West to East. The reports allow consumers to discover and correct errors in their credit records and to assure that accounts have not been fraudulently opened in their names.
On June 30, 2000, Congress enacted the Electronic Signatures in Global and National Commerce Act(1) ("ESIGN" or "the Act"), to facilitate the use of electronic records and signatures in interstate and foreign commerce by ensuring the validity and legal effect of contracts entered into electronically. Careful to preserve the underlying consumer protection laws governing consumers' rights to receive certain information in writing, Congress imposed special requirements on businesses that want to use electronic records or signatures in consumer transactions. Section 101(c)(1)(C)(ii) of the Act requires businesses to obtain from consumers electronic consent or confirmation to receive information electronically that a law requires to be in writing. The Act went into effect in October 2000.
The Check Clearing for the 21st Century Act (Check 21) was signed into law on October 28, 2003, and became effective on October 28, 2004. Check 21 is designed to foster innovation in the payments system and to enhance its efficiency by reducing some of the legal impediments to check truncation. The law facilitates check truncation by creating a new negotiable instrument called a substitute check, which permits banks to truncate original checks, to process check information electronically, and to deliver substitute checks to banks that want to continue receiving paper checks. A substitute check is the legal equivalent of the original check and includes all the information contained on the original check. The law does not require banks to accept checks in electronic form nor does it require banks to use the new authority granted by the Act to create substitute checks.
This bill, operative July 1, 2003, would require a state agency,
or a person or business that conducts business in California, that
owns or licenses computerized data that includes personal
information, as defined, to disclose in specified ways, any breach of
the security of the data, as defined, to any resident of California
whose unencrypted personal information was, or is reasonably
believed to have been, acquired by an unauthorized person. The bill
would permit the notifications required by its provisions to be
delayed if a law enforcement agency determines that it would impede a
criminal investigation. The bill would require an agency, person,
or business that maintains computerized data that includes personal
information owned by another to notify the owner or licensee of the
information of any breach of security of the data, as specified. The
bill would state the intent of the Legislature to preempt all local
regulation of the subject matter of the bill. This bill would also
make a statement of legislative findings and declarations regarding
privacy and financial security.
The Office of Inspector General (OIG) for the National Credit Union Administration (NCUA) engaged Cotton & Company LLP to conduct an independent evaluation of NCUA’s information systems (IS) and security program and controls for compliance with the Federal Information Security Management Act (FISMA), Title III of the E-Government Act of 2002.
The Office of Management & Budget (OMB) issued 2004 Guidance on Annual Information Technology Security Reports on August 23, 2004. This guidance provides clarification to agencies for implementing, meeting, and reporting FISMA requirements to OMB and the Congress. This report contains a summary of our evaluation of the NCUA’s information security program and is presented in the OMB prescribed format.
NCUA Annual Performance Budget 2005 I am pleased to present the National Credit Union Administration’s Annual Performance Budget 2005. You will notice that it is called a performance budget and not a plan. It was developed to serve as an element of budget development and reflects a greater correlation between our strategic and annual performance goals and resource allocation. This enhanced correlation is in support of the President Management Agenda Initiative #5 – Budget and Performance Integration.
The year 2004 has been a very productive year. NCUA Annual Performance Plan 2004 served to guide the agency’s efforts to achieve its performance goals and objectives in its regulatory and supervisory roles during the past year. The credit union industry’s performance validated these efforts with assets increasing $30.6 billion or 5.02%, net worth increasing $4.3 billion or 6.52%, shares increasing $22.8 billion or 4.31%, loans increasing $30.2 billion or 8.02% and delinquent loans as a percentage of total loans decreasing from 0.76% to 0.71% for a very productive year. As a result, NCUA’s priorities continue to stress providing proper training and tools for examiners, an optimal regulatory environment that balances innovation with safety and soundness, enhanced organizational effectiveness and efficiency, promoting access of financial services to all eligible residents and maintaining a responsible budget process.
The National Credit Union Administration (NCUA) has developed this guide to assist credit unions engaging in, or considering, e-Commerce activities. For the purposes of this guide, e-Commerce is defined as the electronic delivery of financial services via the Internet. NCUA does not expect all credit unions to offer e-Commerce. However, NCUA expects credit unions offering e-Commerce to do so in a safe and sound manner. This guide focuses on processes to assist credit unions in managing the risks related to e-Commerce in an environment of rapidly changing technology. Credit union management should use the information in this guide to assist with technology planning, contracting, delivery, and support of e-Commerce activities. This should be done within a framework designed to identify, quantify and, to the extent possible, reduce related technology risks.
Much of the information in this guide is derived from NCUA issuances such as Rules & Regulations and Letters to Credit Unions. Although this information is provided in summary format in the guide, the related issuances typically contain more detail on a particular subject and may contain additional checklists that can assist in evaluating performance in a given area. Please refer to Appendix A for a listing of NCUA reference information. These issuances, as well as additional guidance, can be found via the Information Systems and Technology link under the reference section of the NCUA website (http://www.ncua.gov)*. This site is updated frequently and can serve as a valuable resource.
This statement alerts the Board of Directors and management to some of the risks and concernsof retail on-line, personal computer banking (PC banking). Recently, the staff of the FFIECagencies organized a symposium to hear industry experts offer their thoughts and observations onthe development of retail on-line PC banking. Through this statement, the FFIEC agencies wishto impart many of the ideas discussed during the symposium to bankers and examiners. II.EXECUTIVE SUMMARY Financial institutions are beginning to utilize new technologies to offer innovative products andservices to their customers. On-line PC banking exemplifies an emerging delivery channel forretail banking services made possible by technology. One of the reasons for the rapid evolution ofPC banking involves the increased use of the Internet1. Regulatory agencies recognize that PCbanking offers opportunities for financial institutions to enhance customer relationships andimprove competitive positions. Before implementing a PC banking program, management should exercise sufficient due diligenceand develop comprehensive plans. Such due diligence would ordinarily include the followingactivities.
• Review the implications of PC banking on the institution's strategic plan;
TO:All Federally-Insured Credit Unions The purpose of this letter is to inform you of revised technology-related guidance provided to examiners and the credit union industry. Earlier this year, the Federal Financial Institutions Examination Council (FFIEC1) released the Information Security Booklet – a first in a series of booklets to revise the existing 1996 FFIEC Information Systems Examination Handbook. The revised Information Technology (IT) Examination Handbook will be composed of several booklets to address significant changes in technology since 1996 and incorporates a risk-based examination approachto each booklet.
The FFIEC agencies plan to issue additional booklets covering such topics as business continuity planning, technology service providers, electronic banking, audit, payment systems, outsourcing, management, computer operations, and systems development and acquisition.
This policy issuance alerts all financial institutions to the importance of strategic information systems planning and its role in overall corporate management and planning. It identifies management's responsibilities in preparing strategic plans for their information systems requirements.
This interagency statement alerts financial institutions to potential risks in contracting for EDP services and/or failing to properly account for certain contract provisions.
POLICY STATEMENT FOR THE REVIEW OF INFORMATION SYSTEM VENDORS
Weblinking:
Identifying Risks & Risk Management Techniques ENCL:
Weblinking Guidance The purpose of this letter is to assist
credit unions in identifying risks posed by the use of weblinks on
their websites and suggest a variety of risk management techniques to
mitigate these risks. A large number of credit unions maintain
sites on the World Wide Web. Virtually every website contains weblinks.
A weblink is a word, phrase, or image that contains coding that will
transport the viewer to a different part of the website or a completely
different website by clicking on it. While weblinks are a convenient
and accepted tool in website design, their use can present certain risks.
The primary risk posed by weblinking is viewer confusion about whose
website they are viewing and who is responsible for information, products,
and services available through that website. Credit unions using weblinks are encouraged
to review the enclosed guidance that was developed jointly with other
federal regulatory agencies. This guidance applies to credit unions
that develop and maintain their own websites, as well as those using
service providers for these functions. This letter supercedes NCUA Letter 02-FCU-04.
If you have any questions, please contact your NCUA Regional Office
or State Supervisory Authority.
Chairman Bachus, and Members of the Subcommittee, I appreciate your invitation to present this testimony reviewing the National Credit Union Administration’s (NCUA’s) experiences with information systems and technology (IS&T) incidents and other security events resulting in the potential compromise of personal financial data. We also identify actions by NCUA to ensure credit unions safeguard member information and to mitigate potential losses to credit unions and members when breaches occur. We recommend that NCUA be granted examination authority over third party vendors, which would enable us to better monitor risk and protect credit union members’ personal financial data. Examples of Data Security Breaches Involving Credit Union Members
Information is provided here on types of security breaches NCUA and credit unions have experienced. These security breaches include: fraudulent email or telephone scams, known as phishing; the unauthorized storing of customer information and the ensuing theft of this information; the theft of a credit union’s hard drive; and the theft of a vendor’s computer. We also provide information on how NCUA and credit unions have responded to these data security incidents.
The purpose of this letter is to provide important considerations for credit unions that are currently engaged in or may be considering the use of wireless technology. Wireless technology can potentially provide important benefits for credit unions and their members. For some, this may be a cost-effective alternative for a credit union seeking to expand its existing hard-wired computer network. Additionally, it may enable a credit union to provide members with increased accessibility to its Internet-based financial service offerings.
However, those credit unions that have made a decision to implement wireless technology should also be aware of the potential increase in the amount of risk exposure for the credit union. Credit unions may be able to mitigate the following risk areas with proper planning and controls.
GUIDELINES FOR ENSURING THE QUALITY OF DISSEMINATED INFORMATION Policy NCUA will undertake to ensure that the information it disseminates to the public is objective (accurate, clear, complete, and unbiased), useful and has integrity. Most information disseminated by NCUA is subject to the basic standard described in these guidelines. Additional levels of quality standards are adopted as appropriate for specific categories of disseminated information. The OMB guidelines require “influential scientific, financial or statistical information” to meet a higher standard of quality. OMB defines “influential” to mean, “the agency can reasonably determine that dissemination of the information will have or does have a clear and substantial impact on important public policies or important private sector decisions.” Id. at 8455. Influential information disseminated byNCUA is subject to a level higher than the basic standard. The NCUA’s Chief Information Officer (CIO) serves as the agency official charged with overseeing the agency’s compliance with OMB guidelines for the quality of information disseminated by NCUA.
The National Credit Union Administration (NCUA) Office of Inspector General (OIG) Annual Performance Plan for 2004 delineates those audits and investigations that would most benefit the NCUA. In formulating this Plan, we considered: • The agency’s strategic and annual performance plans; • Pertinent legislation, including the Inspector General Act, the Federal Credit Union Act, the Government Performance Results Act (GPRA), the Credit Union Membership Act, the Federal Information Security Management Act (FISMA), and the Sarbanes-OxleyAct of 2002; • Congressional activity and testimony by NCUA officials as well as significant areas of interest to NCUA Board members and the Congress; • Audits and reviews of NCUA and the credit union industry planned and performed by the General Accounting Office (GAO); • Input obtained from the NCUA Board and Executive staff; and • NCUA and the credit union industry’s operating environment.
The National Credit Union Administration (NCUA) Office of Inspector General (OIG) Annual Performance Plan for 2005 delineates those audits that would most benefit the NCUA. In formulating this Plan, we considered: • The agency’s strategic and annual performance plans; • Pertinent legislation, including the Federal Credit Union Act, the Government Performance Results Act (GPRA), the Credit Union Membership Act, Federal Information Security Management Act (FISMA), the Sarbanes-Oxley Act, and the Inspector General Act; • Congressional activity and testimony by NCUA officials as well as significant areas of interest to NCUA Board members and the Congress; • Audits planned and performed by the General Accounting Office (GAO); • Input obtained from the NCUA Board and Executive staff; and • NCUA and the credit union industry’s operating environment.
The National Credit Union Administration (NCUA) Office of Inspector General (OIG) Annual Performance Plan for 2003 delineates those audits and investigations that would most benefit the NCUA. In formulating this Plan, we considered: • The agency’s strategic and annual performance plans; • Pertinent legislation, including the Federal Credit Union Act, the Government Performance Results Act (GPRA), the Credit Union Membership Act, the Government Information Security Act (GISRA), and the Inspector General Act; • Congressional activity and testimony by NCUA officials as well as significant areas of interest to NCUA Board members and the Congress; • Input obtained from the NCUA Board and Executive staff; and • NCUA and the credit union industry’s operating environment. How the Annual Plan was formulatedThe NCUA OIG plans its work to identify and respond to issues that are of greatest importance to NCUA. For purposes of the Annual Plan, we have identified prospective audit and investigative work that is responsive to the agency’s strategic goals. The agency’s strategic goals are: • Promote a system of financially healthy, well-managed federally insured credit unions able to withstand economic volatility. • Facilitate credit unions’ ability to safely integrate financial services and emerging technology in order to meet the changing expectations of their members. • Create a regulatory environment that will facilitate credit union innovation to meet member financial service expectations. • Enable credit unions to leverage their unique place in the American financial system to extend availability of service to all who seek such service, while encouraging and recognizing their historical emphasis on servicing those of modest means.
• Enhance NCUA’s organization to continue to work with the credit union community in creating an environment that enables credit unions to continue to flourish while addressing the challenges of the 21stcentury.
NATIONAL CREDIT UNION ADMINISTRATIONOFFICE OF INSPECTOR GENERAL EVALUATION The Government Information Security Reform Act (GISRA), Public Law 106-398, requires Inspectors General (IG) to perform independent evaluations to:
•Assess compliance with GISRA and agency security policies and procedures; and The Office of Management and Budget (OMB) has requested IGs to submit the results of their independent evaluation by responding specifically to questions 2 through 13 of OMB Memorandum M-01-24. The following presents our evaluation of the National Credit Union Administration’s (NCUA) compliance with GISRA. The NCUA Office of Inspector General (OIG) has determined that NCUA is not yet in compliance with GISRA. The following represents the agency’s status toward compliance with key GISRA provisions as of August 2001:
•NCUA needs to develop an agency-wide security program. NCUA developed a draft security policy that will be incorporated in the security program. However this policy has not been approved by the agency head or disseminated to personnel with key responsibilities.
Rapidly evolving technologies continue to provide efficient, cost effective methods for providing fast delivery of a wide range of member services. Accompanying the opportunities to deliver cost effective services is growing exposure of technology resources to misuse and theft, which can result in loss of member confidence. Intrusion and abuse of technology is growing at an escalating rate. Intrusions, as noted in the chart below, reflect an increasing average rate of approximately 300 percent annually. The data was provided by Computer Emergency Response Team/Coordinating Committee (CERT/CC). The CERT/CC1is a government sponsored organization operated by the Carnegie Mellon Software Engineering Institute. Part of its mission is to track vulnerabilities in computer systems and recommend methods to improve computer security. Incidents are voluntarily reported and include:
1. Attempts to gain unauthorized access to a system or its data;
The purpose of this Letter is to provide additional guidance for combating the email schemes discussed in the recently released Letter to Credit Unions #04-CU-05 Fraudulent E-Mail Schemes. In addition, this Letter is intended to raise awareness of the increasingly common Internet fraud called “phishing.” NCUA encourages credit unions to educate their members, strengthen monitoring systems, and enhance response programs to reduce the potential risk of Internet-related fraud schemes to their organization and members. Such schemes may negatively impact your credit union’s reputation, transaction, liquidity, and strategic risks.
This alert is intended to raise awareness of an Internet worm, BugBear.B, that recently surfaced as a potential threat specifically targeted to financial institutions and to prompt credit unions and credit union technology service providers to take immediate steps to mitigate the threat to their organizations and customers.
Information technology (IT) and security continue to evolve at a rapid pace. New risks and threats arise quickly to challenge emerging and established technologies. Yet the essential elements of strong controls and sound IT practices remain the same despite the environmental changes. As part of our review of IT in corporate credit unions, the Office of Corporate Credit Unions (OCCU) IT examiners have focused on ensuring the adequacy of basic control elements such as firewalls, intrusion detection, penetration tests, and sound network architectures. I am pleased to note that corporates have been diligent in this regard and that many sound control practices have been implemented. OCCU IT staff will continue to verify that basic IT security control elements remain strong. However, the ever changing dynamics of the corporate credit union IT risk profile require that we also focus attention on the following critical information security areas: Information Security Risk Assessment; 2. Security Application Code Reviews; 3. Service Provider Oversight & Contracts; 4. Security Awareness of Employees; 5. Change Management for Applications & Infrastructure; and 6. Security for Remote Locations. Each area is briefly discussed below.
European Union Data Directive The 1995 European Union Directive on the Protection of Individuals With Regard to the Processing of Personal Data and on the Free Movement of Such Data became effective on October 25, 1998, and covers the processing of data within the EU and its transfer outside of the EU. The Directive requires EU member states to pass national privacy laws implementing the principles established in the Directive. While laws implementing the Directive vary somewhat from one member state to another, the general framework remains the same throughout the EU. Since the EU imposes sanctions on its members for not passing laws according to its Directive, 15 EU member states (except Ireland, Luxembourg and France) have implemented the Directive to date. Even the three exceptions have privacy legislation that requires compliance from companies doing business in these nations. The EU Directive applies to all processing of personal information by any person or organization within the EU, both private and public. The Directive applies to all citizens and resident employees. It also covers data processing and/or transfer by entities owned or affiliated with United States companies that process data within the EU. Data can only be processed if certain processing principles are utilized.
The banking agencies will implement the Central Data Repository (CDR) to process the Reports of Condition and Income (Call Reports) beginning with the third quarter 2005. This filing period begins September 30, 2005. Except for certain banks with foreign offices, data must be received by October 30, 2005. **The agencies recognize that institutions whose operations have been significantly affected by Hurricane Katrina may experience difficulty or delay in filing their third quarter Call Report. Those institutions should contact their primary regulator or the CDR help desk at 1-888-CDR-3111 for special assistance in filing third quarter Call Report data. The CDR will require banks to validate their Call Report data before it will be accepted. To allow sufficient time to complete the new prevalidation process prior to the submission deadline, banks should start their Call Report preparation process earlier than in the past. The new prevalidation process will require banks to correct errors identified by the CDR and, where necessary, to prepare explanatory comments for data that fall outside specific parameters. These explanatory comments, which will be filed along with a bank's data, will be considered confidential.
Welcome to the fourth issue of The SAR Activity Review – By the Numbers, a compilation of statistical data gathered from Suspicious Activity Report forms submitted by depository institutions since April 1996,casinos and card clubs since August 1996,certain money services businesses since January 2002, and certain segments of the securities and futures industries since January 2003. By the Numbers serves as a companion piece to the publication of the Trends, Tips &Issues, which provides information about the preparation, use, and utility of Suspicious Activity Reports. By the Numbers is produced twice a year to cover two periods:January 1 A review of the statistical data generated for Issue 4 of By the Numbers reveals some interesting facts. As of December 31,2004,over 2.1 million Suspicious Activity Report forms 1 had been ith FinCEN. Although the remainder of this publication provides detailed statistical data on those , some general observations are provided below for each type of form.
The SAR Activity Review - Trends,Tips &Issues
">U. S. Implementation of Basel II: Objectives of Basel Accord Advance a “three- pillar ” approach –Pillar 1 - - minimum capital requirement –Pillar 2 - - supervisory oversight –Pillar 3 - - heightened market discipline Develop a measure of capital that is: –more risk sensitive than the current approach –better suited to the complex activities of internationally-active banks –capable of adapting to market and product evolution
assessments of capital adequacy
The Federal Reserve Board on Monday announced amendments to Appendix A of Regulation CC that reflect the restructuring of the Federal Reserves check processing operations in the Twelfth District. These amendments are part of a series of amendments to Appendix A that will take place through the first quarter of 2006, associated with the previously-announced restructuring of the Reserve Banks check processing operations. Appendix A provides a routing number guide that helps depository institutions determine the maximum permissible hold periods for most deposited checks. As of October 22, 2005, the Portland branch office of the Federal Reserve Bank of San Francisco no longer will process checks, and banks currently served by that office will be reassigned to the Seattle branch office of the Federal Reserve Bank of San Francisco.
Today;s announcement that 207,000 jobs were created in July is another significant indicator that Americas economy is expanding. Now, nearly 4 million new jobs have been created since May 2003 and the unemployment rate remains at 5 percent. Combined with several recent reports indicating steady non-inflationary increases in economic activity, this shows that the fundamentals of our economy are strong and that we are continuing on a positive path of growth and prosperity.
FACILITATING AFFILIATION AMONG BANKS, SECURITIES FIRMS, AND INSURANCE COMPANIES
The Patriot Act, and How It Applies to the Banking Industry: The U.S. Department of the Treasury issued a final rule on September 26, 2002, to implement Section 314 of the USA PATRIOT Act that adds sections 103.100 and 103.110 to the Bank Secrecy Act regulations. These sections establish procedures that encourage information sharing between governmental authorities and financial institutions, and among financial institutions themselves. The new section 103.100 establishes a mechanism for law enforcement to communicate names of suspected terrorists and money launderers to financial institutions in return for securing the ability to promptly locate accounts and transactions involving those suspects. Financial institutions receiving names of suspects must search their account and transaction records for potential matches and report positive results to Treasury's Financial Crimes Enforcement Network (FinCEN) in the manner and time frame specified in the request. Each financial institution must designate a point of contact to receive information requests. FinCEN has prescribed that each financial institution supply point of contact information to its primary federal regulator. If you have not already done so, send by e-mail to FDICAdvisory@fdic.gov or by mail to FDIC, Special Activities Section, 550 17th Street NW, Washington, DC 20429, the following information: name of institution, name of point of contact, title, mailing address, e-mail address, telephone number, and fax number. Changes in contact information must be promptly reported.
In 2001, NCUA amended 12 CFR Part 748 to fulfill a requirement in Section 501 of the Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA), in which Congress directed both NCUA and the other Federal Financial Institution Examination Council (FFIEC ) agencies, including the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency, and the Office of Thrift Supervision (collectively, the “Banking Agencies”) to establish standards for financial institutions relating to administrative, technical, and physical safeguards to...
This advisory letter highlights issues regarding bank electronic record systems in light of the E-SIGN Act. 15 USC 7001, et seq. The letter provides a basic framework that bank management can use to assess and address key issues posed by electronic record keeping systems. BACKGROUND Federal legislation changed the legal framework for electronic records and will likely result in more banks adopting electronic record retention systems. Banks can implement electronic record retention systems in many ways to support different business processes. Some examples of possible electronic record retention systems are loan file imaging, retention of paperless applications and online agreements, and the use of electronic payment systems.
On January 17, 2001, the banking regulatory agencies adopted guidelines implementing Section 501 of the Gramm-Leach-Bliley Act (GLBA). The guidelines require financial institutions to establish a comprehensive and coordinated information security program, appropriate to the size of the bank and the complexity of its operations.
This alert is intended to raise awareness of an Internet virus, Bugbear.B, that recently surfaced as a potentially serious threat to financial institutions and to prompt banks and bank technology service providers to take immediate steps to mitigate the threat to their organizations and customers. BACKGROUND Viruses are an increasing threat to Internet-connected systems. The Bugbear.B virus is the latest and most capable variant that threatens financial institutions. Institutions with the capability to access the Internet, including dial-up connections, may be vulnerable to the Bugbear.B virus and other viruses, and should institute appropriate measures to mitigate the risks posed to their servers, desktops, laptops, and other computing devices.
Section 314(a) of the USA PATRIOT Act of 2001 (P.L. 107-56)1 , required the Secretary of the Treasury to adopt regulations to encourage regulatory authorities and law enforcement authorities to share with financial institutions information regarding individuals, entities, and organizations engaged in or reasonably suspected, based on credible evidence, of engaging in terrorist acts or money laundering activities. FinCEN issued a proposed rule on March 5, 2002, and the final rule on September 26, 2002(67 Fed. Reg. 60,579). Section 314(a) requirements are now published in 31 CFR Part 103.100.
Summary: The Federal Financial Institutions Examination Council (FFIEC) has issued the attached guidance, "Authentication in an Internet Banking Environment." For banks offering Internet-based financial services, the guidance describes enhanced authentication methods that regulators expect banks to use when authenticating the identity of customers using the on-line products and services. Examiners will review this area to determine a financial institution's progress in complying with this guidance during upcoming examinations. Financial Institutions will be expected to achieve compliance with the guidance no later than year-end 2006.
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
RSS SyndicationCopyright © 2007 CUInfoSecurity.com