Top Story Operations Related

The National Credit Union Administration released today its annual Cybersecurity and Credit Union System Resilience Report. The report summarizes the current cybersecurity threat landscape, highlights the agency’s key cybersecurity initiatives, and outlines the agency’s ongoing efforts to enhance cybersecurity preparedness and resilience within the credit union industry.

The Treasury Department yesterday reported that OFAC had sanctioned nearly 50 entities and individuals that constitute multiple branches of a sprawling “shadow banking” network used by Iran’s Ministry of Defense and Armed Forces Logistics (MODAFL) and Islamic Revolutionary Guard Corps (IRGC) to gain illicit access to the international financial system and process the equivalent of billions of dollars since 2020. MODAFL and the IRGC engage in several commercial revenue-generating activities, most notably the sale of Iranian oil and petrochemicals.

Networks of Iranian exchange houses and dozens of foreign cover companies under their control enable MODAFL and the IRGC to disguise the revenue they generate abroad that is then available to use for a range of MODAFL and IRGC activities, including the procurement and development of advanced weapons systems such as unmanned aerial vehicles. This revenue also supports the provision of weapons and funding to Iran’s regional proxy groups, including Yemen’s Houthis, who continue a campaign of reckless attacks on global shipping, as well as the transfer of UAVs to Russia for use in its war of aggression against Ukraine.

For the names and identification information of the designated parties, see the June 25, 2024, BankersOnline OFAC Update.

The OCC has requested comment on a proposal to revise its recovery planning guidelines for certain large insured national banks, federal savings associations, and federal branches (banks).

The proposed rulemaking is part of the OCC’s effort to ensure that large banks are adequately prepared and have developed a plan to respond to the financial effects of severe stress, particularly in light of the contagion effects and systemic risks they may pose.

The proposal would:

• Expand recovery planning guidelines to apply to banks with at least $100 billion in assets
• Incorporate a testing standard for recovery plans
• Clarify the role of non-financial risk (including operational and strategic risk) in recovery planning

Comments from the public will be accepted for 30 days following publication of the proposed in the Federal Register.
Publication and comment period update: Published 7/3/2024 at 89 FR 55114. The comment period will close 8/2/2024.

The FDIC has issued FIL-36-2024 with steps intended to provide regulatory relief to financial institutions and facilitate recovery in areas of Florida — Leon County — affected by severe storms, straight-line winds, and tornadoes on May 10, 2024.

The Treasury Department reported on Friday that OFAC has designated twelve individuals in leadership roles at AO Kapersky Lab.

On Thursday, the Department of Commerce issued a final determination under Executive Order 13873 prohibiting Kaspersky Lab, Inc., its affiliates, subsidiaries and parent companies directly or indirectly from providing anti-virus software and cybersecurity products or services in the United States or to U.S. persons. Commerce reached this determination after an investigation found transactions involving the products and services of Kaspersky Lab, Inc. and its corporate family pose unacceptable risk to U.S. national security or the safety and security of U.S. persons, as outlined in E.O. 13873.

In addition, the Department of Commerce has designated AO Kaspersky Lab and OOO Kaspersky Group (Russia), and Kaspersky Labs Limited (United Kingdom) on the Entity List for their cooperation with Russian military and intelligence authorities in support of the Russian government’s cyber intelligence objectives. These activities are contrary to U.S. national security and foreign policy interests.

For the names and identification information of the designated parties, see the June 21, 2024, BankersOnline OFAC Update.

The FDIC has issued FIL-35-2024 with steps intended to provide regulatory relief to financial institutions and facilitate recovery in areas of Oklahoma — Blaine, Caddo, Custer, Delaware, Jackson, Mayes, Muskogee, and Rogers Counties — affected by severe storms, straight-line winds, tornadoes, and flooding from May 19, 2024, to May 28, 2024.

The FDIC and Federal Reserve Board have jointly announced that, following their joint review of the July 2023 resolution plan submissions of the eight largest and most complex banks, they identified a weakness in the plans from Bank of America, Citigroup, Goldman Sachs, and JPMorgan Chase. The agencies did not identify any weaknesses in the plans from the other banks.

The agencies jointly identified a weakness in the 2023 plan submitted by Citigroup, but reached different conclusions on its severity. The FDIC determined that the Citigroup plan is not credible or would not facilitate an orderly resolution under the U.S. Bankruptcy Code and considers the weakness to be a "deficiency." A deficiency is a weakness that could undermine the feasibility of the plan. The Board concluded that the weakness is only a shortcoming. Under the resolution planning rule of the agencies, when one agency finds a shortcoming in a resolution plan and the other agency finds a deficiency, the plan is deemed to have a shortcoming. As a result, Citigroup's 2023 plan is considered to have a shortcoming. The agencies also previously identified a shortcoming in Citigroup's 2021 plan related to data quality and data management, and that shortcoming remains outstanding.

The agencies provided feedback letters to each of the eight banks that identify areas for continued development of banks' resolution strategies and capabilities. For the four banks with an identified shortcoming, the letters describe the specific weaknesses resulting in the shortcoming and the remedial actions required by the agencies. The shortcomings are to be addressed in the next resolution plans due by July 1, 2025. The feedback letters also specify that each bank, in its 2025 resolution plan submission, should address the topics of contingency planning and obtaining foreign government actions necessary to execute the resolution strategy.

2023 Resolution Plan Feedback Letters:

• Bank of America Corporation
• Bank of New York Mellon Corporation
• Citigroup Inc.
• The Goldman Sachs Group
• JPMorgan Chase & Co.
• Morgan Stanley
• State Street Corporation
• Wells Fargo & Company

The Federal Reserve Board has announced it will extend until September 6, 2024, the comment period on its proposal to expand the operating days of the Federal Reserve Banks' two large-value payments services, Fedwire Funds Service and the National Settlement Service (NSS), to include weekends and holidays. The Board extended the comment period to allow the public more time to analyze the proposal and prepare their comments. Comments on the proposal were originally due by July 8, 2024.

Currently, both the Fedwire Funds Service and the NSS operate Monday through Friday, excluding holidays. Under the proposal, both services would operate every day of the year. The operating hours each day would remain the same, with the Fedwire Funds Service open 22 hours per day, and NSS open 21.5 hours per day. The proposal does not include changes to the Fedwire Securities Service or the Federal Reserve's new retail service for instant payments, the FedNow Service.

• Federal Register Notice, published 6/26/2024 at 89 FR 53425

The FDIC Board yesterday announced it has approved a final rule to strengthen resolution planning for insured depository institutions (IDIs) with at least $50 billion in total assets. After careful consideration of comments received, the FDIC issued a final rule that incorporates several changes from the agency’s proposed rule published in September of 2023.

Under the rule announced yesterday, the FDIC will require large banks with total assets of at least $100 billion to submit comprehensive resolution plans that meet enhanced standards to support the FDIC’s ability to undertake an efficient and effective resolution under the Federal Deposit Insurance Act should such an institution fail.

The rule will require IDIs with total assets of at least $50 billion but less than $100 billion to submit more limited “informational filings” to assist in their potential resolution. The agency will not require these institutions to develop a resolution strategy and related valuation information as part of their submissions. These institutions are also exempt from submitting certain strategy-related content requirements regarding the institution’s franchise components.

The new rule strengthens the existing IDI resolution planning framework under 12 CFR § 360.10 by requiring a full resolution submission from most covered IDIs every three years with limited supplements filed in the off years. Covered IDIs affiliated with U.S. global systemically important banking organizations must file a full resolution submission every two years.

The final rule will take effect on October 1, 2024, and the first submissions are expected next year.

• Fact sheet
• FIL-34-2024
• Statement by Acting Comptroller of the Currency Michael J. Hsu
• Statement by CFPB Director Rohit Chopra

Yesterday, the IRS announced it has issued Notice 2024-55, which provides guidance on exceptions to the additional tax when taking early permissible retirement plan distributions for emergency personal expenses and for victims of domestic abuse.

The notice also provides guidance to applicable eligible retirement plans on the plan requirements relating to emergency personal expense distributions and domestic abuse victim distributions, including that it is optional for a plan to permit these types of distributions.

In addition, the notice provides that the Department of the Treasury and the IRS anticipate issuing regulations on the 10% additional tax (including the exceptions to the 10% additional tax) and request comments relating to the notice. Comments are specifically requested on repayments of certain distributions permitted under section 72(t)(2).