Compliance Blog

In honor of my husband and I finally closing on our home, let’s talk about everyone’s favorite activity: moving! First, you have to find a place to live that meets all your criteria, which may take weeks. Second, you have to box up everything you own, take apart all your furniture, and rent a truck to transport your items to the new house. Third, you have to unpack, figure out where everything belongs in the new house, and then buy new everything because your old stuff doesn’t match the aesthetic of your new home. Finally, the last and most difficult step is updating your address with every service, company, and website you use- including your credit union.

 Section 7 of Article XVI of NCUA model bylaws states that “members must keep the credit union informed of their current mailing address.” But what does the credit union need to consider when they receive notice of a change of address from a member? This blog addresses some considerations the credit union may want to review prior to updating a member’s address information.

Identity Theft

NCUA has issued guidance on identity theft and pretext calling in Letter to Credit Unions 01-CU-09, which includes steps credit unions should take to prevent fraud when processing address changes. This guidance indicates that credit unions should verify information prior to processing an address change, and send a confirmation of the address change to the member.

This is an excerpt from page 4 of the PDF document:

“2. Fraud Prevention. To prevent fraudulent address changes, credit unions should verify member information before executing an address change and send a confirmation of the address change to both the new address and the address of record.”

CIP Record Retention

The FFIEC FAQs: Final CIP rule distinguishes the requirement of section 1020.220(a)(3)(ii) for retention of CIP records from updating information on a member. The FAQs state that the credit union must:

 “retain the identifying information obtained about the customer at the time of account opening for five years after the date the account is closed or, in the case of credit card accounts, five years after the account is closed or becomes dormant. Updated information serves valuable, but different, purposes.”

Credit unions may want to make sure that the CIP records are being maintained in compliance with the BSA record retention requirements. Credit unions may want to work with their vendors to ensure updating the address in a core system is not overwriting the information obtained at account opening used to verify the identity of the member in accordance with CIP requirements.

Privacy

Sometimes a member may only want to update information for a joint account but not an individual account or vice versa. Section 501 of the Gramm-Leach-Bliley Act states that “each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers’ nonpublic personal information.” If the personal information involved is considered nonpublic personal information (NPI), a credit union may be prohibited from sharing that information with others under Regulation P. For example, NPI associated with an individual account generally may not be shared with another member who is not authorized to have such information. The credit union may want to consult with local counsel to determine if there are any privacy concerns when updating address information automatically across all accounts.

The credit union may want to review their internal procedures to ensure that updating address information is done in a manner that protects the member from possibly identity theft and privacy concerns, while also not overriding any CIP data.  

Returned Mail

Sometimes members do not inform their credit union of an address change and mail is returned to the credit union as undeliverable. A credit union may consider implementing general returned mail processes and procedures to address these types of situations. This may include retaining some documentation of the attempts to deliver the mail and the post office's return of the item to demonstrate compliance with the requirements. It may also include contacting the member via other methods to obtain updated information.

Regulation Z does provide some guidance for when a periodic statement is returned undeliverable. The official interpretation to section 1026.5(b)(2)(i) explains that if a periodic statement for open-end credit required under Regulation Z is returned as undeliverable, the regulation does not require the credit union to continue to send periodic statements. The interpretation continues to state that if the credit union receives a new address, within a reasonable time before the credit union must send a periodic statement, the regulation would require the credit union to then resume sending periodic statements. The commentary clarifies that a reasonable time would be “at least 20 days before the end of a cycle.” If the credit union has ceased providing periodic statements to a member due to them being returned as undeliverable, when the member updates their address with the credit union, the regulation requires the credit union to then start sending periodic statements to the member.