Tracking Cyber Threats and Regulatory Interpretations for Banks During Coronavirus Crisis
For banks and other financial institutions navigating the difficulties of COVID-19’s impacts, two recent developments are notable.
First, federal officials are warning that cybercriminals linked to the North Korean government are plotting attacks on financial institutions across the globe. In a joint statement, the U.S. Departments of State, Treasury, and Homeland Security and the Federal Bureau of Investigation described how North Korea-linked hackers launch cyberattacks on financial companies and other businesses. You can read the full guidance report on the U.S. Department of Homeland Security website.
Secondly, a new Interpretive Rule has been issued by the Consumer Financial Protection Bureau (CFPB), which concludes that the normal limits on financial institutions imposed by the Electronic Funds Transfer Act (EFTA) and Regulation E do not apply to certain COVID-19 pandemic relief payments by the government to consumers.
Normally these regulations prohibit the government from requiring consumers to establish an account with a particular financial institution as a condition of receiving government benefits. But the CFPB has determined that COVID-19 stimulus payments meeting the criteria outlined in the rule would NOT be considered "government benefits," and thus, a government agency MAY require consumers to establish an account with a particular financial institution as a condition of receiving pandemic relief payments that meet these criteria. This effectively clears the way for the IRS to issue these funds to consumers via prepaid cards.
The four criteria for such payments from Federal, State, or local governments to be considered exempt from the "government benefits" rule are:
- The payments must be to provide assistance to consumers in response to the COVID-19 pandemic or its economic impacts;
- The payments must be OUTSIDE of an already-established government benefit program (for example: payments made pursuant to an existing government benefit program would not qualify for this exclusion, even if the volume or dollar value of the program’s payments is increased due to the COVID-19 pandemic);
- The payments must be on a one-time or otherwise limited basis, as opposed to regular ongoing payments (thus, a limited series of related payments made to the same consumer could qualify for this exclusion); and
- The payments must be offered WITHOUT a general requirement that consumers apply to the agency to receive funds (filing a tax return, or consumer provision of information necessary to complete a consumer identification and verification process prior to activating an access device, does not by itself constitute an "application" to receive funds).
COVID-19 stimulus payments meeting all four of these criteria are excluded from the prohibitions of the EFTA and Reg E and are not considered "government benefits."
Feel free to reach out to our experienced attorneys at Paley Rothman if you would like to discuss these items further.