In light of the quickly changing economic situation presented by COVID-19, consumer lenders should be quickly preparing for the impact of COVID-19 on their customers. In addition, because lenders are also businesses themselves, it’s imperative to prepare for the impact on systems and employees.

Considering Customers

Drawing guidance from the Warren Letter

On March 3, 2020, Senator Elizabeth Warren issued a letter to five banks seeking information from them about how they plan to respond to the coronavirus. Warren wrote, “In the past, in cases of temporary income disruptions due to natural disasters or the 2019 government shutdown you have extended flexibilities to your customers to ensure that temporary conditions do not spell long-term financial ruin. I write to understand what if any flexibilities you intend to offer your customers affected by COVID-19 and to understand how long you may be able to make those measures available, given the uncertainty around the length and intensity of the outbreak.” Warren later alluded to specific “flexibilities” that she claimed banks put into place in connection with the 2019 shutdown, including:

• Zero-interest credit card accounts
• Refunds on overdraft and monthly banking fees
• 0.01% APR “quick loans”
• Forbearance and/or deferrals on credit card, auto loan, and mortgage and home equity payments
• No late fees or delinquency reporting

Among the specific questions Warren posed to the bank executives was whether the banks will report negative credit information to credit reporting agencies (CRAs) for customers affected by the coronavirus. While the senator’s letter carries no legislative or regulatory weight, it does highlight for the consumer financial services industry how and where the scrutiny will fall once defaults increase.

In light of this, financial institutions and licensed lenders should consider their plans for reporting delinquent accounts and accounts in forbearance, which we anticipate will rise due to illness-related work absences and worksite closures affecting customers. Currently, it is unclear under Consumer Data Industry Association (CDIA) guidelines whether a furnisher can report a delinquent account or an account in forbearance because of COVID-19 as an account “affected by a natural or declared disaster.” See guidance issued by CDIA and instructions on coding for natural or declared disasters. We anticipate flexibility to characterize COVID-19 as “a natural or declared disaster” for purposes of credit reporting and, in the absence of clear guidance, would advise doing so given the likely benefits to consumers in doing so. However, it would be beneficial for regulators to confirm that such reporting is proper. Accordingly, financial institutions and lenders should consider updating relevant policies and procedures or adding a COVID-19 addendum to those policies/procedures. Relatedly, we also suggest considering how to address consumer notices of default, right to cure periods, and rights to reinstatement, as applicable.

Of course, business disruption doesn’t just impact borrowers; you, too, have to consider how to respond in the event COVID-19 countermeasures disrupt commerce. We anticipate that the two main areas of coronavirus-related concern for operations will be absenteeism and worksite closures. We recommend having a plan in place for determining what amount of absenteeism will affect payment processing and credit reporting. If absenteeism reaches that level, then the decision should be made as to whether to report all accounts in a specific manner. These decisions and triggers should be incorporated into affected policies and procedures. Note that under the NACHA operating rules, a financial institution is permitted to delay performance of its obligations if (a) the delay was caused by the interruption of communication or computer facilities; and (b) the delay was beyond the reasonable control of the financial institution seeking the excused delay. However, a delay caused by the institution to maintain or implement an appropriate business continuity plan is not excused under the NACHA rules.

Loan Modifications and Payments in the Time of Coronavirus

Inevitably, the strain of the coronavirus pandemic will result in the need to enter into deferrals, extensions, and/or loan modifications with borrowers. On March 13, the CFPB, among other suggestions, urged consumers to contact their lenders if they anticipate having trouble paying their bills to see what kind of relief a lender may be able to provide. On that same day, the FDIC issued a Financial Institution Letter indicating that a financial institution’s prudent efforts to modify the terms on existing loans for affected customers will not be subject to examiner criticism. This all comes on the heels of a March 9 joint statement issued by the federal financial regulators and state regulators stating that financial institutions “should work constructively with borrowers and other customers in affected communities. Prudent efforts that are consistent with safe and sound lending practices should not be subject to examiner criticism.” We suggest all lenders follow this guidance and provide safe and sound relief to borrowers but be mindful of statutory and regulatory hurdles. Notably, some states require a creditor to enter into a signed written agreement with a consumer to extend a payment, and there are few, if any, exceptions to this writing requirement when there is a state-of-emergency situation. Lenders should consider seeking clarification on applicability of these requirements in a state-of-emergency situation.

Furthermore, each lender should consider what kind of credit verification it will require of customers to provide temporary relief. As cautioned by Senator Warren, be cognizant of avoiding an unduly burdensome process for the customer to obtain such relief.

Payment Processing

There is a high degree of confidence that the payment-processing functions of large financial institutions have adequate Continuity of Operations and Disaster Recovery Plans to deal with this crisis but nonetheless payment schedules and processing will also be challenged. Customers should be reminded of any electronic payment methods that are available or if checks need to be rerouted to corporate home offices or other locations. Importantly, the USPS mail-forwarding option should be considered, but note that we could see a delay in mail service, which harkens back to exercising discretion and flexibility in reporting delinquencies, as previously discussed.

In addition to these impacts above, lenders should also consider the following:

• Updating your Business Continuity Plan and Disaster Recovery Plan to support anticipated COVID-19 measures. See recently updated FFIEC Guidance on this topic;
• Considering enhanced due diligence to prevent fraud (e.g. enhanced wire transfer call-back procedures, taking additional steps to confirm credit applicant identity);
• Communicating with your critical service providers– are your vendors set to go with their business continuity plans and are there adjustments to be made on your end to help facilitate the continuity of operations?

Operational Challenges

Contingency plans are also necessary for dealing with the potential closure of a lending operation’s brick-and-mortar locations. If closures are rolled out on a select basis—for example, by geography—there will have to be a determination of the threshold beyond which operations simply cannot continue for some or all bricks and mortar servicing. Customer communication in this instance is key. Financial institutions, licensed lenders and loan servicers will need to draft communications that clearly instruct customers how to make payments and how to communicate if branches are closed.

Furthermore, as operations adapt to conditions on the ground, some interesting legal and regulatory questions arise. For example, will licensed lenders be capable of providing services outside of their state of licensure? Will the lender be allowed by its regulator to originate or service loans from non-licensed locations? As the situation evolves, more and more state agencies are providing guidance on these kinds of questions. The NMLS is collecting such guidance. Overall, we believe that most regulators, if not all, are going to be conducive to helping financial institutions and licensed lenders do what they can to provide services to the consumers, consistent with the March 9 Guidance issued by the federal and state regulators.

Remote Workers, Data Privacy and Data Security

Working remotely can tax even well-prepared information technology teams, but when such a practice is put into place quickly and under duress, data privacy and data security become serious issues that can hamper compliance efforts. Regulators in the state of Washington have put together some thoughtful guidance that is relevant to the issue of remote working. Washington allows mortgage-loan originators to work out of a non-licensed space, but has also provided some guidance on how to approach such a situation:

The licensed mortgage loan originator must be able to access the company’s secure origination system (including a cloud-based system) directly from any remote device the mortgage loan originator uses (laptop, phone, desktop computer, tablet, etc.) using a virtual private network (VPN) or similar system that requires passwords or other forms of authentication to access. Additionally, all security updates, patches, or other alterations to the device’s security must be maintained, and the loan originator must not keep any physical business records at any location other than the licensed main office.

These are commonsense measures and should be considered by businesses that need to implement large-scale closures or to introduce remote worksites. Other, ancillary issues to consider include:

• What positions are conducive to working from home? This may depend on what equipment is needed for the employee to work from home. If the employee is in your servicing center, then that employee will need a secure laptop and a way to call customers (preferably, with company-issued telephones, not their personal phones).
• What are the infrastructure needs for remote working? Lenders should work with IT very closely to meet infrastructure needs while considering data security, confidentiality, and legal liability issues (for example, the Telephone Consumer Protection Act, the Safeguards and Red Flags Rules)
• What physical records can be brought home from the office and by whom? There are certain levels of employees that will not be authorized to bring personally identifiable information home in a physical record. Consider whether you can scan physical records into the computer system now for purposes of remote working.
• How will you monitor the work being done and ensure the employee is actually working? Consider whether you will allow flexible hours given that there may be childcare and school closures. If so, be sure to impress upon any employee making calls to customers any restrictions on calling hours under your policies and procedures and/or applicable law.

This article is, of course, not intended to be representative of all considerations that may affect your institution in these challenging times. Overall, it’s important to put in place flexible policies and procedures that provide the ability to adapt to this fluid situation, but that do not compromise safe and sound practices. We recommend staying in contact with your trade associations, regulators, and counsel as needs dictate.