The Malta Pension Plan – A Supercharged, Cross-Border Roth IRA

Relevant US Tax Principles

In the cross border setting, two of the principal goals in international tax planning are (i) deferral of income earned offshore and (ii) the tax efficient repatriation of foreign profits at low or zero tax rates in the United States. For U.S. taxpayers investing through foreign corporations, planning around the controlled foreign corporation (CFC) rules typically achieves the first goal of deferral, and utilizing holding companies resident in treaty jurisdictions generally accomplishes the second goal of minimizing U.S. federal income tax on the eventual repatriation of profits (for U.S. corporate taxpayers, the use of foreign tax credits may be used to achieve this latter goal).

In a purely domestic setting, limited opportunities exist to defer paying U.S. federal income tax on income or gain realized through any type of entity, and fewer opportunities, if any, exist for the beneficial owners of such entities to receive tax-free distributions of the accumulated profits earned by these entities. A Roth IRA may be the best vehicle available to achieve these goals.

Roth IRA (hereafter, “Roth”) is a type of tax-favored retirement account, under which contributions to the Roth are not tax deductible (like contributions to a traditional IRA would be), but all earnings of the Roth accumulate free of U.S. tax. In addition, qualified distributions from a Roth are not subject to U.S. federal income tax. In other words, once after-tax funds are placed in a Roth, those funds generally are not taxed again. As with traditional IRAs, however, the tax benefits of Roth IRAs are restricted to certain taxpayers who fall below certain modified adjusted gross income thresholds, and even then, such persons are limited in the amounts that can be contributed each year. Additionally, those who are eligible to contribute to such Roth accounts are limited to a maximum contribution of $5,500 per year ($6,500 for taxpayers age 50+). Any “excess contributions” beyond the stated limitations trigger an annual 6 percent excise tax until the excess contributions are eliminated. Finally, because of the “prohibited transaction” provisions, it is not possible for U.S. taxpayers to transfer property (whether appreciated or not) to a Roth without triggering certain taxes (i.e., excise tax as well as income tax on any built-in gain). Therefore, while the benefits of Roths are significant, they are not widely available, particularly to high-income taxpayers.

Relevant Maltese Principles Relating to Malta Pensions

Since 2002, Maltese legislation has been in existence which allows for the creation of cross-border pension funds (although these pension funds have become more relevant to U.S. taxpayers since the effective date of the U.S.-Malta income tax treaty (the “Treaty”) in November of 2010). In contrast to the stringent limitations imposed on contributions to Roths under U.S. law, unlimited contributions may be made to a Malta pension plan. This is true also for U.S. citizens and tax residents, regardless of whether such persons are resident in or have any connection at all to Malta (though no U.S. deduction is permitted for contributions to such Maltese plans). A Maltese pension plan generally is classified as a foreign grantor trust from a U.S. federal income tax perspective because of the retained interest of the grantor/member in the pension fund. Thus, contributions to such a pension fund (including contributions of appreciated property) generally are ignored from the U.S. income tax perspective and should not trigger any adverse U.S. tax consequences.[1]

There also appears to be almost no limitation on what types of assets can be contributed tax-free to a Malta pension, including, for example, stock in private or publicly-traded companies (including PFICs), partnership and LLC interests (including so-called “carried interests”), and interests in U.S. or non-U.S. real estate. While the specific terms of each pension plan vary, Malta law generally permits distributions to be made from such plans beginning at age 50.

The relevant Maltese pension rules allow an initial lump sum payment of up to 30% of the value of the member’s pension fund to be made free of Maltese tax. This initial payment must be made within the first year of the retirement date chosen by that member. Additional periodic payments generally must then be made from the pension at least annually thereafter, and while such payments may be taxable to the recipient, they are usually significantly limited in amount (generally being tied to applicable minimum wage standards in the recipient’s home jurisdiction). Beyond those minimum wage amounts, excess lump sum distributions of up to 50 percent of the balance of the plan generally can be made free of Malta tax.

U.S.-Malta Income Tax Treaty Provisions

As noted above, when the Treaty became effective in late 2010, Maltese pension plans became more attractive to U.S. taxpayers. The Treaty contains very favorable provisions that can result in significant tax benefits to U.S. members of a Maltese pension. In order for such U.S. members to take advantage of these benefits, the pension must qualify as a resident of Malta under the Treaty and also satisfy the limitation on benefits (LOB) article of the Treaty.

Article 4, paragraph 2 of the Treaty provides that a pension fund established in either the United States or Malta is a “resident” for purposes of the Treaty, despite that all or part of the income or gains of such a pension may be exempt from tax under the domestic laws of the relevant country. Under Article 22(2)(e) of the Treaty, a pension plan that is resident in one of the treaty countries satisfies the LOB provision as long as more than 75% of the beneficiaries, members, or participants of the pension fund are individuals who are residents of either the Unites States or Malta.[2]

Thus, as long as a Maltese pension is formed pursuant to relevant Maltese law and more than 75% of its members are U.S. and/or Maltese residents, the pension plan should be eligible for Treaty benefits.

Pursuant to Article 18 of the Treaty, income earned by a Maltese pension fund cannot be taxed by the United States until a distribution is made from that fund to a U.S. resident. This article of the Treaty contains no restrictions on the types of income that are covered, and thus is generally believed to apply broadly to all income (including, for example, income arising in connection with interests in U.S. real estate, PFIC stock, and assets connected to a U.S. trade or business).[3]

Article 17(1)(b) of the Treaty further provides that distributions from a pension arising in one country, and which would be exempt from tax in that country if paid to a resident of that country, must also be exempt from tax in the other country when paid to a  resident of the latter country.  The U.S. Treasury’s Technical Explanation to the Treaty further clarifies that, for example, “a distribution from a U.S. Roth IRA to a resident of Malta would be exempt from tax in Malta to the same extent the distribution would be exempt from tax in the United States if it were distributed to a U.S. resident.”[4]

As mentioned above, pursuant to Maltese law, the initial lump sum payment from a Maltese pension (up to 30% of the value of the relevant pension fund) generally is not taxable in Malta. Thus, based on Article 17(1)(b) of the Treaty, such amounts likewise must not be taxed in the United States when made to a U.S. resident beneficiary. Additionally, this same Maltese exemption generally applies to further lump sum payments received by Maltese resident beneficiaries in certain subsequent years (generally, such distributions may be made tax-free beginning three years after the initial lump sum distribution is received). Notably, any required annual (or more frequent) periodic payments would be taxable in Malta if made to a Maltese resident, and therefore also are taxable in the United States under Section 72 when received by a U.S. resident member of the pension fund.[5]

Finally, while under the so-called “savings clause” the United States generally reserves the right under its income tax treaties to tax its citizens and “residents” as though the treaty did not exist, this savings clause contains certain exceptions. Under the Treaty, Article 1(5) provides that Articles 17(1)(b) and 18 are excepted from the savings clause (found at Article 1(4)). Consequently, the savings clause of the Treaty should not prevent a U.S. citizen or resident member of a Maltese pension from qualifying for Treaty benefits under relevant provisions of Articles 17 and 18.

Example

Assume a U.S. resident individual 49-years of age owns both highly-appreciated U.S. real estate and founders’ shares of a technology start-up that is about to go public. In combination, the interests are worth approximately $100 million, and the aggregate tax basis of the assets is $10 million. As part of her retirement planning, this U.S. individual decides to contribute these assets to a Maltese pension fund.[6] During this same tax year, the real estate is sold for fair market value and the technology company goes public, though she is required to hold the shares for at least six months before disposing of them.  During the following tax year, after her lockup period expires, she sells her shares for fair market value, leaving her portion of the pension plan holding proceeds of $100 million. Since at this time she is at least 50 years of age, assuming the terms of the pension plan permit her to begin withdrawing assets at age 50, the U.S. individual can cause the pension plan to distribute to her during that tax year $30 million of the pension plan funds without the imposition of any tax, either in Malta or the United States.

At this point, the pensioner would need to wait until year 4 to be able to extract additional profits tax-free (pursuant to Maltese law, three years must pass after the initial lump sum distribution before additional lump sum distributions could be made to a resident of Malta tax-free). Thus, in year 4, additional assets can be distributed to the member without triggering tax liability. To calculate how much can be distributed free of tax, it is necessary to first determine the pension holds “sufficient retirement income.” This amount in turn is based, pursuant to Maltese law, on the “annual national minimum wage” in the jurisdiction where the member is resident. To the extent the pension plan balance exceeds the member’s “sufficient retirement income” (on a lifetime basis), 50% of the excess can be withdrawn tax-free each year. Assuming the $70 million remaining assets (after accounting for the initial lump sum distribution) had increased in value to $85 million by year 4, and further assuming it was determined that the individual needed $1 million as her sufficient retirement income, 50% of the $84 million excess, or $42 million, could be distributed to her that year free of tax. Such calculations could likewise be performed in each succeeding tax year, with 50% of the excess being available for tax-free receipt by the beneficiary each year. Consequently, while it is not possible to distribute 100% of the proceeds of such a pension tax-free, a substantial portion of any income generated in the pension (including gains realized with respect to appreciation accrued prior to contribution of assets to the pension fund) may be distributed without any Maltese or U.S. tax liability.

Conclusion

Some commentators have suggested that the purported benefits of Maltese pensions in this context were not intended by Treasury in negotiating the Treaty and that therefore the use of such pensions in this manner is “too good to be true.” The underlying legal principles, however, are not so different from those that apply to Roths in the United States. Like participants in Roths, participants in Maltese pensions can contribute after-tax dollars to the plan and never pay future tax on profits realized with respect to assets held in the plan. Admittedly, the biggest differences relate to the unlimited amounts that may be contributed to Maltese pensions and the fact that prior appreciation in assets that are contributed to the plan also may avoid being subjected to any U.S. tax. Regardless, these distinctions result from features of domestic Maltese law (not U.S. law), and make the use of such pension plans by U.S. residents so potentially attractive.

[1] Note, however, that U.S. information filing obligations may be triggered to the U.S. transferor member pursuant to Section 6048. Unless otherwise noted, all Section references are to the Internal Revenue Code of 1986, as amended (the “Code”), and the Treasury regulations promulgated under the Code.

[2] For this purpose, the term resident includes a U.S. citizen.  Article 4(1) of the Treaty.

[3] It should be noted that the FIRPTA provisions of Section 897 and Section 1445 should not be applicable because the pension plan is treated as a foreign grantor trust for U.S. federal income tax purposes.

[4] Treasury Technical Explanation of the U.S.-Malta Income Tax Treaty, signed 8/8/2008, Article 17, paragraph 1.

[5] Under Section 72, a portion of each payment represents tax-free return of basis.

[6] Note that, as discussed above, there should be no U.S. tax implications on contribution of the assets (for example, under Section 684), as the pension plan should be classified as a grantor trust for U.S. federal income tax purposes.

This post was written by  Jeffrey L. Rubinger and Summer Ayers LePree of  Bilzin Sumberg Baena Price & Axelrod LLP.
Read more on the National Law Review.

Blockchain for the Humanitarian Sector

A network of global charities has begun using blockchain to provide costs savings and transparency to donations. Organisations including Oxfam, Save the Children, Mercy Corps and Christian Aid are three of the 42 members of the Start Network, which trialled the use of blockchain in humanitarian projects last year. The group will work on the project with start-up fund management platform Disberse.

Disberse uses blockchain, which records all transactions in a distributed digital ledger, to try to ensure that less money is lost on exchange rate fluctuations and traditional banking fees. It will also help charities to fight fraud, by tracking all transactions. The ultimate aim would be to track every dollar in aid, from original donor to each individual assisted.

The Start Network plans a three-stage experiment, using blockchain to:

  • Support decentralised decision making by the Start Fund, a peer-reviewed emergency relief fund aimed at rapid response to small-to-medium-scale disasters.
  • Trigger and speed up pay-outs, using “smart contracts” – self-executing arrangements that are guaranteed to deliver swiftly.
  • Enhance transparency by developing a form of “digital ledger” for use in all Start Fund transactions.

A report – Blockchain for the humanitarian sector – published in 2016 by the Digital Humanitarian Network for OCHA, the United Nations’ humanitarian affairs office, concluded:

  • Blockchain “has the potential to transform the humanitarian sector by providing cost savings and traceability of information flows, and by reducing transaction times”.
  • Potential uses are in information management, identification, supply chain tracking, cash programming and humanitarian financing.
  • Since the technology can offer solutions to existing humanitarian challenges, it may be wise to begin studying its impact and experimenting with future implementation.
This post was written byJonathan Lawrence of K & L Gates.

CFPB Proposes Additional Changes to the Prepaid Rule

On June 15, 2017, the CFPB announced that it is proposing for public comment certain modifications to its prepaid rule. The rule, which was issued in final form in October 2016, limits consumers’ losses for lost and stolen prepaid cards, requires financial institutions to investigate errors, and includes enhanced disclosure provisions.

The final rule unexpectedly granted Regulation E error resolution rights to consumers holding unregistered prepaid accounts, a provision that was not part of the CFPB’s original proposal. Financial institutions criticized this aspect of the final rule, arguing that providing error resolution rights to holders of unregistered accounts would invite and open new avenues for fraud. Financial institutions also argued that it would be difficult, if not impossible, to investigate alleged errors if they have little to no information about the purchasing customer. As a result, financial institutions have claimed that, if the CFPB retains error resolution rights for unregistered prepaid accounts, they would no longer provide immediate access to funds on such accounts.

To address these concerns, the current proposal would require consumers to register their prepaid accounts to qualify for Regulation E error resolution rights, including the right to recoup funds for lost or stolen cards. Under the CFPB’s proposal, however, Regulation E error resolution rights would apply to registered accounts even if the card was lost or stolen before the consumer completed the registration process.

The proposal also requests comment on provisions that would create an exception for certain digital wallets. Under the proposed exception, customers using digital wallets linked to a traditional credit card product would continue to receive Regulation Z’s open-end credit protections and would not receive the protections of the credit-related provisions of the prepaid rule.

As discussed in a prior post, in April 2017, the CFPB extended the compliance date for the prepaid rule from October 1, 2017, to April 1, 2018. In the latest proposal, the CFPB requests comment on whether it should extend the compliance date even further.

The proposal also includes other adjustments and clarifications regarding the definition of a prepaid account, pre-acquisition disclosure requirements, submission of prepaid account agreements to the CFPB, and unsolicited issuance of access devices. Along with its proposal, the CFPB has released an updated version if its Prepaid Rule Small Entity Compliance Guide.

Comments on the CFPB’s proposal are due 45 days after publication in the Federal Register.

This post was written by Lucille C. Bartholomew of Covington & Burling LLP.

The ERISA Fiduciary Advice Rule: What Happens on June 9?

This is an update on the upcoming effective date of the “fiduciary rule” or “fiduciary advice rule” (the “Rule”) that was issued under the US Employee Retirement Income Security Act of 1974 (ERISA). The Rule was published by the US Department of Labor (DOL) in April, 2016. The purpose of the Rule is to cause a person or entity to become a “fiduciary” under ERISA and the US Internal Revenue Code of 1986 (the “Code”) as a result of giving of certain types of advice involving investment of assets of employee benefit plans, such as 401(k) or pension plans, or of individual retirement accounts (IRAs) and receiving compensation for that advice.

calendar hundred daysThe Rule was originally intended to become effective April 10, but in April the DOL extended (the “Extension Notice”) the effective date of the Rule for 60 days (until June 9), and provided for reduced compliance obligations under the Rule from that date through the end of 2017 (the “Transition Period”). The effective date for Prohibited Transaction Exemptions (PTEs), both new and amended, that are related to the Rule also was extended until June 9, and further transitional relief was provided with respect to certain of those PTEs.

In a May 23 Op Ed in the Wall Street Journal, Labor Secretary Acosta announced that the Rule would go into effect on June 9, as provided for in the Extension Notice, and that the DOL would seek additional public comment on possible revisions to the Rule.  He indicated that the DOL “found no principled legal basis to change the June 9 date while we seek public input.”  The DOL also published, on May 23, FAQs on implementation of the Rule and an update of its previously-issued enforcement policy for the Transition Period. Therefore, it is important to review the rules that will go into effect on June 9.

Under the Rule, fiduciary status is triggered by investment “recommendations.” It provides, in general, that if a person (1) provides certain types of recommendations to a plan or its participants and/or beneficiaries, or to an IRA owner (collectively, “Protected Investors”); and (2) as a result, receives a fee or other compensation (direct or indirect), then that person is providing “investment advice for a fee” and therefore, in giving such advice, is a fiduciary to the Protected Investor. Receipt of compensation tied to such recommendations by a person or entity that is a fiduciary could result in prohibited transactions under ERISA and the Code. Under the Extension Notice, the DOL provided simplified compliance requirements under the Rule for the Transition Period.

This post was written by Gary W. HowellAustin S. LillingGabriel S. MarinaroRichard D. MarshallAndrew R. SkowronskiRobert A. Stone of Katten Muchin Rosenman LLP.

FINRA Releases Additional Guidance Related to Social Media

FINRA social media

The Financial Industry Regulatory Authority recently released Regulatory Notice 17-18, which contains guidance pertaining to social networking websites and business communications.

FINRA clarified a number of topics, including:

  • Member firms are obligated to retain a record of communications that occur via text messaging applications and chat services between its registered representatives and investors in accordance with Rules 17a-3 and 17a-4 promulgated under the Security Exchange Act of 1934, as amended, and FINRA Rule 4511.
  • An associated person may, in a personal communication, link to content made available by its firm that does not pertain to the firm’s products or services without implicating FINRA Rule 2210.
  • If a firm shares or links to content posted by a third-party website (e.g., an article or a video), the firm has adopted such content and must ensure that the content, when read together with the firm’s original post, complies with the same standards applicable to communications created by the firm. If the shared or posted content contains links to other content, a firm generally does not adopt that other content, although the firm may be deemed to have done so in certain circumstances (e.g., if the firm controls such other content). A firm may link to a section of a third-party website without adopting the content of such website if the link is continuously available to investors via the firm’s site (regardless of whether the linked site contains favorable information about the firm), the linked site could be updated by the third party and investors would still be able to use the link, and the firm does not influence or control the linked content.
  • Firms may use native advertising (i.e., advertising that appears alongside and in a manner similar to content posted by the publisher) provided that such advertising complies with FINRA Rule 2210, among other requirements.
  • Comments or posts about a firm’s brand, product or services that the firm has arranged to be posted must be labelled as advertisements. In addition, if a registered representative likes or shares favorable comments about him or herself that are posted by third parties on an unsolicited basis to such registered representative’s business-use social media website, the registered representative would be deemed to have adopted the comments and such comments would be subject to FINRA’s communication rules, including the prohibition on misleading or incomplete statements.

The guidance supplements, but is not intended to alter, guidance contained in previous FINRA regulatory notices pertaining to social media.

Regulatory Notice 17-18 is available here.

©2017 Katten Muchin Rosenman LLP

Proposed Federal Cybersecurity Regulations for Financial Institutions Face Uncertain Future

cybersecurity regulations for financial institutionsLast year’s proposed comprehensive framework for cybersecurity rules for large financial institutions is suddenly facing an uncertain future.1With the comment period having closed as of February 2017, the framework was facing criticism as unnecessary for an industry already subject to a host of federal, state, and international cybersecurity regimes. That criticism – now coupled with the Trump Administration’s general retreat from regulatory rulemaking across the board – may result in cybersecurity rules that are ultimately more limited in scope than originally envisioned, or lead to the proposed framework being abandoned altogether. In the meantime, large banks and other financial institutions must continue to comply with existing cybersecurity rules under the ever-growing scrutiny of regulators both in the United States and overseas.

I. Overview of the Proposed Framework

On October 19, 2016, three federal banking regulators – the Federal Reserve Bank (“FRB”), the Office of the Comptroller of the Currency (“OCC”), and the Federal Deposit Insurance Corporation (“FDIC”) – issued an advance notice of proposed rulemaking for new cybersecurity regulations for large financial institutions (i.e., institutions with consolidated assets of $50 billion) and critical financial infrastructure.2  The framework was intended to result in rules to address the type of serious “cyber incident or failure” that could “impact the safety and soundness” of not just the financial institution that is the victim of a cyberattack, but the soundness of the financial system and markets overall. Accordingly, the framework envisioned “enhanced standards for the largest and most interconnected entities… as well as for services that these entities receive from third parties.”3

The proposed framework broadly addresses five cybersecurity categories:

  • Cyber Risk Governance. This would require that institutions covered by the new rules develop – and their boards and management approve – an enterprise-wide cyber risk management strategy that articulates how it intends to address its inherent cyber risk and maintain system resilience. Among other things, a cyber strategy must (i) identify cyber risk; (ii) address mitigation strategies; (iii) establish reporting structures for cyber incidents; and (iv) provide a means of testing the effectiveness of the cyber strategy.4

  • Cyber Risk Management. This would require institutions covered by the new rules to adopt a “three lines of defense” risk management model for cyber risk that is often used by large corporations to manage other forms of risk, including traditional financial crime risk. The lines of the “defense” include (i) the business units, which would be tasked, as a first line of defense, with adhering to and implementing the new cyber policies, assessing risk, and reporting incidents; (ii) an independent risk management function, as a second line of defense, that would identify, measure, and monitor the effectiveness of the cyber risk controls in place and to report exceptions and incidents to senior management; and (iii) an independent audit function that would, as a third line of defense, assess whether the cyber risk management framework complies with applicable laws and regulations and is appropriate for the financial institution.5

  • Internal Dependency Management. This category refers to standards that are intended to ensure that financial institutions can effectively identify and manage risk associated with “internal dependencies,” such as, for example, a financial institution’s own employees, technology, and facilities. Examples of risks related to internal dependencies include those from insiders, data system failures, and problems arising from old legacy systems that were acquired through mergers. Among other things, the rules in this category would require financial institutions to maintain a current and complete list of all internal assets and business functions, including mapping the connections and information flows between those assets and functions.6

  • External Dependency Management. “External dependencies” refer to an entity’s relationship with “outside vendors, customers, utilities, and other external organizations and service providers that the entity depends on to deliver services, as well as the information flows and interconnections between the entity and those external parties.” Rules in this category would require financial institutions to maintain complete lists of all external dependencies, to analyze the risks associated with external relationships, and to identify and test alternative solutions in the event an external partner is compromised or otherwise fails to perform as expected. Further, the agencies propose that the standards apply directly to third-party vendors who provide financial services to banks (such as payment processors), including those vendors that provide services unrelated to banking or finance if those vendors nonetheless have trusted access to the bank’s computer systems.7

  • Incident Response, Cyber Resilience, and Situational Awareness. The final category is intended to ensure that financial institutions effectively plan for, respond to, and quickly recover from disruptions caused by cyber incidents – including incidents targeting their external service providers. These rules would require that institutions (i) provide for backup storage of critical records; (ii) establish contingency plans if the institution is unable to perform a service due to a cyber incident; (iii) test for cyber incidents; and (iv) identify and gather intelligence on potential threats.8

The proposed framework provides for additional, even more stringent, standards for anything deemed to be a “sector critical system,” which includes (i) systems that support the clearing or settlement of at least 5 percent of the value of transactions in certain financial markets; (ii) depository institutions that hold a “significant share” (approximately 5 percent) of the total deposits in the United States; and (iii) any system that serves as a “key node” to the financial sector.9 For “sector critical systems,” it proposes that financial institutions adopt additional rules and safeguards, including:

  • requiring that financial institutions minimize the cyber risk posed to “sector critical systems” by implementing the most effective, commercially-available means of protection;10 and

  • requiring that financial institutions establish a recovery time, validated by testing, for “sector critical systems” of 2 hours after a harmful cyber attack.11

Finally, in terms of implementing the standards proposed in the framework, the proponent agencies propose three alternatives: (i) a general regulatory requirement for covered entities to maintain an appropriate cybersecurity risk management program supplemented by policy statements that set forth minimum expectations and standards; (ii) comprehensive regulations that propose specific cyber risk management standards; or (iii) comprehensive regulations that propose specific cyber risk management standards and which contain detailed objectives and practices that firms would be required to adopt.12

II. Potential Hurdles

Recent developments call into question whether the rules prepared as a result of the proposed framework will be as strict as originally envisioned, or whether any new rules will be adopted at all.

First, although some of the comments received during the comment period welcomed the interest in this area, many were critical of the new standards. In general, the comments raised several common concerns, including the following:

  • New rules would, if implemented, join a host of other, already-existing mandatory state, federal, and foreign cybersecurity regulations, including those required under the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, and, most recently, the strict cybersecurity regime adopted by the New York State Department of Financial Services.13 In addition, there are a number of voluntary standards that many financial institutions already follow, such as the Cybersecurity Framework published by the National Institution of Standards and Technology (“NIST”), the Payment Card Industry Data Security Standard, and the Federal Financial Institutions Examination Council’s Cybersecurity Assessment Tool.14 Few, if any, of these competing regimes are harmonized with each other and, as a result, the adoption of yet another cybersecurity regulation would add to the already heavy regulatory burden facing financial institutions without, necessarily, resulting in improved cybersecurity.15

  • To the extent that the proposed framework contemplates applying new cybersecurity rules not just to financial institutions but also to their third-party service providers, there is a concern that rules tailored for large financial institutions would not easily down-scale to smaller companies in different industries and with different risk profiles.16 Further, the additional compliance costs imposed on third-party vendors could potentially drive them away from providing services to the financial sector or stifle innovation.17

  • As an alternative to binding, prescriptive rules, the agencies should consider adopting a set of flexible, risk-based guidelines, similar to the NIST Cybersecurity Framework, that would allow financial institutions to assess and mitigate their particular cybersecurity risks. Specific, prescriptive rules are likely to become outdated by technological developments and, further, encourage regulated entities to focus on merely complying with the rules rather than seeking to comprehensively address their outstanding cybersecurity risks.18

Second, the Trump Administration itself has signaled that it has a limited appetite for major new regulations. Shortly after taking office, President Trump told a group of business leaders that he intends to cut federal regulations by 75 percent or “maybe more.”19 On January 30, 2017, the President signed an executive order which, among other things, required that federal agencies identify two existing regulations for elimination for each new regulation that is proposed.20 Although the “two-for-one” limitation does not apply to independent regulatory agencies such as the FRB, the OCC, and the FDIC,21 the White House nonetheless stated that it is encouraging independent regulatory agencies to “identify existing regulations that, if repealed or revised, would achieve cost savings that would fully offset the costs of new significant regulatory actions.”22

Finally, although the Trump Administration has not yet settled on a comprehensive cybersecurity policy, early indications show that it is likely to favor “public-private” partnerships and other incentives over new mandatory regulations. For example, President Trump’s pick to head the Securities and Exchange Commission, Jay Clayton, has said that he does not believe in regulations to impose cybersecurity mandates on businesses.23Further, an early draft of a proposed Executive Order on cybersecurity – which has not yet been signed – directed the federal government to study “economic or other incentives” to encourage the private sector to adopt effective cybersecurity measures.24 This suggests that the Trump Administration is considering a host of ways to promote cybersecurity risk management in the private sector beyond compulsory regulations.

III. Conclusion

Industry opposition, coupled with the stated reluctance of the Trump Administration to pursue broad new regulatory regimes, may result in the proposed cybersecurity framework being scaled back or even left to wither and die on the vine. However, even in their absence banks and other large financial institutions must continue to comply with the plethora of existing state, federal, international, and industry standards that already apply. Whether and how the proposed framework – and any new rules that emerge therefrom – fits into the existing regulatory scheme so far remains to be seen.

© Copyright 2017 Cadwalader, Wickersham & Taft LLP


See Press Release, Agencies Issue Advanced Notice of Proposed Rulemaking on Enhanced Cyber Risk Management Standards (Oct. 19, 2016),available at https://www.federalreserve.gov/newsevents/press/bcreg/20161019a.htm.

2 Enhanced Cyber Risk Management Standards (Oct. 19, 2016), available athttps://www.federalreserve.gov/newsevents/press/bcreg/bcreg20161019a1.pdf.

3   Id. at 8.

4   Id. at 24-26.

5   Id. at 26-29.

6   Id. at 31-32.

7   Id. at 33-35.

8   Id. at 39.

9   Id. at 39.

10  Id. at 40.

11  Id.

12  Id. at 44-45.

13  See, e.g., Comments of Consumer Data Industry Association, at 2-6 (Jan. 12, 2017), available athttps://www.federalreserve.gov/SECRS/2017/February/20170206/R-1550/R-1550_011317_131681_551357712049_1.pdf. We note that any financial institution large enough to be covered by the proposed standards is likely to have operations outside of the U.S. and, thus, may be subject to cybersecurity or data protection regimes in other jurisdictions, such as the EU’s General Data Privacy Regulation (“GDPR”). We discussed the GDPR in a recent Clients & Friends Memorandum. See S. Baker, J. Facciponti, J. Rennie, and J. Tampi, The EU’s New Data Protection Regulation – Are Your Cybersecurity and Data Protection Measures up to Scratch? (Mar. 6, 2017). We further discussed the New York State cybersecurity rules in a separate client memorandum. See J. Facciponti, J. Moehringer, and H. Wizenfeld, New York State Revises “First-In-Nation” Cybersecurity Rules (Jan. 10, 2017).

14  See, e.g., Comments of SIFMA, ABA, and IIB, at 3 (Feb. 17, 2017), available athttps://www.federalreserve.gov/SECRS/2017/February/20170221/R-1550/R-1550_021717_131711_434399470067_1.pdf (“The Agencies’ [proposed rules] risks undermining the cybersecurity efforts of financial institutions by failing to fully recognize extensive efforts that firms have already made to implement risk-based approaches such as the NIST Cybersecurity Framework and existing federal requirements.”) (“SIFMA Comments”); Comments by the U.S. Chamber of Commerce, at 4-5 (Jan. 18, 2017), available athttps://www.federalreserve.gov/SECRS/2017/February/20170208/R-1550/R-1550_011817_131688_286658311250_1.pdf (“Chamber of Commerce Comments”).

15  See, e.g., Comments of Financial Services Sector Coordinating Council, at 5 (Feb. 17, 2017), available athttps://www.federalreserve.gov/SECRS/2017/February/20170221/R-1550/R-1550_021717_131709_429070260162_1.pdf; Comments of Financial Services Roundtable/BITS, at 3-4 (Feb. 16, 2017), available athttps://www.federalreserve.gov/SECRS/2017/February/20170221/R-1550/R-1550_021617_131723_560608420203_1.pdf; Comments of Electronic Transactions Association, at 1-4 (Feb. 13, 2017), available athttps://www.federalreserve.gov/SECRS/2017/March/20170307/R-1550/R-1550_030717_131766_542476603001_1.pdf (“ETA Comments”); Chamber of Commerce Comments, at 10-11.

16  See, e.g., ETA Comments, at 5; Comments of Mastercard Worldwide, at 3-4 (Jan. 17, 2017), available athttps://www.federalreserve.gov/SECRS/2017/February/20170203/R-1550/R-1550_011717_131679_551358024222_1.pdf; Comments by IHS Markit, at 4 (Feb. 17, 2017), available at https://www.federalreserve.gov/SECRS/2017/March/20170303/R-1550/R-1550_021717_131731_315895562414_1.pdf.

17  See, e.g., Comments of Amazon Web Services, at 5 (Feb. 17, 2017), available athttps://www.federalreserve.gov/SECRS/2017/March/20170307/R-1550/R-1550_030717_131764_542476134029_1.pdf; SIFMA Comments, at 5.

18  See, e.g., Comments by Information Technology Counsel, at 13 (Feb. 17, 2017), available athttps://www.federalreserve.gov/SECRS/2017/March/20170303/R-1550/R-1550_021717_131706_428178516928_1.pdf; Comments by Business Roundtable, at 2 (Feb. 13, 2017), available at https://www.federalreserve.gov/SECRS/2017/February/20170227/R-1550/R-1550_021417_131700_411451111014_1.pdf; Chamber of Commerce Comments, at 3, 6-10 (“There is no regulatory silver bullet for cybersecurity. The complex, dynamic nature of cyber risk makes pursuing flexible, tailored approaches critical.”); Comments of North American CRO Council, at 1 (Jan. 17, 2017), available at https://www.federalreserve.gov/SECRS/2017/February/20170203/R-1550/R-1550_011717_131686_503116251901_1.pdf.

19  See J. Pramuk, Trump tells business leaders he wants to cut regulations by 75% or ‘maybe more’, CNBC (Jan. 23, 2017), available athttp://www.cnbc.com/2017/01/23/trump-tells-business-leaders-he-wants-to-cut-regulations-by-75-percent-or-maybe-more.html.

20  See Executive Order, Reducing Regulation and Controlling Regulatory Costs (Jan. 30, 2017), available athttps://www.whitehouse.gov/the-press-office/2017/01/30/presidential-executive-order-reducing-regulation-and-controlling.

21  See 44 U.S.C. § 3502(5).

22  See Memorandum: Interim Guidance Implementing Section 2 of the Executive Order of January 30, 2017, Titled, “Reducing Regulation and Controlling Regulatory Costs” (Feb. 2, 2017), available at https://www.whitehouse.gov/the-press-office/2017/02/02/interim-guidance-implementing-section-2-executive-order-january-30-2017.

23  See Roger Yu, Honed by Wall Street: What Makes Trump SEC Chair Pick Jay Clayton Tick, USA Today (Jan. 4, 2017), available athttp://www.usatoday.com/story/money/2017/01/04/donald-trumps-sec-chair-nominee-comes-deep-wall-street-ties/96162306/.

24  See Draft Executive Order, Strengthening U.S. Cyber Security and Capabilities, at 4-5, available athttps://apps.washingtonpost.com/g/documents/world/read-the-trump-administrations-draft-of-the-executive-order-on-cybersecurity/2306/.

IOSCO Releases Report on Fintech

IOSCO Fintech financial technologyThe International Organisation of Securities Commissions (IOSCO) has released a new report that says that changes resulting from FinTech are testing the boundaries of full disintermediation through the use of technology.  IOSCO is the international body that brings together the world’s securities regulators and is a global standard setter for the securities sector. IOSCO develops, implements and promotes adherence to internationally recognised standards for securities regulation. It works with the G20 and the Financial Stability Board on the global regulatory reform agenda.

The report incorporates the finding of three surveys:

  1. the Committee on Emerging Risks (CER) and the Growth and Emerging Markets Committee (GEMC) survey to gain further insight on the types of FinTech firms in respective jurisdictions, key regulatory actions taken by members, and the practices of FinTech firms in onboarding investors;

  2. the CER, the Affiliate Members Consultative Committee, and World Federation of Exchanges survey on distributed ledger technology; and

  3. a GEMC survey reviewing the state of development of FinTech in emerging markets, including existing and potential regulatory implications.

The report particularly examines:

  • Financing Platforms, including Peer-to-Peer (P2P) lending and equity crowdfunding (ECF)

  • Retail Trading and Investment Platforms, including robo-advisers and social trading and investing platforms

  • Institutional Trading Platforms, with a specific focus on innovation in bond trading platforms

  • Distributed Ledger Technologies (DLT), including application of the blockchain technology and shared ledgers to the securities markets.

ARTICLE BY Jonathan Lawrence of K&L Gates

Copyright 2017 K & L Gates

Six Reasons Why Wholesale Repeal of Dodd-Frank is Unlikely

Donald Trump Dodd Frank repealIn the days following the November elections, U.S. President-elect Donald J. Trump promised that his Financial Services Policy Implementation team would be working to “dismantle” the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”). However, a more recent account in the Wall Street Journal reported Mr. Trump’s transition team as tempering his promise in favor of rescinding or scaling back the individual provisions Republicans find most objectionable.

In light of the current political and macro-economic environment, here are six reasons why a wholesale repeal of Dodd-Frank is unlikely to occur:

  • Congressional Resistance – A wholesale repeal of Dodd-Frank would have to be effectuated through congressional action and would likely face a democratic filibuster. This would require opponents of Dodd-Frank to muster a 60-vote block in the Senate in order to advance the proposal. Legislative horse-trading to achieve specific objectives that are key to the Republican majority may ultimately prove to be more strategically advantageous.

  • Public Perception – Actions of the new administration which could be perceived as advocating for easing the burden on the financial services industry may alienate the middle-class constituency who were significantly impacted by the great recession and who ultimately propelled Mr. Trump to the Presidency.

  • Balance of Cost – Following massive investments in infrastructure and processes, the industry may perceive the costs of undoing the compliance programs put in place subsequent to Dodd-Frank as outweighing the benefits to be derived from decreased regulation.

  • Accepted Expectations – Counterparties have come to accept the safeguards and reporting requirements put in place by Dodd-Frank as constituting baseline expectations in business transactions. A repeal of Dodd-Frank would leave industry participants to reconstruct by contract what may have been previously mandated under law.

  • International Developments – In the wake of the Brexit vote, international financial organizations may be evaluating the relocation of their operational centers to locations in the U.S. The possibility of significant financial regulatory overhauls and the accompanying specter of an unknown business environment may dissuade consideration of the U.S. by such organizations.

  • Absence of a Perceptible Problem – Dodd-Frank was passed on July 21, 2010 with the wake of the great recession providing momentum and popular support for its enactment. Conversely, there is no corresponding economic situation presently existing that critics can point to for its repeal. The DJIA is up approximately 90% since July 2010. The real estate market has remained strong and, even with the recent increase by the Fed, interest rates remain low, allowing consumers access to both homeownership and financing on attractive terms.

In addition to the issues identified above, the incoming Presidential administration and congressional delegation may face additional hurdles in advancing comprehensive legislative initiatives to pare back Dodd-Frank. As the post-election environment cools and the country marches towards inauguration day, the financial services industry can only hope that clarity on the direction of the U.S. regulatory environment begins to emerge.

The Post-Election FinTech World: Are Happy Days (for Bankers) Here Again?

Fintech financial technologyIn the days following the U.S. federal elections that resulted in the election of Donald Trump as President and Republican control of the 115th Congress, FinTech companies, banks, and other financial institutions are increasingly asking whether they still need to worry about compliance with the landmark Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”), Consumer Financial Protection Bureau (“CFPB”) regulatory actions, and other financial services regulations.

It is true that there will likely be some significant regulatory changes, but it is a little too early for industry participants to pop the champagne corks.  Here are our thoughts about some of the top issues impacting FinTech companies, banks, and other financial institutions:

Dodd-Frank and the CFPB

Created under Dodd-Frank in response to the financial crisis of 2007–2008, the CFPB’s stated aim is “to make consumer financial markets work for consumers, responsible providers, and the economy as a whole.”  Since its inception, the CFPB has regulated the consumer financial services marketplace through sweeping rulemakings, including the recent issuance of a long-awaited final rule for prepaid accounts.[1]  Precedent-setting enforcement actions also have been increasingly utilized by the CFPB in lieu of, or as a precursor to, rulemakings promulgated in accordance with the Administrative Procedure Act.  Policymakers, banks, and others within the broader financial services industry have criticized the CFPB for regulatory overreach and for imposing burdensome, duplicative regulations on market participants that ultimately impact on consumer choice.[2]

It is no surprise, therefore, that revising the CFPB’s structure and operations to try to make the agency more transparent and accountable is among the top priorities of both the incoming Administration and Congress as part of reform of Dodd-Frank.  Some version of House Financial Services Committee Chairman Jeb Hensarling’s (R-TX) financial reform legislation (H.R. 5983, the “Financial CHOICE Act” or “FCA”), will undoubtedly serve as a basis for any reform efforts undertaken in the early days of the Trump Administration and the new Congress.  Although the CFPB will likely survive in the new Administration and Republican-led House and Senate, the FCA furnishes a blueprint for the kinds of reforms that likely will be made.

The FCA contains provisions that would make significant modifications to the structure of the CFPB by making it an independent agency outside of the Federal Reserve to be headed by a five-member commission, instead of a single director.  The FCA would rename the CFPB the “Consumer Financial Opportunity Commission” and would give the agency the mission of consumer protection and competitive markets.  The FCA would also subject the CFPB’s funding to the Congressional appropriations process.  The FCA also includes provisions designed to address the CFPB’s use of enforcement actions by repealing the agency’s authority over “abusive practices” in the consumer financial services industry.  In addition, the FCA also contains H.R. 5413, the “CFPB Data Accountability Act,” which would require the CFPB to verify a consumer complaint prior to posting it on the CFPB’s website.

Durbin Amendment

The FCA also contains a provision that would repeal the “Durbin Amendment,” which limited the interchange fees that banks charge merchants to process electronic debit transactions.  Following enactment of Dodd-Frank, many payments industry participants raised concerns that small banks and low-and moderate-income consumers have been adversely impacted by the Durbin Amendment, while retailers have disproportionately benefited.  Given the anticipated focus of the Trump Administration and new Congress on the promotion of financial market innovation and competitiveness, it is increasingly likely that changes to this provision could be considered as part of broader financial regulatory reform efforts.  Whether it will be entirely repealed is another question.  Merchants, who fought hard for the Durbin Amendment by arguing that the high fees imposed by major banks and the payment networks were unfair, can be expected to vigorously oppose such an effort.

Regulatory Outlook

The regulatory outlook for the CFPB for the near future will likely be impacted by a number of important factors, including the outcome of the CFPB’s recent petition to the U.S. Court of Appeals for the District of Columbia Circuit (“D.C. Circuit”), which requested the full D.C. Circuit to rehear PHH Corp. v. CFPB.[3]  The petition follows the recent holding in PHH by a three-judge panel of the D.C. Circuit that the CFPB’s existing structure is unconstitutional and that the director of the CFPB serves at the pleasure of the President.[4]  President-elect Trump currently has the ability to remove current CFPB Director Richard Cordray “for cause” and to nominate a replacement to be confirmed by the Senate.  Such a change in the director of the CFPB before the D.C. Circuit makes a decision on whether to rehear PHH could have significant implications for the CFPB’s regulatory activities.  Republicans in the 115th Congress also are expected to use the Congressional Review Act (“CRA”) to repeal certain regulations recently issued during the Obama Administration.  However, many of the CFPB’s rules are expected to remain in place but be subject to additional Congressional scrutiny.  Notably, some Congressional Republicans have previously expressed concerns about the broad scope of the CFPB’s rule on prepaid accounts, although it is not yet clear whether the rule will be among the regulations that could be the focus of repeal efforts through use of the CRA.  Additionally, Congressional Republicans will likely subject the CFPB’s operations to heightened oversight and will probably seek to repeal the agency’s authority to prohibit arbitration agreements and to issue guidance related to indirect automobile lending.

Enforcement Outlook Generally

Although the CFPB’s activities may be reduced through reformation of the agency or an appreciable change in its leadership, such changes are also likely to be accompanied by heightened regulatory and enforcement efforts by state government officials and an increase in efforts by consumers to seek redress in the courts.  Anticipating that the incoming Administration could result in a reduction of enforcement activities against banks and financial institutions at the federal level, many state attorneys general are indicating that they will step into the vacuum to protect consumers if necessary.  It has been widely reported,[5] for example, that both New York and California attorneys general intend to fill any regulatory enforcement void created by the incoming Administration.  Nevertheless, a shift in the CFPB’s enforcement priorities may have a lasting impact on financial institutions and financial markets.

Conclusion

Going forward, payments companies and other consumer financial services industry participants should certainly monitor changes in laws, regulations, and enforcement actions closely as they seek to better understand these changing legal and regulatory dynamics and the nature of the regulations with which they will be required to comply.

Copyright 2016 K & L Gates

[1] See, Eric A. Love, Judith Rinearson and Linda C. Odom, CFPB Finalizes Expansive Prepaid Account Rule Creating New Compliance Hurdles, K&L Gates Legal Insight, (Nov. 2016), https://www.fintechlawblog.com/wp-content/uploads/2016/11/FinTech-blog-4….

[2] See, e.g., Press Release, House Financial Services Committee, Who will protect consumers from the overreach of the Consumer Financial Protection Bureau? (Mar. 3, 2015), http://financialservices.house.gov/news/documentsingle.aspx?DocumentID=3….

[3] See, Respondent Consumer Financial Protection Bureau’s Petition for Rehearing En Banc, No. 15-177 (D.C. Cir. Nov. 18, 2016) (Doc. #1646917).

[4] See, PHH Corp. v. Consumer Financial Protection Bureau, No. 15-1177 (D.C. Cir. Oct. 11, 2016).

[5] See, e.g., Joel Stashenko, Trump Presidency Could Shift Regulatory Spotlight to State and AG, N.Y. Law Journal, Nov. 14, 2016.

DOJ-AmEx Case Could Have Ramifications for Health Care Providers

AmEx American ExpressThe U.S. Department of Justice’s loss to American Express sends a message to health care providers: Steering, tiering, exclusive dealing and other contractual arrangements that appear to suppress competition in one part of the market may be legitimate where the arrangements facilitate lower prices and better access to services in another part of the market, or have other valid business purposes.

The decision came Sept. 26 when the Second Circuit Court of Appeals reversed a judgment for the DOJ in a suit accusing AMEX of violating antitrust laws by initiating rules prohibiting merchants who accept AMEX’s credit cards from steering its cardholders to other credit card brands. The court of appeals directed the district court to enter a judgment for AMEX, saying the trial court erred when it found that AMEX’s anti-steering provisions were anticompetitive by focusing only on the interests of merchants and not also on those of cardholders.

The court of appeals said that the district court’s approach “does not advance overall consumer satisfaction.” It concluded that “[t]hough merchants may desire lower fees, those fees are necessary to maintaining cardholder satisfaction—and if a particular merchant finds that the cost of AMEX fees outweighs the benefit it gains by accepting AMEX cards, then the merchant may choose to not accept AMEX cards.”

At issue was whether AMEX’s nondiscriminatory provisions (“NDPs”) in agreements with merchants prohibiting them from encouraging consumers to use other credit cards were anticompetitive. The court of appeals found that the trial court’s ruling against AMEX was wrong in several ways, including its market definition, its analysis of AMEX’s market power and its finding of an adverse effect on competition.

The district court wrongly concluded that the relevant product market consisted of services offered by credit card companies to merchants, while excluding services offered to cardholders. The Second Circuit said that the functions provided by the credit card industry are inter-dependent, and result in what is called a “two-sided market.” The district court erroneously failed “to define the relevant product market to encompass the entire multi-sided platform.”

In addition, the court of appeals said that the district court erroneously determined that AMEX had significant market power. The trial court found that AMEX was able to unilaterally impose price increases on merchants, but it did not acknowledge that AMEX’s increase in merchant fees was necessary to provide increased benefits to cardholders, which amounts to a price reduction to cardholders. “A firm that can attract customer loyalty only by reducing its price does not have the power to increase prices unilaterally.”

Also, the district court’s erroneous market definition resulted in it wrongly finding that the NDPs had an anticompetitive effect on the market. The court of appeals said that “the market as a whole includes both cardholders and merchants, who comprise distinct yet equally important and interdependent sets of consumers sitting on either side of the payment-card platform.” The DOJ made no showing at trial that the NDPs caused anti-competitive effects on the relevant market as a whole.

In 2011, the DOJ issued a policy giving guidance to accountable care organizations that said anti-steering provisions may raise antitrust concerns and should not be implemented by providers with a large market share. Federal Trade Commission and Department of Justice, “Statement of Antitrust Enforcement Policy Statement Regarding Accountable Care Organizations Participating In the Medicare Shared Savings Program,” 76 Fed. Reg. 67026, 76030 (2011) (“An ACO with high PSA shares or other possible indicia of market power may wish to avoid . . . [p]reventing or discouraging private payers from directing or incentivizing patients to choose certain providers, including providers that do not participate in the ACO, through ‘anti-steering,’ ‘anti-tiering,’ ‘guaranteed inclusion,’ ‘most-favored-nation,’ or similar contractual clauses or provisions”).

Healthcare markets have aspects of a two-sided market, including separate interests of insurers and of patients. As a result, after AMEX, claims that steering provisions initiated by providers are anticompetitive because they thwart competition with other providers in the market will likely be evaluated by fully considering the anticompetitive effect of the provisions on the entire marketplace, rather than taking the DOJ’s more narrow enforcement view.

AMEX’s analysis likely has ramifications for any case challenging steering provisions or other allegedly anticompetitive restraints in multi-sided markets. For example, Methodist Medical Center in Peoria, Illinois, brought suit against its rival, St. Francis Medical Center, also in Peoria, challenging St. Francis’ exclusive contracts with health insurers that allegedly foreclosed Methodist from competing for patients in the Peoria hospital market. Consistent with the analysis of antitrust violations that was used in AMEX, on Sept. 30 a federal district court granted summary judgment for St. Francis, saying:

“Market dynamics at each level impact the ultimate inquiry of whether a provider is foreclosed from competing for a commercially insured patient’s business. Accordingly, whether Methodist was foreclosed from competition must be analyzed at each level in the distribution chain—its ability to compete to be included in a payer’s network, the ability of end users to choose among plans that feature each hospital, and also the hospitals’ ability to reach retail customers notwithstanding out-of-network status.”

Applying this analysis at each level, the court found that the exclusive arrangements excluded Methodist from a limited portion of patients and, as a result, the arrangements did not violate antitrust law.

© Polsinelli PC, Polsinelli LLP in California