login-customizer domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home1/natiopq9/public_html/wp-includes/functions.php on line 6131The post Community Banks and Overdrafts — Time for Reconsideration? appeared first on The National Law Forum.
]]>Bank consumer overdraft fees (together with nonsufficient funds (NSF) fees and returned check fees) have long been a target of attacks by consumer advocacy groups and progressive politicians who claim that such fees are disproportionately levied on the most vulnerable consumers. The Obama-era Consumer Financial Protection Bureau (CFPB) initiated efforts to regulate overdraft programs, which were shelved during the Trump administration, and legislation to restrict overdraft fees has regularly been proposed and considered by Congress, but not enacted.
2022, however, may be the year that the US financial regulatory agencies finally move to impose formal restrictions on banks’ overdraft fee programs. In particular, the CFPB, increasingly assertive in President Biden’s second year in office, has clearly signaled its intent to take action in this area:
The attack on overdraft fee programs has been echoed by other administration officials as well as by allied politicians. Acting Comptroller of the Currency Michael Hsu has called traditional bank overdraft programs “a significant part” of a “regressive system” that penalizes the poor and has stated that “banks that hesitate to adopt pro-consumer overdraft programs will soon be negative outliers.” On March 31, 2022, the House Financial Services Subcommittee held a hearing on possible government intervention to restrict overdraft programs, clearly showing coordination by the committee majority with the Biden administration’s initiatives. In March 2022, a group of US Senate Democrats (including Banking Committee Chairman Sherrod Brown) sent letters to seven large banks urging them to abolish or significantly reduce overdraft and other fees, and in early April, New York Attorney General Letitia James, in recent letters signed by numerous other state attorneys general, asked the country’s four largest banks to eliminate consumer overdraft fees altogether by summer 2022.
Adding to the chorus of Biden administration and other political voices critical of overdraft fees has been a steady stream of announcements over the past year by many large banks regarding plans to eliminate or greatly restrict their overdraft and related fees. In January 2022 alone, five of the country’s largest banks announced the planned elimination of NSF fees and certain overdraft charges. These announcements add weight to the CFPB’s attacks on overdraft fee programs and will inevitably result in additional pressure on other large banks to follow suit.
The bottom line is that federal regulation of this area may finally be on the horizon, if not imminent, although it is anyone’s guess what form regulatory action will take. The initial targets of any action taken by the CFPB — whether formal rulemaking, statements of policy, or increased enforcement activity — are likely to be banking companies that have total assets in excess of $10 billion and that are thus subject to direct supervision by the CFPB. However, whatever new policy is implemented by the CFPB in this area will inevitably be applied by the three principal federal banking agencies to financial institutions of all sizes, and community banks should prepare themselves for increased examination scrutiny of their overdraft fee programs and the potential for enforcement actions.
Accordingly, community banks — especially those heavily reliant on overdraft fee income — should review their overdraft programs, ensure that they are compliant with existing regulations and best practices, and consider changes to respond to possible regulatory concerns. While it is impossible to react effectively to a regulatory regime that has not been proposed, much less implemented, reports and statements by the CFPB and other banking agencies provide some guidance. First, the CFPB has indicated that it will demand transparent and fully disclosed pricing of overdraft solutions that allow consumers to make an informed choice. In addition, Acting Comptroller Hsu stated in a December 2021 speech — in which he notably did not call for banks to eliminate overdraft fees — that the OCC had identified several features of bank overdraft programs that could be modified or recalibrated to help achieve the goal of improving the financial health of vulnerable consumers. He stated that these changes included:
Finally, community banks should closely monitor CFPB and other bank regulators’ overdraft fee initiatives, through state and national bankers associations and otherwise, and continue to explore potential methods of managing their overdraft programs in line with stated and possible future regulatory concerns.
The post Community Banks and Overdrafts — Time for Reconsideration? appeared first on The National Law Forum.
]]>The post Russian Sanctions Create Patent Risks appeared first on The National Law Forum.
]]>While multi-national sanctions recently imposed on Russia were intended to punish Russia for its aggression in Ukraine, the effects of the sanctions have led to a need for tough decisions for U.S. entities with patent interests in Russia. The prohibitions on financial exchanges with certain Russian banks will essentially prevent any payment of fees to Rospatent (the Russian patent office), and although a general license from the Department of the Treasury provides a short window for winding down certain administrative transactions, U.S. entities engaged in patent transactions with Rospatent only have a short time to make decisions about current and future patent activities in Russia.
On February 28, 2022, the Department of the Treasury initiated prohibitions related to transactions involving certain financial institutions in Russia, including the Central Bank of the Russian Federation.1 The directive specifically prohibits a United States person (unless otherwise excepted or licensed) from engaging in any transaction involving the listed financial institutions, including any transfer of assets to such entities or any foreign exchange transaction for or on behalf of such entities. Under the directive, the prohibitions are specifically worded to include: (1) any transaction that evades or avoids, has the purpose of evading or avoiding, causes a violation of, or attempts to violate any of the prohibitions of the directive; and (2) any conspiracy formed to violate any of the prohibitions of the directive.
Notably, the prohibited activities do not expressly prevent any transactions of a U.S. person with Rospatent. And although the United States Patent and Trademark Office (USPTO) has cut off direct engagement with Rospatent for carrying out activities such as use of the Global Patent Prosecution Highway (GPPH) program2, Rospatent is not currently a sanctioned entity under the directive. This, however, is essentially a distinction without a difference. Moreover, since the USPTO (and also the European Patent Office) has already cut ties with Rospatent, there still remains the possibility that Rospatent itself will be added to the sanctions at a future date and thus completely eliminate any pursuits by U.S. persons with Rospatent.
The current sanctions directly affect entities seeking patent protection in Russia since payments of required fees related to patent applications and granted patents in Russia are processed through the Central Bank of the Russian Federation. This includes a number of financial transactions, such as payment of government filings fees for directly filing a patent application in Russia or filing a national phase of an international PCT application in Russia, as well as incidental fees incurred during prosecution of pending Russian patent applications and payment of yearly maintenance fees for issued Russian patents. This would also include payment of yearly maintenance fees for patents obtained through the Eurasian Patent Organization (EAPO) and maintained in Russia since such fees paid to the EAPO must be forwarded to Rospatent. Because of the intertwining of Rospatent with the Central Bank of the Russian Federation, any fees paid to Rospatent must be considered equivalent to making a transaction through said bank.
Patent prosecution in Rospatent requires engagement with a Russian patent practitioner. While U.S. entities pursuing patent interests in Russia are unlikely to directly engage Rospatent and pay fees that are ultimately processed through the prohibited bank, it is clear from the directive that strategies, such as routing payments through countries that are neutral in relation to sanctions, are prohibited. As noted above, the directive prohibits any transaction that actually “evades or avoids” the other prohibitions of the directive, as wells as any transaction that “has the purpose of evading or avoiding” the other prohibitions. This language appears to have the potential to ensnare purposeful non-adherence as well as actions that unwittingly end in non-adherence (e.g., forgetting to discontinue an automated payment of a patent maintenance fee to Rospatent).
U.S. entities still have time to complete administrative transactions with Rospatent despite the February implementation of the directive. On March 2, 2022, the Department of the Treasury issued a general license authorizing certain transactions that are otherwise prohibited by the directive.3 The license authorizes U.S. persons to pay taxes, fees, or import duties, and purchase or receive permits, licenses, registrations or certifications to the extent such transactions are prohibited under the directive, provided such transactions are ordinarily incident and necessary to such persons’ day-to-day operations in the Russian Federation. For at least U.S. entities whose day-to-day operations include securing and maintaining intellectual property, including in Russia, this license provides a window to complete activities and avoid violation of the directive. Currently, the transaction window provided under the license runs through 12:01 a.m. eastern daylight time on June 24, 2022.
The incursion of Russia into Ukraine has been underway for shortly more than one month, but there is no way to know when hostilities may cease. Moreover, even when peace is achieved, it is impossible to know how long the current sanctions against Russia may continue. Those familiar with patent law know that the business of obtaining patents is a deadline-driven venture, and uncertainty of time quickly breaks apart the paradigm. A “wait and see” approach thus has the potential to result in a loss of patent rights as well as possible liability for knowingly or unknowingly engaging in activities that are prohibited under the directive. Anyone engaged in patent activities in Russia thus would be advised to undertake a portfolio review and utilize the time remaining under the General License to form a plan that ensures compliance with the current sanctions. This can include at least the following items.
Anyone engaged in patent activities in Russia thus would be advised to undertake a portfolio review and utilize the time remaining under the General License to form a plan that ensures compliance with the current sanctions.
For anyone with significant patent interests in Russia, time is of the essence for cementing a strategy for moving forward. For some, the most expeditious approach could be to simply close your file on any Russian patents and patent applications. If such approach is taken, careful attention must be made, as noted above, to ensure that any possibility of a fee being paid to Rospatent after June 24, 2022, is eliminated. For others, investments in Russia may not allow for a complete abandonment of possible future patent enforcement rights in Russia. If actions as noted above are taken to “batten down the hatches” of the Russian patent portfolio prior to the deadline in order to weather this storm, timing is again crucial in order to avoid unintentional engagement in sanctioned activities. Also, moving to patent filings through the EAPO as a starting point for Russia can be an effective workaround so long as Russian sanctions get lifted before any patent annuities through an EAPO patent would become due in Russia. Finally, in forming a strategy, one also must consider that even before its recent decree on patent enforceability, Russia was already one of nine countries on the United States Trade Representative (USTR) “Special 301 Report” of trading partners presenting the most significant concerns regarding insufficient IP protection or enforcement or actions that otherwise limited market access for persons relying on intellectual property protection.
1 Directive 4 Under Executive Order 14024, “Prohibitions Related to Transactions Involving the Central Bank of the Russian Federation, the National Wealth Fund of the Russian Federation, and the Ministry of Finance of the Russian Federation,” February 28, 2022, Office of Foreign Assets Control, Department of the Treasury. See, https://home.treasury.gov/system/files/126/eo14024_directive_4_02282022….
2 USPTO Statement on Engagement with Russia, the Eurasian Patent Organization, and Belarus, March 22, 2022. See, https://www.uspto.gov/about-us/news-updates/uspto-statement-engagement-r….
3 General License No. 13, “Authorizing Certain Administrative Transactions Prohibited by Directive 4 Under Executive Order 14024, Office of Foreign Assets Control, Department of the Treasury, March 2, 2022. See, https://home.treasury.gov/system/files/126/russia_gl13.pdf.
4 Decree of the Government of the Russian Federation of 06.03.2022 No. 299 “On Amendments to Clause 2 of the Methodology for Determining the Amount of Compensation Paid to a Patent Owner When Deciding to Use an Invention, Utility Model or Industrial Design without His Consent, and the Procedure for its Payment.” See, http://publication.pravo.gov.ru/Document/View/0001202203070005?index=0&r…
Article By Ryan Cagle of Womble Bond Dickinson (US) LLP
For more intellectual property legal news, click here to visit the National Law Review.
The post Russian Sanctions Create Patent Risks appeared first on The National Law Forum.
]]>The post New Year to Bring Increased Regulatory Focus on Cybersecurity for Financial Institutions appeared first on The National Law Forum.
]]>These latest regulatory developments impacting financial institutions will likely affect the cybersecurity policies of other regulators, including enforcement actions against regulated entities that fail to implement adequate cybersecurity programs. Thus, even if your organization is not a financial institution regulated by the NYDFS, CFTC or a state banking regulator, the key takeaways discussed below will provide insight into the types of questions regulators will pose, and offer practical guidance for developing a compliant privacy and data security program to mitigate cybersecurity risks. The December 2014 ruling that retailer Target had an affirmative duty to protect its customers’ personal and financial information illustrates that these pronouncements provide important guidance not just to regulated entities, but to companies generally.
On December 10, 2014, the NYDFS issued the Examination Letter to all New York chartered and licensed banking institutions announcing the Department’s new, targeted cybersecurity preparedness assessment. In an effort to promote greater cybersecurity across the financial services industry, the NYDFS warned that it will expand its routine information technology examinations to include cybersecurity. However, as noted in an article in American Banker2, the Examination Letter provides no indication that the examinations will differentiate among banks by size, meaning a smaller community bank may be subject to the same cybersecurity requirements as multinational banks with significantly more resources.
The new examination procedures are designed to encourage “all financial institutions to view cybersecurity as an integral aspect of their overall risk management strategy, rather than as a subset of information technology.” According to Benjamin M. Lawsky, Superintendent of the NYDFS, new procedures are also intended to promote a “laser-like focus on this issue by both banks and regulators” given that regulatory examination rankings can have a significant impact on the operations of financial institutions, including their ability to enter into new business lines or make acquisitions.
The Examination Letter notes that the NYDFS will be incorporating the following new security-oriented topics into its pre-examination “First Day Letters” to assist in expediting the Department’s review of financial institutions’ cybersecurity preparedness:3
Corporate governance, including written information security policies and procedures, and the periodic reevaluation of such policies and procedures in light of changing risks;
Cybersecurity incident detection, monitoring and reporting processes;
Resources devoted to information security and overall risk management;
The risks posed by shared infrastructure;
Protections against intrusion, including multifactor or adaptive authentication, and server and database configurations;
Information security testing and monitoring, including penetration testing;
Training of information security professionals as well as all other personnel;
Vetting and management of third-party service providers; and
Cybersecurity insurance coverage and other third-party protections.
In addition to the information requested in the First Day Letter, the NYDFS stated that it will schedule IT/cybersecurity examinations following the risk assessments of each financial institution. The new IT/cybersecurity examinations will take a deeper look into the financial institution’s ability to prevent, detect and respond to data breaches and other cyber attacks by requesting:
The qualifications of the institution’s Chief Information Security Officer, or the individual otherwise responsible for information security;
Copies of the institution’s information security policies and procedures;
The institution’s data classification approaches and data access management controls;
The institution’s vulnerability management programs, including its consideration of applications, servers, endpoints, mobile, network and other devices;
The institution’s patch management program, including how updates, patches and fixes are obtained and disseminated;
The institution’s due diligence process regarding information security practices used to vet, select and monitor third-party service providers;
Application development standards used by the institution, including the extent to which security and privacy requirements are incorporated into application development processes;
The institution’s incident response program, including how incidents are reported, escalated and remediated; and
The relationship between information security and the organization’s business continuity program.
The NYDFS’s Examination Letter is essentially a “take-home test” for any New York chartered or licensed banking institution or regulated firm preparing for an NYDFS examination or conducting its own internal audit to strengthen its cybersecurity practices and incident response preparedness. Additionally, although the new examination procedures do not impose cybersecurity requirements on regulated entities per se, the NYDFS is essentially announcing the standards and practices it expects to be adopted in any compliant cybersecurity program. For now, the new cybersecurity examination procedures are limited to banks, but it is likely that the NYDFS will extend these same types of procedures to the other financial services firms it regulates, such as insurance companies and investment companies.
On December 10, 2014, CFTC Chairman Timothy Massad testified before a Senate Agriculture Committee hearing that cybersecurity is “perhaps the single most important new risk to financial stability.” As a result, cybersecurity will become an increasingly important aspect of the CFTC’s oversight for futures and swaps markets.
Chairman Massad testified that the CFTC requires clearinghouses, swap execution facilities, designated contract markets and other market infrastructures to implement system safeguards, which must include four elements: (1) a program of risk analysis and oversight to identify and minimize sources of cyber and operational risks; (2) automated systems that are reliable, secure and scalable; (3) emergency procedures, backup facilities and a business continuity/disaster recovery plan; and (4) regular, objective, independent testing to verify that the system safeguards are sufficient. Each CFTC-regulated entity must also have a risk management program that addresses seven key elements, including information security, systems development, quality assurance and governance. Furthermore, these entities must notify the CFTC promptly of cybersecurity incidents.
Although the CFTC does not conduct independent testing of its cybersecurity requirements, it reviews evidence provided for satisfaction of the requirements. Chairman Massad testified that the CFTC’s upcoming examinations will focus on the following areas:
Governance—Are the board of directors and top management devoting sufficient attention to cybersecurity?
Resources—Are sufficient resources and capabilities being devoted to monitor and control cyber-related risks across all levels of the organization?
Policies and Procedures—Are adequate plans and policies in place to address information security, physical security, system operations and other critical areas? Is the regulated entity actually following its plans and policies, and considering how plans and policies may need to be amended from time to time in light of technological, market or other security developments?
Vigilance and Responsiveness to Identified Weaknesses and Problems—If a weakness or deficiency is identified, does the regulated entity take prompt and thorough action to address it? Does it not only fix the immediate problem, but also examine the root causes of the deficiency?4
On December 17, 2014, the CSBS issued “Cybersecurity 101: A Resource Guide for Bank Executives” (the “CSBS Resource Guide”), which is designed to aid chief executive officers, senior executives and board members in their understanding, oversight and implementation of effective cybersecurity programs. The CSBS Resource Guide is organized according to the five core cybersecurity functions of the Commerce Department’s National Institute of Standards and Technology’s Framework for Improving Critical Infrastructure Cybersecurity: (1) identify internal and external cybersecurity risks; (2) protect organizational systems, assets and data; (3) detect systems intrusions, data breaches and unauthorized access; (4) respond to a potential cybersecurity event; and (5) recover from a cybersecurity event by restoring normal operations and services. For each of these core functions, the CSBS Resource Guide provides questions that chief executive officers should ask, as well as training guidance and a model checklist to follow in the event of a data breach.
In light of these developments, banks and other financial institutions should consider undertaking the following steps and customizing them to their specific circumstances and risks:
1. Conducting Periodic Cybersecurity Risk Assessments
Identify potential cybersecurity threats (including physical security threats) to security, confidentiality and integrity of personal and other sensitive information (both customer and internal) and related systems;
Evaluate effectiveness of current controls in light of identified risks;
Prioritize resources, assets and systems corresponding to the nature and level of threats and vulnerabilities, and revise procedures and controls, as necessary and appropriate, to address and mitigate areas of risk; and
Determine whether existing insurance policies will cover the threats identified in the risk assessment, and determine whether separate cyber coverage is needed.
2. Evaluating Potential Third-Party Vendor Risks
Review due diligence procedures for selecting vendors and procedures for approval/monitoring of vendor access to networks, customer data or other sensitive information;
Obtain copies of vendors’ written information security plans or certifications of compliance with applicable standards; and
Determine whether contracts with vendors include appropriate security measures, including incident response notification procedures and cyber insurance coverage.
3. Developing and Periodically Testing a Comprehensive Incident Response Plan
Implement a comprehensive, written incident response plan to respond proactively to actual or suspected cybersecurity events; and
Conduct periodic “table top” exercises of mock cybersecurity events with IT, legal, compliance, human resources and other business stakeholders.
1 See http://www.dfs.ny.gov/about/press2014/pr1405061.htm
2 See http://www.americanbanker.com/news/bank-technology/new-york-cybersecurity-exams-will-be-tougher-than-ffiecs-1071603-1.html
3 The NYDFS’s new cybersecurity questions and topics are similar to the comprehensive cybersecurity questionnaire attached to the Securities and Exchange Commission’s Office of Compliance Inspections and Examinations’ (“OCIE”) Risk Alert, issued on April 15, 2014, as part of the OCIE’s cybersecurity examinations of registered investment advisors and broker-dealers. Click here.
4 The NYDFS and the CFTC are certainly not the only banking and financial services regulators that have intensified their focus on cybersecurity. Indeed, during her December 10, 2014 testimony before the U.S. Senate Committee on Banking, Housing and Urban Affairs, Valerie Abend, chair of the Federal Financial Institutions Examination Council (“FFIEC”) Cybersecurity and Critical Infrastructure Working Group, said the FFIEC’s interagency cybersecurity guidelines “require banks to develop and implement formal information security programs that are tailored to a bank’s assessment of the risks it faces, including internal and external threats to customer information and any method used to access, collect, store, use, transmit, protect, or dispose of the information.”
The post New Year to Bring Increased Regulatory Focus on Cybersecurity for Financial Institutions appeared first on The National Law Forum.
]]>The post New G-7 Sanctions Against Russia appeared first on The National Law Forum.
]]>
The United States, in coordination with other G-7 nations, announced on Monday, April 28new sanctions on individuals and entities with ties to the Russian government and President Putin. The newly announced sanctions build on earlier rounds of U.S. sanctions imposed on March 6, March 17, March 20 and April 11. The United States also tightened license restrictions for high technology exports to Russia. In addition to the new U.S. sanctions, the European Union, Canada and Japan also announced new sanctions against Russian individuals and entities.
Reasons cited for the new sanctions were Russia’s failure to abide by commitments it made to de-escalate the crisis during an April 17 meeting in Geneva among Russia, Ukraine, the United States and the European Union (also known as the Geneva accord) and continued Russian-supported efforts to destabilize Eastern Ukraine. According to an April 25 statement by the G-7 leaders, Russia has failed to take actions required by the Geneva accord and has continued to escalate tensions through its “increasingly concerning rhetoric” and “ongoing threatening military maneuvers on Ukraine’s border.”
The new U.S. sanctions issued by the Office of Foreign Assets Control of the U.S. Department of the Treasury, target seven individuals and 17 entities, including banks, construction companies and transportation companies, with connections to the Russian government. These sanctions, like those previously announced, freeze the assets subject to U.S. jurisdiction of all sanctioned individuals and bar those individuals from obtaining visas to enter the United States. The sanctions also prohibit U.S. persons, including U.S. companies and their overseas branches and divisions, from transacting business with any sanctioned individuals or entities.
In addition, the Bureau of Industry and Security of the U.S. Department of Commerce announced that it added 13 of the newly sanctioned entities to its Entity List (comprised of parties that are prohibited from receiving some or all items subject to the U.S. Export Administration Regulations without a license), and that it will immediately begin denying pending applications for licenses to export or re-export “high technology” items to Russia or Crimea that may enhance Russia’s military capabilities. Concurrently, the Directorate of Defense Trade Controls of the U.S. Department of State announced that it is placing a hold on all licenses for exports of defense articles and defense services to Russia.
In coordination with the new U.S. sanctions, the new EU sanctions add 15 individuals with ties to the Russian government to the European Union’s existing list of sanctioned individuals.
The two remaining G-7 member states also imposed new sanctions on Russian individuals this week: Canada announced sanctions against two Russian banks and nine individuals, and Japan announced visa bans on 23 as-yet-unnamed individuals.
Companies with interests in Russia or Ukraine or doing business with Russian enterprises are advised to ensure appropriate measures are in place to comply with the sanctions, including careful screening of all parties to transactions.
The post New G-7 Sanctions Against Russia appeared first on The National Law Forum.
]]>