As we mentioned just a couple of weeks ago, the federal banking regulators have taken aim at the risk weighting rules for High Volatility Commercial Real Estate (“HVCRE”) loans that went into effect back in 2015. In a proposal published on September 27, 2017, the regulators seek to simplify the approach in several ways. First, the existing HVCRE definition in the standardized approach would be replaced with a simpler definition, called HVADC, which would apply to credit facilities that primarily finance or refinance ADC activities. Second, an HVADC exposure would receive a 130 percent risk weight.as opposed to the 150% risk weight for HVCRE exposure under the existing rule. The tradeoff though is that HVADC would apply to a much broader set of loans. For example, as compared to the HVCRE exposure definition, the proposed HVADC exposure definition would not include an exemption for loans that finance projects with substantial borrower contributed capital and consequently removes the restriction on the release of internally generated capital.

The definition of “primarily finance” means credit facilities where more than 50 percent of loan proceeds will be used for ADC activities. So for example, multipurpose facilities where more than 50 percent of loan proceeds finance non-ADC activities, such as the purchase of equipment, would not be considered HVADC.

As with the HVCRE rule, there are certain exemptions. HVADC would exempt permanent loans, community development loans, loans for the purchase or development of agricultural land and loans for one to four family residential.  Thus, lot development loans and loans to finance the ADC of townhomes or row homes would not be considered HVADC but raw land loans and loans to finance the ADC of apartments and condominiums generally would be considered HVADC.

Investors frequently talk in terms of trying to find the next unicorn, that small start-up company that is going to turn into a billion dollar valuation.  Lawyers are like that as well, always looking for that new decision where a court opens a crack in the door of some long held legal theory. Something like this occurred in the 1980’s when the courts in California held that a party could bring a tort action for the breach of the obligation of good faith. The courts were expanding a doctrine that then existed only in the area of insurance contracts. The expansion of this theory to noninsurance contracts generated universal criticism by other courts and scholars across the US and after a ten year experiment the California Supreme Court reversed its earlier decision for the following reasons: (1) the different objectives underlying the remedies for tort or contract breach, (2) the importance of predictability in assuring commercial stability in contractual dealings, (3) the potential for converting every contract breach into a tort, with accompanying punitive damage recovery, and (4) the preference for legislative action in affording appropriate remedies. [See: Blanchard, Lender Liability: Law, Practice and Prevention, Chapter 4, Bad Faith Tort Claims]

When a party enters into a loan agreement or a promissory note, one understands what the consequences of a breach might be. If a lender is found to have improperly failed to fund under a line of credit it knows that it may have to pay compensatory damages to the borrower. Likewise, guarantors understand that if the borrower fails to pay the underlying obligation the guarantor must step in and pay the obligation.  Our commercial banking industry is built on this understanding that parties will need to put the nonbreaching party into as good of condition as they would have been if there had been no breach. Damages for breach are therefore predictable.

The unicorn for borrowers counsel today is to tag a lender with punitive damages. This has traditionally been a difficult endeavor. Courts almost uniformly dismiss breach of fiduciary duty claims because absent some unusual set of facts, the normal lender/borrower relationship is not a fiduciary one. Lenders owe no special duty to borrowers or guarantors to advise them on whether a particular business transaction for which the borrower is obtaining funds is a “good” one or not. Fraud claims are a bit easier for a borrower to keep from being dismissed but such claims are subject to heightened pleading standards and require specificity in making the claim, a general claim of “fraud” without more will be dismissed.

Articles 3 and 4 of the UCC provide a roadmap for addressing how to allocate liability for the various mistakes, embezzlements and forgeries that have followed the payments system since its invention several centuries ago.  While as a general rule a customer is not liable for forgeries and other fraud on its account there are several exceptions where the risk of loss can be shifted back to the customer. One of those situations is what practitioners refer to as the “same wrongdoer rule” found in section 4-406(d)(2). The rule says that when the bank sends a customer their statement, the customer has a certain time period, usually 30 days, to review the statement and notify the bank of any unauthorized signatures or alterations. Should the customer fail to flag such transactions then the UCC shifts the risk of loss for all subsequent forgeries by the same wrongdoer to the customer. This result is modified somewhat by the following subsection, 4-406(e) which provides that if there are subsequent forgeries by the same wrongdoer and the customer establishes that the bank failed to exercise ordinary care then the loss is allocated between the customer and the bank unless the customer can show that the bank did not pay the item in good faith in which case all risk is shifted to the bank.

Section 4-406 also provides that without regard to lack of care by either party, a customer who fails to discover and report unauthorized items or any alteration within 60 days after the statement is made available to the customer is precluded from asserting a claim against the bank.

These issues were recently applied in the recent case of Ducote v. Whitney National Bank.   On July 25, 2014, David Ducote, Avery Interests, LLC, Jebaco, Inc., and Iberville Designs filed suit against Whitney and Ducote’s former employee, Michelle Freytag (“Freytag”), alleging that Freytag, in her position as Ducote’s executive assistant, had obtained fraudulent credit cards from Whitney on plaintiffs’ accounts, made personal charges on the cards, and transferred funds from plaintiffs’ accounts to pay the balance on these credit cards. The petition alleged that plaintiffs were not responsible for the charges because the contract on the credit card agreements was null, or alternatively that the credit card agreements should be rescinded because of the fraud committed by Freytag. The petition further alleged that Freytag could not have accomplished this theft without the assistance of Whitney, which failed to follow established procedures and facilitated Freytag’s theft. Whitney responded by denying all liability and argued that the claims were barred by various provisions of the UCC, one of which was Section 4-406.

A recent decision out of federal court arising out of litigation involving a Ponzi scheme has reinforced the principle that the lead in a loan participation does not owe a fiduciary duty to participants.  The case of Finn v. Moyes (Finn v. Moyes,  2017 WL 1194192 (D Minn 2017)) arose from a Ponzi scheme whereby First United Funding, LLC (“First United”) defrauded numerous banks of over $90 million.  A receiver was appointed to recover funds and sued a number of parties for, among other things, aiding and abetting the fraud carried on by First United.

The receiver claimed that one group of defendants (the “Moyes”) had actual knowledge of the fraudulent conduct and aided and abetted First United by fraudulently over-pledging collateral. The Receiver also alleged that the most of the other loans made by First United were to parties that the Moyes had introduced to First United.

Moyes moved for summary judgment on the Receiver’s aiding and abetting claim. The court noted that under Minnesota law to prove its claim the Receiver would need to show: (1) First United committed a tort that caused an injury to the participant banks; (2) Moyes knew that First United’s conduct constituted a breach of duty; and (3) Moyes substantially assisted or encouraged First United in the achievement of the breach.

We have written several times about the rules concerning the appropriate risk weighting for High Volatility Commercial Real Estate (“HVCRE”) loans. The interagency FAQ published on April 6, 2015 provided some guidance but many banks continue to have questions about fact situations that are not addressed under the regulation.  Despite indications that an interagency task force was looking at a further set of FAQ nothing has yet come out. Despite that, there are actually grounds for optimism that the rules will yet be simplified.

Section 2222 of the Economic Growth and Regulatory Paperwork Reduction Act of 1996 (EGRPRA)  requires that, not less than once every 10 years, the Federal Financial Institutions Examination Council (FFIEC) and the Board of Governors of the Federal Reserve System (Board), the Office of the Comptroller of the Currency (OCC), and the Federal Deposit Insurance Corporation (FDIC) must conduct a review of their regulations to identify outdated or otherwise unnecessary regulatory requirements imposed on insured depository institutions. In conducting this review, the statute requires the FFIEC or the agencies to categorize their regulations by type and, at regular intervals, provide notice and solicit public comment on categories of regulations, requesting commenters to identify areas of regulations that are outdated, unnecessary, or unduly burdensome.

In late spring of this year the FFIEC reported to Congress that one of its goals was to simplify the capital rules for community banks. The very first area of attention listed under that heading was to replace the complex treatment of HVCRE exposures with a more straightforward treatment for most acquisition, development, or construction (“ADC”) loans. While the agencies are not ready to lift the curtain on what the revised rule might look like they did cite certain comments they had received from community banks including (i) that the definition of HVCRE is neither clear nor consistent with established safe and sound lending practices; (ii) the 150 percent risk weight applied to HVCRE lending is simply too high; (iii) the criteria for determining whether an ADC loan may qualify for an exemption from the HVCRE risk weight are confusing and do not track relevant or appropriate risk drivers; and (iv) in particular, commenters expressed concern over the requirements that exempted ADC projects include a 15 percent borrower equity contribution, and that any equity in an exempted project, whether contributed initially or internally generated, remain within the project (i.e., internally generated income may not be paid out in the form of dividends or otherwise) for the life of the project.

When negotiating bank third party vendor contracts it is not unusual to ask the vendor to acknowledge in the contract that bank regulators might exercise some sort of supervision over the vendor. Vendors will oftentimes push back on that point, claiming that since they are not a bank the FDIC has no jurisdiction over their affairs. We typically respond that “if the shoe fits, wear it.”

The fit arises because of the definition of “institution-affiliated party” (“IAP”). The definition was added under FIRREA when the regulatory agencies were seeking additional authority to impose sanctions against lawyers, accountants and appraisers whose negligence may have contributed to the failure of a bank. The language added to the statute is broader than just those professionals and covers any shareholder, consultant joint venture party, any other person determined by the appropriate federal banking agency (by regulation or case-by case) who participates in the conduct of the affairs of the bank and any independent contractor who knowingly or recklessly participates in any violation of law or regulation, any breach of fiduciary duty or any unsafe or unsound practice which caused or is likely to cause more than a minimal financial loss to the bank. (12 USC 1813(u))

The practical application of being designated an IAP was recently driven home in an enforcement action the FDIC took against Bank of Lake Mills, Freedom Stores, Inc. and Military Credit Services, Inc. All three parties entered into Consent Orders with the FDIC. The Bank agreed to fund restitution of $3,000,000 and to pay a civil money penalty of $151,000 while Freedom Stores, Inc. agreed to pay a penalty of $54,000 and Military Credit Services agreed to pay a penalty of $37,000.

Back in 2008 and 2009 Eddie Liles lent around $102,000 to his brother Dallas to purchase rental properties at 554 South Shore Drive and 540 South Shore Drive in Greenup County, Kentucky, as well as a 2008 Ford 4×4 truck.  The brothers signed a Loan Agreement that provided the loan would be interest free and that the loan for 554 South Shore Drive to be repaid first, followed by the loan for the truck, and finally the loan for the 540 South Shore Drive. The Loan Agreement called for Dallas to make payments of “ [a] minimum of $600.00 per year,” which it specified could be “multi-payments or one payment of $600.00.” It was also clear that Dallas could pay more than $600 per year towards the indebtedness, if he so desired.

The Loan Agreement also provided that if Dallas died, any outstanding balance would be forgiven. If, however, Dallas survived Eddie and the loan remained unsatisfied, the property would revert to Eddie. If both men died at the same time, and before satisfaction of the loan, the property was to pass to John B. Liles, II, or his estate. Eddie filed the Loan Agreement for record with the Greenup County Clerk and Dallas began making payments. As of early 2011 when the brothers had a falling out, Dallas had reduced the indebtedness to $89,400.

According to an affidavit filed by Dallas, the impetus for the falling out was an argument the two had in January of 2011 about a haircut. The argument was bad enough that the two were no longer communicated except for filing legal pleadings. Eddie refused to accept any more installment payments from Dallas and demand payment in full. Dallas refused but continued to make installment payments into an escrow account. Eddie filed suit and later sought summary judgment on the basis that he had full rights to demand payment in full. The circuit court determined that the loan was not a demand obligation and Eddie appealed.

Over the last decade as the specter of cyber attacks has increased dramatically, financial institutions have been encouraged to look into the use of cyber fraud insurance as one means of minimizing risk. A recent decision by the 8^th Circuit provides an interesting opportunity to see how such policies are going to be interpreted by the courts.

In 2011, an employee at Bellingham State Bank in Minnesota initiated a wire transfer through the Federal Reserve’s FedLine Advantage Plus system (FedLine). Wire transfers were made through a desktop computer connected to a Virtual Private Network device provided by the Federal Reserve. In order to complete a wire transfer via FedLine, two Bellingham employees had to enter their individual user names, insert individual physical tokens into the computer, and type in individual passwords and passphrases. In this instance the employee initiated the wire by inputting the passwords both for herself and the other employee and inserted both of the physical tokens. After initiating the wire the employee left the two tokens in the computer and left it running overnight. Upon returning the next day the employee discovered that two unauthorized wire transfers had been made from Bellingham’s Federal Reserve account to two different banks in Poland. Kirchberg was unable to reverse the transfers through the FedLine system. Kirchberg immediately contacted the Federal Reserve and requested reversal of the transfers, but the Federal Reserve refused. The Federal Reserve, however, did contact intermediary institutions to inform them that the transfers were fraudulent, and one of the intermediary institutions was able to reverse one of the transfers. The other fraudulent transfer was not recovered.

Bellingham promptly notified BancInsure of the loss and made a claim under their financial institution bond which provided coverage for losses caused by such things as employee dishonesty and forgery as well as computer system fraud. After an investigation, it was determined that a “Zeus Trojan horse” virus had infected the computer and permitted access to the computer for the fraudulent transfers. BancInsure denied the claim based on several exclusions in the policy including employee-caused loss exclusions, exclusions for theft of confidential information, and exclusions for mechanical breakdown or deterioration of a computer system. In essence, the policy does not cover losses whose proximate cause was employee negligence or a failure to maintain bank computer systems. Bellingham contested the denial and brought suit in federal court for breach of contract.

Managing third party vendor relationships has always been an important function in banks. More recently it has become a hot topic for state and federal financial bank regulators.

As a result, we have compiled our Seven Part Guide on reviewing third party vendor service contracts into one article.  A checklist for reviewing third party vendor contracts is included in the article, and also available separately.

The analysis covers typical elements that should be found in any third party vendor contract, including provisions on the nature of services to be provided, the location where the word is to be performed, breach and termination, as well as provisions related to the potential outbreak of zombies.

Reviewing Third Party Vendor Service Contracts

Checklist for Vendor Service Contracts

Community banks have recently been on the receiving end of demand letters from plaintiffs law firms alleging that the banks’ websites are in violation of the Americans With Disabilities Act of 1990 (the “ADA”).  Interestingly, there are currently no specific federal standards for websites under the ADA. The Department of Justice (“DOJ”) is in the process of developing regulations for website accessibility, but has announced it will not finalize these regulations until 2018 at the earliest. Even so, the DOJ has emphasized that businesses should make websites accessible to the disabled. While the regulations are being developed, many businesses have been applying the Web Content Accessibility Guidelines (WCAG) 2.0 Level AA with the understanding that the DOJ has made clear that it considers a website accessible if it complies with these guidelines.

When a bank receives a demand letter the first thing they need to do is hire counsel to advise them about their various options, including mitigating any damages by curing website defects, litigation or settlement. As a practical matter, the best defense to such claims is making sure that the bank’s website is compliant with the WCAG 2.0 Level AA Guidelines. That may involve the use of internal resources as well as external consultants.  While it is impossible to tell whether suit will be filed in any given situation, banks should take note that the firms sending demands have previously been engaged in filing over 100 of these types of suits against various non-financial defendants over the past year.

Bryan Cave has put together a resource that provides generally accepted recommendations for website accessibility and federal ADA standards for ATM accessibility to help you review how your banks stands.