FFIEC Releases New Authentication Guidance for Online Banking

By Andrew J. Lorentz and Richard A. Gibbs

On June 28, 2011, the Federal Financial Institutions Examination Council (FFIEC) issued a Supplement to the Authentication in an Internet Banking Environment guidance first issued in Oct. 2005. The FFIEC considered that further guidance was appropriate due to the continued growth of electronic and mobile banking and greater sophistication of the associated threats, which have increased risks for financial institutions and their customers.

The Supplement reflects the FFIEC’s view that the controls in its previous guidance have become less effective over time as criminals have used techniques such as “corporate account takeover” to inflict large losses on banks and their customers for online banking services. The new guidance is expected to spur adoption of enhanced authentication technologies and controls, particularly for smaller financial institutions that may not have invested as heavily in advanced security technology as the largest banks.

Specifically, the Supplement:

  • Reiterates the risk-management framework described in the 2005 guidance;
  • Identifies customer authentication techniques that are less effective in the current environment and calls for enhanced measures;
  • Outlines minimum layered security control elements for online banking activities; and
  • Sets forth specific minimum elements that should be part of an institution’s customer awareness and education program.

A link to the new Supplement is provided here. The FFIEC member agencies have directed examiners to formally assess financial institutions under the enhanced expectations outlined in the Supplement beginning in Jan. 2012.

Continue Reading...

Six Tips for Compliance with Europe's New Cookie Rules

By Robert F. Stankey and Adam Shoemaker

While the European Union’s deadline for implementing new cookie rules has passed, substantial uncertainty remains about what organizations should do to make their online activities compliant. In this advisory we offer six practical tips for dealing with the uncertainty.

Background

The EU adopted the Citizens’ Rights Directive (“Directive”) in 2009 as part of a package of changes to update communications regulation. The Directive imposes new consent requirements on websites that use cookies, including potential limits on the use of online tracking for behavioral advertising. While the Directive’s implementation deadline was May 25, 2011, only a handful of European countries have completed their transposition of the new rules into national law.

EU member states have significant discretion to determine how they will implement the new rules, and many governments have delegated the interpretation and application of these rules to their national or regional data protection authorities. Consequently, even where legislation has been adopted, detailed implementation guidance will be needed. Given the broad scope of possible obligations under the Directive and the potential for a variety of interpretations of its rules, organizations operating websites or providing services over the Internet will need to assess their potential compliance obligations and monitor how key jurisdictions are interpreting the requirements.

Continue Reading...

OCC Proposes New Bank Preemption Rules Under the Dodd-Frank Act

By Andrew J. Lorentz, James H. Mann, Bernard L. Russell, and Andrew Owens

On May 25, 2011, the Office of the Comptroller of the Currency (OCC) proposed revisions to its rules on the scope of federal preemption of state laws with respect to national banks.1  The proposed rules implement critical elements of Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act or the Act).2  Under the OCC’s interpretation, the conflict preemption standard in the U.S. Supreme Court’s Barnett Bank decision, as incorporated in Title X, generally provided the foundation for prior OCC preemption determinations.  Accordingly, the proposed rules make no major changes to the OCC’s existing preemption rules, except for those changes specifically mandated by the Act. The OCC’s restrained reading of the mandate in the Dodd-Frank Act may disappoint States Attorney Generals and consumer groups, who seem likely to argue for a broader rollback of federal banking preemption.

Generally, the Dodd-Frank Act and the proposed rules:

  • Eliminate preemption of state laws for national bank subsidiaries, agents and affiliates;
  • Conform the preemption and visitorial powers standards for federal savings associations to those applicable to national banks;
  • Articulate standards for determining when ‘‘state consumer financial laws’’ are preempted that incorporate the Barnett Bank standard for conflict preemption;
  • Impose new procedures and consultation requirements for OCC preemption determinations;
  • Require the OCC to conduct periodic reviews of its preemption determinations; and
  • In accordance with the Cuomo decision, provide that a court action by a state law enforcement officer to enforce non-preempted state law is not an exercise of visitorial powers.

Comments on the proposed rules are due by June 27, 2011. The OCC expects to issue final rules effective on or shortly after July 21, 2011. The OCC has not proposed any changes to the broader preemption regulations of the Office of Thrift Supervision that currently apply to federal savings associations, but has stated its intention to propose such changes later in 2011.3  Since the Act requires that preemption rules relating to federal savings associations comply with those applicable to national banks, the rules for federal savings associations will mirror those for national banks.

 Preemption of state law for national bank subsidiaries, agent and affiliates

Sections 1044(a) and 1045 of the Dodd-Frank Act eliminate preemption of state law for national bank subsidiaries, agents and affiliates. Accordingly, the proposed rule would rescind the OCC’s regulation concerning the application of state laws to national bank operating subsidiaries (12 C.F.R. §7.4006). The proposed rule would also make conforming revisions to §5.34(a) and subsection (e)(3) by expressly referencing the new section 12 U.S.C. 25b adopted by the Act, which provides that Title LXII of the Revised Statutes of the United States and section 24 of the Federal Reserve Act (12 U.S.C. 371) do not preempt, annul, or affect the applicability of any state law to any subsidiary, affiliate, or agent of a national bank (other than a subsidiary, affiliate, or agent that is chartered as a national bank).

Continue Reading...

China Releases Draft Interim Social Insurance Measures Covering Foreign Employees

By Ron Cai

Earlier this week, the Chinese Ministry of Human Resources and Social Security released for public comment its draft Interim Measures for the Participation in Social Insurance of Foreigners Employed in China. The public comment process will close on June 17, 2011. This short deadline suggests that there will be few public comments, and hence, the draft may be final, or very close to final.

According to the draft Interim Measures, expatriates who are legally employed by enterprises, public institutions, social groups, privately owned non-enterprise units, foundations, law firms, and accounting firms in China are required to participate in basic pension and medical insurance, work-related injury insurance, unemployment insurance, and maternity insurance. Employers and expatriates should pay social insurance contributions in accordance with relevant regulations.

For expatriates who enter into employment contracts with employers outside of China and are then dispatched to work in branch or representative offices registered or recorded in China, both the expatriate and the branch or representative offices are required to pay the social insurance contributions in accordance with relevant regulations.

However, for expatriates who are nationals of countries that have entered into bilateral or multilateral treaties relating to social insurance with China, participation will be handled in accordance with such treaties. Currently only South Korea and Germany have such treaties with China.

Feel free to contact us if you have any questions.

An Overview of China's New Anti-Price Monopoly Rules and Procedures

By Ron Cai and Ariel Fu

On Dec. 29, 2010, the National Development and Reform Commission (NDRC), one of the three authorities responsible for enforcing China’s Anti-Monopoly Law (“AML”), issued the Anti-Price Monopoly Regulations (“Price Rules”) and Regulations on Anti-Price Monopoly Administrative Enforcement Procedures (“Price Administrative Rules”). Both the Price Rules and the Price Administrative Rules took effect on Feb. 1, 2011.

Apart from the AML, the new Price Rules provide further guidance on price-related prohibitions. More specifically, the Price Rules set up several provisions to regulate monopolistic pricing activity such as price fixing agreements, the abuse of dominant market position, and the abuse of administrative power.

The Price Administrative Rules illuminate the competent authorities and the relevant procedures that apply to investigations and proceedings related to monopolistic pricing activity.

Continue Reading...
Tags:

FASB Sounds Retreat on New Accounting Standards for Leases

By John W. Hanley, Jr.

Last year we reported in advisories directed to our health care (see advisory) and real estate (see advisory) readers that the Financial Accounting Standards Board (FASB) is considering new accounting rules for real estate and equipment leases, new rules that would dramatically change the way in which leases are reported in financial statements of public and private companies and nonprofit organizations. The proposed rules were published in an Exposure Draft (Topic 840-Leases) released by the FASB in August 2010.

It now appears that the FASB may be ready to reverse course, and perhaps even to adhere to its current rules, which draw a bright line between capital and operating leases. We believe that those who have been preparing for the new rules may want to hold tight until the FASB’s direction becomes more certain.

In a nutshell, the new rules would discard the fundamental distinction in today’s generally accepted accounting principles (GAAP) between an operating lease and a capital lease. The premise of the new rules is that all leases—no matter the duration or economic terms—should give rise to an asset, and a liability, on the balance sheet of both the lessor and the lessee. These new accounting standards would create real challenges for lessees, since a lessee is required to value the future liability created by a lease using a complex “expected outcome analysis.”

Continue Reading...

FCC and DOJ Allow the Comcast-NBCU Joint Venture to Proceed with Conditions

By John D. Seiver and Paul Glist

Yesterday, both the Department of Justice (DOJ) and the Federal Communications Commission (FCC) took actions that will allow Comcast to create and control a joint venture with NBC Universal, Inc. (NBCU). DOJ announced it would allow the transaction to move forward under a proposed Final Judgment that resolves DOJ’s competitive concerns regarding the Joint Venture through imposition of several significant conditions. Similarly, the FCC announced it had approved all necessary license transfers to allow completion of the transaction, subject to its own set of conditions. The text of the FCC’s order has not yet been released, but a news release outlining the FCC’s conditions was made available yesterday afternoon.

The FCC approval order will require increased local and news programming on NBC broadcast stations, carriage of increased independent and diverse programming on Comcast cable systems, expanded availability of Comcast broadband to rural areas and to lower income customers, as well as a wide variety of other conditions and voluntary commitments offered by Comcast-NBCU (Joint Venture). However, of broader interest to the video programming and distribution industries are requirements contained in both the DOJ Final Judgment and the FCC’s order relating to access to programming for online video distributors (OVDs), and well as the requirements relating to the manner in which Comcast carries such online video programming over its own Internet facilities. 

Continue Reading...

CPUC Authorizes Use of Tradable Renewable Energy Credits

By Steven F. Greenwald and Vidhya Prabhakaran

On Jan. 13, 2011, by a 3-0 vote, the California Public Utilities Commission (CPUC) announced a decision again authorizing the procurement of tradable renewable energy credits (TRECs) by the three largest California investor-owned electric utilities (IOUs) to satisfy a portion of their obligations under the California Renewables Portfolio Standard (RPS) program (2011 TREC Decision).

The 2011 TREC Decision essentially reinstates the Commission’s decision of March 16, 2010 (March 2010 Decision). The March 2010 Decision had initially authorized the use of TRECs for purposes of RPS compliance.

An earlier DWT advisory featured the March 2010 Decision and can be found here.

The 2011 TREC Decision thus ends the almost year-long stalemate in which the CPUC and the Legislature debated the integration of TRECs into the overall RPS program. The “product” of the administrative morass has been primarily delay and uncertainty—during that period, the CPUC allowed no TREC transactions.

The March 2010 Decision limits the three largest California IOU’s use of TRECs for RPS compliance to not more than 25 percent of the IOU’s annual RPS megawatt-hour (MWh) purchases. In addition, the CPUC set an “interim” price cap of $50 per MWh for the purchase of a TREC. Besides lifting the stay on the March 2010 Decision, the 2011 TREC Decision makes no substantive change, other than extending the period in which these caps on TREC use and costs will remain in effect until at least December 2013.

Continue Reading...
Tags: , ,

U.S. Food Safety Overhaul is Underway: FDA Gets Broad Oversight Powers

FDA Food Safety Modernization Act brings sweeping changes to food processing industry
 
By William L. Weigand

On Jan. 4, President Obama will sign into law a major overhaul of food safety regulation in the United States. The FDA Food Safety Modernization Act gives the U.S. Food and Drug Administration broad new powers to force recalls of tainted foods, gain access to internal records of food processors, regulate imported foods and ingredients, and conduct more frequent inspections of food production facilities.

The law gives the government far-reaching authority to set and enforce safety standards for food processors. It affects all whole and processed foods, except meat, poultry, and some egg products, which are regulated by the U.S. Department of Agriculture.

This advisory provides a brief list of the key regulatory changes food processors must address as the FDA ramps up its implementation of the new law.

Continue Reading...

New Year's Resolution 2011: Follow Through on Good Nonprofit Governance Practices

By LaVerne Woods and Thomas C. Schroeder

If there is a unifying theme among the key legal issues of 2010 for nonprofits, it is the importance of good governance practices. The impact of governance is pervasive. It affects an organization’s success in furthering its mission, its exposure to scrutiny by state and federal regulators, and the public perception of its worthiness. A review of important developments in 2010 sets the stage for organizations to follow through on good governance practices in 2011.

IRS to use governance data as basis for audits

The Internal Revenue Service has staked out a position that good governance practices by charitable organizations help promote compliance with the federal tax law, and that weaknesses in governance may be an indicator of compliance issues generally. While the rules regarding nonprofit corporate governance are a matter of state law and not federal tax law, the IRS has turned a spotlight on this area through its power to require disclosures on the publicly available IRS Form 990 information return.

The newly redesigned Form 990 brings a high level of accountability and transparency to nonprofit governance. It includes a wide variety of questions on governance issues, such as the number of “independent” directors on an organization’s board, the business and family relationships among board members, and financial transactions between the organization and its board members and related parties.

Continue Reading...

New Accounting Standards Will Drive Changes in Real Estate Industry Practices

11.04.10
By John W. Hanley, Jr.

In August 2010, the Financial Accounting Standards Board (FASB) released proposed new accounting rules for real estate and equipment leases. If these rules become effective, they will dramatically change the way leases are reported in the financial statements of public and private companies and nonprofit organizations. They will have a substantial effect on the structuring and administration of leases, and on the usefulness of certain common lease terms, such as term extension options and formulaic rent escalations.

In the real estate industry, where ground, space, and equipment leases have been used since the Pilgrims for a wide range of purposes, the impacts will be significant. The proposed accounting standards will be adopted, in final form, sometime next year, with an effective date still to be determined. Once effective, they will apply to all existing leases—even though such leases may have been structured with an eye on current accounting principles—and to all new leases. It is not too late to make objections to FASB about these proposed standards—nor too early to begin planning for these possible changes.

Continue Reading...

Domestic Partner Laws in Washington: How State Law and Health Care Reform Impact Section 125 Plans and Health Plans

10.18.10
By Richard Birmingham, Sarah L. Bhagwandin, and Jeff Belfiglio

Employee benefit plans and procedures should be reviewed to ensure compliance with recent significant changes in Washington state’s domestic partnership law. In November 2009, Washington voters approved Referendum 71, confirming the “everything but marriage” law treating state registered domestic partners the same as married spouses under Washington law. The new law was effective Dec. 3, 2009, and creates new compliance issues for employers administering Section 125 cafeteria plans and the underlying benefits. In addition, questions have arisen as to the impact, if any, of the Patient Protection and Affordable Care Act (PPACA) on coverage for domestic partners and children of domestic partners.

This advisory outlines some preliminary steps employers should take to ensure compliance with the law, answers some key questions employers may have regarding health benefits and tax issues, and analyzes how the new law impacts Section 125 plans in comparison to the underlying benefit arrangements.

Continue Reading...

FERC Opens Docket for Smart Grid Rulemaking Proceeding

10.12.10
By Haeryung Shin and Michael Caughey

Last week the Federal Energy Regulatory Commission (FERC) took the first step toward the adoption of standards for the national Smart Grid by creating docket number RM11-2-000 for the consideration of Smart Grid interoperability standards.

This FERC action begins the process of formalizing Smart Grid standards and protocols for the interstate transmission of electric power, as well as for regional and wholesale electricity markets. It is anticipated that hundreds of such standards may be adopted in the coming years as the nation begins to implement the grid-modernization mandate of the Energy Independence and Security Act of 2007 (EISA).

Following a year-and-a-half-long process coordinated by the National Institute of Standards (NIST) and aimed at integrating the input of and fostering collaboration among the diverse groups of Smart Grid stakeholders, on Oct. 6, NIST sent a letter to FERC Chairman Jon Wellinghoff identifying five foundational families of standards that are ready for FERC consideration:

  • IEC 61970 and IEC 61968: Providing a Common Information Model (CIM) necessary for exchanges of data between devices and networks, primarily in the transmission (IEC 61970) and distribution (IEC 61968) domains.
  • IEC 61850: Facilitating substation automation and communication as well as interoperability through a common data format.
  • IEC 60870-6: Facilitating exchanges of information between control centers.
  • IEC 62351: Addressing the cybersecurity of the communication protocols defined by the preceding IEC standards.

NIST indicated in its letter to Chairman Wellinghoff that it believed sufficient consensus existed as to the proposed standards for FERC to proceed with formal rulemaking. The standards proposed are intended to address the priority areas identified in FERC’s July 16, 2009, Smart Grid Policy Statement and were developed by the International Electrotechnical Commission (IEC) to help enable efficient and secure exchanges of information with and across the Smart Grid.

While FERC does not have authority to require compliance with the final standards adopted under EISA, the agency may require compliance with the final standards under its Federal Power Act authorities. The Oct. 7 notice did not specify how soon the agency will proceed to issue a formal Notice of Proposed Rule Making (NPRM).

However, companies whose businesses may be impacted by the final standards are well advised to be on the lookout for the NPRM and to consider whether they wish to provide comments thereon. Companies that wish to pool resources with similarly situated companies should consider forming or becoming involved in a relevant special interest group (SIG). Companies interested in working through an association or SIG who need advice on initiating such activities should feel free to contact us for guidance.

Health Care Reform: Accountable Care Organizations and Exempt-Organization Participants

Hospitals and other organizations that are exempt from federal income tax face special challenges
09.01.10
By Monica Gianni, Marisa Meltebeke, and Jill H. Gordon

Accountable Care Organizations (ACOs)—groups of health care providers jointly responsible for the overall care and cost of Medicare fee-for-service beneficiaries assigned to them—are one of the structures recommended under the Patient Protection and Affordable Care Act of 2010 (PPACA)1 to achieve the nation’s goals of increasing the quality and efficiency of health care and “bending the curve” of increases in costs.

ACO participants are compensated based on the applicable Medicare fee schedule but have an opportunity to share in savings resulting from the ACO’s more efficient use of resources. PPACA provides little detail on ACOs and imposes no mandatory organizational structure to obtain that goal.

The legislation does, however, explicitly anticipate ACOs that are joint-venture arrangements between hospitals and physicians.2 An ACO could be a joint venture organized through contractual arrangements among the ACO participants. Alternatively, it could operate under a formal, fully integrated entity structure, such as a limited liability company, with the participants all members of the company.

Regardless of the ACO’s structure, hospitals and other health care organizations that are exempt from federal income tax under Section 501(c)(3) of the Internal Revenue Code face special challenges. Those challenges include issues of whether the hospital’s participation creates prohibited “private benefit” or “private inurement” to nonexempt persons, including physicians who are highly compensated.

Continue Reading...

Health Care Reform: New Guidance on Claims and Appeals Procedures for Group Health Plans - by Amy Hwang

Health Care Reform: New Guidance on Claims and Appeals Procedures for Group Health Plans - by Amy Hwang - 08/23/10
 

New interim final rules impose new requirements on internal claims review procedures and establish an external review process for appeals. 

On July 22, 2010, the Departments of Treasury, Labor, and Health and Human Services jointly released interim final regulations regarding new requirements for the internal claims and appeals procedures for group health plans, and a new requirement for an external appeals process. The new requirements generally apply to insured and self-insured group health plans beginning with the first plan year commencing on or after Sept. 23, 2010 (Jan. 1, 2011, for calendar-year plans), but do not apply to group health plans that are treated as “grandfathered plans.” The 24-hour deadline for urgent claim responses, the requirement to continue coverage pending the outcome of the internal review process, and the need for an additional external review process will prove to be cumbersome for most employers.

Changes to internal claims and appeals procedures

Health care reform requires group health plans to implement new processes for internal claims and appeals under ERISA. The regulations create the following six new requirements that supplement the existing ERISA claims and appeals procedures:

The definition of an “adverse benefit determination” that is subject to the new internal appeals procedures has been expanded to include a “rescission of coverage.”

The maximum time period within which a plan must notify a claimant of the determination of an urgent care claims is reduced from 72 hours to 24 hours after receipt of such claim, unless the claimant fails to provide sufficient information for the plan to determine whether, or to what extent, benefits are covered or payable.

Claimants must be allowed to review the claim file and present “evidence and testimony” as part of the internal claim and appeal process. Upon review of a denial of a claim, plans must now provide to the claimant, free of charge:

  • any new or additional evidence considered, relied upon, or generated by the plan in connection with the claim, and
  • any new or additional rationale that will be used as a basis for the denial of the claim on appeal or review.

Plans must provide such information in advance of any final internal adverse benefit determination so that the claimant has a reasonable opportunity to respond prior to the determination.
Plans must take additional steps to avoid conflicts of interest and ensure independence and impartiality in the appeals process. For example, plans must not make decisions regarding hiring, compensation, and promotion with respect to any individual based on the likelihood that such individual will support a denial of benefits.

A notice of an adverse benefit determination must include significantly more disclosures, including diagnosis, treatment, and denial codes and an explanation of those terms. In addition, for a notice of a final internal adverse benefit determination, the notice must include a discussion of the decision. Model notices will be issued on the websites for the Departments of Labor and Health and Human Services.

If a plan fails to comply with all requirements of the internal claims and appeals process, a claimant will be deemed to have exhausted the process and therefore will be eligible to seek external review or judicial review of the claim. This remedy is available even if the plan has substantially complied with these requirements or the error was de minimis.

In addition, the regulations require group health plans to continue coverage pending the outcome of an internal appeal of an adverse benefit determination. Plans are generally prohibited from reducing or terminating an ongoing course of treatment without notice and an opportunity to review, and individuals in urgent care situations and those receiving an ongoing course of treatment may be allowed to proceed with an expedited external review at the same time as the internal appeals process. However, the regulations do not make it clear whether this continued coverage requirement applies to appeals of eligibility claims and rescissions.

New process for external review of appeals

The regulations also provide details of the new external review process for appeals of final internal adverse benefit determinations and rules determining whether a state or federal external review process applies.

Under the new regulations, an insured group health plan that is already subject to an existing state external review process must continue to comply with the applicable state process if such process includes, at a minimum, the consumer protections set forth in the National Association of Insurance Commissioners’ Uniform Model Act as in effect on July 23, 2010 (the “NAIC Model Act”). The Department of Health and Human Services will determine whether a state’s external review process complies with the requirements of the NAIC Model Act. However, the regulations provide for a transition period, such that all existing state external review processes, including those adopted by Washington, Oregon, and California, are deemed to be in compliance with the requirements until the first day of the first plan year beginning on or after July 1, 2011.

Plans that are either not currently subject to a state external review process, such as self-insured plans, or (for plan years beginning on or after July 1, 2011) are subject to state external review processes that do not meet the minimum standards of the NAIC Model Act must comply with a federal external review process. Standards for this process will be similar to those found in the NAIC Model Act and detailed in future guidance.

New notice requirements for internal appeals and external reviews

Under the regulations, group health plans must provide notices of an adverse benefit determination and of available internal claims and appeals procedures and external review processes in a culturally and linguistically appropriate manner, including in a non-English language if 25 percent of all participants are literate in the same non-English language (for plans with 100 or more participants, if the lesser of 500 participants or 10 percent of all participants are literate in the same non-English language).

If the threshold is met, the plan must provide notice in the non-English language and include a statement in the English version of all notices, prominently displayed in the non-English language, that such notices are available in the non-English language. Once a request for a non-English notice has been made, all future notices to the claimant must be provided in that non-English language. In addition, any other customer assistance offered by the plan (for example, a telephone hotline) must be available in the non-English language.

For more information on health care reform please refer to Davis Wright Tremaine’s health care reform Web page.