Update: On June 8, the CFPB announced a sixty day extension of the public comment deadline. Comments are now due by September 12. On May 10, the Consumer Financial Protection Bureau (CFPB) issued a Request for Information (RFI) seeking to learn more about the small business lending market.  If you are scratching your head as to why the CFPB is delving into small business lending, you are not alone. The CFPB was created to regulate those engaged in offering or providing consumer financial products or services.  Yet tucked into the massive Dodd-Frank Act is a small provision, section 1071, which requires the CFPB to issue rules regarding the collection of data to help identify needs and opportunities in the small business lending market and to facilitate enforcement of fair lending laws. For many years, this provision has been a lower priority for the CFPB. However, with the issuance of many of the most high profile Dodd-Frank regulations, the CFPB is now beginning what is expected to be a multi-year process in developing rules for small business data collection. Below, I attempt to flesh out a number of the issues being discussed in the aftermath of the CFPB’s latest action. What is Section 1071 All About? For those of you familiar with the data collection rules under the Home Mortgage Disclosure Act (HMDA) and the new rules published in 2015, section 1071 is described by some as a HMDA-like compliance requirement for small businesses.  Section 1071 amends the Equal Credit Opportunity Act to require financial institutions to report information concerning loan applications made by women-owned, minority-owned and small businesses.  The provision includes a partial list of information that is required to be collected such as the type and purpose of the loan, the amount of credit or credit limit applied for and the amount approved as well as the race, sex and ethnicity of the owners of the business. In adopting  section 1071, Congress authorized the CFPB to write rules implementing the data collection requirement and provided for a catch-all provision for the inclusion of any additional information that the “Bureau determines would aid in fulfilling the purposes of [the] section.” In short, the data collection can be as extensive as the CFPB determines. What is in the CFPB RFI? The CFPB seeks information from the public in five broad categories: the definition of small business; the data points that the CFPB should require to be collected; the financial institutions engaged in business lending and what entities should be subject to data collection; the kinds of financial products and credit available to small businesses; and privacy concerns related to the collection effort.  There are a host of sub-questions raised by the CFPB in each category. In addition, there are number of issues that the industry will likely want to address. For example, feedback is necessary to inform the CFPB on the data lenders are already collecting and what burdens and costs result when certain additional information is required.  The small business lending market is remarkably diverse covering credit cards, SBA loans, personal loans, home equity loans as well as a combination of multiple sources. The RFI represents an important opportunity for industry participants to inform the CFPB before it begins its rulemaking process. Comments are due on July 14, 2017. What are the Initial Reactions to the CFPB’s Action? This depends on where you stand in the small business lending eco-system.  Some lenders urged the CFPB to proceed with caution so as not to place considerable and unnecessary burdens on small businesses and lenders. A trade association representing a segment of the credit union industry argued that the CFPB should exempt all credit unions from any future rulemaking given their unique characteristics and limits placed on member business loans. Some industry folks are supporting a harder line stand arguing that Congress should take action to halt t

Financial Fraud Action UK (FFA UK) recently released their 2016 UK fraud performance report. Whilst there were some logical changes between 2015 and 2016, I was surprised at the fluctuation and significant shifts fraudsters have made in order to circumvent existing controls. Here are some highlights and lowlights I took from the report. Overall, UK fraud losses were up again and this is due to a combination of shifts between fraud types and an increase in the number of victims of fraud (cases). What did surprise me was the rate at which the gross losses increased compared to the value prevented had decreased. For example, Industry losses increased by £13 million (2%), yet the value prevented was reduced by a staggering £380 million (22%). This means that we prevented far less of the overall fraud attack in 2016 than we did in 2015. Here are some other interesting stats: Card fraud was up by 9% from £568 million to £618 million, and the number of victims increased by 22%, yet a large proposition of this was successfully mitigated. We have seen many of our clients upgrading their solutions over the past 12-18 months, and in particular to FICO Falcon Fraud Manager 6. This should be evidence that transaction detection tools are working.   Remote banking fraud (via internet, telephone and mobile app) saw a 19% reduction. Case volumes remained flat compared to 2015 yet the losses went down by £32 million. Well done to the digital teams and security professionals out there for sqeezing the level of opportunity for fraudsters. Mobile banking fraud through apps, while part of remote banking fraud, rose 104%, the largest increase. It’s great to see the adoption of mobile banking apps increasing, but let’s make sure we keep a very close eye on this fraud type. Fraud has never been more cross-pollenated than it is now. Fraudsters are exploiting the customer instead of individual products. Social engineering ‘scams’ have never been more challenging. We always knew that fraudsters target the weakest link, and now that weakest link truly is us. It’s humans over technology, emotion and trust over malware. Our focus should remain on tackling card fraud and e-banking risks. At FICO, we believe that the most effective way of fighting fraud is by having an enterprise fraud strategy. The FICO® Falcon® Platfom has the ability to combine fraud risk decisions at a customer level and removes the silos that have been in place for far too long. It’s not just about the transaction anymore, we have to consider all data sources. The post 2016 UK Fraud Figures Show Disturbing Trend appeared first on FICO.

I recently moderated a regulatory panel discussion before a group of nearly 100 collections and recovery (C&R) professionals at the FICO® Debt Manager™ User Group Forum. The esteemed panel consisted of a mix of veteran policy and business leaders, including: Maria Wolvin, Vice President and Senior Counsel of Regulatory Affairs at ACA International; Terry Collins, Collections and Recovery Manager at Trustmark National Bank; and Lucia Lebens, Vice President of Government Relations and Public Policy at Navient. Much of the discussion focused on what C&R professionals can expect in the new US regulatory environment that has emerged in the wake of the November elections. While our experts spoke on a number of hot-button topics, three main themes emerged. CFPB Debt Collection Rulemaking Will Likely Move Forward The panel discussed the CFPB’s continued focus on developing new debt collection regulations. The CFPB has indicated that its next pre-rule action will be the convening of a small business review panel and the release of an outline that previews its thinking regarding a first-of-its kind rule governing first-party creditors. The panel agreed that the details will likely pick up elements from an outline released last summer related to an effort to update the Fair Debt Collections Practice Act (FDCPA), which applies to third-party collectors. In a previous post, I discussed the sudden emergence of the Congressional Review Act (CRA) and its impact on future regulations. With the threat that Congress can rollback any agency regulation within 60 legislative days of unveiling a final rule, it is clear that the CFPB is constrained from completing any rulemaking that might spark opposition from the Republican-controlled Congress and White House. However, the law does not apply to pre-rule and proposed rulemaking activities. In short, the CFPB can continue with its work, short of issuing a final rule, without triggering any threat from the CRA. As a result, there was agreement on the panel that the CFPB would continue this year to move the ball forward in this area. States Are Likely to Pick-Up the Slack The panel also agreed that a slowdown in federal regulatory activity does not mean that new debt collection rules will come to a screeching halt. In times of federal inaction, the states often pick up the slack. As an example, it was noted that already there has been an uptick in the number of student loan servicing proposals introduced in state legislatures. In addition, given the impact of the CRA at the federal level, it is possible that state agencies may promulgate new debt collections rules like those recently issued by the Department of Financial Services in New York. Of course, the panel experts acknowledged that increased state activity presents compliance challenges of its own, threatening to create a patchwork quilt of regulations. Meaningful TCPA Reform Is a Real Possibility The prospects of reforming the Telephone Consumer Protection Act (TCPA) generated the most lively and upbeat conversation of the morning. Panelists were joined by many in the audience in expressing their frustration with the obstacles associated with the sending of texts and automated communications to customers’ mobile phones. These impediments were the result of an outdated 1991 statute, overly restrictive regulations and the threat of class action lawsuits. However, the panel was optimistic that, for the first time in many years, there was a real possibility of reform. With a new administration and a change of leadership at the FCC, 2017 is set to deliver impactful changes that would enable organizations to send non-telemarketing messages to their customers preferred communication channels, most notably mobile phones. This would provide relief from some of the existing compliance burden and significant liability exposure. It was noted that new FCC Chairman Ajit Pai appears to be waiting to take further action until the DC Circuit of Appeals

Cyber-attacks are hitting the headlines on a daily basis and a lot of effort goes into both preventing them and dealing with the consequences when they have happened. Understanding the motivation behind attacks can help organisations understand more about the risks they face so that they can tackle them. So why do cyber-attacks happen? 1. For financial gain This is the most likely reason an organization get attacked. Criminals are looking to gain financially in three main ways: Data breaches to feed identity theft. Third-party fraud is fuelled by identity theft, and breached data gives criminals the information they need to take over someone’s identity. In the UK the CIFAS Fraud Scape 2016 highlighted a 49% growth in identity theft over the previous year. Criminal gangs are well-organised and operate on a commercial basis – there is a supply chain, those that steal data are unlikely to be the same criminals who commit the identity theft and fraud. The dark web provides a market place for stolen credentials – with those that have stolen personal data selling it on to those who wish to commit fraud. Cyber-attacks with financial demands. A modern take on blackmail, this can affect organisations of all sizes as well as individuals. There are many variations — for example, hackers takeover a victim’s computer and freeze it, they then offer to reinstate access after a ransom has been paid. Another variation lead to a recent case where guests at a hotel in Austria were prevented from entering their rooms until a ransom had been paid – the hotel is reportedly removing electronic locks accessed with cards and reverting to old-fashioned keys! Attacks to perpetrate a direct fraud on a business. This type of attack usually involves the diversion of funds from their legitimate destination to a fraudster’s account. Criminals use techniques such as phishing and vishing to tease out enough information to enable them to mount an attack. They then access email systems and send emails that look legitimate but aren’t. A variation of this attack is invoice fraud when an email is received that looks like it is from a legitimate supplier and is advising of a change of bank account details – unfortunately, the bank account details supplied are those of a fraudster. This kind of fraud often combines elements of cyber-attack with offline elements such as social engineering. 2. To make a political or social point Hacktivism involves breaking into a system for political or social reasons. Until relatively recently, this was seen as the domain of underground organizations such as Anonymous. The recent US election has put focus on the role that governments might play in furthering their aims through hacking activity. Hackivists look to access information that can damage their intended target. Hacked information often ends up on Wikileaks; the breach at Mossack Fonseca and subsequent publishing of the Panama papers is a good example of this. Hacktivists also mount cyber-attacks to stop their targets carrying out their normal activity, known as Denial of Service or DoS attack. Governments and political bodies are often the target of DoS attacks. Hacktivists come from across the political spectrum. Terrorists may use hacking to attack their targets but other hactivists are intent on bringing down ISIS websites. Many businesses may feel that they are unlikely to be a target for political or social hactivists, though it is well to be aware that the targets of these attacks vary greatly. If someone objects to your operations, you could find yourself at the wrong end of a hacktivist attack. 3. For the intellectual challenge This type of hacker plays to the stereotype of the socially awkward loner who lives in a virtual world and turns to hacking for both the intellectual challenge and the adrenaline rush of breaking into a network. Interestingly, research by Bernadette Schell, a researcher at the University of Ontario Institute of Technology, found that hackers

In my 2017 regulatory predictions post last month, I concluded by saying that the new year would be very different for the financial services industry than 2016. This certainly didn’t take long to come to fruition. In the first two weeks of the new administration, President Trump took several steps aimed at slowing down as well as scaling back current and future regulations. Despite these aggressive actions, there remains a number of challenges related to the reach and impact of these directives. Regulatory Reform through Memorandum and Executive Orders Out of the gate, the Trump administration made good on its promise to curtail the pace of federal regulations. Assistant to the President and Chief of Staff Reince Priebus issued a memo on Inauguration Day that, in part, calls for the heads of executive departments and agencies to initiate a regulatory freeze until someone designated by the President has a chance to review and approve them. The freeze was followed by an Executive Order (“1 in, 2 out rule”) issued 10 days later that required for each new regulation issued by an agency, at least two prior regulations be identified for elimination. The executive order further mandates that the financial impact of each new regulation be offset by the savings from the rescinded regulations, such that the total incremental cost not exceed zero. Finally, on February 3, the President signed an Executive Order that details six “core principles for regulating the United States financial system.” The Executive Order directs the Secretary of the Treasury to consult with the heads of Financial Stability Oversight Council (e.g., OCC, FDIC, Federal Reserve, CFPB, FHFA and SEC) and report to the President within 120 days the extent to which current laws, regulations and oversight requirements, including those connected with the Dodd-Frank Act, help promote the six core principles. Application Limited to Executive Branch Agencies Since the term “department or agency” is not defined in either the memo or the first Executive Order, there was some initial confusion as to whether the requirements of these presidential directives extended only to executive agencies, or also to independent agencies such as the CFPB, OCC, FDIC, SEC and Federal Reserve. A few days after issuing the “1 in, 2 out rule,” the White House issued interim guidance explicitly stating that the order’s provisions did not apply to independent agencies. However, this was not before the Federal Reserve had challenged the reach of the regulatory freeze and the “1 in, 2 out rule” on January 30 by announcing a final rule that no longer subjected select regional banks to the quantitative portion of the annual Comprehensive Capital Analysis and Review (CCAR) stress test. Existing Challenges and Potential Impact Despite the swift moves taken by President Trump, it is not clear how much impact these actions themselves will have on slowing down and reducing the number of regulations. While a regulatory freeze will temporarily halt the rulemaking progress at all executive branch agencies, as previously stated, the freeze does not extend to independent agencies. The “1 in, 2 out rule” has been critiqued as being complicated and difficult to implement. For example, many regulations are mandated by statute and cannot be repealed without an act of Congress.  As a result, this may significantly narrow the pool of existing federal regulations that are eligible to be rescinded. Also, any repeal of an existing regulation must go through the extensive and deliberative process required by the Administrative Procedure Act. Already, this Executive Order is facing a legal challenge. In addition, while the Treasury Secretary can make determinations of what regulations align with the six core principles detailed in the February 3 Executive Order, any changes to Dodd-Frank Act regulations will require congressional action. Though the Republicans control both chambers, Democrats have large enough numbers i

The gist of recent media coverage on the state of US auto lending can be summarized by the title of a recent New York Times article: As Auto Lending Rises, So Do Delinquencies. With this concern in mind, FICO recently conducted a research study to examine the credit quality of US consumers with auto loans, as well as other significant credit trends in auto lending. Our findings tell an interesting tale: Banks have been mildly decreasing their car loan underwriting standards. Overall indebtedness for many consumers has been declining since the Great Recession. The size of car loans has been increasing faster than inflation since the recession. More consumers now have six-year auto loans instead of five-year loans, which were the previous standard. These six-year loans have higher delinquency rates, thus this shift to longer-term loans is likely to result in higher losses for US auto loans over the next few years. This blog post is the first in a two-part series where I’ll walk you through our findings in greater detail. As part of our study, we examined underwriting standards during the 2009-2016 timeframe by looking at FICO® Score distributions for consumers who opened new car loans in the prior six months. Because the movement of average FICO® Scores tends to be relatively limited over time, the best way to assess change in score distribution is to look at the fraction of consumers below a given score: Examining the notable shifts in score distribution, we find that underwriting standards for auto loan consumers became looser after the recession, between 2009 and 2012. In other words, more lower-scoring consumers were given car loans during this timeframe. Since then, we have seen relatively little variance in the FICO® Score distribution until a dip in the most recent year. It will be interesting to see if this down-tick represents the beginning of a trend towards tighter underwriting standards. Looking at consumer indebtedness, the story becomes a little more nuanced. The highest-scoring consumers have been taking on more debt since the recession, but the lowest-scoring consumers have seen their debt decline: The largest driver for these trends is mortgages. As house prices increased since the recession (something I’ve discussed in a prior blog post), our study found that the highest-scoring consumers are taking larger mortgages: Consequently, we see increasing debt for the highest-scoring consumers as they move into higher-priced homes. Since we are in a period of low interest rates, this does represent some increase in systemic risk to the extent that some of those loans have adjustable rates, thus consumer payments could increase. According to the Ellie Mae’s Origination Insight Report, adjustable-rate mortgages (ARMs) only represent about 4-5% of mortgage originations on a unit basis. ARMs are far more popular for larger loans in the US, accounting for roughly 30-40% of mortgage balances. Nevertheless, the potential risk impact that rising interest rates might have on auto loan consumers is likely quite limited. Analysis of car loan balances is much more straightforward. Across all score ranges, consumers have been taking out progressively larger auto loans since the recession: Looking at this chart, what’s eye catching is that consumers in the middle FICO® Score ranges are taking out somewhat larger car loans than higher-scoring consumers. One plausible explanation is that higher-scoring consumers can afford larger down payments, however we cannot confirm this hypothesis since bureau data does not include car prices, trade-in amounts or down payments. Another potential reason might be that these higher-scoring consumers opt more frequently for leases as opposed to loans. In any case, the difference between the average car loan amounts for consumers with FICO® Scores 620-719 and those with scores 800+ runs between $900 and $1,200. Not only has the average car loan size increased, that increase has out-paced inflation o

Since medical costs often increase as we age, one might expect that the rate at which medical bills are unpaid and then sent to collections companies would also increase with age – at least until age 65 when US citizens qualify for Medicare. New FICO research shows that not this not the case. Looking at credit bureau data as of July 2016, medical collections reporting – both paid and unpaid collections greater than $99 – breaks down by age as follows: While the peak of this curve occurs at age 27, the rate of consumers with medical collections is uniformly high for ages 24 to 46. Over a quarter of consumers in that age range have at least one such collection showing on their bureau report. After age 46, we see the rate slowly drop, and as expected, it drops substantially after age 65. Part of the issue stems from US health insurance coverage. While the Affordable Care Act has increased insurance coverage rates, we still do not see rates comparable to those who qualify for Medicare. The US Census Bureau’s most recent report on health insurance coverage shows that in 2014 about 17% of the 26-to-44 age group did not have health insurance (see p. 7); coverage rates increase after age 44 until age 65, when only about 1.5% do not have coverage. And even when consumers are insured, they face ever-increasing healthcare costs and deductibles. The annual Kaiser survey of US health insurance indicates that single coverage deductibles increased from an average of $584 in 2006 to $1,478 in 2016 (see Exhibit 7.7) . Similarly, consumers who opt for HMO coverage have seen their deductibles rise from $751 to $2,245 in that same period (see Exhibit 7.20). With medical collections the leading cause of bankruptcy in the US, one might expect that typical unpaid medical collections amounts would dwarf typical balances for other types of consumer debt. But our study revealed a different story: Generally, medical collections amounts are much less than other forms of debt. This trend holds true beyond just credit card balances illustrated in the chart above; medical debt is about one-fifth of average auto loans, as another example. This suggests that much of the problems around medical debt stems from the fact that, unlike many other forms of debt, medical expenses are often unexpected, causing an insurmountable financial burden. Another significant factor driving medical collections is that medical billing and the process of reporting unpaid bills to the bureaus tends to be opaque and confusing. The CFPB cites multiple contributors to this confusion, among them: the lack of standard practices on when overdue medical debt is sent to a debt collector or reported to credit reporting agencies; and the fact that consumers are often held responsible for their entire medical bill as coverage is being worked out with insurance, which can take time. This confusion and inconsistency may be causing additional collection records on credit bureau reports. As a data scientist from FICO’s Scores organization, I feel it’s important to remind our blog readers that collection information on a credit bureau report has consistently been found to be a strong indicator of increased credit risk. More specifically, our research has shown that consumers with a paid collection are less risky than those with an unpaid collection, and therefore we’ve enhanced the predictive value of FICO® Score 9 by ignoring paid collections, and assessing unpaid medical and unpaid non-medical collections separately. As a result, most consumers with a paid medical collection (excluding bills < $99) will see improvement in their scores as banks switch to FICO® Score 9: Ultimately, our research uncovered several surprising findings around medical collections – that it peaks mid-life not later in life, suggesting that insurance coverage and costs are far greater drivers than age, and that it’s likely the unexpected nature of the expense rather than the amount itself that’s the causing problems

Last fall, I suspect that most regulatory compliance professionals in the U.S. consumer lending market anticipated 2017 would be more of the same. This meant a continued focus on implementation of recently adopted rules, while bracing for a wave of new regulations from the federal banking agencies. Everything changed on November 8. The unexpected election of Donald Trump resulted, in many cases, in a 180-degree course correction. The Trump administration, bolstered by the reelection of a Republican majority in both houses of Congress, has fostered a new environment that is expected to promote de-regulation. While I won’t ever be mistaken for Nostradamus, amidst this regulatory sea change, I feel (relatively) confident in sharing with you my top regulatory compliance predictions for 2017. A little-known law will have big impact on regulation. Haven’t heard of the Congressional Review Act (CRA)? You are not alone. This obscure statutory provision was adopted in 1996 as part of the Small Business Regulatory Enforcement Fairness Act. Under the CRA, before a new regulation takes effect, Congress can take action (through a simple majority vote) on a joint resolution disapproving of the rule. If approved in both houses, the resolution is sent to the President for signature or veto. To date, the CRA has only been used successfully one time. In fact, on several occasions during the past two years, Congress passed joint resolutions disapproving of a new regulation only to have President Obama veto the resolutions. Republicans did not have the 2/3 vote majority needed to override the President’s veto. All of this changed with the election of Donald Trump. President Trump would likely sign any such resolution adopted by the Republican Congress. This means that the future fate of controversial rulemaking, such as the CFPB’s arbitration and small dollar lending proposals that began under a Democratic administration, will be subject to the Republican Congress’ potential use of the CRA. How this will change the content of future regulations is anyone’s guess, but it now must be factored into the equation when federal agencies issue final rules. A patchwork quilt of cybersecurity rules will emerge. As the federal government races to address growing cybersecurity concerns, financial institutions will likely have to navigate through a growing number of federal and state cybersecurity regulations in the upcoming year. We’ve already seen several early indications of this. The FDIC, Fed and OCC recently initiated the process for drafting new cybersecurity regulations for banks with assets exceeding $50 billion. Also in 2016, federal agencies like the Commodity Futures Trading Commission and the Department of Defense issued cybersecurity-related rules. However, perhaps the most noteworthy development was the issuance of a first-of-its kind cybersecurity regulatory proposal by the New York Department of Financial Services, which regulates banks, insurance companies and other financial services entities. As I’ve blogged previously, this has the potential to be a game changer, by requiring regulated entities to adopt the most prescriptive requirements seen to date. While New York has recently revised its cybersecurity rule in an effort to address widespread industry concerns (public comments are due at the end of January with an effective date of March 1, 2017), its actions will likely spark more activity in this area from other states. New FCC leadership will provide much-needed TCPA relief. As I have previously written, the Federal Communications Commission has not provided much relief for those seeking legal clarity when using modern technology to communicate important non-telemarketing messages to customers’ mobile phones (e.g., fraud alerts) in accordance with the 1991 Telephone Consumer Protection Act (TCPA). Under Chairman Tom Wheeler’s leadership, FCC actions have been widely criticized as further chilling the use of text and automated messagi

“What gets measured gets managed,” might be the oldest saw in the business universe. But in my mind, it is closely followed by another: “What gets measured gets monetized.” And that is exactly what is happening today in the booming, yet very-brand-new market for enterprise cyber breach insurance. Specifically, I believe that the new FICO® Enterprise Security Score (ESS), a metric that quantifies the vulnerability of an organization to cyber attack, will dramatically catalyze the growth of the cyber breach insurance market. ESS can be used by an enterprise to understand its cyber risk and shore up defense gaps. It is also an important assessment tool for third parties such as potential business partners and, notably, cyber insurance providers. With its quantitative, empirically derived analytics, FICO ESS will drive objective risk measurement, transparency and predictability into both breach insurance underwriting and longer-term portfolio management––essential requirements in monetizing the rapidly evolving market for cyber breach insurance. Explosive growth for cyber breach insurance Breach insurance premiums are on a tear, and expected to grow tenfold over the next ten years from $2 billion to $20 billion per annum by 2025. The number of underwriters active in the US market is growing rapidly as well, with a double-digit CAGR. These volumes are growing in response to a well-publicized need; large breaches are happening frequently and the expense associated with containment and clean-up is escalating. In addition, new regulations (such as those being pushed forward by the New York Department of Financial Services) will create additional pressure on organizations and their downstream suppliers to take steps to protect themselves and their customers. This includes acquiring appropriate financial coverage to remediate debilitating incidents. The need for objective risk measurement Breach insurance is still a relatively new coverage category. It has not yet been reduced to an actuarial problem, and underwriting remains dependent on intensive expert review. This gap has been recognized by the market, and the last couple of years has seen new entrants looking to provide quantitative cyber risk assessments for use by enterprises and by their breach underwriters. Some of these new players’ products are not likely to add value beyond the judgmental assessments that any cyber expert might provide to an underwriter. Others, like ESS, take an empirical, quantitative approach that will provide a direct and predictable correlation to long-term outcomes. The latter category of solutions will be the one to watch. Publicly available data, dark web information, firmographic information and IP scan information can all yield insights about organizations that can be correlated to breach risk. While many of these indicators are not necessarily breach vectors unto themselves, the correlation between the externally visible characteristics of exposed information technology assets and actual breach events can be empirically derived. Consumer credit scoring provides a useful analog: It’s fair to think of enterprise cyber data assets in the same way as one would think about the data available at credit bureaus for consumers relative to their credit performance. It’s equally fair to think about the resulting ability to correlate these characteristics with breach events, as akin to credit scores. The lingua franca of cyber breach underwriting    The rapid growth in demand for breach coverage will draw new, inexperienced underwriters into the market, and also will bring new, unquantified risks to experienced players (as insurance is sought by a broader array of organizations). In addition, new threat vectors, significant breach events, and new regulations will bring in buyers with new, previously unknown risk profiles. Simply put, it’s going to be a wild ride. Managing risk and correlating price with that risk will require new quantitative tools at underw

The potential of alternative data in consumer lending decisions continues to be a hot topic in Washington, D.C., with the latest evidence seen in developments related to the Community Reinvestment Act (CRA). When federal banking agencies recently revised their Q&As for CRA compliance, their focus on the use of alternative data caught my eye. This development is welcome news for those here at FICO and for our many existing and prospective customers. Adopted in 1977, the CRA is intended to encourage depository institutions to help meet the credit needs of the communities in which they operate, including low- and moderate-income neighborhoods. The Act requires federal banking agencies (the OCC, FDIC and Federal Reserve – “Agencies”) to conduct periodic reviews of each depository institution’s efforts in this area. CRA regulations provide various methods of evaluating bank performance, corresponding to differences in institutions’ asset sizes, structures and operations. After a thorough assessment of the institution, bank examiners assign a CRA rating and issue a public performance evaluation. CRA regulations allow a financial institution’s lending performance to be evaluated, in part, by the institution’s “use of innovative or flexible lending practices in a safe and sound manner to address the credit needs of low- or moderate-income individuals or geographies.” Notably, the latest version of the Q&A guidance includes a new clarification of this standard involving the use of alternative credit histories in mortgage and consumer lending programs. The Agencies discuss the use of alternative data, such as rent and utility payments, “to evaluate low- or moderate-income individuals who lack sufficient conventional credit histories and who would be denied credit under the institution’s traditional underwriting standards.” The Agencies consider this use of alternative credit histories as an “innovative or flexible lending practice” that enhances the “success and effectiveness” of the institution’s lending program. This revised CRA guidance gives financial institutions an additional reason to adopt scoring innovations that leverage alternative data responsibly to expand credit access for communities with low- or moderate-income consumers. Responsibly expanding credit access has always been a central focus at FICO. This April, FICO and our partners, LexisNexis® and Equifax®, announced the availability of an alternative data score, FICO® Score XD. This score leverages data found outside the traditional credit file to identify creditworthy individuals among the 50+ million unscorable consumers in the US. FICO® Score XD considers alternative data such as cable, landline, mobile and utility payments, along with select public record information. FICO® Score XD is being piloted by many of the largest lenders for use in bankcard and other unsecured lending programs, and we have plans to expand it to additional loan types. FICO research shows that the score can serve as an on-ramp to the mainstream credit market for people who otherwise might have great difficulty in obtaining credit. My colleague has written a series of blog posts detailing our research and the promise that this new score holds. We’re excited about the results we’ve seen so far – and to see like-minded enthusiasm from regulators and policy makers about the emerging potential of alternative data in lending. The post New CRA Guidance Promotes Use of Alternative Data in Lending appeared first on FICO.