OFFICIAL PUBLICATION OF THE MONTANA INDEPENDENT BANKERS ASSOCIATION

2026 Pub. 14 Issue 3

Compliance Q&A

BSA. Q: Our customer brought in a $25,000 check from their deceased mother (non-customer) along with legal documents showing they could cash the check. The customer just wanted to deposit the funds. Our teller cashed the transit check and then deposited the funds into the customer’s account. Our system shows “cash in” and is triggering a CTR alert.

Would a CTR be necessary in this instance? No cash crossed the teller line (but I’d like to think of it as imaginary cash). Reading the manual, the line “of more than $10,000 by, through, or to the bank” is throwing me off.

A: No, a CTR would not be required since there was no actual exchange of currency.

The bank should note the file with language similar to, “Transaction involved the deposit of a $25,000 check. The core system generated cash debit/credit entries for processing purposes only. No currency was received or disbursed; therefore, the transaction is not reportable on a CTR.” Be sure to retain appropriate documentation in your BSA files.

The phrase in the BSA regulations “by, through, or to the bank” refers to actual currency movements; it does not convert a non-cash instrument into currency.

The bank could look into a more accurate way to process the transaction.

CRA. Q: With the repeal of the CRA regulation, I know that the bank is now examined under the old CRA rule. However, I went to the FDIC regulation in 12 CFR 345.43(c), which states that the CRA public file must be posted on the bank’s website. Can you please tell me whether this requirement has been repealed or remains in effect?

A: The agencies proposed a rule to rescind the 2023 CRA rule and go back to the 1995 rule generally. We have not yet seen that proposal finalized, but they have held that, with the court action against the 2023 rule, they are enforcing the 1995 rule. The 1995 rule does not require posting anything to the bank’s website, though it also does not prohibit doing so.

When the FDIC (and other agencies) adopted the 2023 rule, it was posted to eCFR on its effective date. Then the lawsuit(s) came, and the agencies put the new rule on hold. They seem to be taking their time in finalizing the proposal to roll back to the 1995 rule.

TILA. Q: We have a loan customer who received the Loan Estimate, Closing Disclosure, and Notice of Right to Rescind. He signed an intent to proceed and agreed with the amounts on the CD.

The funds were to be distributed on Thursday to consolidate loans. The customer is now stating that he miscalculated what he needed and actually needs additional funds. We have talked to the title insurance company, and they can update the policy easily and give us the updated premium today.

Our question is: Can we just restart the timeline on this same loan by redisclosing the LE and CD and giving him the rescission notice? Or should it be considered that he exercised his right to rescind, and it must be a brand-new loan and application?

A: There is no reason to restart the whole process. Document the reason for the change (customer request) in the file, then give the customer a revised CD (no need for another LE) and rescission notices. That should take care of it.

ECOA. Q: On the Uniform Residential Loan Application, in the Type of Credit section, where it says “each borrower intends to apply for joint credit” and has a place to initial, do both applicants have to initial there? Or does each applicant just initial that section in their own application?

A: Having each applicant initial the appropriate place on their own application is fine. To satisfy Regulation B, each applicant must sign or initial somewhere to indicate they intend to apply jointly with the other applicant(s), not necessarily in every such space on all applications for a particular loan.

EFAA. Q: Per Regulation CC, we find that our deposit-taking ATM must disclose specifically the availability periods for all types of deposit accounts. Our question is: Is the funds availability notice that is required in our lobby, where deposits are accepted, the same notice required on the ATM?

Also, how many signs for the cut-off time does a bank need? Are they needed at every teller window?

A: The bank does not have to post a full funds availability schedule at each ATM. ATMs require a notice at each location that funds deposited in the ATM may not be available for immediate withdrawal.

This is a pretty simple notice that may either be posted on a sign on the ATM (though these tend to get picked at/removed over time) or on the screen before a consumer makes a deposit.

As for notices of cut-off times, that would be part of the posted availability schedule. The bank has some flexibility in meeting this requirement. The notice must be posted in a conspicuous place in each location where its employees receive deposits to consumer accounts.

The required notice must specifically state the availability periods for the various deposits that may be made to consumer accounts. The notice need not be posted at each teller window, but the notice must be posted in a place where consumers seeking to make deposits are likely to see it before making their deposits (e.g., at the point where the line forms for teller service in the lobby).

EFTA. Q: To what extent is a bank responsible for fraud on debit cards? When a card is compromised, and the customer had no involvement in the transaction, we reimburse. However, what if the customer was responsible for the transaction, but unknowingly used a fraudulent website? Is the bank responsible for reimbursing them?

In our case, the customer “purchased” a cruise through a fraudulent website. Is this considered coercion by the fraudster and thus covered by Regulation E?

A: No, not receiving whatever they “purchased” is not an “error” under Regulation E error resolution requirements (though it is for credit cards under Regulation Z). The transaction was “authorized,” so the bank has no reimbursement obligation.

FDIC Advertising. Q: In regard to the recent FDIC Official Signs and Advertisement Rule update, are all institutions now required to have written policies and procedures in place to be in compliance?

A: Yes, the bank is required to have a policy dealing with the advertisement of FDIC membership requirements. The relevant subsection in the revised rule is 12 CFR 328.8(a) (Policies and procedures).

Privacy. Q: I wanted to confirm our understanding of the annual privacy notice requirements under Regulation P. Last year, the bank updated its privacy policy and mailed the revised notice to applicable customers. Since that time, there have been no additional changes to the policy or our information-sharing practices.

Based on our review, we believe we continue to meet the criteria for the annual privacy notice exception and, therefore, are not required to send a new notice at this time. Correct?

A: Yes. If the bank shares customer information only under the exceptions in sections 1016.13, 1016.14, and/or 1016.15 and has not changed its privacy policy since last year’s mailing, it still falls within the exception.

As you did last year, if another change is made, another set of notices will have to be sent out at that time — and then back to the exception (as long as the exception’s criteria are still met).

Young & Associates provides banks and thrifts with support for their compliance programs, independent reviews and in-bank training, as well as a full menu of management consulting, loan review, IT consulting and policy systems.

Compliance Q&A

Compliance Q&A

BSA. Q: Our customer brought in a $25,000 check from their deceased mother (non-customer) along with legal documents showing they could cash the check. The customer just wanted to deposit the funds. Our teller cashed the transit check and then deposited the funds into the customer’s account. Our system shows “cash in” and is triggering a CTR alert.

Would a CTR be necessary in this instance? No cash crossed the teller line (but I’d like to think of it as imaginary cash). Reading the manual, the line “of more than $10,000 by, through, or to the bank” is throwing me off.

A: No, a CTR would not be required since there was no actual exchange of currency.

The bank should note the file with language similar to, “Transaction involved the deposit of a $25,000 check. The core system generated cash debit/credit entries for processing purposes only. No currency was received or disbursed; therefore, the transaction is not reportable on a CTR.” Be sure to retain appropriate documentation in your BSA files.

The phrase in the BSA regulations “by, through, or to the bank” refers to actual currency movements; it does not convert a non-cash instrument into currency.

The bank could look into a more accurate way to process the transaction.

CRA. Q: With the repeal of the CRA regulation, I know that the bank is now examined under the old CRA rule. However, I went to the FDIC regulation in 12 CFR 345.43(c), which states that the CRA public file must be posted on the bank’s website. Can you please tell me whether this requirement has been repealed or remains in effect?

A: The agencies proposed a rule to rescind the 2023 CRA rule and go back to the 1995 rule generally. We have not yet seen that proposal finalized, but they have held that, with the court action against the 2023 rule, they are enforcing the 1995 rule. The 1995 rule does not require posting anything to the bank’s website, though it also does not prohibit doing so.

When the FDIC (and other agencies) adopted the 2023 rule, it was posted to eCFR on its effective date. Then the lawsuit(s) came, and the agencies put the new rule on hold. They seem to be taking their time in finalizing the proposal to roll back to the 1995 rule.

TILA. Q: We have a loan customer who received the Loan Estimate, Closing Disclosure, and Notice of Right to Rescind. He signed an intent to proceed and agreed with the amounts on the CD.

The funds were to be distributed on Thursday to consolidate loans. The customer is now stating that he miscalculated what he needed and actually needs additional funds. We have talked to the title insurance company, and they can update the policy easily and give us the updated premium today.

Our question is: Can we just restart the timeline on this same loan by redisclosing the LE and CD and giving him the rescission notice? Or should it be considered that he exercised his right to rescind, and it must be a brand-new loan and application?

A: There is no reason to restart the whole process. Document the reason for the change (customer request) in the file, then give the customer a revised CD (no need for another LE) and rescission notices. That should take care of it.

ECOA. Q: On the Uniform Residential Loan Application, in the Type of Credit section, where it says “each borrower intends to apply for joint credit” and has a place to initial, do both applicants have to initial there? Or does each applicant just initial that section in their own application?

A: Having each applicant initial the appropriate place on their own application is fine. To satisfy Regulation B, each applicant must sign or initial somewhere to indicate they intend to apply jointly with the other applicant(s), not necessarily in every such space on all applications for a particular loan.

EFAA. Q: Per Regulation CC, we find that our deposit-taking ATM must disclose specifically the availability periods for all types of deposit accounts. Our question is: Is the funds availability notice that is required in our lobby, where deposits are accepted, the same notice required on the ATM?

Also, how many signs for the cut-off time does a bank need? Are they needed at every teller window?

A: The bank does not have to post a full funds availability schedule at each ATM. ATMs require a notice at each location that funds deposited in the ATM may not be available for immediate withdrawal.

This is a pretty simple notice that may either be posted on a sign on the ATM (though these tend to get picked at/removed over time) or on the screen before a consumer makes a deposit.

As for notices of cut-off times, that would be part of the posted availability schedule. The bank has some flexibility in meeting this requirement. The notice must be posted in a conspicuous place in each location where its employees receive deposits to consumer accounts.

The required notice must specifically state the availability periods for the various deposits that may be made to consumer accounts. The notice need not be posted at each teller window, but the notice must be posted in a place where consumers seeking to make deposits are likely to see it before making their deposits (e.g., at the point where the line forms for teller service in the lobby).

EFTA. Q: To what extent is a bank responsible for fraud on debit cards? When a card is compromised, and the customer had no involvement in the transaction, we reimburse. However, what if the customer was responsible for the transaction, but unknowingly used a fraudulent website? Is the bank responsible for reimbursing them?

In our case, the customer “purchased” a cruise through a fraudulent website. Is this considered coercion by the fraudster and thus covered by Regulation E?

A: No, not receiving whatever they “purchased” is not an “error” under Regulation E error resolution requirements (though it is for credit cards under Regulation Z). The transaction was “authorized,” so the bank has no reimbursement obligation.

FDIC Advertising. Q: In regard to the recent FDIC Official Signs and Advertisement Rule update, are all institutions now required to have written policies and procedures in place to be in compliance?

A: Yes, the bank is required to have a policy dealing with the advertisement of FDIC membership requirements. The relevant subsection in the revised rule is 12 CFR 328.8(a) (Policies and procedures).

Privacy. Q: I wanted to confirm our understanding of the annual privacy notice requirements under Regulation P. Last year, the bank updated its privacy policy and mailed the revised notice to applicable customers. Since that time, there have been no additional changes to the policy or our information-sharing practices.

Based on our review, we believe we continue to meet the criteria for the annual privacy notice exception and, therefore, are not required to send a new notice at this time. Correct?

A: Yes. If the bank shares customer information only under the exceptions in sections 1016.13, 1016.14, and/or 1016.15 and has not changed its privacy policy since last year’s mailing, it still falls within the exception.

As you did last year, if another change is made, another set of notices will have to be sent out at that time — and then back to the exception (as long as the exception’s criteria are still met).

Young & Associates provides banks and thrifts with support for their compliance programs, independent reviews and in-bank training, as well as a full menu of management consulting, loan review, IT consulting and policy systems.