In March of 2016, the Consumer Financial Protection Bureau ("CFPB" or "Bureau") published the Advisory for financial institutions on preventing and responding to elder financial exploitation ("Advisory") and the accompanying Recommendations and report for financial institutions on preventing and responding to elder financial exploitation ("Recommendations").
The Bureau noted that banks and credit unions are uniquely positioned to detect that an older account holder has been targeted or victimized, and to take action. The Advisory and Recommendations covered a spectrum of voluntary best practices to assist financial institutions.
All of the Bureau's 2016 recommendations remain vital today. CFPB provided six categories of voluntary best practices to help financial institutions prevent elder financial abuse and intervene effectively when it occurs. These categories include:
This update focuses on Recommendation 4 in the Advisory regarding reporting of suspected elder financial exploitation ("EFE") by banks and credit unions to appropriate local, state or federal first responders. It reiterates key recommendations regarding reporting from the 2016 Advisory and Recommendations because many financial institutions remain unsure of whether to report suspected financial exploitation due to privacy concerns. In addition, this update provides new information on reporting based on federal and state legislative changes. It highlights findings from the CFPB's 2019 analysis of Suspicious Activity Reports (SARs) on elder financial exploitation which underscores the widespread and damaging impact of elder financial exploitation.
The CFPB reiterates its 2016 recommendation that financial institutions report suspected financial exploitation of older adults to all appropriate local, state, or federal responders, regardless of whether reporting is mandatory or voluntary under state or federal law. In 2013, the eight federal regulatory agencies with authority to enforce the privacy provisions of the Gramm-Leach-Bliley Act ("GLBA") issued Interagency Guidance on Privacy Laws and Reporting Financial Abuse of Older Adults ("Guidance"). The Guidance clarifies that reporting financial abuse of older adults to appropriate authorities does not, in general, violate the privacy provisions of GLBA. This update discusses new laws that have passed since the publication of the 2016 Advisory, such as the Senior Safe Act.
CFPB noted in 2016 that, while it recommends that everyone in every state report suspected financial exploitation to all appropriate first responders, at that time only about half the states mandated that financial institutions or a subset of financial professionals report suspected EFE to Adult Protective Services ("APS"), law enforcement or both. The CFPB recommended that financial institutions determine whether and when state law mandates reporting by the institution. Under state mandatory reporting laws, proof of EFE is normally not required and a reasonable suspicion of EFE triggers a duty to report.9 As of April 2019, 26 states and the District of Columbia mandate reporting of suspected EFE by financial institutions or specified financial professionals. This update includes a statutory chart to identify state reporting requirements. See Appendix A for a chart of state statutes involving mandatory reporting related to EFE and the role of financial institutions in reporting it.
Since the CFPB published its 2016 Recommendations, one state added a broad mandatory reporting requirement for financial professionals and financial institution personnel (including banks and credit unions):
Effective September 29, 2018, Ohio mandates that employees of banks, savings banks, savings and loan associations, or credit unions, in addition to other listed financial professionals, report suspected financial exploitation.
Since 2016, a substantial number of states have enacted legislation based on a Model Act adopted by the North American Securities Administrators Association ("NASAA") that includes a provision permitting delayed disbursements of funds when the financial institution believes that financial exploitation may occur, with accompanying responsibilities.12 These statutes generally provide timelines for transaction holds and provide immunity for institutions and employees who take the proactive steps of withholding transactions and reporting suspected financial abuse to specified authorities. These statutes generally require financial institutions to report suspected financial exploitation if they choose to hold a transaction. Most of these statutes apply only to broker/dealers, financial advisers and others dealing in securities.
However, several states have included depository institutions such as banks and credit unions among the institutions and qualified individuals that may hold transactions. These states include Delaware, Kentucky, Tennessee, Texas, Virginia,20 and Washington. In all of these states but Washington, reporting of EFE is already mandatory. The Delaware, Kentucky, Tennessee, Texas, and Washington statutes also include an additional statutory provision that mandates reporting, sometimes within a certain time period, to specific authorities if the financial institution wishes to delay or refuse a transaction related to EFE. See Appendix B for a chart of state statutes involving transaction holds related to EFE.
State policymakers and key stakeholders in other states are exploring changes to enable depository institutions to delay disbursements if they suspect that an older account holder has been or will be defrauded. These proposed or actual legislative changes suggest that policymakers seek additional ways to prevent EFE entirely or to limit the losses that older adults may incur when targeted.
The federal Senior Safe Act, effective June 2018, provides that financial institutions are not liable for disclosing suspected EFE to covered agencies if the institution has trained its employees on identifying EFE. The Senior Safe Act applies to depository institutions, credit unions, investment advisers, broker-dealers, insurance companies, insurance agencies, insurance advisers and transfer agents. In addition to institutional immunity, the Senior Safe Act provides individual immunity for those who "served as a supervisor or in a compliance or legal function (including as a Bank Secrecy Act officer) for, or, in the case of a registered representative, investment adviser representative, or insurance producer, was affiliated or associated with, a covered financial institution." To establish immunity, the report must be made in good faith and with reasonable care and the employee must have received appropriate training on how to identify and report elder exploitation. The training must:
The Senior Safe Act does not mandate either reporting or training, but does make the safe harbor contingent on the financial institution having provided training to employees. It does not preempt state law unless the Senior Safe Act provides greater protection against liability to a covered individual or institution.
In its 2016 Recommendations, the CFPB recommended that financial institutions establish clear, efficient training protocols to enhance their capacity to detect EFE. The CFPB recommendations stress that training curricula should include indicators of potential EFE, and the CFPB compiled a list of warning signs in an appendix. The CFPB recommended that training programs describe what actions to take when employees detect problems. The CFPB also recommended that training describe the roles and responsibilities of management, frontline staff, and other employees to reduce ambiguity and promote efficient and timely action when staff suspect or observe EFE.
In its 2016 Recommendations, the CFPB recommended that financial institutions file SARs when the financial institution suspects EFE. The CFPB highlighted FinCEN's 2011 Advisory that noted SARs are a valuable avenue for financial institutions to report financial exploitation of older adults.
In February 2019, the CFPB published a research report, Suspicious Activity Reports on Elder Financial Exploitation: Issues and Trends. The CFPB analyzed SARs filed by a broad spectrum of financial institution types from 2013 to 2017 regarding suspected EFE. Over 180,000 SARs describing suspicious activities targeting older adults were filed during this timeframe. SAR filings quadrupled from 2013 to 2017, but these SARs likely represent a tiny fraction of actual incidents. During the study time period, SAR filings by depository institutions increased each year. EFE SARs indicate that EFE is widespread and damaging, with an average loss of $41,800 among adults over age 70 who sustained a loss.
While financial institutions are filing an increasing number of EFE SARs, in most cases the SARs do not indicate that the financial institutions are reporting EFE directly to law enforcement or APS. Less than one-third of EFE SARs (28 percent) state that the filing institution reported the activity directly to APS, law enforcement or other authorities. If the financial institution is not reporting to APS, law enforcement or other first responders, this may be a missed opportunity to strengthen prevention and response. More reporting to the relevant law enforcement agencies can increase investigation and prosecution. Many financial institutions communicate with local law enforcement entities, which assist them in understanding when, where, and how to report. Robust reporting to APS can increase the likelihood that victims will receive appropriate services.
In its 2016 Advisory, the CFPB recommended that financial institutions expedite documentation requests and provide financial records at no charge to APS, law enforcement or other investigatory agencies in EFE cases. This is particularly critical because APS agencies often lack financial resources and having to pay to obtain financial records can impede APS's ability to respond to elder fraud. Because financial exploitation often continues over several months, a timely response to a records request can be an important step in preventing additional losses to an older account holder.
Some states have enacted laws mandating that financial institutions produce financial records relevant to suspected EFE to APS and law enforcement when requested. Since 2016, Kentucky, Tennessee, Texas, and Utah have all enacted new laws regarding the production of records to investigatory agencies. Kentucky and Texas now mandate that financial institutions provide records relevant to suspected EFE to APS and law enforcement, either as part of a report or referral or upon request pursuant to an investigation. In Tennessee and Utah, financial institutions must provide records to authorized investigatory agencies if the agency serves a subpoena. In a few states, it is explicitly permitted—but not mandatory—for financial institutions to disclose records related to suspected EFE. See Appendix C for a chart of all state statutes involving the disclosure of financial records related to EFE.
State statutes also differ regarding the specific agencies to which financial institutions must disclose records.
FinCEN advises financial institutions to provide SAR information and supporting documentation to authorized investigatory agencies: "Financial institutions must provide all documentation supporting the filing of a SAR upon request by FinCEN or an appropriate law enforcement or supervisory agency." "Disclosure of SARs to appropriate law enforcement and supervisory agencies is protected by the safe harbor provisions applicable to both voluntary and mandatory suspicious activity reporting by financial institutions."
The CFPB recommends that financial institutions work with their legal counsel to expedite their responses to requests for SAR supporting documentation by law enforcement and other agencies with authority to access SARs.
Timely reporting of suspected EFE remains critically important and can lead to effective responses and limitation of losses. The CFPB's research underscores the prevalence of EFE and the devastating financial harm that it is causing nationwide. Legislative trends suggest that policymakers are seeking ways to increase and enhance reporting of suspected EFE to government entities that can help victims or take action against perpetrators. Policymakers are also providing incentives to train financial institution staff on recognizing and reporting EFE, and, in some states, enabling them to delay or refuse disbursements when they believe financial exploitation of an older adult has occurred or will occur. The CFPB provides this update to assist financial institutions in continuing to play a vital role in preventing and responding to elder financial abuse.