LAS VEGAS (10/29/14)--Credit unions are charged with protecting their members' information, but when that same information is needed to settle a criminal or civil matter, where does one draw the line? That's the question attorney David Reed discussed during a session at the Credit Union National Association Bank Secrecy Act (BSA) Conference Tuesday.
Reed, founder of a credit union consulting practice, said that almost all rules and regulations governing credit unions, particularly part 748 of the National Credit Union Administration's regulations, require credit unions to not only keep their members' information secure, but to take active steps to make sure it stays secure.
"You want to make sure you have proper policies in place, not only for your part 748 security program, but to have enough detail in your policies to support your decisions," he said.
If a credit union has filed a suspicious activity report (SAR), law enforcement can be given that information specifically relating to the SAR, as long it can be verified that the official is acting on the information given in the SAR.
"A SAR is a huge safe harbor for information requests. If you have a law enforcement officer, federal or state, who is asking you for specific information related to that SAR, you can absolutely give that to them without a subpoena. The system is designed for that," Reed said.
If law enforcement comes to a credit union on a matter that is not the subject of a SAR, they need a subpoena. That's when it becomes important for credit union staff responsible for allowing access to information to be able to gauge whether the request is legitimate, and what the scope of the requested information is.
"You do want to determine very early on who is the subject of this investigation," he said. "Is it a member who may have done something bad, or is this member being looked at as at example of a systemic failure at your institution?"
Reed said often times requests for information can be broad, and credit unions should be upfront about their process of gathering information. As an example, he said, an institution might get a subpoena requesting every single account document since the account was opened.
"What I would do in that situation is have someone send a reply to the attorney and tell them you're happy to comply, but that you charge, for example, 35 cents a copy and $15 an hour for the person gathering the information, and it's going to take 40 hours to get it all together, and courtesy copy that to the issuing court," he said. "I would imagine a vast majority of those requests will be pared down really quick to what's needed."
He added that credit unions should not be afraid to ask for cost reimbursement for the services rendered.
Other best practices for credit union policies dealing with subpoenas include: