First Northwest Bancorp : FEDERAL DEPOSIT INSURANCE CORPORATION WASHINGTON, D.C - Form 8-K

FEDERAL DEPOSIT INSURANCE CORPORATION WASHINGTON, D.C.

In the Matter of: FIRST FED BANK PORT ANGELES, WASHINGTON (INSURED STATE NONMEMBER BANK)

) ) ) ) ) ) ) ) ) )

CONSENT ORDER FDIC-23-0026b

The Federal Deposit Insurance Corporation ("FDIC") is the appropriate Federal banking agency for First Fed Bank, Port Angeles, Washington ("Bank") under Section 3(q) of the Federal Deposit Insurance Act ("FDI Act"), 12 U.S.C. § 1813(q). The FDIC determined that, in connection with the Bank's relationship with Quin Ventures ("Quin"), the Bank engaged in: (a) unsafe or unsound banking practices; (b) deceptive and unfair acts and practices in or affecting commerce, including violations of Section 5 of the Federal Trade Commission Act, 15 U.S.C. §45(a)(1), by making implied claims that credit products with non-optional debt cancellation features were unemployment insurance, approving consumers who did not qualify for the debt cancellation feature, and misrepresenting the fees and benefits for those products; (c) violations of the Truth in Lending Act, 15 U.S.C. §1601, et seq.; (d) violations of the Real Estate Settlement Procedures Act, 12 U.S.C. §2601, et seq.; (e) violations of the Electronic Fund Transfer Act, 15 U.S.C. §1693, et seq.; and (f) violations of Section 18(a)(4) of the FDI Act.

The Bank, by and through its duly elected and acting Board of Directors ("Board"), has executed a STIPULATION AND CONSENT TO THE ISSUANCE OF A CONSENT ORDER ("CONSENT AGREEMENT"), dated November 15, 2023, that is accepted by the FDIC. With the CONSENT AGREEMENT, the Bank has consented, without admitting or denying any charges of unsafe or unsound banking practices or violations of law or regulation, to the issuance of this CONSENT ORDER ("ORDER") by the FDIC.

Having determined that the requirements for issuance of an order under Section 8(b) of the FDI Act, 12 U.S.C. §§ 1818(b) have been satisfied, the FDIC hereby issues the following:

I. CONSENT ORDER

IT IS HEREBY ORDERED that the Bank, its institution-affiliated parties, and its successors and assigns, shall take the following affirmative action:

Correct Violations of Law

1. Within 30 days of the effective date of this Order, the Bank shall correct all violations of law cited in the Consumer Compliance Report of Examination as of March 21, 2022 ("Compliance ROE") and as described in this Order, and implement procedures to prevent future violations of the statutes and regulations cited in the Compliance ROE. The Bank's actions as required by this paragraph shall be satisfactory to the Regional Director of the FDIC's San Francisco Regional Office ("Regional Director") as determined at subsequent examinations and/or visitations.

Board and Senior Management Oversight

2. Within 30 days of the effective date of this Order, the Board shall participate fully in the oversight of the Bank's Compliance Management System ("CMS"), and shall be responsible for the approval of sound policies and objectives, implementation of an adequate compliance program that addresses all consumer compliance risks associated with the Bank's operations, and shall effectively supervise all of the Bank's compliance-related activities, consistent with the role and expertise commonly expected for directors of banks of comparable size and complexity and offering comparable banking products and services.

3. The Board and senior management shall review, revise, develop, and/or implement, as necessary, policies and procedures, including monitoring programs, that are designed to effect compliance with all applicable consumer protection laws and implementing rules and regulations, regulatory guidance, and statements of policy ("Consumer Protection Laws").

4. The Board shall allocate resources and establish policies and procedures that:

(a) Ensure the Bank's compliance officer has sufficient authority and independence to effectuate compliance with Consumer Protection Laws. The compliance officer's authority shall include the right to obtain full information and access to all of the Bank's departments and operations, oversight and monitoring of the Bank's relationships with third parties, including any products and advertising offered by a third party, oversight and monitoring of new products, and the right to implement corrective and/or preventive action when deficiencies are discovered;

(b) Ensure the Bank's compliance officer receives ongoing training, sufficient time, and adequate resources to effectively oversee, coordinate, and implement the Bank's CMS; and

(c) Ensure that the Bank's compliance officer directly reports to the Board regarding the Bank's consumer compliance activities and his or her findings regarding the Bank's consumer compliance activities, at a minimum on a quarterly basis.

5. The Board shall issue minutes that are comprehensive and that accurately reflect the Board discussions, training, and actions to be taken.

6. The Board and senior management shall immediately hold Bank staff accountable for failing to adhere to Consumer Protection Laws and the Bank's policies and procedures.

7. Within 90 days from the effective date of this Order, the Board shall develop and adopt a comprehensive educational program for periodic training for each member of the Board. The educational program shall specifically address Consumer Protection Laws.

New Products and New Third Parties

8. The Bank shall, within 15 days from the effective date of this ORDER:

(a) Identify each credit or deposit product which is being offered by, through, or in conjunction with the Bank ("Bank Product"); and

(b) Identify any entity other than the Bank offering a Bank Product ("Third Party") and the Bank Product it is offering.

9. The Bank shall, within 30 days from the effective date of this ORDER, prepare and submit a list of all Bank Products with an appropriately detailed description of each such Bank Product and the Third Party offering it ("Current Bank Products and Third Parties List") to the Regional Director for review, and comment or non-objection as to the adequacy of the descriptions.

10. For purposes of this ORDER:

(a) Any Bank Product not included on the Current Bank Products and Third Parties List and any Bank Product offered or to be offered by a Third Party not identified as offering the Bank Product on the Current Bank Products and Third Parties List is a new Bank Product ("New Bank Product"); and

(b) Any Third Party not included on the Current Bank Products and Third Parties List is a new Third Party ("New Third Party").

11. The Bank shall not (i) execute a binding commitment or agreement with a New Third Party; (ii) allow a New Third Party to offer a Bank Product through, or in conjunction with the Bank; and/or (iii) offer a New Bank Product, either directly or indirectly, without first receiving the Regional Director's written non-objection to do so. The Bank must submit a New Third Party or New Bank Product non-objection request with, at a minimum, the documentation and analysis below, to the Regional Director for review, and comment or non-objection.

(a) A New Third Party non-objection request shall, at a minimum, include:

(i) An initial thorough and well-documented review and assessment of the risks associated with the New Third Party, including the internal controls established by the New Third Party to ensure compliance with Consumer Protection Laws, including any related information systems and internal audit procedures, credit policies and procedures, any models or systems, including any variables or weightings used or relied on in connection with a proposed New Bank Product, application forms, marketing materials, and oversight and monitoring procedures ("New Third-Party Risk Assessment");

(ii) An appropriately detailed description of the procedures, processes, and/or other actions the Bank will take to ensure compliance with Consumer Protection Laws and satisfactorily mitigate any risks identified in the New Third-Party Risk Assessment;

(iii) An appropriately detailed description of the procedures and/or processes that will be established by the Bank for the ongoing monitoring of the proposed New Third Party for compliance with applicable Consumer Protection Laws and for appropriately addressing and preventing any noncompliance with Consumer Protection Laws;

(iv) The proposed written agreement with the proposed New Third Party; and

(v) The written assessment and recommendation submitted to the Board as to whether the proposed New Third Party meets the Bank's due diligence standards and the Bank should proceed with executing a binding commitment or agreement with the New Third Party for approval; and, the minutes of the Board authorizing the submission of the proposed New Third Party to the Regional Director for review, and comment or non-objection.

(b) A New Bank Product non-objection request shall, at a minimum, include:

(i) An initial thorough and well-documented review and assessment or risks associated with the New Bank Product, including any modifications of internal controls established by third parties identified on the Current Product and Third Parties List ("New Bank Product Risk Assessment");

(ii) An appropriately detailed description of the procedures, processes, and/or other actions that the Bank will take to ensure compliance with applicable Consumer Protection Laws and satisfactorily mitigate any risks identified in the New Bank Product Risk Assessment;

(iii) Any proposed amendments to the written agreement with the Third Party proposed to offer the New Bank Product; and

(iv) The written assessment and recommendation submitted to the Board as to whether the proposed New Bank Product meets the Bank's due diligence standards and the Bank should proceed with offering the New Bank Product for review and approval; and, the minutes of the meeting of the Board authorizing the submission of the proposed New Bank Product to the Regional Director for review, and comment or non-objection.

(c) The Regional Director will provide written notification to the Bank of the date on which a New Third Party or New Bank Product non-objection request is deemed to be substantially complete, but may request additional information or analysis at any time. The Regional Director will act on a New Third Party or New Bank Product non-objection request within 45 days of the date on which the request was deemed to be substantially complete.

(d) Within 45 days of receipt of comments from the Regional Director, the Bank will address the comments of the Regional Director. If the Bank fails to do so within such 45 day period, the Bank will provide a comprehensive written explanation of its failure to take action to the Regional Director.

(e) For requests receiving the written non-objection of the Regional Director, the Board shall at its next regularly scheduled meeting, adopt the plan, policy, or process as non- objected to by the Regional Director; incorporate the revision or addition to the plan, policy, or process as non-objected to by the Regional Director into the plan, policy, or process and adopt the plan, policy, or process with the pertinent revision or addition; or adopt any other matter for which it received non-objection. These actions must be appropriately reflected in the Board minutes. Thereafter, the Board must ensure that the Bank fully implements and adheres to the plan, policy, process, or other matter as adopted and enforce full and complete compliance with those plans, policies, processes, or other matters. In the event these plans, policies, processes, or other matters as adopted by the Board, or any portion thereof, are not fully implemented or adhered to, the Board must promptly, in no instance more than 7 days from the event, advise the Regional Director in writing of the specific reasons for the deviation or delay and the action it will take to address the deviation or delay. The Regional Director may either provide a written non-objection to any such deviation or delay or require compliance with the plan, policy, process, or other matter.

Oversight of Third-Party Agreements and Services

12. Within 60 days from the effective date of this Order, the Bank shall review, revise, develop, and/or implement, as necessary, effective monitoring, training, and audit procedures to review each aspect of the Bank's agreements with third parties and the services performed for the Bank pursuant to those agreements ("Third-Party Agreements and Services"). The policies and procedures shall, at a minimum, provide for:

(a) A comprehensive process with measurable tracking and monitoring controls for (A) risk assessment and due diligence in selecting a third party; (B) structuring, review, and approval of third-party contracts; and (C) ongoing oversight and monitoring of the relationship with the third party. The policies and procedures shall be commensurate with the steps taken by the Bank to conduct a New Third-Party Risk Assessment and/or New Bank Product Risk Assessment and to mitigate any risks identified in a New Third-Party Risk Assessment and/or New Bank Product Risk Assessment, as described in Paragraphs 11(a)(i) and (ii), and 11(b)(i) and (ii) herein. The policies and procedures shall additionally consider the principles in the following Financial Institution Letters ("FILs"): FIL-29-2023, "Interagency Guidance on Third-Party Relationships: Risk Management," issued on June 6, 2023, and FIL-59- 2021, "Conducting Due Diligence on Financial Technology Companies: A Guide for Community Banks", issued on August 27, 2021.

(b) Bank review and approval of copies of (A) all marketing and solicitation materials, including but not limited to promotional materials, advertising, telemarketing scripts whether delivered through direct mail, the internet, electronically, telephonically, social media platforms, mobile devices, or any other type of media; and (B) any other materials provided to consumers generated in connection with the administration and servicing of the Third-Party Agreements and Services.

(c) Maintenance of records of all agreements with third-party service providers, including any changes or amendments with respect to such materials.

(d) Monitoring of the performance of marketing and solicitation programs.

(e) Prompt notification to the Bank by any third-party service provider of all regulatory agencies' inquiries, customer complaint correspondence, and/or legal action, and maintenance by the Bank of all such documents.

(f) Procedures for promptly addressing and resolving consumer complaints regarding services provided by third parties, regardless of the source.

(g) Bank review of all third-party service providers' policies and practices to determine compliance with all Consumer Protection Laws.

(h) Procedures for appropriate corrective and preventive action when noncompliance with Consumer Protection Laws by a third party is identified and require the establishment of appropriate mitigation steps to prevent any such noncompliance from reoccurring.

13. During the life of this Order, the Bank shall perform due diligence on a semi-annual basis to ensure that third parties have in place an adequate training program to ensure that their employees comply with Consumer Protection Laws, including, but not limited to, the statutes and regulations identified in the Compliance ROE.

14. During the life of this order, the Bank's compliance officer shall, on a semi- annual basis, submit a written report to the Board and senior management as to whether third parties are complying with Consumer Protection Laws.

Compliance Program

15. Within 90 days of the effective date of this Order, the Board and senior management shall review, revise, develop, and/or implement, as necessary, a sound risk-based CMS, including a written compliance program ("Compliance Program") that is designed to effect compliance with all applicable Consumer Protection Laws. The Bank's CMS and Compliance Program shall specifically address compliance with the statutes and regulations identified in the Compliance ROE, as it concerns activities related to any of the Bank's third- party relationships. The written Compliance Program shall be an organized document that guides the Bank's compliance activities and shall be a source document that serves as a training and reference tool for all Bank employees and management. At a minimum, the written Compliance Program shall provide for and include comprehensive written policies and procedures, including detailed operating procedures and controls designed to prevent violations of Consumer Protection Laws and prevent associated risks of harm to consumers, particularly with regard to third-party oversight and the statutes and regulations identified in the Compliance ROE.

16. Additionally, the Board and senior management shall take the following actions to effectuate the CMS and Compliance Program:

(a) Review, revise, develop, and/or implement, as necessary, an effective training program that includes regular, specific, and comprehensive training in Consumer Protection Laws and Bank policies and procedures commensurate with individual job functions and duties for appropriate Bank personnel, including all staff, senior management, and the Board, and shall incorporate training for high-risk compliance areas, including oversight of third- party relationships, Section 5 of the FTC Act, and RESPA. The training program shall include regular, ongoing evaluations to ensure the effectiveness of the training. Senior management, Bank staff, and/or third-party staff who have direct responsibility for overseeing any third-party or strategic partner of the Bank, or for implementing any strategic partnership program of the Bank shall receive enhanced training.

(b) Conduct a review and analysis of the resources, management, and staffing necessary (i) to ensure compliance with all Consumer Protection Laws, (ii) to manage and supervise the Bank's Compliance Program, (iii) to provide sufficient oversight over third-party relationships and products and services offered by or through third-party relationships, and (iv) to appropriately address the violations, weaknesses, and deficiencies identified in the Compliance ROE.

(c) Ensure that appropriate individuals are well trained in compliance matters, including oversight of third-party relationships, that they conduct compliance reviews and/or audits, and that such reviews and/or audits are comprehensive enough to detect technical deficiencies, including the types of deficiencies identified in the Compliance ROE.

(d) Review, revise, develop, and/or implement, as necessary, a well- documented internal and proactive CMS monitoring process incorporated into the daily work of Bank personnel that is designed to detect and promptly correct compliance weaknesses within the Bank and third-party service providers, particularly weaknesses that have an impact on consumer accounts.

(e) Review, revise, develop, and/or implement, as necessary, an effective consumer complaint monitoring process, including the maintenance of adequate records of all written, oral, or electronic complaints or inquiries, formal or informal, received by the Bank and all third parties, and the resolution of the complaints and inquiries. This shall include the regular review of complaints received by third parties, at a minimum, on a monthly basis. Complaints that have high risk, including those involving allegations of deceptive and/or unfair practices, shall be reported to the Board, at a minimum, on a quarterly basis. Any significant trends observed with respect to consumer complaints shall also be reported to the Board, at a minimum, on a quarterly basis.

(f) Review, revise, develop, and/or implement, as necessary, effective independent audit coverage of the Compliance Program and the Bank's compliance with all Consumer Protection Laws and internal policies and procedures. Audit findings, deficiencies, and recommendations must be documented in a written report and provided to the Bank's Audit Committee and the Board after completion of the independent audit. In addition, the audit report should be thoroughly reviewed, responses provided, and actions to be taken by the Bank's Board and fully documented in the Board's minutes.

17. Within 90 days of the effective date of this Order, the Board shall perform a full review of all compliance policies and procedures to ensure compliance with all Consumer Protection Laws.

18. Within 90 days of the effective date of this Order, the Board shall perform a full review of the Bank's training program to ensure compliance with all Consumer Protection Laws.

19. Within 90 days of the effective date of this Order, the Board shall perform a full review of all compliance monitoring procedures, including those areas identified as weak in the Compliance ROE to ensure compliance with all Consumer Protection Laws.

20. Within 90 days of the effective date of this Order, the Bank shall complete any changes to its CMS and/or Compliance Program after reviewing its CMS and Compliance Program, and the Board shall review and approve, and record those changes in the Board's minutes. Any subsequent revisions to the Bank's Compliance Program and/or CMS shall also be reviewed and approved by the Board, and recorded in the Board's minutes.

21. The Bank shall comply with the written Compliance Program and/or any subsequent modification of the Compliance Program.

22. During the life of this Order, the Bank shall regularly perform a full review (not less than annually) of each of its compliance policies and procedures to confirm that they properly address all applicable Consumer Protection Laws.

23. Within 180 days from the effective date of this Order, and at least annually thereafter, the Bank shall perform an internal review, including transactional testing, of all compliance monitoring procedures to determine the effectiveness of the monitoring procedures to ensure compliance with all Consumer Protection Laws. The review shall include any areas identified as weak in the Compliance ROE. Monitoring procedures should include review of services provided by third parties to ensure regulatory compliance.

II. NOTIFICATION AND REPORTING REQUIREMENTS

24. On or before the 30^th day after the end of the first calendar quarter following the effective date of this Order, and on or before the 30^th day after the end of every calendar quarter thereafter, the Board shall furnish written progress reports to the Regional Director detailing the form and manner of any actions taken to secure compliance with this Order and the results thereof.

25. Within 30 days from the effective date of this Order, the Board shall provide its parent holding company, First Northwest Bancorp, with either an accurate and complete description of all material aspects of the Order or a copy of the Order.

III. SAVINGS CLAUSE AND EFFECTIVE DATE OF ORDER

The provisions of this Order shall not bar, estop, or otherwise prevent the FDIC or any other federal or state agency or department from taking any other action against the Bank or any of the Bank's current or former institution-affiliated parties, as that term is defined in Section 3(u) of the FDI Act, 12 U.S.C. § 1813(u).

The provisions of this Order shall be binding upon the Bank, its institution-affiliated parties, and any successors and assigns thereof.

This Order will become effective upon its issuance by the FDIC. The provisions of this Order shall remain effective and enforceable except to the extent that and until such time as any provision has been modified, terminated, suspended, or set aside by the FDIC.

Issued pursuant to delegated authority.

Dated this 21st day of November 2023.

	Dana L. Crutchfield Deputy Regional Director Division of Depositor and Consumer Protection San Francisco Region