Attorneys, Members of Congress and Industry Groups Fight Back
After five years in operation, and under the auspices of preventing unfair, deceptive or abusive acts or practices (UDAAP), the CFPB continues to exert its power and authority over the financial industry in troubling ways. This year alone, it successfully argued against a statute of limitations for UDAAP violations and proposed a UDAAP rule on small-dollar loans that many believe could decimate this sector of the financial services industry. Further, the escalating enforcement actions meted out by the CFPB portend troubling times ahead. Some experts believe the CFPB may well have overstepped its bounds, causing these moves to backfire against it: attorneys for financial institutions fined by the CFPB, along with members of Congress and industry groups, are all working to ensure that this rising sentiment yields a fairer and more balanced CFPB in both structure and authority.
Three Troubling UDAAP Trends
When the Dodd-Frank Act first ushered in the UDAAP era, many in our industry expressed serious concerns about the vague language of the regulation and the lack of specific guidance from the CFPB. Today, those concerns are proving well founded, as the CFPB appears bent on expanding its UDAAP sphere of influence through a variety of troubling means. Based on its coverage of the CFPB, the Gibson Dunn legal team warns that the agency “will make use of its UDAAP authority in a wide range of circumstances and across a wide range of industries.”
- CFPB Argues to Eliminate Statute of Limitations on UDAAP Violations
In a stunning move this spring, a CFPB administrative law judge (ALJ) upheld Director Richard Cordray’s ruling that no statute of limitations exists for UDAAP violations brought through the bureau’s administrative proceedings, rather than through civil court. While the ruling is currently under appeal with the DC Circuit Court, it stands as law until that appellate court either upholds or overturns the ruling.
According to the law firm of Barnett Sivon and Natter, the Consumer Financial Protection Act (CFPA) provides the CFPB three ways to deal with violations: “The CFPB may: (1) engage in investigations and administrative discovery, including issuing subpoenas and civil investigative demands (section 1052 of the CFPA); (2) conduct hearings and adjudication proceedings (section 1053); or (3) bring a civil action in court (section 1054).” Unfortunately, only the civil court option is subject to a statute of limitations—three years.
What does this mean for financial institutions? Bloomberg BNA bluntly, but accurately, answers that question: “This has important ramifications for anyone subject to the CFPB’s enforcement powers because the CFPB may seek the same remedies administratively as it can in federal court, including large penalties for novel UDAAP theories.” To that point, close to 60 percent of the CFPB’s enforcement actions to date have been administrative filings. This includes actions with some of the largest fines.
- CFPB Proposes Rule that Applies UDAAP to an Entire Sector of Our Industry
Speaking of novelty, the CFPB issued a proposed rule in June that, for the first time, applies UDAAP to an entire industry sector—payday and small-dollar lending. Two CFPB press releases suggest that the proposed rule is about ability to repay, as neither mention UDAAP. The actual proposal, however, delineates the practices within this sector that the CFPB deems unfair, deceptive or abusive.
Lest you think this doesn’t apply to your institution if you don’t offer payday loans, auto title loans, deposit advance products or certain high-cost installment and open-end lines, think again. American Banker notes, “the CFPB’s proposals seem to be directed at smashing and then remaking the small-dollar lender industry to its liking, rather than preventing particular harmful acts or practices.” If the CFPB can do this to one sector, what’s to stop it from doing the same to other industry sectors?
The Association of Credit and Collection Professionals expresses its fear that CFPB bulletins on debt collection practices suggest the same fate for its sector: “Because the UDAAP language is so broad and vague, the CFPB is able—and has shown it is willing—to use its UDAAP authority to challenge conduct it merely finds troubling, even if not in violation of any express legal requirement.”
- CFPB Enforcement Actions Reveal Its UDAAP Intentions
The CFPB has issued 139 enforcement actions since 2012. As indicated above, a large percentage of those were filed through its administrative channel. From 2012 through 2015, the administrative filings accounted for more than half of each yearly total. However, in 2016 that changed, presumably as a result of the statute of limitations ruling. Through mid-September, 76 percent of the 2016 enforcement actions were administrative proceedings. Institutions should expect this trend to continue.
The CFPB has slapped heavy UDAAP penalties on the four largest banks by assets, and three of the major credit card companies have felt million- and multi-million-dollar UDAAP stings. Many regional banks, mortgage companies and community banks also ended up on the wrong side of the CFPB on UDAAP. The moral here: all institution types and sizes are vulnerable.
Finally, UDAAP has been cited in 3 out of every 4 enforcement actions to date. Clearly, the CFPB has found its weapon of choice.
Three Groups Work to Slow These UDAAP Trends
Will the CFPB succeed in its quest for greater influence on our industry through its UDAAP authority? Three groups are working toward a different end.
Attorneys for the Defense
Attorneys involved in the statute of limitations appeals have pulled out their own arsenal. As Barnett Sivon and Natter points out, in one appeal, defense attorneys questioned the very constitutionality of the statute of limitations rule, indicating that removing such limitations “would impose new duties and burdens on persons after the fact, violating retroactivity principles found in the Constitution.”
Members of Congress
For their part, various members of Congress have proposed legislation to limit the CFPB’s authority or alter its structure. The CFPB Monitor reports that, “Republican Congressman Blaine Luetkemeyer has introduced the ‘Unfair or Deceptive Acts or Practices Uniformity Act,’ which would remove the CFPB’s authority to regulate abusive acts or practices.” Both Senator Richard Shelby and Congressman Randy Neugebauer have proposed bills to transform the CFPB structure to mirror those of other federal agencies. If successful, the current CFPB directorship would be replaced by a bipartisan five-member commission and would be subject to the congressional appropriations process, unlike today.
The CFPB Monitor indicates that “eight leading financial services trade groups have sent a letter to Mr. Neugebauer expressing their support for the bill.” This is but one example of how such groups as the American Bankers Association, the National Association of Credit Unions and others are working on behalf of our industry when it comes to UDAAP. They also publish updates regarding UDAAP, conduct webinars and write educational articles, and advocate for the industry perspective within Congress.
Three Steps Your Institution Should Take to Ensure UDAAP Compliance
Our article, “Surviving UDAAP: CSI’s Guide to Compliance,” identifies tips for improving your institution’s UDAAP compliance stance. While all are important to review, three call for specific emphasis in light of these recent trends.
- Understand Your Risk from UDAAP
This is where many institutions fall short, by either inadequately assessing their UDAAP risk—or not doing it at all. It may not be a required box, but that won’t stop regulators from expecting your institution to have a firm grasp on its UDAAP risk. Perform a detailed and dedicated UDAAP risk assessment now, and plan to routinely review and update it.
- Develop Your Policy to Prevent UDAAP
The good news: a decent number of institutions now have a UDAAP policy in place. The bad news: that policy tends to be a generic one, copied from either another institution or a different regulation. Make sure your UDAAP policy is specific to your institution’s unique risk profile, including its products, services, channels and systems. This will yield a much better exam outcome.
- Pay Attention to UDAAP News and Get Involved
Don’t just sit back and let Congress and industry groups advocate for you. Follow the developments in the statute of limitations case and in UDAAP-related CFPB enforcement actions; comment on the proposed small-loan rule; and advocate for your industry through your state’s congressional representatives.
Will the CFPB Stay on its Current Course?
Citing the CFPB’s inclusion of a Request for Information (RFI) within the proposed rule on small-dollar loans, the Consumer Financial Services Law Blog suggests that, if left to its own devices, the CFPB will stay the course. That RFI asks “additional questions about certain lines of credits, longer-term installment loans and open-end lines of credit, raising the possibility of additional rulemakings in the future.”
Everyone can hope that those working to curtail such additional CFPB rulemakings will be successful, but no one can afford to wait and see. Regardless of whether you’re a regional or community bank; a depository institution or payday lender; or a mortgage or credit card company, pay close attention to UDAAP compliance, or face the costly consequences.
Amber Goodrich, compliance strategist for CSI Regulatory Compliance, has more than 10 years of financial industry experience. She is a Certified Regulatory Compliance Manager (CRCM) and Certified Bank Secrecy Act (BSA) Professional (CBAP).