Mere days away from celebrating its first birthday, last week the Consumer Financial Protection Bureau came of age.
For months observers have wondered who would be the target of the CFPB's first enforcement action. On July 18, the suspense ended—with a consent decree that requires Capital One Bank to refund $140 million to nearly 2 million customers and pay a $25 million penalty.
Working with the Office of the Comptroller of the Currency, the CFPB probe found that Capitol One's vendors used “deceptive marketing tactics” to pressure and allegedly mislead consumers into paying for add-on services, such as “Payment Protection” in the case unemployment or disability, and “Credit Monitoring,” often touted, wrongly, as capable of boosting credit scores and limits.
In addition to a monetary hit, Capital One agreed to a CFPB consent order, which will be monitored by an independent auditor. The company is prohibited from selling add-on products until a compliance plan is approved that guides how future disclosures are made to consumers. It will cover such details as the sales scripts used by salespeople, the type size used in written materials and satisfying an edict that verbal pitches must be “spoken and disclosed in a volume, cadence and syntax sufficient for an ordinary customer to hear and comprehend.”
Jeff Taft, a partner with law firm Mayer Brown, warns that even with this long-anticipated announcement, plenty of uncertainty remains for the banks and non-banks that fall under the purview of the still-maturing CFPB.
“I don't think there is going to be any less uncertainty or less concern,” Taft says. “They have shown their hand a little bit, but you still have to wonder, what's the second enforcement action? What's the third one?”
That lingering uncertainty could prove costly.
A new survey of executives and lawyers at large financial institutions by Mayer Brown found what the firm described as “grave concerns” about the effect of the CFPB. Among those concerns: skyrocketing regulatory compliance costs, and fear that the privacy of privileged information could be compromised, which in turn could drive a host of private or class-action lawsuits. Most respondents (70 percent) said they expect that regulatory compliance costs could jump by as much as 50 percent once the CFPB begins regulation and enforcement.
A little more than half (60 percent) of survey respondents with $10 billion or more in assets say they've either amended existing policies and procedures, or created new ones, to handle CFPB requests for data. Only 30 percent of those below the $10 billion threshold have yet to do so.
Joe Lynyak, a partner with Pillsbury Winthrop Shaw Pittman, agrees with those who say the CFPB will “ultimately mean significantly increased compliance costs.”
“We are hearing from all sorts of lenders and depository institutions that they feel inundated with increased costs because of the overhang of the CFPB and some of their pronouncements about enhanced supervision and enforcement,” he says.
Taft said his firm's survey shows that uncertainty is driving the concerns of legal and compliance executives—especially for non-banks that haven't historically been subject to comprehensive federal supervision and examination.
“Everybody expects that as part of the examination process, the CFPB is going to find things that they want corrected, things that they don't feel are adequate,” he says. “To protect against that, people are ramping up their compliance procedures to address issues they think the CFPB is likely to be most interested in.”
Lynyak says another fundamental question is whether the CFPB will view itself as more of an enforcer or a regulator. “Will it be encouraging realistic, effective compliance? Or will it be enforcing observable violations?” he asks. “If you're a regulator, maybe you're concerned with encouraging people to have adequate risk-management procedures in place. That's an entirely different posture than saying they have identified statutory violations they have to enforce.”
“We are hearing from all sorts of lenders and depository institutions that they feel inundated with increased costs because of the overhang of the CFPB and some of their pronouncements about enhanced supervision and enforcement.”
—Joe Lynyak,
Partner,
Pillsbury Winthrop Shaw Pittman
Eighty percent of those polled in the Mayer Brown survey said they worry about providing privileged information to the CFPB, fearing that they might waive attorney-client privilege regardless of any CFPB policy to the contrary. The survey also cites as a “key wildcard” the CFPB's interaction with state attorneys general.
The fear is that because most state attorney generals are elected and often use their positions as a springboard to higher office, the AGs could have a strong political incentive to ally with the CFPB on enforcement actions and collect lots of headlines with voters back home. Equally unsettling: the prospect that information the CFPB shares with state attorneys general might find its way to plaintiff lawyers, opening the door to class-action lawsuits.
“It's one thing, as part of the examination process and regulatory process, to understand how the CFPB is going to view something,” Taft says. “But the CFPB doesn't speak for the state [officials]. Even though it may agree with your interpretation, that doesn't mean that 50 state AGs with different agendas are going to.” Non-bank lenders, he says, could find themselves surrounded by the CFPB, the Federal Trade Commission, and a posse of state attorneys general. “Is the CFPB just going to be another agency piling onto an investigation, rather than being the primary agency?”
A related question: Will the CFPB share examination reports it prepares, or that it reviews from other banking regulators, with the state attorneys general?
CFPB COMPLIANCE FINDINGS
Below are some key findings from the Mayer Brown survey on CFPB regulation:
Most respondents (70%) expect that regulatory compliance costs could go up by as much as 50% once the CFPB begins regulation and enforcement in earnest.
A majority of respondents (62%) believe that the working relationship between the CFPB and state attorneys general will be uncoordinated, resulting in overlapping and duplicative investigations.
Virtually all respondents (80%) are concerned about providing privileged information to the CFPB, fearing that by doing so they might waive attorney-client privilege regardless of any CFPB policy to the contrary.
A vast majority of respondents (75%) predict that private litigation from class action lawsuits will increase as a result of CFPB enforcement actions, with more than three quarters of companies foreseeing a large or at least moderate increase.
Source: Mayer Brown.
Examination reports often point out deficiencies within the bank, but to encourage candid conversations between the regulator and the regulated that information typically isn't disclosed, Taft says. If those reports are passed onto third parties, including the states, those established privacy protections would fall away and litigation risk increase.
There has been a legislative attempt to address industry concerns on the treatment of privileged information. Specifically, whether providing documents protected by attorney-client privilege to Bureau examiners could waive the institutions' privilege with respect to third parties.
A bill approved by the House would extend protections offered under the Federal Deposit Insurance Act to the CFPB. A Senate version, however, has stalled.
On June 28, the CFPB itself sought to allay concerns and “provide maximum assurances of confidentiality” when it issued a final rule it says protects privileged information and maintain that protection if it is transferred to another federal agency or to states.
The CFPB stated that because the information was not provided voluntarily, attorney-client privilege would not be waived.
For those who question the CFPB's legal authority to demand such materials in the first place, those assurances fall short, especially given that the Bureau has conceded that it will may share privileged material with state attorneys general and other agencies.
Lynyak says the CFPB's interpretation that it has the right to see confidential information “is just simply wrong on the law,” and warns that the agency has signed agreements to share information with other governmental entities “that may have an entirely different agenda for the use of information that they receive.”
“Sharing of data—even though it may be a piece of paper saying, ‘We intend to keep things confidential,'— doesn't necessarily make it so,” he says. “I think there is going to be a long period of time when targeted financial services companies are going to be at risk.”
The CFPB does plan to provide advance notice of potential enforcement actions to individuals and firms under investigation, akin to the Wells notices sent by the Securities and Exchange Commission. Known as the “Notice and Opportunity to Respond and Advise” process, “NORA notices” are intended to allow subjects of a CFPB probe to respond to potential legal actions before the agency decides whether it should take formal legal action.
Lynyak says the distinction between proceeding with an investigation, versus concluding a supervisory examination, is critical. If NORA notices are sent after an examination, “that could be a nightmare for the industry” because federal securities law could end up forcing a bank to disclose the existence of a NORA notice to the market.
“You may have to say to the public that the CFPB examined us and believes we violated federal consumer laws,” he says. “You're telegraphing to the plaintiffs' bar, ‘Come and sue us, because the CFPB has got the goods on us'.”
That dynamic could lead to game of chicken between the CFPB and banks, where the CFPB could use the threat of a NORA notice—which might then be disclosed, and attract plaintiff lawyers like sharks to blood in the water—to pressure a bank into a quick regulatory settlement.
Banking agencies typically give a chance to resolve issues, Lynyak says, “they have a baseball bat, but they don't hit you with it the first time.” However, he adds, “people are fearful, when they look at some of the pronouncements out there, that seem to indicate [the CFPB] is going to be an enforcer versus a regulator.”
No comments yet