- CBA on
- CBA Media
FSR-CBA-CMC Joint CFPB Enforcement Comment Letter
May 14, 2018
VIA EMAIL AND COURIER
Office of the Executive Secretary
Bureau of Consumer Financial Protection
1700 G Street NW
Washington, DC 20552
Re: Request for Information Regarding Enforcement Processes, Docket No. CFPB-2018-0003
Dear Ms. Jackson,
The Financial Services Roundtable, Consumer Bankers Association, and Consumer Mortgage Coalition (collectively, the Associations) appreciate the opportunity to comment on potential changes to the Bureau of Consumer Financial Protection’s (Bureau or CFPB) enforcement processes.
INTRODUCTION AND EXECUTIVE SUMMARY
The Bureau serves an important function to provide vigilant oversight across the consumer financial landscape, especially where institutions might not otherwise be subject to federal oversight. The Associations believe that the Bureau can use its enforcement powers to facilitate a thriving and stable consumer financial market. As discussed herein, the Bureau’s enforcement practices can be improved in order to ensure that these objectives are met.
Most importantly, since inception the Bureau has operated in a manner commonly referred to as “regulation by enforcement action,” with myriad negative implications for the industry and consumers alike. Specifically, the Bureau has utilized enforcement actions to announce new standards for the industry in lieu of issuing rules or other guidance to provide advance notice of the types of conduct that it deems problematic. Consistent with the general sentiment of the industry, the U.S. Department of Treasury recently observed that the Bureau has demonstrated an “[e]xcessive reliance on enforcement actions, rather than rules and guidance, to regulate conduct.” The Bureau has pronounced new “rules” in aggressive enforcement actions, a course of conduct that is inconsistent with its mission and direction, as articulated by Acting Director John Michael (Mick) Mulvaney.
In recent years, Bureau enforcement actions predicated on novel and aggressive legal theories have had significant, costly, and unexpected impacts on entire industries. By way of example, such actions include the Bureau’s application of a fair lending “disparate impact theory” to indirect auto lenders, its stance in connection with Real Estate Settlement Procedures Act (RESPA) matters, and overreaching in connection with certain actions related to the sale, servicing, and marketing of ancillary products.
In other enforcement actions, the Bureau has punished institutions for alleged violations of Bureau regulations immediately after their effective date, relying in whole, or in part, on its power to prohibit unfair, deceptive or abusive acts and practices (UDAAP), or used enforcement actions to declare disagreement with other agency’s interpretive positions. In PHH Corp v. CFPB, for example, federal district and appellate courts have rejected the Bureau’s legal interpretation of RESPA, which departed from the U.S. Department of Housing and Urban Development’s (HUD) longstanding interpretation. Insofar as most institutions have chosen to avoid public battle with the Bureau (often a primary regulator of many who have been investigated), unprecedented legal theories and unreasonable demands for relief have gone unchecked.
The Bureau also has leveraged its power to prohibit UDAAPs to challenge conduct that does not otherwise violate the law or to impose new legal standards retroactively. For example, the Bureau recently alleged UDAAP violations against a mortgage servicer for conduct it only later prohibited through rulemaking. The Bureau’s decision to define the contours of UDAAP through enforcement actions, instead of through its rulemaking process, exemplifies its past preference for “regulation by enforcement.”
The Bureau also has pursued claims and conduct that are unsupported in view of jurisdictional constraints, statutes of limitation, and factual substantiation. For example, in PHH Corp v. CFPB, both federal district and appellate courts held that the Bureau is bound by RESPA’s statute of limitations for its RESPA claims, instead of longer statutes of limitations that the Bureau attempted to use in the context of enforcement investigations. Similarly, the Bureau often has pursued conduct that occurred prior to the effective date of Dodd Frank’s UDAAP statute; a federal court has held that the Bureau has no authority to do so.
The Bureau also has asserted claims that it was unable to substantiate. For example, the Bureau charged an institution with alleged violations of federal consumer financial law based on very “conclusory” evidence, claims which a court dismissed in a strongly worded opinion. These actions are illustrative of the Bureau’s frequent attempts to extend its reach in ways that are improper, yet they only encompass the public actions where the Bureau litigated its claims. There are countless other examples which arose in the context of confidential investigations and consent orders where the Bureau’s arguments were not subject to judicial review.
Improper “regulation by enforcement” exists not just in the Bureau’s legal claims but also in the conduct provisions in consent orders. Such conduct provisions, for example how a specific institution must conduct its sales calls, are not always tethered to any apparent legal requirement, yet in the past the Bureau has suggested that other institutions must also follow these conduct provisions to avoid themselves becoming the subject of enforcement. For example, former director Richard Cordray said that enforcement orders “provide detailed guidance for compliance officers across the marketplace about how they should regard similar practices at their own institutions” and that “it would be ‘compliance malpractice’ for executives not to take careful bearings from the contents of these orders about how to comply with the law and treat consumers fairly.” Expecting an entire industry to follow conduct provisions negotiated with just one institution and sometimes not grounded in any specific law is yet another example of the Bureau’s past overreach.
The Bureau’s “regulation by enforcement” and consistent overreach run counter to the Bureau’s core purposes, which include ensuring that “Federal consumer financial law is enforced consistently [. . .] in order to promote fair competition.” Contrary to this purpose, the Bureau sometimes selects and punishes a single institution to advance its industry-wide interpretations, which results in inconsistent enforcement. Accordingly, we applaud the Acting Director’s new strategic direction for the agency, where the Bureau will no longer attempt to “push the envelope” with its enforcement authority. Below we address those aspects of the Bureau’s enforcement process that the Associations’ members view as particularly problematic and offer suggestions for improvements. To that end, and as discussed below, the Associations make the following recommendations to improve the Bureau’s enforcement processes.
Recommendations on Communicating with Subjects of Investigations
The Associations recommend that the Bureau’s Office of Enforcement (Enforcement) increase its engagement and communication with institutions at the outset and during investigations by (i) holding periodic status meetings with institutions under investigation, including at the outset of the investigation and not less than once a quarter, during which Enforcement must “meaningfully engage” with the institution; (ii) providing the institution with an opportunity to explain to senior Enforcement personnel why an enforcement action is inappropriate prior to the issuance of a Notice and Opportunity to Respond and Advise (NORA) letter; and (iii) implementing a formal process for closing investigations without findings.
Recommendations on Length of Bureau Investigations
The Associations recommend that the Bureau require resolution of investigations within a prescribed time period absent extenuating circumstances, and require Enforcement to engage in internal “touchpoint” meetings, not less than quarterly, in which line level Enforcement attorneys must inform their superiors of the progress they have made in their investigation, their theory of the case, and their preliminary findings.
Recommendations on the Notice and Opportunity to Respond and Advise (NORA) Process
Given the importance of the NORA process, the Associations recommend a number of enhancements.
- First, Enforcement should provide a NORA in all applicable investigations unless exigent circumstances require Enforcement to seek immediate relief.
- Second, the Bureau should require that the NORA call and NORA letter include the specific provisions of laws allegedly violated, citations to specific evidence relied upon, and an application of the law to the specific evidence to demonstrate the alleged violation. Additionally, if Enforcement is relying on specific evidence that the institution did not provide during the investigation, Enforcement should allow the institution the opportunity to review key materials within its investigative file, absent good cause to withhold such information.
- Third, the Bureau should provide a minimum response timeframe of 30 days and a page limit of 60 pages for NORA responses, and provide Enforcement attorneys with greater discretion to set more flexible timelines and page limits based on the specifics of the investigation.
- Fourth, the Bureau should remove the NORA response requirement to include a declaration attesting to all factual assertions under a penalty of perjury; if the Bureau preserves this requirement, however, the Bureau should permit the declarant to limit their attestation to their personal knowledge after a reasonable investigation of the relevant facts.
- Finally, the Bureau should provide greater transparency to and oversight of its decision-making process after receiving a NORA response, including by requiring that Enforcement meet directly with the institution, after it has determined based on the NORA response whether an enforcement action is warranted, to discuss the merits of the institution’s NORA response and the basis for any further action by the Bureau.
Recommendations on Affording Subject the Right to Make In-Person Presentation Prior to the Bureau Determining Whether to Initiate Legal Proceedings
The Associations recommend that Enforcement offer all institutions under investigation the opportunity to make an in-person presentation before the issuance of a NORA, with discretion given to the institutions to turn down such opportunity, and that Enforcement invite senior representatives of the Bureau with decision-making authority to those presentations, as well as perhaps Bureau lawyers who have no connection to the matter.
Recommendations on Calculation of Civil Money Penalties (CMP) and Restitution
The Associations urge the Bureau to implement a formal CMP matrix through the Bureau’s rulemaking process and require that Enforcement provide to institutions its written basis for any proposed CMPs. In addition, in order to enhance transparency regarding the Bureau’s proposed restitution amounts, the Associations recommend that the Bureau issue public guidance outlining its approach to restitution and disgorgement and require Enforcement to provide in writing in any proposed enforcement action its basis for its proposed restitution amounts or criteria.
Recommendations on Standard Provisions in Bureau Consent Orders
The Associations recommend that the Bureau (i) discontinue the use of standard, non-negotiable terms in its consent orders; (ii) include in its consent orders only those facts necessary to support each prong of its claim(s) and discontinue use of inflammatory language that misrepresents the facts at issue in the case; (iii) implement internal guidelines that govern the content of press releases related to consent orders; (iv) align its proposed injunctive relief with the business realities of institutions; (v) develop a formal mechanism through which an institution can seek review of Enforcement’s interpretations of a signed consent order’s terms; and (vi) develop a formal closure process for its consent orders that is meaningfully tied to the satisfaction of requirements.
Recommendations on Coordinating Enforcement Activity with Other Federal and/or State Agencies with Overlapping Jurisdiction
The Associations recommend that the Bureau better coordinate enforcement activity with other agencies with overlapping jurisdiction, including by allowing a single agency, where appropriate, to take the lead in the investigation. The Bureau should also allow other agencies to address their concerns through limited non-duplicative requests, resolve investigations collectively rather than through separate public enforcement actions, and, where another federal agency opposes the Bureau’s position, consult with the objecting agency before deciding whether to pursue an enforcement action.
Recommendations on the Bureau’s Responsible Conduct Bulletin
In order to ensure that institutions continue to have an incentive to self-report, and to reduce confusion introduced by the Bureau’s Responsible Conduct Bulletin, the Associations make the following recommendations: (i) that the Bureau’s Legal Division and Associate Director of Supervision, Enforcement and Fair Lending institute greater oversight over Enforcement to ensure that institutions are not routinely punished with investigations or enforcement actions after self-reporting their conduct to the Bureau, but instead are provided credit where it is due; (ii) that the Bureau publish a procedure for self-reporting; (iii) that the Bureau advise Enforcement against public enforcement action where the conduct at issue already has been identified by the institution, especially where the self-detected conduct is the sole conduct at issue in the prospective action; and (iv) that the Bureau revise its Responsible Conduct Bulletin to remove its significant exceptions.
The Associations discuss each of these recommendations in more detail below.
1.Communication between the Bureau and the subjects of investigations, including the timing and frequency of those communications, and information provided by the Bureau on the status of its investigation
Enforcement does not engage in adequate communication with the subjects of its investigations, with respect to the nature, scope, and status of its investigations. The Associations therefore recommend more frequent, substantive communications with institutions under investigation, which will improve the efficiency of Enforcement investigations and the preparedness of institutions for Enforcement requests.
- Disclosure of Nature and Scope of the Investigation
In the experience of our members, Enforcement is inconsistent in its willingness to disclose the nature and scope of the investigation to the subject. For example, in some instances, Enforcement attorneys clearly outline their concerns to the institution at the outset of the investigation, including the specific information the Bureau hopes to obtain in response to civil investigative demands (CID). Such disclosures not only lead to improved and open dialogue throughout the investigation, but they also facilitate the institution’s collection and delivery of documents, data, and information responsive to Enforcement requests. Furthermore, with additional information from Enforcement, institutions are able to identify potential compliance issues based on Enforcement’s concern, and as necessary, they are able to proactively remediate potentially affected consumers and adopt operational changes to resolve acts or practices that may be of concern to Enforcement.
More commonly, however, Enforcement provides little to no detail regarding the nature or scope of its investigation, leaving the institution to speculate about the legal theories, causes of action, and timeline of the investigation. This lack of information from the Bureau impedes efficiency, causes uncertainty regarding “legal violations,” and impedes proactive resolution of legitimate concerns regarding consumer protection. Among other things, the lack of factual specificity often causes uncertainty at an institution as to what is and what is not permissible. Additionally, the lack of legal specificity exposes institutions to “regulation by enforcement,” presenting exposure in connection with activities not previously believed to be prohibited. Perhaps most importantly, this lack of information prevents the institution from taking action to remediate consumers or proactively change practices prior to the culmination of what may be a lengthy investigation. Put simply, proactive, open, and fulsome disclosure by Enforcement of the nature and scope of the investigation helps institutions identify and recalibrate potentially concerning practices quickly, ultimately benefitting consumers by halting any consumer harm as quickly as possible.
- Communication Regarding Status of Investigation
Throughout investigations, which often span multiple years and CIDs, Enforcement typically provides little communication on the status of the investigation or their review of the documents, data, and information produced to the Bureau. As discussed in our response to the Request for Information on the Bureau’s CIDs (CID RFI Response), our members often devote significant time, expense, and other resources to meet strict CID production deadlines in a timely manner. However, during investigations, Enforcement rarely provides updates and may remain silent for several months or longer, even when met with the institution’s requests for updates or feedback regarding the status of the investigation. Making matters more challenging, after months of silence, Enforcement may suddenly contact the institution with significant follow-up requests for additional information, documents, or data with little time provided for the institution to respond.
The failure to update institutions regarding the status of an Enforcement investigation creates similar negative effects as described immediately above. Further, if institutions are unaware of the status or potential outcome of an Enforcement investigation, there may be myriad negative business implications, which in turn, may negatively affect consumers. By way of example, the institution may pause or cancel potential business transactions, new product offerings, or improvements to existing products. By leaving institutions in the dark, therefore, Enforcement adversely affects the consumer financial services industry and its consumers. The absence of dialogue also negatively impacts the Bureau by making its investigations less efficient and unnecessarily adversarial. Accordingly, all parties would benefit from more periodic and substantive communications with institutions during investigations.
The Associations recommend that Enforcement increase its engagement and communication with institutions at the outset and during investigations. To ensure this occurs in practice, the Associations set forth the following three recommendations:
Periodic Status Meetings. The Associations recommend that Enforcement be required to hold periodic status meetings with institutions under investigation. These meetings should occur at the outset of the investigation and not less than once a quarter until the investigation’s closure, and should include both the line Enforcement attorneys and their supervising Assistant Litigation Deputy. To ensure these meetings are effective, the Bureau should require that Enforcement “meaningfully engage” with the institution, which is the same level of engagement expected of institutions when they “meet and confer” with Enforcement. For example, Enforcement should be required to inform the institution of the evolving nature, scope, and purpose of its investigation, beyond the limited detail provided in the Notification of Purpose found in CIDs, unless there is good cause to withhold this information. With this information, institutions will be better positioned to respond to Enforcement’s requests and proactively address potential compliance risks.
Meeting Prior to NORA. The Associations recommend that, prior to the issuance of a NORA, the institution receive an opportunity to explain to senior personnel in Enforcement why an enforcement action is not appropriate. This will ensure enhanced communication between the Bureau and the institution prior to the NORA process, instead of the Bureau’s current practice of reserving its more detailed, substantive communications until after a NORA is issued (to the extent that such communications occur at all).
Meeting to Discuss Formal Closure of Investigations. The Associations also recommend that the Bureau implement a formal closure process for investigations closed without findings, to ensure institutions understand why Enforcement decided against further action. This process should include discussion of the Bureau’s observations (or lack thereof) and details regarding the reason why the Bureau did not pursue an enforcement action. This level of communication will provide institutions with greater certainty that the investigation has fully concluded and allow it to better monitor its practices for compliance with federal law in the future, providing a benefit to the institution, the consumers that the Bureau protects, and the Bureau itself, to the extent that this communication can facilitate an institution’s self-policing.
These recommendations, taken together with our recommendation in the next section to require internal Enforcement “touchpoint” meetings, will ensure that institutions remain apprised of the investigation’s progress, the focus of its concerns, and the legal theories underlying its potential case.
2.The length of Bureau investigations
In the experience of our members, Enforcement investigations regularly take years to resolve and seem to last longer than comparable investigations at prudential regulators. Indeed, institutions often are in a “fire drill” to provide information to the Bureau in a short timeframe, but once the information is provided, there often is an untimely response from the Bureau, months later. Moreover, it is not uncommon for investigations to appear to go dormant for several months, if not longer, with very little communication from the Bureau investigator as to why. Not only is this dormant time unnerving to an institution, but institutions also continue to expend significant time and resources during this time. Among other things, there are continued obligations to preserve potentially responsive materials, the institution needs to remain prepared for a spontaneous Bureau request, and major internal and external initiatives may be placed in limbo. The Bureau’s inconsistent approach to conducting investigations, where some are elongated and others more expeditious, also negatively affects consumers insofar as legitimate enforcement action is taken because consumers do not receive timely relief and revision of ongoing practices is delayed.
- Adverse Consequences of Lengthy Investigations
The length of Enforcement investigations leads to many different kinds of adverse consequences. Investigations place significant strain on an institution’s resources, in the form of legal, business, and compliance costs, including in connection with protracted collection and production of information. Additionally, there can be significant reputational, financial, and operational burdens for institutions that remain under active Enforcement investigations. For example:
- Prospective business transactions may require the disclosure of any active investigations by federal agencies. If an investigation has remained active for a significant period of time, interested parties—such as purchasers, sellers, partners, or regulatory agencies—may take note of the investigation’s length and infer adverse conclusions, such as a potential public settlement with harsh penalties.
- Our publicly traded members report negative effects with investors and shareholders, as some publicly traded institutions disclose the existence of an Enforcement investigation in their public securities filings. The longer an investigation remains in the public securities disclosures, the more negatively investors may view the investigation, which can cause financial harm to the institution in numerous ways.
These burdens, taken together, impose significant financial, legal and reputational costs on institutions under Bureau investigation.
- Impact on Ongoing Supervisory Examinations
In some instances, investigations carry on for so long that overlapping Bureau supervisory examinations begin before the investigation is closed. This puts the supervised institution in the untenable position of undergoing an examination that may encompass issues for which it is currently under investigation. This also wastes valuable time and resources at the Bureau by having two teams reviewing the same conduct.
To resolve these issues, the Associations recommend that Enforcement consider reducing investigation length, requiring that the investigation must be resolved within a prescribed time period absent extenuating circumstances. To this end, we recommend that the Bureau require that Enforcement engage in internal “touchpoint” meetings, not less than quarterly, in which line level Enforcement attorneys must inform their superiors about the progress they have made in their investigation, their theory of the case, and their preliminary findings. In the opinion of the Associations’ members, this will impose accountability on the line level attorneys to keep the investigation moving forward and allow senior management to intervene if it believes that continuing the investigation is no longer warranted.
3.The Bureau’s Notice and Opportunity to Respond and Advise process, including:
- CFPB Bulletin 2011-04, Notice and Opportunity to Respond and Advise (NORA), issued November 7, 2011 (updated January 18, 2012) and available at http://files.consumerfinance.gov/f/2012/01/Bulletin10.pdf, including whether invocation of the NORA process should be mandatory rather than discretionary; and
- The information contained in the letters that the Bureau may send to subjects of potential enforcement actions pursuant to the NORA process, as exemplified by the sample letter available at http://www.consumerfinance.gov/wp-content/uploads/2012/01/NORA-Letter1.pdf
The stated objective of the Bureau’s NORA process is to provide institutions “the opportunity to present their positions to the Bureau before an enforcement action is recommended or commenced.” However, as described below, our members have found the Bureau’s NORA process frustrating and unproductive, in view of Enforcement’s refusal to provide adequate factual and legal color in connection with its claims. In addition, Enforcement’s general unwillingness to depart from rigid requirements on the timing and format of NORA responses impedes institutions’ ability to respond fully and completely. Furthermore, institutions who have experienced the NORA process remain doubtful of its value and the extent to which NORA responses are fully considered, as Enforcement appears to rarely decide against enforcement action after issuing a NORA.
- Enforcement’s Discretion to Provide the NORA Disclosure
Under CFPB Bulletin 2011-04, the decision to provide an institution with a NORA is entirely discretionary, instead of mandatory. However, the bulletin provides little to no detail as to when Enforcement will not issue a NORA. The bulletin generally refers to cases of “ongoing fraud” or where “Enforcement needs to act quickly,” but we are aware of circumstances in which the NORA process was bypassed that did not seem to meet these criteria. Without additional guidance, institutions are unable to determine the precise circumstances in which the Bureau will not issue a NORA, leaving them in the dark during an investigation as to whether they will receive an opportunity to respond.
Additionally, in some circumstances, enforcement actions may originate based on facts and alleged violations discovered by the Bureau’s Office of Supervision (Supervision) during an examination. Before the matter is transferred to Enforcement, Supervision typically issues a Potential Action and Request for Response letter to the institution, which identifies the findings that Supervision intends to transfer to Enforcement for resolution. However, if Enforcement ultimately receives the matter, they may add, remove, or adjust Supervision’s alleged violations, and may not provide the institution with a fresh opportunity to respond to the Bureau’s final claims via the NORA process. As a result, because Enforcement has the discretion not to issue a NORA, the Bureau may commence dialogue about settlement or a lawsuit without considering the institution’s full factual, legal, and policy arguments against the Bureau’s claims.
Enforcement should provide an institution with a NORA unless exigent circumstances require Enforcement to seek immediate relief. Doing so will not only ensure that all institutions “have the opportunity to present their positions to the Bureau,” but will ensure that Enforcement remains fully informed regarding the appropriateness of any enforcement action. As our members have learned, Enforcement may easily misinterpret documents, data, information, or testimony produced during the course of an investigation. This may lead to incomplete or inaccurate assessments as to the nature, scope, or existence of violations, which only can be corrected if Enforcement provides institutions with an opportunity to respond.
- The Content of the NORA Disclosure
In the experience of our members, despite the bulletin’s requirement that the NORA describe the “nature of the subject’s potential violations,” a typical Bureau NORA offers little factual or legal detail regarding Enforcement’s claims. The NORA process typically begins with a telephone call with the Bureau investigator(s) followed by a letter. The information provided on the telephone call typically is very high-level, and the Enforcement staff appears to follow a script that is limited to a short description of the legal theories and underlying factual allegations. For example, when describing the potential violations at issue, Enforcement merely references the particular law or regulation in question, but does not set forth its legal analysis or reasoning as to why or how the institution violated the provision. Moreover, Enforcement generally refuses to cite evidentiary support for its claims, such as Bates numbers of documents that substantiate those claims. If institutions request additional factual and legal detail from Enforcement during the NORA call, Enforcement typically denies the request.
Enforcement does not provide any meaningful written summary to the institution memorializing the facts and alleged violations discussed during the call, much less information that is more detailed than provided in the call. The NORA letter, which Enforcement attorneys send after the NORA call, typically does not exceed two pages and contains none of the factual or legal detail relevant to Enforcement’s proposed enforcement action. As a result, the only way to establish a written record is for the institution’s counsel to draft and send a summary of the NORA call to Enforcement, and request that Enforcement contact the NORA recipient in case the summary is inaccurate or incomplete in any way. Thus, instead of being able to focus its response on discrete violations based on specific facts, institutions must perform legal guesswork and attempt to debunk Enforcement’s claims on a high-level, theoretical basis. This is not productive for the institution or the Bureau.
The Associations therefore recommend that the Bureau strengthen the NORA process and NORA letter to ensure they provide “information necessary to make the NORA meaningful,” as recommended by the Bureau’s own Enforcement Manual. To do so, the Bureau should require that the NORA call and letter include the specific provisions of laws allegedly violated, citations to specific evidence relied upon, and an application of the law to the specific evidence to demonstrate the alleged violation. For example, if the Bureau alleges that an institution engaged in a deceptive practice, the Bureau should describe in detail (a) the specific statutes that the deceptive practice violates; (b) the deceptive practice and the specific evidence establishing that it occurred; and, (c) how the evidence satisfies the elements of a deception claim, including how the practice is likely to mislead the consumer, materiality, and why the consumer’s interpretation of the practice is reasonable under the circumstances.
Additionally, if Enforcement is relying on specific evidence that the institution did not provide during the investigation, such as evidence Enforcement gathered from other sources, Enforcement should allow the institution the opportunity to review key materials within its investigative file, absent good cause to withhold such information. Although the Bureau’s Enforcement Manual states that “NORA recipients may request to review portions of the Staff’s investigative file,” Enforcement attorneys rarely disclose this opportunity to institutions during the NORA process; furthermore, the Bureau’s Enforcement Manual indicates that Enforcement grants these requests rarely, noting that “[i]t is the Office of Enforcement’s general policy to deny such requests.” The Associations believe that Enforcement should discontinue this “general policy,” which will ensure the NORA process is “meaningful” and that institutions fully understand the “nature” of their potential violations.
- Rigid Deadline and Requirements for the Institution’s NORA Response
The guidelines governing the NORA process—including the timeline for responding and the page number allotted for the response—typically are rigidly enforced and are not tied to the complexity of the issues or the number of claims, as discussed below.
First, Enforcement typically provides only fourteen calendar days to institutions to provide a NORA response, which often is inadequate given the scope of Enforcement’s claims. Institutions must dedicate significant resources to drafting their NORA submission, as the submission must contain all factual, legal, and policy arguments as to why the Bureau should not commence an enforcement action. This often entails extensive legal research, significant fact-gathering and analysis, and the development of relevant data to contest alleged violations across significant time periods. The difficulty of the task is compounded where, as is often the case, Enforcement has been silent regarding its concerns leading up to the NORA and provides little detail on the basis for its alleged legal violations in the NORA call and letter.
An institution may be able to receive a short extension of the 14 days allotted for NORA responses. However, the extensions, which can only be granted by an Enforcement Deputy, rarely exceed an additional seven days. Thus, there is little proportionality in either the default 14 days or the extension to respond to a NORA. The amount of time an institution has to respond to a NORA is the same regardless of the complexity or scope of the alleged violations in the NORA. It is also often the same regardless of the number of the alleged violations, as Enforcement provides a similarly short extension of time to respond whether there are three or 30 alleged violations. This refusal to provide sufficient time to respond is particularly troublesome given that the Bureau may go silent for months after the NORA response is submitted.
Second, Enforcement typically limits the institution’s response to no more than 40 pages, again without any sense of proportionality. This page limit often proves insufficient in view of the complexity, number, and scope of Enforcement’s claims. While enlargements have been granted, there has not been any readily discernable methodology with respect to the number of additional pages granted, and at times, requests for enlargement have been denied.
To address these concerns, the Associations recommend that the Bureau provide a minimum response timeframe of 30 days and a page limit of 60 pages for NORA responses. Additionally, instead of rigidly imposing tight timelines and page limits for all NORA responses, the Associations request that Enforcement attorneys receive greater discretion to set more flexible timelines and page limits, especially where the investigation contains a large number of alleged legal violations or claims that are complex. Doing so would be akin to the Security and Exchange Commission’s (SEC) approach, for example, which authorizes staff to “[s]et reasonable limitations on the length of any submission made by the recipient [. . .] as well as the time period allowed,” instead of a one-size-fits-all page limit and response period.
- Requirement to Certify NORA Response
All NORA recipients must include with their response, a declaration that states that the “factual assertions relied upon or presented in the written statement must be made under oath by someone with personal knowledge of such facts.” This requirement, however, poses two problems for institutions. First, institutions are unlikely to have a single employee capable of attesting, under penalty of perjury, to myriad facts that may underlie allegations. And even if so, as stated in our CID RFI Response, the employee will likely only be able to attest to their personal knowledge after a reasonable investigation of the relevant facts. This declaration requirement ignores the realities of the NORA response process, which involves a significant institutional undertaking with contributions from the business, legal, and compliance departments, as well as the institution’s outside counsel. Even if the requirement is relaxed, it still places a significant burden on the institution and the ultimate signor of the declaration.
To address these issues, the Associations recommend that the Bureau remove the requirement to submit a declaration attesting to all factual assertions under a penalty of perjury. If the Bureau declines this recommendation, and preserves this requirement, the Associations request that the Bureau permit the declarant to limit their attestation to their personal knowledge after a reasonable investigation of the relevant facts. Additionally, the Bureau should permit institutions to use multiple declarants to attest to different components of the NORA response, given their length and factual complexity.
- The Bureau’s Review and Consideration of the Institution’s NORA Response
After submission of the NORA response, the institution often has little visibility into the extent to which its NORA response was fully considered, and if the action proceeds, whether the response affected the posture of the enforcement investigation at all. There is very little substantive response from the Bureau about the NORA response and whether the arguments that were made have been recognized and caused the Bureau to reevaluate its position. Our members’ experience is that the NORA process often appears to have a predetermined outcome, where Enforcement will continue with the action notwithstanding clear factual, legal, and policy arguments fatal to their claims. Additionally, although Enforcement must include the institution’s NORA response with any recommendation to the Director to commence an enforcement action, our members have no visibility into what extent, if any, senior Bureau or Enforcement leadership actually reviews institutions’ NORA responses.
Finally, in some cases, Enforcement will alter its proposed claims against an institution after receiving a NORA response, but will not provide the institution with its reasoning for doing so. For example, our members have received and responded to potential claims of “abusive” acts and practices during the NORA process, only for those claims to disappear when the Bureau commences settlement negotiations or litigation.
The Associations recommend that the Bureau provide greater transparency to its decision-making process after receiving a NORA response. First, the Associations recommend that the Bureau require the General Counsel and the Associate Director of Supervision, Enforcement and Fair Lending to review all NORA responses and confer directly with Enforcement prior to any decision to commence enforcement action. Second, the Associations recommend that the Bureau require Enforcement to meet directly with the institution, after reviewing their NORA response and determining whether enforcement action is warranted, to discuss the merits of the institution’s NORA response. If Enforcement decides to proceed with an enforcement action despite an institution’s NORA response, the institution deserves an explanation to justify Enforcement’s decision. Third, in any prospective enforcement action, Enforcement should only proceed on claims raised in the NORA call; if there are any new claims Enforcement adds after receiving an institution’s NORA response, the institution should have an opportunity to respond to those through a separate NORA process. These recommendations, if adopted, will ensure a more transparent and fair process.
4.Whether the Bureau should afford subjects of potential enforcement actions the right to make an in-person presentation to Bureau personnel prior to the Bureau determining whether it should initiate legal proceedings
To better inform Enforcement about its proposed claims and legal theories, institutions should be able to make in-person presentations before the Bureau decides whether to initiate legal proceedings. Our members often seek meetings with Enforcement at various points of the investigation, especially in the later stages. However, Enforcement does not routinely grant these requests. Instead, the most common opportunity provided by Enforcement for an institution to make a presentation, if at all, is after the NORA process when Enforcement has already determined that it will commence an enforcement action.
Our members see significant benefits to meeting with Enforcement before the issuance of a NORA, however, as it offers a unique opportunity to educate Enforcement on the institution’s relevant business operations and compliance management system. In addition, open dialogue allows the institution to eliminate information gaps that Enforcement may have, as well as resolve factual misunderstandings regarding the institution and its practices. The success of the meetings, however, depends on Enforcement’s willingness to provide candid, meaningful information regarding the purpose of its investigation and Enforcement’s specific concerns. Institutions generally cannot present useful information about the Bureau’s concerns if they do not know what those concerns are. Therefore, if Enforcement refuses to provide this level of detail to an institution, their misunderstandings regarding the institution and its practices remain, which typically translates to serious factual flaws in the claims Enforcement proposes during the NORA process.
Additionally, in the event that Enforcement affords an institution the opportunity to make an in-person presentation, the meeting typically only includes the line level Enforcement attorneys staffed on the investigation. As a result, the institution presents to the same Bureau employees who have spent considerable time, effort, and energy investigating the institution, and therefore are deeply invested in the success of the investigation and perhaps less so in exculpatory explanations from the institution. The Bureau typically rejects requests for more senior Enforcement representatives at the meeting, such as the Assistant Litigation Deputy or the Deputy Enforcement Director.
The Associations recommend that the Bureau require Enforcement to offer all institutions under investigation the opportunity to make an in-person presentation during an investigation and before the issuance of a NORA, with discretion given to the institutions to turn down such opportunity. The Bureau also should require that Enforcement invite senior representatives of the Bureau with more decision-making authority, as well as perhaps Bureau lawyers who have no connection to the matter. This will allow institutions to present to Bureau personnel with fresh perspectives, instead of limiting the presentation to Enforcement attorneys who have spent months, if not years, building their potential claims against the institution. Should Enforcement still proceed with the investigation and ultimately issue a NORA, the Associations further request that the NORA recipients receive the same right to make an additional in-person presentation to this larger audience of Bureau personnel. Doing so will ensure that the Bureau’s decision to commence an enforcement action is as informed as possible, which can reduce the risk that Enforcement wastes its resources on enforcement actions that are vulnerable to challenge in court.
5.The calculation of civil money penalties, consistent with the penalty amounts and mitigating factors set out in 12 U.S.C. 5565(c), including whether the Bureau should adopt a civil money penalty matrix, and, if it does adopt such a matrix, what that matrix should include
Unlike prudential banking regulators, the Bureau has not published any guidance detailing how Enforcement calculates its proposed CMPs in enforcement actions. While 12 U.S.C. § 5565(c) offers a list of “mitigating factors” the Bureau must consider in its CMP determinations, the Bureau has not published any guidance on how Enforcement considers or weighs these factors. This leads to an unpredictable process in which the Bureau investigator typically proposes an amount of CMPs untethered to any factors, causing the institution to negotiate in the dark. The current process does not appear to promote fairness in negotiations and final consent orders, as CMPs often appear to be wholly disconnected from the level of consumer harm and remediation.
- Enforcement’s Refusal to Disclose CMP Calculations
The Bureau consistently has refused to disclose its method for calculating the CMP figures it proposes in settlement negotiations or enforcement litigation. In the experience of our members, during settlement negotiations, Enforcement often puts forth a CMP figure without explanation and does not respond to questions regarding its CMP criteria. At times, Enforcement does not even disclose which tier in section 5565 they are using to calculate their proposed CMPs, leaving institutions to guess whether Enforcement views the alleged violations as “knowing,” “reckless,” or neither. In addition, the proposed CMPs often have little rational bearing to proposed remediation figures, prospective injunctive relief, or the number and severity of alleged violations.
In our members’ experience, the Bureau typically imposes CMPs that are unduly harsh, ultimately lessen competition, and impact the availability and affordability of credit for consumers. And at least one federal court has rejected the Bureau’s aggressive position on CMPs. In CFPB v. Cashcall Inc., the Bureau sought over $51 million in CMPs, basing its CMP determination on its finding that institution’s purported violations were “reckless.” However, the District Court for the Central District of California rejected the Bureau’s CMP calculation because it disagreed with its finding of recklessness, and instead imposed only a $10.3 million CMP under the lowest tier in 12 U.S.C. § 5565. This case illustrates that the Bureau’s proposed CMPs may be unable to survive judicial scrutiny in certain cases, but we note that most institutions do not have the benefit of judicial review as they seek to resolve their matters through confidential settlement negotiations with the Bureau.
- Other Agencies Are More Transparent
Enforcement’s “black box” approach to CMPs is inconsistent with that of prudential banking regulators, such as the Office of the Comptroller of the Currency (OCC), the Federal Reserve Board (FRB), and the Federal Deposit Insurance Corporation (FDIC). Unlike the Bureau, each of those agencies’ CMP determinations are made pursuant to a public CMP matrix, in a manner consistent with the Interagency Policy Regarding the Assessment of Civil Money Penalties by the Financial Institutions Regulatory Agencies (Interagency Policy). The purpose of the matrices is to arrive at fair, equitable, and consistent CMPs in enforcement actions. The OCC has stated that it uses its CMP matrix to “help ensure that CMPs are imposed consistently and equitably,” while the FDIC uses its CMP matrix to “aid the examiner in determining the appropriateness and/or level of CMPs.” When discussing potential enforcement actions with those agencies, our members routinely turn to the matrices as guideposts in evaluating proposed CMPs.
In order to enhance clarity, ensure consistency, and promote proportionality between the amount of CMPs and the severity of the violations, the Associations urge the Bureau to implement a CMP matrix through the Bureau’s rulemaking process. For guidance, the Associations recommend that the Bureau turn to the matrices used by the prudential banking regulators, as well as the Interagency Policy, which together comprise far more factors than the five mitigating factors in section 5565. The Associations also recommend that the Bureau provide clear definitions of “recklessly” and “knowingly” as used as levers of intent in section 5565 as the Bureau relies on those definitions to determine the tier of their proposed CMPs. The Associations further recommend that in any proposed enforcement action going forward, the Bureau require that Enforcement provide to the institution its basis for its proposed CMP in writing. Doing so will not only inform institutions as to how the Bureau calculates its CMPs, but will likely lead to more efficient settlement negotiations, as institutions will be able to understand the basis for and appropriateness of Enforcement’s proposed CMPs.
- The Bureau’s Proposed Restitution
In addition to the concerns raised with respect to the Bureau’s processes surrounding CMPs, our members report that the Bureau offers little transparency regarding its proposed restitution amounts. Specifically, during settlement negotiations, the Bureau may propose a restitution amount without providing a basis for doing so, or will propose restitution criteria that have no basis in law or precedent. When the institution contests the Bureau’s figure or criteria, the Bureau refuses to provide additional information and insists on the institution’s agreement, unless the institution intends to litigate against the Bureau. In other circumstances, the Bureau imposes the obligation on the institution to determine the affected consumer population and is not receptive to the institution’s arguments on the population’s size or the appropriate amount of restitution.
Courts, however, have substantially limited the Bureau’s proposed restitution and indicated that the Bureau’s approach requires revision. For example, in CFPB v. Nationwide Biweekly Administration, the District Court for the Northern District of California wholly rejected the Bureau’s request for $73.9 million in restitution, finding the “CFPB has not offered a basis for any restitution that might be limited in some way so as to make it a just result.” Similarly, in CFPB v. Cashcall Inc., the Bureau sought over $235 million in restitution, only for the District Court for the Central District of California to reject the Bureau’s “enormous restitution award” entirely; in doing so, the court found that “the CFPB failed to present credible evidence demonstrating this is the appropriate amount of restitution [. . . ] [and] the CFPB also failed to present any evidence that its proposed restitution approximates Defendants’ unjust gains.”
The Associations recommend that the Bureau provide greater transparency regarding its approach to restitution and disgorgement through publicly issued guidance. Additionally, in any proposed enforcement action, the Associations recommend that the Bureau require Enforcement to provide its basis for its proposed restitution amounts or criteria in writing.
6.The standard provisions in Bureau consent orders, including conduct, compliance, monetary relief, and administrative provisions
The Bureau typically refuses to revise or remove standard terms in consent orders. This inflexibility extends to the facts the Bureau proposes including in the consent order, which often are inaccurate, incomplete, inflammatory, and notwithstanding, subject to limited negotiation. Accordingly, the Associations recommend greater flexibility in negotiating the facts and terms of consent orders, as well as a means to challenge Bureau interpretation of terms in an executed consent order.
- “Standard” Terms In Consent Orders
During settlement negotiations, our members have reported that Enforcement typically represents that certain terms in the draft consent orders are non-negotiable. When institutions request revision to or removal of those terms, Enforcement typically states that the terms cannot be revised or removed, as doing so would be against Enforcement policy. If the institution identifies a past consent order where the term was revised or not present, Enforcement characterizes the consent order as an isolated incident based on the “facts and circumstances” of that case, without detailing what those were. This approach to consent orders by Enforcement indicates either that the “standard” provisions are truly not standard at all, or if they are standard, that Enforcement is far too inflexible to account for the different “facts and circumstances” in each case it brings. Indeed, standard provisions in consent orders are an impediment to tailoring relief to the particular facts of a case or the nature of the institution signing the consent order.
A common example is the administrative provision that outlines the effective period for the consent order’s applicability. In settlement negotiations, and as commonly found in Bureau consent orders, Enforcement typically insists on a five-year term, regardless of the particular facts and circumstances of the case. Even where an institution can demonstrate that, by the date of the order’s signing, it already has remediated and instituted operational changes described in the consent order, the Bureau still insists on a five-year term for the consent order. Imposing such a significant effective period burdens the institution, as it must continue to comply with extensive reporting obligations (and sometimes other requirements) under the order well after the conduct at issue has been resolved. Additionally, items such as the institution’s compliance rating and its marketability for corporate transactions may suffer as well, as regulatory agencies and counterparties will take note that the institution remains bound by a consent order.
The Associations recommend that the Bureau discontinue the use of standard, non-negotiable terms in its consent orders. Instead, Enforcement should have a reasoned basis for each term in its proposed consent orders, which Enforcement should articulate if institutions would like to remove or revise the term. If Enforcement cannot provide a reasoned basis for a term, then the term should be subject to revision or removal.
- The Facts Asserted in Consent Orders
The Bureau similarly is inflexible in negotiating the revision, removal, or inclusion of facts in consent orders. This has led to facts that are inaccurate or incomplete. As an initial matter, prudential regulators typically do not include extensive statements of facts, unlike the Bureau. Even with respect to those agencies that include facts in their consent orders, such as the Department of Justice, those fact sections only include sufficient facts to support each prong of their claim. Moreover, these agencies permit institutions to meaningfully discuss the facts to be included prior to finalizing a consent order.
In contrast, Bureau consent orders include extensive fact sections, and the Bureau typically is unwilling to engage in a meaningful dialogue. When institutions attempt to negotiate with Enforcement to revise their proposed facts, Enforcement typically refuses the institution’s revisions, noting that the Bureau is entitled to include any facts in the consent order that support its narrative. This remains the case even where the institution requests to expand the narrative to include facts that Enforcement acknowledges are accurate.
Enforcement’s inflexibility regarding facts in its consent order is exacerbated by its tendency to include facts that are inflammatory and mischaracterize the facts at issue in the case. This practice has severe negative effects on the institution that signs the consent order, as well as the consumer financial services market, as institutions routinely review Bureau consent orders to determine how to meet regulatory expectations. In addition, investors, counterparties, media, and the general public review consent orders to understand an institutions’ practices. If the Bureau overstates or embellishes facts in a consent order, then the market, investors, counterparties, the media, and the public will remain misinformed regarding the facts at issue. As these parties have begun to understand that factual allegations sometimes are exaggerated, they also tend to discount the veracity of the Bureau’s allegations, thus lowering the Bureau’s credibility.
To avoid these negative effects, the Associations recommend that the Bureau not include extensive facts in consent orders, and instead limit the facts to those solely necessary to support each prong of its claim(s). Whether or not extensive fact sections remain, the Bureau should require Enforcement to allow institutions to negotiate and, where reasonable, revise Enforcement’s facts in its proposed consent orders. Similarly, the Associations request that the Bureau discontinue use of inflammatory language that misrepresents the facts at issue in the case. These recommendations, if adopted, will ensure that consent orders more accurately reflect the conduct at issue, instead of including embellished narratives that may mislead the public.
·The Bureau’s Press Releases for Enforcement Actions
In addition to the Bureau’s tendency to overstate or embellish facts in its consent orders, the Bureau tends to do the same in its accompanying press releases. Specifically, Bureau press releases often include facts that are inflammatory, legal conclusions that are unsupported, and titles that misrepresent the conduct at issue. In fact, the Bureau Ombudsman examined this issue as it relates to press releases in 2015, finding “some words used with legal meanings or interpretations in the press releases that were not in the consent orders” and “some summarization in the press releases that resulted in certain factual elements seeming more important than they otherwise might, even if factually correct.” Although the Ombudsman’s report indicated that the Bureau intends to avoid this practice in the future, our members have continued to witness the Bureau overstating and embellishing facts both in consent orders and press releases.
As with the Bureau’s consent orders, its inflammatory press releases have severe negative effects on the overall market. Once the Bureau publishes a press release, the investors, counterparties, media, and the general public are alerted to potential unlawful conduct by an institution, and turn to the press release for the facts. In addition, institutions routinely review Bureau press releases to stay mindful of how to better comply with the Bureau’s legal authorities. If the Bureau’s press releases are inaccurate, then the market, investors, counterparties, the media, and the public will be misinformed about an institution and its conduct, which will constitute a major blow to the institution’s ability to operate and thrive in its industry.
To avoid these consequences, the Associations recommend that the Bureau implement internal guidelines that govern the content of press releases, including what can and should be said, and provide institutions with its draft press release and any other related Bureau materials for publication prior to the consent order’s execution. The Bureau must allow the institution to negotiate and, where agreeable, revise these materials to ensure their accuracy and completeness. These recommendations, if adopted, will ensure that press releases accurately reflect the conduct at issue, consistent with our recommendations regarding consent orders.
- Proposed Injunctive Relief
In the Associations’ members’ experience, the Bureau’s injunctive relief provisions are drafted in a vacuum and impose obligations on institutions that are disconnected from the reality of the institutions’ (or the industry’s) business operations. For example, the Bureau often requires institutions to develop new programs, committees, or operations. This further requires the development of policies and procedures to govern the new Bureau-mandated processes. However, when proposing and imposing these requirements, the Bureau rarely considers the institution’s existing business infrastructure and core processes before drafting its requirements.
By drafting these injunctive relief provisions without taking into account the realities of the institution, the Bureau proposes, and often mandates, inefficient processes, policies, and procedures, instead of working with the institution to determine whether its desired goal can be accomplished in a more effective manner. As a result, institutions ultimately must engage in significant negotiation with the Bureau on implementation efforts on the back-end instead of resolving these issues in a more collaborative, efficient, and realistic manner with the Bureau on the front-end. For example, Bureau consent orders often impose board reporting obligations, but the reporting obligations may be inconsistent with the institution’s board of directors’ meeting schedule. As a result, the board of directors must convene additional meetings after the consent order is signed, instead of simply folding the Bureau’s requirements into their existing meetings.
The Associations recommend that the Bureau align its proposed injunctive relief with the business realities of institutions, instead of ordering unrealistic changes to complex business operations. This can be accomplished through detailed discussions regarding the most effective and efficient manner in which to implement certain changes before drafting a consent order.
- The Meaning of Terms in Consent Orders
Once a consent order is signed, the institution must continue to coordinate with the Bureau on its obligations pursuant to the order, which can include a CMP, remediation, and substantial injunctive relief and reporting obligations. In many circumstances, the institution may encounter situations that were not contemplated by either the institution or the Bureau pre-consent order and, therefore, were never addressed before consenting to a resolution. However, in the experience of our members, if the institution and the Bureau disagree as to the meaning or scope of a consent order term, the institution has limited recourse to challenge the Bureau’s interpretation. Instead, the Bureau holds substantial bargaining power, as they may seek enforcement of the order in federal court or pursue a second enforcement action against the institution for failure to comply with the consent order. The institution, on the other hand, must either challenge the Bureau in litigation or attempt to negotiate further with Enforcement, which typically will not depart from its interpretation of the order.
The Associations recommend that the Bureau develop a formal mechanism through which an institution can seek review of Enforcement’s interpretations of a consent order’s terms. Specifically, the Associations recommend involving non-Enforcement representatives of the Bureau, such as representatives from the Legal Division, to opine on whether the institution’s interpretation of a term is reasonable.
·The Closure Process for Consent Orders
In the experience of our members, the Bureau lacks a timely, formal closure process for its consent orders, which can leave consent orders in effect well after an institution has fulfilled the order’s obligations. Specifically, institutions will execute the order’s various requirements, such as those pertaining to CMPs, restitution and injunctive relief, and will furnish evidence of its fulfillment to the appropriate Bureau personnel. Despite receiving this evidence, the Bureau will not move expeditiously to close the consent order, even where the institution expressly requests closure. Without a timely, formal closure process, the Bureau may leave consent orders open through their full term, without granting earlier closure based on the institution’s performance of their obligations.
The Associations recommend that the Bureau develop a formal closure process for its consent orders that is meaningfully tied to the satisfaction of requirements. Specifically, the Associations recommend that the Bureau close a consent order or provide its reasoning against closure within 30 days of receiving an institution’s evidence of fulfilling all obligations under the order. Imposing this requirement will ensure that the Bureau closes consent orders as appropriate, instead of allowing them to remain in effect even after an institution has met its obligations under the order.
7.The manner and extent to which the Bureau can and should coordinate its enforcement activity with other Federal and/or State agencies that may have overlapping jurisdiction
In the experience of our members, as also described in our CID RFI Response, the Bureau and its federal and state partners fail to coordinate their enforcement efforts in a manner that is efficient or fair to institutions. For example, in some instances, the Bureau and other federal or state agencies send similar CIDs to the same institution for the same conduct, with no agency operating as the “lead.” Additionally, the Bureau and other agencies may take different legal positions and communicate those different legal positions to the institution, leaving the institution unclear as to the most appropriate path forward. As Acting Director Mulvaney recently noted, the Bureau has taken positions in the past that invite opposition from its state enforcement partners.
The Associations recommend that at a minimum, on the federal level, where there are multiple agencies interested in an enforcement action against an institution, one agency take the lead in the investigation, and the other agencies address their concerns through limited non-duplicative requests. Such coordination also should be attempted with the states. Additionally, the Associations recommend that the agencies attempt to resolve their investigation collectively, instead of seeking separate public enforcement actions, with separate terms of relief, at separate times. Finally, the Associations recommend that, where another federal agency opposes the Bureau’s position, the Bureau consult with the objecting agency before deciding whether to pursue an enforcement action.
8.Additional Topic: The Bureau’s Responsible Conduct Bulletin
In addition to the topics identified in the Bureau’s Request for Information Regarding Enforcement Processes, our members identified the Bureau’s Responsible Conduct Bulletin as an additional area where the Bureau could improve the efficiency and effectiveness of its enforcement processes.
CFPB Bulletin 2013-06 regarding “Responsible Business Conduct” has injected a considerable level of confusion in the consumer financial services industry. As stated in the bulletin, the purpose of the document is to incentivize “Responsible Business Conduct,” which the bulletin defines through four categories of conduct: self-policing, self-reporting, remediation, and cooperation. If an institution engages in responsible conduct, Enforcement may treat the institution favorably in its investigation, which can include decisions to “resolve an investigation with no public enforcement action, treat the conduct as a less severe type of violation, reduce the number of violations pursued, or reduce the sanctions or penalties sought by the Bureau in an enforcement action.”
However, the bulletin has created more confusion than clarity, as institutions remain wary as to whether conformity with the bulletin will truly immunize them to the Bureau’s often heavy-handed approach to enforcement.
- Self-Reporting: Questionable “Credit,” Mixed Incentives, and No Procedure
Although the bulletin states that “self-reporting” constitutes responsible business conduct, our members’ experience has been inconsistent on this point. Specifically, as described in our CID RFI Response, the Bureau has shown an apparent willingness to initiate investigations and announce public enforcement actions based on issues that were self-reported. This sends mixed messages to institutions about what incentives might exist for self-reporting. For example, the Bureau instituted an investigation of a major bank’s student loan servicing operation only after the bank self-reported its issues to the Bureau. Similarly, despite finding that another institution self-reported a violation and fully cooperated with the Bureau’s investigation, the Bureau still fined the institution for the violation and issued a public consent order. Furthermore, even if the Bureau considers an institution’s self-reporting as worthy of the bulletin’s awards, the “credit” received does not carry forward to other financial regulatory agencies. For example, if an institution self-reports potential violations to the Bureau and avoids an enforcement action, the Bureau, seemingly, will not coordinate with other agencies to ensure no agency punishes the institution for the self-reported conduct.
Additionally, the bulletin prescribes no procedure for self-reporting “potential violations” to the Bureau, such as guidance on to whom the institution should self-report, the form of the submission, and the ensuing process that occurs at the Bureau to determine whether institution’s self-reporting constitutes “responsible business conduct.” In certain instances, Bureau personnel have recommended that institutions report directly to Enforcement, while in other instances, supervised institutions have self-reported to their Supervision examination team and resolved the issue through the supervisory process.
Therefore, the Associations make the following recommendations, which will together ensure that institutions continue to have an incentive to self-report.
Reduce Investigations and Enforcement Actions Based on Self-Reporting. The Associations recommend that the Bureau institute greater oversight over Enforcement to ensure that institutions are not routinely punished with investigations or enforcement actions after self-reporting their conduct to the Bureau, but instead are provided credit where it is due. Specifically, as recommended in the next bullet, for issues self-reported outside of Supervision, other offices at the Bureau should have greater involvement in determining whether an Enforcement investigation should be initiated in response to self-reporting to the Bureau. For example, the Bureau’s Legal Division could be required to review instances of self-reporting, alongside Supervision for entities subject to examination, in order to provide specific approval to Enforcement prior to their imposition of punitive consequences, such as an enforcement action. Additionally, if an institution self-reports a potential issue during an examination, the Bureau should consider resolving the issue through the confidential supervisory process, instead of seeking a public enforcement action. Doing so will incentivize “responsible business conduct” in both examinations and otherwise.
Institute a Self-Reporting Procedure. The Associations recommend that the Bureau publish a procedure for self-reporting. The procedure should prescribe the form the self-reporting must take, such as a written submission or an in-person meeting, as well as the appropriate Bureau contact for all self-reporting. In designating an appropriate contact for self-reporting, the Associations do not recommend choosing Enforcement, given its significant powers. Instead, the Associations recommend that a separate office review instances of self-reporting, with oversight from the Bureau’s Legal Division, which may in turn confer with Enforcement on whether the institution deserves credit for responsible business conduct.
Although the Bureau’s bulletin seeks to incentivize “self-policing,” the Bureau routinely uses the results of institutions’ self-policing efforts, such as compliance testing or internal audit results, as the basis of its investigations and enforcement actions. For example, Enforcement often includes requests for documents, data, or information from institutions’ compliance monitoring operations, such as quality control results, compliance reviews, and internal audits. Instead of rewarding the institution for conducting effective compliance monitoring, the Bureau develops legal claims based on issues and risks identified by the institution. This approach hardly rewards an institution for responsible conduct, but instead punishes the institution, even though its own bulletin acknowledges that “a robust compliance management system appropriate for the size and complexity of a party’s business will not always prevent violations.”
The Associations therefore recommend that the Bureau reconsider whether Enforcement should be able to institute enforcement actions by using the results of their self-policing efforts. In particular, the Bureau should advise Enforcement against public enforcement action where the conduct at issue already has been identified by the institution, especially in circumstances where the self-detected conduct is the sole conduct at issue in the prospective action. Doing so will be consistent with its bulletin, and will incentivize institutions to effectively police themselves and fully document their self-policing efforts.
- The Bulletin’s Exceptions
Although the bulletin offers appealing incentives for engaging in “responsible conduct,” the bulletin’s overly broad exceptions have had the unintended consequence of making these incentives appear illusory. Specifically, the bulletin states that the Bureau “is not adopting any rule or formula, or making a promise to any person about any specific case,” nor is it “in any way limiting its discretion and responsibility to evaluate each case individually on its own facts and circumstances.” Additionally, the bulletin further states that “there may be circumstances where the misconduct is so egregious, or the harm inflicted so great, that no amount of cooperation or other mitigating conduct could justify a decision not to bring an enforcement action, or even to forgo seeking the imposition of a civil money penalty.” The sheer breadth of these exceptions increases the risk of seeking credit from the Bureau for “responsible business conduct,” as Enforcement has significant latitude to deny favorable treatment to an institution, even if its conduct fully comported with the bulletin. Additionally, the more significant the issue, the more discouraged the institution is from self-reporting to the Bureau, as there is a clear risk that the Bureau will deem the issue “so egregious” or “so great” that Enforcement must publicly penalize the institution.
The Associations therefore recommend that the Bureau revise CFPB Bulletin 2013-06 to remove its significant exceptions and ensure that institutions consistently receive appropriate credit for self-reporting. Until the Bureau removes the exceptions, Enforcement will have excessive discretion in determining whether to provide or deny credit for “responsible business conduct,” which renders the bulletin’s purpose futile and incentives virtually non-existent.
* * * * * *
Thank you again for the opportunity to share our views with you on this important matter. The Associations welcome the opportunity to discuss any of the issues raised in this letter. Should you have any questions or if we can provide any additional information, please contact Richard Foster at Richard.Foster@FSRoundtable.org, Steven I. Zeisel at SZeisel@consumerbankers.com, or Anne C. Canfield at firstname.lastname@example.org.
Senior Vice President & Senior Counsel for Regulatory and Legal Affairs
Financial Services Roundtable
Steven I. Zeisel
Executive Vice President, General Counsel
Consumer Bankers Association
Anne C. Canfield
Consumer Mortgage Coalition