How the new A in UDAAP Impacts the Retail Payments Industry. Richard Fraher - FRB Atlanta Paul Carrubba Adams and Reese LLP

Transcription

1 How the new A in UDAAP Impacts the Retail Payments Industry Richard Fraher - FRB Atlanta Paul Carrubba Adams and Reese LLP

2 The Disclaimers The views presented here are the opinions of the presenter and do not represent the views of the FRBA, the Board of Governors of the Federal Reserve, or any other federal agency. This presentation is not legal advice. Your institution needs to consult with its own legal counsel regarding any concerns that your institution may identify with respect to the contents of this presentation. 2

3 What we will cover today Background what is UDAP/UDAAP? Dodd Frank & the creation of CFPB UDAAP the elements Unfair Deceptive Abusive Takeaways: Key point: consumer protection in payments is a big deal How your institution might respond to UDAAP requirements Make UDAAP a prominent part of compliance program Understand how UDAAP differs from regulations Identify and mitigate likely UDAAP risks As you innovate in payments services, build to UDAAP 3

4 Background 4

5 What is UDAAP? Unfair, Deceptive or Abusive Acts & Practices UDAP was and remains a part of the Federal Trade Commission (FTC) Act Abusive prong was added under Dodd-Frank (Sec. 1031) 5

6 Who enforces UDAAP? UDAP was and is enforced by the FTC. Dodd-Frank shifted the responsibility for UDAAP related to consumer financial services to the Consumer Financial Protection Bureau ( CFPB ). Dodd-Frank allows state Attorneys General and certain state regulators to bring civil UDAAP actions in court (Sec. 1042). 6

7 Dodd Frank and Payments: Before and After Payments largely structured by state law (UCC 3, 4, and 4A) and private sector rules (ACH, check clearing houses, image exchanges), with an overlay of federal consumer protections: TILA/Reg Z, EFTA/Reg E, GLB Title V privacy CFPB created with a broad statutory mandate to protect consumers in matters relating to financial services 7

8 The Role of the CFPB Dodd-Frank grants the CFPB broad authority Rulemaking, enforcement, and supervisory powers Authority to write rules to implement a broad array of federal consumer financial protection laws, as well as most consumer compliance supervisory and enforcement powers over larger depositories. CFPB did NOT acquire from the banking regulators the primary supervisory and enforcement powers over smaller depositories. 8

9 The Role of the CFPB CFPB also wields new federal consumer financial protection powers to regulate non-depository financial institutions that provide financial services, including payments, which previously were largely unregulated at the federal level. There is a great deal of uncertainty in how the CFPB will exercise these broad and flexible authorities. War story: breakfast with a senior CFPB official 9

10 CFPB and UDAAP Dodd-Frank grants investigation, rulemaking, and enforcement authority to the CFPB to prevent UDAAP violations. Dodd-Frank also gives consumers the option of reporting a UDAAP complaint directly to the CFPB. State Attorneys General and certain state regulators may bring a civil action for alleged UDAAP violations. 10

11 What is Unfair? Dodd-Frank outlines the standard for an unfair act or practice (This formulation is not new, but based on previous FTC law/regs): (1)The act or practice causes or is likely to cause substantial injury to consumers; (2)The injury is not reasonably avoidable by consumers; and (3)The injury is not outweighed by countervailing benefits to consumers or to competition. 11

12 Likely to cause substantial injury Usually involves monetary harm Ex: Fees paid by a consumer as the result of an unfair practice Actual injury is NOT required in every case. Emotional harm and other subjective types of harm will not ordinarily be considered a substantial injury. An act or practice that causes a small amount of harm to a large number of people could be deemed to cause a substantial injury. 12

13 Reasonable Avoidance An act or practice is not unfair if consumers may reasonably avoid injury. This means an act or practice may not interfere with a consumer s ability to effectively make decisions or take actions to avoid injury. Ex: If material information about a product, such as pricing, is modified after (or withheld until after) the consumer has committed to purchasing the product. 13

14 Reasonable Avoidance This analysis does NOT include whether a consumer could have made a better choice. The focus is on whether the consumer had the appropriate INFORMATION to make a better choice. Hiring legal counsel or financial experts is considered beyond the realm of reasonable for a consumer. 14

15 Injury must not be outweighed by countervailing benefits to consumers or competition The act or practice must cause injury in a net effect. This is a balancing test: the injury must not be outweighed or offset by any benefits to the consumer or to competition that are produced by the act or practice. Ex: Lower prices to a consumer or a wider availability of products and services resulting from competition 15

16 How does this apply to payments? Ex: In re Wachovia Bank, National Association The OCC brought an enforcement action against Wachovia where the bank maintained deposit account relations with telemarketers and payment processors. The telemarketers regularly deposited large numbers of remotely created checks drawn against consumers accounts. Most of the checks were not authorized by consumers. Wachovia did not establish appropriate policies and procedures to prevent, detect, or remedy these activities. 16

17 In re Wachovia, National Assoc. (1) Substantial Injury: Consumers lost money from fraudulent checks. (2) Not outweighed by benefits: The cost to the bank of establishing policies to monitor and respond to such activities would have been much less than the amount of injury to consumers that occurred. (3) Not reasonably avoidable: Consumers could not avoid this harm because it resulted from transactions to which the consumers had not consented. 17

18 What is Deceptive? Dodd-Frank does not outline the standard for a deceptive practice. However, the standard was outlined in the FTC Act: (1) The representation, omission, act or practice misleads or is likely to mislead the consumer; (2) The consumer s interpretation is reasonable under the circumstances; and (3) The misleading representation, omission, act, or practice is material. 18

19 Misleading or likely to mislead The FTC created a four Ps test to evaluate whether an act or practice is likely to mislead: (1) Is the statement prominent enough for the consumer to notice? (2) Is the information presented in an easy to understand format that does not contradict other consumer information and at a time when the consumer s attention is not otherwise distracted? (3) Is the placement of the information in a location where consumers can be expected to look or hear? (4) Is the information is close proximity to the claim it qualifies? 19

20 Reasonable Interpretation When representations are targeted toward a specific audience, the communication must be reviewed from the point of view of a reasonable member of that audience. Ex: older Americans, young people, or financially distressed consumers 20

21 Material Representation A representation is material if it is likely to affect a consumer s choice of, or conduct regarding, the product or service. Certain information is presumed to be material: Costs, benefits, or restrictions of the use or availability of a product or service; Express claims made with respect to a financial product or service; Claims made with knowledge they are false; and Omissions when the financial institution knew or should have known the consumer needed the omitted information to evaluate the product or service. 21

22 CFPB vs Dwolla, Inc. CFPB Determination Dwolla Representations Dwolla employs reasonable measures to protect data Network is safe and secure Transactions are safer than credit cards Data-security exceeds industry standards Sets new precedent for safety and security Dwolla stores info in a bank-level hosting and security environment Encrypts using Fed. Gov. standards Dwolla is PCI Compliant 22

23 CFPB vs Dwolla, Inc. CFPB Determination - Deceptive acts and practices relating to false representations regarding Dwolla s datasecurity practices. Deceptive Practices Dwolla failed to employ reasonable measures to protect data. Data security did not surpass or exceed industry standards. Dwolla did not encrypt Dwolla was not PCI Compliant Dwolla generally did not provide the security as represented 23

24 What is Abusive? Dodd-Frank provides the standard for an abusive act or practice: (1) The act or practice materially interferes with the ability of a consumer to understand a term or condition of a consumer financial product or service; or (2) The act or practice takes unreasonable advantage of: (1) A lack of understanding on the part of the consumer of the material risks, costs, or conditions of the product/service; (2) The inability of the consumer to protect its interests in selecting or using a consumer financial product or service; or (3) The reasonable reliance by the consumer on a covered person to act in the interests of the consumer. 24

25 Material Interference This prong focuses on the consumer s ability to understand a term or condition. Disclosure is very important here. A clear and complete understanding by the consumer is paramount. Model disclosure forms under Regulations E, P, Z, CC, DD, RESPA and others are likely not sufficient for a consumer to understand the complexities of a particular product or service. 25

26 Taking unreasonable advantage This applies particularly to consumers who have a low level of sophistication or understanding of complex material. Financial institutions may take unreasonable advantage of a consumer if they fail to prevent overuse of certain services that generate fees. Ex: overdraft fees 26

27 CFPB v. American Debt Settlement Solutions This was the first action by the CFPB to enforce the abusive standard of UDAAP. ADSI solicited consumers who were in debt with a promise that the company would settle at least one debt and make it easier for the consumer to get out of financial trouble. 89% of the consumers who paid to enroll in the service had no debts settled by the company. The company also continued to enroll consumers whose incomes were too low to complete the debt repayment plan. Result: Return of nearly $500,000 to consumers and a $15,000 civil penalty. 27

28 In the Interests of the Consumer This prong of the definition is crucial. This appears to create a new legal duty on institutions to act in the best interests of the consumer, rather than at arm s length in their own best interests. Intent of Title X of Dodd-Frank is to protect consumers and ensure products and services are principally in their interests and not the institution s. How far this new duty might extend is unclear. 28

29 So what does all this mean to your business? 29

30 Consumer Protection is Key We in the payments business think of technological and operational innovation as being the big drivers of change Dodd Frank marked a new day--consumer protection will be AT LEAST as important as technological and operational innovation in shaping the future of the US payments system. With the uncertainty surrounding UDAAP under Dodd- Frank, clear disclosure, informed choices, and meaningful responses to consumer complaints are key priorities. 30

31 In Re: RBS Citizens Financial Group CFPB Determination Citizens processed Deposits such that certain customers did not receive credit for the full amount of the deposit. This action is an unfair act or practice. Findings and Conclusions Bank reviewed deposit discrepancies over the threshold amount ($50 prior to 9/12 and $25 thereafter) and made an adjustment to the account. If the deposit discrepancy was below the $50 and $25 levels, the bank gave the customer credit based on the deposit slip. The bank s practice harmed the consumer (approximately $12.3 million) Bank s practices caused substantial injury to the consumer and the injury was not reasonably avoidable or outweighed by any countervailing benefit to the consumer or to competition. Bank engaged in unfair acts and practices. 31

32 In Re: RBS Citizens Financial Group CFPB Determination Citizens Processed deposits such that certain customers did not receive credit for the full amount of the deposit. This action is an unfair act or practice. Citizens disclosures were deceptive. Deceptive Practices Bank s deposit agreement provides deposits will be adjusted. Bank expressly or impliedly represented that consumer deposits were subject to verification. Bank did not verify and correct deposits. Bank s failure to disclose constitutes a deceptive act or practice. 32

33 CFPB SUPERVISORY HIGHLIGHTS WINTER 2015 Banks Posted Transactions Based on Available Balance. Debit Card Transactions Caused Overdrafts Customer Charged O. D. Fee Bank Did Not Properly Disclose Bank s Actions Were Deceptive 33

34 Managing UDAAP This is a new risk area, requiring standard risk management techniques: Identify risks Identify mitigants Build a UDAAP program akin to other compliance regimes the agencies will look for policies, procedures, a responsible officer, independent testing, and organizational awareness of a consumer protective culture built through training Specific risk areas to review: disclosures, fees, terms & conditions, and managing your vendors. 34

35 Looking at Fees In June 2014, the FDIC alleged that a bank committed UDAAP violations by failing to disclose certain fees and grace periods associated with the cash advance feature of the bank s credit card program. Result: Bank had to pay a $20,000 CMP. 35

36 Terms & Conditions Proper marketing and full disclosure are key priorities here. In October 2014, the CFPB alleged that a bank s marketing of free checking accounts were misleading because the marketing did not properly disclose the minimum account activity required to keep the account free or that the bank would automatically convert the free account to one with a monthly fee after 90 days of inactivity. Result: Settlement of $2.9 million in consumer refunds and a $200,000 CMP. 36

37 Managing Vendors Under UDAAP, banks can be culpable for the actions of third-party vendors such as broker/dealer, processors, and other vendors the bank uses. CFPB has taken action against auto finance arms because the financial arms permit their auto dealers to lend to consumers within specified spreads, which according to the CFPB results in disparate impact on disadvantaged borrowers 37

38 Consumer Complaints Consumer complaints are red flags for agencies that have authority to bring UDAAP actions. If you know the regulators will be looking at consumer complaints about your services, you need to get there first Collect complaints, and put them in the hands of an officer who has authority to respond Analyze complaints to identify the points at which your services cause complaints See the bigger patterns, not just the individual instances (War story the subprime lender who gave the money back to any borrower who complained) Document your program Train your employees and your vendors 38

39 Compliance with Other Laws Is Not Enough 39

40 UDAAP & Other Consumer Protective Rules An act or practice that is in technical compliance with other state or federal laws may still constitute a UDAAP. Adherence to model disclosure requirements in TILA/Reg Z does not get a lender out of the woods if CFPB decides that a loan was contrary to the best interests of the borrower, e.g. with respect to ability to repay the loan. UDAAP will often require a step above other laws. Think of UDAAP as that one extra step of overall fairness that might be lacking from other laws. 40

41 UDAAP & Regulation E Reg. E protects consumers who engage in electronic funds transfers. Reg. E provides for protections such as change-in-terms notice, disclosures, protections against liability for unauthorized payments, and procedures for resolving errors. It seems reasonable to anticipate that the CFPB will start from the Reg E approach to consumer payments, but with some new twists Example: Has the consumer made a payment (and thus satisfied her obligation to pay the party on the other end) when the consumer authorizes a bank or other payment service provider to transfer funds? Traditional answer was no debt was not satisfied till funds are settled to payee. CFPB seems to believe that the consumer s obligation is finished when consumer has done all the she can do to effect payment which will create new risks for payment processors. Example: remittances under

42 UDAAP v. UCC UCC Articles 3 and 4 define the structure of check issuance, collection, presentment, and return There are a lot of places where the UCC may be less consumer protective than the CFPB may turn out to be, and the CFPB may use UDAAP to change some things: Excessive or abusive fees, obviously overdrafts, but maybe over the counter presentment fees Order of posting items Free checking accounts, with fine print Terms in deposit agreements that do things that anger depositors: BOFD s ability to debit account holder for any item that comes back as a return or as a breach of warranty claim Paying bank s ability to prescribe a very short time for depositor to review statements and identify unauthorized checks Paying bank s ability to charge account holder for unauthorized checks where accountholder was negligent 42

43 Predictable Tug of Wars Finality versus conditionality of payments Complexity and confusion of payments rails versus stated desire for simplicity and clarity Unauthorized payments: the moral hazard view versus the rational cost spreader view; the individual instances versus the aggregate statistical view; the view that it is the duty of the financial service provider (and not the customer) to protect the customers data and their funds Payments service providers are more likely to complain that the cost burden is too great instead of launching a serious, empirically grounded discussion of which consumer protection (and other compliance related) measures actually produce the desired effects 43

44 Conclusions The exact shape of UDAAP and its enforcement is still unclear, although the general outline is clear enough the CFPB and other agencies are on the lookout for financial services that are unfair to vulnerable consumers To ensure compliance, it is best to err on the side of caution: Make sure your institution has a UDAAP compliance function that looks and works like other compliance functions, e.g. BSA/AML But be aware that UDAAP is going to be different there is no regulation that defines all UDAAPs, and the CFPB and the agencies will likely proceed case by case, bank exam by bank exam, and not by rulemaking Best advice from a payments lawyer to payments service providers is to go the extra mile: review your existing practices, especially the ones grounded in the UCC, and adjust in the places where consumer complaints indicate that some of your customers see aspects of your services or practices as unfair, deceptive, or abusive. The voices of your customers need to be heard! As you envision your institution s payments innovations, innovate with UDAAP issues in the forefront of your thinking 44

45 QUESTIONS Richard Freher Paul A. Carrubba

46 How the new A in UDAAP Impacts the Retail Payments Industry Richard Fraher - FRB Atlanta Paul Carrubba Adams and Reese LLP