The CFPB & UDAAP a primer

The CFPB & UDAAP a primer Excerpt from the CFPB Manual: Unfair, Deceptive or Abusive Acts and Practices Risk of Harm and Injury As examiners review products or services, such as deposit products or lending activities, they generally should identify the risks of harm to consumers that are particular to those activities. Examiners also should review products that combine features and terms in a manner that can increase the difficulty of consumer understanding of the overall costs or risks of the product and the potential harm to the consumer associated with the product. The act or practice must cause or be likely to cause substantial injury to consumers. Substantial injury usually involves monetary harm. Monetary harm includes, for example, costs or fees paid by consumers as a result of an unfair practice. An act or practice that causes a small amount of harm to a large number of people may be deemed to cause substantial injury. Actual injury is not required in every case. A significant risk of concrete harm is also sufficient. However, trivial or merely speculative harms are typically insufficient for a finding of substantial injury. Emotional impact and other more subjective types of harm also will not ordinarily amount to substantial injury. Nevertheless, in certain circumstances, such as unreasonable debt collection harassment, emotional impacts may amount to or contribute to substantial injury. About Transparency and True Information An act or practice is not considered unfair if consumers may reasonably avoid injury. Consumers cannot reasonably avoid injury if the act or practice interferes with their ability to effectively make decisions or to take action to avoid injury. Normally the marketplace is selfcorrecting; it is governed by consumer choice and the ability of individual consumers to make their own private decisions without regulatory intervention. If material information about a product, such as pricing, is modified after, or withheld until after, the consumer has committed to purchasing the product; however, the consumer cannot reasonably avoid the injury. Moreover, consumers cannot avoid injury if they are coerced into purchasing unwanted products or services or if a transaction occurs without their knowledge or consent. A key question is not whether a consumer could have made a better choice. Rather, the question is whether an act or practice hinders a consumer s decision-making. For example, not having access to important information could prevent consumers from comparing available alternatives, choosing those that are most desirable to them, and avoiding those

that are inadequate or unsatisfactory. In addition, if almost all market participants engage in a practice, a consumer s incentive to search elsewhere for better terms is reduced, and the practice may not be reasonably avoidable. Misleading the Consumer Deception is not limited to situations in which a consumer has already been misled. Instead, an act or practice may be deceptive if it is likely to mislead consumers. It is necessary to evaluate an individual statement, representation, or omission not in isolation, but rather in the context of the entire advertisement, transaction, or course of dealing, to determine whether the overall net impression is misleading or deceptive. A representation may be an express or implied claim or promise, and it may be written or oral. If material information is necessary to prevent a consumer from being misled, it may be deceptive to omit that information. Written disclosures may be insufficient to correct a misleading statement or representation, particularly where the consumer is directed away from qualifying limitations in the text or is counseled that reading the disclosures is unnecessary. Likewise, oral or fine print disclosures or contract disclosures may be insufficient to cure a misleading headline or a prominent written representation. Similarly, a deceptive act or practice may not be cured by subsequent accurate disclosures. Acts or practices that may be deceptive include: making misleading cost or price claims; offering to provide a product or service that is not in fact available; using bait-and-switch techniques; omitting material limitations or conditions from an offer; or failing to provide the promised services. In determining whether an act or practice is misleading, one also must consider whether the consumer s interpretation of or reaction to the representation, omission, act, or practice is reasonable under the circumstances. In other words, whether an act or practice is deceptive depends on how a reasonable member of the target audience would interpret the representation. When representations or marketing practices target a specific audience, such as older Americans, young people, or financially distressed consumers, the communication must be reviewed from the point of view of a reasonable member of that group. Moreover, a representation may be deceptive if the majority of consumers in the target class do not share the consumer s interpretation, so long as a significant minority of such consumers is misled. When a seller s representation conveys more than one meaning to reasonable consumers, one of which is false, the seller is liable for the misleading interpretation. A representation, omission, act, or practice is material if it is likely to affect a consumer s choice of, or conduct regarding, the product or service. Information that is important to consumers is material. Certain categories of information are presumed to be material. In general, information about the central characteristics of a product or service such as costs, benefits, or restrictions on the use or availability is presumed to be material. Express claims made with respect to a financial product or service are presumed material. Implied claims are presumed to be material when evidence shows that the institution intended to make the claim (even though

intent to deceive is not necessary for deception to exist). Claims made with knowledge that they are false are presumed to be material. Omissions will be presumed to be material when the financial institution knew or should have known that the consumer needed the omitted information to evaluate the product or service. If a representation or claim is not presumed to be material, it still would be considered material if there is evidence that it is likely to be considered important by consumers. The Role of Consumer Complaints Consumer complaints play a key role in the detection of unfair, deceptive, or abusive practices. Consumer complaints have been an essential source of information for examinations, enforcement, and rule-making for regulators. As a general matter, consumer complaints can indicate weaknesses in elements of the institution s compliance management system, such as training, internal controls, or monitoring. While the absence of complaints does not ensure that unfair, deceptive, or abusive practices are not occurring, complaints may be one indication of unfair, deceptive or abusive acts and practices. For example, the presence of complaints alleging that consumers did not understand the terms of a product or service may be a red flag indicating that examiners should conduct a detailed review of the relevant practice. This is especially true when numerous consumers make similar complaints about the same product or service. Because the perspective of a reasonable consumer is one of the tests for evaluating whether a representation, omission, act, or practice is potentially deceptive, consumer complaints alleging misrepresentations or misunderstanding may provide a window into the perspective of the reasonable consumer. When reviewing complaints against an institution, examiners should consider complaints lodged against subsidiaries, affiliates, and third parties regarding the products and services offered through the institution or using the institution s name. In particular, examiners should determine whether an institution itself receives, monitors, and responds to complaints filed against subsidiaries, affiliates, and third parties. Document Review CFPB examiners are instructed to look for unfair, deceptive or abusive acts and practices by reviewing the following material: Training materials. Lists of products and services, including descriptions, fee structure, disclosures, notices, agreements, and periodic and account statements. Procedure manuals and written policies, including those for servicing and collections. Minutes of the meetings of the Board of Directors and of management committees, including those related to compliance. Internal control monitoring and auditing materials.

Compensation arrangements, including incentive programs for employees and third parties. Documentation related to new product development, including relevant meeting minutes of Board of Directors, and of compliance and new product committees. Marketing programs, advertisements, and other promotional material in all forms of media (including print, radio, television, telephone, Internet, or social media advertising). Scripts and recorded calls for telemarketing and collections. Organizational charts, including those related to affiliate relationships and work processes. Agreements with affiliates and third parties that interact with consumers on behalf of the entity. Consumer complaint files. Documentation related to software development and testing, as applicable. Marketing Disclosures All representations are factually based. All materials describe clearly, prominently, and accurately: costs, benefits, and other material terms of the products or services being offered; related products or services being offered either as an option or required to obtained certain terms; and material limitations or conditions on the terms or availability of products and services, such as time limitations for favorable rates, promotional features, expiration dates, prerequisites for obtaining particular products or services, or conditions for canceling services. The customer s attention is drawn to key terms, including limitations and conditions, that are important to enable the consumer to make an informed decision. All materials clearly and prominently disclose the fees, penalties, and other charges that may be imposed and the reason for the imposition. Contracts clearly inform customers of contract provisions that permit changes in terms and conditions of the product or service. All materials clearly communicate the costs, benefits, availability, and other terms in language that can be understood when products are targeted to particular populations, such as reverse mortgage loans for the elderly. Materials do not misrepresent costs, conditions, limitations, or other terms either affirmatively or by omission. The entity avoids advertising terms that are generally not available to the typical

targeted consumer. When it comes to making marketing claims about the service the company should make sure performance statements include both completed and uncompleted accounts, it is a statement supported by the facts, the average client is likely to receive that result. The Debt Relief Company Liability for Third-Party Marketing Representations Examiners are directed to evaluate how the entity monitors the activities of employees and third-party contractors, marketing sales personnel, vendors, and service providers to ensure they do not engage in unfair, deceptive, or abusive acts or practices with respect to consumer interactions. Examiners are told to interview employees and third parties, as appropriate. Specifically, consider whether: The entity ensures that employees and third parties who market or promote products or services are adequately trained so that they do not engage in unfair, deceptive, or abusive acts or practices. The entity conducts periodic evaluations or audits to check whether employees or third parties follow the entity s training and procedures and has a disciplinary policy in place to deal with any deficiencies. The entity reviews compensation arrangements for employees, third-party contractors, and service providers to ensure that they do not create unintended incentives to engage in unfair, deceptive, or abusive acts or practices, particularly with respect to product sales, loan origination, and collections. Performance evaluation criteria do not create unintended incentives to engage in unfair, deceptive, or abusive acts or practices, including criteria for sales personnel based on sales volume, size, terms of sale, or account performance. The entity implements and maintains effective risk and supervisory controls to select and manage third-party contractors and service providers. A four article series regarding the CFPB & UDAAP. 1. The CFPB s confusing definitions of unfair, deceptive or abusive acts and practices The CFPB gives financial institutions relationships with consumers fiduciary overtones By: John Tumilty & Katherine Guarino September 13, 2012

After the cataclysmic financial meltdown of 2008, Congress reacted with the Dodd-Frank Act to correct market misbehavior, stabilize the economy and shield consumers from exploitation by financial institutions. Out of this far-reaching legislation emerged a new, independent consumer protection agency with the potential to transform the relationship between financial institutions and consumers. The Consumer Financial Protection Bureau (CFPB), America s first federal agency focused solely on consumer financial protection, is spearheading a fundamental culture shift in financial compliance and operation. With its single director and insulation from executive and legislative control, the CFPB is vested with broad and sweeping power to control, supervise and enforce promulgated rules for consumer financial providers. One of the CFPB s primary goals, and the source of most controversy and risk for covered persons, is the prevention of unfair, deceptive or abusive [consumer financial] acts or practices. Armed with powerful regulatory and enforcement abilities and an arsenal of looselydefined statutory terms, the CFPB is leading a crusade against unfairness toward consumers with respect to financial products, the extent of which is yet to be determined. What has come to be known as UDAAP is Dodd-Frank s prohibition of the use of an unfair, deceptive, or abusive act or practice by any covered person, defined as any person (or entity) that engages in offering or providing a consumer financial product or service, and that person s service provider. Service provider means any person that provides a material service to a covered person in connection with the covered person s offering of a financial product or service. Dodd-Frank defines unfairness and abusive acts or practices, but curiously leaves the term deceptive undefined. An act or practice is unfair when it causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers and such substantial injury is not outweighed by countervailing benefits to consumers or to competition. An abusive act or practice materially interferes with the ability of a consumer to understand a term or condition of a consumer financial product or service or takes unreasonable advantage of a consumer s lack of understanding, the inability of the consumer to protect his own interests or the reasonable reliance by the consumer on a covered person to act in the interests of the consumer. Although Dodd-Frank does not include a definition of deceptive, the CFPB has issued guidance in the form of a supervision and examination manual outlining a three-part test for deceptiveness, and providing examples. For an act or practice to be deceptive, it must mislead or be likely to mislead the consumer, it must be material and the consumer s interpretation of the act or practice must be reasonable. Despite this guidance, the lack of any definition in the statute itself appears to give the CFPB extra leeway to expand the scope of deceptiveness either through application of the current guidance or the issuance, at any time, of additional guidance redefining the deceptiveness standard with no statutory limitation. The inherent subjectivity and indistinctness of each component of UDAAP is likely to create numerous difficulties for financial institutions. The UDAAP definitions are replete with vague and nebulous terms, such as substantial, likely and reasonable, that allow the CFPB unfettered discretion to declare acts or practices unfair, deceptive or abusive. Actual harm is not required for an act to be unfair or deceptive. Thus, the CFPB can target practices that are not harming consumers, but that create a significant risk of harm. For example, when a consumer is not misled into purchasing a certain financial product or service, but a covered person did something that was likely to mislead that consumer, the practice is deceptive. Conversely, if a consumer does not understand the product or service, the covered person may not take unreasonable advantage of that lack of understanding. According to the manual, even emotional effects can amount to substantial injury in some cases. Financial institutions now have to gauge the myriad diverse personalities and comprehension levels of each of their customers. Most problematic, however, is the definition of abusive, the extra A that has been added to make UDAAP. Despite its newness, the CFPB provides no examples of the term in its manual, and offers only a riddle-like caveat that each component of UDAAP is separate yet overlapping. While a covered person seemingly can minimize the risk of consumer misunderstanding through disclosures, the idea in the second prong of the definition that a consumer can reasonably rely on a financial institution to

act in the interests of the consumer is a clear departure from past precedent. With the introduction of an abusive standard with this reliance component, the CFPB has single handedly transformed the relationship between financial institutions and consumers from one of arms-length dealing to one with fiduciary overtones. 2. Financial institutions post-dodd-frank: The new fiduciary? UDAAP provisions included in the law impose somewhat subjective obligations on banks dealings with customers By: John Houlihan & Elizabeth Kelly October 12, 2012 Typically, a fiduciary relationship arises when one party places special confidence and trust in another, who then becomes obligated to act with due regard for the interests of the first party. While the law varies slightly from state to state, courts have been reluctant to impose fiduciary duties on banks in their dealings with consumers. As the Supreme Court of Ohio explained, advice given by a creditor to a debtor in a commercial context in which the parties deal at arm s length, each protecting his or her respective interests, is insufficient to create a fiduciary relationship. By enacting the unfair, deceptive or abusive acts or practices (UDAAP) provisions in the Dodd-Frank Act, Congress initiated a process that appears certain to change the nature of the relationship between financial institutions and their consumers, creating something more than an arm s length business negotiation but less than a fiduciary relationship. Commentators have suggested that the UDAAP definition of abusive conduct comes close to, but stops short of, creating a fiduciary duty requiring financial institutions to act in the interests of their consumers. Under the act, an abusive act or practice is one which: (1) materially interferes with the ability of a consumer to understand a term or condition of a consumer financial product or service; or (2) takes unreasonable advantage of (A) a lack of understanding on the part of the consumer of the material risks, costs, or conditions of the product or service; (B) the inability of the consumer to protect the interests of the consumer in selecting or using a consumer financial product or service; or (C) the reasonable reliance by the consumer on a covered person to act in the interests of the consumer. Surprisingly, given that the UDAAP definition marks a clear departure from prior law, the Consumer Financial Protection Bureau (CFPB) has offered little analytical guidance regarding the prohibition of abusive acts beyond confirming that the legal standards for abusive, unfair, and deceptive each are separate. However, the language of the definition indicates that the CFPB intends to focus on the consumer s state of mind. The first prong of the definition of abusive prohibits financial institutions and their service providers from materially interfering with a consumer s ability to understand a term. This appears to be aimed at preventing affirmative acts that result in deception. However, the definition does not include any state-of-mind requirement for the financial institution. Therefore, while the financial institution s interference must be material, it need not be intentional. In contrast, the consumer s state of mind, couched as the consumer s ability to understand is directly relevant to the inquiry. The second prong of the definition is similarly focused on the consumer s subjective state of mind. It forbids a financial institution from taking unreasonable advantage of the consumer s lack of understanding with respect to the material risks or the terms of a financial product or service, the consumer s lack of ability to protect his or her interests; and the consumer s reasonable reliance on the financial institution to act in her interest. Thus, in order to avoid taking unreasonable advantage of a consumer, a financial institution must take steps to understand the extent to which its customers comprehend the terms of, and risks involved in, a proposed transaction. The institution also must assess whether or not the consumer is reasonably anticipating that the institution will act in her best

interest. In order to avoid a UDAAP violation under the first prong of the definition of abusive, financial institutions must ensure that the terms of their documents are clear and easily understood. Compliance with the second prong is more problematic. It appears to require that financial institutions gain an understanding of each individual consumer s state of mind and factor that understanding into their decision making. By imposing obligations of this type, UDAAP dramatically alters the nature of the relationship between a financial institution and its consumer-customers. Plainly, UDAAP requires more than the good faith and fair dealing obligations implied in every contract, but less than a fullblown fiduciary duty. Given the subjective nature of this obligation, the scope of the abusive standard will, at least in the near term, remain amorphous. The CFPB has apparently chosen not to exercise rule making authority to give any additional meaning to the definition. Instead, it intends to examine the acts of financial institutions on a case-by-case basis. Over time, this process may yield some degree of certainty, but, in the near term, the uncertainty surrounding the precise nature of the obligations imposed through the definition of abusive practices will almost certainly drive financial institutions to adopt careful and conservative marketing practices and to focus sales efforts on more traditional and less risky products. 3. 4 ways for financial institutions to avoid liability for vendor actions Two proposed rules from the Consumer Financial Protection Bureau demand greater third-party oversight from mortgage servicers By: John Houlihan & Colin O'Donovan October 26, 2012 In its first enforcement actions, the Consumer Financial Protection Bureau (CFPB) caught the financial industry s attention with restitution awards and refunds for consumers totalling $425 million and civil penalties exceeding $46 million. The CFPB also signalled its intention to ensure that financial institutions supervise their vendors, the products they sell and the services they provide. In addition, although the three enforcement actions involved credit card companies, the CFPB has warned that future enforcement actions will not be limited to credit card add-on products. Indeed, the director of the CFPB, Richard Cordray, recently acknowledged that fixing the mortgage markets remains an urgent priority. With final rules relating to mortgage products due by January 2013, the mortgage industry may be next. Traditionally, financial institutions used third-party service providers because they lowered costs, reduced the risks of exposure on consumer claims and provided expertise that organizations could not be efficiently replicate in-house. The Dodd-Frank Act, however, significantly altered the pros and cons of that calculus. It requires supervised banks and non banks to oversee the actions of their service providers. The act also includes a very broad definition of service provider, which encompasses any person that provides a material service to a covered person in connection with the offering or provision by such covered person of a consumer financial product or service. With high fines and headlines, the CFPB alerted all companies of its intention to closely monitor marketing practices and to hold covered institutions responsible for the actions of their third-party vendors. Indeed, the CFPB put the mortgage industry on notice that financial institutions must oversee their third-party vendors as early as October 2011, when the agency issued examination procedures for mortgage servicing. More recently the CFPB issued two proposed rules that would require mortgage servicers to oversee the actions of their vendors. These proposed rules under Regulation Z in the Truth and Lending Act and Regulation X of the Real Estate Settlement Procedures Act would require greater third-party oversight, incorporating aspects from the National Mortgage Settlement, pursuant to which the CFPB and other government agencies required the five largest servicers to

supervise and independently audit their third-party vendors. Fortunately, financial institutions can minimize their risk of becoming the target of a CFPB enforcement action based on a vendor s activities by taking a few simple steps to increase their internal and external compliance programs. 1.Establish written procedures and minimum criteria for selecting service providers 2.In appropriate circumstances, create record keeping guidelines for service providers, with particular attention to foreclosure-related documents 3.Periodically review third-party service providers and have an independent audit conducted on your own business records to ensure compliance with the written guidelines 4.Establish a method of monitoring complaints about third-party vendors and require that vendors address any deficiencies in service related to those complaints While those procedures may reduce liability for a vendor s actions, financial institutions must also consider whether the vendor markets any potentially abusive products. Dodd-Frank and the CFPB provide less guidance in this respect. The act focuses on minimizing abusive acts and practices, rather than on limiting or eliminating the sale of individual products. Not surprisingly, therefore, the CFPB seems to have focused its early attention on marketing practices rather than specific products. Thus, no one knows what, if any, products will gain the dubious distinction of garnering the CFPB s specific attention. While the CFPB has not provided definitive answers, it has indicated through proposed rules, that it will be monitoring certain products carefully, including force-placed insurance and adjustable rate mortgages. To minimize the risk associated with marketing such products, companies would be well advised to provide consumers with a clear and concise explanation of how the product works before the customer purchases the product. Similarly, businesses should disclose any subsequent changes in the product well in advance of the effective date of the change. In short, legal compliance no longer provides the safe haven that it once did. As before, mortgage services and products must comply with all legal requirements. However, to comply with the act, lenders and servicers must now consider whether the way in which they market a particular product is fair to the consumer, and they must make same inquiry regardless of whether the financial institution sells the product or provides it through a third-party vendor. 4. Protecting against UDAAP violations Implementing compliance training programs and carefully reviewing consumer complaints can help financial institutions guard against CFPB investigations By: John Tumilty & Raymond M. Ripple November 23, 2012 In the first three articles in this series, we have outlined the origins of the CFPB, addressed its new definition of abusive, and discussed an institution s exposure to liability for vendor actions in light of this new definition. In this article, we suggest ways in which financial institutions can protect themselves against unfair, deceptive or abusive acts and practices (UDAAP) violations through a combination of efforts, including employee compliance training, programs for receipt and analysis of consumer complaints, and increased consideration of financial products from the perspective of the lay consumer. The CFPB has made clear that financial institutions subject to its jurisdiction must develop and implement effective compliance management systems to prevent UDAAP violations. A cornerstone of any such compliance management system is employee training. As part of a formal, written compliance program, to be administered by the institution s chief compliance officer, the institution

should develop a formal training program designed to ensure that its employees are educated about the concept of UDAAP, fertile areas for potential violations and the steps the institution takes to ensure compliance. An overview of the CFPB s compliance management review, which can be foundon the CFPB s website, reveals that effective employee UDAAP training requires that institutions consider the specific regulatory requirements related to an employee s job functions and tailor the training accordingly. A review of the CFPB s recent regulatory actions confirms this approach. In a bulletin issued on July 18, the agency indicated that it would be targeting the marketing of credit card add-on products as part of its regulatory efforts. The bulletin advised companies that they should institute comprehensive employee training regarding credit card add-on products as part of their compliance management programs. The CFPB specifically noted that organizations should implement such training to limit the potential for regulatory violations and consumer harm. Additionally, on Oct. 1, the CFPB fined American Express Bank for engaging in deceptive debt collection practices. In the consent order entered into between the CFPB and the bank, the agency specifically noted that the bank had failed to implement an effective employee training program that addressed deceptive acts and practices. As part of the consent order, American Express was required to implement a training program that included training on consumer protection laws. Financial institutions should also have a clear and effective process for receiving, reviewing and addressing consumer complaints as a method to avoid, or minimize the potential for, UDAAP violations. Consumer complaints can play a key role in the detection of UDAAP because the complaints may be indicative of weaknesses in an institution s compliance management system, such as training or internal controls. Moreover, the CFPB solicits and reviews complaints directly from consumers. According to CFPB Director Richard Cordray s Sept. 20 testimony before the House Financial Services Committee, as of Sept. 3, the CFPB had received 72,297 complaints from consumers regarding credit cards, mortgages and other financial products and services. The CFPB reviews these complaints and considers whether to initiate enforcement actions. Accordingly, if the CFPB is receiving and considering complaints directly from consumers, financial institutions should ensure that they have effective processes in place for receiving, reviewing and addressing their customers complaints because the results may be indicative of CFPB concerns. Finally, financial institutions can minimize the risk of a UDAAP violation by considering their financial products from the perspective of an uninformed consumer or financial layman. The CFPB is the consumer watchdog of financial institutions, and describes its work as a mission to make markets for consumer financial markets and services work for Americans. Accordingly, it can be expected that CFPB officials will review the products and practices of financial institutions from the perspective of the consumers they are seeking to protect. Financial institutions should therefore review their products and services from the same lay perspective and assess whether any of them might be considered to have confusing or misleading language or terms. Moreover, institutions may want to consider the internal reasons behind the creation of the product or service. If the reason is difficult to describe or does not clearly reflect a benefit to the consumer, the product or service may be the type that will draw the attention of the CFPB. While there is no single task that a financial institution can take to prevent a CFPB investigation for UDAAP violations, a combination of proactive efforts can successfully limit the likelihood of such investigations.