Despite the cloud of speculation and uncertainty dogging the CFPB, the agency continues to launch supervisory examinations and enforcement investigations—including in new markets.
So if you haven't encountered the CFPB yet, now is not the time to put off CFPB preparedness, including audits and mock exams, build-outs of compliance management systems, and deep-dive reviews of substantive policies, procedures, and practices. And if you have already been under the CFPB microscope, it is equally important to demonstrate remediation and ongoing compliance.
|
It takes only one CFPB examination or investigation to uncover potential violations of law, giving the agency the opportunity to broadcast its regulatory expectations through a public enforcement action. If you go back and look at the dozens of public CFPB lawsuits, negotiated settlements, and supervisory exam highlights, there's a consistent focus on promoting deterrence, setting new standards, and increasing consumer education through enforcement activity. The companies that have completed exams with few or no findings or that have received closing letters ending investigations are those that not only comply with legal requirements, but also effectively demonstrate such compliance through a tailored compliance management system. No CFPB two preparedness plans are the same, but all companies that fall under the CFPB’s jurisdiction should be prepared for at least an onsite examination of several weeks or an investigation that could span months or years. Different considerations, including the size of the company, public information and complaints available to the CFPB, and, importantly, the specific products and services offered by the company, influence the CFPB's priorities. At a minimum, a gap analysis can help companies identify areas of risk in order to make smart enhancements and adjustments to existing compliance programs. |
Knowing the CFPB's internal examination and investigation policies and processes, including who is responsible for making policy and decisions based on factual findings, how information is evaluated, and the intersection among CFPB examinations, investigations, and enforcement, is important for developing a strategy for responding to examination informational requests (IRs) or civil investigative demands (CIDs). In addition to the CFPB Supervision and Examination Manual, we recently uploaded the CFPB Examination Playbook and the CFPB Enforcement Policies and Procedures Manual, which can be found exclusively on our firm's website. For example, the CFPB has adopted an "Action Review Committee (ARC) Process" that governs decision-making regarding whether certain legal violations identified in the course of an examination or targeted review should be addressed by public enforcement action or non-public supervisory action.
Here are some important considerations that we have learned should be taken into account when developing a CFPB preparedness plan:
- Plan with All Stakeholders, but Be Prepared to Defend with Counsel. A culture of compliance starts at the top and is exemplified by an active compliance committee involved in exam and investigation preparedness. But exams and investigations can go off track and become contentious when there's an allegation of violations of consumer financial law or a deficient compliance management system. As a result, in-house and outside counsel should be included early to ensure that rights are protected and legal obligations are interpreted correctly.
- Know the Limits of Attorney-Client Privilege. During any audit or compliance review, consider issues of attorney-client privilege and the potential for CFPB requests for audit and compliance reports in IRs and CIDs.
- Know Your Data Management Systems. In this age of computerized databases, email, and cloud-based collaboration tools (e.g., Slack, WhatsApp), where everything is instantly accessible, companies cannot afford to sit back – they must proactively develop some expertise, which includes learning the scope and burdens of a request for information. To minimize the burden at the early stages, involve the HR and IT departments in CFPB preparedness.
- Designate a Leader and Ambassador. A CFPB exam or investigation is demanding and requires internal leadership and an "ambassador" who can interface with Bureau staff. Designate an employee (preferably within the legal or compliance department) to serve as the point of contact for the CFPB examination team and the document collection and production process.
- Develop Advocates. Prepare and train staff who likely will interface with CFPB examiners. Employees can be instrumental in reflecting a compliance culture, and in explaining how compliance is addressed among complex operations.
- Know Your Business. Be prepared to explain the company's business model and set appropriate expectations. The beginning of an examination or the meet and confer process that's part of responding to a CID is the best opportunity to demonstrate your "culture of compliance" and educate the Bureau staff on the company's structure and operations. This may include preparing brief presentations on the company's organizational structure and compliance framework, which can be used to help focus the attention of fact finders.
- Be Prepared to Respond Swiftly. Develop internal processes that will enable timely responses to IRs or CID requests. At the same time, it is important to identify and explain the limits of your ability to factually respond, and the burdens and cost of responding, to IRs or CIDs. Establishing boundaries early in the process can help conserve your staff's resources and ensure that you provide accurate and clear information.
- Watch Your Flank. Develop a process of working with legal counsel to review all submissions to the CFPB for responsiveness, privilege, and consistency. The overall facts presented during the course of a review will be analyzed, and findings of an examination or investigation may lead to a recommended course of action (i.e., supervisory or enforcement action).
- Know the Law. Specific facts and law should be assessed with an eye to differences between the company and the CFPB on legal positions and analysis. This will help inform how perceived violations of federal consumer financial law are addressed (i.e., remediation, company responses to matters requiring attention, exam appeals, or litigation).
The key to successfully navigating a CFPB examination or investigation lies in careful advance preparation. The companies in the best position to manage regulatory scrutiny are those that understand and follow applicable laws, have invested significant time and resources in building their compliance management programs, and have the capacity to proactively identify issues and make corrections when needed.
By being strategic about CFPB preparedness, companies can get the most "bang for their buck" from their compliance programs. Of course, preparing for the CFPB also can help companies manage requests from clients and counterparties and other regulatory and law enforcement agencies.
* * * * * * * * * *
Jonathan L. Pompan, Partner, and Alexandra Megaris, Counsel, advise on consumer financial services matters and represent clients in examinations, investigations, and enforcement actions brought by the CFPB, FTC, state attorneys general, and regulatory agencies.
Related Articles and Publications:
The CFPB's Examination Playbook Revealed
What's Inside the CFPB Enforcement Policies and Procedures Manual 2.0
What to Expect When You're Under a CFPB Investigation – Negotiating the Scope of the CID
How to Prepare for and Survive a CFPB Examination
Navigating Debt Buying in a "Regulation by Enforcement" Environment During a Rulemaking
What's Changing in the Regulatory Environment? Hear From Your Federal and State Regulators