The CFPB at 10: The Past is Prologue

Ten years ago today, the Consumer Financial Protection Bureau began its operations, consolidating many consumer financial protection responsibilities into one federal government agency. In this CFS Digest, members of our Consumer Financial Services Group look back at the CFPB's first decade, elucidate how the Bureau has impacted consumer financial services providers, and discuss what's next for the agency. And we've included some of our most popular and valuable insights from the decade.

On July 21, 2021, the Consumer Financial Protection Bureau turned 10. As the country picked up the economic pieces after the Great Recession, Congress passed the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, and Title X is the Consumer Financial Protection Act, which is the Consumer Financial Protection Bureau's enabling act. The CFPB grew out of a 2007 article, "Unsafe at Any Rate," that then-Harvard Law professor Elizabeth Warren published in Democracy, a small academic journal.

The Dodd-Frank Act states that the CFPB's mission is to implement and enforce federal consumer financial laws, and to ensure that markets for consumer financial services and products are fair, transparent, and competitive. To fulfill that mandate, the CFPB can issue rules, examine certain institutions, and enforce consumer financial protection laws and regulations. The CFPB has supervisory authority over large depository institutions with assets of more than $10 billion, as well as some nonbanks. The CFPB also can enforce the consumer financial protection laws and its specific enabling act's prohibitions against unfair, deceptive, or abusive acts or practices (UDAAP) against any party that offers a consumer financial product or service. The creation of the CFPB gave rise to a dramatic shift in how consumer financial services companies assess risk. As a result, there is a greater need for legal counsel to help make sense of the consumer financial services regulatory landscape.

And now the Bureau's influence is found throughout the federal government. Many of the attorneys and other professionals who were part of Warren's original (and diverse) team have since secured leadership roles in key positions throughout the Biden administration, as well as in academia and throughout the financial services sector. Many of the ideas that helped to establish the CFPB also continue to inform the evolution of financial services regulation – and economic regulation, more generally – throughout federal and state government.

Here, members of Venable's Consumer Financial Services Practice Group look back on the founding of the CFPB, the impact it has made over the past 10 years, and what's ahead.

Q: Let's go back 10 years, or maybe even a year or two before the CFPB opened its doors. What was the immediate impact of the creation of the CFPB, and the passage of the Dodd-Frank Act? What were you doing on July 21, 2011?

Allyson B. Baker: I was an enforcement attorney at the CFPB. I'd been among the first dozen attorneys hired in the spring of 2011 by Richard Cordray to join the team tasked with standing up the Bureau's Office of Enforcement. It was exhilarating to work on the ground floor of a brand-new agency staffed with some of the smartest minds in the United States. I learned something new every time I had a conversation. That team of early Bureau staffers, who worked tirelessly, joined from everywhere: other government agencies (as I had), law firms, banks, consulting firms, and university economics departments.

Meredith L. Boylan: In July 2011, I was representing bank directors and officers in connection with the FDIC's pursuit of civil liability in the wake of numerous bank closures during the Great Recession. When the Bureau came online, I was interested to see how it would deploy its supervisory and enforcement powers to address some of the issues we were confronting in the D&O space – particularly issues relating to consumer lending.

Allen H. Denson: I was working through the morass of the financial crisis, at the Office of the Comptroller of the Currency (OCC), the regulator of national banks. At the OCC, the CFPB's creation prompted a lot of reflection and caused the agency to take a harder look at what it did to protect consumers as part of its overall mission to ensure the safety and soundness of the banking system. We saw the CFPB as a partner and met with the enforcement team there as they stood up the agency and worked together on consumer protection actions like the credit card add-on cases.

Leonard L. Gordon: I was running the Northeast Regional Office of the FTC and trying to figure out what this new agency meant for the FTC.

Jonathan L Pompan: I presented on the CFPB and related developments at a conference of nonbank consumer financial services providers on July 21. We represented a number of bank and nonbank clients that fell under the scope of the CFPB. We knew during the lead-up to the passage of Dodd-Frank (in 2010) and as the CFPB was being formed, the agency would be transformative, create a lot of needs and challenges, and launch careers.

Venable has long had a financial services practice, and we were particularly experienced in guiding nonbank consumer financial services providers on compliance with federal consumer financial law, UDAAP prohibitions, the Telemarketing Sales Rule, and the patchwork of overlapping and varying state laws, such as statutes that cover lending, credit services, debt collection, money services/money transmission statutes, and so on. So, what was in some respects being amplified by many as the CFPB's "novel" authority or something to study up on was not new to Venable.

Q: What was going through your mind as the CFPB was founded?

Allyson B. Baker: During the Great Recession, I had been working at the Department of Justice, Tax Division, where I was prosecuting civil tax fraud cases throughout the United States. I spent a lot of time trying cases and interviewing witnesses in towns and cities that had been economically devastated. Between my travels and my then-intense focus on tax fraud, I became very interested in the circumstances that gave rise to the Great Recession. I was inspired to apply for a job at the CFPB.

Allen H. Denson: A lot of the work I was doing overlapped with or complemented the CFPB's priorities, so I was deeply interested in the new agency and curious about how it would implement its mission – particularly how it would oversee nonbank financial services companies, which vastly outnumber the number of banks. In my view, the agency faced a tall order.

Jonathan L. Pompan: I had a practice representing consumer financial services providers, including some banks, on consumer protection law matters as they navigated and came out of the Great Recession. This also included the top nonprofit HUD-approved housing and credit counselors, along with nonbanks developing new credit products, and equity investors in companies throughout the credit and debt life cycle.

The CFPB is a place with an overriding sense of mission, as it was designed to be, a fully functioning and aggressive enforcement and regulatory agency that had maximum tools at its disposal (like civil penalty and rulemaking authority, plus supervision) and was not tied to the traditional relationships between government and consumer financial services providers.

Venable recognized that we had attorneys with the practical and relevant experience needed to help clients find a way to deal with what was then being billed as the "new sheriff" in town. Venable attorneys knew the alums from the FTC, banking agencies, and elsewhere who were tapped to hold senior positions at the Bureau, and whom we were meeting with senior leadership on behalf of clients before the agency was even formally open for business – in advance of building out their rulemaking, supervision, and enforcement agenda. Many of those senior staff are either at the Bureau or elsewhere in government and are still relevant today.

Q: What has changed for the CFPB and financial services companies it oversees?

Allen H. Denson: The CFPB as an agency has matured. There are now seasoned leaders and staff there. They know what they want to accomplish and how to do it. Financial services companies have also matured. Most of my clients have been incredibly adept at adjusting to the new reality of strong federal regulations and adopting complex compliance management systems that require a significant investment of time and resources.

Leonard L. Gordon: I'd like to think the agency has matured. In the CFPB's early years, staff and leadership often displayed a bunker mentality, perhaps reflecting the many challenges the agency faced in its early days. That displayed itself at times in litigation where the agency seemed to behave as if it did not have to play by the same rules as other litigants.

Jonathan L. Pompan: Looking back after ten years, the CFPB ushered in an era where tailored compliance management systems, multiple lines of defense, and counterparty diligence and monitoring are now the baseline for serious consumer financial services providers. But the challenges the CFPB posed regardless of administration didn't disappear, especially on an individualized basis for companies if they fell under an investigation and faced a potential "bet the company" enforcement action. The Consumer Financial Protection Act bestows a lot of unchecked power on the director of the CFPB and by extension on the staff, so the tone starts at the top, and "personnel is policy" as well.

Q: The CFPB supervises a range of companies to assess their compliance with federal consumer financial laws through exams, and can launch investigations. There is also overlap for many in the consumer financial services space by the banking agencies/FTC and state supervision and licensing. Is there overregulation of nonbank consumer financial services companies?

Allen H. Denson: Yes, the pendulum has swung quite far in the opposite direction from the days before the financial crisis. The CFPB is an aggressive regulator with vast enforcement powers, and for nonbank financial services companies it shares overlapping authority with the FTC. And let's not forget the state regulators, who, along with attorneys general, have become much more active in the last 10 years. If you were, for example, a storefront payday lender, in a decade you would have transitioned from having a comfortable relationship with state regulators, and a very remote threat of federal involvement through the FTC, to a near-constant threat of federal examination or investigation by the CFPB that could mean the end of your company. It's been quite the change.

Jonathan L Pompan: No one expects noncompliance with applicable law to get a free pass, but that should hold true for the CFPB, too. So, that's a big part of navigating investigations and enforcement matters, as well as policymaking. It makes little sense for the CFPB to look at someone and hold them accountable based on evolving expectations after the fact and without fair notice. The CFPB shouldn't always feel it's necessary to take a bludgeon to one company, a sector, or a particular business model to signal a shift in expectation or interpretation of law in place of rulemaking and the other non-enforcement tools the Bureau has at its disposal. Additionally, for many nonbanks there's been active regulation and supervision on the state level that pre-dates the CFPB.

Q: The CFPB has regulatory authority over providers of an array of consumer financial products and services under specific statutes and UDAAP authority. This was a significant departure from the FTC, which doesn't have the same authority. How has this changed the areas in which it has embarked on rulemaking?

Allen H. Denson: UDAAP means everything. It drives almost every CFPB enforcement action, and the flexibility and generality of unfairness, deception, and – especially – abusiveness allow the Bureau to take aggressive positions on other laws that it enforces. The flexibility of UDAAP and the Bureau's significant penalty authority allow it to dictate the staggering fines and restitution amounts we see in public settlements.

Jonathan L. Pompan: Rulemaking can take a long time to get right. Just look at the history of the debt collection rule. In contrast, when we had our first meet and confer on one of the earliest CFPB investigations at the enforcement office, there were taped handmade signs everywhere with labels like "Payday Alley," "Debt Collection Corner," and so on. We could tell it was a war room–like setup – and it was looking at many of the same areas the FTC had already had jurisdiction over, until the Bureau became the primary federal agency. As time has shown, a lot of the enforcement work is done under UDAAP, or by use of the same restrictions that are found in certain other statutes, like the Fair Debt Collection Practices Act or TSR. But by their nature, exams and investigations are backward looking, and for obvious reasons companies have invested in their compliance programs. This also means companies will often have identified and taken steps to remediate potential areas of concern that may later be scrutinized through a UDAAP lens by the CFPB. It's important that the CFPB recognize good conduct and give it credit, and provide fair notice of what its interpretation of the law is before it seeks to apply it, especially using UDAAP.

Q: One of the key mantras of the CFPB has been disclosure. Has the CFPB been as transparent as it expects its consumer financial services companies to be?

Jonathan L. Pompan: There's a lot of information that is made public, but there are also notable gaps. The allegations and the CFPB's findings get a lot of attention. But there are rarely best practices or positive observations that are made public, and in some instances the agency can move too quickly. For example, the CFPB's bulletin on consumer authorizations for preauthorized electronic fund transfers was generated, in part, by a need to walk back a previously published "supervisory highlight" (and what could have been an enforcement action), suggesting that well-established methods of obtaining consumer authorization for pre-authorized transactions (e.g., recurring payments) were non-compliant. This is also an agency that had to have its Enforcement Policies and Procedures Manual and Examinations Playbook made public through Freedom of Information Act requests, and it still doesn't publish a staff directory on its own website.

Q: What can a company do if it finds itself in an investigation?

Allyson B. Baker: If you receive a civil investigative demand from the CFPB, here are the first things that you should do as soon as possible:

Read the CID's notification of purpose to understand what potential conduct the CFPB intends to investigate.
Assess which business lines or units might be implicated by the investigation's potential scope. This will inform your ongoing assessment of risk. It may not, however, be possible from reading the face of the CID to know if your business is the subject of the CFPB's investigation or is a third party in the investigation.
Implement a litigation hold in your organization.
Hire counsel to reach out to the Office of Enforcement attorney who issued the CID to set up a meet and confer, which must be conducted within a relatively short time of receiving the CID.

Meredith L. Boylan: Control the narrative. When you get a whiff of a potential enforcement action, assume that your company's actions are being watched. Be mindful of public statements and ensure they align with your company's practices. Keep enhancing your compliance management systems – you can't change the past, but you can show progress and growth. Be collegial with the Bureau, but don't get lulled into complacency and oversharing. And watch the news – has the Bureau pursued enforcement actions against others in your industry? If so, study those complaints or consent orders as possible roadmaps for the Bureau's theories against your company.

Allen H. Denson: It is absolutely critical to have an experienced advocate who knows how the Bureau operates and can guide you through the process. Throughout the investigation, there are opportunities to seek an "off ramp" and de-escalate the situation or to draw a line in the sand and challenge an unreasonable position. The value of having someone who knows both the Bureau and your business or industry cannot be overstated.

Jonathan L. Pompan: Costly investigations can be a death knell for a product or an entire company. So, as has been a prominent theme for these past ten years, having a compliance program is critical. The challenge for anyone engaged in consumer financial services is proving compliance to avoid the CFPB taking a "you're wrong and we're right" position. It isn't an ideal way to regulate or to protect consumers, but that's often the perception of what can occur in an inquiry or exam. A potential danger is that the CFPB could become so aggressive that it could inadvertently reduce access to credit and dampen financial innovation.

Q: A lot of attention is given to the CFPB's announcement of enforcement actions, supervisory highlights, and reports. What are some examples of CFPB activities that haven't received as much attention?

Jonathan L. Pompan: First, there's a wealth of consumer education and resources the Bureau supports. And the agency has built up a large pool of civil monetary penalty funds that could support a lot of financial counseling, education, and literacy efforts. Second, Congress gave the CFPB a lot of power, but it's not unlimited, and there are baselines Congress established, under the FTC Act around UDAP, and a lot of the specific laws and regulations the CFPB can enforce. The CFPB does, on occasion, close investigations, lose in court, or realize its preferred position is not supportable. Third, there have been instances in litigated cases and settlements in which penalty amounts sought were premised on new readings of established law that were contrary to previous regulatory guidance. Finally, the markets team, which monitors financial markets, conducts research, and supports rule writing, has been an important and positive feature of the CFPB.

Q: What are some myths that participants in the consumer financial services sector believe about the CFPB?

Allen H. Denson:

My company is too small to show up on the CFPB's radar. Time and again, we have seen that no company is small enough to be overlooked. In fact, small companies seem to present the perfect opportunity for the Bureau to push a novel interpretation of the law and send a message to others.
My company has passed all of its state examinations – what could the Bureau find wrong with my company? State regulations and federal regulations are entirely different. Ten years later, if you are still asking this question, you are not paying close enough attention.
The agency is staffed with idealogues. The Bureau is a specific agency with a specific mission, staffed with hard-working people who are committed to making sure that the mission is accomplished. In the case of an enforcement action, that mission is securing maximum relief for consumers. That can often make targets feel like they are being singled out. Instead, this is the legal framework that Congress set up for consumer protection. The Bureau is an enforcement-driven agency, so when they bring cases, they intend to send a message.

Jonathan L. Pompan: The CFPB is not all-knowing when it's investigating a company or during an exam. Sometimes less is more, but other times it can be helpful if key documents, information, and reports that companies provide offer context about the positive aspects of the compliance management system and its results.

What about the CFPB should keep in-house counsel up at night?

Allyson B. Baker: Here are some key things to consider if you are in-house counsel of a financial services company offering consumer-facing products or services:

Are you offering a consumer financial product or service to a vulnerable consumer segment?
Are you offering a consumer financial product or service that is not always one selected by consumers in the marketplace, i.e. servicing, collections, etc.?
More recently, has your product or service been especially used by consumers during the pandemic?

If the answer to any of these questions is yes, there is a chance that your company's consumer financial products or services might become the subject of heightened Bureau scrutiny during the next year.

Jonathan L. Pompan: There are plenty of examples of the CFPB using its authority in ways some have not anticipated. Companies need to be able to adapt and stay ahead of the trends to spot issues and make informed risk and compliance decisions. Have a position that is defensible from the point of view of the Bureau and through the eyes of the consumer.

Q: What can companies do to try and avoid a CFPB enforcement action or negative exam finding?

Jonathan L. Pompan: For many consumer financial services providers and their vendors there has been a heavy investment in compliance management systems and processes to promote compliance with applicable law, train staff, and monitor and test that compliance. Having a robust compliance program is important, but it is truly useful only when it can be explained and has had its intended outcome – compliant activity. Keep up the investment, but don't lose sight of what all the talk about compliance is intended to produce (and avoid).

* * * * * *

If you have other questions about the impact of the CFPB's first 10 years, or about what lies ahead, contact our Consumer Financial Services attorneys or visit Venable's Consumer Financial Services page to learn more about our capabilities.