CFPB and Indirect Lending

Today, the CFPB released a bulletin explaining that certain lenders that offer auto loans through dealerships may be responsible for unlawful and discriminatory pricing.  As Robin, Batman’s young sidekick might say, “Holy Fair Lending violations, Batman!”.  If your bank is involved in any type of dealer financing, you should review the parameters and determine whether changes need to be made.  The announcement, bulletin, and a cool little chart may be found here http://www.consumerfinance.gov/blog/buying-a-car-heres-what-you-need-to-know/

To combat the scourge of unfair pricing in auto financing, the CFPB bulletin recommends that bank take steps to curtail such activity, including, but not limited to:

• Imposing controls on dealer markup, or otherwise revising dealer markup policies;

• Monitoring and addressing the effects of markup policies as part of a robust fair lending compliance program; and

• Eliminating dealer discretion to markup buy rates, and fairly compensating dealers using a different mechanism that does not result in discrimination, such as flat fees per transaction.

Let’s see, in its short tenure, the CFPB has singlehandedly impacted the consumer real estate, student loan, and auto lending markets (and not always for the better), caused jitters in the credit card industry, and is making the consumer reporting industry begin to shake.  Before long, Uncle Vito will be the only place to get a loan, and even the CFPB doesn’t want to make Uncle Vito mad.

ABS is helping as best we can so that you don’t get an offer from the CFPB that you can’t refuse.

Get on the Train!

Proverbs 22:6 tells us to “Train up a child in the way he should go, and when he is old he will not depart from it.”  Having survived three teenagers who have grown into reasonably responsible adults (employed, married, no known addictions or long-term incarcerations), my view of “training up” has changed.  Early on, I was hoping that it meant to put them on a train and send them far away for an indeterminate amount of time.  I realized, however, that the phrase meant that my wife and I were to teach, prepare, and continually encourage them in good thinking and good doing in line with their individual personalities.

As we all have experienced, the regulatory agencies have given bankers a plethora of learning and training opportunities in these last few years, and 2013 promises to be a banner year.

At American Bank Systems, we want to partner with you in “training up” your staff to meet the ever increasing need for knowledge created by all the regulatory changes.  Our topics range from basic to technical and are delivered as on-site seminars and webinars.  The 2013 schedule is semi-dependent on the timing of the releases of the CFPB’s final rules, but here’s what we have so far:

              HMDA, 1/22/2013 - Webinar

Competing the GFE/HUD-1, 2/12/2013 - Webinar

Deposit Account Basics, 2/26/2013 - Webinar

Flood Rules, 3/5/2013 - Webinar

Regulation E Error Resolution, 3/26/2013 - Webinar

Adverse Action Rules, 4/16/2013 - Webinar

Dodd-Frank – Risk-Based Pricing, Exception, and Credit Score Notices, 

5/14/2013   - Webinar

NEW Real Estate Lending Rules, 5/30/2013 - Webinar

Fair Lending Compliance, 6/11/2013 - Webinar

Safe Deposit Box, 7/9/2013 - Webinar

The Basics of Deposit Account Opening, 7/23/2013 - Seminar

Completing the Loan Estimate and Closing Disclosure, 8/9/2013 - Webinar

Basic Loan Documentation, 8/20/2013 - Seminar

Basic Real Estate Loan Documentation, 9/24/2013 - Seminar

The Bank Secrecy Act, 10/15/2013 - Webinar

NEW Real Estate Lending Rules, 10/29/2013 - Webinar

HMDA, 11/14/2013 – Webinar

Hope to see you on the train!  Register at: http://www.americanbanksystems.com/training.aspx

Reg. E Foreign Remittance Rule

Great day, y'all!

At a mere 31 pages, the CFPB International Fund Transfers, Small Entity Compliance Guide is a must for home or office.  Small enough to go anywhere; big enough for the really tough jobs. (Sorry, practicing for my next gig as infomercial spokesperson)

On October 17, 2012, the CFPB released its guide for the Reg. E Foreign Remittance Transfer rule which will take effect 02/07/13.  If your bank plans to permit your consumer customers to electronically send funds outside the U.S., you should take advantage of this overview of the new Reg. E rule; it’s straight from the horse’s…uh…mouth.  In addition, the Bureau plans to have a replay of its wildly entertaining Remittance Rule Overview webinar that was attended by thousands this afternoon.  

http://files.consumerfinance.gov/f/201210_cfpb_small_business_guide.pdf

And remember, it makes a great gift for the holidays!

Your partner in the madness!

The Long and Winding Road

In 1938 the Wheeler-Lea Act amended section 5 of the Federal Trade Commission Act to declare unfair or deceptive acts or practices in commerce illegal and expanded the FTC’s authority to include consumer protection. Adopted as a companion amendment to the 1938 Federal Food, Drug, and Cosmetic Act, which granted the FDA authority over the food and drug industry, medical devices, and cosmetics, as well as establishing mandatory pre-market drug approvals, the amendment gave the FTC authority over drug advertisements.

While the instigating factor was unfair or deceptive acts or practices relating to the advertisement of drugs, the amendment was drafted much broader, specifically: “Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful.” (Note the focus on commerce - not consumers!) While the prohibition applies to all engaged in commerce, the FTC was not granted authority over banks, savings and loan institutions, or Federal credit unions.

In 1975, the FTC Act was amended to require the banking agencies to establish consumer complaint processes and take action on complaints alleging unfair or deceptive practices. (Note the focus on consumers – not commerce!) This amendment prompted the FRB to issue Regulation AA, Subpart A establishing the consumer complaint process. Over the course of time, Congress took action on specific abusive, unfair, or deceptive acts or practices, resulting in regulations such as those covering TILA, Fair Credit, Home Equity, TISA, HOEPA, and Privacy – but none of the agencies adopted a regulation covering the broad topic of “unfair or deceptive acts or practices.”

Oh, they skirted the topic from time to time. In 1980 the FRB issued a policy statement on unfairness, followed by a policy statement on deception in 1983. And in 1985, Regulation AA was expanded to include Subpart B “for the purpose of preventing specific unfair or deceptive acts or practices of banks.” Beginning in 2002, the agencies issued various notifications to institutions of their intent to enforce the prohibitions against unfair or deceptive trade practices, based on the law and interpretations established by the courts and the FTC. And, agency examination procedures for FTC Unfair or Deceptive Acts or Practices were added to some, but not all, supervisory manuals, and no interagency exam procedures were issued.

The 2010 Dodd-Frank Act (DFA) reopened the debate as to whether the banking agencies should promulgate rules prohibiting unfair or deceptive acts or practices, and added a new category of concern – abusive. Additionally, the DFA directs the newly created CFPB to issue regulations to prevent UDAAP against consumers. (Again, note the focus on consumers – not commerce!) While to date the CFPB has not issued the required regulation, it did include UDAAP procedures in its examination manual.

Bureau examiners are directed “to assess the quality of the regulated entity’s compliance risk management systems, including internal controls and policies and procedures, for avoiding unfair, deceptive, or abusive acts or practices.” Further, the procedures enumerate specific topics that should be covered in the institution’s policies and includes consideration of whether “internal control processes are documented” in evaluating the adequacy of the institution’s program.

Gulp! Based on the exam procedures, I feel a project plan coming on. Have you specifically identified the policies, procedures, and internal controls relating to UDAAP in your institution? Are they all documented? Does your training program specifically cover UDAAP, and do you include third party providers in UDAAP training? Do you routinely analyze (and, of course document the analysis of) consumer complaints specifically for UDAAP? Oh, wait – generally the level of formality of the program expected will be dictated by the level of risk – have you done a UDAAP risk assessment? Have you expanded the audit scope so that it “includes a review of potential unfair, deceptive, or abusive acts or practices” and is that work “performed consistent with the audit plan?” And the list goes on!

But wait – there’s more! Within the introductory information of the examination procedures, in the section Relationship to Other Laws it states: “a transaction that is in technical compliance with other federal or state laws may nevertheless violate the prohibition against UDAAPs.” The example provided relates to an advertisement that complies with TILA but contains other statements that are untrue or misleading. But what impact, if any, does UDAAP have on an institution’s use of a Model disclosure?

The FTC’s clear and conspicuous standard, which is included in the CFPB’s manual, evaluates communications with consumers based on the “four Ps” – prominence, presentation, placement, and proximity. The Model forms generally appear to meet the prominence, placement, and proximity tests. The presentation standard stated in the CFPB manual looks for an “easy-to-understand format” and the FTC version asks if the wording and format are easy for consumers to understand. Well, have you read those Model forms lately? Do we need to expand our project plan to include designing disclosures with wording and formatting that are easy for the consumer to understand AND that meet all regulatory requirements?!?!

Clearly, regulators are focused on UDAAP and consumers – just look at the recent CFPB enforcement action against Capital One based on “deceptive” practices – yet, 75 years after Congress declared “unfair or deceptive acts or practices in or affecting commerce unlawful,” we have yet to see a regulation dealing with this broad topic. The CFPB is required to issue regulation; all of the agencies continue to issue guidance relating to specific products or practices; and, examiners are including varying degrees of UDAAP reviews in examination scopes. And, my personal view is that the regulatory consumer-centric focus will ultimately expand to encompass all types of customers.

Institutions that implement a project plan addressing UDAAP now will be better positioned to respond to the new regulation and the increased regulatory focus. Determine your UDAAP-readiness by reviewing the examination procedures published by your primary regulator – and those published by the CFPB – to identify opportunities for enhancement. Then draft a plan and timeline to implement those enhancements. And, by all means, stay tuned to the agencies for breaking news!

Anchors Away and the SCRA

Usually the phrases “Servicmember’s Civil Relief Act” and “enforcement action” don’t appear in the same hemisphere let alone the same sentence. However, that combination does occur in the OCC/DOJ announcement of a 07/26/12 enforcement action against Capital One. The full text may be found at the URL below.

It’s probably been a while since you took the SCRA 101 class in Bankers School, but, if you recall, the core of the Act is that servicemembers are provided relief from certain obligations, and it temporarily suspends many judicial and administrative proceedings and transactions involving civil liabilities when their service affects their ability to meet or attend to civil matters.

We all should be avid and vocal supporters of our military men and women. However, the nature of Capital One’s crimes does not appear to fit the punishment (as often occurs in this season of enforcement actions). From the text of the settlement, it appears that the grievous nature of the crime was one of not paying attention rather than an intentional infliction of financial distress targeted on our troops.

Regardless, there are several points that community banks should take from the enforcement action because, you know, stuff always rolls down hill. Institutions should
•Have procedures for determining whether the institution has servicemembers as customers;
• Understand the special protections servicemembers are afforded;
• Have procedures for timely providing any requested SCRA benefits;
• Obtain and retain accurate and complete records that document the basis for decisions regarding servicemembers’ eligibility for SCRA benefits or protections;
• Document the institution’s compliance with the Act;
• Have adequate oversight over any third-party vendors, such as marketing, sales, servicing, credit card accounts, mortgage loans, motor vehicle finance loans, and consumer loans and lines of credit;
• Follow the letter of the law, especially with regard to any collection activity (from collection calls through the sale of the repossessed/foreclosed collateral).
http://www.occ.treas.gov/news-issuances/news-releases/2012/nr-occ-2012-115.html

As always, ABS stands ready, willing, and able to partner with you in the battle.

A New Risk Measurement?

While the Federal Reserve, the FDIC, and the Office of the Comptroller all expect a financial institution to have in place a risk management program, commensurate with the size and complexity of the institution, to identify, measure, monitor, and control risk, the categories of risk to be included in a risk management program vary across agency. All three agencies include: credit risk; liquidity risk; price/market risk; transactional/operational risk; and, compliance/legal risk. The Fed and the OCC include reputation risk; and the OCC also incorporates interest rate risk, strategic risk, and foreign exchange risk. In spite of the differences in categories of risk, the primary objective of the program is consistent across the agencies: to measure the institution’s potential risk of loss associated with its activities, given the level of mitigating factors implemented by the institution.

Enter the Consumer Financial Protection Bureau. The CFPB was established as a regulator of financial institutions to supervise banks, credit unions, and other financial companies and to enforce Federal consumer financial laws. However, its mission is to make markets for consumer financial products and services work for Americans; a somewhat different focus from the other regulatory agencies. And the difference is further highlighted in the Risk Assessment process set forth in the CFPB Supervision and Examination Manual published in September 2011. This risk assessment evaluates the “risk to consumers,” defined as “the potential for consumers to suffer economic loss or other legally-cognizable injury as a result of a violation of Federal consumer financial law.”

The two risk assessments use the same methodology; with both evaluating the inherent risk and analyzing the effectiveness of the controls to arrive at a residual risk level or, in the case of the CFPB, an overall consumer risk level. But if one approach is focused on the risk to the financial institution and the other on the risk to the consumer, are the results comparable? In a case where an institution has a high level of residual compliance risk associated with a specific product, is there an equally high level of consumer risk?

Let’s look at a few examples. If an institution makes a significant number of real estate loans in a special flood hazard area, has a history of flood violations, and has weak controls, the residual risk to the institution is high. If a consumer obtains a real estate loan in a special flood hazard area and the institution fails to require flood insurance, the risk that the consumer may suffer a loss if the area floods is also high. In spite of the difference in focus, the residual risks appear comparable – when an institution is facing a high level of compliance risk, there is also a high level of consumer risk.

In our next example, consider an institution with a history of violations relating to transaction limitations for savings accounts under Regulation D. Given the prior violations and assuming weak controls, the residual risk to the institution is high. However, under the CFPB’s definition of consumer risk, does this violation have “the potential for consumers to suffer economic loss or other legally-cognizable injury as a result of a violation of Federal consumer financial law?” Because the institution’s lack of enforcing these limitations will allow the consumer to continue to maintain the account and continue to exceed the transaction limitations, there is no harm to the consumer.

Clearly these two different risk assessment approaches do not always yield comparable results. How, then, is the institution to identify, measure, monitor, and control consumer risk? Although the CFPB does not require institutions to implement its risk assessment methodology, it appears that institutions will need to add consumer risk and the CFPB’s methodology to its current risk management program.

Another interesting difference in the CFPB’s risk assessment is the manner in which an institution’s inherent risk to consumer is mitigated or amplified by the strength or weakness of the controls. The CFPB provides a Risk Matrix similar to those developed to represent the traditional method, with inherent risk categorized as high, moderate, or low, and the quality of risk controls defined as strong, adequate, or weak.

However, under this new methodology, a high level of inherent risk cannot be mitigated to less than moderate risk level – even with strong controls. A low risk area increases to moderate risk if the risk controls are weak. And, across every inherent risk level, implementing adequate controls will not reduce the residual risk below the inherent risk level.

To illustrate, let’s apply a typical point rating system to this risk assessment analysis. Using a one-to-three scale:

• High/Weak = 3 points
• Moderate/Adequate = 2 points
• Low/Strong = 1 point

Based on the total point structure, the Overall risk categories are defined as:

• High Risk = 7 to 9 points
• Moderate Risk = 4 to 6 points
• Low Risk = 1 to 3 points

The resulting risk matrix, using the traditional risk assessment methodology is:

Whereas, under the CFPB’s new risk assessment methodology, the amplified by approach produces a very different matrix:

As you can see from this illustration, implementing strong controls will result in a decreased residual risk; however, adequate controls will never reduce the residual risk level below the inherent level. How long before an examiner tells you that adequate controls are no longer good enough?

Will your Risk Management Program withstand this new focus?

CFPB's New Service Provider Pronouncement

The CFPB, Obamacare for the financial industry, has reared its ugly head, again, and rattled the “unfair, deceptive or abusive acts or practices” sabre. The Bureau (and I don’t mean the piece of furniture where you keep your socks and underwear and sometimes hide a Christmas gift for your spouse) has announced that covered financial institutions may be held responsible for illegal actions of a service provider. Institutions are expected to be responsible for their service provider’s activities beyond the normal due diligence practices that have served the industry and consumers well for the past several decades. The Bureau’s expectations are summed up in the following bullet points:
• Conducting thorough due diligence to verify that the service provider understands and is capable of complying with Federal consumer financial law; (A nebulous expectation from a nebulous agency. Do we give them a 10 page multiple choice test to document their understanding? Is it a pass/fail grading system? And what about Spring Break?)
• Requesting and reviewing the service provider’s policies, procedures, internal controls, and training materials to ensure that the service provider conducts appropriate training and oversight of employees or agents that have consumer contact or compliance responsibilities; (Does the Bureau really believe that the large national or international service provider will turn over all the documentation that an institution needs to properly do this? And if they do, how many institutions have the staff, time, and wherewithal to properly analyze all this information provided? If they do comply, I have Las Vegas odds that the price of the service will increase.)
• Including in the contract clear expectations about compliance as well as appropriate and enforceable consequences for violating any compliance-related responsibilities, including engaging in unfair, deceptive, or abusive acts or practices; (Unfortunately, it’s the CFPB that determines what is an unfair, deceptive, or abusive acts or practice and only then when it can’t cite a violation of anything else.)
• Establishing internal controls and on-going monitoring to determine whether the service provider is complying with Federal consumer financial law; and (Again, how may large service providers will put up with this nonsense?)
• Taking prompt action to address fully any problems identified thorough the monitoring process, including terminating the relationship where appropriate. (This is the only sensible part of the expectations, and institutions are already doing this.)

Presumably, the resources that institutions would normally employ to serve their customers are thought, by the Bureau, to be better used in combatting the evils lurking in the service provider realm. Undeterred by the fact that most consumers neither care about the consumer compliance laws designed to protect them nor read the ream after ream of disclosures designed to make them better informed, the Bureau, in its never-ending quest to protect somebody from something, marches on making mountains out of molehills.

You should be concerned about this pronouncement even if your institution isn’t regulated by the CFPB. The tone set by the Bureau will, as does other kinds of…stuff, roll downhill and will be coming soon to a regulator near you.

ABS is ready, willing, and able to assist you with compliance strategies.