On May 22, the CFPB released its fourth “Supervisory Highlights” publication, giving financial services providers a preview of the CFPB’s future enforcement priorities. This edition drew attention to regulatory compliance in nonbank financial entities like debt collectors, payday lenders, and consumer credit reporting firms. While those industries have been subject to CFPB oversight since the passage of the Dodd-Frank Act in 2010, the report signaled that nonbank financial entities should review their companies’ compliance programs to prepare for a possible increase in regulatory enforcement. (Supervisory Highlights open with a summary of recent enforcement actions, many of which fall on firms that failed to heed previous reports.)
Among consumer reporting agencies (CRAs), the CFPB found significant issues with dispute handling procedures under the Fair Credit Reporting Act and Dodd-Frank. The CFPB took particular issue with CRAs that required an “identification number” – available only if the consumer purchased a report from the agency – to file a dispute by phone or online. There was also a disconnect between CRAs’ compliance officers and boards of directors, with several CRAs not requiring any type of board approval of compliance programs. Some firms even lacked an executive who was formally responsible for compliance oversight. CRAs that lack a clear chain of accountability for regulatory compliance, up to and including the board of directors, are likely to encounter heavy scrutiny if faced with a CFPB investigation.
The CFPB’s examination of debt collectors pointedly identified “a number of practices that violate the law.” In particular, the CFPB noted debt collectors’ failure to comply with the Fair Debt Collection Practices Act’s limitations on the time, quantity, and content of phone calls. Debt collectors also made use of unlawful misleading statements – for example, threatening litigation over unpaid debts when the collectors “demonstrably had no such intention.” The CFPB also found multiple violations of the Electronic Fund Transfer Act, which requires written authorization prior to commencing a recurring electronic fund transfer from a consumer’s account. Debt collectors who fail to monitor statutory limitations on their collection practices are at heightened risk of regulatory enforcement actions.
Payday lenders faced compliance issues similar to those faced by debt collectors. The report focused primarily on violations surrounding lenders’ collection practices and not on the loan process itself. The CFPB “pays close attention to the way in which lenders oversee those debt collectors acting as their service providers.” As such, violations like unauthorized disclosure of consumer information to third parties, false threats of legal action or fees, or improper workplace collection visits invite regulatory enforcement, even if perpetrated by outside collection agencies. The CFPB also noted that payday lenders suffered from the same lack of defined leadership over compliance as did consumer reporting agencies.
The report stressed some issues common to debt collectors, payday lenders, and credit reporting firms alike. The first was the importance of thoroughly documenting compliance programs. Firms that fail to produce evidence of a program may find themselves treated as if they had none at all – when the CFPB was unable to corroborate the dates of internal compliance audits or received undated policies in response to its investigations, its examiners assumed that “no such policies existed prior to the examination.” The second common issue was a lack of oversight by regulated firms over third-party service providers. Some firms with robust compliance programs still ran afoul of the CFPB because they failed to ensure that service providers – and their employees – were properly trained and understood their responsibilities under federal consumer financial laws.
Previous CFPB reports have foreshadowed increased regulatory enforcement. This report was vague about the extent of the practices about which it expressed concern, perhaps to encourage a holistic review in the targeted industries. Decision-makers in consumer reporting, debt collection, and payday loan firms should evaluate their compliance programs to prepare for a potential increase in regulatory scrutiny.