Consumer Advertising Law Blog

FTC FACTA Report: Credit Where Credit’s Due?

How often do you check the data underlying your credit score, as opposed to the score itself?  Probably not very often -- if at all.  At least that appears likely based on a report released by the Federal Trade Commission (FTC) on February 11, which was previewed by 60 Minutes on February 10.  Based on that report, it seems the three national credit reporting agencies (CRAs) -- Experian, Trans Union, and Equifax -- need to pay closer attention as well.  As the report documents, the data supporting the credit rating decisions of the CRAs frequently produced material errors in credit reports that consumers find difficult to correct.  This may color the accuracy of a consumer’s actual credit risk and creditworthiness. 

The FTC’s report was issued pursuant to the Fair and Accurate Credit Transactions (FACT) Act of 2003, which requires the FTC to conduct a study of consumer credit rating accuracy and to report to Congress on its findings every two years, which the FTC has done since 2004.  The most recent report (the fifth in the series) focuses on the ability of consumers to locate and correct errors in their credit reports.  Each credit report provides a summary of a consumer’s credit history, including an overall “score” assigned based on that history.  The most widely used score is the “FICO” score created by the Fair Isaac Corporation, which is used by all three of the major CRAs.  The FICO score, which measures the degree of credit risk a consumer poses based on the likelihood that the consumer will meet his or her credit obligations, runs from 300 to 850; the higher the score, the lower the risk.

The FICO score takes into account current and past credit card usage and payment history, loans, and mortgages, public records of bankruptcy, foreclosures and similar proceedings, and unpaid debts.  Each time a consumer requests access to credit, such as applying for a credit card, that is registered in the score.  The length of credit history is incorporated as well.  The approximately 30,000 sources of this information include financial institutions, insurance companies, government agencies, creditors, and collection agencies (collectively known as “data furnishers”).  The FTC engaged data furnishers in producing the February 11 study, along with consumers, the CRAs, and the Fair Isaac Corporation.

To conduct its study, the FTC randomly selected 1,001 participants from consumers with credit histories generated by the three national CRAs.  The participants were asked to review their credit reports for accuracy and, to help them spot errors, a trained study associate was provided.  When errors were found, the participant was urged to challenge any material errors – i.e., errors sufficiently serious to affect the consumer’s credit score – under the dispute resolution mechanism established by the Fair Credit Reporting Act (FCRA).  Participants received a provisional FICO score when initiating the challenge and, when the dispute resolution process was complete, they were provided new credit reports and new credit scores.  The FTC then used the provisional score, the new report, and the new score for each participant to measure the influence of the errors (actual and potential) on the participant’s credit.

The FTC found that 1 in 4 of consumers (262 participants) discovered a material error in at least one of their three credit reports.  (Errors in the “header information” (e.g., addresses, age, employment) are not considered material because this information is not used in determining a consumer’s credit score.)  All of these consumers challenged these errors, but only 1 in 5 of them (206 participants) received some kind of credit report change.  Of these 206 consumers, the CRAs corrected all the material errors in the reports of 97 consumers.  For 109 of them, the CRAs corrected only a portion of the identified errors, and for 56 participants, the CRAs did not correct any errors.  When the CRAs did not correct the identified errors, the CRAs informed the 56 participants that the party that had furnished the data denied the existence of any inaccuracy.

NAD Deals a Double Whammy on Two Consumer Promotions

Although the products at issue -- credit cards and breakfast burritos -- could not be much further apart, recent decisions issued by the National Advertising Division of the Council of Better Business Bureaus (the NAD) involving Discover Financial Services LLC (Discover) and Sonic Corp. (Sonic) both remind advertisers to communicate clearly the important terms and limitations of their consumer promotions.  According to the NAD, both Discover and Sonic failed to do so. 

In Discover’s case, competitor Chase Bank challenged Discover’s credit card commercials on the ground that Discover had “obscured critical terms” of its cash-back programs in advertisements claiming “right now, all over the country, Discover card customers are getting 5% Cashback bonus [in selected purchase categories],” and also stating that Discover customers could earn “up to 1% cash back” on ordinary everyday purchases.  In fact, the 5% cash-back benefit was a temporary, opt-in promotion and the “up to 1%” cash-back program was only applicable after Discover card holders made $3,000 in qualifying purchases; prior to that threshold, a 0.25% rate applied.

Although Discover argued that its commercials were directed at existing customers who would understand these limitations, NAD sided with Chase, noting that television commercials are generally understood as messages to the public at large.  NAD has recommended that Discover more clearly disclose the limitations on the cash-back programs or discontinue the advertising, specifically instructing Discover to modify the commercials to make disclosure of the program’s opt-in requirement, limited duration, and qualifying purchase limitation “easy for consumers to notice, read, and understand.”  

NAD was alerted to the Sonic promotion at issue -- offering a “Free Coffee With Any Breakfast Burrito” -- by a disgruntled consumer who, upon ordering a Junior Breakfast Burrito and requesting his free coffee, was told that his order did not qualify.  Instead, only one of Sonic’s Premium Burritos would suffice.  The consumer, who ultimately went to another store, notified NAD of the claim.  In its Sonic decision, NAD stated that advertisers are “responsible for all reasonable interpretations of their clams, not just the messages they intend to convey,” and found that Sonic should have clearly and conspicuously disclosed the material limitations on its promotion “in close proximity to the claim.”  Sonic has since offered the consumer a $50 gift card to regain his goodwill -- what we don’t know is whether the consumer also received any free burritos.

The moral of both stories: Disclose the important limitations on your company’s promotional deals. 

- Joanna Persio and Roberta Horton

 

Whaddaya Think About Arbitration? The CFPB Wants to Know

Acting on powers it received in the Dodd-Frank Act, the Consumer Financial Protection Bureau has opened the public comment period to gather views regarding the use of arbitration agreements “in connection with the offering or providing of consumer financial products or services.” 

The CFPB seeks comments by June 23, 2012, regarding

1. the prevalence of arbitration clauses in consumer financial products and services;
2. the types of claims brought by and against consumers in the financial services context;
3. the effects on consumers and financial services companies of actual arbitrations; and
4. how arbitration clauses affect consumers and financial services companies outside of arbitration.

The timing of this comment and rulemaking process is particularly interesting in light of recent Supreme Court decisions reaffirming the scope of the Federal Arbitration Act and the enforceability of arbitration agreements in business transactions. As widely reported last year, in ATT Mobility LLC v. Concepcion, the Supreme Court held that arbitration clauses are enforceable in consumer contracts even when prohibiting class actions. (For more on Concepcion, see here and here). And earlier this year, in Greenwood, the Supreme Court held that because the law at issue (the Credit Repair Organizations Act) was silent on whether claims can proceed in arbitration, the Federal Arbitration Act required that the arbitration clauses in the challenged consumer contracts be enforced according to their terms.

The call for comments by the CFPB is an early step in a long process of reviewing the issue of arbitration clauses in financial services contracts, but those interested should be sure to let their views be known.  Stay tuned and watch this space for updates on the public comment process, as well as the resulting reports and rules issued by the CFPB.

- Nicholas Kennedy, Gil Serota, and Sean Morris

 

FTC to Car Dealerships: Misleading Ads Must Be “Gone in 60 Seconds”

“We will pay off your balance no matter how much you owe” is a slogan that was used by a car dealership for years until the Federal Trade Commission, last week, reached settlement agreements with five car dealerships prohibiting this type of advertising regarding paying off loans on consumers’ trade-in cars and other advertising related to financing terms.  The FTC alleged that the advertising was false and misleading, in violation of the FTC Act, the Truth in Lending Act, Regulation Z, and the Consumer Leasing Act and Regulation M by implying that when the consumer trades in a used car to purchase another car, the consumer will have no remaining obligation for any amount on the used car.  However, according to the FTC, when a used car had a loan balance that exceeded the car’s value, called negative equity, the car dealerships involved in the settlement did not pay off the balance of the loan but rather included the amount of the negative equity in the loan for the new vehicle.  For example, according to the FTC’s Consumer Alert Publication on this topic, consumers who had a loan payoff of $18,000 on a car worth $15,000 would then have the negative equity amount of $3,000 added to the loan for the new car by the car dealerships, thus increasing the amount of monthly payments for the new car or down payments.

The five dealerships, from various cities in the U.S., have entered into proposed consent agreements with the FTC (here, here, here, and here). The consent agreements prohibit them from advertising that they will pay the remaining balance on a trade-in if the consumer is still responsible for the negative equity value and from misrepresenting other facts related to leasing or financing a vehicle.  These consent agreements reflect a broader FTC initiative to identify and address consumer fraud and deceptive practices targeting people who are financially distressed, which included a series of roundtable events last year soliciting information on potential consumer protection actions concerning the sale, financing, or lease of motor vehicles.  As the FTC’s website states, “Having access to a motor vehicle is essential for many consumers to fulfill their daily obligations.  It imposes a substantial expense, however, and accordingly most consumers seek to lease or finance the purchase of a new or used car.  As the nation's consumer protection agency, the Commission is committed to protecting consumers in connection with these financial transactions.”  As we have written in the past, it is important that advertising is clear and gives full information to consumers, otherwise -- as these five recent consent agreements show -- the FTC may well act fast and furiously.

- Deborah Birnbaum & Angel Garganta

Time to Consider Overdraft Policies: It’s on the CFPB’s Radar

On Wednesday, the Consumer Financial Protection Bureau (CFPB) announced that it is beginning an inquiry into bank checking account overdraft policies.  As an initial step, the CFPB issued a Notice and Request for Information seeking information from the public.  Overdrafts have been the subject of increasing federal bank regulators’ scrutiny during the past few years and the CFPB’s interest in the issue is not surprising.

An “overdraft” occurs when an account does not contain sufficient funds to support a transaction.  The types of transactions that could cause an overdraft include ATM, point-of-sale debit card, preauthorized debit card, Automated Clearing House (ACH), and online banking transactions.  If a consumer did not have sufficient funds in his or her bank account to support a transaction, a bank may decline to pay the item and charge a non-sufficient funds (NSF) fee.  However, in recent years, many institutions have introduced automated overdraft systems under which overdraft items are paid for the convenience of the account holder and an overdraft fee is charged per item.

Not surprisingly, a 2008 FDIC study concluded that the most frequent overdrafters were low and moderate income individuals and young adults.  Since that study, the Federal Reserve amended its regulations (i) to require all depository institutions to provide periodic statement disclosures of overdraft fees and fees for returning unpaid items; and (ii) to prohibit an institution from charging fees for transactions that overdraw an account by use of a debit card at an ATM or point-of-sale unless the consumer opts in to permitting the institution to pay overdrafts.  Most recently, in 2010 the FDIC issued guidance on identifying, managing, and mitigating risks associated with overdraft programs.

The CFPB is seeking information from the public regarding:

1. lower cost alternatives to overdraft protection programs, such as linked savings accounts or overdraft lines of credit;
2. the extent to which institutions provide consumer alerts regarding balances and overdraft triggers;
3. the impact of the above-referenced regulatory changes made by the Federal Reserve, and demographics concerning overdraft opt-in rates;
4. the impact of recent changes in some institutions’ operating policies, including, for example, changes to the posting order of debit transactions;
5. the economics of the overdraft program, including the revenue generated from overdraft programs and the extent to which different consumer groups incur overdrafts and related fees disproportionately; and
6. the long term impact of overdraft programs on consumer behavior and options.

The CFPB has also released a model “penalty fee box” for possible disclosure of overdrafts and associated fees.

Overdrafts are plainly in the limelight again.  Financial institutions would be well advised to review carefully their overdraft policies and practices, including the disclosures to consumers regarding those policies and practices.  Consumers would be well advised to track their spending habits closely and review their accounts to determine whether they want to opt for overdraft coverage.

- Michael Mierzewski, Nancy Perkins, & Jeremy Hochberg

CFPB and FTC Reach Agreement on Cooperation

On January 23, 2012, the Consumer Financial Protection Bureau (CFPB) and the FTC announced that they had signed a memorandum of understanding (MOU). In doing so, the two agencies fulfilled requirements of the Dodd-Frank Act that they negotiate an agreement to coordinate enforcement actions against entities subject to both agencies’ jurisdiction and to harmonize certain rulemakings.

Under section 1024 of the Dodd-Frank Act, the CFPB has enforcement authority over nonbank entities that offer or provide consumer financial products or services. Because the FTC retains enforcement authority over such entities under the Dodd-Frank Act, both agencies could bring separate, and perhaps inconsistent or duplicative, enforcement actions against the same entity over the same issue in the absence of coordination. Accordingly, the Dodd-Frank Act requires the CFPB and the FTC to negotiate an agreement to coordinate enforcement actions against nonbank entities subject to the enforcement authority of both agencies regarding the offering or provision of financial products or services. Under the MOU, each agency has agreed to give notice to the other before commencing an investigation, filing an action or commencing a proceeding, settling an action or proceeding, or intervening in an action against a supervised entity where the other agency also has the authority to bring an enforcement action against the supervised entity. They will coordinate to avoid duplicative or conflicting enforcement actions.

The Dodd-Frank Act also requires the two agencies to negotiate an agreement to coordinate CFPB rulemaking to prohibit “unfair, deceptive, or abusive acts or practices” under section 1031 of the Dodd-Frank Act and FTC rulemaking to prohibit “unfair or deceptive acts or practices” under section 18 of the Federal Trade Commission Act as applied to nonbank entities that are subject to the jurisdiction of both the CFPB and the FTC. Under the MOU, each agency has agreed to provide the other agency with notice before proposing or issuing any rules or formal comprehensive guidance documents under these statutory provisions. They will consult on such rules or guidance documents.

As with other MOUs the FTC has entered into in the past, for example, its MOU with the FDA over review of labeling and advertising of food, cosmetics, medical devices and dietary supplements), the devil is often in the details, and a plan for coordination does not mean that there will be perfect efficiency or consistency. Given that many of the attorneys working at the CFPB came from the FTC, we expect the communication between the two agencies to be open and frequent. It is clear from the detail in this MOU that the agencies have given considerable thought on how to manage the overlapping jurisdiction to maximize agency resources.  Whether this results in more or less aggressive rulemaking, supervisory and/or enforcement actions overall remains to be seen.

UPDATE: For a more detailed discussion of this issue, click here.

- Nancy Perkins and Harry Wu

Non-Bank Entities Providing Financial Services: Get Ready to be Examined

The Consumer Financial Protection Bureau (CFPB) announced in a press release last Thursday the launching of its nonbank supervision program. Following the recess appointment of Richard Cordray as its Director, the CFPB announced that, effective immediately, it has authority to oversee, regardless of size, nonbank mortgage companies, private education lenders, and payday lenders.  Cordray has indicated that the CFPB will be aggressive despite the fact that he is a recess appointment.

Nondepository providers of consumer financial products and services are subject to federal supervision for the first time under the Dodd-Frank Wall Street Reform and Consumer Protection Act.  While the Dodd-Frank Act grants the CFPB authority to supervise nonbank mortgage companies, private education lenders, and payday lenders, regardless of size, the CFPB can generally only supervise entities in other markets for consumer financial products or services if the entity is deemed to be a “larger participant” of such market.  Examples of other markets that could be subject to a “larger participant” rule include debt collection, consumer reporting, auto financing, and money service businesses.

Last June, the CFPB issued a notice seeking comment on how “larger participants” are to be identified.  For a discussion of that notice click here. The CFPB stated on Thursday that it will issue an initial “larger participant” rule in the near future. The Dodd-Frank Act provides that the CFPB may also supervise any nonbank that it has a reason to determine “is engaging, or has engaged, in conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services.” The CFPB also stated that it plans to publish rules regarding the implementation of this provision.

The CFPB’s nonbank supervision program will be a risk-based program. The CFPB will assess whether nonbanks are conducting their business in compliance with federal consumer financial laws, such as the Truth in Lending Act, the Real Estate Settlement Procedures Act, and the Equal Credit Opportunity Act.  An examination may include, among other things, a review of marketing materials, products, and lines of business, and a requirement that nonbanks file certain reports.  According to the CFPB, the agency will apply the same approach to nonbank examination as it does to bank examination, including notifying nonbanks in advance of examinations.  Nonbanks should familiarize themselves with the CFPB’s Supervision and Examination Manual, published on its website, to prepare themselves for eventual examinations.

- Michael Mierzewski and Jeremy Hochberg

Consumer Financial Protection Bureau’s New Supervisory Manual Focuses on Risk to Consumers

On October 13, 2011, the Consumer Financial Protection Bureau (CFPB) released a supervisory manual.  The Manual provides the CFPB’s examiners with guidelines for determining whether entities providing consumer financial products and services are complying with the consumer protection laws subject to the CFPB’s jurisdiction. Consistent with the purpose of the agency, and not surprisingly, the Manual indicates that when the CFPB examines an institution, it will focus on the risk to consumers. 

The Manual incorporates exam procedures developed by the Federal Financial Institutions Examination Council for many of the federal consumer financial laws now enforced by the CFPB. The exam structure and approach presented in the Manual is generally similar to that of the other federal banking agencies (indeed, it was drafted based largely on guidance issued by the other agencies). There are, however, aspects that are new and significant.  For example, the Manual includes detailed exam procedures for mortgage servicing, which is an indication that the agency plans to devote a great deal of attention to that area.

Under the CFPB’s new procedures, mortgage servicers will be subject to nine exam “modules": (1) servicing and loan-ownership transfers; (2) payment processing and account maintenance; (3) customer inquiries and complaints; (4) maintenance of escrow accounts and insurance products; (5) credit reporting; (6) information sharing and privacy; (7) collections; (8) loss mitigation; and (9) foreclosures.

In addition, the Manual states that the CFPB expects each entity it regulates to have an effective compliance management system. An effective compliance management system commonly has the following four components: (1) board management and oversight; (2) a compliance program comprised of policies, procedures, training, and monitoring and corrective action; (3) a system for responding to consumer complaints; and (4) a compliance audit program.

The Manual specifies that every exam will include a review of the entity’s compliance management system, as well as a review for any potential unfair, deceptive, or abusive practice (UDAAP), and regulatory compliance matters presenting risks to consumers. The Manual also provides that every exam covering lending activities must include a review for discrimination and fair lending compliance.

Notably, the Manual’s provisions relating to UDAAP do not provide any insight as to how the term “abusive” will be interpreted and applied in practice. In a departure from the normal exam process of the other federal banking agencies, the Manual also instructs examiners to interview consumers, as necessary, if the examiner uncovers a potential UDAAP issue.

The CFPB has indicated that in the coming months it will release additional guidelines, like these mortgage servicing modules, organized by product and line of business.  If the mortgage servicing procedures are any guide, the forthcoming guidance will likely be more detailed than that currently used by the other federal banking agencies.  As the CFPB updates the Manual and shifts its regulatory focus to new products and business lines, regulated entities may wish to review and enhance corporate compliance policies to directly address the agency’s new priorities and areas of concern.

For a more detailed description on this topic, click here.

- Beth DeSimone, Nancy Perkins, and Jeremy Hochberg

Prepaid/Stored Value Card Providers and Sellers: Prepare to Monitor for Suspicious Activity

On July 29, 2011, the Financial Crimes Enforcement Network (FinCEN) issued a Final Rule that modifies the government’s treatment of stored value, prepaid cards, and other prepaid access products under the Bank Secrecy Act (BSA) regulations. The Final Rule replaces FinCEN’s current construct of treating “issuers and redeemers” of stored value separately from other Money Service Businesses with one in which “providers” and “sellers” of “prepaid access” are subject to BSA requirements. The nuanced definitions given to these terms in the Final Rule will require participants in the prepaid area to analyze carefully their activities to determine their formal role in the process. Most notably, under the Final Rule “providers” of prepaid access will be responsible for suspicious-activity monitoring and reporting, as well as for other registration, customer identification, and recordkeeping activities. “Sellers” of prepaid access will share in each of these requirements, except for the registration requirement, for which the provider will retain sole responsibility.

The Final Rule covers prepaid devices such as plastic cards, mobile phones, electronic serial numbers, key fobs, and other mechanisms that provide access to funds that have been paid for in advance and are retrievable and transferable by replacing the term “stored value” with the term “prepaid access.” The changes made by the Final Rule have the potential to impact significantly the relationship among participants in the prepaid industry, as well as the products they sell. Industry participants should review their operations to determine the extent to which any revisions may be necessary to existing policies and procedures in light of the Final Rule. In addition, industry participants must assess their prepaid programs to determine who will become the “provider” for registration and other compliance purposes, lest FinCEN make the decision itself. In light of the compressed timeframes imposed by the Final Rule, it is important that such assessments commence promptly. For more details on the Final Rule, click here.

- Beth DeSimone and Jeremy Hochberg

Consumer Financial Protection Bureau Opens Its Doors: Will it be the Cop Folks Expect?

Tomorrow, exactly one year after the passage of the Dodd-Frank Act, the Consumer Financial Protection Bureau officially becomes a new cop on the consumer “banking beat,” responsible for enforcing the laws on credit cards, mortgages, student loans, prepaid cards, and other kinds of financial products and services. But as it opens its doors, it does not have the full force that many hoped or expected.

Only Monday, President Obama finally nominated a director for the CFPB, and it was not Elizabeth Warren, who envisioned the agency and its powers, and spent the last year setting it up. Rather, it was former Ohio Attorney General Richard Cordray ─ the CFPB’s current Assistant Director for Enforcement and one who is seen as an effective consumer advocate. However, Cordray’s confirmation is likely to be highly contested and may not move at all. In fact, dozens of Republican senators have announced their intent not to confirm any nominee, unless substantial changes are made to the CFPB, including turning it into a five-member commission ─ setting up the possibility of a controversial recess appointment.

Without a confirmed director at its helm, the CFPB will not be able to exercise all of the powers provided to it by the law. For example, the CFPB may not start supervising non-bank providers of consumer financial products until a director is in place. Yet many believe that it is these non-bank providers ─ i.e., payday lenders, student lenders, nonbank mortgage companies, and auto lenders ─ that most need federal oversight.

Bank Regulator Reminds Banks: Pay Attention To Risks Associated With Prepaid Products

On June 29, 2011, the Office of the Comptroller of the Currency (OCC) issued a bulletin to national banks focusing on their obligation to assess and manage the risks associated with what the OCC calls prepaid access programs. The OCC defines “prepaid access” as a wide range of devices that provide consumers with access to money electronically, including general purpose reloadable cards, payroll cards, government benefit cards, retail gift cards, mobile phones, and Internet sites. The Bulletin states that it applies to any other electronic devices or vehicles that are in use or may be developed in the future. Because the other federal banking agencies have not issued similar guidance, the Bulletin imposes expectations on national banks that are not imposed on other banks, although the guidance will also apply to federal savings banks as of July 21, 2011.

While prepaid access devices are attractive to banks because they can be marketed to a broad range of persons that are not usually bank customers, the OCC is concerned that they can also increase a national bank’s risks if not implemented appropriately.

Thus, the Bulletin reminds national banks that offer prepaid access devices to consumers that they should have a comprehensive risk management program that identify, measure, monitor, and control the risks related to those products. The program also should clearly assess how prepaid access devices fit within its overall business strategy and risk appetite. Additional components of such a program include:

• Policies and procedures to govern the program, including a due diligence process for selecting third-party service providers;
• Policies and procedures to ensure that disclosures to consumers about pricing, fees, transaction limits, and other program requirements and restrictions are clearly outlined;
• Robust audit and compliance functions; and
• Parameters for reporting to the bank’s board of directors.

For example, the Bulletin reminds banks that their arrangements with third-party service providers that often market these products should be governed by a well-constructed, enforceable service contract that clearly defines the rights and obligations of each party, as required by the OCC’s policies on use of third party service providers.

The Bulletin also states that national banks should ensure that the audit and compliance functions provide for sufficient consumer protection transaction testing (i.e. fees and disclosures), and BSA/AML and OFAC compliance. The program should also include procedures to evaluate any proposed changes or additions to the product prior to implementation.

The Bulletin finally outlines the duties of the national bank’s board of directors with respect to these programs, including receipt of periodic reports from bank management that allow the board to determine whether the prepaid access program is operating within established risk limits.

While the OCC is the only agency issuing such guidance to date, the guidance in the Bulletin is very broad and essentially is covered by more generic agency guidance such as the guidance for third party service providers. See Financial Institution Letter 44-2008, Guidance for Managing Third Party Risk (June 6, 2008). Thus, while the issuance continues to show agency concern over prepaid access generally, it does not really break new ground in the area. However, with the CFPB scheduled to take over responsibilities for this area this week, stay tuned for more substantive developments in the near future.

- Beth DeSimone and Jeremy Hochberg

Large Banks Beware: A CFPB Examiner is Coming to See You Soon

In an attempt to get off to a strong start, the Consumer Financial Protection Bureau (CFPB) warned the banking industry that, on July 21, it will begin supervising the 111 depository institutions that have total assets exceeding $10 billion for compliance with federal consumer protection laws. In guidance issued on July 12, the CFPB outlined the scope of its bank supervision program. Significantly, the CFPB stated that its examiners will review an institution’s products and services to determine whether they comply with consumer rules over their entire life cycle, including through development, marketing, sale, and management.

The CFPB also stated that it will conduct periodic examinations for most of the banks that it regulates and implement a year-round supervision program for the largest and most complex banks in the country. The CFPB stated that it will assess each institution’s ability to detect, prevent, and remedy violations that may harm consumers. It will evaluate an institution’s policies and practices for compliance with the consumer financial protection laws and regulations, and bring enforcement actions as necessary. It will also conduct fair lending reviews to detect and address potential discriminatory practices.

Managed out of satellite offices in Chicago, New York, San Francisco, and Washington, DC, the CFPB supervision team will initially be comprised of more than 100 members transferred from the other federal banking agencies. The CFPB expects that number to eventually rise to several hundred examiners. The CFPB anticipates that it will conduct its first round of on-site examinations in the coming weeks, after it coordinates with other regulators and finalizes its supervision plans. The CFPB will post its examination manual on its website with an invitation for feedback and suggestions. The CFPB stated that it will provide additional information to the 111 institutions by letter, and hold informational roundtables starting in August.

The Dodd-Frank Wall Street Reform and Consumer Protection Act gave the CFPB authority to exam and enforce the consumer financial protection laws against depository institutions with total assets exceeding $10 billion, and their affiliates. For all institutions with less than $10 billion in total assets, however, compliance with consumer financial protection laws will continue to be enforced by their primary federal regulators. For a more extensive discussion of the CFPB’s regulatory powers, click here.

Nondepository providers of consumer financial products and services also will be subject to federal supervision for the first time, but the CFPB’s power to start supervising such entities is constrained by the fact that a director has not yet been appointed. For more information about the CFPB’s supervision of nondepository entities, click here.

- Beth DeSimone and Jeremy Hochberg

Are you a "Larger Participant" in the Consumer Financial Area? How Big is Big Enough to Be CFPB-Supervised?

On June 23, 2011, the new Consumer Financial Protection Bureau (CFPB) issued its first notice and request for comment. The Notice requested input on how the CFPB should define “large participants” for purposes of its supervision of nondepository entities. The reason for the Notice is that nondepository providers of consumer financial products and services are subject to federal supervision for the first time by the CFPB under the Dodd-Frank Wall Street Reform and Consumer Protection Act. While the Dodd-Frank Act grants the CFPB authority to supervise nonbank mortgage companies, private education lenders, and payday lenders, regardless of size, the CFPB can generally only supervise entities in other markets for consumer financial products or services if that entity is deemed to be a “larger participant” of such market.

The Dodd-Frank Act thus requires that the CFPB issue an initial rule to define the entities that are “larger participants of a market for other consumer financial products or services.” A variety of consumer financial products and services offered by nondepository entities could potentially be subject to supervision by the CFPB under the “larger participant” rule. The Notice identifies the following market categories for possible inclusion:

1. Debt collection;
2. Consumer reporting;
3. Consumer credit and related activities;
4. Money transmitting, check cashing, and related activities;
5. Prepaid cards; and
6. Debt relief services.

No State Consumer Protection Act Claim in Competitor False Advertising Case

The Lanham Act is not a “consumer protection act,” and courts have recognized that the Lanham Act false advertising cases vindicate “competitive” injuries virtually without regard to “consumer” interests. A recent decision confirms a related principle: Lanham Act plaintiffs may not automatically tack on state consumer protection claims to their competitor cases.

In a decision on May 26, 2011 involving competing tax services, Jackson Hewitt v. H&R Block, the Southern District of New York dismissed a New Jersey consumer protection act (CPA) claim from a lawsuit alleging competitive misconduct. In its complaint, Plaintiff Jackson Hewitt alleged that H&R Block, plaintiff’s “direct competitor” in the tax preparation business, disparaged Jackson Hewitt by suggesting that 2 out of 3 tax returns prepared by Jackson Hewitt contained errors (see H&R Block's Second Look Review program here). The court noted that Jackson Hewitt’s case alleged “unfair practices that have disadvantaged Jackson Hewitt in the marketplace.” Significantly, however, the court found that “[n]owhere does Jackson Hewitt allege a harm associated with consuming H&R Block's services”. While the allegations stated a claim under the Lanham Act, the court dismissed the New Jersey CPA claim because that statute remedies “consumer fraud,” not competitive injuries.

This is the outcome, even though the advertising at issue actually was directed to consumers, and, if the advertising is false, consumers could bring a separate lawsuit for the same conduct. But not in this lawsuit. The court concluded that “Jackson Hewitt has brought this lawsuit as a competitor of H&R Block, not a consumer of its services, and therefore cannot avail itself of the [consumer protection] Act.” This will not be the result in all competitor cases because some state CPA statutes also reach competition injuries.

- Randy Miller

Inside Scoop on the Consumer Financial Protection Bureau - Members of the Implementation Team Speak

The Women in Housing and Finance (WHF) hosted a panel last week with two key members of the Consumer Financial Protection Bureau’s (CFPB’s) implementation team, Peggy Twohig and Steve Antonakes.Twohig, formerly the Treasury Department’s Director of the Office of Consumer Protection, is the Assistant Director for Non-Bank Supervision. Antonakes, who has served as the Massachusetts Banking Commissioner for the past seven years before joining the CFPB, is the Assistant Director for Large Bank Supervision.

As the date of enforcement authority (July 21, 2011) quickly approaches, Twohig stated in the opening remarks that the CFPB’s implementation team has focused on organizational efforts to translate the agency’s mission statement into a functioning organization. The agency currently has 570 employees and has already brought in a number leaders for its operational units. For instance, one of the more recent additions was the appointment of Gail Hillebrand, formerly a senior attorney with Consumers Union, as the Associate Director of Consumer Education and Engagement.

The two panelists shared remarks about their current initiatives in their specific groups. Antonakes stated that his activities fall into two main buckets. First, he and his team are educating themselves on the 110 financial institutions that fall under the purview of the Large Bank Supervision unit. These institutions have approximately $10 trillion in assets and represent 80 to 90 percent of the total bank assets in the United States. In order to learn more about these institutions, his group has entered into information-sharing agreements with other state and federal regulators and stressed that his group will continue to work closely with these regulators in sharing information. The education efforts will help determine the scope of examinations, as most of the 110 institutions will be subject to point-in-time supervision, while the largest institutions will be subject to continuous supervision (similar to the resident examination programs of other federal agencies). The second initiative involves the recruitment of examiners. Antonakes plans to recruit from two sources: transferees from existing agencies, and external recruiting of entry-level examiners, including candidates with previous financial services experience. The challenge will be to train these examiners in the short period of time before the CFPB launches.

Twohig then shared that the main challenge facing the Non-Bank Supervision group is determining which entities are to be regulated. Non-bank entities, including mortgage lenders, mortgage servicers, student lenders, payday lenders, credit bureaus, and debt collectors, will definitely be supervised by the group. Other types of entities to be regulated will be defined through the rulemaking process. Twohig indicated that they are consulting with trade associations to define what types of industries are to be regulated. An entity that does not fall under the statute can still be examined if the group receives information that the entity is selling a financial product that is posing a risk to consumers. Twohig called this exception the “risk catchall provision.” The most important factor in initiating an examination is the risk posed to consumers. The group will then consider asset size and the extent to which existing state laws already regulate the entity. The group will initially focus on larger firms for examination. Twohig also discussed how the group will interact with state regulators. The group has entered into information-sharing agreements with state regulators in order to develop a common standard for examination of non-banking entities. Twohig sees the group augmenting a state’s role in regulation in non-banking entities. In areas where there is no state regulation, there is likely more risk to consumers and thus, more authority for the non-banking supervision group to act.

Antonakes and Twohig then opened the floor for questions, many of which focused on the examination process. One question posed asked was what extent would the CFPB interfere with prudential federal regulators’ safety and soundness exams. Antonakes stated that there is a statutory obligation to coordinate with prudential federal regulators to avoid any overlap. He anticipates robust information sharing and coordination so that there will be no duplicative information requests. Another question asked was whether information provided to CFPB examiners will receive similar privileged treatment as it does with other prudential regulator examinations. Antonakes responded that the examination process will likely be similar to what has been done in the past, but that procedures are still being worked out. Another question was raised about whether fees will be assessed for examinations, and the panelists stated that they believed the necessary funding would be provided so that fees would not be necessary. Finally, there was a question as to whether there would be a problem if no director is named for the CFPB before July 21. Twohig had no answer, but Antonakes believes that the Large Bank Supervision unit will be able to function without CFPB having a director.

While there is still much work to be done in defining the scope and procedures of the examinations before the July 21 rollout date, the two common themes from the panelists were: that the primary focus of CFPB examinations will be on consumer risk and that significant efforts will be made to ensure that examinations do not overlap with existing federal and state regulations.

- Chester Choi and Amy Mudge

Obama Nominates Leibowitz for New Term as FTC Chairman

Last week, President Obama announced his intention to nominate Jon Leibowitz for a second term as chairman of the Federal Trade Commission (FTC). The announcement likely signals a continuation of the rigorous consumer protection and antitrust enforcement that we have seen from the FTC under his leadership.

The FTC is an independent agency and, as such, operates differently than many other US agencies. It is headed by five commissioners who are nominated by the President and confirmed by the Senate to serve staggered seven year terms. No more than three sitting commissioners may belong to the same political party. The current Republican commissioners are William E. Kovacic and J. Thomas Rosch, whose terms expire on September 25th of 2011 and 2012, respectively, and the current Democrats are Edith Ramirez and Julie Brill, whose terms expire on September 25th of 2015 and 2016, respectively. Commissioner Leibowitz originally was appointed by former President George W. Bush in 2005 when a democratic seat became vacant. The President selects one commissioner to serve as chairman. The Chairman names the directors of the FTC's bureaus, including the Consumer Protective Bureau.

Since being appointed Chairman in 2009, Leibowitz has tackled a number of high profile consumer protection issues. For example, in the wake of the financial crisis, Leibowitz urged Congress to expand the FTC’s rulemaking and enforcement powers to more effectively target financial fraud. Though such legislation was never enacted, the FTC persisted in its consumer financial protection efforts by bringing dozens of lawsuits against debt relief and credit repair scams, issuing a rule prohibiting the use of advance fees and false claims by mortgage relief companies, and proposing a rule banning deceptive mortgage advertising.

Leibowitz has also led the FTC’s aggressive consumer privacy agenda. He has encouraged robust enforcement against companies that fail to protect consumers’ personal information, including treating the failure to maintain reasonable security as an “unfair” practice that violates the FTC Act. In addition, under his chairmanship, the agency has issued revised behavioral advertising self-regulatory principles, brought eight new actions against the use of harassing “robocalls,” and shut down a rogue ISP that helped distribute illegal spam and child pornography (this action temporarily decreased worldwide spam by thirty percent).

Going forward, we expect to see clearer and broader guidance with respect to behavioral advertising, where Leibowitz feels there is “still work to be done.” Likewise, although the Consumer Financial Protection Bureau now has primary regulatory authority over consumer financial products, the FTC will likely remain active in this area, as Leibowitz is determined to weed out corrupt foreclosure consultants, debt collectors, and payday lenders. He foresees the two agencies working collaboratively to meet these goals. Finally, we expect to see more high profile deceptive advertising cases, larger settlements, and an increased willingness by the FTC to take matters to court. All-in-all, expect a bumpy ride for companies who previously may have been able to stay under the radar. Leibowitz's consumer protection agenda is aggressive, ramped up, and, assuming no unexpected bumps in the process of extending his term, well on track.

- Amy Mudge and Anita Kalra

Watch Your End User: FTC Goes After Credit Reporting Agencies for Failing to Monitor Their Clients’ Security Protocols

The Federal Trade Commission (FTC) recently reached a settlement with three credit reporting agencies, SettlementOne, ACRAnet, and Statewide Credit Services. These companies (respondents) have contracted to received credit reports and their accompanying bits of sensitive information from the three major consumer reporting agencies, Equifax, Experian, and TransUnion. With this information, the respondents create “trimerge reports” that can be accessed by the respondents’ clients via a user name and password to assess the credit worthiness of individuals seeking credit. The essential issue, according to the FTC, was that these companies had failed to monitor the security protocols of their clients, resulting in a situation where hackers were able to breach clients’ systems in order to access sensitive information on approximately 1,800 consumers.

Data security has become a major issue to the Commission given the impact of identity theft and other data crime. The FTC’s latest report on the matter estimates that 8.3 million Americans were victims of identity theft in 2005. Aside from the financial harm, which the Report estimated at $15.6 billion, consumers also face lingering issues, such as problems obtaining additional lines of credit or new loans, unpleasant dealings with collection agencies, and hours upon hours of lost time trying to restore their financial and data security.

The FTC’s Complaints against the respondents (SettlementOne, ACRAnet, Statewide Credit Services) and affiliated entities alleged violations of the Gramm-Leach-Bliley Act Safeguards Rule, Fair Credit Reporting Act (FCRA), and Section 5 of the FTC Act by, among other things, (1) neglecting to create and articulate security policies for end users to follow; (2) not establishing and maintaining adequate security protocols; (3) failing to ensure that the end users of their products would properly protect sensitive information; (4) failing to provide training on security measures to end users; (5) not creating a system to monitor end users’ access of trimerge reports (including odd patterns or suspicious viewing); and (6) not remedying security issues even after known breaches.

The FTC alleged that, because of these failures, the respondents had allowed their clients to access reports without ensuring that they had “basic security measures in place, such as firewalls and updated antivirus software.” The FTC further asserted that after the alleged data breaches occurred, the respondents did not take reasonable steps to find out the causes of the breaches or to ensure that such breaches would not occur again in the future. Altogether, the crux of the FTC’s allegations was that the reporting agencies had failed to take “reasonable and appropriate measures” in maintaining the confidentiality and security of sensitive information by failing to ensure that only persons with—in the words of the FCRA—a “permissible purpose[ ]” would receive third-parties’ credit reports (i.e., that unauthorized persons could not access such information), and that the reporting agencies’ actions thereby threatened to cause or caused substantial injury to consumers.

In the Consent Orders (SettlementOne, ACRAnet, Statewide Credit Services), each respondent agreed to implement “comprehensive information security program[s]” that would protect the security of confidential information contained in the trimerge reports. Each signed off on having a key employee to oversee the program and to updating the program regularly to keep up with ongoing security needs. To ensure compliance with these terms, the respondents agreed to undergo assessments by independent parties, with assessment reports to be submitted to the FTC for the next 20 years. These assessment reports must certify the adequacy of the safeguards the respondents have in place as well as that the respondents’ information protection systems are working properly.

Separate from the final agreement, Commissioner Brill issued a statement — which was joined by Chairman Leibowitz and Commissioners Rosch and Ramirez — indicating that, in the future, these Commissioners “will call for imposition of civil penalties against resellers of consumer reports” who do not go to the appropriate lengths to protect the sensitive information contained in these reports. It seems that the Commission was not willing to go that far in this case, with Commissioner Brill’s statement recognizing that this was the first instance in which the FTC had held credit reporting agencies responsible for the data-protection failures of their clients. While the respondents did not bear the full burden of the FTC’s potential enforcement mechanisms, this case makes clear that information brokers should scrutinize the information security policies of their clients and should at all times be as knowledgeable as possible regarding the security and confidentiality measures their clients are taking.

- Ronald Lee, Nancy Perkins, and Michael Thorpe

CFPB Moving into the Sunshine; Clouds Remain

Last week, the new Consumer Financial Protection Bureau (CFPB) moved out of the shadows and more into the sunshine, by releasing a letter to Rep. Randy Neugebaurer summarizing its organization, budget and goals and by launching a website listing its priorities.

The letter to Rep. Neugebaurer, who chairs the Oversight subcommittee of the House Financial Services Committee, responds to his letter of January 18, which asked for additional information on the Bureau. Released on Monday, the letter gives some details on the Bureau’s expected structure. As the letter notes, the Bureau is expected to have six divisions: consumer engagement and education, supervision and enforcement, research markets and regulations, legal matters general counsel, external affairs, and the organization's own internal operations. These divisions mirror the responsibilities given to the Bureau by the Dodd Frank Wall Street Reform and Consumer Protection Act.

The letter emphasizes that the structure is designed to meet what it sees as its mission, which, among other things is: (1) to engage with consumers in everything it does; (2) enforce consumer financial laws efficiently and effectively ; (3) create a level playing field between large banks, other financial institutions and non-bank providers of consumer products; (4) advance financial education; and (5) make the Bureau a data-driven agency by having research and market analysis become a core to all of its work.

These details are also reflected in the website in a more user friendly format. The site is organized around consumer education and feedback, with various opportunities for user input, complaints and feedback. It also is peppered with YouTube videos and other visual media designed to appeal to a tech-savvy generation.

 

Yet these releases still leaves many questions unanswered. While Elizabeth Warren is meeting with industry representatives and others to assure them that her goal is to streamline regulation and only go after the bad actors, there is still a lot that is undefined and disquieting. The regulation and enforcement areas are particularly undefined. The emphasis on data collection and consumer complaints bring additional fear of regulatory burden and unfounded “gotcha” actions. And the lack of a named, confirmed Director that can issue regulations add to that unease. Much of this is understandable, given that this is a new agency still under construction. It remains to be seen if these fears are eased as the Bureau continues its building activities.

- Beth DeSimone

FTC Chair Forecasts a Business-Friendly Partnership with the Consumer Financial Protection Bureau

Last week, in remarks to the US Chamber of Commerce, Federal Trade Commission (FTC) Chairman Jon Leibowitz sought to defend the Consumer Financial Protection Bureau (CFPB) to one of the CFPB’s primary opponents. Indeed, during the speech, Chairman Leibowitz quipped that the FTC and the CFPB would be so busy focusing on “bottom feeder” companies that the agencies would not have the resources to excessively regulate “legitimate” businesses.

As has been reported previously, The Dodd-Frank Wall Street Reform and Consumer Protection Act created the CFPB to serve as the primary regulatory authority over consumer financial products and nearly every federal consumer financial protection law. The CFPB and the FTC will share regulatory authority over nondepository institutions, and also coordinate enforcement efforts through a negotiated memorandum of understanding - the difference is that the CFPB will have a budget that dwarfs that of the FTC. The CFPB is scheduled to begin its regulatory operations on July 21, 2011, and the President, with Senate’s consent, must still appoint a single director to run the agency for a five-year term.

In the speech to the Chamber of Commerce, Chairman Leibowitz acknowledged that the CFPB’s broad power, independent (and large) budget, and enormous staff should cause anxiety within the business community. However, Chairman Leibowitz noted that these fears are unfounded primarily because the Obama Administration has signaled a more pro-business direction following the 2010 mid-term elections.

Actually, the biggest signal of the CFPB’s impact on business will likely occur when the President nominates the Director of the CFPB. The Director, in conjunction with White House Special Advisor Elizabeth Warren, will set the culture and policies for how the CFPB’s broad authorities will be applied.

Chairman Leibowitz envisioned a regulatory world where the FTC and CFPB will work collaboratively to “weed[] out crooks and scam artists who divert dollars from legitimate businesses.” He would like for the two agencies to focus on “fly-by-night ‘foreclosure consultants’ taking advantage of struggling homeowners, debt collectors engaged in illegal harassment, and payday lenders failing to disclose outrageous fees.” Given those priorities, he remarked that the remaining “legitimate” businesses should be subject to limited regulatory burden. The future will show whether Chairman Leibowitz’s more powerful, and yet to be determined counterpart at the CFPB will share this regulatory vision.

- Beth DeSimone and Brian Larkin

Paying for Coffee with an App is New; Consumer Protection Laws are Not

Starbucks announced last week with some fanfare that it now will let customers pay for their coffee with their BlackBerry or iPhone if it has the Starbucks Card Mobile App (see here).

How does this app work? According to Starbucks, the app is “a complement to your plastic card.” Thus, you still have to get a plastic Starbucks Gift Card, which has been around for years. What the app does is display a barcode on your smartphone. The barcode is linked to the Starbucks Card number, so when it is scanned, money can be deducted from the Starbucks Card to pay for the purchase. Starbucks may be the first major chain of coffee shops in the US to offer this type of app, but it would seem that other retailers could easily follow suit if customers like it.

And what’s not to like? Whether you use a retailer-issued plastic card or a barcode linked to that card to pay for your purchases, the applicable consumer financial protection laws are the same (and they are very limited). A retailer-issued card like the Starbucks Card does not work like a bank debit card. In fact, it is not linked to any account at any financial institutions, and most of the traditional disclosure requirements and other restrictions of the Electronic Fund Transfer Act and Regulation E do not apply. Also, if no fees are charged for the issuance or use of the card and the card has no expiration date, as in the case of the Starbucks Card, the gift card disclosure requirements added to the EFTA by the CARD Act of 2009 would not apply, either.

Nevertheless, debiting a customer’s bank account in order to load value onto the customer’s card would be subject to Regulation E, which means the retailer must obtain the customer’s authorization properly to do so (through the swipe of a debit card or otherwise). Alternatively, using a credit card to load funds onto the card would be subject to the protections of Regulation Z. From the consumer’s perspective, the important thing to remember is that, when you lose a retailer-issued card like the Starbucks Card or the smartphone that carries the corresponding barcode, it is no different than losing cash, unless you call the retailer immediately and you have registered the card with the retailer. If you hadn’t registered the card, the retailer would not be able to identify the card you lost. In contrast, when your bank debit card gets lost and someone else uses it, your loss is limited to $50 by law, assuming that you provide timely notice.

But while the protection is limited, the convenience of using the app may turn out to be too tempting. Modern society likely could function without nutrients (which is not a synonym for food or coffee) for a moment; but could it without BlackBerries or iPhones - or coffee?

- Beth DeSimone and Harry Wu