Recent Posts

October 18, 2018
September 17, 2018
September 13, 2018
September 12, 2018
September 5, 2018
August 30, 2018
August 28, 2018

Managing Investigations from the Consumer Financial Protection Bureau

Disclaimer: This article is intended for informational purposes only and is not intend to be legal or professional advice. You should not act or rely on information in this article without first seeking the advice of an attorney.

The Consumer Financial Protection Bureau (CFPB or Bureau) markets itself as the federal government’s new “cop on the beat to patrol the consumer financial services markets.” Since even its marketing scheme evokes a strict law-and-order regime, it should come as no surprise that the Bureau is approaching the markets it regulates with an “enforcement-first” attitude, and private sector schools are in the line of fire as evidenced by the Bureau’s recent lawsuit against ITT Educational Ser vices. But no CFPB lawsuit proceeds without some formal factgathering beforehand, and the ITT matter almost certainly began with the Bureau’s primary investigatory tool, the Civil Investigative Demand (CID).

As the CFPB turns its attention to private sector schools, many may see a CID firsthand. How likely is it that you could be the lucky recipient of a CID? Consider the following. The CFPB’s budget is roughly $583.4 million for FY 2014. The Supervision, Enforcement and Fair Lending Division, the part of the CFPB that issues CIDs and conducts enforcement actions, has a budget of nearly $165.3 million, nearly 30 percent of the Bureau’s entire budget. In addition, the $165.3 million figure represents a tremendous increase from the $105.5 million budgeted for the same division in FY 2013. In short, the Bureau’s increase budget likely means more CIDs in the future.

No CFPB lawsuit proceeds without some formal factgathering beforehand, and the ITT matter almost certainly began with the Bureau’s primary investigatory tool, the Civil Investigative Demand (CID).

 

What Does Receiving a CID Mean for My School?

A CID is how the CFPB begins a formal investigation. For recipients, it means the Bureau has taken the first step in its ultimate goal of initiating an enforcement action (lawsuit) and/or entering into a settlement agreement. Either a settlement or an enforcement action will typically require the recipient to change its business practices and to pay a penalty, which can vary greatly in terms of magnitude. In some cases, the CFPB has conducted its investigation without pursuing a formal enforcement action against the recipient of a CID. In most cases, however, a CID typically ends with a lawsuit or settlement.

Here are some basic statistics regarding the CFPB’s enforcement actions since it opened its doors. In 21 public settlements (only one case besides the ITT case has not settled), civil money penalties have varied widely. Excluding one case where a defendant in bankruptcy paid a $1 penalty, the penalty amounts have ranged from the low five figures ($34,000 for technical errors in data reporting) to several million dollars ($25,000,000 for “unfair or deceptive” billing practices). The Bureau assessed these civil money penalties in addition to any “restitution,” which can reach into the hundreds of millions of dollars (Bank of America recently paid more than $700 million in restitution to settle claims about its billing practices for certain credit card products). Restitution derives from the alleged harm to consumers as determined by the CFPB. Between civil money penalties, restitution and legal defense fees, resolving a CID can be costly.

Basic Considerations in Responding to a CID

However, before you even consider the monetary amounts that are potentially at stake, you should be aware of the difficulties and procedural hurdles that are involved with responding to a CID. In a word, they can be burdensome. Here are a few practical considerations.

CIDs require you to provide voluminous information. A CID is, in its initial stages, a massive exercise in information gathering for “specifications” that come in one of three forms: (1) Interrogatories; (2) Requests for Documents; and (3) Requests for Written Reports. Each type of specification requires a different sort of information from the recipient. An initial CID can also include a request for oral testimony, but that usually comes at a later stage in the process.

An interrogatory typically requires you to provide a narrative response that describes or explains your business practices. It can also provide what practices the Bureau may be targeting. For private sector educational institutions, CID interrogatories are likely to focus on student loan marketing and servicing, student loans being the “consumer financial product or service” over which the Bureau has jurisdiction.

Thus, expect the Bureau to delve into the way that you market or enroll students in private student loans, the manner in which you disclose the terms of the loan, and if you service loans on your own behalf or enlist others to service loans for you, the manner in which you collect your loans or report delinquencies.

For private sector educational institutions, CID interrogatories are likely to focus on student loan marketing and servicing, student loans being the “consumer financial product or service” over which the Bureau has jurisdiction.

Like its name suggests, a request for documents requires you to produce written material concerning a given topic. Satisfying the CFPB with your responses to their requests for documents will be the most difficult and time-consuming aspect of your response. The CFPB often words its requests for documents in the broadest possible terms. For example, a CID specification may request all documents “related to” the way in which you market your private loans to students. When the Bureau says “related to,” be prepared for a heavy lift to provide a complete response. The CFPB usually wants all emails, meeting notes, and correspondence, basically, any thought committed to writing that references or concerns the given topic. A single request for documents “related to” consumer complaints, for instance, could yield millions of pages of responsive materials.

A written report can also require significant legwork for the CID recipient. Essentially, a request for a written report requires that you provide varying sets of data. For example, the Bureau may request that you compile a table providing data on employment outcomes for your students. It may sound simple enough, but difficulties arise when the Bureau wants you to provide data that is not conveniently available. 

This could result in your needing to create tables or other reports based on information that does not exist in electronic format, requiring you to construct data from a manual review of your files. As you can imagine, a manual review of even a smaller collection of files can be resource intensive.

In addition to the voluminous information the CID requires, the CFPB will also mandate that you produce that information in a specific way.

 

CIDs require you to provide your response in a certain manner. In addition to the voluminous information the CID requires, the CFPB will also mandate that you produce that information in a specific way. The CID’s “Document Submission Standards” (DSS), which accompany a CID, will describe the production format in a very specific way. The DSS specifies everything from the content of your transmittal letter to the acceptable method(s) for encrypting electronic data. The most significant and burdensome aspect of the DSS are the requirements for your electronic documents, or Electronically Stored Information (ESI). Producing ESI will likely require you (specifically your IT department) to work closely with a vendor who can convert your ESI into the format requested by the Bureau. For example, a printed email will not suffice; you must produce the email in “native” format (the original electronic file) accompanied by certain “metadata” that reveals background information about the file.

Many aspects of the CID are negotiable. There is much about the CID that you can negotiate. From the time you receive the initial CID, you have opportunities to negotiate the terms, conditions, and timeline for responding to the CID. The first opportunity to modify the CID is called the “meet and confer” session, which usually occurs within 10 days of receiving the CID. This is an informal session where you can advise the Bureau of specifications that will be particularly burdensome and clarify any vague language. Perhaps most importantly, you can also request extensions of time for your response, since the response time for a CID can be unrealistically short. If you make any requests to modify the terms, conditions, or timing of the CID, be prepared to have a clear rationale for why you seek a modification and suggest modifications that will work for you and still get the Bureau adequate information to meet its needs. This means that you need to realistically estimate your time, effort, and cost to comply with the CID.

Although the Bureau, in my experience, will be reasonable in considering your request, a modification, in particular an extension of time, is not automatic. Thus, you should prioritize what modifications are important to you and plan accordingly for the meet and confer session. If you are unable to secure any agreement from the Bureau regarding modifications during the meet and confer, there is a formal option to submit a written “Petition to Modify or Set Aside” the CID. However, if you decide to file one be prepared for disappointment; the Bureau has denied all petitions that have been filed to date. The better tactic is to secure what modifications you can during the meet and confer session and obtain agreement to revisit certain issues as appropriate. Building goodwill up front helps as you get farther down the road in responding to the CID. Glitches or other bumps in the road almost always arise.

The way in which you respond to a CID matters. While it is technically enough to provide the Bureau with the information it requests through its CID, some proactive conduct on your part may go a long way in reducing any liability you face down the road. The reason for this is that the CFPB issued a bulletin entitled “Responsible Business Conduct” in June 2013.1 According to the bulletin, “a party may proactively self-police for potential violations, promptly self-report to the Bureau when it identifies potential violations, quickly and completely remediate the harm resulting from violations, and affirmatively cooperate with any Bureau investigation above and beyond what is required.” Any of these actions may constitute “responsible conduct” under the terms of the bulletin. Responsible conduct can have real effects on the type and severity of the enforcement action that the Bureau ultimately pursues. In the best scenario, the Bureau would pursue no public enforcement action against you. In other circumstances, the Bureau could pursue “a less severe type of violation, reduce the number of violations pursued, or reduce the sanctions or penalties sought by the Bureau in an enforcement action.”

All of this comes with the caveat that the Bureau is not required to award any credit for responsible conduct. In fact, the bulletin warns that no consistent formula can be applied to all enforcement actions to accomplish the Bureau’s goal of protecting consumers. Despite these warnings, you should evaluate whether it makes strategic sense for you to pursue any of the circumstances that the Bureau would consider to be responsible conduct. In at least one instance, a 2013 case against U.S. Bank for deceptive marketing and lending practices that targeted the military, the Bureau did not assess a CMP where it identified responsible conduct that consisted of proactively altering “problematic aspects” of the program in question and voluntarily providing refunds to consumers that the Bureau claimed had been harmed. In short, the idea here is to identify proactive steps that you can take now so that you can later make the case for your institution’s responsible conduct.

It is also important to keep in mind that responding to a CID, while bearing some similarities to litigation, is a completely different e x e r c i s e t h a n responding to a civil complaint. A CID is a request for information from your federal regulator. As your federal regulator, the CFPB will continue to exercise oversight of the private sector industry on an ongoing basis for years to come. Thus, scorchedearth litigation tactics, even if successful in the short-run, could have unintended consequences in the future.

While it is technically enough to provide the Bureau with the information it requests through its CID, some proactive conduct on your part may go a long way in reducing any liability you face down the road.

The initial CID is only the first step in a long process. Maddeningly, despite the burden and expense required in responding to a CID, your response is only the first step in what is ordinarily a very long process. An initial CID requesting general information may be followed by a second CID that is more specific. Moreover, initial requests for interrogatory responses and documents will be followed by specific requests to hold “investigational hearings.” Think of an investigational hearing as a deposition. There, CFPB lawyers will interview relevant personnel in a formal, on the record, proceeding. However, Bureau rules limit the ability of your attorney to interject or respond during the proceedings. Investigational hearings may be followed by still more requests for additional documents, interrogatory responses, or written reports through supplemental CIDs.

Maddeningly, despite the burden and expense required in responding to a CID, your response is only the first step in what is ordinarily a very long process.

When these information gathering steps conclude, you should expect that the CFPB will provide you with a Notice of Opportunity to Respond and Advise (NORA) through a letter or phone call. The NORA will formally advise you that the CFPB seeks to start an enforcement action against you through filing a lawsuit and it should explain the charges upon which it would base the action. The CFPB will ask that you provide a written response to their NORA charges. After you respond, the CFPB will make a final decision on whether to pursue an enforcement action against you. If the Bureau chooses to proceed, it will attempt to negotiate a settlement with you before filing a lawsuit. As mentioned above, all but two of the Bureau’s enforcement actions have ended in settlements.

Having experienced counsel is highly advised. As should be apparent by the above considerations, it is highly advisable that experienced legal counsel represent you in your dealings with the Bureau. The difference could mean millions; CFPB settlements since it first filed enforcement action in 2012 have routinely settled for seven figures or more. Insurance coverage is not currently available in the marketplace. However, since it can potentially give rise to a claim, schools should seek advice from their brokers related to choosing counsel and notifying appropriate carriers.

 

Originally published in Career Education Review.

 

Download PDF Version

 

Contact Information:

Bruce Denson Jr., President, Cobbs Allen 115 Office Park Drive Birmingham, AL 35223 Phone: 205.874.1212 Email: bruce.denson@cobbsallen.com

Allen Denson Hudson Cook, LLP 1020 19th Street, NW 7th Floor Washington, DC 20036 Phone: 202-223-6930 Email: adenson@hudco.com

This site uses cookies. Some of the cookies we use are essential for parts of the site to operate and have already been set. You may delete and block all cookies from this site, but parts of the site will not work.