Guilty Until Proven Innocent?

QUESTION 

I am the Chief Executive Officer of a lender and servicer. Last week, the CFPB hit us with a Civil Investigative Demand. Our in-house lawyer has put a team together from various departments to respond to it. And you kindly referred us to an attorney who specializes in this process. We are retaining the attorney you recommended. 

At this point, many people in the company are aware that we received the Civil Investigative Demand, and I am very concerned about reputation risk. We have built a fantastic company, yet rumors have already started that we did something to violate laws and regulations. I need a way to calm everyone down and not worry. 

Because of the rumors, some employees now think we are guilty of wrongdoing. We intend to fight any such charges! I need to issue a statement that explains the process in plain and simple language. I need your help in providing information that helps them to understand the process. 

What is the CFPB’s Civil Investigative Demand? 

Are we guilty until proven innocent? 

COMPLIANCE SOLUTION 

CMS Tune-up®  

RESPONSE 

Rumour doth double, like the voice and echo,

The numbers of the feared.

Henry IV, Part 2, Shakespeare 

Allow me to put the above lines into our modern idiom: An unconfirmed report expands like an echo growing louder and louder, magnifying the perceived size and threat. 

DO NOT IGNORE THE RUMORS! 

Perhaps you think that the truth will reduce the rumors. Sometimes, it does; sometimes, it does not. One of my favorite literary figures, Jonathan Swift, once said that “falsehood flies, and the truth comes limping after it.” He cautioned that by the time people become “undeceived,” the “jest” is over, and the “tale” has already had its effect.  

Reputation risk is real, and adverse issues can hobble a company financially, even when there’s nothing to the allegations of wrongdoing. Some rumors don’t have a scintilla of truth, but they thrive nonetheless. Like a garden of weeds, pull out one, and another takes its place. Your aim should be to control the message. However, do not ignore rumors! 

PEEKING BENEATH THE CFPB HOOD 

I am going to give you a peek into the CFPB’s Civil Investigative Demand process. The acronym is “CID,” and for brevity, I will use this acronym. If you’re wondering if the CFPB has coopted the authority to conduct CIDs, you might be interested in knowing that it certainly does have the authority pursuant to the Dodd-Frank Act.[i] A primary access point to the authority is Unfair, Deceptive, or Abusive Acts or Practices (UDAAP),[ii] which

 “…take any action . . . to prevent a covered person or service provider from committing or engaging in an unfair, deceptive, or abusive act or practice under Federal law in connection with any transaction with a consumer for a consumer financial product or service, or the offering of a consumer financial product or service…”[iii] 

Most CIDs are triggered by CFPB examination. However, the examination is not the only source of the CID. I’ll get back to examinations momentarily. 

NON-EXAMINATION SOURCES OF CIDs 

Other sources can trigger a CID, many of them being external to the company itself. For instance, the Office of Enforcement monitors the CFPB’s Consumer Complaint Database for potential violations.[iv]

The CFPB also sources allegations of violations from its Whistleblower and Tips portal. 

In addition, states and federal agencies may send referrals relating to possible breaches of regulations. 

News reports and even Better Business Bureau complaints can lead to activating a CID. 

Unfortunately, a company may have no idea that it has come to the attention of the CFPB’s enforcement investigation team until the CID is actually issued. Often, the company is surprised by the CID. Indeed, it may have no idea of the alleged violations. Put otherwise, the first a company learns of an investigation is usually when it gets the CID.[v] 

TRIPARTITE TEAM 

Such enforcement puts huge pressure on a company. One reason for the pressure is that there is an unyielding timeline for document production and appropriate responses.[vi] This is the reason why I referred you to an attorney who is steeped in handling the CID process. 

You must retain a lawyer who is capable of vetting relevant information, identifying witnesses and knowledgeable people in the company, and determining the legal violations implicated in the investigation. Importantly, the attorney must ensure compliance with the CID while also advising the company of any legal and factual risks. The appropriate legal counsel should be experienced in understanding UDAAP (for instance, the “unfair” and “deceptive” prongs), including, but not limited to, public consent orders, CFPB administrative adjudications, district court opinions, the CFPB examination manual, published guidance, and relevant CFPB policy statements. 

I have often said that the best tactical response to a CID is to establish a Tripartite Team, as follows: