Guilty Until Proven Innocent?

QUESTION 

I am the Chief Executive Officer of a lender and servicer. Last week, the CFPB hit us with a Civil Investigative Demand. Our in-house lawyer has put a team together from various departments to respond to it. And you kindly referred us to an attorney who specializes in this process. We are retaining the attorney you recommended. 

At this point, many people in the company are aware that we received the Civil Investigative Demand, and I am very concerned about reputation risk. We have built a fantastic company, yet rumors have already started that we did something to violate laws and regulations. I need a way to calm everyone down and not worry. 

Because of the rumors, some employees now think we are guilty of wrongdoing. We intend to fight any such charges! I need to issue a statement that explains the process in plain and simple language. I need your help in providing information that helps them to understand the process. 

What is the CFPB’s Civil Investigative Demand? 

Are we guilty until proven innocent? 

COMPLIANCE SOLUTION 

CMS Tune-up®  

RESPONSE 

Rumour doth double, like the voice and echo,

The numbers of the feared.

Henry IV, Part 2, Shakespeare 

Allow me to put the above lines into our modern idiom: An unconfirmed report expands like an echo growing louder and louder, magnifying the perceived size and threat. 

DO NOT IGNORE THE RUMORS! 

Perhaps you think that the truth will reduce the rumors. Sometimes, it does; sometimes, it does not. One of my favorite literary figures, Jonathan Swift, once said that “falsehood flies, and the truth comes limping after it.” He cautioned that by the time people become “undeceived,” the “jest” is over, and the “tale” has already had its effect.  

Reputation risk is real, and adverse issues can hobble a company financially, even when there’s nothing to the allegations of wrongdoing. Some rumors don’t have a scintilla of truth, but they thrive nonetheless. Like a garden of weeds, pull out one, and another takes its place. Your aim should be to control the message. However, do not ignore rumors! 

PEEKING BENEATH THE CFPB HOOD 

I am going to give you a peek into the CFPB’s Civil Investigative Demand process. The acronym is “CID,” and for brevity, I will use this acronym. If you’re wondering if the CFPB has coopted the authority to conduct CIDs, you might be interested in knowing that it certainly does have the authority pursuant to the Dodd-Frank Act.[i] A primary access point to the authority is Unfair, Deceptive, or Abusive Acts or Practices (UDAAP),[ii] which

 “…take any action . . . to prevent a covered person or service provider from committing or engaging in an unfair, deceptive, or abusive act or practice under Federal law in connection with any transaction with a consumer for a consumer financial product or service, or the offering of a consumer financial product or service…”[iii] 

Most CIDs are triggered by CFPB examination. However, the examination is not the only source of the CID. I’ll get back to examinations momentarily. 

NON-EXAMINATION SOURCES OF CIDs 

Other sources can trigger a CID, many of them being external to the company itself. For instance, the Office of Enforcement monitors the CFPB’s Consumer Complaint Database for potential violations.[iv]

The CFPB also sources allegations of violations from its Whistleblower and Tips portal. 

In addition, states and federal agencies may send referrals relating to possible breaches of regulations. 

News reports and even Better Business Bureau complaints can lead to activating a CID. 

Unfortunately, a company may have no idea that it has come to the attention of the CFPB’s enforcement investigation team until the CID is actually issued. Often, the company is surprised by the CID. Indeed, it may have no idea of the alleged violations. Put otherwise, the first a company learns of an investigation is usually when it gets the CID.[v] 

TRIPARTITE TEAM 

Such enforcement puts huge pressure on a company. One reason for the pressure is that there is an unyielding timeline for document production and appropriate responses.[vi] This is the reason why I referred you to an attorney who is steeped in handling the CID process. 

You must retain a lawyer who is capable of vetting relevant information, identifying witnesses and knowledgeable people in the company, and determining the legal violations implicated in the investigation. Importantly, the attorney must ensure compliance with the CID while also advising the company of any legal and factual risks. The appropriate legal counsel should be experienced in understanding UDAAP (for instance, the “unfair” and “deceptive” prongs), including, but not limited to, public consent orders, CFPB administrative adjudications, district court opinions, the CFPB examination manual, published guidance, and relevant CFPB policy statements. 

I have often said that the best tactical response to a CID is to establish a Tripartite Team, as follows:

 

Team 1: Company Management, the subject of the Civil Investigative Demand,

Team 2: Law Firm, the attorney with expertise in handling such matters, and

Team 3: Compliance Firm, the compliance firm that audits and reviews.

 

These three teams collaborate on the three factors that contribute to an acceptable response to the CID:

 

(1) Managing the procedural tasks driven by the CFPB,

(2) Finding the requested information sought by the CFPB, and

(3) Learning about the potential violations under investigation. 

Each one of these teams is essential to meeting the challenge! 

EXAMINATIONS AS SOURCE OF CIDs 

Now, here are a few words about CFPB examinations as a source of Civil Investigative Demands. The Office of Supervision sends a team to the company. The team is generally familiar with the regional financial landscape because there are four geographic regions. The choice of the institution subject to examination is not random inasmuch as it reflects certain priorities that, among other things, are determinative of the Bureau’s selection of which company is selected, which loan products are critical to monitor, and which regulatory concerns manifestly require greater scrutiny. 

If there are potential violations, the CFPB sends a letter called a Potential Action Request (“PARR”). The company must comply with a formal response. Based on the examination, the PARR letter, and the company’s response to the PARR letter, the CFPB decides if a CID should be initiated.[vii] 

And this is why I believe there are only two possibilities for your receiving the CID notice: 

(1) You knew a CID could be coming your way as a result of a CFPB examination because you would have received the PARR letter in advance of a CID (if it were to be issued),

 

or

 

(2) You did not know the CID was coming because of a non-examination source (as described above)! 

Since you did not receive the PARR letter, the source of the CID was a non-examination source (supra), which resulted in an investigation that led to the surprise of getting the CID. Thus, it was your first notice that a potential violation had taken place. 

CIVIL INVESTIGATIVE DEMAND 

Granted, the term “Civil Investigative Demand” is pretty scary. 

No getting around it: the CID is a demanding Demand! 

There are many process rules, and the timeline for response is strict, uncompromising, and virtually non-negotiable. The CID contains a section called the Notification of Purpose, which sets forth alleged violations.[viii] This means that the company is somewhat in a position to determine what statutes, rules, and regulations may have been violated. 

LIEUTENANT COLUMBO 

However, the reason for the investigation is usually slightly vague, deliberately so, because the investigation wants to ensure that it has obtained all relevant information broadly that could shed light on the Bureau’s suspicions. 

Like Lieutenant Columbo, the investigative team obtains documents, materials, tangible things, written reports, answers to questions, evidence, oral testimony, and so forth.[ix] 

Like Lieutenant Columbo coming to a crime scene, the CID warns the company to preserve everything, which means keeping all routine documents, electronic and otherwise. We usually tell our clients to notify all their department heads to preserve records, and we advise that the IT people ensure that such preservation is maintained. 

READY, SET, GO! 

From this point forward, you should have the Tripartite Team ready to go. A CID gives the company ten (10) calendar days[x] from receipt of the CID to meet with the CFPB investigative team. Formally, this is called the Meet and Confer Meeting. 

I recommend having the Tripartite Team ramped up and ready to go at this point. On the call, the Notification of Purpose will need careful vetting, and discussion relating to it should be central to the company’s preparation and compliance requirements. 

The goal of this first call is to: 

(1)   inform that the company intends to cooperate with the Bureau, as appropriate;

 

(2)   elucidate the CFPB’s investigative interest (i.e., the origins of the investigation, if unknown, such as a whistleblower or public complaint);

 

(3)   provide information about the company, its product, the industry, and its policies and procedures;

 

(4)   discuss if there are issues involving the company’s ability to timely comply (i.e., limitation of staff, other resources);

 

(5)   review carefully the timing and sequencing of document production; and

 

(6)   determine point persons for company and CFPB communications 

KNOW YOUR RIGHTS 

It is possible to quash a CID, which means to set aside or void it. It is also possible to modify a CID. Counsel will determine if such a petition to quash or modify is a feasible route. I have spoken to a CEO who thundered that a petition to quash should be filed immediately. It took quite a bit of effort on the part of counsel and myself to talk him off the ledge because, in his case, filing that petition would have been very unwise and detrimental. 

The petition is bracketed by a stringent filing deadline, to wit, twenty (20) calendar days[xi] after serving the CID on the company. And the filing is only available with the caveat that it must have been raised in the first call![xii] In our experience, a petition to quash completely is very rare. It is possible to make modifications, though it doesn’t happen often. It also takes time to get the CFPB’s decision. My suggestion is to proceed in complying with the CID’s requirements and providing documentation and information for those parts of the CID that are not subject to the modification request. Throughout, prepare as if the CID decision will not go in the company’s favor. 

SEQUEL 

There’s so much more to handling a CID. I have only grazed the surface. I took you through a general overview without dragging you down into a deep dive. There is a tremendous amount of expertise, knowledge, experience, and skill involved in responding adequately to a CID. This is a complex, exacting, time-constraining, and often burdensome process. Bring in the experts early. Do not try to go it alone! 

If you have questions, please contact me. I’d like to hear from you! 

You did not ask about how to comply with the CID, how to respond to potential violations, how to plan for the investigation’s conclusion, how to resolve any CID open issues, and the various legal options available toward resolution. 

Perhaps I will offer more feedback about those and other aspects of the Civil Investigative Demand in the future. If you want me to write more on this subject, please let me know. 

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director
Lenders Compliance Group

_______________________________________

[i] Pub. L. 111-203, 124 Stat. 1376 (2010)
[ii] 12 U.S.C. § 5531
[iii] The CFPB may litigate in district court for alleged violations of the CFPB; however, any state may bring a civil action to enforce provisions of the Consumer Financial Protection Act of 2010 (CFPA) provisions. See 12 U.S.C. § 5552(a)(1).
[iv] 12 U.S.C. § 5493(b)(3)(A)
[v] 12 C.F.R. § 1080.6
[vi] 12 C.F.R. § 1080.6(c) & (e)
[vii] See Summer 2015 Supervisory Highlights, § 3.1.4, which describes the Action Review Committee Process.
[viii] 12 C.F.R. § 1080.5
[ix] 12 C.F.R. § 1080.6
[x] 12 C.F.R. § 1080.6(c)
[xi] 12 C.F.R. §1080.6(e)
[xii] 12 C.F.R. § 1080.6 (c)(3)