The Lead Generation Company: Managing the Risks

Jonathan Foxx

President & Managing Director

Generating leads is an important way to reach consumers. It is also fraught with regulatory risk. A lead is consumer information that signals consumer interest or inquiry into products or services offered by a business, such as residential mortgage lenders and originators. There are several factors to be considered, not just licensing. I will list some rudimentary guidelines in this article, specifically with respect to contact with the consumer. Caution is urged to consult with a risk management professional to ensure compliance with federal and state guidelines required by a marketing campaign to generate leads. Although my focus is primarily on the online lead generation process, virtually all the guidelines provided herein may be extrapolated for use in offline lead generation campaigns.

My firm often is requested by clients to vet a lead generator, which I will call a Lead Generation Company. Careful risk management advice should be considered when developing and managing leads, whether obtained from an outsourced entity or a loan originator’s own website, in-house, or through online lead generation advertisements. Certainly, any loan originator that uses leads must have an internal compliance function that accounts for proper licensing of the Lead Generation Company (where required), monitoring of the data integrity derived therefrom, testing conformance with the originator’s policies, and training of staff in the appropriate use of lead generated, consumer data.

Banking departments these days are not just looking at licensing qua licensing. They are looking for loan originator compensation violations that are triggered by lead generation. For instance, they know that loans may have different cost structures depending on how the loans were initially received by the lender. A lead generated by the loan originator may be compensated differently than those generated by the creditor. As long as this doesn’t constitute a proxy for a loan term or condition, it is generally acceptable; that is, the loan officer may also be reimbursed for lead generation and other legitimate business costs, but the creditor must beware of how this may serve as a proxy for terms and conditions. It is up to the lender to make this determination (and properly document it).

Four Rules

In any lead generating marketing, the following four rules should be implemented:

1.     Complete, accessible, and straightforward disclosure of all parties’ intent regarding data collection and usage is essential;

2.     Data should not be brokered or sold without consent (or notice and choice) of all parties involved, including the consumer and the loan originator;

3.     Both the consumer, Lead Generation Company, and the loan originator should be made aware, through clear notices, of all parties involved in data collection and sharing; and,

4.     All parties should be educated and aware of current regulations regarding consumer protection and privacy.

These four rules become the bases of the policies, procedures, contractual arrangements, and protocols that ensure a viable marketing campaign that relies, in whole or in part, on lead generation.

Regulatory Focus

The regulators involved in enforcement of compliance with lead generation rules include, but are not limited to, state banking departments, state Attorneys General, the Federal Trade Commission (“FTC”),[i] and the Consumer Financial Protection Bureau (“Bureau”). We already know that the Bureau examines for whether the lead generator is a third-party provider and reviews the terms and appropriateness of the relationship. The Bureau reviews advertisements and advertising sources. It will review TV, radio, print media, Internet, scripts, recordings, and so forth. It will determine if there was proper consumer disclosure all along the way, from point of contact with the consumer to point of contact with the lender, including any intimation of fees and other terms and conditions. Plus, a review is conducted for online data security and sharing of consumer information.

Although the new loan originator qualification standards do not impose licensing requirements, every lender must ensure that each loan originator in its employ is licensed and registered in compliance with laws related to Secure and Fair Enforcement for Mortgage Licensing Act (SAFE), if applicable. Further, entities engaged in lead generation and marketing activities, as well as the companies that do business with such entities, need to pay particular attention to their activities to ensure that they do not inadvertently engage in loan originator activity. If they do, they’ll need to make sure that they meet the new loan originator qualification standards, including licensing requirements. Failure to meet these standards will give rise to severe civil liability that could impair the collectability of the loan.

The Bureau has stated that anytime a consumer gives out sensitive personal and financial information on the Internet there are risks involved to the consumer. In the context of Pay Day Loans, for instance, the Bureau has already warned consumers that if a consumer applies for a loan online, the consumer could be increasing risk significantly.

The Bureau has expressed concern that an online application or form that consumers fill out could be sold to a loan originator that offers to originate a loan on behalf of the consumer. Indeed, the Bureau also has indicated it has concerns that multiple lenders or other settlement service providers could pay for this information, thereby causing them to contact or email the consumer.

Consumer Advocacy

In a November 11, 2013 announcement to consumers, the Bureau stated, “Lead generators might not find you the lowest cost loans, and you should be cautious of sites that promise they will. Many consumers can also be confused about who actually made the loan, which makes getting help when you need it harder.”[ii] In addition, the Bureau has provided caution regarding key words, tags, and tactics.

Importantly, the Bureau’s view toward the Pay Day lead generator should be applied to residential mortgage lenders and originators that purchase leads from a Lead Generation company. Here’s the point: the Bureau has clearly issued an answer to the question, "What is the difference between an online payday lender and one with a storefront?" Its answer was that consumers need to make sure the online website is licensed to do business in the consumer's state and whether the lead generator follows the state's [payday] lending laws. Consider it a warning to all residential loan originators!

Therefore, when the Bureau starts looking at online lead generation involving residential mortgage loans, it is somewhat certain that it applies an even stricter standard to the Lead Generation Company that solicits mortgage information or a mortgage conversation from consumers and sells it or even passes it on to a loan originator. Questions that the Bureau would resolve, either by promulgating rules or through enforcement action, will likely be: (1) Is the Lead Generation Company violating the SAFE Act if it is not licensed in the state it is operating in?, and (2) If it is licensed under SAFE will it be violating the broadly defined Loan Officer Compensation Rule?

Lead Generation as Advertising

Depending on the advertising used to find a consumer for a loan originator, the Bureau may deem the communication to be an advertisement to generate a lead by using certain phrases, such as “Let us help you find a mortgage! Call us! Or Click Here for More Information!” If deemed an advertisement, the Bureau will move to the view that such advertising is a solicitation for a mortgage conversation from a consumer. The outcome of that position would likely lead to a violation of SAFE, because most states consider such a solicitation a violation of SAFE even if no payment is made by the lender or loan officer to the Lead Generation Company - because this type of solicitation would trigger a license requirement.

Even if the Lead Generation Company is properly licensed under a particular state's SAFE Act, if it sells that lead to an unlicensed loan originator in that state the Bureau could pursue an action against the Lead Generation Company because it assisted or facilitated a consumer’s information to be sold to an unlicensed entity, pursuant to various third party vendor management bulletins.

Some states already require a Lead Generation Company collecting consumer information to be licensed as "mortgage brokers" such as Arizona and Virginia. The licensing requirement varies from state to state. Referencing Pay Day lenders, most of the Pay Day lenders in Ohio, for example, have become Mortgage Brokers under the SAFE Act as it takes them out of the state usury statute for Pay Day lenders.

Three Concerns

What type of online Lead Generation Company could cause issues of concern?

(1) Unlicensed Lead Generation Company that tells consumers, for instance, whether they are "Qualified for a Loan or Not";

(2) Online Lead Generation Company that collects any sort of non-public personal information data (the definition of what is “NPI” may vary from state to state, but is also federally settled in Gramm-Leach-Bliley, et alia) and fails to inform and obtain the consumers consent that their information will be shared with a third party; and,

(3) Online Lead Generation Company where it has spoken directly with the consumer and then transfers the "Live Handoff" over to the loan originator (especially if the Lead Generation Company is not licensed, where required by state law). If the Lead Generation company acts as a special kind of mortgage broker then it may be best to stay away because this could violate the standards associated with the Loan Officer Qualifying Rule, mentioned above, which became effective on January 1, 2014.

Additionally, please note that the Bureau has broad authority to enforce Fair Lending Laws, the Telemarketing Sales Rule, Mortgage Lending and Regulations, Mortgage Acts and Practices Advertising Rule, and most certainly Unfair, Deceptive and Abusive Acts or Practices (UDAAP).[iii]

Waiting for the CFPB

My sources tell me that the Consumer Financial Protection Bureau (CFPB) will soon announce substantial monetary penalties and other administrative actions against a large nonbank. I guess it is inevitable that when such an announcement is finally out and about, humans  - and especially the financial services type humans - will be easily aroused to panic - which means the nascent, CFPB exam preparation industry will receive a steroidal boost. And the frisson of dismay and frenzy will be stirred up even further by the ambulance chasers, running to the rescue, with their merry band of products and services to quell the indomitable, bureaucratic brute.

There are plenty of compliance and law firms scouring the horizon for new clients that seek CFPB exam readiness. Indeed, I know of one such firm that has made fear-mongering into a fine art, whirring about and speaking at industry events where a surfeit of anxiety and angst may be supremely generated. As the affrighted crowd bounds into the arms of these ushers of deliverance, seeking the aegis of their singular protection, they are quite sold on a full scale risk assessment and sempiternal, on-going monitoring. But the prospective clients, sore at the loss of money in this endeavor, need not be too vexed, inasmuch as they do get action plans, some risk assessment tools, and assorted bric-a-brac of one-size-fits-all templates "specially drafted" for their own unique purposes.

Our industry is a strong bunch, survivors of the toughest real estate cycles, and accustomed to adapting to regulatory mandates. We have seen the largest fall and the lowest rise. We push back, when needed; and we push forward, when appropriate. We know that our industry is the backbone of the economy. Our future will not be compromised by cold sweat and consternation.

So, when considering the legal and regulatory compliance requirements of the CFPB, how alarmed and apprehensive should we be?

_____________________________________________________

Trembling before the Tsar

In the Tsardom of Russia, most people never met the Tsar. They met his agents, which at the time meant the duly constituted orders of functionaries who acted in accordance with the law. The people who did meet the Tsar, even nobles, were known (and even expected) to tremble in his presence. Like the custom required by English kings, the people who stood in the presence of the Tsar stated their views, when called upon to speak, and, upon finishing their statements, they left the reception chamber by bowing and slowly backing out of the room, always facing the Tsar. This kind of obeisance showed respect for the established order and reflected the insuperable power and primacy of the monarchy.

But we do not live in a monarchy and the CFPB is not the Tsar.

We need not tremble before the CFPB!

There are a set of guidelines that the CFPB requires for implementation by lenders, mortgage brokers, servicers, and others in the financial services sector. Most of these guidelines are not particularly ponderous, unless the foregoing entities hadn't been implementing them all along. It is not as if we do not know the importance of fair lending or proper data collection pursuant to the Home Mortgage Disclosure Act (HMDA). There is no real mystery regarding compliance with advertising rules. Every company is keenly aware of the mandates set forth in the Real Estate Settlement Procedures Act (RESPA) and the Truth in Lending Act (TILA).

At this point in the industry's growth, who does not know about the importance of risk controls and risk mitigation? Who does not know about the central importance of responsible and knowledgeable management? How many companies willfully ignore consumer complaints?

A whole generation of bankers, lenders, brokers, and servicers have cultivated a heightened sensitivity to the Fair Credit Reporting Act (FCRA) and Fair & Accurate Credit Transaction Act (FACTA), Gramm-Leach-Bliley Act (GLBA), Bank Secrecy Act and Anti-Money Laundering Program requirements, Equal Credit Opportunity Act (Regulation B), Home Ownership & Equity Protection Act (HOEPA), Secure & Fair Enforcement for Mortgage Licensing Act (SAFE Act), the Fair Housing Act, the Anti-Predatory Lending Act, the National Do-Not-Call Registry, and monitoring third party service providers (sometimes neutrally referred to as "vendor management").

These are the sorts of areas about which the CFPB has an interest in ensuring consumer financial protection. None of the aforementioned is strange or new to anybody who has been paying attention!

I have said many times that 'Preparation is Protection' - and most companies associated with residential mortgage loan originations and servicing have been preparing, thus protecting themselves, for a long, long time. Many have been through numerous state and federal banking examinations, responding, where needed, with corrective actions. Not a few have retained competent mortgage risk management firms or in-house compliance advisors. Even those who cannot afford compliance counsel have participated in one way or another in conferences, conventions, and training venues in order to be educated in regulatory developments. Everybody now knows unequivocally that sales are cemented to compliance.

_____________________________________________________

Who's afraid of the big bad wolf?

As I wrote recently, the CFPB has considerable enforcement powers. Among other things, it can rescind or reform contracts, require the refunding of money to a consumer and demand other forms of restitution, mandate the disgorgement and refunding of various types of assets, compel the return of real property, cause fees and other compensation to be disgorged for unjust enrichment, require the payment of damages or other monetary relief, cause public notification regarding a violation, limit the activities or functions of alleged violators, and, of course, exact civil monetary penalties.

But, in terms of the remedies mentioned above, none of these administrative actions is really new. Virtually every state banking department in the country has most of these enforcement powers. Nearly all prudential regulators have many such authorities. Banks and nonbanks that have undergone routine examinations are not an unsuspecting lot, completely unprepared for the kinds of detailed review that the CFPB conducts. Having watched the CFPB in action, I can say that a firm that is adequately prepared for a state or federal examination should be prepared for a CFPB examination.

Is the CFPB's examination a bit more detailed? Yes. But most of the exam requirements are re-treads or the kinds of state and federal banking information and documentation requests or guidelines that are mostly customary and pro forma.

CFPB: Compliance Management System

On October 31, 2012, the CFPB issued its first issue of Supervisory Highlights: Fall 2012, a newsletter to the public and the financial services industry about its examination program, including the concerns that it finds during the course of its completed work, and the remedies that it has obtained for consumers who have suffered financial or other harm.

It is written as an Executive Summary, and it will not refer to any specific institution. But it will "signal to all institutions the kinds of activities that should be carefully scrutinized for compliance with the law."

According to the CFPB, it has already taken non-public supervisory actions against financial institutions participating in the credit card, credit reporting, and mortgage markets, confirming "remedial relief" to 1.4 million consumers, and causing the affected financial institutions to correct illegal practices. Importantly, and in consequence to the CFPB's examinations and actions, financial institutions were required to adopt effective policies and procedures to ensure that violations do not recur and, especially, mandating that they implement a robust Compliance Management System (CMS). 

The CFPB maintains that an effective CMS is a "critical component of a well-run financial institution."

After a brief discussion about the CMS concept, I should like to outline these three significant findings derived from the CFPB's examinations:

- Comprehensive CMS Deficiencies Found Through CFPB Supervisory Activities

- Deficiencies Related to Failure to Oversee Affiliate and Third-party Service Providers

- Deficient Fair Lending Compliance Programs

___________________________________________________

IN THIS ARTICLE

Compliance Management System

Comprehensive CMS Deficiencies

Failure to Oversee Affiliate and Third-party Service Providers

Deficient Fair Lending Compliance Programs

Library

___________________________________________________

Compliance Management Systems

I consider the term Compliance Management System to be a proxy for the term mortgage risk management. Our firm was founded on the premise that such risk management was the best way to ensure a financial institution's safety and soundness with respect to mortgage banking. At the time, there was only the term "risk management", a catch-all term that was overly broad. So I coined the term "mortgage risk management" to bring mortgage compliance into greater focus, expertise, and application.

Over the years, the prudential regulators and state banking departments have included much guidance in preparedness for their mortgage banking examinations. And now the CFPB has further elaborated the crucial and central importance of managing risk and examination readiness. As recently as July 2012, I published a magazine article about The Rules of Operational Risk, in order to bring into strong relief the practical matters and unique circumstances of mortgage risk management.

The CFPB's conception of a well-conceived CMS is certainly consistent with the foundational features of mortgage risk management.

Both the CFPB and mortgage risk management require effective internal controls and oversight, training, internal monitoring, consumer complaint response, independent testing and audit, third-party service provider oversight, recordkeeping, product development and business acquisition, and marketing practices.

Mortgage risk management and the CMS both expect the development, maintenance, and integration of mortgage compliance practices across a financial institution's framework and applied to its entire loan product and service lifecycle.

As the CFPB states:

"Without such a system, serious and systemic violations of Federal consumer financial law are likely to occur. Further, a financial institution with a deficient CMS may be unable to detect its own violations. As a result, it will be unaware of resulting harm to consumers, and will be unable to adequately address consumer complaints."

__________________________

Comprehensive CMS Deficiencies

The CFPB has issued findings for financial institutions lacking an effective CMS across the entire consumer financial portfolio, or in which the company failed to adopt and follow comprehensive internal policies and procedures. In these instances, the finding held that this condition resulted in "a significant breakdown in compliance and numerous violations of Federal consumer financial law."

The corrective action required an adopting of appropriate policies and procedures, and establishing an effective CMS to ensure legal compliance, which had to include the "enhancement" of financial institutional regulatory knowledge and expertise to help ensure proper monitoring of business activities and prompt identification of potential risks to consumers.

In this regards, educating about and training employees in a company's policies and procedures should be fully implemented and routinely followed. I suggest a schedule of on-going education and training modules, given to both new hires and all active, affected personnel.

Keep in mind that the CFPB will exam not only the policies and procedures and their communication to employees but also management's inclination to be proactive or passive, preemptive or complacent, knowledgeable or disinterested. According to the CFPB, a financial institution’s CMS is “inadequate” where appropriate policies have been adopted, but management fails to take measures to ensure compliance with those policies.

In a typical CMS examination, the CFPB evaluates both the understanding and application of the financial institutions’ compliance management program by its managers and employees. The CFPB has stated that it has found "one or more situations in which the financial institution had articulated many elements of an appropriate compliance policy, but the policy was not followed."