Surviving a CFPB Examination and Investigation NCHER 2017 Knowledge Symposium November 7, 2017 Melissa Harris Robert Savoie

Areas of Concern for CFPB Sources: Consumer Complaint database Reports of the Student Loan Ombudsman Supervisory Highlights Recent enforcement actions

Narrative Preparation Your Compliance Management System is the story of your compliance operations Show the CFPB that compliance is part of the day-to-day responsibilities of management and employees

Narrative Preparation Bottom Line A person reviewing your Compliance Management System should walk away confident that you have a thorough understanding of all statutes and regulations applicable to your business, that your company effectively complies with those requirements, and that you treat your customers fairly

Substantive Preparation Substantive preparation is the process of ensuring compliance with the various state and federal consumer finance laws and regulations, including UDAAP requirements

Substantive Preparation Advertising and lead generation Applications and originations Servicing and collections Customer inquiries and complaints Information sharing and privacy UDAAP General statutes (SCRA, etc…)

Substantive Preparation Student loan servicing issues Income driven repayment plans Borrower choice for allocation of payments Communications related to paid-ahead status CFPB standards for servicer competency

Operational Preparations Company awareness Create Initial Response Teams

Operational Preparation Operational preparation is the process of creating the mechanisms and teams necessary to effectively respond to a CFPB audit or CID

Initial Response Teams One team or multiple teams Need to include: Senior management Counsel (inside and outside) Key personnel IT department Outside vendors (e-discovery)

Initial Response Team: Senior Management Responsible for developing the overall response strategy (narrow or modify scope of CID; minimize disruptions) Employs outside counsel Communicates relevant information to other team members Estimates costs of examination

Initial Response Team: Counsel (Inside and Outside) Serves as the point of contact for CFPB negotiations and communications Reviews CID to identify areas of focus (specific product or statute) Reviews documents for responsiveness to CID requests and privilege Assists with preparing written responses to interrogatories

Initial Response Team: Key Personnel Knowledgeable about the organization and records management Identifies or attempts to resolve early issues related to complying with the CID Bridge between the requests in the CID and the organization Can assist with development of search terms for emails and electronic documents

Initial Response Team: IT Identifies location and format of stored information, documents, and data Provides information about data retention policies Can assist in submitting documents to CFPB with required content and format but outside vendor is likely preferable because of complex requirements

IT, Document Submission, and E-Vendors The role of IT is extremely important in retrieving stored documents and data, compiling and/or converting the information and delivering the documents to the CFPB CFPB has complex technological standards for document submission (DOJ) E-discovery vendors can assist in managing, compiling, and transmitting documents to CFPB in the required format

IT, Document Submission and E-Vendors E-vendors can assist in developing search terms and methodologies E-vendors process documents for review on reviewing platforms For large-scale document reviews, e-vendors may have resources to assist with review

Part II: What to Expect During an Examination The Scope and Content of the Civil Investigative Demand Submitting Information to CFPB The Costs of an Examination Time Crunch The Follow-Up and Waiting Game Resolution

Scope and Content of CID Arrives without warning Cover letter from the CFPB It will identify the entity subject to the CID Looks similar to a subpoena and litigation discovery requests

Scope and Content of CID Will generally contain requests for documents and interrogatories May also contain requests for written reports

Scope and Content of CID May arise out of complaints received by CFPB in 2015-16, CFPB handled 5,500 private student loan complaints and 2,300 debt collection complaints related to private and federal student loans, and 3,900 federal student loan servicing complaints.

Scope and Content of CID: Initial Actions Notify appropriate personnel Issue Litigation Hold Prepare for Meet and Confer Review CID to determine types of information and documents requested Determine how to modify/narrow scope of requested information

Scope and Content of CID: Broad Nature Dodd-Frank requires that the recipient of a CID “be advised of the nature of the conduct constituting the alleged violations that are under investigation and the provisions of law applicable to such violations.” 12 C.F.R. § 1080.5

Scope and Content of CID: Broad Nature Example Notice of Purpose of CID: “The purpose of this investigation is to determine whether title lending companies, auto purchase finance companies or other unnamed persons have engaged or are engaging in unlawful acts or practices related to the offering, providing, marketing, underwriting…servicing…collecting debts…and repossessing and/or selling collateral securing title or auto purchase loans in violation of the Dodd-Frank Act, Truth in Lending, Fair Credit Reporting…or any other federal consumer financial law.”

Scope and Content of CID: Broad Nature Example Interrogatory: Describe each instance in which the Company has been investigated, sued, prosecuted, or had action taken against it for alleged violations of Section 8 of the Real Estate Settlement Procedures Act for allegedly unfair or deceptive act or practices or for any other alleged violation of state or federal law, the names of all parties, the jurisdiction involved, the case number, the claims asserted, and the current status and final resolution of the matter.

Scope and Content of CID: Broad Nature Example Production Request: All telephone calls, emails, or instant messages, relating to [Loan Product identified in CID] that were exchanged between: (a) the Company and any Partner Company and (b) those consumers who used a last name beginning with the letters A, M or S.

Scope and Content of CID: Broad Nature Example Written Report: In a delimited text file compatible with Microsoft Access, provide a written report containing the following information for each payment made to the Company by a consumer during [a specified period]: (a) the account number to which the payment relates; (b) the mode used to transmit the payment to the Company (e.g. U.S. mail, ACH, etc.) (c) the date the payment arrived; (d) the date the payment was applied to the consumer’s balance; and (e) the amount of late fees or other fees charged in relation to each payment.

Scope and Content of CID: Broad Nature You may be able to negotiate scope/content of CID during meet-and-confer Examples: definition of “Company” to exclude certain related entities; narrowing of relevant time period Also consider filing petition to modify (although rarely granted)

Scope and Content of CID: Broad Nature Will likely need to craft search terms for emails and electronic documents These will need to be defensible to CFPB if (when) they ask for them Work with IT vendor in creating search terms

Submitting Information to CFPB CID is very specific on how information and documents must be formatted Must follow CFPB Office of Enforcement’s Discovery Requests Document Submission Standards Document identification requirements Privilege log requirements Encryption requirements for material containing sensitive information Media specifications File and document formats

Submitting Information to CFPB Encryption requirements for material containing sensitive information Media specifications File and document formats

Costs of an Examination CFPB’s Estimate: one full-time compliance officer and one-tenth of a full-time attorney for total labor cost of $27,611 The reality is that these costs are much higher

Organizational Costs Time Resources Disruption to daily activities and production Outside counsel and e-vendors Reputational costs if investigation becomes public (enforcement action)

Time Crunch: Meet and Confer First meeting with CFPB (“Meet and Confer”) occurs within 10 calendar days of receiving CID You are responsible for contacting the CFPB within this time period

Time Crunch: Meet and Confer Be prepared to discuss: Scope issues Proposed limitations Deadlines Custodians Issues with obtaining documents

Time Crunch: Meet and Confer After Meet-and-Confer, CFPB will likely issue modification letter This will set forth any new deadlines, changes to CID scope, or other matters discussed during the Meet-and-Confer

Time Crunch: Other Deadlines A petition for an order to modify or set aside a CID must be filed within 20 days of service of a CID Privilege claims must be made by the production return date (or as modified after Meet-and-Confer)

Time Crunch: Production Timing to respond to interrogatories and produce documents and written reports provided in CID, generally 30-60 days Negotiate extended and/or rolling deadlines at Meet and Confer CFPB may be more willing to grant extensions or rolling deadlines if you can demonstrate significant burden with complying under original deadlines

Time Crunch: Production Make sure you factor in time needed by vendors to process production If you anticipate trouble making a deadline, let CFPB know sooner rather than later!

The Follow-Up and Waiting Game After documents are submitted, it is a waiting game CFPB can request additional documents CFPB can request investigational hearings (can be used at any time): testimony generally to seek clarification of procedures and other information from the documents Persons providing testimony must be prepared just as a deposition witness

The Follow-Up and Waiting Game CFPB will notify company of findings and actions (could be up to 1 year or more after originally receiving the CID) Investigation remains confidential during that time (except to extent disclosure required in company’s public filings)

The Follow-Up and Waiting Game Notice of Opportunity to Respond and Advise (“NORA”): company’s chance to explain why CFPB should not take enforcement action for factual, legal, or policy reasons. May be able to convince CFPB, but most investigations that reach this stage result in enforcement action.

Resolution Close of investigation with no enforcement action This is best case scenario but is extremely unlikely

Resolution Enforcement action Complaint and consent judgment/settlement Implement corrective actions Pay required fine to CFPB, restitution to consumers CFPB will publish final enforcement action and issue press release

Supervisory Examination Similar to CID process once it is referred to enforcement Focus is on substance initially Narrative and operational preparation

Supervisory Examination Request Letter Onsite Examiners / OSP Exam Procedures / CMS / Supervisory Highlights PARR/ARC Exam Outcomes Appeal Process Confidentiality

Conclusions Be prepared Take it seriously Expect demanding requests and timeframes Structure your IT and data systems in advance to facilitate efficient disclosure of information

Questions? Melissa Harris Robert Savoie mharris@mcglinchey.com (504) 596-2709 Robert Savoie rsavoie@mcglinchey.com (504) 596-2797