1. Single-Family Compliance Management Strategies
NCSHA HFA Institute
Washington, D.C.
January 12, 2017

2. Single-Family Compliance Management Strategies NCSHA HFA Institute Washington, D.C. January 12, 2017
Discussion Leader:
Howard Tolley– Utah Housing Corporation
Participants:
Mariam J. Masid – Raplexity Resources, LLC
Drew Page – Kutak Rock LLP

3. CFPB Regulatory Authority
The CFPB enforces “Federal Consumer Financial Law.”
Federal Financial Consumer Law includes 19 different federal statutes and related regulations, including
Truth In Lending Act (“TILA”)
Real Estate Settlement Procedures Act (“RESPA”)
Equal Credit Opportunity Act
Fair Debt Collection Practices Act
See 12 USC 5481(14) and (15).

4. CFPB Supervision & Examination Authority
Four Groups of Supervised Entities
Supervised Banks
Supervised Nonbanks
Service providers to Supervised Banks and Supervised Nonbanks
Service providers to a large number of small insured depository institutions or credit unions
See 12 USC 5514, 5515 and 5516.

5. Is your HFA a Supervised Nonbank?
A Supervised Nonbank is
Any covered person who offers or provides origination, brokerage or servicing of loans secured by real estate for use by consumers primarily for family or household purposes, or loan modifications or foreclosure relief services in connection with such loans.
See 12 USC 5514(a)(1)(A).

6. CFPB Supervision & Examination Authority
Supervised Banks are examined “regularly” and those examinations occur simultaneously with prudential regulators examinations.
Supervised Nonbanks are not examined regularly. They are identified for examination on the basis of the risk they pose to consumers.

7. CFPB’s Purposes for Supervision and Examinations
Assess compliance with Federal Consumer Financial Laws;
Obtain information about activities and compliance systems or procedures; and
Detect and assess risks to consumers and to markets for consumer financial products and services.
CFPB SUPERVISION AND EXAMINATION MANUAL – CFPB Supervision and Examination Process, at pg. Overview 3.

8. Compliance Management System
A Compliance Management System is how a supervised entity:
Establishes its compliance responsibilities;
Communicates those responsibilities to employees;
Ensures that responsibilities for meeting legal requirements and internal policies are incorporated into business processes;
Reviews operations to ensure responsibilities are carried out and legal requirements are met; and
Takes corrective action and updates tools, systems and materials as necessary.
CFPB SUPERVISION AND EXAMINATION MANUAL – Compliance Management Review, at pg. CMR 2.

9. Compliance Management System
“While all of the firms under our jurisdiction must follow the law, we understand that the means that they employ to achieve that goal will – and likely should – differ. We recognize that large, complex entities necessarily have different compliance oversight and management systems than smaller entities or those offering a more limited number of products or services.”
CFPB SUPERVISION AND EXAMINATION MANUAL – CFPB Supervision and Examination Process, at pg. Overview 4.

10. Compliance Management System, cont’d
“CFPB understands that compliance will likely be managed differently by large banking organizations with complex compliance profiles and a wide range of consumer financial products and services at one end of the spectrum, than by entities that may be owned by a single individual and feature a narrow range of financial products and services, at the other end of the spectrum.
CFPB SUPERVISION AND EXAMINATION MANUAL – Compliance Management Review, at pg. CMR 1.

11. Single-Family Compliance Management Strategies NCSHA HFA Institute Washington, D.C. January 12, 2017
Discussion Leader:
Howard Tolley– Utah Housing Corporation
Participants:
Mariam J. Masid – Raplexity Resources, LLC
Drew Page – Kutak Rock LLP

13. Compliance Management Systems
Twelve Steps To A Successful Compliance Management Plan
Raplexity Resources, LLC

14. Subtitle: How do you eat an elephant?

15. What is a Compliance Management System anyway?
It’s How an Entity

16. Establishes its compliance responsibilities;
Communicates those responsibilities to employees;
Ensures that responsibilities for meeting legal requirements and internal policies are incorporated into business processes;
Reviews operations to ensure responsibilities are carried out and legal requirements are met;
Takes corrective action, and
Updates tools, systems, and materials, as necessary.

17. CMS deficiencies in nonbanks are generally related to the supervised entity’s lacking a CMS structure altogether
[CFPB Supervisory Highlights, Summer 2013, p. 6]

18. Step One
Clear written statement that compliance management and oversight is the responsibility of the Board and Management.

19. Board and Leadership Responsibility
The leadership of a supervised entity up to and including the Board should:
Establish a Compliance Function and allocate sufficient resources to that function “commensurate with the entity’s size, organizational complexity, and risk profile” [CFPB Supervisory Highlights, Spring 2013, p.8]
Establish clear lines of accountability
Establish CMP
Provide oversight of CMP

20. Step Two
Identification of those persons, committees or teams responsible for oversight and governance of the CMP.

21. Step Three
Establishment of a reporting structure to make certain that adequate information is provided in a timely manner to those responsible for governance and oversight.

22. Adapt CMS to your business strategy and operations
The CFPB does not require entities to structure their CMS in any particular manner:
Large banking organizations with complex compliance profiles and a wide range of consumer financial products and services will likely manage compliance differently than entities that may be owned by a single individual or feature a narrow range of financial products and services.
Other entities may outsource functions with consumer compliance-related responsibilities to service providers. (CFPB Supervisory Highlights, Summer 2013, p. 5)

23. Step Four
Emphasis on accountability for compliance at all levels of the organization, including employees with day to day business functions as well as the legal and senior management level staff.

24. Step Five
Assign responsibility to persons or departments to draft and adopt policies and procedures, and updates resulting from new or amended laws or regulations.

25. Policies and procedures
Address every consumer financial product or service offered by the entity.
Formal, written documents detailing consumer compliance responsibilities and instruct employees on the appropriate methods for executing these responsibilities.
Designed to prevent violations and to detect and prevent associated risk of harm to consumers
Maintained and modified regularly to remain current and referenced by employees in day-to-day activities

26. Step Six
Create a centralized process to monitor consumer complaints, identify trends, determine appropriate remedial actions and report back to the Board and/or management.

27. Key elements to customer complaint management
Establishment of channels to receive consumer complaints and inquiries; e.g. telephone numbers or addresses dedicated to receiving consumer complaints or inquiries.
Proper and timely resolution of all complaints;
Recordation, categorization, and analysis of complaints and inquiries;
Reviews for possible violations of Federal consumer financial laws.

28. CFPB observations when consumer complaint tracking is not centralized
Not conducive to trend analysis of findings across the entity as a whole.
Inability to to identify systemic issues or to determine the root cause of regulatory violations or internal control weaknesses.
Failure to address an issue across the entity as a whole.

29. Consumer Complaint Management
Be responsive to consumer complaints and inquiries
Monitor and analyze complaints to understand and correct weaknesses that could lead to consumer risks and violations of law
Organize, retain, and analyze complaint data to:
identify trends isolate areas of risk identify areas of weakness

30. Step Seven
Establish expectations for compliance by service providers/third party vendors with obligations applicable to the service provider or its products or services.

31. (CFPB Supervisory Highlights, Spring 2014, p. 7)
The fact that a supervised entity enters into a business relationship with a service provider does not absolve the supervised entity of responsibility for complying with Federal consumer financial law and, depending on the circumstances, it may be held legally responsible for violations by the third party.
(CFPB Supervisory Highlights, Spring 2014, p. 7)

32. Third party service providers
Select service providers carefully
Include compliance expectations in contracts
Monitor service providers’ work and complaints about their work
If they fail to provide services properly, require remediation and take appropriate measures including possible termination of contract.

33. Step Eight
Establish a training plan for all staff and management based on their roles and the nature and risks to consumers. Such training must be consistent with and designed to reinforce internal policies and procedures. Keep track of training.

34. Training
Leadership should ensure regular training of employees on their consumer compliance responsibilities.
Current, complete, effective, and commensurate with the entity’s size and risk profile.
Federal consumer financial laws regulatory requirements and entity’s own consumer compliance-related policies and procedures.
Reinforces and helps implement written policies and procedures.
Board members need sufficient information, including training, to understand the entity’s consumer compliance responsibilities and the commensurate resource requirements.

35. Training Programs Include formal training schedules Attendance records
Written reference materials
Responsive to new or changing regulatory requirements, new products and services, and product changes.

36. Step Nine
Identify resources for, and schedule frequent monitoring of, activities for compliance with policies and procedures.

37. What is expected for Monitoring?
An effective CMS implements both periodic monitoring reviews and an independent compliance audit.
Periodic monitoring reviews may be conducted by either individual business lines or the compliance department on a frequent basis, monthly or quarterly, to self-check processes and ensure day-to-day compliance with Federal consumer financial laws.

38. Insufficiency in monitoring increases risks
Violations and weaknesses may go undetected for long periods of time potentially leading to multiple regulatory violations and increased consumer harm.
Insufficiencies in the periodic monitoring process may not be identified
Board is not made aware of regulatory violations or program weaknesses
Practices or conduct by employees within the business lines or compliance department that are unfair, deceptive, abusive, discriminatory, or otherwise unlawful could go undetected

39. Step Ten
Require annual audit by a person or team independent from the compliance function and business units. This audit addresses compliance with the CMS, internal policies and procedures, state and federal consumer finance laws and regulations with coverage appropriate for the size of the organization.

40. Independent compliance audits
Usually done annually
This audit is independent from the compliance function and from the business unit
Compliance with Federal consumer financial law is ongoing
CMS as a whole is operating properly
The Board is made aware of consumer compliance issues

41. Audit schedule and scope is expected to be appropriate for the entity’s size, its consumer financial product offerings, and structure for offering these products. The compliance audit program should address compliance with all applicable Federal consumer financial laws, and also identify any significant gaps in policies and standards.
(CFPB Supervisory Highlights, Summer 2013, p.11)

42. Reports should be timely made to the Board or executive management.
Step Eleven
Reports should be timely made to the Board or executive management.

43. Independent compliance audit
Provides Board/Board Committee with determination whether implemented policies and standards are implemented to Board’s established level of compliance and consumer protection
Audit results are reported directly to Board or Board committee.

44. Results leading to appropriate corrective action are documented.
Step Twelve
Results leading to appropriate corrective action are documented.

45. Corrective action
Areas of weakness identified in Monitoring and Audit are addressed through implementation of corrective actions
Management follow up on corrective actions
Ensure violation of law or program deficiencies are resolved
Findings escalated to management and Board, where appropriate

46. Let’s look at CHFA’s approach
Assigned legal and compliance staff to the tasks
Conducted internal research and interview business units
Prepared a Gap Analysis
Sought out training opportunities – especially those provided by the CFPB
Reported Findings to Executive Leadership

47. CHFA’s Implementation
Created Comprehensive Management Plan for Board level approval
Refined and updated existing policies and procedures to incorporate CFPB guidance
Overhauled complaint tracking and response system
Updated Seller’s Guide; Mortgage Purchase Agreements with Participating Lenders and Vendor Contract forms and procedures
Educated CHFA business units, Participating Lenders and third-party vendors about CFPB requirements and CHFA’s expectations
Established a training curriculum for all CHFA staff and management

48. Getting started Gap Analysis Assess your human capital
Survey what you already have
What can you re-use or repurpose
Assess your human capital
Who can take charge - person or committee
Assess your resources

50. Where to start
Assign specific persons to take responsibility for implementation
Take stock of what you already have in place
Where are the Gaps?
Prepare Formal Action for approval by the Board or other Executive Leadership
Consider your organization’s culture and how to best incorporate the necessary changes

51. Resources Supervisory Highlights
CFPB has provided guidance through its Supervision and Examination Manual
Supervisory Highlights
Published Bulletins, e.g. CFPB Bulletin Date: April 13, 2012 Subject: Service Providers providers.pdf
Published Consent Orders – e.g. ADMINISTRATIVE PROCEEDING File No CFPB-
In the Matter of: CONSENT ORDER U.S. Bank National Association
order_us-bank.pdf