Obtaining Optimum Compliance Performance

Obtaining Optimum Compliance Performance
TM Obtaining Optimum Compliance Performance Foundational Training on ACA’s Professional Practices Management System (PPMS TM) © 2014 ACA International All Rights Reserved.

Obtaining Optimum Compliance Performance
TM This information is not to be construed as legal advice. Legal advice must be tailored to the specific circumstances of each case. Every effort has been made to assure that this information is up-to-date as of the date of publication. It is not intended to be a full and exhaustive explanation of the law in any area. This information is not intended as legal advice and may not be used as legal advice. It should not be used to replace the advice of your own legal counsel. Although I am an attorney, I’m not providing you with legal advice. For legal advice, you must consult your own legal counsel. If you are not familiar with an attorney in the credit and collection industry, be sure to ask for more information on the ACA International Members’ Attorney Program (MAP) or request additional information by sending an to © 2014 ACA International All Rights Reserved.

© 2014 ACA International. All Rights Reserved.
Course Outline Federal Compliance State Law Compliance Compliance Resources While we will be talking about areas to examine within compliance, this won’t be a traditional compliance seminar. Rather, we’re going to discuss how compliance issues relate to the 17 elements of PPMS. © 2014 ACA International All Rights Reserved.

Areas to Examine Federal Compliance Fair Debt Collection Practices Act (FDCPA) Fair Credit Reporting Act (FCRA) Bankruptcy Gramm-Leach-Bliley Act (GLBA) Telephone Consumer Protection Act (TCPA) Health Insurance Portability and Accountability Act (HIPAA) Servicemembers Civil Relief Act (SCRA) As I mentioned at the beginning, this is not a traditional compliance presentation. We’re going to focus on areas of risk within compliance and link those areas to the PPMS elements. The underlying message to take away from today is that all 17 elements, in some way, shape or form, apply to compliance areas. There certainly isn’t enough time to talk about how each element relates to compliance, so we’re going to focus on one element for each risk area. We put the elements up on these flip chart pages so we remembers the others as we focus on a few. Because we have a limited period of time, we have focused this presentation on two main areas of federal law that require compliance from the credit and collection industry: the Fair Debt Collection Practices Act and the Fair Credit Reporting Act. Of course there are several more statutes and regulations that require compliance such as HIPAA, the Gramm-Leach-Bliley Act, the Telephone Consumer Protection Act, the Servicemembers Civil Relief Act, and bankruptcy law, to name a few. However, we don’t have time to cover all of the areas of the law. Instead, we have included information on these topics in your PPMS compliance handout materials. © 2014 ACA International All Rights Reserved.

Federal Compliance - FDCPA
FDCPA Areas of Risk Communications Disputes Prohibited Practices © 2014 ACA International All Rights Reserved.

FDCPA Areas of Risk: Communications
Communications with Consumer Oral Written Electronic Communications with Third Parties Authorized Third Parties Unauthorized Third Parties Over the past two days, we’ve heard a lot about “debtors.” I’m not going to use that term because it is not defined in either the Fair Debt Collection Practices Act or the Fair Credit Reporting Act. Rather, I’m going to use the term “consumer.” © 2014 ACA International All Rights Reserved.

FDCPA Areas of Risk: Communications with Consumer
Oral Communications Mini-Miranda requirements Element 8 – Process control Overshadowing Element 11 – Identification of non-conformity Hours allowed to contact Element 5 – Purchasing In phone conversations or live, in-person meetings, are the appropriate disclosures given? How do you know that they’ve been given? What controls do you have in place to be sure? You’ll hear this a lot, too – don’t forget about state law requirements. Are you sure that you are including all of the state-mandated disclosures in your oral communications with consumers. You need to be sure that you aren’t communicating with the consumer during the 30 validation period pressuring the consumer to pay the debt before the expiration of the 30 days. How do you know that such calls aren’t being made? Do you check on your collectors to make sure they are conforming with the law and with your company’s policies and procedures? Does the automatic dialing device or predictive dialer you use for collection calls have the ability to recognize time zones and not to call certain numbers until it is between 8 a.m. and 9 p.m. in the state to which the call is being placed? Do you keep records of how often the consumer is called in regards to a debt? The FDCPA doesn’t set a limit as to the number of times you can call a consumer in any given day or week. It does prohibit collectors from harassing or annoying any consumers and anyone at the called number. However, some states do put limits on the number of contacts. You need to keep a record of all contacts with consumers. © 2014 ACA International All Rights Reserved.

Written Communications Validation Notice Element 15 – Internal Management Audits Verification Element 13 – Handling, Storage, Preservation, & Delivery Mini-Miranda Element 9 – Inspection & Testing Overshadowing Element 12 – Corrective Action, Preventive Action & Continuous Improvement Does your management team require the validation notice to be included in all initial communications with the consumer? What checks are in place to make sure the letters say what they should? When you receive a verification request from a consumer, what do you do with it? How do you respond to the request? What happens if you cannot verify the debt? It is important that you keep a record of the verification request and the response to the request. In order to efficiently and accurately respond to a verification request, it is important to handle, store, and preserve all records pertaining to the debt while in the collection process. Delivery of the verification information must also be documented. If a suit should arise against your company for an FDCPA violation, the more records you have of your actions, the better off you will be in most cases. Do you periodically review your collection letters to make sure they comply with changing case law and state requirements? What about external testing, such as ACA’s Collection Notice Review program? Parties who obtain their insurance through ACA are required to have their collection letters reviewed by CNR attorneys. This is done to ensure the letters contain the required state and federal disclosures. If you found a letter that overshadows the 30-day validation period, did you immediately correct it? What do you do to make sure it doesn’t happen again? © 2014 ACA International All Rights Reserved.

Electronic Communications Element 8 – Process Control Web site Element 13 – Handling, Storage, Preservation, & Delivery Caller ID Element 3 – Review of Client Issues Does your company communicate with consumers via ? How? Do you copy and paste your collection letters into electronic text. Do your collectors decide what to say in ? What process do you have in place to control what collectors are writing in ? Is the appropriate state-required special text included? What do “to,” “from,” and “re:” lines state? Do they disclose the existence of a debt? How does your company’s Web site deliver information? Is it user-friendly? Is the information on your Web site accurate? How often is the information changed and updated? When new text is added to the Web site, who reviews the new information? When the site is changed, what happens to the old pages? What if someone sues you based on what the site said two years ago? How can you pull the information from that time? If you allow consumers to make payments online, what happens to the consumer’s payment information, whether it be a credit card number or bank routing information? Is the information encrypted? Is it kept private and secure? There is a difference between “private” and “secure.” Who has access to the consumer’s payment information when provided by the Web site? © 2014 ACA International All Rights Reserved.

FDCPA Areas of Risk: Communications with Third Parties
Authorized Third Parties Spouse (sometimes) Element 14 – Management of Records/Data Attorney for consumer Element 7 – Data Identification & Traceability Parent of minor consumer (sometimes) Element 16 - Training Records should document whether the consumer is married, if the spouse is jointly liable for the debt (if known), and the type of the debt. You need to be careful of common law marriage – they may say that they are married, but legally, they are not married. Or vice versa. Your records should also include the date the debt was incurred. Was it incurred before or after the marriage? It might make a difference. However, that information may not always be obtainable. How do you know an attorney represents a certain consumer? Who told you the consumer was represented by an attorney? When did you find out the consumer was represented by an attorney? Did your collectors make any contacts with the consumer after being notified of attorney representation? You need to be able to trace attorney information back to the appropriate consumer and to the date you received notice of the representation to show whether a contact (written or oral) with the consumer was made before or after knowledge of the attorney representation. Collectors need to be trained when a parent can be contacted about a debt incurred by a minor. You cannot always contact a minor’s parents – emancipated minors; minor has baby and baby incurs expenses. © 2014 ACA International All Rights Reserved.

Authorized Third Parties (cont’d) Guardian Element 6 – Control of Client & Customer-Supplied Data Executor/administrator Element 13 – Handling, Storage, Preservation, & Delivery Attorney for creditor or debt collector Element 8 – Process control How did you obtain the information that the consumer has a guardian? Was it provided by the creditor? The consumer? What happened once the guardian information was received? Did the collector receive documentation of the consumer’s death? It is important to show that there is no third-party disclosure. This can be done by preserving records of the consumer’s death and the name of the executor/administrator of the estate. Who else should receive notice of the death? Did your collector tell the creditor? You’re always allowed to discuss the debt with the attorney for the creditor or the debt collector. What process controls do you have in place to make sure you know who the attorney is for these parties? © 2014 ACA International All Rights Reserved.

Unauthorized Third Parties Consumer Credit Counseling Services Element 12 – Corrective Action, Preventive Action & Continuous Improvement Power of Attorney Element 16 – Training Employers and Others Element 14 – Management of Records/Data Did the consumer authorize you to talk with a consumer credit counseling service? If not, you cannot communicate with the service. How do you prevent this from happening? It is important for you to obtain a signed authorization from the consumer permitting you to communicate with a consumer credit counseling service. You need to keep a record of the authorization. If you don’t have the authorization, you should not communicate with a credit counseling service. Just because a party claims to have power of attorney over a consumer does not mean you can communicate with that party regarding the debt. Power of attorney can be for one specific purpose or overall. Always keep a record of a consumer providing information to you regarding power of attorney. You need to train your collectors regarding the different between an attorney representing a consumer and a party who has power of attorney for a consumer. When can you talk to the consumer’s employer? What information can you request from the employer? How do you document and maintain the the information? If you’re trying to carry out a post-judicial remedy (e.g., garnishment) there is certain information the employer must receive. This type of disclosure is permitted under the FDCPA. © 2014 ACA International All Rights Reserved.

FDCPA Areas of Risk: Disputes
Oral Disputes Element 2 – Management Systems Written Disputes Element 6 – Control of Client & Customer-Supplied Data How often does a consumer say “I dispute this debt.” Hardly ever, right? There is always a stall, excuse or objection. How do you know what constitutes an oral dispute? Management should develop a policy for handling oral disputes and what constitutes a dispute if the consumer doesn’t say “I dispute.” This policy must be explained to and followed by the collectors. When a dispute is made in writing, how does your company handle it? Does the dispute immediately get escalated to a supervisor or manager? What if the dispute comes within the 30-day validation period? What if dispute comes after the validation period or after the debt is paid? You need to document any and all disputes. All of your collectors need to know how to handle disputes. © 2014 ACA International All Rights Reserved.

FDCPA Areas of Risk: Prohibited Practices
Section 806 – Harassment or abuse Section 807 – False or misleading representations Section 808 – Unfair practices Element 8 – Process Control Element 11 – Identification of non-conformity Element 12 – Corrective Action, Preventive Action & Continuous Improvement Element 16 – Training There are a number of violations that fall under Section Everything from failure to disclose the mini-Miranda to false threats of legal action or an action that can’t legally be taken to meaningful involvement in the collection of the debt. You must have controls in place to ensure that collectors don’t threaten to take actions that are intended to be taken or can’t legally be taken. What controls do you have in place to ensure that collectors give the right disclosures, that they don’t threaten the consumer or misrepresent what will or won’t be done? How do you correct, prevent, and improve such actions? © 2014 ACA International All Rights Reserved.

Federal Compliance - FCRA
FCRA Areas of Risk Data Furnishers Disputes Permissible Purpose Identity Theft Now we are going to turn to the Fair Credit Reporting Act. The FCRA was amended in December There are several new provisions regarding identity theft, credit card and debit card truncation, notice requirements, reporting medical information, etc. These new provisions have staggering effective dates and several require the Federal Trade Commission to draft rules and regulations. The ACA Compliance Division has been preparing Fastfax documents to inform our members of what these amendments mean and what is required for compliance. These documents were prepared subsequent to your PPMS Manual going to print. If you want more information on the amendments, please go to the Compliance or Fastfax pages of the ACA Web site at There are six areas of risk under the FCRA that we are going to cover today: date of delinquency, data furnishers, disputes, permissible purpose, medical information, and identity theft. © 2014 ACA International All Rights Reserved.

FCRA Areas of Risk: Data Furnishers
Date of delinquency Element 6 – Control of Client & Customer-Supplied Data Accurate and complete information Element 4 – Document and Data Control Report disputes Element 12 – Corrective Action, Preventive Action & Continuous Improvement You must make sure the information you give the consumer reporting agency is accurate and complete. If the debt is disputed, you may need to verify or investigate so you can make sure you can support what you report. Did the creditor give you all of the information he had regarding the debt? If additional information is discovered from the creditor or the consumer, the report must be updated and corrected. No matter what form disputes are in, disputes must be reported to the consumer reporting agency and the debt marked disputed. If they aren’t, you must develop a procedure to take corrective action to mark disputed and update the information. Also need to have a system in place to make sure all disputed debts are marked as such in the future. The revised system should prevent such issues from happening again and continuously improve the reporting system. © 2014 ACA International All Rights Reserved.

FCRA Areas of Risk: Disputes
Disputes from Consumer Written Element 13 – Handling, Storage, Preservation, & Delivery Oral Element 7 – Data Identification & Traceability Disputes from CRA Element 8 – Process Control If you receive a dispute in writing from the consumer, the FDCPA will dictate whether you need to verify the debt. This will depend on the timing of the dispute. If you receive the dispute within the thirty day validation period, you are required to verify the debt or cease collection efforts. If after the thirty-day validation period, the collector is not obligated to verify the debt. However, the odds of the consumer paying the debt are greater if he receives some kind of verification of the debt. As for the FCRA, if the collector is reporting the debt, the collector must also report the debt as dispute if he receives a dispute from the consumer. Should you keep the dispute letter in your records? How and when do you deliver the dispute information to the consumer reporting agency? If the consumer disputes the debt orally, the dispute must reported to the CRA. How do you identify that the consumer disputed the debt? Are able to trace the oral dispute back to the consumer through screen notes or other records. If the consumer disputes the debt directly with the consumer reporting agency, you, as the collector, have 30 days from the date of dispute to respond. What processes do you have in place to ensure an investigation and response in that time frame? © 2014 ACA International All Rights Reserved.

FCRA Areas of Risk: Permissible Purpose
Review or Collection of an Account Element 9 – Inspection & Testing Employment Purposes Element 14 – Management of Records/Data Legitimate Business Need Element 11 – Identification of non-conformity In order to pull a consumer’s credit report, you must have a permissible purpose to do so. Section 604 of the FCRA details what constitutes a permissible purpose. One is the review or collection of an account. Is that why the collector is pulling the report? How do you know? Do you check the request when it goes to the CRA? Do you monitor when your collectors are pulling reports and why? E.g., A law firm is held responsible for no permissible purpose when “rogue” employee used access through work to pull an unauthorized report. The law firm should have been reviewing bills and checking that all reports were pulled for a permissible purpose. You can also pull a credit report for employment purposes. You must keep the information private and secure in the employment file. It is not for further disclosure. In order to obtain a collection agency license, the state may pull the credit reports of management or executive staff. Management will have to make sure that those parties have a good credit record. The final permissible purpose we will cover is a legitimate business need. This is only for transactions initiated by the consumer or to review the consumer’s credit information to determine if he continues to meet the requirements of the account. You must identity if reports are being pulled for other reasons. What are those reasons? Once you’ve identified the reason for the non-conformity, you must act to fix it. © 2014 ACA International All Rights Reserved.

FCRA Areas of Risk: Identity Theft
Required Consumer Notices Element 9 – Inspection & Testing Duty to Update CRA(s) of ID theft notice Element 8 – Process Control If you receive a notice from a consumer that he is a victim of identity theft, you are required to send specific information and notices to the consumer. The FTC is developing regulations for these notices. You need to make sure that your collectors are sending out these notices once required and the notices contain the appropriate information. This is done by inspecting the notices and testing your collectors for compliance. If you receive a notice of identity theft, you have a duty to update the consumer reporting agencies of this information. You need to make sure you have a process in place for providing this information to the CRAs. © 2014 ACA International All Rights Reserved.

Federal Compliance - Bankruptcy
Bankruptcy Areas of Risk Automatic Stay Discharged Debt © 2014 ACA International All Rights Reserved.

Bankruptcy Areas of Risk: Automatic Stay
Actual vs. Constructive Notice Element 6 – Control of Client & Customer-Supplied Data Ceasing Collection Activity Element 16 – Training © 2014 ACA International All Rights Reserved.

Bankruptcy Areas of Risk: Discharged Debt
Cease Collection Attempts Element 8 – Process Control Update Credit Reports Element 12 – Corrective Action, Preventive Action & Continuous Improvement © 2014 ACA International All Rights Reserved.

Federal Compliance - GLBA
GLBA Areas of Risk Privacy Rule Safeguards Rule © 2014 ACA International All Rights Reserved.

GLBA Areas of Risk: Privacy
Privacy Notice and Opt-Out Policy Element 7 – Data Identification and Traceability Annual Notice Element 14 – Management of Records/Data © 2014 ACA International All Rights Reserved.

GLBA Areas of Risk: Safeguards
Develop, Implement and Maintain Written Security Program Element 2 – Management System Contract Requirements Element 11 – Identification of non-conformity © 2014 ACA International All Rights Reserved.

Federal Compliance - TCPA
TCPA Area of Risk Use of ADADs/Prerecorded Messages © 2014 ACA International All Rights Reserved.

TCPA Areas of Risk: ADADs/Prerecorded Messages
Identification Requirements Element 10 – Inspection & Test Status Calling Wireless Numbers Element 5 – Purchasing © 2014 ACA International All Rights Reserved.

HIPAA Areas of Risk: Privacy Rule
Covered Entity vs. Business Associate Element 2 – Management System Business Associate Agreements Element 3 – Review of Client Issues Minimum Necessary Requirement Element 7 – Data Identification and Traceability Commingling Data Element 4 – Document and Data Control © 2014 ACA International All Rights Reserved.

HIPAA Areas of Risk: Security Rule
Develop and Implement Security Measures Element 2 – Management Systems Maintain and Monitor Security Measures Element 9 – Inspection & Testing © 2014 ACA International All Rights Reserved.

Federal Compliance – SCRA Areas of Risk
Adverse Action Element 16 – Training Interest Rates Element 7 – Data Identification & Traceability Legal Actions and Statutes of Limitations Element 11 – Identification of non-conformity © 2014 ACA International All Rights Reserved.

Areas to Examine State Compliance Areas of Risk License or Registration Bond requirements Communication requirements/restrictions Trust account requirements Now we are going to turn to the state-related areas of risk. Again, due to time constraints, we are only able to cover a small number of state areas of risk. We have decided to cover the five major areas relevant to the collection industry. © 2014 ACA International All Rights Reserved.

State Areas of Risk: License or Registration
Main and/or branch office Element 5 – Purchasing Collection Manager Element 3 – Review of Client Issues Individual Collectors Element 13 – Handling, Storage, Preservation & Delivery First, let’s discuss licensing and registration. Does each office or branch need to be licensed or registered in order to collect in a certain state? If so, you need to purchase the appropriate licenses. In what states are you collecting or doing business? In what states does your client want you to collect? Do those states require you management staff or collection managers to be licensed? Do the states in which you collect require you to license your individual collectors? How is this handled? Where do you keep the licensing information? Are you taking the appropriate steps when new collectors are hired? Does the state allow you to collect using an alias? Must the alias be registered? Must they be consistently used? Are you tracking what collectors are using what aliases? Have you trained the collectors as to when they can use an alias and when they are prohibited from doing so? Does the collector know if he needs to always use the same alias? © 2014 ACA International All Rights Reserved.

State Areas of Risk: Bond Requirements
Statutory Element 5 – Purchasing Client Contract Element 3 – Review of Client Issues Some states require by statute that you purchase a bond prior to collecting in that state. You will need to examine state law to see if that requirement applies and the amount of the bond required. If you are located in a particular state in which you are collecting, there are certain requirements that must be met for the bond. In whose name does the bond need to be, what is the amount of the bond. You need to make sure you are conforming with the appropriate requirements. If you are an out-of-state collection agency collecting in a state that requires a bond, you will need to be able to trace the bond back to the consumer and client to show the state that you’ve got your bases covered and have the appropriate bond in place. Does your contract with your client require you to obtain a bond? What amount? © 2014 ACA International All Rights Reserved.

State Areas of Risk: Communication Requirements/Restrictions
Hours to contact Element 13 – Handling, Storage, Preservation & Delivery Frequency of contacts Element 14 – Management of Records/Data Contacts at PoE Element 16 – Training Recording conversations Element 9 – Inspection & Testing Some states have set limitations on communications with consumers. Under the FDCPA, you can call between the hours of 8 a.m. and 9 p.m. Most states have the same requirement. However, what if the consumer tells you that you called at an inconvenient time. How do you handle that information? How is it recorded and preserved so all of the collectors are aware of the information? You need to be sure to update screen notes to log all calls and contacts with the consumer on a particular debt. You need to make sure you are not harassing the consumer or contacting her too much. Some states prohibit contacting the consumer at his place of employment. For example, Massachusetts requires a notice to go out after contacting the consumer at his place of employment. Do your collectors know about such requirements? How are they trained to handle them? As for recording conversations, are you allowed to do so? Are you collecting in a one-party consent state? Or is the consent of all parties to the conversation required? Beyond that, how are you using the recordings? Do you use them for Element 16 Training? Do you let your collectors listen to the calls later? How often do you inspect or test your recording equipment? © 2014 ACA International All Rights Reserved.

State Areas of Risk: Communication Requirements/Restrictions
Adding fees/interest Element 6 – Control of Client & Customer-Supplied Data Special text requirements Element 9 – Inspection & Testing Does the state in which you are collecting allow for the collection of fees or interest on a debt? Does the statute allow for the collection of fees permitted by contract? If so, what does the contract between the creditor and consumer say? What fees are you permitted to collect under the terms of the contract? Do you periodically review your collection letters to make sure they provide the appropriate state-specific special text? The doctrine of necessaries provides that parents are liable for the children and spouses may be liable for each other. Each state has different provisions regarding the doctrine of necessaries. In some states, parents are only liable for their children’s medical debts or debts for necessaries. The same between spouses. You need to be able to identity the type of debt and trace it back to the original consumer to determine from whom you can attempt to collect the debt. Community vs. non-community property states throw an entirely different spin on things. If the state is a community property state, generally the obligation may only be satisfied by property that is considered community property or the property of the obligation spouse that is not community property. © 2014 ACA International All Rights Reserved.

State Areas of Risk: Trust Account Requirements
Commingling funds Element 14 – Management of Records/Data Remittance Element 8 – Process Control Under the majority of most state statutes, you are prohibited from commingling the funds received from the collection of debts with the funds used to pay for company expenses. You must keep a detailed record of funds collected for clients, what clients are due what money. Some states require you to keep your trust accounts in the state in which the money was collected. Management needs to set up the appropriate accounts in the appropriate locations. You need to have a system in place for remitting funds to your clients. You need to know what is owed to each client and how much is remitted to each client and when. When a consumer overpays on the debt, how do identify overpayment? How do you identify who made the overpayment and who should receive a refund and in what amount? Some state statutes detail how refunds are to be paid. You need to know what those statutes require. © 2014 ACA International All Rights Reserved.

Areas to Examine Compliance Resources ACA website Campus ACA™ ACA International Publications FDCPA Guide FCRA Guide State Guide Statutory Penalties Guide HIPAA Implementation Guide and DVD That is all of the information we are going to cover on state risk areas. Now we are going to turn to compliance resources available to you. © 2014 ACA International All Rights Reserved.

Obtaining Optimum Compliance Performance

Similar presentations

Presentation on theme: "Obtaining Optimum Compliance Performance"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

Obtaining Optimum Compliance Performance

Similar presentations

Presentation on theme: "Obtaining Optimum Compliance Performance"— Presentation transcript:

Similar presentations

About project

Feedback