On January 4, President Obama, via a recess appointment, installed Richard Cordray as the Director of the Consumer Financial Protection Bureau (CFPB or the Bureau). The appointment was the latest battle in what promises to be a “long war” between the president and Senate Republicans over the future of the CFPB, its structure, and the extent of its powers.

Despite the political issues that continue to surround Director Cordray’s appointment, the very fact of that appointment, as well as Cordray’s background as the Bureau’s Chief of Enforcement and as Ohio Attorney General, signal the Obama administration’s commitment to building the CFPB into a vigorous agency. Indeed, just one day into his tenure, Director Cordray told an audience at the Brookings Institution that the Bureau had opened several investigations, some of which may require enforcement action.^[1]The following week, PHH Corp., a mortgage lender based in New Jersey, became the first company to publicly disclose a CFPB investigation.

Given these clear indications that the CFPB intends to move quickly to carry out its consumer protection mandate, entities and individuals who are within the Bureau’s jurisdiction must become familiar with its powers and practices. This White Paper provides guidance on the CFPB’s structure, its supervision and enforcement authority, and what regulated entities and individuals might expect from this new agency.

Background on the CFPB and Its Governing Laws

The CFPB is a creation of the Dodd-Frank Wall Street Reform and Consumer Protection Act, passed by Congress on July 21, 2010. Pub. L. No. 111-203, 124 Stat. 1376 (2010) (Dodd-Frank). Title X of Dodd-Frank, titled the Consumer Financial Protection Act of 2010 (CFP Act), established the CFPB as an independent agency under the Federal Reserve System with a mandate to protect consumers and increase transparency with respect to financial transactions.

The CFP Act gives the CFPB broad powers to assume regulatory and rulemaking authority under numerous existing federal consumer protection laws, and additionally vests the Bureau with the power to enact new regulations and take enforcement and supervisory actions with respect to consumer financial products and the entities that deal in them. In addition to overseeing certain activities of banks and other financial institutions, the Bureau has authority over entities that are currently unregulated or lightly regulated, such as mortgage companies, payday lenders, and private education lenders.

The CFPB’s purpose is to “seek to implement and, where applicable, enforce federal consumer financial laws consistently for the purpose of ensuring that all consumers have access to markets for consumer financial products and services and that markets for consumer financial products and services are fair, transparent, and competitive.” Dodd-Frank § 1021(a). Further, the CFPB is designed to consolidate consumer financial protection, previously within the purview of seven federal agencies, into one agency.

The Bureau currently has six divisions: Consumer Education and Engagement; Supervision, Enforcement, Fair Lending, and Equal Opportunity; Research, Markets, and Regulations; General Counsel; External Affairs; and Chief Operating Officer. In addition to its home office in Washington, D.C., it has field offices in New York, San Francisco, and Chicago that will primarily employ examiners.

What the CFPB Will Regulate

The CFPB will regulate “consumer financial products and services.” A “consumer” is an individual or an agent, trustee, or representative acting on behalf of an individual. As defined in Dodd-Frank, “financial products or services” include a variety of transactions:

• Extending credit and servicing loans, including mortgages
• Extending or brokering leases of personal or real property
• Providing real estate settlement services
• Engaging in deposit-taking activities
• Transmitting or exchanging funds
• Acting as a custodian of funds or any financial instrument for use by or on behalf of a customer
• Selling, providing, or issuing stored value or payment instruments
• Check cashing, check collection, or check guaranty services
• Providing payments or other financial data processing products or services
• Providing financial advisory services (other than services related to securities provided by a person regulated by the Securities and Exchange Commission (SEC) or Commodity Futures Trading Commission (CFTC), but only to the extent that such person acts in a regulated capacity) to consumers on individual financial matters or relating to proprietary financial products or services (other than publishing a bona fide newspaper, news magazine, or business or financial publication of general and regular circulation, including publishing market data, news or data analytics, or investment information or recommendations that are not tailored to the individual needs of a particular consumer)
• Collecting, analyzing, maintaining, or providing consumer report information or other account information
• Collecting debt, including foreclosing on property

Going forward, the CFPB will have the authority to propose and adopt rules to include other financial products or services within its jurisdiction if the financial product or service is entered into or conducted as a subterfuge or with a purpose to evade any federal consumer financial law.

Who Is Regulated by the CFPB?

The CFPB regulates a wide array of bank and nonbank institutions. When it launched operations in July 2011, the CFPB’s initial focus was on depositories with more than $10 billion in assets. The Bureau is the primary rulemaker, supervisor, and enforcer of consumer protection laws and regulations over these entities, but it is required to coordinate examinations and other supervisory activities with these entities’ state and federal prudential regulators and establish procedures to resolve conflicts between the Bureau and such regulators.

The CFPB’s rulemaking authority with respect to consumer protection laws and regulations also applies to depositories with less than $10 billion in assets. However, although these institutions will be subject to the CFPB’s rulemaking authority, their prudential regulators will retain supervisory and enforcement powers. The CFPB can also participate in examinations of these institutions “on a sampling basis,” can refer enforcement actions against these institutions, and will have access to and can even require reports directly from these institutions.

Aside from these institutions, which have traditionally been subject to federal regulation, Dodd-Frank gives the Bureau the authority to oversee a variety of nondepository-covered persons, such as those who offer or provide the following:

• Origination, brokerage, or servicing of loans secured by real estate
• Loan modification or foreclosure relief services
• Private student loans
• Payday loans

According to an estimate made by the Conference of State Bank Supervisors, more than 132,000 money transmitters, prepaid card issuers, student lenders, check cashers, payday lenders, and nondepository finance companies will now fall under the CFPB’s supervision. Such entities have rarely been subject to a supervisory scheme utilizing examinations as a basis for enforcement actions. The Bureau will be the primary enforcer of federal consumer financial laws and will have primary rulemaking authority over these institutions, but with respect to examinations, it is required to rely on existing examination reports by other federal and state prudential regulators “to the fullest extent possible” and must coordinate with the company’s primary state or federal regulator.

Further, if any of the following entities is engaging in the extension of credit, selling or offering to sell a consumer financial product or service, or otherwise engaging in activities that subject it to a consumer law within the CFPB’s domain, the CFPB will regulate those activities:

• Merchants, retailers, and sellers of nonfinancial goods
• Automobile dealers
• Real estate brokers
• Real estate agents
• Sellers of manufactured mobile homes
• Income tax preparers
• Accountants

Although the CFPB’s mandate is sweeping, Dodd-Frank exempts a variety of entities and activities from the Bureau’s reach. For example, any person regulated by the SEC, CFTC, or a state securities commissioner is not subject to CFPB regulation. Attorneys and insurance companies are also outside of the CFPB’s reach.

Rulemaking

The CFPB’s Director has the ability to prescribe rules and issue orders and guidance “as may be necessary or appropriate to enable the Bureau to administer and carry out the purposes and objectives of the Federal consumer financial laws, and to prevent evasions thereof.” Dodd-Frank § 1022(b)(1). The CFPB also has primary rulemaking and enforcement authority under numerous existing federal consumer protection laws (such as the Alternative Mortgage Transaction Parity Act, the Consumer Leasing Act of 1976, the Equal Credit Opportunity Act, the Fair Credit Billing Act, large portions of the Fair Credit Reporting Act, the Home Owners Protection Act of 1998, and the Truth in Lending Act). Dodd-Frank Act § 1061.^[2] With this authority, the Bureau can prescribe rules applicable to a covered person or service provider identifying as unlawful any unfair, deceptive, or abusive acts or practices in connection with consumer financial products or services. Dodd-Frank § 1031. Further, the CFPB can prescribe disclosure rules and mandate model disclosure forms. Dodd-Frank § 1032.

The CFPB’s rulemaking authority is limited by the requirement that it must consult with “appropriate” financial regulators before proposing a rule. Dodd-Frank § 1022(b)(2)(B). The Financial Stability Oversight Council also has the authority to set aside final CFPB regulations if they would “put the safety and soundness of the U.S. banking system or the stability of the financial system of the U.S. at risk.” Dodd-Frank § 1023(a).

Supervision and Enforcement

Examinations

The CFPB’s supervision and enforcement arm exists to increase accountability and transparency with respect to various financial products. The Bureau will conduct examinations and require reports to (a) assess compliance with federal consumer financial laws, (b) obtain information about a regulated entity’s activities and compliance systems or procedures, and (c) detect and assess risks to consumers and to markets for consumer financial products and services. Dodd-Frank §§ 1024(b), 1025(b).

In October 2011, the CFPB published a comprehensive Supervision and Examination Manual as a guide to how its examiners will supervise and examine consumer financial service providers under its jurisdiction for compliance with federal consumer financial law. In doing so, the CFPB signaled that it intends its examination program to follow the model established by federal banking regulators; indeed, its Supervision and Examination Manual borrows heavily from a similar manual published by the Federal Financial Institutions Examination Council (FFIEC) for bank examinations.

The manual provides regulated entities with meaningful insight into the CFPB’s examination process. It notes that nondepository consumer financial services companies will be identified for examination on the basis of risks to consumers, including consideration of the company’s asset size, volume of consumer financial transactions, extent of state oversight, and other factors determined relevant by CFPB. Regular examination schedules for large depository institutions and affiliates will depend on an assessment of risks to consumers and coordination with those institutions’ prudential regulators and state regulators. The CFPB expects to notify both nondepository and depository institutions in advance of an upcoming examination.^[3]

When conducting examinations, Bureau examiners will go on site to conduct interviews and review additional documents and information. The CFPB views its examination authority broadly and recently issued a bulletin reminding regulated entities that it is entitled to “full and unfettered access to information.”^[4] In Bulletin 12-01, the Bureau further expresses its belief that supervised institutions cannot refuse to make documents available during an examination on the basis of attorney-client privilege. The Bureau based this position, in part, on its belief that courts have determined that the production of privileged information during the course of a regulatory examination does not constitute a waiver of applicable privileges. Because these decisions are not uniform, and certain courts have deemed such disclosures to constitute a waiver, the Bureau’s position is certain to draw objections from supervised entities.

After conducting examination fieldwork, the Bureau’s examiners will draw preliminary conclusions about the regulated entity’s compliance management and its statutory and regulatory compliance, and draft an examination report that will be sent to the regulated entity. At the conclusion of an examination resulting in a preliminary finding that violations have occurred, the Bureau’s staff may suggest corrective actions that the institution should take, whether through informal agreement or a formal enforcement action.^[5]

Enforcement

The CFPB appears to be adopting an enforcement program modeled after those developed by other agencies, such as the SEC and FTC, that have only civil or administrative, and not criminal, enforcement powers. The Bureau’s investigations are designed to determine whether any person is, or has, engaged in conduct that violates federal consumer financial law. As noted in the introduction to this White Paper, the Bureau has already launched several investigations of entities subject to its regulation. Although the CFPB is a new agency and its procedures and investigative practices are sure to develop over time, the Bureau has provided some guidance on how it intends to operate.

Rules Relating to Investigations

In July 2011, the Bureau issued interim Rules Relating to Investigations that provide some guidance on its investigative process. The rules draw heavily from procedures used by the SEC and FTC in their investigations. Among other things, the rules set forth the following procedures:

• Disclosure of the nature of an investigation: Persons compelled to provide information to the Bureau must be advised of the nature of the conduct that is under investigation. The CFP Act states that this information must be included in the demand, along with the provision of law applicable to the potential violation.
• Sworn responses: Responses to civil investigative demands for documents must be made under a sworn certificate, the form of which will be described in the demand, which states that all of the information required by the demand and in the possession, custody, or control of the responding party has been produced. Similarly, demands for written responses to questions must be made under oath.
• Inadvertent privilege waivers: The production of privileged documents shall not operate as a waiver if the disclosure was inadvertent, the holder of the privilege took reasonable steps to prevent disclosure, and the holder of the privilege took reasonable steps to rectify the error by notifying the Bureau investigator of the claim and the basis for it.
• Objections to demands: Petitions to modify or set aside a civil investigative demand must be made within 20 days after service of the demand, must include a signed statement representing that counsel for the petitioner attempted to resolve the issues raised by the petition with the Bureau’s staff, and will be ruled upon by the Bureau’s Director. Importantly, petitions are part of the public record of the Bureau, unlike investigations, which are nonpublic.
• Testimony: The rules regarding the rights of witnesses in testimony follow the FTC’s nonadjudicative procedures. Like the FTC’s rules, the Bureau’s rules permit a person called to testify to be accompanied by counsel, who may object to questions on the basis of privilege but may otherwise not interrupt the examination of the witness by making any objections or statements on the record. Counsel for the witness may, at the conclusion of the testimony, request that the witness be permitted to clarify any of his or her responses. The Bureau investigator has sole discretion to grant or deny the request. Testimony shall be transcribed and may also be videotaped.  
• Enforcement of demands: The Bureau may file an enforcement proceeding in any district court in which a person resides, is found, or transacts business if the recipient of a demand fails or refuses to comply with its terms.
• Disposition of investigations: The Bureau, upon the approval of the Director or his or her designee, may initiate enforcement actions as it deems appropriate in federal or state court or administratively. The Bureau may also refer its findings to appropriate regulators. If enforcement action is not warranted, the Assistant Director of the Office of Enforcement is authorized to close the investigation.

Early Warning Notices

The CFPB has also adopted a procedure for providing notice to individuals and firms under investigation of potential enforcement action that is patterned after the SEC’s “Wells notice” process and similar processes at other federal agencies. In a November 2011 bulletin, the Bureau announced that before its staff recommends enforcement action against anyone it regulates, the Office of Enforcement may give the subject of such recommendation notice of the nature of the subject’s potential violations.^[6] The staff may also provide the recipient of the notice with the opportunity to submit a written statement in response. As in SEC matters, the staff has the discretion to decide whether to issue these notices and generally will not do so in the case of ongoing frauds or in instances when the Office of Enforcement needs to act quickly.

In another similarity to the SEC’s Wells notice process, the CFPB’s November 2011 bulletin also cautioned that written submissions should address legal and policy issues relevant to the investigation and not focus on disputed facts. In a departure from the SEC’s procedures, however, the bulletin requires that to the extent the submission does address facts relating to the investigation, those factual assertions must be made under oath by a person with personal knowledge of such facts. If the Office of Enforcement continues with its enforcement recommendation despite the subject’s arguments, the written submission will be provided to the Director or his designee along with the enforcement staff’s recommendation.

Enforcement Actions

CFPB may bring administrative enforcement proceedings or civil actions in federal district court or state court. The Bureau can obtain “any appropriate legal or equitable relief with respect to a violation of [f]ederal consumer financial law,” including, but not limited to the following:

• Rescission or reformation of contracts
• Refund of money or return of real property
• Restitution
• Disgorgement or compensation for unjust enrichment
• Payment of damages or other monetary relief
• Public notification regarding the violation
• Limits on the activities or functions of the person against whom the action is brought
• Civil monetary penalties (which can go either to victims or to financial education)

The provisions that allow the Bureau to seek restitution and damages are significant because other regulators, such as the SEC, currently lack such powers. It is also possible that the CFPB will seek significant fines in its enforcement actions. The penalties that the Bureau may seek are also significant. The CFPB can seek to impose civil penalties of (a) up to $5,000 per day for the violation of a rule imposed by the Bureau, (b) up to $25,000 per day for the reckless violation of a federal consumer protection law, and (c) up to $1,000,000 per day for a knowing violation of a federal consumer financial law. Dodd-Frank § 1055.

FTC Commissioners have observed that the FTC retains all of its current enforcement jurisdiction under Dodd-Frank and will have concurrent authority to enforce certain rules promulgated by the CFPB. The FTC has indicated that a memorandum of understanding likely will be executed between the two agencies setting out how they intend to coordinate enforcement actions. This interagency agreement is required by Dodd-Frank § 1024(c)(3)(A).

Conclusion

Director Cordray’s appointment starts the CFPB down the path laid out in the Dodd-Frank legislation, which envisioned a new and vigorous “cop on the beat” for consumer matters. Since its launch in July 2011, the Bureau has hired staff, begun examinations and investigations, and looked to two vigorous regulators—the SEC and FTC—to develop its investigative procedures. Companies that fall within the CFPB’s jurisdiction can expect to see increased examination and enforcement activity, as well as continued developments in the Bureau’s practices and procedures, in the coming years.

_{[1]. Remarks by Richard Cordray at The Brookings Institution (Jan. 5, 2012), available at http://www.consumerfinance.gov/speech/remarks-by-richard-cordray-at-the-brookings-institution/.}

_{[2]. When the Federal Trade Commission (FTC) issued its July 2011 rule regarding consumer protections against deceptive mortgage advertisements, it stated that both the FTC and the CFPB will be able to bring actions to enforce the rule, notwithstanding the transfer to the CFPB of rulemaking authority for future revisions to the new rule.}

_{[3]. In addition to regular examinations, the CFPB expects to conduct “Target Reviews” that will generally involve a single entity and will focus on a particular situation such as significant volume of particular customer complaints or a specific concern that has come to CFPB’s attention. The Bureau will also conduct so-called “Horizontal Reviews” that will look across multiple entities to examine issues arising from particular products or practices and determine whether supervisory measures or enforcement actions are needed.}

_{[4]. Bulletin 12-01, available at http://www.consumerfinance.gov/wpcontent/uploads/2012/01/GC_bulletin_1201.pdf.} 

_{[5]. In addition to making internal enforcement referrals, CFPB examiners may refer findings of possible criminal violations to the Justice Department and of possible tax-related violations to the Internal Revenue Service.}

_{[6]. Bulletin 2011-04, available at http://www.consumerfinance.gov/wpcontent/uploads/2011/11/EarlyWarningNotice.pdf.}