On January 19, 2021, the Consumer Financial Protection Bureau (CFPB or Bureau) published a special edition of its Supervisory Highlights focused on its COVID-19 Prioritized Assessments. As Cadwalader previously wrote, the CFPB announced in July 2020 that it had sent targeted information requests to supervised financial institutions regarding the consumer risks posed by the pandemic, including how institutions were implementing the special borrower protections under the Coronavirus Aid, Relief, and Economic Security (CARES) Act. Among its many features, the CARES Act provides relief to consumer and small business borrowers, such as the temporary small business lending program known as the Paycheck Protection Program (PPP), forbearance programs for federally backed mortgages and student loans, and amendment of certain provisions of the Fair Credit Reporting Act (FCRA) to address reporting of delinquent or defaulted loans. Financial institutions also offered voluntary programs to borrowers who were experiencing financial hardship due to the pandemic. The CFPB’s Prioritized Assessments involved higher-level inquiries than typical examinations and covered the period from May 2020 through September 2020.

Last week’s Supervisory Highlights shares the CFPB’s key findings stemming from these reviews, which are summarized in more detail below. As the Supervisory Highlights makes clear, financial institutions face legal and operational risk not only from the potential wave of defaulted consumer loans, but also from the implementation of programs intended to prevent or mitigate those defaults. While the Prioritized Assessments themselves “were not designed to identify violations of Federal consumer financial law,”¹ financial institutions today face a reinvigorated CFPB under the Biden administration. That means, going forward, we anticipate that the CFPB will employ the full measure of its supervisory and enforcement authorities to investigate potential legal violations and corresponding consumer harm stemming from the pandemic. For example, the CFPB notes that it “will be following up on risks identified while conducting [the Prioritized Assessments] in the normal course of the Bureau’s supervisory work.”²

For financial institutions, the Supervisory Highlights provides a road map for the types of issues the CFPB is likely to consider problematic. Thus, we believe it is imperative that financial institutions use this time to critically assess their implementation of the CARES Act, as well as any other voluntary consumer loan loss mitigation programs, in light of the CFPB’s findings, with an emphasis on improving policies, procedures, and training around these programs, as well as self-identifying and self-remediating any potential legal violations. Specifically, we recommend that financial institutions:

• Assess communications with borrowers to ensure they accurately convey borrower's options and do not involve materially misleading statements.

• Review implementation of forbearance programs and other bespoke requirements under state law (for example, requirements regarding distribution of Economic Impact Payments) to ensure they are correctly operationalized and do not result in the imposition of inaccurate payments or fees or otherwise result in consumer harm.

• Review the institution's implementation of the PPP for compliance with the Equal Credit Opportunity Act (ECOA) and its implementing regulation, Regulation B. In particular, the CFPB noted that existing customer overlays in connection with the PPP-while neutral on their face-run the risk of disproportionately impacting borrowers on the basis of a prohibited characteristic, such as race or gender. This raises a question of whether the CFPB's approach to fair lending will be consistent with that outlined by the Office of the Comptroller of the Currency. In addition, because we expect fair lending to be a significant focus of the CFPB under the Biden administration, financial institutions also should consider whether to seek no action letters from the CFPB, as some lenders recently have done with respect to their underwriting models.³

• Implement appropriate corrective action in response to self-identified issues. The CFPB favorably notes, for example, that "[m]any entities engaged in robust monitoring . . . , leading them to self-identify issues and implement corrective actions where needed," including providing "customer remediation" and "reversing fees."⁴ In our experience, financial institutions that self-identify and self-remediate potential legal violations and compliance gaps generally have a greater chance of success in heading off supervisory or enforcement action down the road.

With respect to the CFPB’s specific findings in the Supervisory Highlights, we summarize below the agency’s observations with regard to mortgage servicing, auto loan servicing, student loan servicing, credit card account management, consumer reporting-furnishing, deposits, and small business lending.

A.  Mortgage Loan Servicing

The CFPB highlighted on the operational challenges faced by mortgage services in implementing the CARES Act forbearance program, which allows consumers with federally backed mortgages to request forbearance for up to 180 days, which can be extended to 360 days upon request. The Bureau found that mortgage servicers:

• Provided incomplete or inaccurate information regarding forbearances, including the available period under the CARES Act for forbearance, the amount of interest accrued, amounts owed, and eligibility requirements;

• Took actions on borrowers’ accounts inconsistent with being enrolled in CARES Act forbearance, including sending collections and default notices, assessing late fees, and initiating foreclosure;

• Canceled or provided inaccurate information about borrowers’ preauthorized electronic funds transfers;

• Failed to timely process forbearance requests, including completely failing to process some requests;

• Enrolled borrowers in automatic or unwanted forbearances and then informed consumer reporting companies that the accounts had been placed in forbearance; and

• Failed to take appropriate steps relating to loss mitigation for borrowers in CARES Act forbearances.

B.  Auto Loan Servicing

Although not required by the CARES Act, the CFPB reported that in response to the pandemic, many auto loan servicers expanded existing payment assistance programs to help borrowers who were having trouble making payments. Specifically, many market participants waived late fees, permitted non-delinquent as well as delinquent borrower enrollments, and provided longer payment deferrals. According to the CFPB, loan deferments were generally offered on a case-by-case basis with most borrowers receiving a payment deferment of three or more months (with subsequent extension of their loan terms by an equivalent period); interest generally continued to accrue during the period of deferment. Auto loan servicers also generally ceased repossession efforts, though more so due to state-specific stay-at-home orders.

The CFPB observed a number of risks to consumer harm presented by auto loan servicers’ pandemic response efforts, including:

• Failures to provide precise information regarding the effect of interest accrual during deferment periods on the final loan payment amount;

• Continued withdrawal of funds for monthly payments after agreeing to deferments and failure to process payment assistance requests; and

• Warning borrowers of possible repossession even though repossession efforts had been suspended, which may have led to borrowers spending money on auto loan payments they otherwise would not have needed to pay.

C.  Student Loan Servicing

The CARES Act provides significant relief to certain student loan borrowers. The law set interest rates for federal loans owned by the U.S. Department of Education to zero and suspended monthly payments for most of these loans. But not all student loans are held or issued by the Department of Education. Private lenders or holders of student loans also implemented payment relief measures, mainly relying on provisions in the original note, such as natural disaster or economic hardship forbearances. Others created pandemic-specific relief options. Such provisions, however, do not provide the same level of relief as the CARES Act provides to borrowers with direct or Education Department-held federal loans.

One challenge faced by servicers of privately held student loans was confusion on the part of borrowers who mistakenly believed that their loans qualified for relief under the CARES Act.

The Prioritized Assessments revealed several issues in student loan servicers’ implementation of the CARES Act and overall pandemic relief efforts, including:

• Providing incorrect or incomplete information about available payment relief options in written communications to numerous consumers;

• Multiple servicers failed to provide information to borrowers seeking payment assistance regarding the full range of payment relief options, including switching to income-based repayment or other non-standard repayment options that could provide long-term relief;

• Multiple instances of payment allocation errors for borrowers’ voluntary payments such that when payments and interest accrual resume, these borrowers would end up paying more over time; and

• Some servicers failed to prevent preauthorized electronic funds transfers following forbearance approvals for non-federally owned loans.

D.  Credit Card Account Management

Credit card issuers also provided some degree of pandemic-related payment relief with the most common relief permitting skipping of a payment or deferring payments for one to six months. Most issuers did not waive interest accrual during these periods of deferment. The CFPB noted a number of operational challenges faced by credit card issuers during this period including failing to obtain necessary consumer consents for electronic disclosures, meeting regulatory requirements to address consumer disputes, and adjusting monitoring and testing schedules for credit card operations.

E.  Consumer Reporting and Furnishing

The CFPB found that consumer reporting companies and furnishers of consumer information faced challenges in implementing the CARES Act’s amendment to section 623(a)(1) of the FCRA. Specifically, for credit obligations or accounts that were current before the furnisher provided an accommodation with respect to one or more payments on a credit obligation, the furnisher must continue to report that obligation or account as current during the period of accommodation. If, on the other hand, the credit obligation or account was delinquent before the accommodation, then the furnisher cannot advance the delinquent status during the accommodation.⁵

Consumer reporting companies and furnishers reported staffing challenges that affected their ability to resolve disputes within the time periods required by statute or regulation and some furnishers reported needing to make changes in procedures due to the new accommodation provisions. The CFPB found the risks of consumer harm included inaccurate reporting of accommodations and other information by furnishers and the failure to timely resolve disputes by credit reporting companies.

F.  Deposits

Direct deposit was the primary method by which direct monetary payments authorized by the CARES Act—Economic Impact Payments (EIPs)—were delivered to many consumers and remained the most common means by which unemployment benefits, which were increased by the CARES Act, reached beneficiaries.

The CFPB identified multiple issues in depository institutions’ response to the pandemic that elevated risk to consumers:

• Examiners found that some institutions failed to fully implement new state-level protections to consumers’ access to the full amount of their government benefits, including prohibiting institutions from using EIPs or unemployment insurance benefits to cover charged-off loan obligations, fees owed to the institutions, or overdrawn account balances. Such failure to “properly identify, analyze, and, as applicable, comply with state actions poses a risk that consumers might be deprived of the full use of government benefits,” and “under certain circumstances, constitute an act or practice that violates Federal consumer financial law”;⁶

• Failure on the part of some institutions to clearly communicate how and when provisional credits—which were used to waive setoff rights—would be revoked, especially if revocation of provisional credit would result in a negative account balance, thereby generating an overdraft fee; and

• Failure to implement policies and procedures that fairly and consistently operationalized account fee waivers and refunds.

G.  Small Business Lending

The Prioritized Assessments included reviewing fair lending risks associated with institutions’ participation in the Paycheck Protection Program, including compliance with Equal Credit Opportunity Act (ECOA) and its implementing regulation, Regulation B. As part of implementing the PPP, multiple lenders adopted policies that limited small business participation in the PPP beyond the requirements of the CARES Act and the rules and regulations of the Small Business Administration, namely to small businesses that already had an existing relationship with the institution. According to the CFPB, these “existing customer overlays” could take two forms: 1) limiting participation to small businesses with pre-existing relationships or particular pre-existing relationships; or 2) requiring the small business to become a customer of the institution by opening a business account and only then becoming eligible to apply for a PPP loan.

Institutions offered a wide range of business justifications for applying such an overlay, including Know Your Customer and other due diligence legal requirements, as well as operational reasons related to processing as many applications as possible as quickly as possible. The Bureau, however, found that such policies—while facially neutral—could run the risk of violating ECOA and Regulation B. The CFPB made clear, though, that it had not made a determination one way or another whether any specific overlay complied with ECOA or Regulation B.

¹   Consumer Financial Protection Bureau, Supervisory Highlights COVID-19 Prioritized Assessments Special Edition, Issue 23 (Winter 2021) at 3 [hereinafter Supervisory Highlights].

²   Id.

³   See, e.g., CFPB, Office of Innovation, Synchrony Bank Approval Order (Dec. 30, 2020), available at https://files.consumerfinance.gov/f/documents/cfpb_synchrony_approval-order_2020-12.pdf; No-Action Letter from Edward Blatnik, Acting Ass’t Dir. for the CFPB Office of Innovation, to Alison Nicholl, Gen. Counsel, Upstart Network, Inc., Nov. 30, 2020, available at https://files.consumerfinance.gov/f/documents/cfpb_upstart-network-inc_no-action-letter_2020-11.pdf.

⁴   Supervisory Highlights at 4.

⁵ See CFPB, Consumer Reporting FAQs Related to the CARES Act and COVID-19 Pandemic (June 16, 2020), available at https://files.consumerfinance.gov/f/documents/cfpb_fcra_consumer-reporting-faqs-covid-19_2020-06.pdf.

⁶   Supervisory Highlights at 22.