The Consumer Financial Protection Bureau, or CFPB, is one of the federal agencies that has the authority to issue civil investigative demands, or CIDs, to gather information relevant to one of their investigations. When the CFPB initiates an investigation, it follows the procedures it has established for determining whether someone has participated in behavior that is against federal consumer financial law. If your financial institution receives one, how you respond to it will determine whether you protect your company or expose it to significant legal liability. 

What are CFPB Civil Investigative Demands?

The CFPB is the federal agency tasked with protecting consumers in the financial industry. To the surprise of many, though, its jurisdiction is not relegated strictly to banks. It also covers:

• Mortgage originators

• Mortgage servicers

• Payday lenders

• Private student loan lenders

• Debt collection companies

• Automotive finance companies

• Consumer reporting agencies

A key component of the CFPB’s investigatory techniques is a civil investigative demand. This potent investigative tool behaves like an administrative subpoena: It requires the disclosure of the information listed in the CID and threatens criminal contempt charges for noncompliance. Under the authority of 12 CFR § 1080.6, the CFPB can demand:

• Documentary material

• Tangible things

• Written reports

• Answers to questions in an interrogatory

• Oral testimony

Importantly, CIDs are issued without the oversight or approval of a court, so they do not require the CFPB to show probable cause first. Instead, all that is necessary is for the agency to deem that the information requested is likely in your possession and that it is relevant for an investigation, even if that investigation does not target you.

Some Important Steps to Take in Responding to Them 

While every case is different, there are still some basic steps that are generally in your best interests when responding to a CFPB Civil Investigative Demand (CID).

Institute a Legal Hold of All Potentially Covered Material

Something that you should probably do immediately after receiving a CID from the CFPB is to implement a company-wide legal hold of all material and relevant documents that might be covered by the CID. The last thing that you want to have to happen is for your company’s standard document retention policies to destroy disclosable information and other supporting documentation after the CID has been received. The CFPB will not see this circumstance as an accident. At the very least, the destruction of potential evidence will create the presumption that they were incriminating. You may also be accused of spoliation or charged with obstruction of justice.

Consider Challenging or Quashing the CID

While the CFPB has wide latitude to issue CIDs in the preliminary stages of their investigations, their discretion is not absolute. They still have to comply with the authority delegated to them. The CID has to demand information that is relevant to an investigation and the CFPB has to follow the correct process for issuing it. You can file a motion to challenge or quash in federal district court the issuance of the CID and argue that it is:

• Unduly burdensome

• Abuse of the judicial process

• Seeking information that is already in the agency’s possession

• Asking for information that is irrelevant to a CFPB investigation

Known as a petition to modify or set aside the CID, under 12 CFR § 1080.6(e), this motion has to be filed within 20 days of the receipt of the CID and it must set forth all factual and legal objections to the CID, including all appropriate arguments. However, the motion is filed with the CFPB itself. The odds that the agency will agree to simply set aside its own investigative demand are slim. However, it can open a useful dialogue about the appropriateness and scope of the demand. Additionally, not challenging the legal validity of the CID at this stage can waive your right to do so in the future.

As Dr. Nick Oberheiden, a CFPB civil investigative demand defense lawyer at Oberheiden P.C., says, “Challenging the validity of a CID rarely leads to an absolute victory. However, it may be in your interests to try to quash the demand, anyway. A lot will depend on the specific circumstances of your case. Trying to quash the CID may make the CFPB wonder what you are trying to hide, escalating the scrutiny that you are facing and backfiring as a defense.”

Gather the Material Well Before the Deadline for Disclosure

Even if you decide to try to quash the CID, you should still go through the process of complying with the demand by gathering the evidence it lists. If your petition to set aside the CID fails, the deadline for disclosure will still remain – you do not want to put yourself in a position where your petition is denied, the deadline is a week away, and you have done nothing to meet your disclosure obligations.  

But aiming to meet your compliance obligations on the eve of the deadline is not good enough. You should try to beat the deadline by as much as possible to give your legal counsel and defense team the time they need to review what you are about to hand over to the federal law enforcement agency. 

Use Privileges and the Scope of the CID to Protect Potentially Damaging Information

If your CID defense team identifies potentially damaging or even incriminating evidence among the information that you are about to hand over to the CFPB, there are steps that you can take to avoid disclosing it, or to at least mitigate the damage.

The best option is to come up with a strong reason why the information falls outside the scope of the demand. Doing so can justify non-disclosure.

Another good option is to identify a privilege that insulates the information from disclosure. The most common privilege to invoke during a CFPB investigation is the attorney-client privilege. However, the spousal privilege and the healthcare professional privilege are occasionally invoked, as well.

You can also avoid disclosing particularly damaging evidence of a crime by invoking your Fifth Amendment right against self-incrimination. This is generally only a last resort, though, because it admits that you have incriminating evidence. Doing so will trigger a criminal investigation to find what you have from other sources.

If nothing can be done to avoid disclosure, you can still protect your interests and mitigate the damage by explaining what the information really means and why it is not as bad as it might seem at first. This can put the information forward in as good of a light as possible.