Financial institutions that are regulated and supervised by the Office of the Comptroller of the Currency (OCC) should know that the OCC has recently updated its booklet on Unfair or Deceptive Acts or Practices (UDAP) and Unfair, Deceptive, or Abusive Acts or Practices (UDAAP). The booklet — which is designed to inform examiners about the risks of banks and their third parties engaging in lending, marketing, overdraft programs, or other practices that may constitute UDA(A)P — was last updated in June 2020.

Federal law has long prohibited UDAP (under section 5 of the Federal Trade Commission Act, as enforced by the Federal Trade Commission) and UDAAP (under the Consumer Financial Protection Act of 2010, as enforced by the Consumer Financial Protection Bureau), but the OCC’s update sets forth expanded procedures for examiners to evaluate risks under those laws and serves as a reminder that the OCC will continue to emphasize them in its supervisory and enforcement matters.

In its updated booklet, the OCC:

• Offers clarity on sound risk management practices for third-party relationships, emphasizing that risk can increase when a bank offers products or services through third parties or outsources origination, servicing, or operational processes to such parties; 
• Guides examiners on overdraft services and overdraft protection program risk management;
• Incorporates Consumer Financial Protection Bureau updates on data protection and information security policies and procedures;
• Offers detail about loan and deposit account management, identifying activities that heighten regulatory risk;
• Updates the “Appendix B: UDAP and UDAAP Risk Indicators;” and
• Incorporates OCC and interagency issuances that have been published or rescinded since June 2020;

OCC-regulated entities can use the booklet as a resource as they manage the regulatory compliance landscape. The appendices at the booklet’s conclusion are particularly beneficial, as they outline a structured approach to assess risk and provide a framework for evaluating the effectiveness of an institution’s compliance management systems. That said, given the expansive nature of the UDA(A)P prohibitions, there is no one-size-fits all approach. Effectively managing UDAAP risk requires a detailed, institution-specific analysis that takes into account the unique characteristics of the underlying products and services and how they are marketed and delivered to consumers.