Banks Fear Confidentiality of Data Shared with CFPB

WASHINGTON — Richard Cordray extended an olive branch to the banking industry last week when he said the Consumer Financial Protection Bureau would support legislation to protect data that institutions provide during exams.

But the problem is far from solved.

Although banks are pleased with the agency's position, the industry is concerned that until the law is changed, plaintiffs could argue that the bank waived its attorney-client privileges when it turned the information to the CFPB. In such cases, a bank could be subpoenaed to provide confidential data that might be used against them in a lawsuit.

"Once privilege is waived, it's waived," said Richard Riese, senior vice president for the American Bankers Association's Center for Regulatory Compliance. "A bank can't just say, 'I'll share it today and maybe you'll resolve the waiver issue in a year.'"

House Financial Services Committee Chairman Spencer Bachus and Rep. Shelley Moore Capito, R-W.V., called on the CFPB last week to stop requesting privileged information from banks until the panel can at least hold a hearing on the issue — one is scheduled for Wednesday — and until a permanent legislative fix is enacted.

But the letter is worrying some banks, specifically those who have already turned over privileged information, or are poised to do so.

While banks agree publicly with the bureau's analysis that sharing information is not a waiver of privilege, privately some have doubts that the argument would protect them in court. If they have to rely on the bureau's legal argument as a defense against subpoenas, the last thing banks want is a Congressional record suggesting there are holes in that argument, sources said.

The CFPB has argued that banks have nothing to worry about.

In a bulletin issued last month, CFPB General Counsel Len Kennedy said the bureau is the same as any other bank regulator. When a bank turns over privileged information to the Federal Reserve, Federal Deposit Insurance Corp. or the Office of the Comptroller of the Currency, it is not considered a waiver of privilege, nor would it be when they turn information over to the bureau.

Banks operated for years without the protection in statute because the regulatory policy was always upheld by the courts. But conflicting legal decisions in the early 2000s prompted Congress to put the policy into law in 2006.

When the CFPB was created by the Dodd-Frank Act, however, legislators failed to add the bureau to the list of banking regulators for which privilege is exempted.

Cordray said several times last month that the agency would support an amendment that would fix what he called an oversight if it would allay industry concerns. But he made clear at a press briefing with reporters on Jan. 13 that he doesn't think it's necessary.

"If the banks want to get us listed in the statute, we would welcome that. It would put this entirely at rest," he said. "I personally don't think it's needed. It didn't exist for the other banking agencies until fairly recently."

Cordray has not supported any particular legislative proposal. But a provision to amend the statute has been added to a bill, sponsored by Capito and Rep. Carolyn Maloney, that would allow banks to appeal their exam ratings.

In the meantime, the agency has pledged to take "all reasonable and appropriate actions to rebut" claims of waiver if a supervised institution were ever faced with one, the bulletin said. As other regulators have argued, the disclosure is not voluntary — it's a requirement of the supervision process — and doesn't constitute a waiver. It hasn't revised its policy in light of the Bachus letter.

But lawyers said that doesn't provide much comfort.

"If people were confident in that argument, they wouldn't have passed the statute," said Oliver Ireland, a former Fed official and partner with the law firm Morrison & Foerster.

What is privileged information? It generally includes any communication from a bank's lawyer offering legal advice, which would include the best legal argument in support of the bank, and the best argument against it.

Observers said the law assures banks that such advice won't be viewed by third parties, who could use the legal weaknesses outlined by the bank's own attorneys to mount a case against it.

Changing those dynamics could have significant implications for the supervision process, observers said.

If a lawyer thinks the information could be viewed by others, he will likely leave the bank's legal weaknesses out of the memo, or simply stop putting that advice in writing, bank lawyers said. In turn, the banks may stop telling their lawyer everything, or stop proactively addressing problems.

"The privilege is designed to encourage a client to be completely candid with their lawyer, and to allow their lawyer to be explicit about the legal risks facing the client," said Eric Mogilnicki, a partner with the law firm of Wilmer Hale who advises financial institutions on CFPB matters. "Our legal system has long assumed that it would corrode the attorney-client relationship if neither could be sure that their communications would remain confidential."

As it is now, banks are supposed to be finding their own problems, and examiners are evaluating how well the banks have dealt with those issues, in addition to reviewing other information, said JoAnn Barefoot, a co-chairman with Treliant Risk Advisors.

But banks are fearful that if they have to share all of their internal communications with the bureau without the waiver exemption, "they almost don't dare look under the covers," she said.

"Speaking as a former deputy comptroller, the entire examination process relies upon an assumption of trust and openness, and if that were to break down and banks were to feel like they could or should hide information from examiners, the entire system would fall apart," Barefoot said.

Driving these fears about privileged information are further concerns about the types of information the bureau intends to collect, and how it intends to share it.

In the same bulletin on privilege, the CFPB also said supervised institutions may not selectively withhold documents based on their judgment that the materials "are not necessary to the bureau's execution of its responsibilities or that other materials would be sufficient to suit the bureau's needs."

"The supervisory process is based on the supervisor's full and unfettered access to information, and the supervisor is entitled — indeed, duty bound — to ensure that it thoroughly understands the institution in question and has access to all information that, in its independent judgment, may bear on its supervisory responsibilities," the bulletin said. "Failure to provide information required by the bureau is a violation of law for which the bureau will pursue all available remedies."

The industry has argued, however, that the bureau's jurisdiction only extends to consumer financial services and products.

Some have also expressed concerns about the agency sharing that information with other law enforcement officials — specifically, state attorneys general — in the course of investigations.

Banking regulators have always been able to disclose bank supervisory information at their discretion to third parties, Ireland said. But they have exercised that authority with discretion, and often only shared information during the course of a joint investigation to compare notes, he said.

The concern among banks is that the information — especially if it concerns an issue beyond the consumer lending space — could be taken out of context.

"When I was at the Fed, we shared exam information — even with other federal agencies — only very, very carefully," Ireland said. "Because you don't know what other people are going to do with it, you don't know how its go to be interpreted, particularly if you're not giving it to another bank supervisor."

Some banks have considered asking the CFPB to obtain the information through the prudential regulator, which might prevent them from sharing it with others. The CFPB is still working on an interagency memorandum of understanding that would clarify how supervisory information would be shared among the regulators.

Some observers acknowledged that these concerns are largely theoretical at this point — the prudential regulators don't often request privileged information anyway, and they expect CFPB to act with the same discretion. The bureau also hasn't been pushing banks for overly broad types of information yet.

Barefoot said her firm is advising consultants to be guided by their attorneys on the question of turning over privileged information, but they are emphasizing the importance of being cooperative and transparent with examiners.

A legislative fix could give the industry more confidence that information will be kept private, and encourage them to look more closely at potential risk, thereby enhancing the bureau's exam process.

"Because if the banks all go and find their own risks on their own and share that in an open, constructive way with the examiners and show them what they're doing about it, the whole industry will move to a better (compliance) performance faster than if they waited for the bureau to find their problems," she said.