CFPB Dragnet May Inflate Processing Costs for Community Banks

WASHINGTON — Community bankers are up in arms after one of the largest core processors told institutions it will likely raise costs because of a data collection effort undertaken by the Consumer Financial Protection Bureau.

Fiserv recently sent a letter to bankers saying it could raise fees later this year because of the time and cost involved in complying with a CFPB order to obtain a large amount of anonymized data on overdraft activity at banks.

The CFPB sought such data late last year from the three largest core processors, viewing it as more efficient to gather information that way rather than from individual banks. Though CFPB's intentions have been clear for some time, bankers said they were surprised by the amount of information being collected and the fact that it may drive up their own costs.

"Why should community bank processing costs go up because CFPB wants to do some research?" said Cam Fine, president and chief executive of the Independent Community Bankers of America. "This also raises serious customer information privacy and security issues as well as cost issues."

All three large processors — FIS, Fiserv and Jack Henry & Associates — confirmed that they have received and are complying with the data request, scrubbing it of any information that would point to individual institutions. The CFPB initially sent the request in November, which was largely related to information about overdraft programs.

The agency launched a public inquiry on overdraft in 2012, and is planning to issue new rules governing them in October. CFPB officials said that they were asked by community bankers who "urged" them to broaden their study on overdraft to include smaller banks.

But it wasn't until Fiserv said it might raise costs that some bankers said they became aware of the order specifically sent to core processors, as well as what it would cost them.

"In our case, the first time we knew about the CFPB's data request was in the letter we received from Fiserv," said Jack Hartings, president and chief executive of $445 million-asset The Peoples Bank Co. in Coldwater, Ohio. "The major processors service most of the community banks which are outside of the CFPB's exam authority. This is the kind of authority that goes outside of what we considered normal and prudent steps that were made in in the past."

In the Fiserv email sent to clients and obtained by American Banker, the company said providing the data to the CFPB "creates a significant expense for us" that might have to be passed on to banks.

"The CFPB asserts it is within their statutory power to impose these costs on the industry they regulate rather than fund them from their own budget, and to that end we are tracking our costs carefully with the likelihood that these will be passed through to our clients on our hosted bank platforms," the notice said. "We are committed to provide an estimate of the impact to each of our clients by the end of August 2015."

In a follow-up statement emailed to American Banker, the company said "compiling this information will require many thousands of hours of internal effort to extract, review, format and transmit the data as specified in the order … We believe our clients appreciate our transparency and our commitment to working with them individually to answer any questions this order raises."

Fiserv is the only core processor among the big three to announce a potential cost increase, but collectively they provide services to thousands of community banks across the country.

"We estimate that those three processors service about 85% of the community banks in the country," Fine said. "We're talking about data on millions of consumers."

The CFPB did not disclose the original request sent to the servicers but said it was all related to its study of overdraft programs, which has been public for some time.

The agency had already sent a similar inquiry to the largest banks that it supervises. Though it does not examine banks with less than $10 billion in assets, the entire industry could still be subject to overdraft regulation. In that case, the agency argues it's important for community banks to be a part of its overall market study before rules are written.

"The CFPB is currently weighing what protections are necessary related to overdraft products. To do that, we want to fully understand the overdraft practices at banks and credit unions of different sizes, a goal that has been encouraged by small institutions," said Moira Vahey, a CFPB spokeswoman. "This information request was designed give us insight into the overdraft experience at smaller banks and credit unions, with minimal burden on these institutions. Other institutions participating in this request have complied or are in the process of complying. We expect Fiserv to comply as well and will continue to work with the company to better understand any unique challenges with this request."

However, Fiserv and Fine said the data request is bigger than anticipated. The CFPB is seeking roughly 60 different data points from each bank's systems, according to the email that Fiserv sent to clients. The data is scrubbed of identifiers and Fiserv told clients that the "CFPB assures" them it won't be used against an individual bank.

"We and other major financial processors were served with an order by the Consumer Financial Protection Bureau (CFPB) to report anonymized data about the overdraft-related system settings in use within our large number of outsourcing clients. These settings define how overdrafts are identified and processed, how their duration is measured, and how, what and when fees are assessed," Fiserv said. "We notified our clients of the order to ensure they are aware of this CFPB initiative, and to assure them that all data is being provided in anonymized form that cannot be tied back to any individual institution."

Core processor Jack Henry said it also received the request, but added that it does "not have any plans to raise costs as a result of this data request."

"Jack Henry & Associates received and complied with the recent CFPB request to provide information regarding hosted client overdraft programs," the company said in an emailed statement. "The data provided did not identify specific financial institutions' identities nor did it contain personally identifiable information regarding consumers."

In its own statement, FIS said it "anonymized all of the data" given to the CFPB "which means no FIS clients or FIS client customers are identified in the data we have shared with the CFPB." But it did not respond to a question on whether it would raise costs as a result.

Still, Fine suggested the CFPB should have chosen to do a less-costly "sampling" of the industry instead. He is also doubtful about the protection of the data.

"The CFPB's unwarranted overreach could put community banks into a liability trick bag in regard to individual customer financial data," Fine said. "At the very least, the CFPB should make every bank whole that is forced to pay more for processing costs to feed the insatiable CFPB research beast."

Peoples Bank's Hartings said that most processors have a caveat in the contracts that allows for any unexpected costs imposed by a regulatory request to be passed through to the bank.

"Because of that, we don't have a lot of say in these contracts," Hartings said. "Technically, we are not under the supervision of the CFPB. And yet, they're costing us dollars and cents."