Why CFPB Must Share Oversight on Consumer Policy

WASHINGTON — The conventional wisdom is the federal agency born out of the crisis — the Consumer Financial Protection Bureau — is the last word on financial consumer regulatory policy, with other more established regulators playing a supporting role.

But a growing number of experts are putting more stock in the authority older agencies kept in the Dodd-Frank Act to enforce consumer rules at small banks they supervise, and see one policy in particular — the ban on "unfair, deceptive or abusive acts or practices" — where the prudential regulators could carry substantial weight.

"Even though it is clear today the CFPB is the leader on consumer rules, that doesn't have to be the case for every aspect of consumer issues going forward," said Kip Weissman, a partner at Luse, Gorman, Pomerenk & Schick.

Dodd-Frank gave the CFPB vast authority to write rules for banks and nonbanks to comply with preexisting and new consumer statutes, as well as enforcement powers over larger institutions. But the bank regulators — Federal Deposit Insurance Corp., Federal Reserve Board and Office of the Comptroller of the Currency — kept authority to ensure their institutions under $10 billion in assets were in compliance with the statute and any implementing regulations.

That is still the rule of thumb under UDAAP. The law took rule-writing for the old "unfair or deceptive acts or practices" standard for banks away from the Fed — giving it to the CFPB — and also authorized the bureau to write rules around the new "abusive" standard. (The Federal Trade Commission retained rule-writing authority for certain nonfinancial companies.)

But absent a rule, some observers say, the prudential agencies have the ability to put the new standard to work if they see an institution under their watch committing an infraction.

If there is not a rule on the books, "there is an obligation for them to make sure their institutions are not violating the law," said Michael Calhoun, president of the Center for Responsible Lending. "The CFPB has signaled that certainly in the short run they're not going to come out with a wide range of specified unfair, deceptive and abusive rules. … Historically, the CFPB is following the tradition that how this is enforced is through enforcement in individual cases."

In a recent American Banker interview, CFPB Director Richard Cordray said the new "abusive" standard was "pretty well-defined" in the law, and indicated that enforcement actions may be the model for how the standard is established.

"We have given some exam guidance around these concepts, and I think maybe we'll have more to say over time. I don't anticipate us writing a rule around UDAAP," Cordray said. "Again, I think a lot of the law is really clear in that area, and what is maybe not clear to people because they haven't had experience with it has been specifically defined by Congress, so that is what it is. We'll continue to develop as we go."

While interpretations of the law are still being debated, many believe the agencies' surviving authorities — cast against Cordray's remarks — give them significant authority in the UDAAP regime for institutions they supervise under the $10 billion threshold. In addition to outlining the preexisting UDAP framework, Dodd-Frank said abusive acts or practices, among other things, are those that interfere with a customer's ability to understand terms or take advantage of someone's lack of understanding about a product's risk.

The other agencies "could look at whatever regulation is adopted by the bureau down the road, but there is a statute out there that defines abusive. I don't think the bank regulators, if they see a practice that is unfair or deceptive or abusive, I don't think they're going to feel constrained not to use their enforcement powers," said Michael Mierzewski, a partner at Arnold & Porter LLP. "I don't think they have to wait."

With the regulators still in an aggressive stance coming out of the crisis and Dodd-Frank passage, the bureau will likely set the tone for all the agencies on UDAAP and other measures. But if the CFPB does not promulgate a rule, the other regulators would have a strong device for acting in the future if the bureau became less aggressive under different political leadership.

"The whole legislative scheme envisions that new" practices subject to UDAAP "may arise in the future. At that point we may be in a different political environment with different leadership of the agencies," said Weissman. "If in the future the bureau is headed by a less aggressive director and another banking agency is more consumer-oriented, we could see another agency take the lead."

But even though Dodd-Frank gave some guidance about how UDAAP is defined, the path forward is still marked by uncertainty, especially since there have not been any enforcement actions in the new regime.

The industry has been most concerned about the addition of the new "abusive" standard, which some say could cover relatively benign practices, and there is additional confusion about how the three different standards — unfair, deceptive and abusive — could overlap.

"Everything about UDAAP is in flux and to the extent we're trying to pin down clear guidance we're going to have to be patient. It's going to unfold over time," said Jo Ann Barefoot, a co-chairman of Treliant Risk Advisors.

Barefoot said without an implementing rule for the new "abusive" standard, all the agencies have found the pre-Dodd-Frank UDAP authority sufficient in monitoring institutions for compliance.

"The other agencies have been aggressively enforcing UDAAP and will continue to do so. What I hear from the other regulators is the 'abusive' standard isn't an essential tool, since 'unfair and deceptive' is covering the issue," she said. "Over time we'll have more clarity, but right now the regulators are taking the broad mandate under UDAAP and they're all enforcing it, including the bureau."

However, she added, ultimately it will be the bureau that will set the tone.

"My prediction is the bureau will dominate this issue with its enforcement actions and interpretations. It's possible though that one of the other agencies will take a different view," she said. "There is a lot of interagency dynamism. … But the more likely scenario is the bureau will take enforcement actions that amount to guidance for the other agencies."

But some noted there is precedent in the old UDAP regime — which was part of the Federal Trade Commission Act — for a regulator that lacked rulemaking authority to act without there being a specific regulation. Specifically, in 2000, the OCC took action against San Francisco-based Providian Bank for allegedly deceptive credit card marketing practices. At that time, only the Fed had authority to issue FTC-related rules for banks identifying unfair and deceptive practices. (The now-defunct Office of Thrift Supervision had rulemaking authority for savings-and-loan institutions.) But no such rules existed.

In a 2004 American Banker interview, Jerry Hawke, who had been comptroller when the agency targeted Providian, said the OCC had found that even "without the benefit of a defining rule, we could bring an action and prove the facts of a particular case that the conduct was unfair or deceptive." Though the OCC's authority was challenged somewhat at the time, the agency got backing in a written opinion from then Fed Chairman Alan Greenspan.

"When Providian came out, there were those including some at the FTC who thought the OCC didn't have authority to enforce section 5 of the FTC Act because the Federal Reserve Board had not promulgated implementing regulations. … But Jerry Hawke as comptroller wasn't afraid to flex his muscles even in the absence of Fed regulations," said Mierzewski. "Just as the regulators had interpreted section 5 of the FTC act, I think they're going to feel they have the authority to interpret the new abusive standard if they see a practice that satisfies the elements of the statutory language."

Yet industry representatives are hoping for a common approach by the agencies so enforcement is consistent across different charter types.

"Right now we're not seeing any real regulatory activity involving the new 'abusive' area. It's one which the bankers would rather have some upfront, explicit guidance about where future application might occur, rather than see it cited out of the blue in a gotcha approach during an exam," said Richard Riese, senior vice president for the American Bankers Association's Center for Regulatory Compliance.

"The way the statue is written it appears a bank could receive an enforcement action or a supervisory criticism under the new abusive standard without a new rule being written. From an industry perspective, we believe clarity around the new UDAAP standards should be an interagency development."

Elizabeth Eurgubian, vice president and regulatory counsel for the Independent Community Bankers of America, agreed. "Consistent application across all of the regulatory agencies, including the CFPB" is important, she said.