-
The Consumer Financial Protection Bureau finalized its first rule, took its first enforcement actions, and landed its first deals with state regulators and municipalities to enhance data sharing all during the agency's first year. The CFPB's most challenging work, however, is still to come.
January 2
The ink wasn't dry on the consent orders when the plaintiffs' lawyers started filing suit.
Three major credit-card companies paid more than half a billion dollars in fines and customer restitution as part of settlements reached with the Consumer Financial Protection Bureau and other federal regulators in the second half of 2012. Immediately following these settlements – and in one case, while the investigation was still pending – plaintiffs' lawyers filed class action shareholder derivative suits against the directors and senior officers of these companies based on the investigative findings of and settlements with the CFPB and other regulators.
The suits follow a clear – and familiar – pattern: allegations describing the defendants' compliance policies and public representations about them, followed by allegations citing extensively from the investigations or settlements, and then claims asserting that the defendants' alleged failure to follow their own policies (evidenced by the regulators' actions) establishes breach of fiduciary duty, mismanagement or unjust enrichment.
The emergence of private law suits filed after CFPB investigations is hardly surprising. These types of follow-on or piggyback suits historically have occurred after regulatory actions, including those by the Federal Trade Commission, the Securities and Exchange Commission, and the Department of Justice. Extrapolating from prior types of follow-on litigation to provide guidance for these new suits is challenging, given that the CFPB is a new – and somewhat different – agency, with only a year of regulatory work and a handful of sizable settlements, and these suits are still in their early stages. Still, this new version of follow-on litigation does suggest some trends.
First, the judicial backlash against potential abuses of previous piggyback litigation already may have had a limiting effect. For example, in litigation asserting claims of false advertising or state consumer protection claims based on FTC settlements involving claim substantiation, for example, courts have required affirmative evidence of actual falsity, not just mere lack of substantiation. Courts have dismissed suits alleging violations of Rule 10b-5 and the Private Securities Litigation Reform Act of 1995 for failure to plead particularized factual allegations of fraud where the complaints merely repeat defendants' public compliance representations and allegations from SEC investigations for failure.
Against this backdrop – and perhaps to avoid adverse precedent – the three CFPB-related lawsuits allege only state common law claims: breach of fiduciary duty, corporate waste and mismanagement and unjust enrichment.
Second, the CFPB enforces statutory schemes that provide greater room for private rights of action than has been at issue in other follow-on litigation. Consumer suits following FTC settlements, for example, encountered judicial opposition in part because the FTC Act does not provide a private right of action. In contrast, a number of the statutes and regulations the CFPB now oversees expressly do.
Third, the number of companies subject to CFPB regulation is potentially huge, and many are smaller businesses that, unlike the large and sophisticated companies defending these current suits, may still be struggling just to understand their responsibilities to the CFPB.
The Bureau has the authority to regulate all nonbank entities of any size that offer financial products or services in residential mortgage, private education lending and payday lending markets and “larger participants” in offering other consumer financial products or services, including debt collection, consumer reporting, auto financing and money services businesses, as well as “service providers” to these consumer financial services companies.
Many companies (like those service providers, which can include firms as far afield as marketers, public-relations agencies and data storage companies) are not yet aware that the CFPB could be looking over their shoulder. Even those that realize they are subject to Bureau oversight may not yet know how to meet their compliance requirements. Still others may recognize an immediate need to prepare for CFPB oversight or even investigations, but may not recognize their exposure to significant private litigation.
Given that follow-on litigation is common in other regulatory contexts and emerging in the context of CFPB investigations, all companies subject to CFPB regulation should, at a minimum, consider conducting their internal evaluations of potential compliance deficiencies with a view toward minimizing their risk of second-stage exposure to private litigation.
