The following is a guest post from Lauren Sartwell & Siena Marr, Klaros Group.
On Aug. 10, 2022, the Consumer Financial Protection Bureau (CFPB) issued an interpretive rule aimed at digital advertisers who “commingle” the targeting and delivery of advertisements for financial products with the provision of advertising “time or space.”
At first glance, this action may appear to be a shot across the bow at big tech. Still, its impacts are far broader: the rule opens a large swath of personal finance companies, loan platforms, and financial product comparison sites to CFPB oversight and enforcement actions related to unfair, deceptive, and abusive acts or practices (UDAAP). These companies must prepare for increased oversight from their banking partners and bolster compliance and reporting capabilities to weather regulatory examinations.
The “time or space” exception in the Consumer Financial Protection Act (CFPA) aimed to shield advertisers who provided physical space or airtime for advertisements for financial products and services.
In a time when “advertising” meant buying time on network TV or radio or in mass market print publications, this protection made sense, but as technology, analytics, and algorithms have evolved, two things have happened: companies increasingly use “sophisticated behavioral targeting techniques” to market to consumers, and digital advertisers have assumed much of the strategic and technical work behind the targeting and delivery of advertisements.
In doing so, advertisers have taken on a role that financial services companies used to take on in-house, thereby becoming, in the CFPB’s definition, “materially” involved in the targeting of advertisements for financial products and services.
If the CFPB says it’s so…
The interpretive rule expands the range of companies considered “service providers” under the CFPA, noting that “Digital marketers that are involved in the identification or selection of prospective customers or the selection or placement of content to affect consumer behavior are typically service providers for purposes of the law.” Companies that previously fell outside the CFPB’s definition of the service provider must now look closely at their business relationships with financial services companies to determine whether they fall within this expanded definition.
So, digital advertisers are service providers now?
If you determine that the new interpretive rule makes your organization a service provider to one or more financial services companies, watch out: The CFPB’s 2016 Compliance Bulletin and Policy Guidance on service providers grant the CFPB enforcement authority, stating that “the CFPB will also exercise its enforcement authority against supervised service providers as appropriate,” and outlines regulatory expectations for service providers.
Your financial services partners need a more hands-on approach to overseeing their relationship with your organization. Now is the time to begin preparing for this scrutiny.
How can you prepare?
In preparation for increased due diligence from your partners and oversight from the CFPB and state regulators, you can ensure your organization has the programs, documentation, and data to pass muster. As a digital advertiser, this means formalizing and documenting your compliance programs and ensuring you can effectively and efficiently furnish the data and documents your product partners may need for a regulatory examination.
Your financial services partners are responsible for ensuring you, as a service provider, do not present unwarranted risks to consumers.
Proactively formalizing and documenting your compliance program and related functions will ease tension and ensure a smoother due diligence process.
Demonstrable strength in your compliance program will look like: documentation on model risk management (including model inventory, list of attributes, documented testing and validation, and fair lending assessment of outputs), as well as an up-to-date and accessible repository of policies, procedures, training materials, and documentation of your marketing review process.
The service provider designation allows your organization to direct regulatory examination and enforcement.
Digital advertisers, now categorized as service providers, should put structures and data retention standards in place to streamline the reporting process.
You should ensure you have access to all data and documents your product partners may need for an examination, including terms of service, privacy policies, product experiences, and disclosures; documentation of what offers the customer saw and which they selected; the words that were presented (e.g., rates, fees, payment amount, etc.); and your marketing repository (including targeting criteria, what was sent, to whom, where, how, and when, and the marketing collateral itself).
The bottom line
In an age where digital marketers can no longer claim to provide “time or space” for the advertisements of their financial services partners, the expectations of partners and financial regulators are mounting. Taking steps to bolster your organization’s compliance programs and reporting capabilities can now strengthen your relationship with your partners and shield you from enforcement action down the road.
