The following is a guest post from Catherine Brown and Paul Marker from Klaros.
Perhaps inspired by his former roles at the Federal Trade Commission (FTC) and as the Consumer Financial Protection Bureau’s (CFPB) Student Loan Ombudsman, CFPB Director Rohit Chopra has made it clear that he embraces an expansive view of the Bureau’s authority to remedy actual or perceived inequities in a range of financial products and services.
In particular, he’s been clear that the Bureau will not tolerate unfair, deceptive, or abusive acts and practices (UDAAP), defined as practices that “cause significant financial injury to consumers, erode consumer confidence, or undermine the financial marketplace,” and that it will use its UDAAP authority to address discrimination, even when traditional fair lending laws do not apply.
Chopra expressed this sentiment during his introductory remarks at the 2020 National Fair Housing Alliance Conference, noting, “The FTC Act [UDAP] can serve as an important gap-filler to combat discrimination across the economy.”
UDAAP manual revised
What that would mean for the banking industry from a supervisory and enforcement perspective wasn’t entirely clear… until last week, when the Bureau significantly revised its UDAAP examination manual.
The manual, which was last updated in 2012, provides additional guidance on how the CFPB defines UDAAP and most notably expands the definition of discrimination beyond traditional bounds of consumer credit.
The revisions define any discrimination involving a consumer financial product or service as “unfair.” They use an institution’s unwillingness to open deposit accounts for African Americans as one example of an “unfair” practice that would also be discriminatory.
With the revised manual, the CFPB is poised to use its broad UDAAP authority as an enforcement tool to combat discrimination throughout the entire product life cycle of every consumer financial product and service, with a particular focus on those areas that existing regulations do not specifically cover, and those that have been relatively untouched by regulators historically.
Together with a blog post published concurrently by the Directors of Supervision and Enforcement at the CFPB, the new guidance signals the Bureau’s use of a disparate impact-like standard “…in all consumer finance markets, including credit, servicing, collections, consumer reporting, payments, remittances, and deposits” to identify discriminatory outcomes.
Standard is controversial
Although the disparate impact standard under ECOA/Reg. B remains controversial, and the subject of potential litigation with the CFPB, that likely won’t matter if the CFPB applies the unfairness standard to address discrimination more broadly, as the Bureau is suggesting it will.
UDAAP can be used in conjunction with or in lieu of technical violations of law/regulation.
A more comprehensive disparate impact standard born from an expanded UDAAP rubric may also mean the CFPB will use Bayesian Improved Surname Geocoding (BISG) proxy methodology in other products/services and novel aspects of the product life cycle, such as loan servicing. CFPB regulated institutions should consider using BISG, in the same way, to identify and remediate discrimination proactively.
Application of those discrimination standards to areas with significant operational or human discretion, which can result in unintentional but disparate outcomes for similarly situated consumers, could prove problematic for financial institutions of all shapes and sizes.
That problem may be further exacerbated if it requires institutions to expand their use of the BISG proxy to identify discrimination.
Although some suggest BISG (which combines geography and name-based information into a single proxy probability for race and ethnicity) is flawed, it remains an essential tool in the CFPB’s proverbial supervisory toolbox. Unless and until the CFPB changes course, any CFBP regulated entity must continue to use BISG as a tool for identifying discrimination.
Rapid remediation expected
Moreover, the CFPB expects institutions to fully and timely remediate the identified consumer harm once discrimination is identified.
Failure to do so may result in the CFPB alleging additional UDAAP violations under the “abusive” standard, as it did when it amended its complaint against Fifth Third Bank in June 2021.
Although not explicitly addressed in the revised UDAAP manual, the CFPB will presumably look for discrimination based on individual/demographic attributes such as the existing prohibited bases established by the ECOA/Reg. B.
It is possible, however, that an expanded UDAAP approach will also include a more expansive view of protected classes, as the Bureau “…will also look more broadly, beyond fair lending, to identify and root out unlawful conduct that disproportionately impacts communities of color and other vulnerable populations.”
This could mean the CFPB will seek to afford greater protections to broader groups of vulnerable consumers on the agency’s radar, such as veterans, elderly, students, borrowers in default, individuals adversely affected by Covid-19, and those who are also on the agency’s radar with Limited English Proficiency.
Enforcement will set benchmarks
Whatever factors the CFPB ultimately applies to identify discrimination, it seems likely that the agency will further flesh out these concepts via enforcement rather than engaging in the cumbersome administrative rulemaking process to provide additional clarity.
Financial institutions of all types should brace for more aggressive CFPB supervision generally and the general use of its UDAAP enforcement authority to address discrimination either singularly or in conjunction with technical violations of other laws/regulations.
They should also closely examine all consumer touchpoints, particularly where discretion may create disparities in the treatment of consumers, such as default servicing.
The traditional first, second, and third line of defense activities (e.g., risk assessments and monitoring and testing) may not be effective in identifying more obscure consumer harm that’s less obvious or intuitive, such as the potential downstream harm resulting from inaccuracies in credit reporting.
Accordingly, all risk and compliance activities should be enhanced, focusing on UDAAP and identifying discrimination and other potential consumer harm, consistent with the CFPB’s evolving approach and expectations.
Identifying and addressing potential consumer harm
Between adopting a more expanded view of vulnerable populations and utilizing the BISG proxy methodology more broadly, the CFPB will be more likely to find disparities and potential consumer harm.
At the same time, the risk and compliance activities financial institutions have traditionally used (e.g., risk assessments, monitoring, and reporting) are less likely to identify and mitigate the increased risk arising from this more aggressive approach to UDAAP and Fair Lending enforcement.
So, how do you identify potential consumer harm that may be lurking in your institution, and what do you do when you find it?
How do you assess your products, service, and processes for these novel risks?
- Assess your enterprise Compliance Management System (CMS) with a robust UDAAP lens to ensure that first, second, and third line of defense activities include a nuanced approach to the identification of discriminatory outcomes and potential consumer harm;
- Analyze your entire suite of products and services, and identify those with the greatest risk of UDAAP exposure, particularly in light of the revised UDAAP guidance and prioritize further analysis of those products, services, and practices;
- Consider the expanded use of the BISG proxy methodology to identify discriminatory outcomes;
- Mitigate risk of discriminatory outcomes (e.g., reduce discretion and bias, adjust fees and other product features, and continuously enhance UDAAP training to reflect emerging issues);
- Document and remediate identified consumer harm completely and in a timely manner, using Attorney Client Privilege protection, as appropriate.
