Similar to that of her more established, older siblings — the Securities and Exchange Commission and the Department of Justice (and even the PCAOB) — the relatively new-kid-on-the-block Consumer Financial Protection Bureau (CFPB or Bureau) has now provided certain factors it will consider when evaluating enforcement actions by issuing CFPB Bulletin 2013-06 "Responsible Business Conduct: Self-Policing, Self-Reporting, Remediation, and Cooperation." Offending parties subject to CFPB's enforcement authority who seek more favorable results may wish to take proactive measures, or what the CFPB refers to as "responsible conduct." When the offending party applies these factors, the CFPB may consider, for example, to "resolve an investigation with no public enforcement action, treat the conduct as a less severe type of violation, reduce the number of violations pursued, or reduce the sanctions or penalties sought ... in an enforcement action." There is no magic formula provided and no guarantees, but the CFPB has provided a roadmap to enable those under the purview of the CFPB the opportunity to shore up compliance programs now and implement a plan of action upon learning of any potential or actual violations of federal consumer financial laws.
The CFPB identified four factors of responsible conduct, along with a series of questions relevant to each factor, that it considers when evaluating whether credit should be given to a party under an enforcement investigation.
Self-Policing
Under this factor, which is described as "self-monitoring" or "self-auditing," the CFPB evaluates the proactive commitment by a party to utilize preventative resources, such as a robust compliance program, to detect potential violations of consumer financial laws. When evaluating this factor, the CFPB considers 1) the nature, origin and duration of the potential or actual violation; 2) how the potential or actual violation was detected, by whom and how effective self-policing mechanisms put in place to identify or prevent such instances were; 3) results of a party's self-policing mechanisms before and after internal or external evaluations; and 4) the "tone at the top" and culture of compliance by the party.
Self-Reporting
While all the factors of responsible conduct are important in the Bureau's decision to give favorable consideration, the bulletin emphasizes that this category is "worth special mention." Self-reporting advances the CFPB's ability to protect customers by reducing agency resources it would otherwise use to identify potential violations or violations significant enough to warrant an investigation. The CFPB also believes that self-reporting provides concrete evidence of a party's willingness to address any potential or actual violations. The CFPB evaluates 1) whether a party provided complete and effective disclosure to applicable regulators; 2) whether the disclosure was timely; and 3) whether the self-reporting was proactive or merely a response to inevitable disclosure.
Remediation
The CFBP notes that its remedial priorities seek 1) a full redress for those injured by any violations of federal consumer financial laws; 2) implementation of measures by the offending party to prevent future violations; and 3) changes to the offending party's future conduct to benefit and protect consumers. The CFPB considers 1) the steps taken upon learning about misconduct, ceasing the misconduct and implementing an effective response to the misconduct; 2) whether individuals were held responsible for the misconduct; 3) whether the party promptly preserved information, identified the extent of harm to customers and recompensed those adversely affected; and 4) assurances that the misconduct will not recur.
Cooperation
This factor of responsible conduct focuses on the quality of a party's interactions with the CFPB after potential or actual violations become known to the CFPB. A party must take "substantial and material steps above and beyond what the law requires in its interactions with the Bureau." The CFPB evaluates 1) the promptness and completeness by the party to cooperate with CFPB, including the identification of additional misconduct; 2) whether the party undertook a thorough investigation of the misconduct and related behavior and subsequently shared those findings with the CFPB; and 3) whether the party conducted an internal investigation, including participation by the party's employees, and shared those full results with the Bureau.
As noted in our recent post about the CFPB's first referral of a case for criminal prosecution in SDNY, it definitely looks like the CFPB will emphasize enforcement. How it will weigh proactive measures undertaken by parties employing the responsible conduct is yet to be determined.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
