Preparing for a CFPB Examination: Don't Overlook Your Obligations to Audit Service Providers

Jeff Dickey

For months now, the ARM industry has been anxiously awaiting the final rule from the Consumer Financial Protection Bureau defining the Larger Participants in the Consumer Debt Collection Market.  The rule, released October 24, 2012 and taking effect January 3, 2013, will determine the companies that will be subject to the supervision and examination authority of the CFPB.

There has been a great deal of prognostication on this site and others as to what impact this will have for the ARM industry, and moreover, how far the tentacles of the CFPB will reach out to touch various participants in this marketplace as a result of the definition of a larger market participant. One thing that hasn’t been covered is the impact on service providers to the larger market participants.

The CFPB’s real goal in publishing the rule was to define and identify the larger participants of the collection market in order to establish a process to audit and supervise a significant segment of the market activity.  Just because a company may not meet the CFPB’s definition as stated in the Larger Market Participants rule, one should not assume they are immune from the regulatory oversight of the CFPB or operate outside of its enforcement authority.

Additional Requirements of Larger Market Participants

While the effort by the CFPB through this rule was to capture a significant portion of the overall collection market activity though regulating the industry’s larger participants, the CFPB has issued a number of bulletins further defining obligations of all market participants designed to widen the net of audit and supervision authority cast by the CFPB.  On (Friday) April 13, 2012, the CFPB released a little known and seldom discussed bulletin entitled simply Bulletin 2012-03 with the subject line Service Providers.  This bulletin outlines the Bureau’s expectations of banks and non banks under their supervision and enforcement authority to be able to among other things:

“verify that the service provider understands and is capable of complying with Federal consumer financial law;”

The preamble of the bulletin states the following:

The Consumer Financial Protection Bureau (“CFPB”) expects supervised banks and nonbanks to oversee their business relationships with service providers in a manner that ensures compliance with Federal consumer financial law, which is designed to protect the interests of consumers and avoid consumer harm. The CFPB’s exercise of its supervisory and enforcement authority will closely reflect this orientation and emphasis.

The CFPB expects supervised banks and nonbanks to have an effective process for managing the risks of service provider relationships. The CFPB will apply these expectations consistently, regardless of whether it is a supervised bank or nonbank that has the relationship with a service provider. 

To limit the potential for statutory or regulatory violations and related consumer harm, supervised banks and nonbanks should take steps to ensure that their business arrangements with service providers do not present unwarranted risks to consumers.

By issuing this bulletin, the CFPB has placed a new requirement on all collections market participants to establish a policy and set of procedures to audit and continually monitor the compliance of their service providers.  Furthermore, under Title X of Dodd Frank, the CFPB is granted supervision authority over supervised service providers, including its authority to examine for compliance as outlined in the bulletin below.

B. The CFPB’s Supervisory Authority Over Service Providers

Title X authorizes the CFPB to examine and obtain reports from supervised banks and nonbanks for compliance with Federal consumer financial law and for other related purposes and also to exercise its enforcement authority when violations of the law are identified. Title X also grants the CFPB supervisory and enforcement authority over supervised service providers, which includes the authority to examine the operations of service providers on site.  The CFPB will exercise the full extent of its supervision authority over supervised service providers, including its authority to examine for compliance with Title X’s prohibition on unfair, deceptive, or abusive acts or practices. The CFPB will also exercise its enforcement authority against supervised service providers as appropriate.

What Defines a Service Provider Relationship?

Over the last six months I have discussed this topic with a number of the industry’s most respected attorneys, operations managers, thought leaders and trade association leaders to get their feedback and opinion about this topic.  Many of them, without the benefit of reading the bulletin first, incorrectly assumed they would not be held accountable for the actions of their service providers, or felt certain third party service providers with which they interacted would not be held to the definition outlined by the CFPB in this bulletin.  It is worth noting that when defining a service provider relationship, the CFPB deliberately avoided such criteria as “financial consideration” or “substantial assistance” and yet settled on a broader definition of “material service”.  Furthermore, it is interesting that the CFPB also noted that a service provider may not be affiliated with the person to which it provides a service.