Insights

In the world of consumer financial services, we are all well aware of the variety of federal laws and regulations that govern how we communicate with leads and existing customers and keep sensitive consumer information safe and secure. And some of us, unfortunately, have first-hand knowledge of the penalties that regulators impose when we make mistakes under these standards. A related topic that many of us understand less well, however, is the cost associated with a regulator’s investigation of a possible violation, regardless of whether it leads to an enforcement action.

Focusing on the Federal Trade Commission as an example, the Commission’s investigations typically begin in response to one or more consumer complaints, but they may also be initiated without a single complaint. For example, the FTC might conduct a survey investigation of an entire industry’s practices, and I am also aware of cases in which an investigation began when an FTC employee received a questionable direct mail piece or email or saw a problematic ad on TV.

When the FTC opens an investigation, its information gathering may be in the form of an informal access letter or a formal civil investigative demand, which is like a subpoena. You may be asked to produce responsive documents, submit responses to written interrogatories, or produce people with relevant knowledge for an interview, which may or may not be under oath and transcribed by a court reporter.

The documents, interrogatory responses, and interviews are the FTC staff’s opportunity to determine if the isolated incident that caught their eye is truly an outlier or, alternatively, part of a larger course of conduct. (Of course, even an isolated “outlier” can be a law violation worthy of the FTC’s attention, depending on the facts.)

Almost by definition, this process is a fishing expedition – an overbroad, scattershot effort to find the bigger picture. On TV, judges frown on such broad lines of inquiry; in that context, the claim “fishing expedition” is a pejorative zinger. In reality, though, this process is an accepted FTC practice. FTC access letters and civil investigative demands routinely request information related to several or even ten or twenty topics or more, all generally relating back somehow to the FTC’s core concern.

In any investigation, regardless of the subject matter, you can expect wide-ranging requests for information and documents related to the target’s size, corporate structure, leadership, and personnel. For example, in CIDs that I have seen, the FTC has requested documents sufficient to show all company positions and job descriptions as well as a balance sheet and statement of income and expenses for each year of the FTC’s defined time period.

Within the specific subject matter of the investigation, you can expect many detailed requests covering issues ranging from compliance policies and procedures to training materials to consumer complaints and resolutions of those complaints to internal disciplinary standards and application of those standards in the event of a violation. For example, CIDs I have seen have asked the target to: (1) describe the company’s policies, practices, and/or procedures to ensure compliance with the Fair Credit Reporting Act, including the Fair and Accurate Credit Transactions Act; (2) describe how the company monitors employees to ensure compliance with the Fair Debt Collection Practices Act and the FCRA; and (3) produce documents sufficient to identify and describe any unauthorized access to personal information by or through any user, including but not limited to the types of information accessed without authorization, the methods or devices used to obtain unauthorized access, the causes of such incidents of unauthorized access, and the steps taken by the company in response to each incident.

In short, responding to an FTC investigation, whether formal or informal, is difficult, time-intensive, and stressful. And expensive. Not only will you bear the cost of time spent by in-house personnel; sooner or later, you will likely bring in outside counsel to assist. Even if an investigation is closed without an enforcement action, companies under investigation could be facing dozens of hours of work that does not contribute favorably to the bottom line. Outside counsel will spend a similar amount of time getting up to speed on the investigation, guiding the company response, and negotiating with the FTC. Moreover, frequently, an initial access letter or CID is followed by additional requests for information and perhaps in-person interviews by the FTC with people with knowledge of the facts that prompted the investigation.

This can translate into tens of thousands of dollars or more, even in response to a closed investigation where the FTC decides to drop the matter without taking further action. If, on the other hand, the FTC determines that its investigation supports an enforcement action, that will mean many more hours and resources and much more money and stress as your team tries to negotiate a settlement with the FTC (which is common) or prepares for litigation (which is not). And on top of this, you need to recognize the additional costs associated with investigations and enforcement proceedings by state regulators.

An investment in a robust compliance program can cut a significant percentage of the hours, stress, and money described above. To be sure, compliance efforts bring their own resource demands. However, your investment in robust compliance is virtually guaranteed to be less than the investment required by an FTC investigation. Regardless of how you assess your company’s compliance budget and risk tolerance, it is essential to recognize that the costs of a violation are much greater than the amount of the civil penalty at the end of the process. In many cases, the costs of getting to the penalty will be greater than the penalty itself and also greater than the costs of implementing a robust compliance program.

Michael A. Goodman is a partner in the Washington, D.C., office of Hudson Cook, LLP. Michael can be reached at 202-327-9704 or by email at mgoodman@hudco.com.