Insights

You may have heard that the new sheriff in town, the Consumer Financial Protection Bureau, has started enforcing the many laws over which it has responsibility. Just in the past few weeks, it has come down hard on three of the largest financial institutions in the country, Capital One, Discover Card, and American Express, requiring them to pay, in total, hundreds of millions of dollars in refunds and fines.

But, a little-noticed action that the CFPB took on September 20 of this year may have more immediate relevance to small and medium-sized financial institutions. Before explaining what the CFPB did, I will need to give some background.

Civil Investigative Demands

Among the many investigative tools in the CFPB’s toolbox, the civil investigative demand (CID) is the one you are most likely to encounter. The CFPB typically begins its law enforcement investigations by serving one or more CIDs on the target of the investigation and sometimes others who may have relevant information. The CIDs are essentially pre-litigation subpoenas, requiring the company to turn over documents, answer interrogatories, testify under oath at an investigational hearing… or all three. Recipients typically have 30 days to comply. Our experience representing clients who have received CIDs has been that the CFPB is VERY thorough, seeking vast numbers of documents and copious information.

The CID recipient does have some rights, however. Under the CFPB’s rules of practice, the company has twenty days to file a petition to modify or set aside the CID (commonly known as a “motion to quash”) with the CFPB. The motion may be based on some legal infirmity in the CID, the burden of complying with it, the relevance of the documents or information it seeks, or other grounds. The motion is then reviewed by the Director of the CFPB, who issues a decision and order ruling on the objections. While that ruling is pending, the companies’ obligation to comply with the CID is suspended. Although the Director’s ruling is not self-executing, in the sense that the Director cannot punish the company for not complying, the CFPB can obtain enforcement of the CID by filing an action in federal district court.

The Motion to Quash and the CFPB’s September 20 Decision and Order

That leads us to the CFPB’s September 20 action, a decision and order issued by Director Richard Cordray on a motion to quash filed by a CID recipient. PHH Corporation, described as “one of the leading non-depository mortgage companies,” was served on May 22, 2012 with a CID in an investigation to determine whether PHH had violated Section 8 of the Real Estate Settlement Procedures Act through a practice called “premium ceding.” The CID posed 21 interrogatories and included 33 document specifications seeking documents and information going back several years. As directed by the agency’s rules, CFPB’s enforcement staff met with PHH’s counsel to discuss concerns PHH had about the CIDs, including, among other things, the breadth of the demand and in particular the lengthy time period covered. According to Cordray’s decision, staff’s offer to limit the CID in several respects was met by a lengthy list of objections from PHH and little willingness to negotiate.

On September 20, Cordray denied the petition to quash in full. As this was the CFPB’s first ruling on a petition to quash, the decision describes the basis for the ruling in a great deal of detail.

The decision first explains why CID specifications are often very broad – at this early stage of an investigation, there is usually an “information gap” between the staff and the company, and the purpose of the CID is to provide the staff with enough information to close the gap and permit them to make a reasoned judgment about the substance of the investigation. It is the company’s responsibility, the decision asserts, to work with the staff to narrow and clarify the scope of the CID and to do so in a constructive and forthcoming way, not by taking a “scorched earth” approach.

As the decision notes, there is extensive precedent governing the enforceability of CIDs and other forms of administrative discovery, most of which involves Federal Trade Commission cases dating back many decades. Those cases emphasize the broad investigative powers of a federal agency, which the Supreme Court has likened to a grand jury’s power to investigate on a mere suspicion of wrongdoing. Thus, the courts have consistently enforced CIDs and subpoenas if (1) the investigation is for a lawful purpose, and (2) the information requested is relevant to that purpose, unless the request creates an “undue burden” or is an abuse of process.

Cordray’s decision next turns to PHH’s specific objections. First, PHH had argued that the CID did not provide it with sufficient notice of the purpose of the investigation. The decision, however, recounts all of the ways in which PHH was advised of that purpose.

Second, PHH had contended that the CID was overbroad and posed an undue burden (describing it as a “fishing expedition”). The decision rejects this contention, noting again the necessarily broad scope of the demands at the early stages of the investigation and asserting that PHH failed to cooperate despite staff’s willingness to narrow the CIDs. As an example of this failure, Director Cordray recounts that the enforcement team offered to consider modifying the time period covered by the CID if PHH could explain the “specific nature of the burden” PHH would bear if it were required to collect the information. Claims of overbreadth and burden must be specific, detailed, and supported by evidence. Instead, according to the decision, PHH’s petition “contains only generalized assertions and suggestions devoid of any tangible detail.”

Finally, the decision also rejects PHH’s argument that the time period covered by the request was too long and extended beyond the applicable statute of limitations. Even if the practices to which the information relates are not themselves actionable because of their age, the CFPB can still require that the company turn over that information if it might shed light on practices that are within the statute of limitations, for example by showing the company’s original intent.

The decision closes with a summation of what a company like PHH should not do when it receives a CID:

PHH primarily objected to the burden imposed by the CID, yet it refused to produce personnel knowledgeable about the information technology issues necessary to have an informed discussion of the issues, to provide information about the volume, format, location, and accessibility of any potentially responsive data, or even to propose a timetable to obtain such information ….

Notably, the decision also requires PHH to respond to the entire CID within 21 calendar days of the decision, although it leaves open the possibility that the CFPB’s enforcement team would be willing to consider further suggestions from PHH concerning modifications to the CID. The point seems clear: either cooperate in the process through substantive discussions with the CFPB’s enforcement team concerning the scope of and specific burdens imposed by the CID or respond to 21 interrogatories and 33 documents requests within 21 days.

Lessons

Here are some lessons that financial institutions subject to the CFPB’s enforcement powers can learn from this episode:

• You may well receive a CID from the CFPB, even if they only suspect you may have done something wrong. If you do get a CID, don’t ignore it. Have an action plan in place beforehand so that you can react quickly when the time comes. The plan should include having a response team that includes your compliance officer, in-house counsel, and, if appropriate, outside counsel. Make sure that you suspend any routine document destruction policies while the CID is pending.
• The CID probably will be broad, extensive, and expensive to answer. But, don’t panic! CFPB staff usually are willing to consider narrowing the CID, granting more time to respond, or both, if you can show that they don’t need all that information to investigate the issues about which they are concerned (at least at this stage) and that full production would be unduly burdensome. But, you must be specific about what the burden would be and prepared to back it up with hard numbers. For example, you should prepare estimates of the number of documents that might be responsive to the CID and the number of hours it would take your employees or contractors to gather the documents and at what cost.
• Because the CID will require the production of Electronically Stored Information (ESI), your estimates should factor in the costs associated with this production. Given the volume of ESI a typical business stores and the organization (or lack of organization) of the ESI, you should consider involving an e-discovery vendor in the process as early as possible unless your business already has the necessary technical professionals in-house who have significant e-discovery experience.
• Approach the meet-and-confer sessions in a spirit of cooperation. You will need to have available people who are familiar with your ESI records management system. The CFPB enforcement team will almost certainly include ESI professionals who will be advising the enforcement attorneys throughout the process. The CFPB will not be intimidated, or dissuaded, by technical responses to complex ESI production issues and will have the expertise to determine whether objections concerning the burden imposed by ESI production requirements are well-founded.
• By all means, present your arguments vigorously – you don’t have to accede to everything they want, and you may need to file a petition to quash if you can’t come to a reasonable agreement. But, as the September 20 decision and order indicates, stone-walling the CFPB usually is not going to be productive.

Joel Winston is a partner in the Washington, DC office of Hudson Cook, LLP. Joel can be reached at 202-327-9716 or by email at jwinston@hudco.com.