Insights

The Consumer Financial Protection Bureau (CFPB or Bureau) markets itself as the federal government's new "cop on the beat to patrol the consumer financial services markets." Since even its marketing scheme evokes a strict law-and-order regime, it should come as no surprise that the Bureau is approaching the markets it regulates with an "enforcement-first" attitude. But no CFPB lawsuit proceeds without some formal fact-gathering beforehand, often in the form of the Bureau's primary investigatory tool, the Civil Investigative Demand (CID).

How likely is it that you could be the lucky recipient of a CID? Consider the following. The CFPB's budget is roughly $583.4 million for FY 2014. The Supervision, Enforcement and Fair Lending Division, the part of the CFPB that issues CIDs and conducts enforcement actions, has a budget of nearly $165.3 million, nearly 30% of the Bureau's entire budget. In addition, the $165.3 million figure represents a tremendous increase from the $105.5 million budgeted for the same division in FY 2013. In short, the Bureau's increase budget likely means more CIDs in the future.

A CID is how the CFPB begins a formal investigation. For recipients, it means the Bureau has taken the first step in its ultimate goal of initiating an enforcement action (lawsuit) and/or entering into a settlement agreement. Either a settlement or an enforcement action will typically require the recipient to change its business practices and to pay a penalty, which can vary greatly in terms of magnitude. In some cases, the CFPB has conducted its investigation without pursuing a formal enforcement action against the recipient of a CID. In most cases, however, a CID typically ends with a lawsuit or settlement.

Here are some basic statistics regarding the CFPB's enforcement actions since it opened its doors. The majority of its cases have settled. Excluding one case where a defendant in bankruptcy paid a $1 penalty, the penalty amounts have ranged from the low five figures ($34,000 for technical errors in data reporting) to several million dollars ($25,000,000 for "unfair or deceptive" billing practices). The Bureau assessed these civil money penalties in addition to any "restitution," which can reach into the hundreds of millions of dollars (Bank of America recently paid more than $700 million in restitution to settle claims about its billing practices for certain credit card products). Restitution derives from the alleged harm to consumers as determined by the CFPB. Between civil money penalties, restitution and legal defense fees, resolving a CID can be costly.

However, before you even consider the monetary amounts that are potentially at stake, you should be aware of the difficulties and procedural hurdles that are involved with responding to a CID. In a word, they can be burdensome. Here are a few practical considerations:

CIDs require you to provide voluminous information.

A CID is, in its initial stages, a massive exercise in information-gathering for "specifications" that come in one of three forms: (1) Interrogatories; (2) Requests for Documents; and (3) Requests for Written Reports. Each type of specification requires a different sort of information from the recipient. An initial CID can also include a request for oral testimony, but that usually comes at a later stage in the process.

An interrogatory typically requires you to provide a narrative response that describes or explains your business practices. It can also provide into what practices the Bureau may be targeting. Like its name suggests, a request for documents requires you to produce written material concerning a given topic. Satisfying the CFPB with your responses to their requests for documents will be the most difficult and time-consuming aspect of your response. The CFPB often words its requests for documents in the broadest possible terms. For example, a CID specification may request all documents "related to" the way in which you market your private loans to students. When the Bureau says "related to", be prepared for a heavy lift to provide a complete response. The CFPB usually wants all emails, meeting notes, and correspondence -- basically, any thought committed to writing that in any manner-that references or concerns the given topic. A single request for documents "related to" consumer complaints, for instance, could yield millions of pages of responsive materials.

A written report can also require significant legwork for the CID recipient. Essentially, a request for a written report requires that you provide varying sets of data. For example, the Bureau may request that you compile a table providing data on employment outcomes for your students. It may sound simple enough, but difficulties arise when the Bureau wants you to provide data that is not conveniently available. This could result in your needing to create tables or other reports based on information that does not exist in electronic format, requiring you to construct data from a manual review of your files. As you can imagine, a manual review of even a smaller collection of files can be resource intensive.

Many aspects of the CID are negotiable.

There is much about the CID that you can negotiate. From the time you receive the initial CID, you have opportunities to negotiate the terms, conditions, and timeline for responding to the CID. The first opportunity to modify the CID is called the "meet and confer" session, which usually occurs within ten days of receiving the CID. This is an informal session where you can advise the Bureau of specifications that will be particularly burdensome and clarify any vague language. Perhaps most importantly, you can also request extensions of time for your response, since the response time for a CID can be unrealistically short. If you make any requests to modify the terms, conditions, or timing of the CID, be prepared to have a clear rationale for why you seek a modification and suggest modifications that will work for you and still get the Bureau adequate information to meet its needs. This means that you need to realistically estimate your time, effort, and cost to comply with the CID.

Although the Bureau, in my experience, will be reasonable in considering your request, a modification, in particular an extension of time, is not automatic. Thus, you should prioritize what modifications are important to you and plan accordingly for the meet and confer session. If you are unable to secure any agreement from the Bureau regarding modifications during the meet and confer, there is a formal option to submit a written "Petition to Modify or Set Aside" the CID. However, if you decide to file one be prepared for disappointment; the Bureau has denied all petitions that have been filed to date. The better tactic is to secure what modifications you can during the meet and confer session and obtain agreement to revisit certain issues as appropriate. Building goodwill up front helps as you get farther down the road in responding to the CID. Glitches or other bumps in the road almost always arise.

The way in which you respond to a CID matters.

While it is technically enough to provide the Bureau with the information it requests through its CID, some proactive conduct on your part may go a long way in reducing any liability you face down the road. The reason for this is that the CFPB issued a bulletin entitled "Responsible Business Conduct" in June 2013.[1] According to the bulletin, "a party may proactively self-police for potential violations, promptly self-report to the Bureau when it identifies potential violations, quickly and completely remediate the harm resulting from violations, and affirmatively cooperate with any Bureau investigation above and beyond what is required." Any of these actions may constitute "Responsible Conduct" under the terms of the Bulletin. Responsible Conduct can have real effects on the type and severity of the enforcement action that the Bureau ultimately pursues. In the best scenario, the Bureau would pursue no public enforcement action against you. In other circumstances, the Bureau could pursue "a less severe type of violation, reduce the number of violations pursued, or reduce the sanctions or penalties sought by the Bureau in an enforcement action."

All of this comes with the caveat that the Bureau is not required to award any credit for Responsible Conduct. In fact, the Bulletin warns that no consistent formula can be applied to all enforcement actions to accomplish the Bureau's goal of protecting consumers. Despite these warnings, you should evaluate whether it makes strategic sense for you to pursue any of the circumstances that the Bureau would consider to be Responsible Conduct.

The initial CID is only the first step in a long process.

Maddeningly, despite the burden and expense required in responding to a CID, your response is only the first step in what is ordinarily a very long process. An initial CID requesting general information may be followed by a second CID that is more specific. Moreover, initial requests for interrogatory responses and documents will be followed by specific requests to hold "investigational hearings." Think of an investigational hearing as a deposition. There, CFPB lawyers will interview relevant personnel in a formal, on the record, proceeding. However, Bureau rules limit the ability of your attorney to interject or respond during the proceedings. Investigational hearings may be followed by still more requests for additional documents, interrogatory responses, or written reports through supplemental CIDs.

When these information-gathering steps conclude, you should expect that the CFPB will provide you with a Notice of Opportunity to Respond and Advise (NORA) through a letter or phone call. The NORA will formally advise you that the CFPB seeks to start an enforcement action against you through filing a lawsuit and it should explain the charges upon which it would base the action. The CFPB will ask that you provide a written response to their NORA charges. After you respond, the CFPB will make a final decision on whether to pursue an enforcement action against you. If the Bureau chooses to proceed, it will attempt to negotiate a settlement with you before filing a lawsuit. As mentioned above, all but two of the Bureau's enforcement actions have ended in settlements.

Having experienced counsel is highly advised.

As should be apparent by the above considerations, it is highly advisable that experienced legal counsel represent you in your dealings with the Bureau. The difference could mean millions, as CFPB settlements since its first filed enforcement action in 2012 have routinely settled for seven figures or more.

_________________________
1 CFPB Bulletin 2013-06 (June 25, 2013).

Allen Denson is an associate in the Washington, D.C. office of Hudson Cook, LLP. Allen can be reached at 202-223-6930 or by email at adenson@hudco.com.