Insights

With apologies to the Bard, recent developments concerning the CFPB's time to commence an action leave many wondering if their potential liability for past conduct extends "to the last syllable of recorded time."

Statutes of limitations are important tools to control compliance risk. They let us know when we can no longer expect to be hauled into court for past conduct. Unfortunately for many, the CFPB's vaguely defined time to sue has made projecting compliance risk an impossible task.

Beginning in July 2011, the newly formed Consumer Financial Protection Bureau gained authority to prohibit Unfair, Deceptive, and Abusive Acts or Practices ("UDAAP"). To enforce this new prohibition, Congress authorized the Bureau to bring cases either in federal district court or through "administrative adjudications" heard by agency-appointed Administrative Law Judges.

Congress also sought to impose limits on this new authority through a statute of limitations. Specifically, no "action" based on a UDAAP violation may be brought more than three years after the "date of discovery." Two aspects of this limitations provision create serious problems for anyone attempting to mitigate compliance risk.

"Date of Discovery"

By using the phrase "date of discovery," Congress codified a so-called "discovery rule" for UDAAP claims. This rule means that the time to sue begins to run when a party knows or with the exercise of due diligence should know facts that will form the basis for an action, not when the action occurs.

Historically, the discovery rule has been used in fraud cases, where it would be unfair to hold plaintiffs to limitations periods tied to the date conduct occurs. It has been an exception rather than the rule because, in the ordinary course, a private party is immediately aware of an injury and has fair notice that his or her time to sue is running. Injuries due to fraud are self-concealing, so the discovery rule is a way to protect against that possibility.

That same justification for the discovery rule may not be present when the government is seeking to impose penalties and redress. UDAAP claims do not necessarily involve concealment; in many cases affected consumers know they are injured at the time of the action. Consider a UDAAP claim based on making excessive collection calls to a consumer, which was one of Bureau's causes of action against small-dollar lender Ace Cash Express. Assuming the allegations were true, consumers did not need to wait to "discover" that they had been injured; they knew the frequency of Ace's calls.

But, pinning down exactly when the Bureau "knows" or "should know" it has a viable UDAAP claim poses a unique challenge. The Bureau is not monolithic; it has numerous employees-supervisors, lawyers, examiners, and economists. When does an institution of that size and sophistication "know" that a violation occurred? When should it know that a violation occurred?

Unlike a private plaintiff, the Bureau can conduct an investigation or (for some) an examination. It has nearly unfettered authority to access the books and records of those falling within its purview, and one of its core missions is to enforce federal consumer financial laws by bringing cases against alleged violators. Another critical difference between the Bureau and a private plaintiff is the available relief. While a private plaintiff may recover damages or an injunction, the Bureau may, beyond standard relief, impose substantial penalties meant to deter future conduct by both the enforcement target and others in the industry.

In short, the Bureau does not "discover" violations in the same way that a private party would. Going back to our example of excessive collection calls, the discovery rule means that the Bureau's time to bring an enforcement action will begin to run some time after the calls occur, but not at any specific date. It could be after the next examination cycle. It could be after a consumer complains about call frequency through the CFPB's complaint portal. It could also be when the Bureau decides to begin an investigation. The salient point is that businesses trying to project risk have no way of knowing when the CFPB knows or should know of a potential violation.

While it is difficult to project how long the Bureau can "wait" to bring its case after the relevant conduct occurs, there are some limiting principles as to how far in time it can reach back for its currently-viable claims. First, because the Dodd-Frank Act imposes new penalties and creates new causes of action (abusive claims) the Bureau may not impose the new penalties or proceed under the new causes of action for conduct occurring before it could use this authority (July 2011). Second, the government generally has a five-year statute of limitations for actions involving "penalties." It is arguable that this general limitations period would apply to both CFPB actions for Civil Money Penalties and those actions seeking restitution or disgorgement; some courts have held that these remedies are a "penalty" within the meaning of the statute.

Regardless of these limiting principles, however, the fact remains that projecting for future liability under the discovery rule is not possible because one cannot know the mind of the government.

Limitation of "Actions" Only

If the discovery rule itself does not create enough uncertainty, note that the Bureau's statute of limitations provision applies only to an "action." The CFPB recently held in a final agency decision that "action" only means cases filed in federal district court. In the Matter of PHH Corp. No. 2014-CFPB-0002. Because the Bureau can enforce UDAAP through cases filed in federal district court and through administrative adjudications, it held that no statute of limitations applies when the Bureau decides to pursue its case administratively. Thus, in any case where the discovery rule is not flexible enough to cover all potential violations, the Bureau may simply choose to file a case administratively where its claims are viable indefinitely. In projecting risk, no one can know whether the Bureau will choose to file a hypothetical case administratively or in federal district court, making limitations period for a UDAAP claim (or any other federal consumer financial law) effectively unbounded.

Prudent Planning for the Current Reality

The potential for unbounded limitations periods creates a lot of uncertainty (and headaches) for compliance professionals. Until there is clear guidance from the courts on what constitutes an "action" or Congress amends the discovery rule, projecting risk will remain impossible. In the meantime, there are a few practical steps to take that may help mitigate liability for stale claims.

First, have a clear document retention policy and discard documents after you no longer need them. From the "front lines" of many investigations, we have often found that the fodder for UDAAP claims comes from training documents no longer in use, old marketing pieces, and years-old email traffic. Ask yourself why you are retaining these materials. If you do not otherwise need to retain the document (e.g., adverse action notices) consider discarding it. A better course would be to adopt a formal schedule for culling unnecessary data and other materials and rigorously adhere to it.

Second, be sure to frequently review policies and procedures. Make sure that your policies match your practice. Document any updates, changes, and the reasons for changes. In our investigations, we have often seen the Bureau focus on outdated policies that were effectively changed after clients became serious about adopting a formal CMS.

These may seem like small steps, but culling unneeded material and keeping policies up to date may limit your exposure down the road. An ounce of prevention is worth a pound of cure.

Allen H. Denson is an associate in the Washington, D.C., office of Hudson Cook, LLP. Allen can be reached at 202-327-9718 or by email at adenson@hudco.com.