Fair Debt Collection Practices Act (FDCPA) might cause concern for first-party creditors. By way of background, the statutory scope of the FDCPA does not reach first-party creditors, instead applying only to entities collecting “debts owed or due … another.” We explained that the CFPB might attempt to use its unfair, deceptive, or abusive acts and practices (UDAAP) authority to apply the standards set forth in its NPRM industry-wide in light of the CFPB’s October 2018 Consent Order with Cash Express LLC, where the CFPB used its UDAAP authority to apply provisions of the FDCPA to a non-debt collection company.
Six months later, in May, the CFPB finally published its long-awaited NPRM. Sure enough, certain provisions in this NPRM imply that it might apply to first-party creditors, which should raise concerns for auto lenders, installment lenders, mortgage servicers, card issuers, and other first-party creditors.
Possible Application to First-Party Creditors via UDAPP
The NPRM’s scope is extensive; it includes proposed rules concerning limited-content voice messages to avoid third-party disclosures, controversial limits on frequency of contact by debt collectors, and a variety of other proposed rules. At the outset of the NPRM, the CFPB explains it relies primarily on its authority to issue rules implementing the FDCPA; and, therefore, the proposed rules would “impose requirements on debt collectors, as that term is defined in the FDCPA” (NPRM at 4). Such language would suggest no extension of rules to first-party creditors, who are generally not “debt collectors” under the FDCPA. But, passages embedded within the NPRM suggest otherwise.
On page 30 of the NPRM, the CFPB proposes to expand upon the FDCPA’s non-exhaustive list of examples of unlawful conduct to outline additional unlawful acts for debt collectors. While those additions would seem to apply only to debt collectors as currently defined by the FDCPA, footnote 69 states:
Where the Bureau proposes requirements pursuant only to its authority to implement and interpret sections 806 through 808 of the FDCPA, the Bureau does not take a position on whether such practices also would constitute an unfair, deceptive, or abusive act or practice under section 1031 of the Dodd-Frank Act. Where the Bureau proposes an intervention both pursuant to its authority to implement and interpret FDCPA sections 806 through 808 and pursuant to its authority to identify and prevent unfair acts or practices under Dodd-Frank Act section 1031, the section-by-section analysis explains why the Bureau proposes to identify the act or practice as unfair under the Dodd-Frank Act. (NPRM at 31, emphasis added)
The highlighted portions of this footnote should concern first-party creditors, because the NPRM suggests therein that the CFPB may seek to enforce the unlawful practices it defines in this NPRM pursuant to its powers to regulate “unfair, deceptive or abusive acts or practices” under section 1031 of the Dodd-Frank Act. That enforcement, if actually undertaken, would cover not just debt collectors as defined by the FDCPA, but arguably any “covered person or service provider” subject to the reach of the CFPB, including first-party creditors.
Another provision of the NPRM also suggests the application of specific FDCPA rules to first-party creditors. At first blush, the CFPB’s controversial proposed limitations on telephone calls to consumers to one call per week absent an exception appears to apply to debt collectors as defined by the FDCPA (NPRM at 156). But, again, a footnote suggests that there may be future attempts to extend the rule to first-party creditors. Footnote 331 to the NPRM states:
The Bureau has not determined in connection with this proposal whether telephone calls in excess of the limit in proposed § 1006.14(b)(2)(ii) by creditors and others not covered by the FDCPA would constitute an unfair act or practice under Dodd-Frank Act 1031(c) if engaged in by those persons, rather than by an FDCPA-covered debt collector. (NPRM at 156)
Just as with footnote 69, footnote 331 leaves open the possibility that the CFPB will enforce the limitation on weekly calls to first-party creditors.
Rulemaking by Enforcement?
Historically, the CFPB has been criticized for its perceived tendency to regulate by enforcement. In other words, some industry participants have observed that the CFPB tends to announce new rules—particularly under its UDAAP powers—through enforcement proceedings and consent orders. This perception, whether right or wrong, leads to the uncomfortable concern that any single financial services industry participant might be subject to a claim of UDAAP violations for conduct that has not been specifically targeted in any statute or regulation.
For instance, what if a hypothetical auto lender is servicing a loan that is just less than 30 days late. If that auto lender places a call to its customer on Monday and discusses a promise to make a payment to bring the account current, will the lender be allowed to call the customer later that week if the promise is not kept? As industry participants know, it is critical in many cases to conduct early follow up on recent delinquencies in order to maximize repayment—particularly in the subprime space. The follow-up call is critical.
Current law excludes first-party creditors, such as the hypothetical auto lender, from the scope of the FDCPA. For a debt collector, the NPRM suggests that a second telephone call to this delinquent customer within a seven-day period would be an unfair, deceptive or abusive act or practice. Considering the text of footnote 331, it appears at least plausible that the hypothetical auto lender should have some concern that the CFPB might extend this rule to cover its collection calls, too. What is more concerning is the fact that the hypothetical auto lender might not find out about the application of the rule to first-party creditors until after it has been made a party to an enforcement action.
One other concern for this hypothetical auto lender reaches beyond the CFPB. Some states have enacted their own debt collection laws that expand the reach of the FDCPA’s enumerated unfair and deceptive acts to first-party creditors. It is eminently possible that certain states might enforce the NPRM’s proposed rules to first-party creditors under those statutes. Additionally, Section 1042 of the Dodd-Frank Act provides state attorneys general and state regulatory agencies with the ability to enforce UDAAP violations, so a state attorney general or state regulator may also seek to enforce the NPRM through this avenue.
Timing of Implementation
It should be noted that the NPRM is not yet law and may still change. The comment period following this rulemaking will last for 90 days, with a possible extension of 60 days. Thereafter, there will be a period for the CFPB to review comments and revise the NPRM. The revised proposed rulemaking will then be published, likely in early 2020, and go into effect one year later. Thus, the changes might not take effect until 2021.
Has the FDCPA’s Reach Indeed Expanded?
Unless the CFPB alters course and explicitly carves out first-party creditors from the NPRM, we believe that certain provisions of the FDCPA will be expanded to cover first-party creditors when the NPRM becomes law. While unlikely, the CFPB could announce that it will adopt all of its regulations in the NPRM as examples of unfair, deceptive, or abusive acts or practices that apply to all entities it regulates—including first-party creditors. More likely, the CFPB would abstain from explicitly expanding UDAAP for now, but state laws or state regulators through their UDAAP authority may decide to apply the NPRM’s regulations to first-party creditors.
It is also important to recognize that in the absence of an explicit carve out for first-party creditors, a more idealistic administration than the one we have presently may seek to penalize past conduct in violation of the NPRM using a UDAAP theory. This is particularly true since the CFPB has essentially already gone through the exercise of defining the conduct covered by the NPRM as “conduct the natural consequence of which is to harass, oppress, or abuse . . . .” (NPRM at 30, emphasis added).
It is far from certain that these regulations will be adopted in their current form. Yet, if the NRPM does become law in its current form, it would be hard to take the position that the FDCPA’s reach has not expanded in some form or fashion. We expect to provide more thoughts on this NPRM as the comment and revision process continues.