On July 18, 2012, the Consumer Financial Protection Bureau ("CFPB") announced its first public enforcement action - a Consent Order requiring Capital One Bank (USA) N.A. (the "Bank") to refund approximately $140 million to two million customers and pay a $25 million civil money penalty. As you may recall, the Dodd-Frank Wall Street Reform and Consumer Protection Act ("Dodd-Frank Act") established and granted jurisdiction to the CFPB to enforce the Consumer Financial Protection Act ("Act") and other consumer financial laws. The Consent Order is the product of the CFPB's examination into tactics used by the Bank's third-party call-center vendors to pressure or mislead consumers with low credit scores or credit limits into purchasing certain Bank payment protection and crediting monitoring "add-on products" ("Products") when the consumers activated their credit cards. A copy of the CFPB's press release and Consent Order may be found here.

In the Consent Order, the CFPB finds (and the Bank neither admits or denies) that the Bank, through its third-party vendors, engaged in deceptive acts or practices in violation of the Act by misleading and/or deceiving consumers regarding the benefits, nature, and cost of the Products and the consumers' eligibility to receive the benefit of the Products and, in some cases, processing purchases of the Products without the consumers' consent. In addition to requiring a $25 million payment to the CFPB's Civil Penalty Fund, the Consent Order requires that the Bank take certain remedial actions to prevent further violations and provide relief to the consumers affected, including, but not limited to, ceasing marketing of the Products until a compliance plan is approved by the CFPB, providing complete repayment (plus interest) of the fees charged under the Products' terms, refunding any account finance charges or other fees assessed to consumers' accounts resulting from the fees charged for the Products (plus interest) and issuing payments for claims originally denied based on consumers' ineligibility at enrollment.

The CFPB coordinated its enforcement action with a parallel enforcement action by the Office of the Comptroller of Currency ("OCC"), which issued a related Consent Order to the Bank ordering restitution of approximately $150 million (including the $140 million refund to be paid under the CFPB's Consent Order), an additional civil money penalty of $35 million and separate restitution for practices engaged in by the Bank that were discontinued prior to the effectiveness of the CFPB's enforcement authority.

Financial institutions should take note that the CFPB issued a compliance bulletin to put institutions on notice that "the CFPB will not tolerate deceptive marketing practices, and institutions will be held responsible for the actions of their third-party vendors," per the CFPB's press release. In light of the CFPB and OCC enforcement actions against the Bank and the release of the CFPB compliance bulletin, we expect institutions may consider increasing oversight of their third-party vendors' consumer practices as a form of risk management.