As CFPB watchers already know, the CFPB celebrated its one-year anniversary earlier this week by announcing its first enforcement action. The action against Capital One Bank alleges that the bank marketed various credit card related services deceptively. To settle these charges, Capital One has agreed to pay a total of $210 million to reimburse customers ($150 million) and as fines for the alleged deceptive practices ($25 million to the CFPB and $35 million to the Office of the Comptroller of the Currency (OCC)). While the announcement has created a great deal of hoopla, what has been lost in the excitement—and should be of most concern to financial institutions—is that the action not based on Capital One’s marketing tactics, but by its third-party vendors. 

In a press release, the CFPB explained that the enforcement action “results from a CFPB examination that identified deceptive marketing tactics used by Capital One’s vendors.” Capital One, which has denied any liability, appears to have had little at all to do with the alleged deceptive practices. Instead, Capital One contends that the alleged conduct was the result of a third party vendor that failed to adhere to Capital One’s own sales scripts. Ryan Schneider, President of Capital One's Card business, explained, "[w]e are accountable for the actions that vendors take on our behalf. These marketing calls were inconsistent with the explicit instructions we provided to agents for how these products should be sold. We apologize to those customers who were impacted and we are committed to making it right."

Since its inception, the CFPB has warned financial institutions of their obligations to oversee their third-party service vendors and the CFPB’s intention to hold the institutions accountable for the actions of these vendors. The enforcement action not only reaffirms the CFPB’s intentions, but the CFPB also issued a compliance bulletin that, according to the CFPB, “establishes that institutions will be held responsible for the actions of their third party vendors.”   

In announcing the enforcement action, CFPB Director Cordray warned other financial institutions that this was only the beginning of the CFPB’s enforcement activities. No surprises there. Cordray continued: “We expect announcements about other institutions as our work continues to unfold.” Cordray also forewarned that the CFPB knows the alleged deceptive market practices “are not unique to a single institution,” and that the “compliance bulletin puts all financial institutions on notice about these prohibited practices and reinforces that they must make sure their service providers are complying with the law.”

And so it begins.