The Consumer Financial Protection Bureau has issued the bulletin “Responsible Business Conduct”, providing guidance to individuals and businesses within its enforcement authority on four categories of “responsible conduct” that they can engage in before, during, and after an alleged violation. The bulletin suggests that companies that “meaningfully engage” in these best practices – proactively self-policing for potential violations, promptly self-reporting to the Bureau when they identify potential violations, quickly and completely remediating the harm resulting from violations, and affirmatively cooperating with any Bureau investigation above and beyond what is required by the law – might be rewarded with more lenient treatment by the Bureau during an enforcement action.
The bulletin very much follows the approach announced in October 2001 by the Department of Justice (DOJ) and the Securities & Exchange Commission (SEC), outlining similar programs for companies subject to enforcement actions brought by those agencies. See DOJ's "Federal Prosecution of Corporations" release dated October 23, 2001 (known as the "Holder Memorandum"), and the SEC's "Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934 and Commission Statement of Relationship of Cooperation to Agency Enforcement Decisions," Exch. Act Rel. No. 44969 (Oct. 23, 2001).
Although the bulletin specifically stresses that the Bureau can offer neither a guarantee nor a formula for how it might reward responsible conduct in any particular case, the guidance is instructive insofar as it reflects the CFPB’s priorities in flexing its enforcement muscle. It reviews the various factors that are weighed in the Bureau’s enforcement calculus, including the nature, extent, and severity of the violations; the actual or potential harm from those violations; the party’s history of past violations; and its effectiveness in addressing those violations. Beyond these (and other) factors, the bulletin sets out four main categories of conduct in which a company can engage in order to reduce its exposure to severe enforcement actions, noting that the purpose of the guidance is “to encourage activity that has concrete and substantial benefits for consumers and contributes significantly to the success of the Bureau’s mission.”
Within each category, the bulletin specifies various measures a party may take to reduce the risk and harmful effects of potential violations. Notably, the Bureau explicitly places special emphasis on self-reporting conduct, stating that prompt self-reporting “represents concrete evidence of a party’s commitment to responsibly address the conduct at issue.” The bulletin makes clear that while every company faces the risk of potential violations, the Bureau will credit a company’s efforts to institute proactive measures to identify potential violations and, when identified, disclose suspected violations to the CFPB rather than being passive and reactive. The Bureau’s approach is holistic, assessing the company’s culture of compliance and its diligence in reporting potential problems immediately, even if there is no immediate threat of whistle-blowing or detection by the Bureau.
Besides pre-emptively reporting problems to the CFPB when identified, companies are encouraged to take steps to remediate harms immediately, obtaining full redress for consumers who are injured by the violations and taking appropriate measures to avoid future violations. For example, the Bureau will consider whether a company implemented means to prevent further misconduct (including appropriate disciplinary measures and revisions to procedures) and proactively sought to provide complete redress to any consumers harmed by the potential or actual violation.
Finally, the CFPB will consider an institution’s cooperation after the Bureau becomes aware of a potential violation – but only when the cooperation is substantially more than would otherwise be required. “In order to receive credit for cooperation in this context, a party must take substantial and material steps above and beyond what the law requires in its interactions with the Bureau. Simply meeting those obligations will not be rewarded by any special consideration.” The bulletin notes that the CFPB will credit behavior that demonstrates particular diligence, speed, and responsiveness once an investigation is underway.
Overall, the bulletin reflects the Bureau’s intention to investigate and enforce aggressively, balanced by an acknowledgment of the limitations on its investigation and enforcement resources. By adopting – and adhering to – internal policies and practices designed to identify potential violations and then report and remediate these violations promptly, companies are offered the prospect of receiving less punitive treatment if they fall under the CFPB’s investigatory eye.