A federal district court recently entered an order resolving a joint action by the Consumer Financial Protection Bureau (CFPB) and state attorneys general against a debt-relief service provider who charged fees to consumers in advance of actually settling their debts, violating federal and state laws. The order included an instruction to pay a civil monetary penalty which, according to the CFPB, was limited because the company “immediately ceased the unlawful conduct and cooperated with our investigation.”[1] The CFPB’s comment provided some of the first insight into the types of conduct the Bureau might consider when deciding whether to award credit to a corporation during enforcement actions. This comment was recently amplified in a bulletin issuing formal guidance on cooperation with the CFPB.

What does it mean to cooperate with the CFPB?

On June 25, 2013, the CFPB issued Bulletin 2013-06,[2] which details activities companies should consider if they want credit for cooperating during CFPB enforcement investigations. In particular, the CFPB identified four categories of “responsible conduct” that “may favorably affect the ultimate resolution of a Bureau enforcement investigation”: self-policing, self-reporting, remediation and cooperation.

Although the CFPB avoided making promises of leniency, some of the potential advantages of engaging in responsible conduct include resolving investigations with no public enforcement action, reducing the number or severity of pursued violations and/or reducing sanctions and penalties. The Bulletin emphasizes, however, that to qualify for favorable treatment, a corporation must “substantially exceed the standard of what is required by law in its interactions with the Bureau.”

When will the CFPB investigate?

Although the CFPB considers “many factors” before exercising its enforcement authority, the Bulletin lists four factors that affect the CFPB’s decision to investigate:

  1. the nature, extent and severity of the identified violations;
  2. the actual or potential harm stemming from the violations;
  3. whether a company has a history of past violations; and
  4. a company’s effectiveness in addressing violations.

The Bulletin does not explain these factors, nor does it provide guidance as to how a corporation can evaluate the likelihood that the CFPB will investigate any particular violation. Rather, as noted above, the Bulletin focuses on a set of best practices that the Bureau calls “responsible conduct” with the stated goal of encouraging activity that concretely and substantially benefits consumers and contributes to the success of the Bureau’s mission.

What Is “Responsible Conduct”?

The Bulletin sets forth four categories of conduct that the CFPB “may favorably consider” when deciding whether to award credit to a corporation during enforcement actions.

  • Self-policing – A corporation’s “robust compliance management system” should be proportionate to its size and complexity and should facilitate early detection of potential violations of consumer financial laws. The CFPB will consider the nature and source of the violation, how the violation was detected, the existence of applicable compliance procedures, a corporation’s responses to any past CFPB examination and the corporation’s culture of compliance (including involvement of senior personnel in the violation).
  • Self-reporting – A corporation’s “prompt and complete self-reporting to the Bureau of significant violations and potential violations” must include complete and effective disclosure of conduct to CFPB regulators and consumers. Note that the CFPB places “special emphasis” on self-reporting in evaluating a corporation’s overall conduct and will consider the timeliness of any self-report in its analysis.
  • Remediation – A corporation should provide “full redress for violations” of consumer financial laws. Relevant factors include the timeliness of the company’s response upon learning of misconduct, consequences imposed on those individuals involved in the misconduct, steps taken to preserve information and redress the harm (both monetary and non-monetary) and the extent and effectiveness of corrective measures to prevent future violations.
  • Cooperation – A corporation must take “substantial and material steps above and beyond what the law requires in its interactions with the Bureau” to receive credit for cooperation. A corporation should promptly and completely cooperate with the CFPB (including by identifying “additional related misconduct”), conduct a comprehensive investigation and then share the results of that investigation by, among other things, a written report and documentation reflecting the corporation’s response to the misconduct.

This list is not exclusive; the Bulletin expressly states that “if a party engages in another type of activity particular to its situation that is both substantial and meaningful, the Bureau may take that activity into consideration.”

Familiar Guidance

The CFPB’s guidance is in line with guidance from other law enforcement agencies like the Department of Justice (DOJ) and the Securities and Exchange Commission (SEC) regarding steps that corporations may take to cooperate before, during and after enforcement actions.

The DOJ’s “Principles of Federal Prosecution of Business Organizations” explain that a corporation’s “timely and voluntary disclosure of wrongdoing and its cooperation with the government’s investigation” may be relevant to the DOJ’s decision to charge and resolve a corporate criminal case and “may benefit the corporation by presenting it with the opportunity to earn credit for its efforts.”[3] For example, under the U.S. Sentencing Guidelines, self-reporting, full cooperation and acceptance of responsibility before an imminent threat of disclosure or government investigation and within a reasonable time after discovery, are mitigating factors that can lower an organization’s culpability score and therefore lower its guideline fine range.[4]

Likewise, the SEC’s Enforcement Cooperation Initiative includes tools for facilitating and rewarding cooperation by corporations and individuals including agreements to reduce charges and sanctions in exchange for cooperation, deferred prosecution agreements and non-prosecution agreements.[5] The SEC lists the same four factors – self-policing, self-reporting, remediation and cooperation – as relevant to its decision to credit positive corporate conduct in its enforcement actions.[6] Like the CFPB, the SEC has expressly rejected a rigid rule or formula that would limit its ability to evaluate each case individually.[7]

In many ways, the substance of the CFPB’s guidance is therefore familiar to counsel with experience in DOJ and SEC investigations. But even in the context of DOJ and SEC investigations, it is sometimes difficult to achieve sufficient clarity to give concrete ex ante guidance. This will be especially true when dealing with the CFPB because it is a brand new agency with no enforcement history to help corporations predict how it will exercise its enforcement discretion.

What Are the Key Take-Aways?

  • Framework. Outside of putting “special emphasis” on self-reporting, the Bulletin provides little insight into how the above pieces work together and stresses that the relative importance of each factor and the manner in which the factors will be weighed “depend on the circumstances.” Nevertheless, the clear implication is that the CFPB expects early and extensive involvement at all levels of the corporation in enforcement actions.
  • Baseline. The conduct described in the Bulletin sets a high bar for the CFPB’s baseline expectations of corporate conduct. “Cooperation” is a term of art for law enforcement agencies that means doing significantly more than the law requires. The Bulletin outlines ways in which corporations may be successful in cooperating with the CFPB, thereby potentially achieving some degree of leniency.
  • Remediation. In addition to compensating consumers for their financial losses stemming from corporate misconduct, the Bulletin states that corporations should take steps to identify and implement appropriate compensation for harms beyond the amounts the victims paid. The Bulletin offers no practical tips for identifying non-monetary harms or for adequately compensating (much less identifying) potential victims.
  • No guarantees. The Bulletin reflects the CFPB’s intention to maintain maximum flexibility and discretion in enforcement actions. There is no “rule or formula” corporations can follow to lessen or avoid liability because there “is no consistent formula that can be applied to all enforcement actions to accomplish the goal of protecting consumers.” Accordingly, there are no guarantees that significant and substantial responsible conduct will result in lesser penalties. Corporate counsel should be aware that in certain cases, the misconduct may be so egregious or the harm so great that no amount of cooperation or mitigating conduct will prevent an enforcement action or monetary penalty.

The Bulletin makes clear that responsible corporate behavior has the potential to positively affect the outcome of a CFPB enforcement action. By promptly consulting with effective and experienced legal counsel, a corporation facing a CFPB enforcement action can maximize the probability that it will take the necessary steps to present its conduct in the best possible light.