Latham & Watkins operates worldwide as a limited liability partnership organized under the laws of the State of Delaware (USA) with affiliated limited liability partnerships conducting the practice in the United
Kingdom, France, Italy and Singapore and as affiliated partnerships conducting the practice in Hong Kong and Japan. The Law Office of Salman M. Al-Sudairi is Latham & Watkins associated office in the
Kingdom of Saudi Arabia. In Qatar, Latham & Watkins LLP is licensed by the Qatar Financial Centre Authority. Under New York’s Code of Professional Responsibility, portions of this communication contain
attorney advertising. Prior results do not guarantee a similar outcome. Results depend upon a variety of factors unique to each representation. Please direct all inquiries regarding our conduct under New York’s
Disciplinary Rules to Latham & Watkins LLP, 885 Third Avenue, New York, NY 10022-4834, Phone: +1.212.906.1200. © Copyright 2014 Latham & Watkins. All Rights Reserved.
White Collar Defense & Investigations
May 15, 2014 | Number 1685
How to Respond to a CFPB Civil Investigative Demand
Under CFPB’s broad mandate, many companies outside the financial services industry may be subject to expensive civil investigations.
A for-profit technical school may not appear to be a financial services company. But a recent investigation and enforcement action brought against ITT Education Services by the Consumer Financial Protection Bureau (CFPB) suggests that CFPB takes a broad view of its authority to regulate consumer financial products and services, and will not limit its enforcement activities to the financial services industry.1
Congress created the CFPB in the Wall Street Reform and Consumer Protection Act of 2010 — a law designed to prevent the practices Congress felt led to the financial crisis (e.g., subprime mortgage lending and the securitization of subprime mortgages). Among other things, the CFPB was created to enforce Dodd-Frank, and centralize oversight of the various existing consumer financial protection laws (e.g., the Fair Debt Collection Practices Act and the Fair Credit Reporting Act). Dodd-Frank itself authorizes CFPB to bring enforcement actions against acts or practices in connection with a consumer financial product that are “unfair, deceptive, or abusive.” 12 U.S.C. 5531.
Since Dodd-Frank went into effect on July 21, 2011, the CFPB has grown into an agency with an annual budget of over US$400 million, and nearly 1000 employees. CFPB has already brought dozens of enforcement actions, including several that have recovered hundreds of millions of dollars from major financial institutions. For example, in April 2014 CFPB recovered $772 million from a Major US banking institution for deceptive marketing practices in add-on products offered in connection with credit cards.2
CFPB’s initial enforcement actions have focused where one might expect — the mortgage industry, credit cards, auto loans and debt relief organizations. But CFPB’s authority under Dodd-Frank — and thus its likely reach — is much broader. CFPB has jurisdiction over “any transaction with a consumer for a consumer financial product or service,” 12 U.S.C. 5531(a). “Financial product or service” is defined broadly to include:
• Extending credit and servicing loans (including “acquiring, purchasing, selling, brokering, or other extensions of credit”)
• Extending or brokering leases
• Providing real estate settlement services
• Acting as a custodian of funds
• Selling, providing, or issuing stored value or payment instruments
• Providing check cashing, check collection, or check guaranty services
• Providing payments or other financial data processing products or services to a consumer
• Providing financial advisory services
Latham & Watkins May 15, 2014 | Number 1685 | Page 2
• Collecting, analyzing, maintaining, or providing consumer report information
• Collecting debt related to any consumer financial product or service.
12 U.S.C. 5481(15)(i)-(x)
Therefore, any organization that arguably engages in the above activities — for example, third-party financing for products or services3 — or activities such as third-party debt collection and credit reporting that CFPB received transferred authority to oversee, could receive a Civil Investigative Demand (CID) for documents and/or testimony from the CFPB.
How to Respond to CFPB Investigation
A CID can require a company to respond within a matter of days after service. The following high-level overview of the deadlines and key considerations will help affected companies plan and respond to a CID from the CFPB.
Upon Receipt of a CFPB Civil Investigative Demand (CID):
Develop a Response Plan and Implement a Legal Hold.
• Develop a Response Plan. Upon receipt of a CID, a company should immediately begin to develop a response plan. Important response deadlines come up in a matter of days after service of a CID, so delays can impair a company’s ability to effectively respond in a timely manner.
o Lots to do in Little Time. Counsel must meet with CFPB enforcement staff, raise all potential objections to enforcement of the CID, attempt to obtain modifications from the Bureau, and (if unable to obtain satisfactory modifications) file a petition to modify or set aside the CID stating all unresolved objections with the Executive Secretary of the Bureau — all within 20 days of service.
o Limited Availability of Extensions. Deadline extensions are available under CFPB regulations, but are within the discretion of Bureau staff and are “disfavored” under CFPB regulations. See 12 C.F.R. 1080.6(e)(2).
o Evaluate Ability to Respond. As soon as possible, CID recipients should begin analyzing the feasibility of a complete response to the CID and evaluating the burdens posed by specific requests.
Prepare for Meet and Confer. All legal and factual objections to compliance with the CID must be raised at the Meet and Confer — which CFPB regulations state should occur within 10 days of service, 12 C.F.R. 1080.6(c) — so CID recipients should identify unduly burdensome or costly requests prior to that time.
Note on Legal Objections. CID recipients should also evaluate whether to assert legal (e.g. statutory or constitutional) objections to the CID. By their terms, CFPB regulations require CID recipients to raise such objections at the Meet and Confer. See 12 C.F.R. 1080.6(c). Bureau Staff likely will not negotiate on these objections, but companies subject to a CID should still raise them to avoid the risk of waiver.
Latham & Watkins May 15, 2014 | Number 1685 | Page 3
• Circulate and Implement Legal Hold.
o Upon receipt of a CID, the company has a duty to preserve all documents “potentially relevant” to the CID. This category of documents will likely extend beyond the documents the CID explicitly seeks, although at the outset of an investigation determining how far beyond can be difficult. Companies should consult with outside counsel and relevant employees (including IT personnel) on the delicate decision of how far to extend a legal hold.
o The Bureau has a special interest in companies’ direct interactions with consumers. Consistent with this, the Bureau often seeks documents related to these interactions — some of which can be difficult or expensive to search and preserve. Depending on the company’s customer service practices, this could extend, for example, to call recordings or to employees’ notes from customer service or marketing calls. If retaining this data will be burdensome, the company should implement the hold and seek relief from the Bureau through the Meet and Confer process.
Within 10 Days of Service:
Meet and Confer with Bureau Staff.
• Meet and Confer Requirement. CFPB regulations require the recipient of a CID to meet with Bureau staff within 10 days of service “to discuss and attempt to resolve all issues regarding compliance with the civil investigative demand.” 12 C.F.R. 1080.6(c).
• Personnel with Knowledge Must Participate. Consistent with the purpose of resolving “all issues regarding compliance,” id., the CID recipient is required to ensure that “personnel with the knowledge necessary to resolve any issues relevant to compliance with the demand” are available to participate. 12 C.F.R. 1080.6(c)(1). Bureau regulations note that such personnel should include both “individuals knowledgeable about the recipient’s information or records management systems and/or the recipient's organizational structure,” id., and “a person familiar with its ESI systems and methods of retrieval.” 12 C.F.R. 1080.6(c)(2). The failure to do so could be viewed as a failure to “meaningfully engage” in the Meet and Confer process under 12 C.F.R. 1080.6(c)(3).4
• Waiver Considerations. CFPB regulations state that the Bureau will not entertain petitions to set aside from parties that have not “meaningfully engaged” in the Meet and Confer process, and “will consider only issues raised during the Meet and Confer process.” 12 C.F.R. 1080.6(c)(3). Thus, CID recipients should make sure to not only actively engage in the Meet and Confer process but to raise all legal and factual objections to the CID at the Meet and Confer.
Within 20 Days of Service:
Negotiate modifications to the CID and file a Petition to Set Aside or Modify the CID regarding any unresolved objections.
• CFPB regulations provide the recipient of a CID 20 days from the date of service to object to the CID by filing a Petition to Set Aside or modify the CID with the Executive Secretary of the Bureau. 12 C.F.R. 1080.6(e).
Latham & Watkins May 15, 2014 | Number 1685 | Page 4
• The petition must “set forth all factual and legal objections to the civil investigative demand, including all appropriate arguments, affidavits, and other supporting documentation.” 12 C.F.R. 1080.6(e).
• The return date of the CID is stayed while a party’s petition is pending 12 C.F.R. 1080.6(f).
Why Might a CID Recipient File a Petition to Set Aside?
• Waiver risk. Failing to raise objections to the CID through the Meet and Confer process and in a Petition to Set Aside will likely waive the company’s right to raise those objections if CFPB subsequently sues to enforce the CID.
o Note on Meet and Confer Participation. CFPB regulations state that the Bureau will not entertain petitions from parties that have not “meaningfully engaged” in the Meet and Confer process, and “will consider only issues raised during the meet and confer process.” 12 C.F.R. 1080.6(c)(3). Accordingly, the failure to do so can amount to a waiver even if a company files a Petition to Set Aside.
• Obstacles to Modification by Agreement. The Meet and Confer process is designed to resolve objections before the petition becomes due. While a modification that satisfies both parties is desirable for obvious reasons, negotiating and finalizing modifications prior to the deadline to file a Petition within 20 days of service can prove difficult – due both to the short deadline, and the fact that Bureau regulations require senior officials in the Enforcement Division to approve modifications.
o “Nondelegable authority to issue CIDs” (and thereby the authority to modify or withdraw them) is vested in “the Director of the Bureau, the Assistant Director of the Office of Enforcement, and the Deputy Assistant Directors of the Office of Enforcement.” 12 C.F.R. 1080.6(a).
o Because the authority to modify CIDs is nondelegable, the enforcement attorneys who attend the Meet and Confer will not have the authority to grant modifications. Accordingly, they will not be in a position to promise particular modifications at the Meet and Confer, and will have a limited ability to negotiate on the scope of the CID as a result.
This situation tends to prevent parties from resolving objections at the Meet and Confer stage.
Approval of modifications takes time, which places the recipient of a CID in a difficult position. The deadline to file a Petition to Set Aside is just 10 days after the Meet and Confer deadline, and — depending on the complexity of the CID and the recipient’s objections — a party must begin preparing the Petition even while awaiting a response from the Bureau on proposed modifications.
What are the Key Elements of a Petition?
• Must State All Legal and Factual Objections. The petition must “set forth all factual and legal objections to the civil investigative demand, including all appropriate arguments, affidavits, and other supporting documentation.” 12 C.F.R. 1080.6(e). The failure to do so will likely waive these
Latham & Watkins May 15, 2014 | Number 1685 | Page 5
objections, and thus prevent the CID recipient from raising them if the Bureau subsequently files suit (in federal court) to enforce the CID.
• Requires Supporting Affidavits and Documentation. CFPB regulations note that petitions to set aside should, where appropriate, be supported by “affidavits, and other supporting documentation,” 12 C.F.R. 1080.6(e), and past CFPB orders denying petitions have emphasized the need for specificity in objections based on undue burden.5 If the CID recipient wishes to make factual objections about the burden and cost of compliance, the CID recipient should support these claims with affidavits from relevant personnel (e.g. IT staff), and other supporting documentation.
• Meet and Confer Statement. The Petition must be accompanied by a signed statement that the recipient of the CID met with counsel for the Bureau and made a good faith effort to resolve the objections in the CID. 12 C.F.R. 1080.6(e)(1). This statement assists the Bureau in determining whether the CID recipient waived any of its objections by failing to raise them through the Meet and Confer process. See 12 C.F.R. 1080.6(c)(3).
• Note on Public Disclosure. CFPB regulations state that “petitions and the Director’s orders in response to those petitions are part of the Bureau’s public records unless the Bureau determines otherwise for good cause shown.” 12 C.F.R. 1080.6(g). A number of petitions to set aside and orders are posted on CFPB’s website.6
o Under CFPB regulations, any showing of good cause must be made no later than the time the petition is filed. 12 C.F.R. 1080.6(g).
o The CFPB has not laid out guidelines for what might justify confidential treatment, but the Bureau would not likely find good cause to refrain from publishing any submission that did not meet the standards for confidential treatment under the Freedom of Information Act, 5 U.S.C. 552.
What Happens Next?
• The Director has the Authority to Decide Petitions. Authority to decide petitions is vested in CFPB Director Richard Cordray. 12 C.F.R. 1080.6(e)(4). The Director has only published a few orders regarding petitions (a few of which Deputy Director Steve Antonakes has signed).7 These generally deny the petitioners’ objections and order them to comply with the CID. See id.
• Be Prepared to Wait. CID recipients may encounter a substantial delay before a petition is decided. The Director has only published a few orders on petitions to set aside, and these generally have been issued several months after the petition was filed. Indeed, the Bureau’s website includes a number of undecided petitions, including some that were filed months ago.8
• Consider Voluntary Cooperation while the Petition in Pending. The return date of the CID is stayed while a party’s petition is pending, 12 C.F.R. 1080.6(f), and as noted above, the Petition decision likely will be delayed. This delay provides a CID recipient an opportunity to produce documents voluntarily that can be collected without undue burden and continue to work with Bureau staff to resolve objections that the parties were unable to resolve through the Meet and Confer process. If the parties are able to reach a mutually-agreeable resolution, the Petition can be withdrawn or denied as moot.
Latham & Watkins May 15, 2014 | Number 1685 | Page 6
Given the broad scope of CFPB’s authority, the potential expense of a CFPB investigation, and the short deadlines within which CID recipients must respond, companies engaged in businesses related to consumer financial products should ensure they are aware of the possibility they will receive a CFPB CID, and understand how to respond.
If you have questions about this Client Alert, please contact one of the authors listed below or the Latham lawyer with whom you normally consult:
Alice S. Fisher
Peter L. Winik
John S. Cooper
Client Alert is published by Latham & Watkins as a news reporting service to clients and other friends. The information contained in this publication should not be construed as legal advice. Should further analysis or explanation of the subject matter be required, please contact the lawyer with whom you normally consult. The invitation to contact is not a solicitation for legal work under the laws of any jurisdiction in which Latham lawyers are not authorized to practice. A complete list of Latham’s Client Alerts can be found at www.lw.com. If you wish to update your contact details or customize the information you receive from Latham & Watkins, visit http://events.lw.com/reaction/subscriptionpage.html to subscribe to the firm’s global client mailings program.
1 See http://www.consumerfinance.gov/newsroom/cfpb-sues-for-profit-college-chain-itt-for-predatory-lending/
2 See http://www.consumerfinance.gov/newsroom/cfpb-orders-bank-of-america-to-pay-727-million-in-consumer-relief-for-illegal-credit-card-practices/
3 Retailers that offer first-party financing are generally exempt from Dodd-Frank, see 12 U.S.C. 5517(a)(2), but retailers should approach this exemption with care in responding to a CID, because CFPB arguably has authority to issue CIDs to otherwise-exempt entities. See 12 U.S.C. 5517(n)(2).
4 See In re PHH Corp., 2012-MISC-PHH Corp.-0001 at 9 (Sept. 20, 2012), available at http://files.consumerfinance.gov/f/201209_cfpb_setaside_phhcorp_0001.pdf.
5 See, e.g., In re PHH Corp., 2012-MISC-PHH Corp.-0001 at 6 (Sept. 20, 2012) (stating “in order to meet its legal burden, the subject must undertake a good-faith effort to show ‘the exact nature and extent of the hardship’ imposed, and state specifically how compliance will harm its business”) (citation omitted), available at http://files.consumerfinance.gov/f/201209_cfpb_setaside_phhcorp_0001.pdf.
6 See http://www.consumerfinance.gov/guidance/petitions-to-modify-or-set-aside/.
7 See http://www.consumerfinance.gov/guidance/petitions-to-modify-or-set-aside/.
8 See http://www.consumerfinance.gov/guidance/petitions-to-modify-or-set-aside/.