The CFPB’s Legal Minefield for CREDIT UNIONS Presented by: Ron Brown, IFCCE, MCE, CCCO, CARS, MPRS, CFA CSI Group Oklahoma City, Oklahoma

CFPB - Background Created by virtue of the Dodd-Frank Wall Street Reform and Consumer Protection Act. “the Dodd-Frank Act” One “Agency” responsible for consumer financial protection. Consolidates enforcement from Board of Governors of the Federal Reserve Department of Housing and Urban Development Federal Deposit Insurance Corporation Federal Trade Commission Office of Comptroller of Currency Office of Thrift Supervision National Credit Union Administration COVERED ENTITIES: Individuals or entities engaged in offering or providing consumer financial products and services (Sec 1002)

Supervision & Examination CFPB’s supervision and examination powers Since July 21, 2011, the CFPB has had supervision and examination powers over banks and credit unions with $10 billion or more in assets. The CFPB director does not have direct supervision and examination authority over credit unions with less than $10 billion in assets. NCUA and state legislators retain examination authority for these credit unions. The appointment of a director, however, provides the CFPB with supervision and examination authority over nondepository institutions.  Specifically, the CFPB has authority over nonbanks that provide mortgage origination and servicing, private student loans or payday loans. This authority applies to all nonbanks that provide these products or services, regardless of their asset size. In addition, the CFPB has the ability to supervise and examine “larger participants” in other markets for consumer financial products and services. The Dodd-Frank Act requires the CFPB to issue a rule before July 21, 2012, outlining which nonbanks are larger participants. The CFPB is currently taking steps to determine what other consumer markets should fall under its initial supervisory and examination authority. Last June, the bureau issued a notice and request for comment that identified six consumer finance markets where nonbank larger participants fall under its authority. Those six markets are: debt collection; consumer credit reporting; consumer credit and related activities; check cashing and money transmitting; prepaid cards; and debt relief services.  The CFPB also indicated that additional markets could be added in subsequent rulemakings. In February, the CFPB took the next step and proposed a definition for "larger participant" in the debt collection and consumer reporting markets. The bottom line: When the larger participants are defined by CFPB regulation, these nonbank entities will be subject to federal oversight for the first time. 

CFPB Bottom Line Going forward, credit unions need to monitor the CFPB for changes and amendments to consumer regulations. The CFPB’s amendments to consumer regulations will apply to credit unions of all asset sizes. The CFPB’s mission is to protect consumers and, unlike NCUA, the agency does not have a safety and soundness mandate to follow when writing regulations. Unfair, deceptive or abusive acts or practices: Although we don’t know where the CFPB will act first, credit unions need to be aware of the bureau’s new UDAAP powers. The bottom line With a director, the CFPB now has the full powers it was granted by the Dodd-Frank Act. While many of these powers relate to supervising non depository institutions, the CFPB also gains new powers that will eventually impact credit unions. As the CFPB continues to regulate, credit unions will need to learn how to track and monitor the CFPB’s rulemaking proceedings and follow any additional initiatives the CFPB undertakes that could impact credit union operations.

Regulatory Authority CFPB’s regulatory authority While most credit unions will not fall under the CFPB’s supervision and examination authority, they will be subject to its regulatory authority. On July 21, 2011, the Dodd-Frank Act transferred regulatory authority of the “enumerated consumer laws” to the CFPB. This transfer of authority means the CFPB is now the regulator tasked with implementing consumer laws through regulation. Going forward, credit unions need to monitor the CFPB for changes and amendments to consumer regulations. The CFPB’s amendments to consumer regulations will apply to credit unions of all asset sizes.

Direct Supervision Large Bank Supervision Program – banks, thrifts and credit unions with assets over 10 billion Non Bank Supervision Program – Non bank providers of consumer financial products and services All non banks in the residential mortgage, private education lending and payday lending “larger participants” in other markets Any non bank that it determines is engaging or has engaged in conduct that poses risk to consumers with regard to consumer financial products or services

Service Provider Supervision Service Provider definition: Any person who provides a material service to a covered entity in connection with the offering or provision by such covered entity of a consumer financial product or service 12 U.S.C. 5514, 5515,5516 Title X grants CFPB Supervisory and Enforcement authority

Due Diligence Verification process used by the covered entities to insure the service providers they use understand and are capable of compliance with all consumer protection laws, included but not limited to: FDCPA FCRA TCPA GLBA TRPPA HIPAA

Verification & Monitoring Process Review Service Provider policies, procedures and training materials Language in contracts setting forth clear expectations and compliance requirements Language in contracts setting forth consequences for non compliance and violations of consumer protection laws Review insurance, bonds, licensing and complaint handling procedures Audit process for monitoring

Complaint Handling Program CFPB actions are driven by complaints Service Provider MUST have a system in place to track and respond to consumer complaints Service Provider MUST demonstrate they take prompt action to address complaints and respond accordingly Covered entity MUST address any problems and “terminate the relationship where appropriate”

CFPB Audits Start at the top Supervision & Examination Manual Oct. 2011 CFPB Examiners should seek to determine whether the Board and Senior Management have: Demonstrated clear expectations regarding compliance, not only within the entity but also to third party Service Providers The Board of Directors is ultimately responsible for administering a compliance management system Audit Board of Directors meeting minutes and through direct interviews

CFPB AUDITS Due Diligence Contracts Oversight Financial Condition Relevant Experience Knowledge of Applicable Laws and Regulations Reputation Effectiveness of Operations & Controls Management of Information System Contracts Scope Cost/Compensation Performance Standards Reports Audits Confidentiality & Security Oversight Monitor Financial Condition Monitor Controls Assess Quality of Service & Support Documentation

Risk Monitoring You cannot remove the risk… You can mitigate the risk Service Provider Risk Management Strategic Risk Compliance Risk Reputation Risk Operational Risk Transaction Risk Credit Risk You cannot remove the risk… You can mitigate the risk

Questions ??? Ron L. Brown CSI Group Rbrown@CSI-ARM.com