Heather Anderson The CFPB fined Citibank $700 million on July 21, charging the bank with unfair and deceptive acts and practices in its credit card activities prohibited by Dodd-Frank. The following day, the bureau fined Discover Bank $18.5 million for UDAAP violations as a result of the bank's student loan servicing.

While this might seem like great news for credit unions, it is not. In fact, those responsible for credit union compliance should be very concerned.

The problem isn't UDAAP itself, but instead, the way the CFPB enforces it. Traditionally, regulators interpret new banking laws, then propose and finalize detailed regulations.

UDAAP does not have any implementing regulations and it probably never will. In fact, CFPB Director Richard Cordray said the bureau will not issue any regulations that define exactly what actions or practices violate the law.

So how will a bank, credit union or other financial services provider know if it has violated the law?

Like Citibank, Discover Bank and others, the institutions will know when the CFPB issues an enforcement action or consent order. The CFPB has also said that even if a financial services provider complies with all consumer financial protection laws, it could still be charged with violating UDAPP.

As a result of these broad guidelines, the CFPB has already issued several enforcement actions that have produced almost $2 billion in fines and restitution orders. Additionally, financial services providers have spent billions trying to interpret UDAAP, develop compliance policies and procedures and train employees.

If credit unions believe they are safe because they don't practice the same lending and collection actions as big banks such as Citibank, they are wrong.

NAFCU issued an alert to members on the topic earlier this week, and the ways in which credit unions could violate UDAAP are very troubling.

According to the CFPB's Supervision and Examination Manual and consent orders, an act or practice is unfair when it meets the following three-part test: It causes or is likely to cause substantial injury to consumers; the injury is not reasonably avoidable by consumers; and, substantial injury is not outweighed by countervailing benefits.

NAFCU rightly points out the key phrase here is substantial injury. Normally, substantial injury means monetary harm. However, according to the CFPB, substantial injury can occur without monetary harm. For example, emotional harm could qualify as substantial injury and could be determined by such subjective measures as excessive collection calls.

A recent consent order from the CFPB cited collection activities that included calls to work numbers, the disclosure of consumer debts to non-liable third parties and calls to consumers after being notified they were represented by legal counsel.

What is considered excessive? Five calls? 25 calls? What constitutes debt disclosure to third parties? What if legal counsel doesn't accept or return calls?

The CFPB has not issued specific regulation or guidance on the matter.

That means some snot nosed millennial at the CFPB who doesn't think he needs to repay his student loans, and was probably never disciplined by his parents, could use subjective measures to determine if your credit union's collection practices caused substantive injury, and there's nothing you can do about it.

Another gem in the three-prong test is the loosey goosey definition of acts or practices that are unfair because they prevent consumers from reasonably avoiding injury. That includes the requirement that institutions give consumers all the information they may need to make a rational and reasonable decision.

In other words, according to NAFCU's bulletin, if information has been hidden, omitted, withheld or presented inaccurately, it could hinder the consumer's decision-making process. However, the CFPB refuses to define exactly what information needs to be provided.

The third and final dagger for credit unions is the requirement that any substantial injury must offset benefits produced by the offending act or practice.

So, even if a credit union allegedly violates UDAAP, it could lower prices, offer more products and services, or offer other competitive olive branches – and maybe get away with it. Again, this is extremely subjective and open to interpretation by the CFPB.

Credit unions can bury their heads in the sand and tell themselves that because they can't afford to pay millions of dollars in fines, the CFPB probably won't come after them. Like a poor person at low risk of an IRS audit, that might be true.

However, the fact that the CFPB could pursue credit unions for violations of UDAAP based upon commonplace lending and collection practices should keep the entire community up at night.

Instant Insights /

Subjective UDAAP Enforcement the Next Big Threat

Related Stories

Recommended For You