In news at the Consumer Financial Protection Bureau, the agency released a special edition of its Supervisory Highlights focused on consumer reporting and was handed a major loss from the U.S. Court of Appeals for the D.C. Circuit in an attempt to enforce a civil investigative demand (CID).
What happened
A special 14th edition of the CFPB’s Supervisory Highlights reported examination findings in the area of consumer reporting, discussing the bureau’s experiences with both “consumer reporting companies” and furnishers, or the companies that provide information to CRCs.
As the first federal agency to have supervisory authority over many of the key institutions in the consumer reporting ecosystem, the CFPB explained it has worked to achieve its vision for the industry, rooted in the obligations and rights set forth in the Fair Credit Reporting Act (FCRA) and Regulation V: “A system where furnishers provide and CRCs maintain and distribute data that are accurate, supplemented by an effective and efficient dispute management and resolution process for consumers.”
Recent supervisory reviews of CRCs under the CFPB’s supervisory authority have emphasized accuracy throughout the life cycle of the data collected, maintained and used by the CRC. While the agency hailed “significant advances” that promote greater accuracy, it acknowledged that continued improvements are necessary.
Data accuracy for CRCs requires four key elements, the bureau said: data governance, quality control, public records oversight, and furnisher vetting and data monitoring.
Initial reviews of data accuracy revealed that many CRCs’ data governance functions were decentralized and had undefined responsibilities. But one or more CRCs have improved their policies and procedures and formalized a data governance program, the bureau reported, with personnel authorized and directed to oversee a centralized repository of data definitions, business rules and data quality rules, for example.
On the subject of quality control, follow-up reviews at one or more CRCs found improvements ranging from the establishment of “robust” quality control programs that regularly assess the accuracy of information included in consumer reports to enhancements in oversight of third-party public records providers. Changes have also been made in the way CRCs vet furnishers after the CFPB expressed concern that new furnishers were initially vetted but not subject to ongoing monitoring. Such oversight has been stepped up, the bureau said, with “improved” efforts at one or more CRCs to establish and implement enhanced controls, like review of an existing furnisher’s ability to maintain minimum data security standards.
The CFPB reviewed CRC policies and procedures to monitor furnisher dispute data as a component of CRCs’ data accuracy program (such as the use of data indicating that particular furnishers receive a higher rate of disputes from consumers under the FCRA, for example) and found that new procedures “improved furnishers’ dispute response levels.” However, the bureau noted that one or more CRCs has yet to implement policies or procedures to monitor furnisher dispute data.
Dispute handling and resolution was another focus of the CFPB’s supervision. CRCs have obligations under the FCRA to process and investigate consumer disputes, the bureau said, and prior Supervisory Highlights have shared improvement in industry processes such as online portals consumers can use to submit disputes and provide supporting documentation.
Building on this progress, the CFPB has kept its eye on “the dispute resolution procedures in place to conduct a reasonable investigation of consumers disputes and communicate the results of the investigation adequately to the consumer.” The bureau discovered failures at one or more CRCs to fulfill the obligation to complete a reasonable reinvestigation of an item contained in a consumer file (by relying entirely on the furnisher to investigate the dispute) and directed the CRCs to revise policies and procedures accordingly.
Other areas needing improvement: providing notice to furnishers of disputes and reporting the results of reinvestigations to consumers.
At furnishers, supervisory observations revealed weaknesses in compliance management systems as well as “numerous violations” of the FCRA and Regulation V that required corrective action. At one or more furnishers, bureau examiners discovered weak oversight by management and the board of directors over furnishing practices, no formal data governance program in place, and failure to update policies and procedures.
The CFPB also provided a laundry list of policies and procedures that one or more furnishers lacked, from handling the investigation of direct disputes from consumers to preventing duplicative or mixed file reporting. Furnishers were found similarly lacking in their compliance with Regulation V, the bureau added, and corrective actions were ordered with respect to maintaining records, internal controls for the accuracy of information furnished, and staff training.
One or more furnishers were found to have provided consumer information to CRCs “while knowing or having reasonable cause to believe that the information was inaccurate because the information furnished did not accurately reflect the information in the furnishers systems,” the bureau said, with errors such as consumers being delinquent or having no payment history. Furnishers were also tripped up by failures to report the results of direct dispute investigations to consumers and to comply with indirect dispute handling requirements.
To conclude the report, the CFPB emphasized that its work in the consumer reporting market remains a “high priority,” noting that CRCs and furnishers “lack incentives and under-invest in accuracy.”
“Overall, we are satisfied with the steady pace of progress in addressing weaknesses identified in Supervision’s first round of accuracy and dispute resolution reviews and will continue to work with supervised companies to ensure that they invest the necessary resources to solve compliance challenges,” the bureau wrote.
In other CFPB news, the D.C. Circuit refused to enforce a CID issued by the bureau to the Accrediting Council for Independent Colleges and Schools, reminding the agency of the limits of its enforcement powers. A nonprofit organization that accredits for-profit colleges in the United States, the ACICS received a CID from the agency in August 2015. The “Notification of Purpose” stated:
“The purpose of this investigation is to determine whether any entity or person has engaged or is engaging in unlawful acts and practices in connection with accrediting for-profit colleges, in violation of Sections 1031 and 1036 of the Consumer Financial Protection Act of 2010, 12 U.S.C. Sections 5531, 5536, or any other Federal consumer financial protection law. The purpose of this investigation is also to determine whether Bureau action to obtain legal or equitable relief would be in the public interest.”
ACICS petitioned the bureau to set aside or modify the CID but the agency refused, filing a petition for enforcement in federal court. A district court judge denied the petition, and the federal appellate panel affirmed.
The Consumer Financial Protection Act, which established the CFPB, provided the bureau with the authority to issue CIDs requiring the production of documents and oral testimony from “any person” it believes may be in possession of “any documentary material or tangible things, or may have any information, relevant to a violation” of the laws that the bureau enforces. “But there are real limits on any agency’s subpoena power,” the D.C. Circuit wrote. “The statutory power to enforce CIDs in the district courts entrusts courts with the authority and duty not to rubber-stamp the bureau’s CIDs, but to adjudge their legitimacy.”
Pursuant to the CFPA, “[e]ach [CID] shall state the nature of the conduct constituting the alleged violation which is under investigation and the provision of law applicable to such violation.” This provision “ensures that the recipient of a CID is provided with fair notice as to the nature of the Bureau’s investigation,” the court said. “Because the validity of a CID is measured by the purposes stated in the notification of purpose, the adequacy of the notification of purpose is an important statutory requirement.”
Considering the Notification of Purpose in the CID issued to ACICS, the panel found it “perfunctory” at best. “[T]he Bureau’s ability to define the boundary of its investigation does not absolve it from complying with the CFPA,” the court said. “We conclude that, as written, the Notification of Purpose fails to state adequately the unlawful conduct under investigation or the applicable law.”
The nature of the conduct under investigation was merely described as “unlawful acts and practices,” which failed to provide ACICS with sufficient notice as to the nature of the conduct and the alleged violation under investigation, the panel wrote, despite the statutory requirement to adequately inform the CID recipient of the link between the relevant conduct and the alleged violation.
“We cannot determine, for example, whether the information sought in the CID is reasonably relevant to the CFPB’s investigation without knowing what ‘unlawful acts and practices’ are under investigation,” the D.C. Circuit said. “That is to say, where, as in this case, the Notification of Purpose gives no description whatsoever of the conduct the CFPB is interested in investigating, we need not and probably cannot accurately determine whether the inquiry is within the authority of the agency and whether the information sought is reasonably relevant.”
Judged similarly inadequate was the CID’s description of “the provision of law applicable to such violation,” which broadly referenced “any other Federal consumer financial protection law.” Combined with the insufficient explanation of the conduct at issue, the CID told ACICS “nothing about the statutory basis for the Bureau’s investigation,” the panel said. “Indeed, were we to hold that the unspecific language of this CID is sufficient to comply with the statute, we would effectively write out of the statute all of the notice requirements that Congress put in.”
To read the CFPB’s Supervisory Highlights, click here.
To read the opinion in CFPB v. Accrediting Council for Independent Colleges and Schools, click here.
Why it matters
The CFPB said its emphasis on data accuracy and compliance management has shifted the perspective of the consumer reporting industry to one of “proactive attention to compliance, as opposed to a defensive, reactive approach in response to consumer disputes and lawsuits.” The bureau promised to continue its efforts, writing that it was “encouraged by some positive trends.” The CFPB’s focus on furnishers should be noted by those supplying information to CRCs.
While those in the consumer reporting industry can expect continued supervisory oversight, other entities may see changes as a result of the D.C. Circuit’s refusal to enforce a CID issued by the CFPB and in light of other recent CFPB reversals. Given the federal appellate panel’s conclusion that the bureau failed to comply with statutory requirements in its investigatory efforts, the agency might re-evaluate its approach to CIDs going forward.
