At the end of 2014, the New York Department of Financial Services (“DFS”) became the first state regulator to settle a case using its authority to enforce the federal Consumer Financial Protection Act (“CFPA”).[1] In Benjamin M. Lawsky, Superintendent of Financial Services of the State of New York v. Condor Capital Corporation and Stephen Baron,[2] the DFS claimed that indirect auto lender Condor Capital Corporation (“Condor”) and its sole shareholder, Stephen Baron, violated both New York State law and the CFPA’s prohibition on unfair, deceptive, or abusive acts or practices (“UDAAP”) by, among other matters, overcharging consumers and deceptively retaining credit balances due to them. The settlement requires Condor and Baron to admit to New York and federal violations, pay an estimated $8-9 million in restitution and pay a $3 million penalty, and surrender all of Condor’s state lending licenses. 

Although several state attorneys general have leveraged Dodd-Frank’s[3] state action provisions to enforce and seek remedies under the CFPA,[4] the Condor case marks the first time a state regulator has used them, and it will likely prompt other state regulators to do the same. In his press release announcing the settlement, Superintendent Lawsky said, “This case demonstrates that the Dodd-Frank Act provides a powerful new tool for state regulators to pursue wrongdoing and obtain restitution for consumers who were abused. We hope other regulators across the country will consider taking similar actions when warranted.”[5]

The DFS’s use of Dodd-Frank’s state action provisions is significant because although the Consumer Financial Protection Bureau (“CFPB”) has enormous power and an ambitious agenda, it does not have limitless resources. Further, the CFPA’s remedies[6]—including steep penalties of up to $1 million per day for knowing violations—are significantly stronger than the remedies otherwise available to many state players. In empowering state actors to enforce the CFPA and pursue its remedies, Congress provided an avenue for states to target institutions that have not yet hit the CFPB’s radar screen or are outside of the CFPB’s authority and to potentially obtain remedies that were previously unavailable to them.

This Client Alert summarizes Dodd-Frank’s state action provisions and highlights key takeaways for institutions subject to the enforcement jurisdiction of state regulators and attorneys general.

I. State Enforcement of the CFPA

The Condor case and the state attorneys general cases invoking Dodd-Frank’s state action provisions are almost certainly precursors to more state enforcement of the CFPA. To be prepared for potential state challenges, it is helpful to understand the Dodd-Frank provisions enabling these types of actions.

A. Who Can Bring an Action and For What

Section 1042 of Dodd-Frank, codified at 12 U.S.C. § 5552, provides the state action language that enabled New York’s DFS and the state attorneys general to file their CFPA complaints. 

Section 1042(a)(1) authorizes the attorney general (or equivalent) of any state[7] to bring a civil action in any federal district court or state court located in that state and that has jurisdiction over the defendant, to enforce provisions of the CFPA or regulations issued under the CFPA.[8] Note, however, that a state attorney general may not use this authority to enforce the CFPA against a national bank or federal savings association, but may use it to enforce a regulation prescribed by the CFPB under the CFPA.[9] This essentially means that state attorneys general cannot enforce the CFPA’s UDAAP provisions against national banks and federal savings associations, but can enforce the CFPB’s regulations against such entities.  Further, state attorneys general can enforce both the CFPA’s UDAAP provisions and CFPB-issued regulations against all other covered persons.

Section 1042(a)(1) also authorizes a state regulator, such as the New York DFS in the Condor case, to bring a civil action “or other appropriate proceeding” to enforce the CFPA or regulations issued under the CFPA against any entity that is state-chartered, incorporated, licensed, or otherwise authorized to do business under state law.[10] In other words, state regulators may bring both UDAAP claims and claims under CFPB-issued regulations against such institutions.

Finally, Section 1042(a)(3) confirms that the foregoing provisions do not effect any enumerated consumer law provision relating to state attorneys generals’ or state regulators’ rights to enforce such laws.[11]

B. State Action Notification Requirements under Section 1042

The state action provisions require a state attorney general or regulator to notify the CFPB and any applicable prudential regulators before bringing an action under the CFPA.[12] The CFPB issued a final rule implementing these notification procedures on June 29, 2012.[13] Under the rule, a state actor must notify the CFPB at least 10 calendar days before initiating any adjudicative proceeding before a court or an administrative or regulatory body to determine whether a violation of the CFPA or regulation prescribed thereunder has occurred.[14] The requirements for the contents of the notice are lengthy and the rule limits disclosure of the substance and fact of the notice.[15]

The preamble to the notification provisions clarify that they apply to proceedings that “initiate an action in a court or administrative body,” but not to “examination findings or licensing proceedings.” Further, the notification requirements do not apply to state actions brought under enumerated consumer laws or the laws for which authorities were transferred to the CFPB pursuant Dodd-Frank.

Importantly, the notice process enables the CFPB to intervene in a state action as a party and, upon intervening, remove the action to the appropriate United States district court, be heard in all matters arising in the action, appeal any order or judgment to the same extent as any other party in the proceeding, and otherwise participate in the action.[16]

C. Remedies Available

Section 1042 enables state actors to secure remedies under the CFPA. Importantly, this includes the following remedies:

• Rescission or reformation of contracts;
• Refund of moneys or return of real property;
• Restitution;
• Disgorgement or compensation for unjust enrichment;
• Payment of damages or other monetary relief;
• Public notification regarding the violation, including the costs of notification;
• Limits on the activities or functions of the person; and
• Civil money penalties of up to $1 million per day for knowing violations of a federal consumer financial law, $25,000 per day for reckless violations of a federal consumer financial law, and $5,000 per day for any violation of a law, rule, or final order or condition imposed by the CFPB.[17]

In addition, the state attorney general or the state regulator may recover its costs in connection with prosecuting such action if the state attorney general or the state regulator is the prevailing party in the action.[18]

II. Important Takeaways

Financial institutions should be familiar with Dodd-Frank’s state action provisions for several reasons. First, subject to the limitations applicable to national banks and federal savings associations,[19] the provisions bestow much of the CFPB’s enforcement powers on every “state attorney general” and “state regulator” in the United States. A pessimistic person might think of this as the creation of hundreds of mini-CFPBs. As if this were not alarming enough, the state action provisions do not contain language limiting state actors’ authority to residents of their own states, and a number of state actors, including the New York DFI, have already used the provisions to seek remedies for out-of-state consumers as well as their own residents.

Equally or maybe even more concerning is that the CFPA’s UDAAP prohibitions are broadly defined and could potentially be used to challenge a wide range of conduct that, in many cases, is not expressly prohibited by state law. Although most states have a statutes prohibiting unfair and deceptive acts and practices (“UDAP”), few, if any, expressly prohibit “abusive” conduct. Further, in many cases, state regulators do not have authority to bring state UDAP claims. Moreover, whether or not a practice is viewed as a UDAAP is often influenced by subjectivity. Ideally, state actors will align their UDAAP interpretations and enforcement policies with those of the CFPB and Federal Trade Commission, thus giving institutions a more uniform view of the types of conduct that could be challenged; theoretically, however, the state actor provisions could open institutions up to hundreds of subjective interpretations.     

Finally, the CFPA’s remedies are considerably stronger than the remedies most state actors can seek under state law, providing a means for state actors to both recover very large monetary awards as well as severely disrupt an institution’s business. In the Condor case, for example, in addition to the financial restitution and penalties, the New York DFS obtained a temporary restraining order that stopped Condor from obtaining new business in any state, froze the company’s assets, enabled the DFS to inspect Condor’s documents and access Condor’s business premises and storage facilities, and allowed the DFS to secure and take control of the business’s premises.[20] Ultimately, the DFS achieved a settlement that will completely shut Condor down and obtain penalties and restitution for the company’s consumers. 

*                       *                       *                       *                       *

Dodd-Frank’s state enforcement provisions further elevate the significant risk to institutions that are not in compliance with the CFPA’s UDAAP prohibitions and CFPB-prescribed regulations. Institutions should consider evaluating the effectiveness their compliance processes to ensure that they are effectively managing their compliance risk.

Notes:

[1] 12 U.S.C. §§ 5481–5603.

[2] Complaint, Lawsky v. Condor Capital Corp. and Stephen Baron, No. 14-cv-2863 (S.D.N.Y. April 23, 2014).

[3] Dodd–Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111–203, H.R. 4173 (2010).

[4] See, e.g., Amended Complaint, State of N.M. v. Capital One Bank (USA) N.A. et al., No. 13-cv-00513 (D.N.M. July 2, 2013); Complaint, People of the State of Ill. v. CMK Investments, Inc. d/b/a All Credit Lenders Inc., No. 2014-ch-04694 (Ill. Cir. Ct. Mar. 18, 2014); Complaint, State of N.M. v. Landau et al., No. 14-cv-00663 (D.N.M. July 23, 2014);

[5] Press Release, N.Y. Dep’t of Fin. Serv., NYDFS Reaches Agreement on Final Consent Judgment with Condor Capital, Obtaining Full Restitution for Consumers Under Dodd-Frank Lawsuit (Dec. 19, 2014), available at http://www.dfs.ny.gov/about/press2014/pr1412191.htm.

[6] 12 U.S.C. § 5552; Amended Complaint, State of Fla. et al. v. Berger Law Group PA et al., No. 14-cv-1825 (M.D. Fla. Aug. 22, 2014).; Amended Complaint, People of the State of Ill. v. Alta Colleges et al., No. 14-cv-03786 (N.D. Ill. Sept. 30, 2014); and Complaint, Consumer Fin. Prot. Bureau et al v. Freedom Stores Inc. et al., No. 14-cv-00643 (E.D. Va. Dec. 18, 2014).

[7] The term “state” means any state, territory, or possession of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the Commonwealth of the Northern Mariana Islands, Guam, American Samoa, or the United States Virgin Islands or any federally recognized Indian tribe, as defined by the Secretary of the Interior under section 479a–1 (a) of title 25.  12 U.S.C. § 5481(27).

[8] 12 U.S.C. § 5552(a)(1).

[9] 12 U.S.C. § 5552(a)(2).

[10] 12 U.S.C. § 5552(a)(1).

[11] 12 U.S.C. § 5552(a)(3).

[12] 12 U.S.C. § 5552(b).

[13] State Official Notification Rule, 77 Fed. Reg. 39112 (June 29, 2012).  The rule is codified at 12 C.F.R. Part 1082.

[14] 12 C.F.R. § 1082.1(a)(1).

[15] 12 C.F.R. § 1082.1(c).

[16] 12 C.F.R. § 1082.1(d).

[17] 12 U.S.C. § 5565(a)(2).

[18] 12 U.S.C. § 5565(b).

[19] 12 U.S.C. § 5552(a)(2).

[20] Temporary Restraining Order and Order to Show Cause for Preliminary Injunction, Lawsky v. Condor Capital Corp. and Stephen Baron, No. 14-cv-02863-CM, ¶¶ 5-32 (S.D.N.Y. Apr. 23, 2014).