Episode Description
This episode of the COMPLY Podcast is the second part of a conversation between four industry experts—James Kim from Troutman Pepper, Brian Serafin from Weiner Brodsky Kider PC, Pia Thompson from lawesomeGC, and Rhonda McGill from PerformLine.
Today they continue their discussion on UDAAP. Topics on today’s episode include:
- How to avoid common UDAAP pitfalls
- Mitigating UDAAP compliance risk in marketing materials
- Developing effective UDAAP compliance programs
Show Notes:
- The Top UDAAP Compliance Issues Report: https://bit.ly/43lT1FB
- Watch On Demand – Minimizing UDAAP Compliance Risks: https://bit.ly/45qzuWm
- UDAAP Resource Library: https://bit.ly/3IAYW1I
- Connect with Pia Thompson: https://www.linkedin.com/in/pia-thompson/
- Connect with James Kim: https://www.linkedin.com/in/jameskim99/
- Connect with Brian Serafin: https://www.linkedin.com/in/brian-serafin-23297620/
- Connect with Rhonda McGill: https://www.linkedin.com/in/rhonda-mcgill/
Subscribe to COMPLY: The Marketing Compliance Podcast
About COMPLY: The Marketing Compliance Podcast
The state of marketing compliance and regulation is evolving faster than ever, especially for those in the consumer finance space. On the COMPLY podcast, we sit down with the biggest names in marketing, compliance, regulations, and innovation as they share their playbooks to help you take your compliance practice to the next level.
Episode Transcript:
Ashley:
Hey there COMPLY podcast listeners and welcome to this week’s podcast. This week is the second part of a conversation that we picked up during our last episode, between four industry experts on all things UDAAP, including James Kim from Troutman Pepper, Brian Serafin from Weiner Brodsky Kider PC, Pia Thompson from lawesomeGC, and Rhonda McGill from PerformLine. Topics this week include how to avoid common UDAAP pitfalls, mitigating UDAAP compliance risk in marketing materials, and developing effective UDAAP compliance programs. Thanks for listening and enjoy!
Rhonda:
There’s been many enforcement actions from states, and banking, and federal regulators. Without calling anyone out in particular by name, could you summarize at a high level some recent enforcement actions that you might be aware of and some of your thoughts on them? I would like to start with you, James, because I believe you have some interesting insights.
James:
Yeah. So this is a perfect kind of segue from kind of the exotic, more aggressive use of UDAAP including abusive. Me and some colleagues we filed an amicus brief in the Southern District of New York in a case brought by the CFPB and the New York AG jointly against an indirect auto company. And the reason why I want to call that out, other than my kind of personal involvements, it is kind of top of my mind is two of the claims are perfect examples of everything we’ve been talking about. They are aggressive novel uses of UDAAP, and I would say take it up the further, because the conducted issue is either expressly permitted by TILA or expressly not banned by TILA, and they [the CFPB] don’t like it. Again, they are outcome oriented. They have a paternalistic view.
James:
it is a practice in the marketplace that is been going on out in the open for decades. And instead of doing amending TILA, which is never going to happen, but, you know, public rulemaking on Reg Z, they just like concoct a UDAAP theory and then they litigate it. So it is enforcement by, I mean regulation by enforcement and litigation. So in that case, it is indirect auto, right? These are credit sales. And I think as we all know in the credit sale point of sale finance, you know, merchants, dealers take a discount from the finance company, right? I mean, think about how credit cards work and TILA expressly permits it, right? But again this case, the CFPB and New York AG assert that it is an unfair practice. And I think the one other thing about this example that I would point out similarly Truth in Lending Act and Regulation Z only imposes the ability to pay requirements for credit cards conspicuously absent from other areas, right?
James:
Well, mortgage is a different area. I’m not a mortgage person, so I’ll let Brian, but on unsecured it is only for credit cards. And certainly not for auto or student loans for that matter. But again, in this lawsuit, they fashion a UDAAP theory to say it is unfair to not assess ability to repay beforehand, even though it is a conspicuously missing from the Truth in Lending Act and Regulation Z, right? they are very clear when they want you to do ability to repay in Truth in Lending and Reg Z and when they are not, and in this case you are not required to do it, but they want to impose that, make up that requirement by fashioning it as UDAAP.
Pia:
James, I just have a couple of questions. So with respect to ability to repay, do they provide any explanation as to how that would happen while you are sitting at the car dealership to get your car loan? And then my second question has to do, when you talk about the discount, right? That’s almost the buy now pay later model, right? Because it is no interest for four weeks. I buy a hundred dollars mascara from Sephora and the buy now pay later, people pay Sephora ninety-five dollars and I pay them hundred dollars, right? And so those are my two questions.
James:
Yeah, I’ll take them in reverse. I mean, the merchant discount, I don’t know the answer to that. There’s kind of no rhyme or reason why they object to it in this context, but not elsewhere. So I don’t know. And then on the ability to repay, I mean it is not in the complaint. Whether or not privately they discussed this is what you should be doing in a more detailed prescriptive manner, I don’t know. But my point is it is not required. And even if they did have private conversations, it is kind of like you can’t just unilaterally tell me how to do one that I must do ability to repay and tell me how to do it when you haven’t gone through the proper rulemaking process like you did with credit cards ability to repay in Reg Z. So if you are going to do it, do it fairly openly with comments, with input from all stakeholders. Don’t just like have three enforcement attorneys tell me how to do ability to repay.
Brian:
I think that that is actually a really good point. I mean, you know, again, if you look at Reg Z for example, the steps you have to go through to do the ability to repay analysis are complicated. And you have to do it in a certain way, in a certain process and to just say, oh, yeah, do an ability to pay analysis without saying what exactly that entails does make a lot harder to actually turn that guidance into an actual compliance program or into policies and procedures.
Rhonda:
Absolutely.
Brian:
Actually, sort of just a little different than, you know, talking about another enforcement trend that I’ve noticed this, the CFPB also seems to be taking a lot of interest in, I guess we could kind of call add-on products. These would be things like programs where you sign up and you get charged a monthly fee for something. If you sign up for a credit card, if you get some sort of insurance or protection they’ll take care of the balance in case some issue comes up. They seem to have a lot of concern that all these add-on products are basically just a way of putting fees onto people without giving them much in return. Or they are this concern that people are kind of being, again, according to me, they are sort of being tripped into signing up for these things without realizing they are going to be getting, for example, a monthly payment or some sort of ongoing payment over time that, I guess the CFPB is concerned that the person will forget that they signed up for it and every month they’ll keep paying this charge without really using this product that they signed up for.
Brian:
And so I think that is something actually they’ve started to show a lot of interest in, and they are trying to find some ways to either get people to go back on them or to really strengthen the ways that these programs are disclosed and presented to consumers and making sure consumers are reminded for them after they sign up.
Rhonda:
Yeah, that is happened to me. I had a couple of subscriptions where it was like, I forgot I even subscribed to that and just going through a bank statement and was like, what is this? And they’ve been taking money out of my bank account every month for a year. So sometimes I think it can happen, sometimes it can be confusing to the consumer. I don’t know if it needs to come through better in a disclosure or how can we better educate the consumer? Because to me, it is a consumer protection issue. But I think that it is an opportunity across the board with those types of disclosures. You know, if we’re doing add-ons, there should be a disclosure and maybe even that reminder that you have this, do you want to continue it periodically. I think it is great marketing. I think it builds trust with the consumer.
Brian:
I think that is right. I think part of the issue is the CFBP is coming at it with it with a more of a hatchet than a scaffold. I have some banking clients, for example, some of these add-on products, they created them because customers are coming and say, well, I’m having a problem with X, is there any way you can help me? And the bank will think about this, if we sell this extra product, it’ll give you this extra layer of protection cases, particular issue arises. You know, a a lot of these programs can be very helpful for consumers. So the idea that they could just be knocked out in a broad stroke kind of, in a way it is sort of, it is anti-consumer. It takes away a consumer action.
Rhonda:
With you guys, I know you probably have a lot of clients, you definitely Brian in the mortgage space and James in the fintech space. How are you guiding your clients to help them to avoid these potential pitfalls? Because as you said, they are coming after them with a hatchet, so if they are coming after you with a hatchet, you know, maybe there’s some safeguards that they could put into place to just make sure that they are protecting themselves. Brian, what are you thoughts?
Brian:
Well, so part of it, we try to stress for our clients that that compliance is an ongoing process. You don’t do it once and then you are done. Right? For example, a lot of our clients, they have a policy and procedure about UDAAP compliance. And a lot of them they look and they say, well, the statute hasn’t changed. They haven’t released a new formal regulation on UDAAP, therefore, we don’t need to update our policy. Everything’s good. And our thought says, well actually the statute might be the same, the regulations haven’t been changed, but there’s a lot of new guidance, there’s a lot of new consent orders, there’s other things that are coming out that are either previewing what the CFPB is expecting or showing these change interpretations.
Brian:
So what you really need to do is, sometimes it is once a year, once every other year, there might be an appropriate length of time you really need to go back through these policies and procedures looking when they were written. And then how things have changed over the last year or two years to make sure you are really encompassing the major concerns that are out there. A lot of our clients, they are focused on their ads. They want to make sure their ads are not deceptive, which is really, again, extremely important. But making sure the ads are not deceptive is not the whole gamut of UDAAP protections. We’re just trying to stress to them that it is an ongoing process. You really have to keep track of what’s changing and make sure you are keeping up with those changes. In some case, you are being proactive to get ahead of where you think changes are going to be happening going forward.
Rhonda:
Very fair point, I think James…
James:
Yeah, really quick and then I would love to hear what Pia has to say because she’s kind of wearing that in-hat role. Just a couple of practical considerations and consistent with the theme and what I’ve been saying, you are not going to find it in UDAAP in precedent in the elements. So this is kind of the overlay of what the regulator expectation is that isn’t rooted necessarily in the statute. The product or service you have to be able to clearly convey the value to the consumer, right? You have to make that clear what is the value proposition to the consumer. So that is kind of the disclosure communication part. But then here’s the outcome part. You have to actually allow the consumer to reasonably unlock and get the value of the product or service.
James:
it is one thing to tout it, but if you put obstacles or make it difficult for them to actually access or use the value, that is where you are going to have an unfair and abusive problem. And then, you have to Brian’s point, it is not just the front end, go through compliance before product launch. You have to actually track product usage and the outcomes, the data afterwards to make sure that actual usage in the wild is sensible, it is reasonable, right? That the outcomes in individually or in the aggregate are reasonable, they are fair to the consumer or whatever that might be. I mean, if you talked about add-on products, if an optional add-on product is adopted or used 95% of the time, that is going to be a red flag for the CFPB. So then you know that you have to go back to the drawing board and say, is the process and the disclosures around the optional add-on? Are they really good enough or are people going to assume that they are really not optional?
Rhonda:
Right, and thank you. And Pia…
Pia:
I think those are fabulous points. As far as progress and plan for review of policies and procedures, I always say you are better off not having a policy if you never read it and don’t do it. So you definitely need to read it and make sure that it is trained on in the entire company. I think James, that tracking is absolutely essential. And so I think you can convince the use of resources in the tracking from a business perspective as well. Right? Well, of course we got to track it. Like is it worthwhile to even have it? All those kinds of things. And then you get into value propositions that could be conflicting. And so this is just a concrete example. So in the subprime space, sometimes credit insurance is offered. So on the one hand,, these are subprime folks, they don’t have a lot of savings. If something happens, this credit insurance will take care of that obligation.
Pia:
On the other hand, if you are dealing with folks who don’t have a lot of money, shouldn’t every dollar they have go to paying off the obligation as opposed to paying a premium for the credit insurance, right? And so where does that come out? And so I think that that is part of the add-on product UDAAP, right? For some people I think it is a glass half full, half empty. Like some people would look at my two choices and be absolutely certain, which is the right one.And that doesn’t help when you are working with a regulator, even though they might be as certain, they might not have a nuanced an ability to approach things in a nuanced way, but it is not black and white.
Rhonda:
That’s for sure. So for the sake of time, because we have just gotten into this conversation, and I still have a whole bunch of questions, I want to talk a little bit about going into a little bit of the identifying and mitigating some UDAAP risks. So many of our clients are in the marketing compliance side of the world. There’s also a lot of our clients that are utilizing our product for performance purposes. So we know UDAAP has been a hot topic for a lot of our clients. And so we recently put together a UDAAP report that did a deep dive into some of the most commonly flagged terms and phrases based on the thousands of marketing assets that we’re ingesting for our clients in our platform, and this is on a daily basis.
Rhonda:
So some of our top finds highlighted in the report were around exaggerated claims, subjective language, no barrier to entry, and false sense of urgency. So there’s so many layoffs in the in many spaces of the financial industry right now, as we all know. And I’ve seen some instances where marketing teams have been taking over the marketing compliance pieces from now shrinking compliance teams. What advice would you give to companies that are trying to scale their businesses during these times? And especially those that are no longer have a compliance team or a full compliance team that can handle some of the some of those issues. Who would like to go first? I’ll turn it to Brian.
Brian:
Sure. Well again, our advice to our clients is be very careful when you scale back your compliance department. It might seem like an easy way to save money in the short run, but a few years down the road when you get a civil investigative demand from the CID or a DOJ subpoena, it might suddenly seem like you haven’t actually saved a lot. Something interesting, the CFPB isn’t really concerned about if the economy is up or down, they are not really concerned if your business is making a lot of money or not. You know, there was some of the bank regulators like the FDIC or the OCC, they are actually very concerned about the stability and soundness of the bank. They really have a problem if a bank goes under, the CFPB has less of a problem if your auto lending business or your credit card company goes under because that is not part of their mission. So from their perspective, the fact that you are in a tougher economy is just not something that they are really going to consider when deciding what’s necessary to protect consumers.
Brian:
And so kind of going to that, obviously again, this is a hard time a lot of companies are facing some volatility. And the best thing we can tell them is you really want to focus on putting some of that advanced investment into your compliance management system for example, because once you get it set up, I don’t want to say it is going to run itself, but the after the fact costs are going to go down significantly. Basically it is making sure you are integrating all these things into your businesses to make sure you are collecting information you need as it happens, as opposed to ending up in a situation where it is the end of the year and you suddenly have to collect fifty different types of doctrines from ten different departments and everybody’s scrambling to do it and all at once, and also trying to do all their regular job duties. So again the best advice we can say is focus on getting things set up upfront so that you can save money on the back end, and that way if there are fluctuations in the market or difficulties, you are less faced with this concern about what needs to be cut.
Pia:
And from an in-house perspective, I think the reduction, let’s be practical. How can a company reduce some headcount for a handful of months, right? Like that permanently. So what is your least risky advertising material going to be? Well, stuff that you’ve already used and you are not even changing a comma, right? And I’m not saying no risk, but that is going to be the least risky piece to use. Now if you’ve decided to get rid of your compliance review, creating a brand new piece is not advised, right? Stick with what you got and then to keep your costs in line, maybe consider a fractional demo council. You know, it is something that could work for you budget wise, but I think that is part of it is there are some practical things you can do to minimize the advertising risk if that is a situation you are in for a handful of months.
Rhonda:
And I think there’s still that competition though, because now the market is getting a little bit more competitive. Everybody is trying to be seen and they are taking more risks. So it is like you are taking more risks but less compliance. It is kind of scary for folks. James, did you want to weigh in on that one?
James:
Just a quick point. You know if the objective, and I think it is for everybody, especially if your earlier stages to scale, to me, scale means grow primarily by volume. And I think the way that you could balance that growth while managing risk is to reduce complexity, right? When I hear companies want to do something so complicated, you are multiplying the risk because the product itself is complicated. So that is embedded in the product and the processes around it, but then their execution risk, it is also magnified. So I mean it is not pure legal advice, but I think the practical compliance business advice is, okay, I get it, you have to scale. Your investors require it, you got milestones you got to meet, can you kind of reduce some complexity so that you could scale without picking on undue risk.
Rhonda:
Fair?
Pia:
And there is the cardinal rule, right? You cannot cut your way to growth, it is impossible. And it is impossible for governments, municipalities, companies, you can ride out some hard times, deal with cash flow issues, but if you really want to scale it takes investment. And so I think that is something that people need to be reminded of.
Rhonda:
Sure.
Pia:
You are going to rule out this number of people. I don’t think they were sitting around doing nothing. Right? So it is going to impact your growth trajectory.
Rhonda:
For sure. It is difficult times, that is for sure. Are you going to say something Brian?
Brian:
Yeah, just one other thought. It is the job of either the legal department, the client’s department, or your outside counsel, it is helping your clients understand where the risks in their business are. Because most of our clients, for example, for a mortgage company, the person who started them, they were usually somebody who started out as a loan originator. Someone who met with customers, explained to them the product, got them to agreed to a loan so their background isn’t necessarily going to be in terms of compliance or risk management. So again, your outside council, your legal department, they have to educate sort of the business side people on what the company’s areas of risks are. So they can make an educated decision about what can be cut with limited risks or what can be expanded with limited risk versus what are more high risk areas where, again, you are going to have to do things, a little more slowly and a little more deliberately to make sure. It is again, making sure your clients or the business side people really understand all the aspects of their business and not just the sales side.
Rhonda:
Absolutely. I know we always hear folks talk about the importance of building a sound compliance program that includes updated policies, your training, making sure it is timely and everything is like going a million miles a minute right now. So one of the more important things that a business can do is to ensure that they are monitoring and that they are documenting. What are some areas where you would recommend our viewers place a little bit more attention during these times when they have smaller teams, but yet everything’s on spreadsheets or in file folders or who knows where, what’s some advice that you can give them?
Brian:
Just again one thing, there’s a lot of software out there that makes it a lot easier these days to automate business functions or functions or to track things automatically. I’ve seen this a lot in particular with respect to training. If you are tracking which staff members or which employees went to which training programs on an Excel spreadsheet that is kind of the bare minimum. I mean, really there’s a lot of software these days that’ll really make it easy. You know, it’ll automatically know when the person did their training, it’ll send them notifications when they didn’t tell them to go get it. It’ll tell your compliance officer, hey, employee x hasn’t done training y so you really need to get on them now because, you know, the one year deadline where they are supposed to have that training is coming up, or it might have passed, so you really need to make this happen. Again it is a little bit more of an upfront investment, but the amount it saves you in terms of employees manually inputting things on spreadsheets in terms of compliance risk, it really tends to pay off in the long run.
Rhonda:
Okay, great.
Pia:
And Brian, I think that is perfect. And the example with the spreadsheets and everything else, right? Resources aren’t just dollars, it is people, it is time, it is all of those kinds of things. And so there are some great solutions.
James:
I guess that leaves me last here. So I’m going to kind of turn away from resources cause I think you guys got that covered. I think I try to put myself in the shoes of the people I work with, right? So their in-house council may be compliance and they have to sometimes butt heads with business, right? And it is hard to educate business people about the UDAAP risk because it is so subjective, blah, blah, blah, right? I think one helpful tool for everybody, it is an exercise for everybody and business people I think will understand this intuitively, is can we explain, defend, and feel comfortable about whatever it is that we’re considering doing? If it were blasted in mass media, my grandmother, a judge, Washington Post or whatever, because if you kind of frame it as a legal issue, it might be a tougher education process if you are the in-house legal or compliance professional. But if you kind of phrase it that way which I think more aligns with how the CFPB views it, because as we said they don’t feel bound by precedent. That would be my suggestion is what it boils down to do we feel comfortable explaining, defending this to the media, the mass public, a judge, forget the technicalities of the law.
Rhonda:
Absolutely. Protecting the brand is very important. That’s one of the things we take very seriously with our clients, is making sure that, our tenants are discover, monitor and act for that reason. Because you want to know what’s out there so that you can be on top of it and take action before the regulators come after you. So I thank you guys so much for such a great discussion. As we’re concluding, I want to go around the horn one more time to allow each of you to share some of your closing thoughts and maybe a takeaway for our attendees as it applies to UDAAP compliance and risk. And if you have anything that you’d like to share with them that would be great. Let’s start with Pia.
Pia:
Thank you so much for the chance to participate. I feel like I have some great takeaways and I think people should find folks like Brian and James and PerformLine and perhaps exactly them for the pulse on what’s happening. And my big takeaway for a new way to articulate and think about it is the results-oriented aspect of the CFPB. And I think I’ve thought that before, but I think that way to articulate it is just fantastic and we’ll also frame my thinking.
Rhonda:
Thank you so much. James?
James:
I guess this is a little bit of a looking ahead thing. Like a lot of people in my field, I’m carefully tracking at this point it is not really tracking, awaiting Supreme Court decision on the CFPB constitutional issues. But that is kind of obvious if you are a CFPB practitioner. I think related to that, there seems to be a broader challenge against administrative agency regulatory power. So I’m keeping careful track of that too. And I don’t oversell that to say companies feel like, they have card blanche to do whatever they want, but it is just these are sea change potentially developments that we should all keep an eye on.
Rhonda:
For sure. And Brian?
Brian:
I guess sort of the thing I always go with is there there’s two phrases that really scare me. It is one, everybody else does it or two, that is the way we’ve always done it. Whenever I hear some of those phrases from a client, that is kind of a code red moment.
Brian:
That’s interesting you said that. Let’s think about that because you’ll see these instances where you said we focus on it this way, we actually aren’t really a hundred percent sure why we do it that way or how that makes it legal.
Brian:
So again it just goes back to this that compliance is dynamic. It is always changing, kind of going what to James said, you know, regulation to be cyclical. You could have a really laissez fair administration that really is hands off and then you could have a new one come in and suddenly everything’s back on the table and there’s no grace period. We’re going to heavy fines right away. So again, it is always staying up to date about what’s happening and what you can do to get ahead. At least not to fall behind.
Rhonda:
Exactly. There you go. And I would say that my takeaways based on James’ statement is you got to be able to explain it. You got to be able to defend it to your mom, your daddy, the regulators and everybody else. So I will remember that one forever. Thank you so much. This was such a great discussion and hopefully we’ll have you guys come and visit us with us again for one of our future sessions.
Ashley:
Thanks for listening to this episode of the COMPLY Podcast. Many of the key topics of discussion today are highlighted in our Top UDAAP Compliance Issues Report, which I will drop for you in today’s show notes, if you have not had a chance to read it yet. And if while listening to our podcast today, you realize you may need to prioritize incorporating UDAAP into your marketing compliance program, I’m going to include a link to our UDAAP resource library. It has a number of helpful pieces to help you better understand and prioritize UDAAP compliance. As always, for the latest content on all things marketing compliance, you can head to content.performline.com. And for the most up-to-date pieces of industry news, events, and content, be sure to follow PerformLine on LinkedIn. Thanks again for listening and we’ll see you next time.
Rhonda McGill 
Xavier Holland