Winter 2018

Be Proactive: Managing UDAP and UDAAP Risks

Related Practices

Related Industries

Attorneys & Professionals

By Anthony D. Weis and Rodney A. Holaday
(Published in the Winter 2018 issue of The Bankers' Statement)

While the prohibition on unfair or deceptive acts or practices in or affecting commerce (UDAPs) by financial institutions is not new, we have observed a noticeable uptick over the past few years in the number of alleged UDAPs cited by federal banking regulators in the course of examinations. Acts or practices that, historically, may have been identified within an examination as a violation of a specific consumer protection statute or regulation (e.g., TILA, TISA, RESPA, etc.) and typically addressed in the examination report as a matter requiring attention (MRA), appear to be more frequently considered and scrutinized as potential UDAPs. In addition, acts or practices that are in technical compliance with consumer protection statutes and regulations may nonetheless be scrutinized as potential UDAPs.

The potential impact on financial institutions in this area can be significant. A finding of a UDAP can subject an institution to increased supervisory and enforcement consequences, which, in addition to restitution and uncomfortable communications with customers, may include formal or informal enforcement actions, downgrades in compliance and/or CRA ratings, and possible civil money penalties. These supervisory and enforcement actions can further result in significant restrictions on a financial institution’s ability to engage in acquisition transactions, branch and market expansions, and new lines of business.

In view of the foregoing, it is important for all financial institutions to be aware of the types of acts and practices that may implicate concerns, and of the standards and policies established by the federal banking regulators and the Consumer Financial Protection Bureau (CFPB) in interpreting and applying the prohibitions on unfair, deceptive and abusive practices.

Background

Section 5 of the Federal Trade Commission Act (FTC Act) prohibits all persons, including banks and other financial institutions, from engaging in "unfair or deceptive acts or practices in or affecting commerce."1 The FTC’s prohibition on unfair or deceptive acts or practices has been the subject of examination and enforcement by the bank regulators for several years. Pursuant to Section 8 of the Federal Deposit Insurance Act,2 the Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System (FRB) and the Federal Deposit Insurance Corporation ((FDIC) and together with the OCC and the FRB, the federal banking regulators) are authorized to take appropriate action against national and state banking institutions for violations of any laws or regulations, including Section 5 of the FTC Act. Between 2002 and 2004, the federal banking regulators issued specific guidance to financial institutions addressing the enforcement of the UDAP prohibition and setting forth standards for what constitutes an unfair or deceptive act or practice.3

In 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) implemented an additional statutory prohibition on engaging in unfair and deceptive acts and practices and also introduced a further prohibition on "abusive" acts and practices. Pursuant to Sections 1031 and 1036 of the Dodd-Frank Act, it is unlawful for any provider of a consumer financial product or service to engage in any unfair, deceptive or abusive act or practice (a UDAAP) in the offering or provision of such product or service. The Dodd-Frank Act further provided the CFPB with rule-making, supervisory and enforcement authority to prevent unfair, deceptive or abusive acts or practices in connection with the offering or provision of a consumer financial product or service.

While the CFPB has the express authority to bring enforcement actions against financial institutions for acts and practices it has deemed to be unfair, deceptive or abusive (and has in fact brought such actions), much of the supervision and enforcement continues to be done by the federal banking regulators. This is especially the case for community banks, where most alleged unfair or deceptive acts or practices continue to be raised in the course of regular safety and soundness or compliance examinations.

Virtually any consumer product or service can potentially implicate UDAP or UDAAP concerns. The Federal Trade Commission, as well as the federal banking regulators and the CFPB, have specifically identified certain acts and practices that pose significant risk of being viewed as unfair, deceptive or abusive through regulation, guidance and enforcement actions. Particular areas of concern that have been identified include acts and practices regarding:

Ultimately, a finding of a UDAP or UDAAP is dependent upon the application of a set of general standards and principals to the particular facts and circumstances of each case. This article is a brief summary of these general standards and principals.

What Constitutes an Unfair Practice?

The standard for determining whether an act or practice is unfair is the same under both the FTC Act and the Dodd-Frank Act. Pursuant to guidance issued by the federal banking regulators and the CFPB, an act or practice will be considered to be unfair if (1) it causes or is likely to cause substantial injury to consumers, (2) the injury caused by the act or practice is one that consumers could not reasonably have avoided, and (3) the injury is not outweighed by countervailing benefits to consumers or to competition.

In addition, public policy may be considered as a factor in determining whether an act or practice is unfair, although public policy considerations alone will not be the primary basis for such determination. For example, the fact that a particular act or practice is a violation of a federal or state banking or consumer protection law or regulation can be considered as evidence that the act or practice is unfair. Likewise, the fact that a particular act or practice is permitted or expressly authorized by federal or state law can be considered as evidence that the act or practice is not unfair. As stated above, however, an act or practice can be found to constitute an unfair, deceptive or abusive practice even where the act or practice is in technical compliance with applicable substantive laws and regulations.

In interpreting and applying the three-prong test for unfairness, the federal banking regulators and the CFPB have provided the following guidance:

What Constitutes a Deceptive Practice?

A three-prong test is also used to determine whether a representation, omission, act or practice is deceptive under the FTC Act or under the Dodd-Frank Act. To be considered deceptive, (1) there must be a representation, omission, act or practice that misleads or is likely to mislead the consumer, (2) the representation, omission, act or practice must be deceptive from the perspective of a reasonable consumer, and (3) the representation, omission, act or practice must be material.

In interpreting and applying the three-prong test for determining whether an act or practice is deceptive, the Federal Banking Regulators and the CFPB have provided the following guidance:

What Constitutes an Abusive Practice?

As indicated above, the Dodd-Frank Act added a third prong to the traditional prohibitions under the FTC Act by making it unlawful to engage in any abusive act or practice. Enforcement of abusive practices under the Dodd-Frank Act is delegated exclusively to the CFPB. According to the CFPB, an act or practice will be considered abusive if it does either of the following:

Steps to Manage Risk

Financial institutions should take proactive steps to monitor and manage their UDAP/UDAAP risks in order to minimize the potential for UDAP/UDAAP findings that could significantly impact their institutions. It is critical that financial institutions continually review and evaluate their products, services, policies and procedures for potential issues that could implicate a UDAP/UDAAP. Institutions should carefully review and scrutinize their consumer products and services, in particular any new products or services, to ensure that there are no features that could reasonably be considered to be unfair, deceptive or abusive.

Financial institutions should further evaluate and scrutinize on a regular basis the disclosures and information provided to their consumers to ensure that the information is accurate and complete so that a reasonable consumer can be expected to understand the information and not be misled or deceived as to any term or feature of a product or service. Among other things, institutions should ensure that any contract provision that permits the financial institution to change pricing, fees or other material terms is disclosed clearly and up-front.

Finally, when an act or practice is identified internally or alleged through a customer complaint and implicates potential unfair, deceptive or abusive practice concerns, it is imperative that the institution act diligently to fully investigate the matter, including its scope and potential impact on other consumers. Once a potentially unfair, deceptive or abusive practice is identified, the financial institution should act promptly to correct the act or practice and, if necessary, provide an appropriate remedy (which may include restitution) to affected consumers.

Financial institutions are encouraged to consult their professional advisors and consultants, including legal counsel, early in this process.

__________

1 15 U.S.C. §45(a)(1).

2 12 U.S.C. §1818.

3 See Guidance on Unfair or Deceptive Acts or Practices, OCC Advisory Letter 2002-3, Office of the Comptroller of the Currency (March 22, 2002); and Unfair or Deceptive Acts or Practices by State-Chartered Banks, Financial Institution Letter by the Board of Governors of the Federal Reserve System and the Federal Deposit Insurance Corporation (March 11, 2004).