Return receipt meets RESPA information request acknowledgment requirement

By Richard Roth

The U.S. Court of Appeals for the Eleventh Circuit has set a very low bar for what mortgage loan servicers must do to satisfy Real Estate Settlement Procedures Act regulations requiring mortgage loan servicers to acknowledge having received a homeower’s request for information. While a servicer must provide a written acknowledgment of receipt within five business days, the requirement can be met simply by signing the homeowner’s certified mail return receipt, the court said in a not-for-publication opinion (Meeks v. Ocwen Loan Servicing LLC).

According to the court, the homeowner had his attorney send Ocwen Loan Servicing a written request for information about his loan, and the attorney chose to send the letter using certified mail. Ocwen received the letter, and an employee signed the receipt, which was returned to the attorney in due course. Seven months later, the homeowner sued Ocwen, claiming in part that it had not provided a timely acknowledgment of having received his letter.

Reg. X requirements. Reg. X—Real Estate Settlement Procedures requires a mortgage loan servicer to acknowledge receiving a qualified written request for information, in writing, within five business days (12 CFR 1024.36(c)). However, neither the regulation nor the staff comments offer any details about the form or contents of that acknowledgment.

The court said there is no precedent as to whether a certified mail receipt can constitute a written acknowledgment. However, the court said—without any analysis—that under the facts presented, the return receipt was sufficient.

Applicability. Reg. X is not the only consumer protection regulation that imposes acknowledgment duties. Reg. Z—Truth in Lending requires a creditor to provide a written acknowledgment of a consumer’s billing error claim within 30 days (12 CFR 1026.13(c)). Like Reg. X, Reg. Z gives no details about what providing a written acknowledgment entails.

The Eleventh Circuit opinion gives no hint about whether a certified mail return receipt alone would be adequate in circumstances other than Reg. X.

For more information about RESPA, subscribe to the Banking and Finance Law Daily.

CFPB snapshot reveals consumers continue struggle with credit report errors

By Katalina M. Bianco, J.D.

Consumers continue to complain about the difficulties of resolving credit report errors, according to the Consumer Financial Protection Bureau’s monthly complaint snapshot. This month’s snapshot covers complaints the bureau has received as of Feb. 1, 2017. The snapshot (Vol. 20) also highlights trends seen in complaints coming from Louisiana and the New Orleans metro area.

 

"Credit reports provide the means for consumers everywhere to take important steps in their financial lives," said CFPB Director Richard Cordray. "The Bureau will continue to work to ensure that credit reports are accurate and when disputed issues arise on credit reports, consumers are able to resolve them quickly and with little hassle."

 

Credit reporting complaints. As of Feb. 1, 2017, the CFPB has handled approximately 1,110,100 consumer complaints across all products nationally. Approximately 185,700 of those complaints were about credit reporting. According to the snapshot, consumers complained about:

• difficulties submitting disputes to credit reporting companies;
• inaccurate information on credit reports; and
• confusion over the variety of scores and scoring factors that accompany credit score information.

 

National overview. The snapshot includes statistics about complaints submitted to the CFPB nationally. The findings include the following:

• Debt collection was the most complained-about financial product or service in January 2017, followed by student loans and credit reporting.
• Student loan complaints showed the greatest increase of any product or service in a year-to-year comparison examining the three-month time period of November through January.
• Georgia, South Dakota, and Mississippi had the greatest year-to-year complaint volume increases from November 2016 to January 2017 versus the same time period 12 months before.
• The top three companies receiving the most complaints from September through November 2016 were Wells Fargo, Equifax, and Transunion. 

 

Spotlight on Louisiana. As of Feb. 1, 2017, consumers in Louisiana have submitted 12,400 of the 1,110,100 complaints the CFPB has handled to date. Of those complaints, 4,500 came from consumers in the New Orleans metro area. The snapshot includes the following findings: 

 

• Debt collection complaints accounted for 34 percent of all complaints submitted by consumers from Louisiana, a rate that is higher than the national rate of debt collection complaints.
• Consumers in Louisiana submitted complaints about credit reporting at roughly the national average.
• The most complained about companies were Equifax, TransUnion, and Experian.

For more information about the CFPB monthly complaint snapshots, subscribe to the Banking and Finance Law Daily.

Report reveals banks' need to bolster risk-management practices for technology vendors

By Thomas G. Wolfe, J.D.

The Federal Deposit Insurance Corporation’s Office of Inspector General has issued a report evaluating “Technology Service Provider Contracts with FDIC-Supervised Institutions.” Generally, while the Inspector General commends the FDIC’s efforts during the past two years to provide financial institutions with guidance on “comprehensive business continuity, cybersecurity, and vendor management,” the February 2017 report (Report No. EVAL-17-004) recommends that the FDIC continue to communicate to supervised financial institutions the importance of bolstering risk-management practices in connection with third-party “technology service provider contracts (TSPs).” In underscoring ways in which the FDIC can direct the focus of its supervised financial institutions on TSP provisions and terms, the IG also recommends that the FDIC’s Division of Risk Management study and assess the extent to which the financial institutions have effectively addressed these issues.

In two prior evaluations, the IG determined that “greater scrutiny” of the sufficiency of TSP contracts with FDIC-supervised institutions was warranted. The stated objective of the latest evaluation was to “assess how clearly FDIC-supervised institutions’ contracts with TSPs address the TSP’s responsibilities related to (1) business continuity planning and (2) responding to and reporting on cybersecurity incidents.”

Findings. According to the report, the supervised financial institutions’ contracts with TSPs did not clearly address TSP responsibilities and “lacked specific contract provisions to protect FI interests or preserve FI rights.” Moreover, the IG found that the pertinent contracts “did not sufficiently define key terminology related to business continuity and incident response.” Consequently, the contracts provided financial institutions with “limited information and assurance” that TSPs could “recover and resume critical systems, services, and operations timely and effectively if disrupted” or that TSPs “would take appropriate steps to contain and control incidents and report them timely to appropriate parties.”

Recommendations. The IG’s report recommends that the FDIC’s Division of Risk Management Supervision continue to stress to the supervised financial institutions the importance of: “(1) fully considering and assessing the risks that TSPs present; (2) ensuring that contracts with TSPs include specific detailed provisions that address FI-identified risks and protect FI interests; and (3) clearly defining key contract terms that would be important in understanding FI and TSP rights and responsibilities.” In addition, the report recommends that, “at an appropriate time,” the FDIC division evaluate the supervised financial institutions’ progress on effectively addressing these issues.

FDIC response. According to the report, the FDIC concurred with the IG’s recommendations and agreed to complete its responsive actions by October 2018.

For more information about Inspector General reports about federal financial regulators, subscribe to the Banking and Finance Law Daily.

Secondary market mortgage buyer can ignore public assistance income

By Richard A. Roth, J.D.

A bank that refused to consider Section 8 housing aid when it decided which mortgage loans met its criteria for secondary market purchases did not violate the Equal Credit Opportunity Act, according to the U.S. Court of Appeals for the Fifth Circuit. Rejecting the Consumer Financial Protection Bureau’s argument for a broader definition of “creditor” under the ECOA, the court said the bank did not participate in the lender’s credit decisions (Alexander v. AmeriPro Funding, Inc.).

Consumers who wanted to buy homes in the Houston, Texas, area sued Wells Fargo Bank and AmeriPro Funding for claimed ECOA violations. According to the consumers, Wells Fargo’s secondary market purchase guidelines explicitly said the bank would not buy mortgages if the buyer’s income came in part from Section 8 assistance. Since AmeriPro wanted to be able to sell mortgages it originated to Wells Fargo, it likewise refused to consider Section 8 assistance.

However, the ECOA makes it illegal for a creditor to discriminate against an applicant because some or all of the applicant’s income is from a public assistance program (15 U.S.C. §1691(a)(2)). AmeriPro directly violated this ban, the consumers claimed, and Wells Fargo violated it as well because its guidelines amounted to participating in AmeriPro’s credit decisions.

Loan buyer discrimination. Potentially the most significant discussion addressed four applicants’ claims that Wells Fargo was a creditor under the ECOA and that it had discriminated against them. Despite the CFPB’s arguments supporting the consumers, the theory was rejected.

Looking at the ECOA’s definitions of “applicant” and “creditor,” the court decided that Wells Fargo could be a creditor only if it participated in the decision to extend credit. The bank’s secondary market purchasing guidelines did not constitute participation in the credit decision.

The CFPB argued for a broader view of participation, such as that included in Reg. B. However, even Reg. B would not include “those who have no direct involvement whatsoever in an individual credit decision,” according to the court.

Other lending. This could be seen as bringing into question the CFPB’s guidance on the ECOA, Reg. B—Equal Credit Opportunity (12 CFR Part 1002), and indirect auto lending. The bureau has, since issuing guidance in 2013, held and enforced the position that indirect auto lenders—companies that buy loans originated by automobile dealers—are creditors and can be responsible for the dealers’ discriminatory practices (see CFPB Bulletin 2013-02).

However, the bureau’s position in this case seems to have gone one step farther than its indirect auto lending guidance. The process described in the 2013 bulletin included the dealer forwarding the consumer’s credit information to one or more potential loan borrowers, who then would make an individual decision as to whether to buy the loan. While mortgage loan originators may follow a similar practice in finding investors to fund a loan, the court opinion did not indicate that Wells Fargo, as a secondary market buyer, was consulted on individual loans before credit decisions were made. In fact, the court’s reference to direct involvement in an individual credit decision could imply that there was no such prior consultation.

Wells Fargo applicants. The court swiftly dispensed with the claims of the two consumers who applied directly to Wells Fargo. The consumers were applicants under the ECOA, and Wells Fargo was a creditor, the court agreed. However, the consumers had offered nothing to show that the bank had discriminated against them as a lender. Rather, they relied only on the bank’s secondary market purchase guidelines.

The ECOA applies only to loan originators, the court said, not to secondary market buyers. Moreover, what Wells Fargo did as a loan buyer was distinct from what it did as a loan originator. There was no showing that Wells Fargo refused to consider Section 8 income when it originated loans, the court noted.

Application requirement. The consumers who only made inquiries were not applicants under the ECOA and thus were not protected by the law, the court decided. The ECOA said that a creditor who violated the law was liable to an “aggrieved applicant,” and to be an applicant one must actually request credit.

It was possible that the consumers were discouraged from making an application because they were told their Section 8 income would not be considered, the court conceded. Also, Reg. B banned creditors from discouraging applications on a prohibited basis, the court observed. However, the ECOA does not allow a suit by an “aggrieved prospective applicant.” 

The CFPB can enforce a regulatory ban on discouragement, the court said, but that did not mean there was a private right of action if the law did not provide one.

For more information about Equal Credit Opportunity Act issues, subscribe to the Banking and Finance Law Daily.

Enhanced cybersecurity standards should be consistent and risk-based, say industry groups

By J. Preston Carter, J.D., LL.M.

Comment letters to the federal financial regulatory agencies from a number of industry groups urge the adoption of a risk-based approach and consistent standards in the agencies’ proposed enhanced cybersecurity standards for big banks. Last October the Federal Reserve Board, Federal Deposit Insurance Corporation, and Office of the Comptroller of the Currency proposed enhanced cybersecurity risk-management and resilience standards for large and interconnected entities under their supervision, as well as to services provided by third parties to these financial institutions.

SIFMA, ABA, and IIB. In one comment letter, the Securities Industry and Financial Markets Association, American Bankers Association, and Institute of International Bankers noted the "extensive work that has been done by regulators and industry to develop core principles and practices that are risk-based and harmonized across the regulatory environment." The groups also noted that financial institutions have already designed cybersecurity programs to align with the NIST Cybersecurity Framework and to comply with federal cybersecurity regulations such as those promulgated under the Gramm-Leach-Bliley Act, which also adopt risk-based approaches to cybersecurity.

If any new rule is promulgated, they urged, it should adopt a risk-based approach consistent with the global approach used in voluntary frameworks such as the NIST Cybersecurity Framework, setting control objectives rather than prescriptive requirements.

Specifically, the letter states, the agencies should consider the risks of certain provisions within the proposed regulation, which include: (1) arbitrary application of the proposal to entities with $50 billion in assets (regardless of risk), unnecessarily placing regional financial institutions in-scope; (2) creation of a mandatory two-hour recovery time objective irrespective of active cyber threats, potentially forcing targeted institutions to choose between resuming services prior to firm readiness, or resuming services after the two-hour window if necessary and facing noncompliance ramifications; and (3) lack of harmonization with existing industry standards, which exacerbates existing industry cyber risks by forcing information security personnel into compliance functions, rather than actively defending their institutions.

FSR. The Financial Services Roundtable technology policy division BITS said, "It is critical that the Agencies adopt a risk-based approach to cybersecurity regulation." According to the FSR, this would permit financial institutions to align their cyber risk strategies with their particular risk profiles. The letter continued, "Rather than imposing a rigid set of requirements that purports to fit the needs of all institutions in this very diverse sector, a risk-based approach would hold institutions accountable to develop a customized, enterprise-wide program of cyber preparedness based on a more accurate assessment of their inherent and residual risks."

The letter also highlighted the "many overlapping cybersecurity regulations facing the financial industry," such as the Interagency Guidelines Establishing Information Security Standards, the FFIEC Cybersecurity Assessment Tool, the New York Department of Financial Services cybersecurity regulations for financial services companies, and the Office of the Comptroller of the Currency’s guidance on third-party relationships and risk management. "Viewed in isolation," FSR said, "these regulations are each well-intentioned and can contribute to the cybersecurity of the financial services sector. When layered upon one another, however, they create differing and potentially conflicting approaches to cybersecurity."

The FSR called for "a temporary pause in regulatory proceedings and adoption of a more unified approach to cyber risk management … coalescing around clear and more consistent standards that simplify execution and translates into improved critical infrastructure protection."

For more information about cybersecurity standards for financial institutions, subscribe to the Banking and Finance Law Daily.

En banc rehearing of suit invalidating CFPB structure granted

By Richard Roth

The U.S. Court of Appeals for the District of Columbia Circuit on Feb. 16, 2017, granted the Consumer Financial Protection Bureau’s request for a full-court rehearing of PHH Corp. v. CFPB, in which a majority of a three-judge panel decided that constitutional separation of powers principles prevents the Dodd-Frank Act’s organization of the CFPB. According to the panel decision, it is impermissible for the bureau to be structured as an independent agency whose director can be removed by the president only for cause. The panel said that the bureau is instead to be treated as an executive agency whose director can be removed at the president’s pleasure.

The per curiam order by the full court explicitly vacates the panel’s decision.

RESPA enforcement suit. The origin of the case was a CFPB administrative enforcement action against PHH Corp. that alleged violations of the Real Estate Settlement Procedures Act ban on kickbacks and unearned fees. The bureau reinterpreted RESPA’s application to captive insurance companies, applied its new interpretation to PHH Corp.’s prior business activities, found a RESPA violation, and entered a $109 million disgorgement order.

PHH Corp. appealed the bureau’s administrative enforcement proceeding, asserting both that the CFPB was unconstitutional and that the retroactive application of RESPA had denied the company due process.

Panel RESPA decision. The three-judge panel unanimously rejected the bureau’s RESPA arguments. The CFPB’s interpretation of RESPA was wrong, the judges decided. Moreover, even if the bureau’s interpretation was right, it could not be applied to prior conduct that was legal under the prior interpretation.

The new interpretation could at most apply only to conduct within the three-year statute of limitations, the judges added. They unanimously rejected the bureau’s claim that there was no time limit on administrative enforcement proceedings.

Separation of powers. Two of the three judges, over the objections of a dissenter, also decided that the bureau’s single director structure violated the Constitution’s separation of powers requirements. Noting that the Constitution neither condemned nor approved the bureau’s arrangement, the majority based its conclusions on a lack of precedent.

Historical practices consistently allowed an executive agency to have a single director but required independent agencies to have multi-member boards, the majority said. The use of a multi-member board provides a check against arbitrary actions and abuses of power because power is not concentrated in the hands of one person.

However, the majority declined the sweeping remedy that PHH Corp. desired—the invalidation of the entire CFPB. The Dodd-Frank Act included a severability clause that made clear Congress’s intent. The removal-for-cause requirement was to be severed from the remainder of the act and the bureau was to continue to operate.

The dissenter argued that the case should have been decided based on the interpretation of RESPA. It was unnecessary to consider the larger constitutional issue.

Issues outlined by the court. The order granting rehearing asked the parties to address three specific issues:

1. Is the single director structure a violation of the separation of powers principles and, if not, is severing the removal for cause requirement the proper remedy?
2. Would it be proper to decide the case based on the RESPA interpretation issues and avoid deciding the larger constitutional issue?
3. What effect, if any, would a decision in Lucia v. SEC have on the PHH Corp. case?

Lucia v. SEC has the potential to influence PHH Corp. v. CFPB. The issue in Lucia is whether Securities and Exchange Commission administrative law judges are inferior officers under the Constitution or SEC employees who are outside of the scope of the Appointments Clause.

The court could be signaling that it sees some connection between the two cases, given the explicit question in the PHH Corp. order, that the court granted en banc rehearings of both cases on the same day, and that oral arguments in both cases are scheduled for the same day.

Possible results. There are three likely results of the en banc rehearing:

1. The effects of the panel decision could be affirmed. In that case, it would be up to the CFPB to decide whether to ask the Supreme Court to hear an appeal. Of course, whether President Trump would attempt to remove CFPB Director Richard Cordray in the interim, and what the result of such an attempt might be, would be open questions.
2. The panel’s decision could be rejected, with the full court deciding that the single-director structure does not violate the Constitution.
3. The full court could decide that the CFPB’s administrative order should be overturned based on the RESPA issues. In that case, the court could exercise judicial restraint and decline to consider the constitutional issues.

A complete CFPB victory, however, seems unlikely. The weakness of the bureau’s RESPA arguments, the unanimous and forceful rejection of those arguments by the three-judge panel, and the questions on which the full court asked the parties to focus their arguments imply that the CFPB will find it very difficult to convince the full court to reinstate the administrative order and required disgorgement.

Oral arguments are scheduled for May 24, 2017.

For more information about the Consumer Financial Protection Bureau, subscribe to the Banking and Finance Law Daily.

‘Laughable’ loan applications might cost Bank of America $900,000 restitution

By Katalina M. Bianco, J.D.

A U.S. district judge should not have ordered defendants convicted of mail fraud to pay Bank of America $893,015 in restitution without considering the bank’s responsibility for its losses, the U.S. Court of Appeals for the Seventh Circuit has decided. The judge was told he should consider whether fining the defendants in the same amount would be a better choice (U.S. v. Litos, Feb. 10, 2017, Posner, R.).

The three defendants were convicted of scheming to induce B of A to make mortgage loans to straw buyers that they knew the buyers could never repay. The properties were bought from the defendants, who furnished the buyers with necessary down payments and helped them complete loan applications. When the purchases were complete, the defendants ended up with the loan proceeds, and the loans went into default.

Bank’s complicity.  In ordering restitution, the judge should not have relied on a claim by a bank employee that B of A would not have made the loans if it had known the source of the down payments, the appellate court said. The bank "ignored clear signs" of problems with the loans, the court said, and the bank’s lack of clean hands made the restitution order questionable.

The appellate court made its scorn for B of A’s practices clear, beginning by charging the bank with "a long history of blunders and shady practices." Statements by the district judge that the loan applications were "a joke on their face" and "laughable" were supported by the loans, the appellate court said. B of A made multiple mortgage loans to individuals in short spans of time, based on financial claims in loan applications that were clearly untrue—the most notable transactions being the extension of six loans over only 10 days to a borrower who falsely claimed to own two other properties, to have $3,400 in monthly gross income, and to have $320,000 in a bank account.

The fraud was "transparent," the court charged—if the bank had done any investigation, it would have discovered that the borrowers’ applications were fraudulent and that the loans would not be repaid. B of A was not negligent, it was reckless, ignoring the risk of the loans because it intended to sell the loans and transfer the risk to Fannie Mae. The district judge needed to consider whether a reckless bank is entitled to restitution, the appellate court said.

For more information about banking law cases, subscribe to the Banking and Finance Law Daily.