For the first time in nearly a decade, the CFPB recently updated the Unfair, Deceptive, or Abusive Acts or Practices (UDAAPs) examination procedures. The updates mainly focused on two areas of the procedures: 1) the section discussing unfair acts or practices, and 2) the procedures contained in the second half of the manual for evaluating the bank’s policies, procedures and processes. These changes seem to align with the current administration’s focus on consumer protections and fair lending issues such as redlining, pricing and certain biases in computer models and algorithms.
The first area of change includes a new authority under UDAAP to address discriminatory conduct in connection with a non-credit products or services. We’re used to seeing regulators address discriminatory conduct regarding credit products or services under fair lending and ECOA, and this is an effort by the CFPB to address discrimination in the offering of non-credit products and services in a similar way. In the example provided by the CFPB in the updated manual, not allowing African-American consumers to open deposit accounts, or subjecting African-American consumers to different requirements to open deposit accounts, may be an unfair practice even in those instances when ECOA does not apply to the transaction.
Traditionally the exam manual stated that an unfair act or practice could be a UDAAP violation if it caused substantial injury to consumers that they could not reasonably avoid, where the injury is not outweighed by countervailing benefits to consumers or competition. The updated exam manual retains the same general standard, with the exception that consumers cannot reasonably avoid discrimination. This appears to create a standard for instances of discrimination being an act or practice that causes substantial injury where the injury is not outweighed by countervailing benefits to consumers or competition. Furthermore, although substantial injury is still the requirement for an unfair act or practice, the updated manual states that emotional impacts such as “dignitary harm” may contribute to substantial injury, despite not normally being considered substantial injury by itself.
The second area of change includes updates to the exam procedures to focus on preventing discriminatory conduct. As part of the document review, in addition to looking at things like training materials and consumer complaint files, the manual now includes the following: 1) a review of documentation regarding the use of models, algorithms, and decision-making processes, 2) information regarding customer demographics, and 3) any demographic research relating to advertising of consumer financial products or services.
As a part of reviewing a bank’s written policies and procedures, audit reports, management reports, examination reports, etc. for UDAAP concerns, the examiner will additionally determine: 1) whether the bank has a process to prevent discrimination in relation to all aspects of consumer financial products or services, including the evaluation of all policies, procedures and processes, and continued monitoring for discrimination after implementation, and 2) whether the bank’s compliance program includes an established process for periodic analysis and monitoring of all decision-making processes, and a process to take corrective action to address any potential UDAAP concerns related to their use.
Further when reviewing internal controls in addition to looking for potential UDAAP concerns, the updated procedures now include the following four considerations: 1) whether the bank has established policies and procedures to review, test, and monitor any decision-making processes it uses for discrimination, 2) whether the bank has established policies and procedures to mitigate discrimination arising from the use of its decision-making processes, 3) whether the bank’s policies, procedures and practices target or exclude consumers from products and services, or offer different terms and conditions, in a discriminatory manner, and 4) whether the bank has appropriate training to prevent discrimination.
The final significant changes come in the section on potential areas for transaction testing, where six new areas have been added: 1) the bank gives inferior terms to one customer demographic compared to others, 2) the bank offers more products or services to one customer demographic compared to others, 3) bank employees treat customers of certain demographics worse or provide extra assistance or exceptions to customers of certain demographics, 4) the bank engages in targeted advertising or marketing in a discriminatory way, 5) the bank uses decision-making processes in its eligibility determinations, underwriting, pricing, servicing or collections that result in discrimination, and 6) the bank fails to evaluate and make necessary adjustments and corrections to prevent discrimination.
As is evident by this overview of the updates, the changes for banks in drafting their policies, procedures and processes could be significant, so you’ll want to review relevant documentation to prepare for future examinations.