The FCRA, ECOA and the Consumer Financial Protection Bureau:

Two Areas of Ambiguity the Bureau May Address

Presented byJoshua A. del Castillo & Kenyon D. Harbison

for

January 8, 2013

Financial Institutions Committee Business Law Section State Bar of California

Presentation Preview 1

• The Fair Credit Reporting Act

• The Transfer Authority From the FTC to the CFPB

• How the CFPB is Stepping Up Enforcement

• Two Case Studies in Ambiguity: Potential Issues the CFPB Might Resolve

• FCRA Adverse Action Notices and Commercial Transactions

• Adverse Action Notices to Guarantors • The Equal Credit Opportunity Act• Notices to Guarantors under the FCRA and ECOA

• Conclusions

2

The Fair Credit Reporting Act

3

Used with permission of the artist. All rights reserved.

Review of the FCRA’s Broad Coverage 4

• The FCRA covers the popular conception of “credit reports.”

• But the focus of the FCRA is more broadly on consumer reports information of many types and as used for many purposes:

o Insuranceo E.g., a report obtained from a credit bureau during a claims proceeding.

o Employmento E.g., an employment history reports, including a listing of accidents.

o Other business transactions, such as:o rental transactions and tenant histories;o medical records or payments;o insurance claims;o check-writing history.

Key Abbreviated Definitions 5

• Consumer: an individual.

• Person: an individual, partnership, corporation, etc.

• Consumer reporting agency (“CRA”): any person who, for profit or not, regularly assembles or evaluates consumer credit or other information to furnish it to third parties.• Note: may be implied, no federal registration or licensing required.

• Consumer report: any communication by a CRA about a consumer’s creditworthiness, character or reputation, used or expected to be used even in part to establish eligibility for:• credit or insurance to be used primarily for personal, family or household purposes;• employment purposes; or• other permissible purposes such as court subpoenas, to determine government benefit

eligibility, existing credit obligations, or as otherwise directed by a consumer.

Distinction: Not a Consumer Report 6

• The following examples are not consumer reports:• Aggregated/blind data;• Mere ID data;• Data not from a CRA;• Data not intended to be used for an FCRA permissible purpose (e.g., law enforcement).

• Also statutorily excluded under FCRA 603(d)(2)(A):• Transaction and experience information solely about the consumer/reporter interaction;• Such communications as between affiliated companies;• What would otherwise be a consumer report, which is shared as between affiliated

companies after a notice and opportunity to opt out;

• Other statutory exclusions:• Point of sale credit approvals (FCRA 603(d)(2)(3));• Employment agency communications after a consumer opt out (FCRA 603(o)).

• Note: May still be regulated information under the Gramm-Leach-Bliley Act (“GLBA”).

Key Benefits / Duties of the FCRA 7

Consumer Benefits: • Ease access to credit data;• Ease ability to correct/dispute data.

Consumer Reporting Agency Duties:• Protect data (identity theft);• Prevent uses for impermissible purposes;• Maintain accurate data;• Investigate disputes;• Report only prescribed data.

User Duties:• Use for permissible purposes only; • Notify consumers of adverse decisions.

Furnisher Duties:• Provide accurate data;• Investigate disputes.

Consumer Reporting Agency Duties 8

• Most sections in the FCRA relate to the duties of CRAs.• “Gatekeeper” relating to use of consumer report info for permissible purposes.

• Exclusion of info from consumer reports (e.g., paid tax liens > seven years old).

• Help prevent and remedy identity theft (some req’s apply to Nationwide CRA’s only).

• Disclosures to consumers on request, including free annual disclosures.

• Initial point of contact for most consumer disputes, and related reinvestigations; must notify the information furnisher of the dispute and relevant information within 5 days.

• Restrictions on employment reports/information, and on investigative reports.

• Criminal penalties for employees who make unauthorized disclosures.

• Disclosures to the government for counterintelligence and anti-terrorism purposes.

Duties of “Users” of Consumer Reports 9

• The sections relating to users nevertheless contain many rules, some of which are:• Permissible Purposes: concurrent duty only to obtain and use for such a purpose,

including certification to the CRA.

• Restrictions on the manner and circumstances in which “prescreened” offers based on consumer reports may be made to consumers.

• Requirements relating to notices a user must give a consumer when it takes “adverse action” based on a consumer report, including credit score and key decision factors.

• Special rules for employment/investigative consumer reports exist, including consent, and notification to a consumer before taking adverse action.

• ID Theft Rules: “Red Flag” rule to spot potential ID theft, “reasonable” belief in ID before granting credit if a fraud alert is in place, and policies to know the ID.

Duties of Furnishers of Information to CRAs 10

• No private right of action for most violations, such as.• Duty to provide accurate information, may not furnish if “reasonable cause”

exists to believe it is inaccurate;• Duty to correct and update;• Duty to not furnish information resulting from ID theft to a CRA;• Duty to respond to direct disputes from a consumer;• Duty to provide notice to consumer when negative information is furnished;

• Duty to investigate disputed information when notified by a CRA of a dispute and to respond to a CRA in time for the CRA to respond to a disputing consumer.• “Reasonableness” has been required by courts, including the Fourth Circuit.

Enforcement of the FCRA 11

CFPB Enforcement of this and other consumer financial law statutes:• $5,000 per day penalties for negligent violations;• $25,000 per day for reckless violations;• Up to $1 million per day penalties for “knowing” violations.

FTC Enforcement:• $2,500 per violation for knowing violations that are part of a pattern or practice.

State Enforcement:• $1,000 for negligent or willful violations, per violation.

Private Right of Action:• Not as to all aspects of the FCRA (e.g., user adverse action, most furnisher duties);• Negligent violations: actual damages, attorneys fees;• Willful violations: no need to prove actual damages; statutory damages of $100 to

$1,000 per transaction, punitive damages, attorneys’ fees

12

The Transfer of Regulatory and Some Enforcement Authority From the FTC to the CFPB

The Process of Empowerment for the CFPB 13

• July 21, 2010 – Dodd-Frank Wall Street Reform and Consumer Protection Act created the Consumer Financial Protection Bureau (“CFPB”), in a portion of Dodd-Frank called the “Consumer Financial Protection Act,” (12 USC 5481 et seq.).

• The CFPB was given broad regulatory and enforcement authority relating to many federal consumer financial protection laws, including all sections of the FCRA except Section 615(e) (red flags rules for users) and Section 628 (disposal of records).

• In July 2011 the FTC rescinded its previous commentary on the FCRA and in its place published a “Staff Report” that kept much of it, but also made changes.

• In January 2012 the CFPB entered into a Memorandum of Understanding with the FTC relating to the FTC’s parallel enforcement of certain acts, including the FCRA.

14

The CFPB is Stepping Up Enforcement

The CFPB Has Reformulated and Republished Regulations B & V 15

• On December 21, 2011 the CFPB restated, and on December 30, 2011 the CFPB republished the FRB’s FCRA “Regulation V” as 12 CFR 1022.1 et seq.

• (It also republished ECOA regulation B.)

• Per the CFPB, the new regulation “substantially duplicates the…regulations promulgated…by the Board, the FDIC, the FTC, the NCUA, the OCC, and the OTS.”

Participated in Amicus Briefing on the Constitutionality of a Provision of the FCRA 16

• The CFPB is formally committed to filing amicus briefs even in private cases involving federal consumer financial protection laws, and so far has filed at least six.

• This summer it participated in an amicus brief relating to the constitutionality of an FCRA provision relating to how long criminal records can remain in a consumer report.

First Legal Enforcement Action Filed 17

• On July 18, 2012 the CFPB filed its first actual legal enforcement action, relating to a California law firm that offered mortgage assistance relief services to consumers.

Major Settlement with American Express 18

• On October 1, 2012 without filing an actual lawsuit, the CFPB entered into a major consent decree with various American Express entities, including banking entities, to:

• Pay $85 million to 250,000 consumers in restitution for violations of various statutes, including the FCRA;

• Pay $27.5 million in civil penalties to the CFPB.

• Violations Related To:• Deceiving consumers into thinking they were getting reward points;• Charging unlawful late fees;• Age-based discrimination relating to new account applicants (ECOA violation);• Failing to report consumer disputes to CRAs (FCRA violation);• Misleading consumers into believing paying old debt first would improve scores.

CFPB Now Producing Examination Standards 19

• September 2012: the CFPB issued its examination procedures for non-depository institutions that are “larger participants.”

• Permits supervision of co’s w/annual gross of > $7mil from consumer reporting: i.e., the Nationwide Consumer Reporting Agencies, Transunion, etc.

• October 24, 2012: the CFPB published its debt collection examination procedures, including significant reference to overlap between the FCRA and the FDCPA.

• October 31, 2012: the CFPB published version 2 of its Supervision and Examination Manual, including extensive commentary on examination for FCRA compliance.

• December 17, 2012: the CFPB published its education loan examination procedures, including reference to and overlap with the FCRA.

Bulletins Regarding Compliance 20

• November 29, 2012: CFPB issued a bulletin warning that nationwide consumer reporting agencies must comply immediately with the annual disclosure provisions of the FCRA.

• NCRAs:

• Transunion

• Experian

• Equifax

New Report on Credit Reporting System 21

• In December 2012 the CFPB published a new report titled “Key Dimensions and Processes in the U.S. Credit Reporting System.”

• CFPB initial focus with regard to the FCRA is on consumer reporting agencies.

• Examples:

• e-OSCAR system by which NCRAs report disputes to fu• nishers does not have mechanism for transmitting supporting documents, which

is an FCRA violation;

• Previous slide about non-compliance w/free annual report requirements.

• The “Key Dimensions” report promises to be the basis of increased future regulatory action, and a precursor to a greater focus on users and furnishers, including banks.

The CFPB’s Deadline to Update FCRA-Required Forms has Arrived 22

• Pursuant to regulations promulgated by the CFPB last year, January 1, 2013 was the deadline to revise FCRA notices to reflect the enhanced role of the CFPB.

• Pertains to the following required FCRA notices:

• Summary of Consumer Rights

• Notice of Furnisher Responsibilities

• Notice to Users of Consumer Reports of Their Obligations Under the FCRA

23

Two Case Studies in Ambiguity: Potential Issues the CFPB Might Resolve

24

Case Study One: Adverse Actions and Commercial Transactions

25

Used with permission of the artist. All rights reserved.

What is an Adverse Action? (The FCRA’s ECOA Cross-Referenced Definition) 26

• "Adverse Action" is defined in the FCRA by reference to the Equal Credit Opportunity Act (“ECOA”) (of which more in a few minutes), as a:

• “[D]enial or revocation of credit, a change in the terms of [existing credit]…or a refusal to grant credit in substantially the amount or on substantially the terms requested."

• And also pursuant to terms in the FCRA, as:

• An adverse action in connection with insurance (e.g., denial, cancellation, or change in terms of coverage), employment (e.g., denial), and licenses (e.g., charge increase); and

• (Catch-all): An action taken or determination made re: an application made by, or a transaction that was initiated by, a Consumer and adverse to the interests of the Consumer.

• Note: the additional terms means the FCRA definition is arguably broader than ECOA’s.

Adverse Action Notices Under the FCRA 27

• Purpose: Provide applicants with notice of the adverse action, along with info relating to the CRA that provided the Report, and info relating to the consumer's credit score (if applicable) and rights to obtain and dispute credit information.

• Required: Only where creditor takes any adverse action with respect to a consumer "based in whole or in part" on information contained within a consumer report.

• Form: No specific form of adverse action notice is prescribed by the FCRA, but Section 615(a) requires notice of:• the adverse action;• any credit score or range of scores used, the date the score was provided, who

provided it, and key factors adversely affecting it;• the CRA’s contact information and a statement it did not make the decision;• notice of the right to obtain a free credit report from the applicable CRA;• notice of the right to dispute the accuracy of the consumer report.

Case Study: What about commercial transactions under the FCRA? 28

• Open Issue: One of the longstanding issues under the FCRA is whether a credit report obtained on an individual obtained in connection with a commercial transaction is a “consumer report” thereby bringing the transaction within the ambit of the statute, for the purposes of the adverse action notice requirement.

• I.e., an individual’s credit/consumer information is evaluated in connection with a business transaction (sole proprietorship, guarantors, etc.).

• Note: This question presumes the applicant is in fact an individual consumer and not a corporation or other business entity, to which the FCRA plainly does not apply.

View One: Consumer Reports May Not Be Delivered in Commercial Transactions 29

• FCRA does not apply to transactions where no individual credit is evaluated.

• Some case law, much of it developed in the context of loan origination, suggests that the FCRA does not apply to a consumer report on an individual obtained in any way in connection with a commercial transaction.

• These cases generally take position that FCRA was not intended to regulate reports in commercial transactions, and that only credit transaction in which a Consumer Report (as defined by statute) can exist is for personal, family, or household expenses.

• The FTC’s 1990 Commentary also took this position at pages 562 and 567.

View Two: Consumer Reports May Be Delivered in Commercial Transactions 30

• Contrary case law looks to the purpose for which credit information was collected (e.g. for inclusion in a consumer report), not the purpose for which it is ultimately used.

• These cases typically do not address the context of loan origination; instead developed from cases where use of a Consumer Report was used for impermissible purpose, often a circumstance involving improper conduct.

Before the CFPB, the Latter Line of Cases Had Received Regulatory Endorsement 31

• View Two Endorsed: This line of cases recently received regulatory endorsement from FTC, which rescinded it 1990 Commentary to the contrary effective July 26, 2011.

• Separately, the July 2011 FTC staff report states that "a report from a CRA on the personal credit of a consumer to a business credit grantor is a 'consumer report' regardless of the purpose for which the information may in fact be used."

• So far nothing has changed with the CFPB:

• In implementing the new Regulation V, the CFPB indicated it was not making changes at that time.

• However, there is also no indication the CFPB has officially adopted the staff commentary of the FTC, and the National Consumer Law Center was advocating as recently as June 2012 that it do so.

32

Case Study Two:ECOA, Commercial Transactions, and Adverse Action Notices to Guarantors

What is ECOA? 33

• The Equal Credit Opportunity Act, enacted in 1974, is another federal consumer financial statute.

• Explicitly and primarily creditor-focused, unlike the FCRA.

• Under ECOA it is unlawful for any creditor to discriminate against any applicant, with respect to any aspect of a credit transaction, on the basis of:• race; • color;• religion;• national origin;• sex, marital status;• or age (provided the applicant has the capacity to contract).

Adverse Action Notices Under ECOA 34

• Required: In any transaction where adverse action is taken, regardless of whether a consumer report is provided and reviewed.• Each "applicant against whom adverse action is taken" is entitled to statement as

to reasons for action.

• Applicant: “[A]ny person who requests or who has received an extension of credit from a creditor, and includes any person who is or may become contractually liable regarding an extension of credit.“

• Form: No form of Adverse Action Notice is prescribed (with the exception of standard ECOA disclaimer). However, the FRB has created combined ECOA and FCRA adverse action notice forms which may be used, at least where personal credit is concerned, as a form of "safe harbor.“ The CFPB has kept these forms.

ECOA Applies to Commercial Transactions 35

• Applicability: ECOA applies both to consumer and to business transactions for which an application (absent any credit or other consumer report) has been submitted to the creditor.

• Timing of Adverse Action Notices: • For business applicants w/ ≤ $1 million in gross revenues, with exceptions, a creditor

may provide oral/written notice within the timeframe applicable to consumer applicants.• For business applicants w/ > $1 million in gross revenues, the creditor may comply with

the above rule, or within a “reasonable time.”

• Two Problems:• Are relaxed reqs for larger businesses truly applicable? Imagine a $15 million property

secured by a $10 million loan to a single asset entity, but ≤ $1 million in gross revenues.• Which party's revenue should be examined? “Borrower" may not be established until

time of closing (e.g., LBO, real estate transaction w/holding company or an SAE). Who is the "applicant"? The sponsor? Consider the definition of "applicant" under ECOA.

ECOA, FCRA, and Guarantors 36

• ECOA and Guarantors: The general rule under ECOA is guarantors are not “applicants” for commercial credit, and, therefore, are not entitled to adverse action notices.

• The Seventh Circuit has ruled any other interpretation would make no sense.

• However, some courts have held or implied otherwise.

• An old FTC staff letter confirms the common-sense and Seventh Circuit view, but ambiguity nevertheless remains.

• This letter was actually written in the context of an inquiry w/regard to the FCRA, which incorporates the ECOA definition of adverse action, making this issue more generally applicable to both statutes.

• Note: The CFPB has not yet spoken on this issue either.

Conclusions 37

• There is no indication of fundamental change coming from the CFPB thus far, including as to adverse action notices in commercial transactions, and with regard to guarantors.

• There are indications that CFPB rulemaking and commentary may result in changes in statutory interpretation and application. CFPB has not kicked into “4th gear” yet.

• Ongoing Sources of Authority in Order of Persuasion:• Statute (as amended five times from 1970 to 2010);• Rulemaking: the CFPB’s revised Regulations B & V;• Existing case law relating to the FCRA and ECOA;• Federal Trade Commission Materials;

• 2011 Staff Report on FCRA: Replaced the Official Commentary;• Existing FTC staff opinion letters re: FCRA and ECOA;• Records of enforcement actions;

• New guidance by the CFPB to the extent it exists;• Existing custom/practice.

Bio: Joshua A. del Castillo• Joshua A. del Castillo is senior counsel in Allen Matkins’ Los

Angeles office, and practices in the firm's Bankruptcy & Creditors’ Rights, Litigation, and Banking and Financial Institutions groups.

• Joshua serves as the lead attorney for Allen Matkins’ Consumer Finance and Regulatory Compliance sub-group. In this capacity, he regularly defends institutional lenders and other creditors in consumer finance and regulatory compliance litigation, including in Fair Credit Reporting Act, Real Estate Settlement Procedures Act, Truth in Lending Act, and other federal and state consumer finance litigation. In addition, he provides specific regulatory compliance advice in the non-litigation context regarding a variety of federal and state consumer finance matters, an area of increased focus in the wake of the enactment of the Dodd-Frank Wall Street Reform and Consumer Protection Act.

Joshua A. del CastilloLos Angeles Office

Phone: 213.955.5591Facsimile: 213.620.8816jdelcastillo@allenmatkins.com

FocusBankruptcy and Creditors’ RightsLitigationBanking and Financial Institutions

EducationJ.D., University of Southern CaliforniaM.A., University of MichiganB.A., University of Southern California

Bio: Kenyon D. Harbison• Kenyon Harbison practices in the areas of real estate, insurance,

and general litigation, including litigation in bankruptcy courts. He has worked in all phases of litigation, including appeal in state, federal, and federal bankruptcy court proceedings. His cases have involved commercial lease disputes, insurance recovery, soil contamination, construction defect litigation, and partnership disputes.

• Kenyon also serves as a leading attorney for Allen Matkins’ Consumer Finance and Regulatory Compliance sub-group. In this capacity, he defends institutional lenders and other creditors in consumer finance and regulatory compliance litigation, including in Fair Credit Reporting Act, Real Estate Settlement Procedures Act, Truth in Lending Act, and other federal and state consumer finance litigation. In addition, he provides specific regulatory compliance advice in the non-litigation context regarding a variety of federal and state consumer finance matters, an area of increased focus in the wake of the enactment of the Dodd-Frank Wall Street Reform and Consumer Protection Act.

• At UCLA School of Law, Kenyon was a staff member and a managing editor of the UCLA Law Review, was a student instructor of legal writing, and was made a member of The Order of the Coif. He also served as a research assistant to Professor Joanna Schwartz and he externed for the Honorable Paul Boland of the California Court of Appeal, Second District. After practicing law at Allen Matkins for nearly a year, Kenyon took a leave of absence and clerked for the Honorable Florence-Marie Cooper of the U.S. District Court, Central District of California, after which he returned to Allen Matkins.

Kenyon D. HarbisonLos Angeles Office

Phone: 213.955.5661Facsimile: 213.620.8816kharbison@allenmatkins.com

FocusLitigationBanking and Financial InstitutionsConstruction

EducationJ.D., University of California, Los AngelesB.A., Yale University