UDAAP: Wading Through Murky Waters

The threat of unintentionally engaging in an unfair, deceptive, or abusive act or practice (UDAAP) is enough to keep a diligent banker up at night. UDAAP violations are rightfully scary – UDAAP is broad and subjective, lacks in concrete guidance, and presents a serious reputational risk to a bank. Since the passage of the Dodd-Frank Act which granted the Bureau of Consumer Financial Protection (CFPB) new UDAAP authority, UDAAP has become a hot topic and growing concern in the banking industry. Though we would all benefit from further delineation of UDAAP, the regulatory guidance, along with recent enforcement actions and litigation, as described below, provide some direction to bankers seeking to successfully manage UDAAP risk. 

By way of background, the Dodd-Frank Act prohibits banks and others from engaging in unfair, deceptive, or abusive acts or practices. In addition, Section 5 of the FTC Act prohibits banks and other persons from engaging in unfair or deceptive acts or practices. As you can see, the Dodd-Frank Act broadened the scope of the FTC Act by adding the term “abusive.” Banks, whether federally- or state-chartered, are subject to both prohibitions. 

Such prohibitions broadly cover all acts and practices in banking – from advertising to debt collection, consumer to business credit transactions, along with add-on products and third-party vendor relationships, to name a few. Thus, bankers should frequently question whether their actions, or those of a vendor, could amount to a violation of UDAAP. 

So, what does amount to a UDAAP violation and what should bankers consider when examining their bank’s acts and practices? Bankers should consider the following guidance issued by the banking regulatory agencies when evaluating an act or practice in the context of UDAAP:

Is the act or practice UNFAIR? An act or practice is unfair when:

  • It is likely to cause substantial injury to consumers; 

Substantial injury may include a larger harm to one consumer or a small amount of harm to a large number of people. Typically, the injury involves monetary harm, though in certain circumstances, such as debt collection harassment, emotional harm could amount to substantial injury.

  • The injury is not reasonably avoidable by consumers; and 

In other words, the consumer could not avoid the injury by taking actions that are practical and not unreasonably expensive. A consumer cannot reasonably avoid an injury if the act/practice interferes with or hinders their decision-making ability, like if material information about a product is withheld until after the consumer purchases a product, for instance. 

  • The injury is not outweighed by countervailing benefits to consumers or to competition.

Such countervailing benefits may include, for example, lower prices or a wider availability of products/services. This was demonstrated in a 2016 CFPB enforcement action which found a bank’s practice unfair wherein the bank advertised and charged customers for credit-monitoring services that were not provided due to the bank’s failure to receive proper customer authorization. Just two years earlier, the FDIC, along with the CFPB and the OCC, took enforcement action against a bank for similar practices, costing the bank over $50 million in civil money penalties and restitution.  

Is the act or practice DECEPTIVE?  A representation, omission, act or practice is deceptive when:

  • It misleads or is likely to mislead the consumer;

The FTC’s “Four P’s” Test provides guidance to determine if an action or omission is misleading:

  1. Is the statement prominent enough for the consumer to notice it?
  2. Is the information presented in an easy-to-understand format that is not contradicted elsewhere? Is information presented at a time when the customer is not distracted? 
  3. Is the information placed in a location where consumers are expected to look/hear?
  4. Is the information in close proximity to the claim it qualifies?

Furthermore, misleading information may include an express or implied claim or promise (written or oral). Some examples of misleading information include: misleading cost or price claims, offering products or services that are unavailable, or omitting material limitations or conditions from an offer. To illustrate, in June 2014, FDIC took enforcement action against a bank for understating available interest rates on deposit-secured loans.

  • The consumer’s interpretation of or reaction to the representation, omission, act or practice is reasonable under the circumstances; and

Banks should consider whether a reasonable member of the target audience would feel misled (e.g. if marketing is targeted to college students, the communication must be examined from the perspective of a reasonable college student).

  • The misleading representation, omission, act or practice is material.

Among others, the central characteristics of a product/service are presumed material: cost, benefits, and restrictions on use or availability. Outside of defined presumptions, a bank should look to whether the consumer’s choice of, or conduct regarding, a product or service is impacted.   

To demonstrate, CFPB took enforcement action against Santander Bank who, through its vendor, misled consumers into opting into overdraft services by misrepresenting the fees associated with opting in and the consequences of not opting-into the service, among others.

Additionally, the banking regulatory agencies settled an enforcement action in 2014 where the bank’s efforts to market free checking accounts misled consumers, as the marketing did not properly disclose the minimum account activity required nor did it disclose the fact that the account would convert to a monthly-fee checking account after 90 days of inactivity. 

Is the act or practice ABUSIVE? An abusive act or practice:

  • Materially interferes with the consumer’s ability to understand a term or condition of a product or service; or
  • Unreasonably takes advantage of:
    • a consumer’s lack of understanding of the material risks, costs, or conditions of the product or service;
    • a consumer’s inability to protect his/her own interests in selecting or using a product or service; or
    • a consumer’s reliance on the Bank (or a representative of the Bank) to act in the consumer’s interest.

A recent example of an abusive practice is the deceptive marketing of reverse mortgages to elderly populations.

Additional examples of recent UDAAP enforcement actions and litigation trends include:  

  • Refusing to release a lien after a consumer has paid in full;
  • Failing to establish policies and procedures to prevent against fraudulent payment processing; 
  • Misrepresenting loan terms; and
  • Misrepresenting the assessment of overdraft fees (assessed based on the available balance but contracts and marketing materials state such fees are assessed based on the actual balance).

Bankers should heed the regulatory guidance and glean lessons from recent mistakes of other financial institutions. Notably, UDAAP violations can be, and often are, assessed in conjunction with violations of other state and federal laws. For example, if a TRID disclosure significantly misrepresents closing costs, a UDAAP violation could be brought in addition to a Truth-in-Lending/Regulation Z violation. Additionally, as examples described above demonstrate, a bank is responsible for the actions of its vendors.

In order to combat UDAAP, bankers should take both a proactive and reactive approach. First, banks should integrate UDAAP reviews proactively into areas such as new product development, creation and revision of fee schedules, marketing plans, and reviews of third-party vendor materials. In addition, UDAAP training should be provided to employees, as appropriate. Reactively, banks should ensure UDAAP is a part of regularly-scheduled audits (internal and external), and, importantly, a robust complaint management procedure should be in place. Such procedures should specify how the bank receives, monitors, and responds to customer complaints. Notably, regulators will often review consumer complaints in an effort to identify areas of the bank at risk for UDAAP violations. 

In summary, UDAAP should be appropriately integrated into the organization. Penalties are high, litigation is costly, but the reputational hit is the highest price a bank can pay.

WBA wishes to thank Atty. Lauren C. Capitini, Boardman & Clark, LLP for providing this article. Boardman & Clark is a WBA Gold Associate Member.

By, Ally Bates