CFPB Guidance for Oversight Over Sales and Other Incentives

On November 28, 2016, the Consumer Financial Protection Bureau issued a compliance bulletin entitled “Detecting and Preventing Consumer Harm from Production Incentives.” [1] The bulletin describes the risk of “significant” harm to consumers posed by incentive programs for employees or service providers that tie compensation to various benchmarks. These benchmarks can include the following:

• sales goals, including “cross-selling” products or services to existing customers;
• sales at higher prices where pricing discretion exists;
• quotas of customer calls; and
• collections benchmarks.

As CFPB Director Richard Cordray stated in an accompanying press release, “Tying bonuses and job security to business goals that are unrealistic or not properly monitored can lead to illegal practices like unauthorized account openings and deceptive sales tactics.” [2]

The CFPB bulletin describes the role of incentive programs in prior CFPB enforcement actions, including the recent Wells Fargo consent order. There, the CFPB imposed a $100 million penalty for “unfair” and “abusive” practices involving allegations that thousands of bank employees opened deposit accounts and issued credit cards without consumers’ knowledge or consent so that the employees could satisfy sales goals and earn financial rewards. [3]

The CFPB’s bulletin describes the agency’s expectation that companies using incentive programs institute effective controls and exercise oversight of employees and service providers. Below, we summarize the steps the CFPB has outlined for ensuring that a company’s compliance management system (CMS) is “effective” with respect to incentives. We then discuss the implications of the bulletin and the Wells Fargo action for both financial services and other consumer-facing companies.

The CFPB’s Expectations for Effective Compliance Oversight With Respect to Incentives

As the CFPB has “emphasized repeatedly,” a robust compliance management system (CMS) is necessary to detect and prevent legal violations. With respect to incentives, the CFPB recognizes that a supervised entity’s CMS should reflect the “risk, nature, and significance” of the incentive programs in place. The “strictest controls” will be necessary where incentives concern products or services “less likely to benefit consumers,” reward outcomes “that do not necessarily align with consumer interests,” or implicate a significant proportion of employee compensation.

The CFPB outlines the following steps that supervised entities may take (among others) to ensure their CMS is effective:

Board of directors and management oversight

• The highest levels of corporate leadership should be committed to a culture of customer service and legal compliance with respect to incentives. The CFPB gives as an example “ensuring that consumers are only offered products likely to benefit their interests.”
• Leadership should carefully consider any unintended consequences that might result from incentives structures and should empower compliance personnel to address these risks and provide them adequate resources for doing so.
• Leadership should set a “tone from the top” that encourages all employees to report problematic behavior without fear of retaliation.

Compliance program

• Policies and procedures. Among other things, companies should ensure that any sales/collections quotas are “transparent to employees” and “reasonably attainable.” They should implement “clear controls” for managing the risk of incentives at “each stage of the product lifecycle,” including marketing, sales (including account opening), servicing, and collections. Companies should also address “potential conflicts of interest” posed for supervisory personnel who are covered by incentives but also responsible for monitoring the quality of consumer treatment. Procedures should exist for reporting suspected improper behavior.
• Companies should implement “comprehensive training” that addresses topics including: “expectations for incentives, including standards for ethical behavior,” common risky behavior involving incentives, and regulatory and business requirements for obtaining and maintaining “evidence of consumer consent.”
• Monitoring and corrective action. Companies should implement compliance monitoring programs that track specific metrics designed to flag improper behavior. For instance, monitoring trends in sales and incentive payouts could identify outliers worthy of further investigation. Companies should promptly implement corrective action to address incentive-related problems, including termination of employees, service providers, and managers, as necessary; changes to incentive structures; increased training; and consumer restitution. Corrective action should “ensure that root causes of deficiencies are identified and resolved.”

Consumer complaint management program

Companies should collect and analyze consumer complaints for indications that incentives are leading to legal violations or consumer harm.

Independent compliance audit

Companies should schedule audits to address incentive issues across all products or services to which they apply. Audits should be “conducted independently of both the compliance program and the business functions.”

Observations

Following the CFPB’s bulletin and the Wells Fargo action, banks and other consumer financial services companies should give serious consideration to engaging in a review of their incentive programs and related compliance programs. While not announcing any new elements, the CFPB’s bulletin—both in tone and content—sets a demanding standard for such compliance programs. The standard also leaves much room for discretionary judgments as to which a regulator and a company may well disagree. For example, is a certain sales goal “reasonably attainable”? By what metric does a company determine that consumers are, in the CFPB’s words, “only offered products likely to benefit their interests”? Unfortunately, the reasonableness of a company’s programs will often be assessed in hindsight after legal violations have been discovered. Nevertheless, engaging in—and documenting—a formal review and enhancement of incentive programs and related compliance controls can strengthen a company’s position in the face of regulatory scrutiny.

In addition to the CFPB’s likely increased supervisory and enforcement focus on incentives, [4] the federal banking agencies are likewise increasingly focused on this issue, [5] as is the New York Department of Financial Services (DFS). Indeed, the DFS recently issued guidance that warns its regulated banks that it will review incentive compensation arrangements as part of its regular examinations process, “including the review of processes in place in identifying and deterring misconduct, participation of frontline business units, effective risk management and internal audit, and effective oversight of the board of directors.” [6]

Finally, companies outside the financial services space should also consider reviewing their incentive programs and related compliance controls. As the CFPB bulletin notes, incentive programs are common in many industries. The recent attention on this issue could well cause the Justice Department, the Federal Trade Commission, State Attorneys General, and other industry regulators to focus on sales and other incentives in consumer-facing businesses as potential progenitors of legal violations.

Endnotes:

1CFPB Compliance Bulletin 2016-03, Detecting and Preventing Consumer Harm from Production Incentives (Nov. 28, 2016), available here.(go back)

2CFPB Warns Financial Companies About Sales and Production Incentives That May Lead to Fraud or Consumer Abuse (Nov. 28, 2016), available here.(go back)

3Consumer Financial Protection Bureau Fines Wells Fargo $100 Million for Widespread Illegal Practice of Secretly Opening Unauthorized Accounts (Sept. 8, 2016); Consent Order, In re Wells Fargo Bank, N.A., CFPB No. 2016-CFPB-0015 (Sept. 8, 2016). In addition to the CFFB penalty, Wells Fargo was required to pay a $35 million penalty to the Office of the Comptroller of the Currency (OCC), a $50 million penalty to the City and County of Los Angeles, and full restitution.(go back)

4 There is, of course, uncertainty as to the direction the CFPB may move in a new administration. The D.C. Circuit recently struck the CFPB Director’s for-cause removal protection, meaning that the CFPB would operate as a non-independent agency. See PHH Corp. v. Cons. Fin. Protection Bureau, 839 F.3d 1, 39 (D.C. Cir. 2016). For a discussion of that decision and its implications, see our post, D.C. Circuit Finds Single-Director Structure of the CFPB Unconstitutional. The D.C. Circuit panel’s decision is the subject of a pending motion for rehearing en banc, to which the Court has ordered a response. See Order, Case No. 15-1177, Doc. No. 1647585 (D.C. Cir. Nov. 23, 2016).(go back)

5 The OCC, for example, was one of the enforcement agencies in the Wells Fargo matter. Moreover, Comptroller of the Currency Thomas Curry noted in Senate testimony that the Wells Fargo action is a reason for supporting the ongoing rulemaking on incentive-based compensation arrangements (sometimes known as the “exec comp” rule). See An Examination of Wells Fargo’s Unauthorized Accounts and the Regulatory Response: Hearing Before the S. Comm. on Banking, Housing, & Urban Affairs, 114th Cong. 14–16 (2016) (statement of Comptroller Thomas Curry). That rule was proposed by the OCC, the Federal Reserve, the FDIC, the FHFA, the NCUA, and the SEC. See Incentive-Based Compensation Arrangements, 81 Fed. Reg. 37,670 (proposed June 10, 2016).(go back)

6 N.Y. State Dep’t of Fin. Servs., Guidance on Incentive Compensation Arrangements (Oct. 11, 2016), available here. As the DFS notes, its guidance was based in part on the 2010 “Guidance on Sound Incentive Compensation Policies” jointly issued by the OCC, the Federal Reserve, and the FDIC.(go back)