State of Enforcement: Recent Issues and Trends Facing the Financial Services Industry

For consumer finance industry participants, overlapping state and federal enforcement is nothing new. The post-financial crisis decade has seen an enhanced focus on consumer protection and increased coordination between federal and state regulators. But ongoing changes at the Consumer Financial Protection Bureau since November 2017 have palpably shifted the balance of those overlapping systems. Where the CFPB had taken a leading role, many industry watchers predicted an enforcement void that would be filled by the states, and several states openly said they intended to do just that. See, e.g., Attorney General Grewal Announces New Leadership at the Division of Consumer Affairs, N.J. Dep’t Law Pub. Safety (Mar. 27, 2018), https://nj.gov/oag/newsreleases18/pr20180327a.html (“As the federal government abandons its responsibility to protect consumers from financial fraudsters, it is more important than ever that New Jersey picks up the mantle to protect its own residents.”); Letter from Eric T. Schneiderman, to President Trump on behalf of 17 Attorneys General (Dec. 12, 2017) (“Regardless of the future director or leadership of the CFPB, we as state attorneys general will vigorously enforce state and federal laws to ensure fairness and deter fraud.”). And, states are more well equipped to fill that role than ever before. 

In this changing environment, industry participants should expect more scrutiny and consumer protection enforcement activity at the state level. For example, in 2018, there were 47 publicly announced or filed actions by the CFPB (down from 86 in 2017), leaving significant room for states to increase their enforcement activities. Companies need to be prepared and understand the tools available to state enforcers. In the State of Enforcement series, Goodwin’s Consumer Finance Enforcement Practice will preview those tools to help companies know what to expect. In this first installment, we provide a general overview of the primary tool used at both the federal and state level—consumer protection statues prohibiting unfair, deceptive and abusive practices. This article explains the key characteristics and functions of these statutes, and discusses how enforcement agencies use them in practice by reviewing recent enforcement actions. As state statutes most often follow and model the federal statutes, we will begin by discussing the federal Unfair Deceptive Acts and Practices (UDAP) and Unfair, Deceptive or Abusive Acts and Practices (UDAAP)—which state actors have the authority to enforce themselves—and then turn to the state analogues. Armed with a greater understanding and appreciation of these statutes, industry participants and counsel can better prepare themselves and direct their clients to avoid becoming the target of an enforcement action.

I. Federal UDAP and UDAAP Enforcement

Among the tools in the federal enforcers’ toolboxes are UDAP and UDAAP. Federal UDAP arises from Section 5 of the FTC Act, which prohibits “unfair” and “deceptive” acts and practices. 15 U.S.C. § 45(a)(1). Under UDAP, an act is unfair if it (1) is likely to cause substantial injury to consumers, (2) cannot be reasonably avoided by consumers, and (3) is not outweighed by countervailing benefits to consumers or to competition. 15 U.S.C. § 45(n). Moreover, UDAP’s unfairness prong applies not only to overt acts and practices, but also to those that unreasonably impair a consumer’s ability to make an informed decision, such as withholding material information until after a consumer has purchased a product.  Id. But a bevy of UDAP case law creates significant nuances. For instance, “substantial injury” can be monetary or reputation harm, but there must be a significant risk of concrete harm rather than a speculation that harm might occur. See FTC v. Roca Labs, Inc., No. 8:15-cv-2231-T-35TBM, 2018 U.S. Dist. LEXIS 182171, at *27-29 (M.D. Fla. Sept. 14, 2018). Additionally, an act is not considered unfair if its benefits outweigh any injuries caused. See American Financial Services Asso. v. FTC, 767 F.2d 957, 975-77 (D.C. Cir. 1985). Some examples of benefits include lower prices or the availability of products and services to a wider range of consumers. See In the Matter of LabMD, Inc., No. 9357, 2016 FTC LEXIS 128, at *27 (F.T.C. July 28, 2016). 

As to UDAP’s deceptiveness prong, an act or practice is deceptive if (1) it misleads or is likely to mislead the consumer, (2) a consumer’s interpretation of the representation is reasonable, and (3) the misleading representation is material. FTC v. Direct Mktg. Concepts, Inc., 569 F. Supp. 2d 285, 297 (D. Mass. 2008). Generally speaking, proving that a defendant engaged in deception is easier than proving unfairness, since there is no cost-benefit analysis or requirement that the practice cannot be reasonably avoided by consumers. Id. Examples of potentially deceptive acts include bait-and-switch techniques, omitting material conditions, or making misleading price claims. FTC v. Pantron I Corp., 33 F.3d 1088, 1096 n.22 (9th Cir. 1994). In UDAP cases under the deceptiveness prong one sticking point is whether a practice is material or not, but practices are generally deceptive if they are likely to affect a consumer’s decision to purchase a product or service. See FTC v. Five-Star Auto Club, 97 F. Supp. 2d 502, 532 (S.D.N.Y. 2000). Moreover, courts will analyze consumer’s interpretation from the position of the “least sophisticated consumer.” Id.

The financial industry’s prudential regulators—the Office of the Comptroller of the Currency (OCC), Federal Deposit Insurance Company (FDIC), and Board of Governors of the Federal Reserve (Federal Reserve)—all retain enforcement authority over UDAP, and regularly bring enforcement actions under the statute. For example, in July 2018, the OCC entered into a consent order with TCF National Bank related to that institution’s overdraft opt-in procedures. OCC Consent Order No. 2018-064. The consent order focused on TCF’s attempts to comply with the Federal Reserve’s requirements under Regulation E that institutions disclose their overdraft procedures and obtain affirmative consent to those procedures from customers.  Id. at 1-2. The OCC issued a $3,000,000 fine. Id. at 3. The consent order explains that although TCF’s overdraft service was technically compliant with Regulation E and TCF provided customers with written disclosures, its practice was nonetheless deceptive since the disclosures lacked key information to allow customers to make an informed choice and gave a “net impression” obscuring the optional nature of the overdraft service. Id. And, in March 2018, the FDIC entered into a consent order with The Bancorp Bank related to fees charged by that institution for point of sale, signature based transactions. FDIC Nos. 18-0008b and 18-0009k. There, the FDIC concluded that Bancorp Bank charged customers fees that exceeded what had been disclosed to them. Although it did not specify what prong, the FDIC concluded that this conduct violated UDAP, highlighting one of the key challenges with UDAP laws for companies: there is no concrete list of what is and what is not a violation. With the addition of the broad “abusiveness” prong, the scope of what might be considered a violation has expanded tremendously.

In 2010, in connection with Dodd Frank and the creation of the CFPB, Congress provided a new enforcement mechanism for the Bureau and others—the Unfair, Deceptive, and Abusive Acts and Practices Act. 12 U.S.C.S. § 5531. Seizing on the familiar UDAP model, Congress added a new prong through the abusiveness standard.  12 U.S.C.S. § 5531(a). Conduct is abusive where it (1) materially interferes with a consumer’s ability to understand a term or condition of a product or service, or (2) takes unreasonable advantage of (i) a consumer’s lack of understanding of the material risks, costs, or conditions, (ii) a consumer’s inability to protect his or her interests in selecting or using a product or service, or (iii) a consumer’s reasonable reliance on a covered person to act in the interests of a consumer. 12 U.S.C.S. § 5531(d). In hearings leading up to the passage of the Act, members of Congress expressed their intentions to protect consumers from abusive practices, elicit help from the states in enforcing consumer protection, and make the consumer protection process more easily accessible to individuals. See Improving Federal Consumer Protection in Financial Services, Hearing Before the H. Comm on Fin. Servs., 110th Cong. 37-40 (2007). A few of the practices members of Congress expressed concern about included excessive overdraft fees, double-cycle credit card billing, universal defaults, and banks entering into agreements with unregulated third parties to issue subprime credit cards. Id. Some of these actions cannot be pursued under UDAP because, so long as they are adequately disclosed, they are not treated as unfair or deceptive. Id. UDAAP adds an “abusive” standard to address some of these inadequacies.  

Since the UDAAP’s “abusiveness” prong was first proposed, numerous commentators, including industry participants, have raised concerns that the new prong would create uncertainty. That concern has not abated after UDAAP’s enactment. The CFPB has not set forth any clear examples of abusive conduct, instead choosing to define through enforcement. See How Will the CFPB Function Under Richard Cordray: Hearing Before the Subcomm. on TARP, Financial Services, and Bailouts of Public and Private Programs Before the H. Comm. On Oversight and Government Reform, 112th Cong. 1, 2 (2012) (statement of Richard Cordray, Director of the CFPB) (“[W]e are going to have to see what kind of situations may arise where that would seem to fit the bill.”). Although the Bureau has brought “abusiveness” claims against defendants, cases in which it has done so do little to disperse that uncertainty.

For example, in one of its first court actions alleging abusive conduct under UDAAP, the Bureau sued CashCall, Inc., WS Funding, LLC, and others in 2013, alleging that the defendants made loans in violation of several states’ usury caps. Case No. 13-cv-13167 (D. Mass.). There, the Bureau alleged that the defendants were the true lenders of loans made by tribal lender Western Sky Financial LLC.  Id. at 9-11. The Bureau alleged that, although state usury laws did not apply to Western Sky, they did apply to the defendants and that, because the defendants were the true lenders of the loans at issue, the loans were void.  Id. at 11. The Bureau brought suit under UDAAP, and, in addition to alleging unfairness and deception, alleged that the defendants’ conduct was abusive because it preyed on consumers’ lack of understanding of state usury laws. Id. at 21. After the case was transferred to the Central District of California, the Bureau prevailed and sought more than $200 million in restitution, but Judge John F. Walter disagreed and awarded $10 million instead. The case is currently on appeal to the Ninth Circuit which is set to decide a dispute over the amount of damages. See Case Nos. 18-55407 and 18-55479 (9th Cir.). The Bureau filed a similar suit more recently, in November 2017 against a different group of affiliated companies, also alleging a violation of UDAAP’s abusiveness prong. CFPB v. Think Finance, LLC, No. 17-cv-127 (D. Mont.) Dkt. No. 1. 

The administration change has not led to any clarity regarding the “abusiveness” prong. While former CFPB Director Mulvaney expressed intent to define the “abusiveness” standard at the Mortgage Bankers Association’s annual conference back in October 2018, see Mulvaney: BCFP Intends to Define “Abusive” of UDAAP, Inside ARM (Oct. 16, 2018), https://www.insidearm.com/news/00044416-mulvaney-bcfp-define-udaaps-abusive-new-r/ (“[R]egulation by enforcement is done . . . [companies] have a right to know what the law is.”), his successor, Kathy Kraninger, has not yet indicated any intention to follow suit.  

What we do know is that, despite the changes in administration, the CFPB is still using the abusiveness prong. In late October 2018, the CFPB settled with Cash Express, LLC, a small-dollar lender, in part for its practice of using check-cashing services to offset outstanding debt. Cash Express instructed its employees to determine whether consumers owed money prior to cashing their checks, and if so, keeping some or all of the check proceeds to satisfy that debt. Employees were instructed not to disclose during the check-cashing transaction, that Cash Express would deduct any previously owed amounts from the checks. The CFPB found that despite the fact that consumers signed disclosures regarding the policy, the practice was abusive since (1) it took unreasonable advantage of the consumer’s lack of understanding that Cash Express would withhold a portion of their checks, (2) Cash Express capitalized on this misunderstanding by physically keeping the check away from consumers until the transactions were complete, and (3) consumers were denied the ability to make informed decisions when deciding whether to cash their check with Cash Express. Cash Express was ordered to provide redress to all affected consumers in addition to a civil money penalty of $200,000 to the Bureau.

Despite this, the abusiveness prong has not become one of the Bureau’s most commonly used enforcement tools. Instead, the Bureau’s focus continues to be on unfairness and deception. For example, in September 2018, the Bureau filed suit against several affiliated companies that offer lump sum payments in exchange for future payments for pension plans and other income streams through automatic withdrawals. BCFP v. Future Income Payments, LLC, No. 18-cv-1654 (C.D. Cal.) Dkt. No. 1 at 2. Among other things, the Bureau claimed that these companies misled consumers by representing that these arrangements were not loans, had no applicable interest rate, and were less expensive than alternative means of credit while the arrangements were loans and were more costly than alternatives. Id. The Bureau claimed that these arrangements were deceptive under UDAAP because of the alleged misrepresentation. Id. at 12. Further, the Bureau argued that the alleged misrepresentations were material because they prevented consumers from comparing the cost of the arrangements against other forms of credit. Id.

II. State “UDAP” Statutes

While state agencies do not have authority to bring actions under federal UDAP, every state has its own version of a “UDAP” statute and a handful even have multiple UDAP-type statutes. But these statutes vary from federal UDAP and from each other in many ways ranging from superficial differences, such as their titles (such as Consumer Protection Act, Deceptive Trade Practices Act, Deceptive and Unfair Trade Practices Act, or Consumer Sales Practices Act), to the substantive, such as (1) the scope of who has standing to sue, (2) the types of institutions that are exempted from regulation, and (3) the standard of proof a plaintiff would need to meet. Id.

In every state (and the District of Columbia), attorneys general and other state actors have the ability to enforce state UDAP laws. Id. In addition to the prospect of enforcement actions, in over thirty-nine states (including the District of Columbia) consumers may also bring UDAP actions. Id. State UDAP laws differ, however, in the types of industries that are exempt from these UDAP statutes. For example, Michigan and Rhode Island exempt regulated industries writ large (see, e.g., Smith v. Globe Life Ins. Co., 460 Mich. 446 (1999) and Chavers v. Fleet Bank RI, 844 A.2d 666 (R.I. 2004)), Ohio exempts all lenders other than payday, mortgage brokers, and non-bank mortgage lenders (see Ohio Rev. Code § 1345.01(A), (K)), and Alabama and Florida exempt all banks, (see Ala. Code § 8-19-7; Fla. Stat. Ann. § 501.212(4)). Id. There are also significant differences in the substantive application of these state laws. For instance, in states like Colorado, Nevada, and Wyoming, plaintiffs must prove defendants acted with intent or knowledge. In Minnesota and North Dakota, plaintiffs must prove defendants intended for consumers to rely on the deception. Colorado, Georgia, Minnesota, Nebraska, New York, South Carolina, and Washington all require consumers prove a defendant engaged in a deceptive business practice, rather than one isolated act. In Arkansas, Georgia, Indiana, Maryland, North Carolina, Pennsylvania, Texas, Virginia, and Wyoming, consumers must prove they actually relied on the deception. As yet another example, some states (such as New York) incorporate the concept of unconscionability into their statutes, providing an avenue beyond unfair or deceptive claims.

As industry participants well know, New York has been particularly active in bringing actions under the Consumer Protection from Deceptive Acts and Practices Section of the New York General Business Law (CPDAP). One recent example demonstrates how UDAP claims can begin with wide reaching, multi-state investigations. In October 2018, the New York Attorney General filed claims against jewelry retailer Harris Originals alleging that defendant’s sales practices to active-duty members of the military were unconscionable, unfair, and deceptive. But the lawsuit was just the tip of the iceberg, as it was filed only after a two-year multistate investigation conducted by New York in conjunction with Tennessee, Delaware, Georgia, Hawaii, Idaho, Illinois, Kansas, Louisiana, Maryland, Nevada, North Carolina, Pennsylvania, and Virginia.  

In another action, the New York Attorney General filed claims against student loan debt relief companies in the New York Supreme Court for the county of New York in September 2018 in New York v. Debt Resolve. These claims were also brought under the CPDAP, various other New York state laws, and several federal laws including the Federal Credit Repair Organization Act, the Telemarketing Sales Rule, and the Truth In Lending Act. New York alleged that these companies engaged in various deceptive practices including misrepresenting that they were affiliated with the federal government, giving incomplete and harmful advice, charging illegal upfront fees, misrepresenting that fees would go towards student loan balances, misidentifying themselves as “student loan experts,” and lying about being registered on the New York Stock Exchange. New York sought injunctive relief, restitution, damages, disgorgement, civil penalties, and costs. The case remains pending.

Another state that has ramped up its UDAP efforts is Florida. In August 2018, the Florida Attorney General brought a claim under its Deceptive and Unfair Trade Practices Act (FDUTPA) in Florida v. Dollar Thrifty Automotive Group. This suit was brought against Dollar Thrifty, a national car rental company, in the Circuit Court of the Fourth Judicial Circuit in Duval County, Florida. Florida alleged that Dollar Thrifty engages in deceptive and unfair practices by charging excessive administrative fees without disclosing to consumers that the fee is a profit and not required by the state, charging these excessive fees to induce consumers to purchase a more expensive product, misrepresenting its $15 per toll charge as a fee, charging consumers for a damage waiver product when consumers had declined the product, charging consumers for an upgraded car class when that car class was unavailable, and misrepresenting the total cost of a car class upgrade. The state sought injunctive relief, costs, restitution, penalties, and other statutory relief. The case remains pending.

Also in August 2018, the Florida Attorney General filed a claim under the FDUTPA in the Circuit Court of the Fourth Judicial Circuit in Duval County, Florida in Florida v. American Investigative Services LLC. The state alleged defendant deceptively marketed and sold mortgage and foreclosure relief services to consumers. Defendant is accused of charging and collecting upfront fees for foreclosure services before performing those activities, failing to execute written agreements with these consumers, misrepresenting the likelihood of obtaining mortgage loan modifications for consumers that would reduce their regular mortgage payments, failing to disclose that defendants were not associated with the government or approved by the government, and failing to disclose that if consumer stops making mortgage payments, such nonpayment could result in loss of consumer’s home. The state sought an injunction, reimbursement to every consumer who paid defendants in response to these solicitations, civil penalties, and costs. The case remains pending.

III. State UDAAP Enforcement

In addition to their own UDAP equivalents, states also have authority to sue under UDAAP. 12 U.S.C. § 5552. State attorneys general and other state regulators may bring civil actions against “any entity that is State-chartered, incorporated, licensed, or otherwise authorized to do business under State law.” Id. at § 5552(a)(1). Before initiating an action, states just need to “timely provide” the CFPB with a copy of the complaint, and thereafter the CFPB may choose to intervene or appeal any order of judgment. Id. at § 5552(b)(1), (2). Since its enactment, a handful of states (such as Pennsylvania, Illinois, and Florida) have brought UDAAP claims against various institutions.

In 2012, the Illinois Attorney General filed claims in the Northern District of Illinois under UDAAP and the Illinois Consumer Fraud and Deceptive Business Practices Act against Westwood College in Illinois v. Alta Colleges. Case No. 14-cv-3786. This is one of the earliest instances a state attorney general filed a UDAAP claim without CFPB involvement. The state alleged that the college made false or misleading representations to consumers about the cost of attendance, the school’s accreditation and admission process, the terms of its in-house lending program (APEX), and the types of jobs graduates would be qualified to obtain. The state claimed these acts were abusive since they targeted students who, due to socioeconomic background or lack of sophistication, had little knowledge about financial aid. Additionally, the defendant allegedly held out salespeople as “admissions representatives” who would guide students to the education program best suited for them. In its opinion, the court articulated a broad interpretation of UDAAP’s abusiveness standard and found that the state’s allegations were sufficient to withstand a motion to dismiss. This case settled in 2015 with Westwood agreeing to forgive approximately $15 million in student loans financed through APEX.

In October 2017, the Pennsylvania Attorney General Josh Shapiro, filed a claim in the under UDAAP and the Pennsylvania Unfair Trade Practices and Consumer Protection Law in Pennsylvania v. Navient Corp.  Case No. 17-cv-1814 (M.D. Pa.). The state alleged that Navient, a student loan provider, violated the statute in its administration of student loans. Id. at 2-3. The state sought an injunction, refund of moneys paid, disgorgement, and civil money penalties. Id. at 4. The court denied Navient’s motion to dismiss and the case remains pending.

In 2014, the Illinois Attorney General filed claims in the Northern District of Illinois under UDAAP and the Illinois Consumer Fraud and Deceptive Business Practices Act against All Credit Lenders in Illinois v. CMK Investments. The state alleged that defendant engaged in unfair, abusive, and deceptive practices in connection with its Revolving Credit Plan by failing to disclose that the loans would never be paid off if consumers only made minimum payments and charging interest over 36% by disguising interest as an account protection fee. All Credit Lenders moved to dismiss, arguing that disclosures such as, “PLEASE NOTE: if you only pay your minimum payment, you will not pay down your principal balance,” protected it from liability. The court denied that motion, allowing the case to proceed under both state and federal claims. Under state law, the court held that claims for misrepresentations may proceed even if the misrepresentations contradict terms of the contract. Similarly, the court relied on guidance from the CFPB which states, “disclosures may be insufficient to correct a misleading statement or representation, particularly where the consumer is directed away from qualifying limitations in the text or is counseled that reading the disclosures is unnecessary.” In 2016, the case settled and All Credit Lenders agreed to pay $3.5 million in restitution, stop accepting payments for loans with hidden fees, and stop collections on loans that were offered with hidden fees.

As a final example, in 2014, the Florida Attorney General filed claims in the Middle District of Florida under UDAAP and the Florida Deceptive and Unfair Trade Practices Act against the Berger Law Group in Office of Attorney General v. Berger Law Group. Case No. 14-cv-1825.  Defendant offered a mortgage modification service. The state alleged that defendant charged consumers upfront fees before a written agreement was executed, discouraged consumers from communicating directly with their lenders instead claiming that they would reach out to those lenders, and failed to disclose that consumers could lose their homes if they stopped paying their mortgage. Default judgment was entered for the state in 2015 since the defendant failed to respond to the complaint. The defendant was ordered to pay $1,914,669 in restitution and $3,875,000 in civil money penalties.

IV. Decreased CFPB Activity Leaves a Void for States to Fill

Recent trends demonstrate that, although it has continued to initiate enforcement actions, there is some anecdotal support that the former Acting Director Mulvaney of the CFPB has made good on some of his statements that he would  decrease the level of such actions. This decrease of public activity creates room for state attorneys general to increase their efforts to fill the void.  These state attorneys general not only have a broad range of enforcement tools to choose from, such as federal UDAAP and their own UDAP-equivalent statutes, but they also have strength in numbers through information-sharing and joint investigations. Both the CFPB and state attorneys general have processes in place to share information regarding investigations and enforcement efforts, meaning that industry participants are more likely to face joint state-state or state-federal actions. More on the extent of this information sharing and key recent joint-enforcement efforts will be addressed in the next article.