Latest / COMPLY: The Marketing Compliance Podcast / UDAAP Compliance Trends and Best Practices Pt. 2
Transcript
- 0:07Speaker 1: Hey there by podcast listeners and welcome to this week's podcast. This week is the second part of a conversation that we picked up during our last episode, between four industry experts on all things Udap , including James Kin from Troutman Pepper, Brian Serafin from Wiener Brodsky Kitter , PC Pia Thompson from Lawson gc, and Rhonda McGill from Perform Line Topics this week include how to avoid Common UDAP pitfalls, mitigating UDAP Compliance, risk in Marketing Materials, and developing effective UDAP compliance programs. Thanks for listening and enjoy .
- 0:58Speaker 2: There's been many enforcement actions from states and banking and federal regulators. Um, without calling anyone out in particular by name, could you summarize at a high level some recent enforce enforcement actions that you might be aware of and some of your thoughts on 'em ? I'd like to start with you, James, if, cuz I believe you, you have some interesting insights.
- 1:20Speaker 3: Yeah. Um, so , uh, Ian , this is a perfect kind of segue from , um, kind of the exotic, more aggressive use of , uh, uw , uh, including abusive , uh, uh, me and some colleagues. We filed an AMIC amicus brief in the Southern District of New York in a case , uh, brought by the CF p b and the New York Ag jointly , um, against an indirect auto company. And , um, the reason why I want to call that out, other than my kind of personal involvements , um, it's kind of top of my mind is , uh, two of the claims are perfect examples of everything we've been talking about. They are aggressive, novel uses of udap , and I'd say take it up the further, because the conducted issue is either expressly permitted by Tela or expressly not banned by Tela , and they don't like it. Again, they're outcome oriented. They have a paternalistic view. It's a practice in the marketplace that's been going on out in the open for decades. And instead of doing , uh, amending Tela , which is never gonna happen, but, you know, public rulemaking on Reg Z , they just like concoct a UAP theory and then they litigate it . So it's enforcement by, you know , uh, I mean regulation by enforcement and litigation. So in that case, it's indirect auto, right? These are credit sales. And uh, um, I think as we all know, in , in in the credit sale point of sale finance, you know, merchants, dealers take a discount from the finance company, right ? I mean , think about how credit cards work , um, and te expressly permits it, right? Um , it's, you know, and and , but, but again, in this case, the CF p b and New York Ag assert that it's an unfair practice. And I think the one other thing about the , uh, this , uh, example that I would point out similarly , um, truth and Lending Act, regulation Z only imposes , um, ability to pay requirements for credit cards , uh, conspicuously absent from other areas, right? Well, mortgage is a different area. I'm not a mortgage person, so , I'll , I'll, I'll let Brian, but on unsecured it , it's only for credit cards. Um, and certainly not for auto or student loans for that matter. Um , but again, in this lawsuit, they fashion a udap theory to say it is unfair to not assess ability to repay , uh, beforehand, even though it's a conspicuously missing from the Truth and Lending Act and Regulation Z, right? Everyone, they're very clear when they want you to do ability to repay in truth and lending and Reg Z and when they're not, and in this case you're not required to do it, but they wanna impose that, make up that requirement by, by fashioning it as in you . Wow .
- 4:13Speaker 4: Brian James , I just have a couple of questions. So , um, with respect to ability to repay , um, do they provide any explanation as to how that would happen while you're sitting at the car dealership to get your car loan? And then second , uh, my second question has to do, when you talk about the discount, right? That's almost the buy now pay later model, right? Because it's no interest for four weeks. I buy a hundred dollars mascara from Sephora and the buy now pay later, people pay Sephora 95 bucks and I pay the hundred bucks, right ? And so those are my two questions.
- 5:04Speaker 3: Yeah, I'll take them in reverse. I mean, the merchant discount, I , I don't know the answer to that. There's kind of no rhyme or reason why they object to it in this context, but not elsewhere. So I, I don't know. And then on the ability to repay, I I , I mean it's not in the complaint. Um , whether or not privately they discussed this is what you should be doing in a more detailed prescriptive manner, you know, I, I , I don't know . Um , but, you know, my my point is it's not required. And even if they did have private conversations, it's kind of like you can't just unilaterally tell me , um, how to do one that I must do ability to repay and tell me how to do it when you haven't gone through the proper rulemaking process like you did with credit card's, ability to repay in Reg Z . So if you're gonna do it, do it fairly openly with comments, with input from all stakeholders. Don't just like have three enforcement attorneys tell me how to do ability to repay.
- 6:09Speaker 5: I think that that's actually a really good point . I mean , you know , again, if you look at Reg Z for example, the , the steps you have to go through to do the ability to repay analysis are complicated. And you have to do it in a certain way, in a certain process and to just say, oh, yeah, do an ability to pay analysis without saying what exactly that entails does make a lot harder to, to actually turn that guidance into an actual compliance program or into policies and procedures.
- 6:35Speaker 2: Absolutely.
- 6:38Speaker 5: Actually , sort of just a little different than , you know , talking about another enforcement trend that I've noticed this , we also seems to be taking a lot of interest in , I guess we could kind of call add-on products. Mm . Um, these would be things like, you know, programs where you sign up and you get charged a monthly fee for something. Um, you know, if you sign up for a credit card, if you get some sort of insurance or protection mm-hmm . , um, they'll , you know, take care of the balance in case some issue comes up. Um, they , they seem to have a lot of concern that all , all these add-on products are basically just a way of putting fees onto people without giving them much in return. Or they're this concern that , um, people are kind of being, again , according to me , they're sort of being tripped into signing up for these things without realizing they're gonna be getting, for example, a monthly payment or some sort of ongoing payment over time that , um, you know, the , I guess is concerned that , you know, the person will forget that they signed up for it and every month they'll keep paying this charge without really using this product that they signed up for. Um, and so I think that's something actually they've started to show a lot of interest in, and they're trying to be , trying to find some ways to either get people to go back on them or to really , to really strengthen the ways that these programs are disclosed and presented to consumers and making sure consumers are reminded for them after they sign up.
- 7:58Speaker 2: Yeah. I , that's happened to me. I had a couple of subscriptions where it was like, I forgot I even subscribed to that and going through my, just going through a bank statement and was like, what is this? Right ? And they've been taking money outta my bank account every month for a year. So it's, sometimes I think it can happen, sometimes it can be confusing to the , uh, consumer. I , I , I don't know if it comes through , um, needs to come through better in a disclosure or how, how can we better educate the consumer? Cuz that , that to me, it is a consumer protection issue. Mm-hmm. . But I think that it is , um, an opportunity , um, across the board with those types of , um, disclosures. You know, if we're doing add-ons, there should be a disclosure and maybe even that reminder that you have this, do you wanna continue it, you know, periodically. I think it's great marketing. I think it builds trust with the consumer. Mm-hmm.
- 8:50Speaker 5: , I think that's right . The , no , I think part of the issue is the CP is coming , kind of coming at it with it with a more of a hatchet than a scaffold. Yeah . , you know, I have some banking clients, for example, some of these add-on products, they, they created them because customers are coming and say , well , I'm having a problem with X. Is there any way you can help me ? And the bank will , they'll think about this , you know , if we so this extra product, it'll give you this extra layer of protection cases , particular issue arises. You know, a a lot of these programs can be very helpful for consumers. So the idea that they could just be knock , knocked out in a broad stroke kind of , in a way it's sort of, it's anti-consumer. It takes away a consumer action .
- 9:27Speaker 2: So how do , uh, and with you guys, I know you probably have a lot of clients, you definitely Brian in the mortgage space and James in the , um, FinTech space. How are you guiding your clients to help them to avoid these potential pitfalls? Because as you said , they're coming after 'em with a hatchet, so if they're coming after you with a hatchet, you know, maybe there's some safeguards that they could put into place to just make sure that they're protecting themselves. Brian , what are , what are your ,
- 9:56Speaker 5: Well , so part of it , we , we , we try to stress for our clients that that compliance is an ongoing process. You don't do it once and then you're done. Right? Um, you know, for , for example, you know, a lot of our clients, they have , uh, a policy and procedure about UDAP compliance. And a lot of them, they, you know, they, they look and they say, well, the statute hasn't changed. They , they haven't released a new formal regulation on udap , therefore, we don't need to update our policy. Everything's good. And our thought says, well actually, you know, the , the statute might be the same. The regulations haven't been changed, but there's a lot of new guidance, there's a lot of new, there's consent orders, there's other things that are coming out that are kind of, again, either previewing what the CPU is expecting or showing these change interpretations. So what you really need to do is, again, you know, sometimes it's once a year, once every other year, there might be an appropriate length of time you really need to go back through these policies and procedures looking when they were written. And then h how things have changed , uh, changed over the, the last, you know, again, year, two years to make sure you're really encompassing the major concerns that are , um, that are out there. You know, again, a lot of our consumer, or sorry, our clients, they're , they're focused on their ads. They wanna make sure their ads are not deceptive, which is really, again, extremely important. But, you know , uh, making sure the ads are not deceptive is not the whole gamut of UAP protections. Exactly. So again, we're just trying to stress them that it's an ongoing process. You really have to keep track of what's changing and make sure you're keeping up with those changes . In some case , you're being proactive to get ahead of where you think changes are gonna be happening going forward.
- 11:31Speaker 2: Very fair point, I think, James, so
- 11:35Speaker 3: Yeah, really quick and then, you know, I , I'd love to a PS to say cuz she's kind of wearing that in hat role . Um , just a couple of, I think practical considerations and , and consistent with the theme and what I've been saying, you're not gonna find it in udap in precedent in the elements. So this is kind of the overlay of what the regulator expectation is that isn't rooted necessarily in the statute . Um, I, I think you have , you , you know, the product or service , um, you know, you have to be able to clearly , uh, convey , uh, the value to the consumer, right? You have to make that clear what is the value proposition to the consumer. So that's kind of the disclosure communication part. But then here's the outcome part. You have to actually allow the consumer to reasonably unlock and get the value of the product or service. It's one thing to tout it, but if you put obstacles or make it difficult for them to actually access or use yeah , the value, that's where you're gonna have an unfair and abusive problem. And then, you know, you have to , um, to Brian's point, it's not just the front end , you know, go through compliance before product launch. You have to actually track product usage and the outcomes, the data afterwards to, to make sure that actual usage in the wild , um, you know, is, is sensible. It's reasonable, right? That the outcomes in individually or in the aggregate are reasonable. They're fair to the consumer, you know , um, whatever that might be. I mean, if you talked about add-on products, if an optional add-on product is u you know, adopted or used 95% of the time, that's gonna be a red flag for the CF p b . So , um, then you know that you have to go back to the drawing board and say, is the process and the disclosures around the optional add-on? Are they really good enough or are people gonna assume that they're really not optional?
- 13:36Speaker 2: Right. No , thank you. And Pia ,
- 13:40Speaker 4: I , I think those are fabulous points. Um , as far as progress and plan for review of policies and procedures, I always say you're better off , uh, not having a policy if you never read it and don't do it. So you definitely need to read it and make sure you know that it's trained on in the entire , um, company. I think James, that tracking is absolutely essential. And so , um, I think you can convince the use of resources in the tracking , um, from a business perspective as well. Right? Well, of course we gotta track it. Like is it worthwhile to even have it? All those kinds of things. And then you get into value propositions that could be conflicting. And so this is just a concrete example. So in the subprime space, sometimes credit insurance is offered. So on the one hand, right, these are subprime folks, they don't have a lot of savings. If something happens, this credit insurance will take care of that obligation. On the other hand, if you're dealing with folks who don't have a lot of money, shouldn't every dollar they have go to paying off the obligation as opposed to paying a premium for the credit insurance, right? And so, like, where does that come out? And so I think that that's part of the add-on product udap , right? For some people I think it's a glass half bull , half empty. Like some people would look at my two choices and be absolutely certain, which is the right one and right. And that, that doesn't help when you're working with a regulator. Um, even though they might be as certain , uh, thank you not have a , not have a nuanced , uh, an ability to approach things in a nuanced way, but it's, it's not black and white,
- 15:51Speaker 2: That's for sure. That's for sure. So we're gonna , for the sake of time, because we have just gotten into this conversation, and I , I still have a whole bunch of questions, , I wanna talk a little bit about , um, going into a little bit of the identifying and mitigating some udap risks. So many of our clients are in the , um, marketing compliance side of the world. Um, there's also a lot of our clients that are , um, utilizing our product for performance purposes. Um, so we know udap, udap has been a hot topic for a lot of our clients. And so we recently put together a , um, UDAP udap report that did a deep dive into some of the most commonly flagged terms and phrases based on the thousands of marketing assets that we're ingesting for our clients and our platform. And this is on a daily basis. So some of our top fines , um, highlighted in the report were around exaggerated claims , um, subjective language, no barrier to entry, and some false sense of urgency. So there's so many layoffs in the , um, in many spaces of the financial industry right now, as we all know. And I've seen some instances where marketing teams have been taking over the marketing compliance pieces from the now shrinking compliance teams. What advice would you give to companies that are trying to scale their businesses during these times? Um, and especially those that are no longer allowing their co compliance or no longer have a compliance team or a full compliance team that can handle some of the , um, some of those issues. Um, who would like to go first? I'll turn it to Brian .
- 17:29Speaker 5: Sure. Well , well , again, our , our advice to our clients is be very careful when you scale back your compliance department. Uh, it might seem like an easy way to save money in the short run, but , um, a few years down the road when you get a , a civil investigative demand from the C I D or a DOJ subpoena, it might suddenly , um, seem like , uh, you you haven't actually saved a lot compliance people . Well , so , so one of , sort of something interesting, you know , I , the CFPB isn't really concerned about how the, if the economy is up or down, they're not really concerned if you're , if your business is making a lot of money or not. Um, you know, is there was some of the bank regulators like the F D I C or the O C C , they're actually very concerned about the stability and soundness of the, the bank. They really, they really have a problem if a bank goes under, for sure, the cftb has less of a problem if your auto lending business or your credit card company goes under because that's not part of their mission. So from their perspective, the fact that you're in a tougher economy is just not something that they're really gonna consider when deciding what's necessary to protect consumers. Yeah . Um , and, and so kind of going to that, obviously again , this is , this is a hard time a lot of companies are having, are facing some volatility. And the best thing we can tell them is, you know, you , you really wanna focus on putting some of that inva advanced investment into like, again, your compliance management system for example, because , um, you know, once you get it set up, it'll , I don't wanna say it's gonna run itself, but, but the after the fact costs are gonna go down significantly on , basically it's just, you know , making sure you're integrating all these things into your businesses , um, to make sure you're collecting information you need as it happens, as opposed to ending up with in a situation where it's the end of the year and you suddenly have to collect, you know, you know, 50 different types of doctrines from 10 different departments and everybody's scrambling to do it and all , you know, at once. And also trying to do all their regular job duties. Yeah . So again, the , the best advice we can say is just, you know , again, fo focus on getting things set up upfront so that you can save money on the back end . And that way if there are fluctuations in the market or difficulties, you , you're , you're less faced with this concern about what, what needs to be cut .
- 19:42Speaker 4: Absolutely. Great . And from an in-house perspective, right? I , I think the reduction, you know, let's be practical. How can a company reduce some headcount , uh, for a handful of months, right? Like that permanently. So what is your least risky advertising material gonna be? Well, stuff that you've already used and you're not even changing a comma , right? And I'm not saying no risk mm-hmm . , but that's gonna be the least risky piece to use. Now if you've decided to get rid of your compliance review, creating a brand new piece is not advised , right? Right. Stick with what you got and then, you know, to keep your costs in line, maybe consider a fractional demo council . You know, it's something that could work for you budget wise , but , um, I, I think that's part of it is there are some practical things you can do to minimize the advertising risk if that's a situation you're in for a handful of months.
- 20:55Speaker 2: And I think there's still that competition though, because now the market is getting a little bit more competitive. Everybody is trying to be seen and they're taking more risks. So it's like you're taking more risks but less compliance. That's, yeah . It's kind of scary for folks. James, did you wanna weigh in on that one?
- 21:13Speaker 3: Uh , just a quick point. Um, you know, if , if the, if the objective, and I think it is for everybody, especially if your earlier stages to scale, to me, scale means grow primarily by volume. Um, and I think the way that you could balance that growth while uh, managing risk is to reduce complexity, right? Yeah . Um, when I hear companies wanna do something so complicated, it's, it's actually too , you're , you're , it's a multiplying, you're multiplying the risk cuz the product itself is complicated. So that's embedded in the product and the processes around it, but then their execution risk, it's also magnified. Um , so I mean it's not really, it's kind of like not pure legal advice, but I , I think the practical compliance business advice is, okay, I get it, you have to scale. Your investors require it, you got milestones you gotta meet, can you kind of reduce some complexity so that you could scale without picking on undue risk
- 22:17Speaker 2: Fair? And,
- 22:19Speaker 4: And there is the cardinal rule, right? You cannot cut your way to growth . It's impossible and it's impossible for governments, municipalities, companies , um, you can write out some hard times, deal with cash flow issues, but you know , if you really wanna scale, it takes investment. It , you know, and, and so I think that's something that people need to be reminded of
- 22:49Speaker 2: Sure. Is ,
- 22:50Speaker 4: You know, you're gonna roll out this number of people. I don't think they were sitting around doing nothing. Right? So it's gonna impact your growth trajectory
- 23:02Speaker 2: For sure. It's difficult times, that's for sure. Are you gonna say something Brian ? Yeah, just
- 23:09Speaker 5: One other thought. You know, I i I think this kind of goes , um, is part of , you know, it's the , the job of you , the , the legal department, the clients department, your outside counsel . It's helping your clients understand where the risks in their business are. Because , you know, most of our clients, the, the peop again, for example, for a mortgage company, the person who started them , they were usually somebody who started out as a loan originator. Someone who, you know, again, you know , met with customers, you know , and , you know, explained to 'em the product, got them to , uh, agreed to a loan so that they're , they're , their background isn't necessarily going to be in terms of compliance or risk management, right? So again, so , so the the third, your outside council , your , your legal department, really, they have to educate sort of the business side people on what the company's areas of risks are. So they can make an educated decision about what, what can be cut with limited risks or what can be expanded with limited risk versus what are more high risk areas where, again, you're gonna have to do things, you know, a little more slowly and a little more , more deliberately to make sure. It's just, again, making sure you , your clients or the business side people really understand all the aspects of their business and not just, for example, the sales side .
- 24:18Speaker 2: Absolutely. So we, I know we always hear , um, folks talk about the importance of building a sound compliance program that includes updated policies, your ta , um, training, making sure it's timely , um, and everything is like going a million miles a minute right now. So , um, one of the most things that an important , uh, or important things that a business can do is to ensure that they're monitoring and that they're documenting. What are some areas where you would recommend our viewers , um, pla place a little bit more attention during these times when they have smaller teams, but yet everything's on spreadsheets or in file folders or who knows where, what are , what's some advice that you can give them ?
- 25:06Speaker 5: Just again, 1, 1, 1 thing. Um, you know, there's a , you know, there's a lot of software out there that makes it a lot easier these days to automate business functions or functions or to track things automatically. Um, I've seen this a lot in particular with respect to training. If you're tracking, you know, which staff members or which employees went to which training programs on an Excel spreadsheet , um, that's kind of the bare minimum. I mean, really there's a lot of software these days that'll really make it easy. You know, it'll automatically know when the person did their training, it'll send them notifications when they didn't tell them to go get it. It'll tell your compliance officer, Hey, employee X hasn't done training y so you really need to get on them now because, you know, the one year deadline where they're supposed to have that training is coming up, or, you know, it might have passed. So you really need to make this happen. Um, again, it , you know, it is a little bit more of an upfront investment, but the , the amount it saves you in terms of employees manually inputting things on spreadsheets in terms of compliance risk, it really tends to pay off in the long run.
- 26:04Speaker 2: Okay . Great .
- 26:07Speaker 4: And Brian , I think that's perfect. And the example with the spreadsheets and everything else, right? Resources aren't just dollars, it's people, it's time, it's all of those kinds of things. And so there are some great solutions.
- 26:27Speaker 3: Um, I I guess that leaves me last here. Um, so I'm gonna kind of turn away from resources cause I think you guys got that covered. Um, I, I, I think I try to put myself in the shoes of the people I work with, right? So their in-house council may be compliance and they have to sometimes butt heads with business, right? Um, and it's hard to educate business people about the UDAP risk because it's so subjective, blah, blah, blah, right? Um, so , uh, I think one helpful tool for everybody, it's an exercise for everybody and business people I think will understand this intuitively, is can we explain, defend, and feel comfortable about whatever it is that we're considering doing? If it were blasted in mass media, my grandmother , um, a judge , uh, you know, Washington Post or whatever , um, cuz if you kind of frame it as a legal issue , um, it , it might be a tougher education process if you're the in-house legal or compliance professional. But if you kind of phrase it that way , um, which I think more aligns with how the CF p p views it, cuz as we said, they're not, they don't feel bound by precedent. Um , so , uh, that, that would be my, my suggestion is kind of like all of this is kind of, it boils down to do we feel comfortable explaining, defending this to the, the media, the mass public, a judge , uh, forget the technicalities of the law.
- 28:02Speaker 2: Absolutely. Protecting the brand is very important. That's one of the things we take very seriously with our clients, is making sure that, you know, our, our our tenants are discover, monitor and act for that reason. Um, because you wanna know what's out there so that you can be on top of it and , um, take action before the regulators come after you. So , um, I thank you guys so much for such a great, great discussion. Um, as we're concluding, I wanna go around the horn one more time to allow each of you to share some of your closing thoughts and maybe a takeaway for our attendees , um, as it applies to udap compliance and risk. And if you have anything that you'd like to share with them , um, that would be great. Um, let's start with Pia .
- 28:46Speaker 4: Thank you so much for the chance to participate. I feel like I have some great takeaways and I think people should , uh, find folks like Brian and James and perform line , uh, and perhaps exactly them , um, for the pulse on what's happening. And my big takeaway , uh, for a new way to articulate and think about it is the results oriented , uh, aspect of the cfpb. And I think I've thought that before, but I think that way to articulate it is just fantastic and we'll also frame my thinking.
- 29:27Speaker 2: Thank you so much James.
- 29:30Speaker 3: I guess this is a little bit of a looking ahead thing. Um, like a lot of people in my field, I'm carefully tracking , uh, at this point it's not really tracking awaiting Supreme Court decision on the CF p b constitutional issues. Um, but that's kind of obvious if you are a CF p b practitioner. I think related to that, there seems to be a broader , um, challenge against administrative agency regulatory power. So I'm keeping careful track of that too. And I, I don't oversell that to say companies feel like , um, they have card blanche to do whatever they want, but it's just these are sea change potentially , uh, developments that we should all keep an eye on
- 30:13Speaker 2: For sure. And Brian ? Yeah ,
- 30:15Speaker 5: I guess sort of the , the thing I always go with is , um, there there's two phrases that really scare me. It's, it's one, everybody else does it or two, that's the way we've always done it. Whenever, whenever I hear some of those phrases from a client, that's kind of a , a code red moment. Like yes,
- 30:31Speaker 2: . Well
- 30:32Speaker 5: That's interesting you said that. Let's think about that because you , you'll see these instances where sent you said , you know , we really , we focus on it this way , we actually aren't really a hundred percent sure why we do it that way or how that makes it legal.
- 30:44Speaker 2: Yep .
- 30:44Speaker 5: So again, that just, it just goes back to this that compliance is dynamic. It's always changing, kind of going what to James said, you know, reg regulation to be cyclical. You could have a really laissez fair administration that really is hands off and then you could have a new one come in and suddenly everything's back on the table and you know, there's no grace period. We're going to heavy finds right away. So again, it's just, it's, it's always staying up to date about what's happening and what you can do to get ahead
- 31:11Speaker 2: Absolutely.
- 31:12Speaker 5: At it's not to fall behind
- 31:13Speaker 2: . Exactly. There you go. And I would say that my takeaways , um, based on James' statement is you gotta be able to explain it. You gotta be able to defend it to your mom, your daddy, the regulators and everybody else. So , um, I will remember that one forever. Thank you so much. This was such a great discussion and um, hopefully we'll have you guys come and visit us with us again for one of our future sessions.
- 31:41Speaker 1: Thanks for listening to this episode of The Comply podcast. Many of the key topics of discussion today are highlighted in our top UDAP compliance issues report, which I will drop for you in today's show notes. If you have not had a chance to read it yet. And if while listening to our podcast today, you realize you may need to prioritize incorporating udap into your marketing compliance program, I'm gonna include a link to our udap resource library. It has a number of helpful pieces to help you better understand and prioritize UDAP compliance. As always, for the latest content on all things marketing compliance, you can head to content dot perform line.com . And for the most UpToDate pieces of industry news events and content, be sure to follow perform line on LinkedIn. Thanks again for listening and we'll see you next time .