May 31, 2016
Bad Boys, Bad Boys, Whatcha Gonna Do?
If you've ever watched even one episode of the TV show "Cops," you've heard these words from the theme song: "Bad boys, bad boys, whatcha gonna do? Whatcha gonna do when they come for you?"
That song comes to mind when I think about what dealers and finance companies can do before the 'cop on the beat' (a/k/a the Consumer Financial Protection Bureau or the Federal Trade Commission) comes for them via the issuance of a Civil Investigative Demand ("CID"). Here are some questions you should be asking yourself and my answers to those questions.
1. What the heck is a CID? A CID is a formal investigation by the CFPB or the FTC. Essentially, it's a subpoena for information relating to suspected violations of law. The CID recipient may be directed to produce documents for inspection, copying, and reproduction, to submit tangible things, to provide written reports, to answer questions, and/or to appear at a place and time to testify. The CID can be very broad, arrive with little to no warning, and have short response deadlines.
2. Why did we get a CID? There are many possible reasons. The Dodd-Frank Act requires the CFPB to state in the CID the nature of the conduct constituting the alleged violation that is under investigation and the provision of law applicable to such violation. There are targeted CIDs, which you might receive if there's bad press about you in the media or you have too many consumer complaints filed against you. There are also "compliance sweep" CIDs, which you might receive because of a particular type of compliance sweep being conducted by the CFPB. The CFPB could even send you a CID if it suspects you may have information in your possession about a suspected violation of law.
3. What could a CID ask us to produce? There are three main targets of a typical CID: (i) documents; (ii) written reports; and (iii) answers to interrogatories. In connection with document requests, you could be asked to produce such items as
- advertisements, marketing research and programs, and website information;
- organization charts and process flowcharts;
- Board minutes, annual reports, or the equivalent, to the extent available;
- relevant management reporting, including aggregate contract data;
- price structure;
- credit applications, disclosures, account documents and notes, and telephone recordings;
- sample customer contracts;
- operating checklists, worksheets, and review documents;
- relevant computer program and system details;
- historical regulatory examination documents;
- consumer disputes and responses, including individual consumer suits and class actions;
- training programs and materials and documented employee compliance training;
- policies and procedures, including manuals and drafts;
- emails and instant messages;
- audit and compliance reports; and/or
- third-party contracts.
For example, the regulator could ask you to produce "all policies and procedures related to the company's compliance with Federal Consumer Financial Law" or "all documents related to the company's repossession activities." Be careful when the questions ask for a document "related to" a particular subject, as the CID may read that term very broadly.
In connection with requests for written reports, you could be asked to produce reports with specific information. For example: "Provide a table detailing complaints received during the applicable time period in the following format: (a) complaint identification number; (b) date of complaint; (c) customer name; (d) customer issue; (e) resolution; and (f) date of resolution." You may have that information, but not in the required format, or you may not be capturing the information requested, in which case you may have a difficult time complying with the request.
In connection with interrogatories, you could be asked to respond to specific questions. For example: "Identify all service providers used by the Company during the applicable time period and describe the function of each service provider," or "Describe the process the Company uses for identifying and responding to consumer complaints."
4. Are there steps we can take now to prepare for a CID? You bet! In anticipation that a CID may be issued to you at some point in the future, you should identify and populate initial response teams before you receive a CID. Some of the response teams could include a Strategy Team, a Counsel Team, a Meet and Confer Team, an IT and Document Delivery Team, and a Public Relations/Investor Relations Team. The size and number of teams should be based on your company size and the CID request. Here's a description of each of these potential response teams:
A. Strategy Team. This team is primarily comprised of senior management, department heads, and outside counsel. The team develops company goals and response strategies; communicates receipt of a CID to the response teams and other necessary parties; participates (with lead counsel) in the required "meet and confer" with the regulator; and identifies CID requests that need to be modified, e.g., scope, relevant time period, production schedules, etc. The team also prepares a plan to mitigate potential business disruptions. Finally, the team obtains a detailed and realistic estimate of the likely cost of complying with the CID within the specified return date that might justify a request for modification to the CID.
B. Counsel Team. Management should identify lead outside counsel to serve as the intermediary between the company and the CFPB. Lead counsel heads the Counsel Team and coordinates activities of the other response teams. If a CID is directed at a particular consumer finance law and detailed expertise is necessary, regulatory counsel should be considered to support the lead counsel. Finally, document counsel may also be necessary. Document counsel will work with the IT and Document Delivery Team, and the e-vendor if one is employed, to review documents, confirm that they are within the scope of the CID, and identify those that are subject to claims of privilege.
C. Meet and Confer Team. This team's size depends on the company's size and the CID's scope. A "meet and confer" meeting with the CFPB must occur within 10 days after receiving a CID. This team should include personnel with the knowledge necessary to resolve issues relevant to complying with the CID, personnel with knowledge of the recipient's information or records management systems, and personnel familiar with the recipient's organizational structure. If electronically stored information ("ESI") is requested, staff familiar with the company's ESI systems and retrieval methods should participate in the meet and confer meeting.
D. IT and Document Delivery Team. This team should always be staffed and ready. The team should know where documents and data likely to be requested in a CID are stored and how they are accessed. The team should be aware of the CFPB's document submission standards and be well versed in document retention standards, both legal and company-specific. This team will work with the e-vendor, if one is employed.
E. Public Relations/Investor Relations Team. Publicly traded companies may have to disclose receipt of a CID in regulatory filings. In addition, publicly traded and privately held companies may have covenants with investors and holders of debt that require disclosure of the CID. The nature of a company (as public or private) and the complexity of its debt and equity structure will influence whether this team is separate from or part of the Strategy Team.
5. What should we do if we get a CID? The first thing you must do is activate a litigation hold - halting all regularly scheduled document deletion and destruction schedules. Next, the response teams should be activated. The CID should be reviewed with the response teams to determine if you should request a modification. The document submission standards should be sent to the IT and Document Delivery Team. Finally, cost and burden justifications should be prepared. If you receive a CID, you should be ready to respond quickly because the response deadlines may be short, the requested material may be voluminous, and your lack of preparedness may be viewed as suspect. Your inability to quickly organize and produce requested material may be looked upon unfavorably by the regulator.
Don't be like so many of those guys getting chased down by the police officers on "Cops" - shirtless, shoeless, and without a plan. Put a plan in place now so you're ready if and when the 'cop on the beat' shows up at your door.