CFPB Issues Guidance on "Responsible Conduct"

This afternoon, the CFPB issued CFPB Bulletin 2013-6, which identifies four pillars of “responsible conduct” on the part of potential targets of enforcement action by the Bureau. The CFPB expressly states that such conduct may be rewarded with (i) resolution of an investigation with no public enforcement action; (ii) treatment of subject conduct as a less severe type of violation; (iii) reduction in the number of violations pursued; or (iv) reduction in sanctions or penalties. The Bulletin, titled “Responsible Business Conduct: Self-Policing, Self-Reporting, Remediation, and Cooperation,” states that such conduct has “concrete and substantial benefits for consumers and significantly contributes to the success of the Bureau’s mission” because it speeds detection and increases investigative and enforcement efficiency, thereby enabling the Bureau to pursue a larger number of investigations.

The Bulletin has interesting parallels to the SEC Seaboard Report and the DOJ’s Thompson and McNulty Memoranda. The four factors to be considered by the CFPB—self-policing, self-reporting, remediation, and cooperation—are discussed in further detail below.

• Self-Policing. In deciding whether to provide favorable consideration for self-policing, the Bureau will evaluate the nature of the violation (duration, pervasiveness, and significance); how it was detected (effectiveness of internal mechanisms); prior or relative performance of compliance management and audit functions; and the institution’s “culture of compliance.”
• Self-Reporting. The Bureau notes that it views self-reporting to be “special” among the four factors, and will evaluate for favorable consideration the completeness, effectiveness, and timeliness of the disclosure, as well as the degree to which the disclosure was purely proactive or a violation otherwise was likely to be discovered.
• Remediation. Remediation activity will be credited based on a review of how timely potential misconduct was addressed and how quickly it was remediated; whether responsible individuals were disciplined; whether information and extent of harm were documented and preserved promptly; and the Bureau’s confidence that misconduct is unlikely to recur.
• Cooperation. In evaluating cooperation with enforcement efforts, the Bureau will look for “substantial and material steps above and beyond what the law requires,” including cooperation from start to finish and the identification of any additional misconduct; proper steps taken to complete an objective internal investigation and share findings with the Bureau; encouragement of employee cooperation; and facilitation of enforcement actions against other potential targets.

The Bulletin should be considered carefully by any entity facing enforcement action by the CFPB because, among other things, the way in which these factors will be applied remains an open question. Despite the encouragement of self-policing, self-reporting, remediation, and cooperation, the Bulletin notes that there is no consistent formula that can be applied to the crediting of responsible conduct, and satisfaction of some or all of the factors will not bar the Bureau from bringing any enforcement action or pursuing any remedy. The Bulletin also states that there may be misconduct so egregious or harm so great that enforcement actions or penalties cannot be mitigated.