What Should You Do About Someone Else’s Enforcement Action? Five Things to Keep in Mind

Heartburn, schadenfreude, existential dread – reading an enforcement action issued by one of your regulators can evoke these reactions even when your company wasn't the target. You may recognize similarities between your company’s practices and the facts described in the consent order. The knee-jerk reaction might be to change what you're doing. Sometimes that might be the right thing to do. Other times, it may not be.

For example, in May 2022, the CFPB fined Bank of America $10 million and ordered it to pay hundreds of thousands of dollars in restitution to consumers over alleged deficiencies in the bank’s garnishment-related practices. Over forty-plus pages, the CFPB described in detail what it viewed as errors in the bank’s garnishment practices and required the bank to make numerous changes. The order revealed that the CFPB’s view of the law conflicts with the long-established understanding shared by those in the industry and state courts around the country. Most notably, the order asserts that applicable garnishment exemptions are governed by the law of the state where the customer lives, contradicting the general rule that the law of the forum state determines what civil remedies are available. The order also ignores important distinctions among various states’ laws regarding how to determine where a bank account is located, and how that impacts or does not impact the jurisdictional reach of the state’s courts.

In short, the order puts every bank in a tough spot. It’s not as if they can disregard valid state court orders based on the CFPB’s enforcement action. At the same time, the order shows that the CFPB’s expectations do not align with long-standing and widespread practices in the industry. More broadly, it shows that the agency’s expectations conflict with basic legal principles because, just like every other recipient of a court order, banks are expected to comply. This presents real regulatory and enforcement risk to institutions, and there is no clear or easy answer on how to proceed.

Enforcement actions are tricky to interpret because they don’t carry the full force of law the way a regulation does. They are a one-sided view written by the government. They are not technically binding on anyone except the named company. But they provide a window into the agency’s view of the law and explain how the agency applied it to a specified fact pattern. What should you do with that information? Here are a few considerations to think about:

1. Don’t lose perspective. Remember that you aren't getting the whole picture from the facts in the consent order. Look for opportunities to discuss the enforcement action with industry groups, outside counsel and others with a broad sense of the market and agency involved. Think about what the order might have left out and what went on behind the scenes. It may change how you understand the order and what it means for your company.
2. Consider getting some guidance from the source. Enforcement actions express the views of the enforcement attorneys involved. Those views may or may not align with the approach that the supervisory or regulatory staff will take moving forward. Many agencies offer avenues for regulated entities to ask the agency for guidance. Obviously, you risk getting an answer you dislike and drawing attention to yourself. But if reading the enforcement action leaves you with a burning question, there might be a way to get a sense of the agency’s stance on an issue in light of the enforcement action. This kind of guidance is generally non-binding, but can be valuable nonetheless. Outside counsel with broad connections in the industry and the agency involved can help you craft an approach that can get you guidance without drawing scrutiny.
3. Weigh the impact on your industry’s outlook and look for opportunities. Think about what the enforcement action says about the outlook for your industry. Could it make funding more expensive or harder to come by? What does it say about the potential for growth in the next five years? Does it open up new opportunities? Will its unintended consequence likely be reduced access to services for traditionally underserved people or communities? Could you take this moment to differentiate your company from others?
4. Kick the tires. Think you're different enough to be safe? Are you sure? Once a particular statute, product or practice is brought to the top of the mind of regulators, and consequently the plaintiffs' bar, additional activity will follow. Even if you think you could distinguish your company’s practices from the activity described in the enforcement action, it’s worthwhile to kick the tires and think about what other action the agency could take given the views expressed in the enforcement action. For example, after the CFPB consent order related to garnishments, many banks noted the CFPB’s focus on state law protections for judgment debtors. Those banks made sure their policies and procedures incorporated these protections.
5. Make a stand only on principle. Just because the target of the enforcement action was cited for a particular practice or was required to take an action as part of the order, that doesn’t necessarily mean your company has to follow suit. There might be valid reasons for you to stay the course, but you shouldn’t come to that conclusion quickly or without careful consideration of the potential risks of each possible course of action.