The Lead Generation Company: Managing the Risk

Jonathan Foxx

President & Managing Director

Generating leads is an important way to reach consumers. It is also fraught with regulatory risk. A lead is consumer information that signals consumer interest or inquiry into products or services offered by a business, such as residential mortgage lenders and originators. There are several factors to be considered, not just licensing. I will list some rudimentary guidelines in this article, specifically with respect to contact with the consumer. Caution is urged to consult with a risk management professional to ensure compliance with federal and state guidelines required by a marketing campaign to generate leads. Although my focus is primarily on the online lead generation process, virtually all the guidelines provided herein may be extrapolated for use in offline lead generation campaigns.

My firm often is requested by clients to vet a lead generator, which I will call a Lead Generation Company. Careful risk management advice should be considered when developing and managing leads, whether obtained from an outsourced entity or a loan originator’s own website, in-house, or through online lead generation advertisements. Certainly, any loan originator that uses leads must have an internal compliance function that accounts for proper licensing of the Lead Generation Company (where required), monitoring of the data integrity derived therefrom, testing conformance with the originator’s policies, and training of staff in the appropriate use of lead generated, consumer data.

Banking departments these days are not just looking at licensing qua licensing. They are looking for loan originator compensation violations that are triggered by lead generation. For instance, they know that loans may have different cost structures depending on how the loans were initially received by the lender. A lead generated by the loan originator may be compensated differently than those generated by the creditor. As long as this doesn’t constitute a proxy for a loan term or condition, it is generally acceptable; that is, the loan officer may also be reimbursed for lead generation and other legitimate business costs, but the creditor must beware of how this may serve as a proxy for terms and conditions. It is up to the lender to make this determination (and properly document it).

Four Rules

In any lead generating marketing, the following four rules should be implemented:

1.  Complete, accessible, and straightforward disclosure of all parties’ intent regarding data collection and usage is essential;

2.  Data should not be brokered or sold without consent (or notice and choice) of all parties involved, including the consumer and the loan originator;

3.  Both the consumer, Lead Generation Company, and the loan originator should be made aware, through clear notices, of all parties involved in data collection and sharing; and,

4.  All parties should be educated and aware of current regulations regarding consumer protection and privacy.

These four rules become the bases of the policies, procedures, contractual arrangements, and protocols that ensure a viable marketing campaign that relies, in whole or in part, on lead generation.

Regulatory Focus

The regulators involved in enforcement of compliance with lead generation rules include, but are not limited to, state banking departments, state Attorneys General, the Federal Trade Commission (“FTC”),[i] and the Consumer Financial Protection Bureau (“Bureau”). We already know that the Bureau examines for whether the lead generator is a third-party provider and reviews the terms and appropriateness of the relationship. The Bureau reviews advertisements and advertising sources. It will review TV, radio, print media, Internet, scripts, recordings, and so forth. It will determine if there was proper consumer disclosure all along the way, from point of contact with the consumer to point of contact with the lender, including any intimation of fees and other terms and conditions. Plus, a review is conducted for online data security and sharing of consumer information.

Although the new loan originator qualification standards do not impose licensing requirements, every lender must ensure that each loan originator in its employ is licensed and registered in compliance with laws related to Secure and Fair Enforcement for Mortgage Licensing Act (SAFE), if applicable. Further, entities engaged in lead generation and marketing activities, as well as the companies that do business with such entities, need to pay particular attention to their activities to ensure that they do not inadvertently engage in loan originator activity. If they do, they’ll need to make sure that they meet the new loan originator qualification standards, including licensing requirements. Failure to meet these standards will give rise to severe civil liability that could impair the collectability of the loan.

The Bureau has stated that anytime a consumer gives out sensitive personal and financial information on the Internet there are risks involved to the consumer. In the context of Pay Day Loans, for instance, the Bureau has already warned consumers that if a consumer applies for a loan online, the consumer could be increasing risk significantly.

The Bureau has expressed concern that an online application or form that consumers fill out could be sold to a loan originator that offers to originate a loan on behalf of the consumer. Indeed, the Bureau also has indicated it has concerns that multiple lenders or other settlement service providers could pay for this information, thereby causing them to contact or email the consumer.

CFPB: Mortgage Originator Violations

Yesterday, I outlined for you the features of the CFPB's requisites of a Compliance Management System (CMS). My observations were based on the CFPB's newsletter, entitled Supervisory Highlights: Fall 2012, an issuance to the public and the financial services industry about its examination program, including the concerns that it finds during the course of its completed work, and the remedies that it has obtained for consumers who have suffered financial or other harm.

There are other important areas covered in the newsletter that I would now like to briefly discuss: 

Violations relating to Credit Reporting, and

Violations by Mortgage Originators

Fair Lending Compliance 

These subjects are very nuanced and complex, involving many aspects of regulatory compliance mandates. Necessarily, my remarks will be limited to the kinds of observations that the CFPB has indicated as principal concerns with respect to these matters.

_____________________________________________________

IN THIS ARTICLE

Violations relating to Credit Reporting

Violations by Mortgage Originators

Fair Lending Compliance

Library

_____________________________________________________

Violations relating to Credit Reporting

The Fair Credit Reporting Act (the FCRA) regulates the collection, use, and dissemination of consumer report information, and promotes the accuracy, fairness, and privacy of information held by the nation’s credit bureaus.

As you many know, the CFPB examines financial institutions for their compliance with the FCRA’s requirements for handling consumers’ credit information. Among other things, the FCRA and its implementing regulation, Regulation V, generally require entities that provide consumer information to credit bureaus to establish and implement reasonable written policies and procedures regarding the accuracy and integrity of the consumer information they furnish to these entities.

A party’s failure to comply with the FCRA may cause significant consumer harm.

According to the CFPB's most recent announcement on its examination findings, its examiners have discovered one or more instances in which a financial institution’s employees did not have sufficient training or familiarity with the requirements of the FCRA to implement it properly.

Such deficiencies resulted in a failure implement the following actions:

- Communicate appropriate and accurate account information to the credit bureaus.

- Indicate when account information had been disputed by consumers.

- Determine whether disputes had been fully investigated.

Findings by the CFPB noted that companies were unaware of the potential and actual violations of the FCRA, and, therefore, they repeatedly failed to respond to communications from consumers about their accounts.

The remedial actions mandated by the CFPB included (1) implementing procedures for properly reporting consumer credit disputes to all credit bureaus, (2) taking action on all disputes reported directly to the financial institution and correcting errors where appropriate, and (3) deleting information regarding customers, as appropriate, upon completion of their credit dispute investigations.

_________________________________

Violations by Mortgage Originators

CFPB examiners have found significant violations of Real Estate Settlement Procedures Act (RESPA) and Truth in Lending Act (TILA).

Violations under RESPA have included failures to make proper and complete disclosures to consumers of costs and other terms of a transaction due to inadequate or improper completion of the Good Faith Estimate and the HUD-1 settlement statement.

Violations under TILA have included failures to provide accurate interest rate disclosures, and payment amounts and schedules, as well as disclosures regarding late payments, security interests, and assumption policies.

One aspect of the CFPB's examination, it should be mentioned, is to review a company's policies and procedures with respect to RESPA and TILA. Those financial institutions that do not maintain an accurate and current set of such policy statements should expect to receive an adverse finding.

Specifically, where financial institutions have violated RESPA and/or TILA, they have been directed to implement appropriate policies, procedures, and monitoring to prevent recurrence of the violations, and to ensure that any third-party vendors, including mortgage brokers, are identified and included in the company’s oversight program. The relevant policies and procedures should provide guidelines to ensure that proper Good Faith Estimate and HUD-1 disclosures are provided to consumers, and that consumers are not improperly charged. In fact, where appropriate, the CFPB has actually directed that consumers receive a corrected HUD-1, and, just as in state banking examinations, where customers are improperly charged, a financial institution will be directed to provide reimbursement to the consumer.

_________________________________

Fair Lending Compliance

Another area of concern is compliance with the Home Mortgage Disclosure Act (HMDA), and its implementing regulation, Regulation C.

In our newsletter yesterday, I discussed deficiencies of fair lending compliance programs and some "common features" of well developed programs. The CFPB utilizes HMDA data in the course of its review of such programs, and it may seek corrective action or relief, as appropriate, in cases that demonstrate fair lending violations.

CFPB: Compliance Management System

On October 31, 2012, the CFPB issued its first issue of Supervisory Highlights: Fall 2012, a newsletter to the public and the financial services industry about its examination program, including the concerns that it finds during the course of its completed work, and the remedies that it has obtained for consumers who have suffered financial or other harm.

It is written as an Executive Summary, and it will not refer to any specific institution. But it will "signal to all institutions the kinds of activities that should be carefully scrutinized for compliance with the law."

According to the CFPB, it has already taken non-public supervisory actions against financial institutions participating in the credit card, credit reporting, and mortgage markets, confirming "remedial relief" to 1.4 million consumers, and causing the affected financial institutions to correct illegal practices. Importantly, and in consequence to the CFPB's examinations and actions, financial institutions were required to adopt effective policies and procedures to ensure that violations do not recur and, especially, mandating that they implement a robust Compliance Management System (CMS). 

The CFPB maintains that an effective CMS is a "critical component of a well-run financial institution."

After a brief discussion about the CMS concept, I should like to outline these three significant findings derived from the CFPB's examinations:

- Comprehensive CMS Deficiencies Found Through CFPB Supervisory Activities

- Deficiencies Related to Failure to Oversee Affiliate and Third-party Service Providers

- Deficient Fair Lending Compliance Programs

___________________________________________________

IN THIS ARTICLE

Compliance Management System

Comprehensive CMS Deficiencies

Failure to Oversee Affiliate and Third-party Service Providers

Deficient Fair Lending Compliance Programs

Library

___________________________________________________

Compliance Management Systems

I consider the term Compliance Management System to be a proxy for the term mortgage risk management. Our firm was founded on the premise that such risk management was the best way to ensure a financial institution's safety and soundness with respect to mortgage banking. At the time, there was only the term "risk management", a catch-all term that was overly broad. So I coined the term "mortgage risk management" to bring mortgage compliance into greater focus, expertise, and application.

Over the years, the prudential regulators and state banking departments have included much guidance in preparedness for their mortgage banking examinations. And now the CFPB has further elaborated the crucial and central importance of managing risk and examination readiness. As recently as July 2012, I published a magazine article about The Rules of Operational Risk, in order to bring into strong relief the practical matters and unique circumstances of mortgage risk management.

The CFPB's conception of a well-conceived CMS is certainly consistent with the foundational features of mortgage risk management.

Both the CFPB and mortgage risk management require effective internal controls and oversight, training, internal monitoring, consumer complaint response, independent testing and audit, third-party service provider oversight, recordkeeping, product development and business acquisition, and marketing practices.

Mortgage risk management and the CMS both expect the development, maintenance, and integration of mortgage compliance practices across a financial institution's framework and applied to its entire loan product and service lifecycle.

As the CFPB states:

"Without such a system, serious and systemic violations of Federal consumer financial law are likely to occur. Further, a financial institution with a deficient CMS may be unable to detect its own violations. As a result, it will be unaware of resulting harm to consumers, and will be unable to adequately address consumer complaints."

__________________________

Comprehensive CMS Deficiencies

The CFPB has issued findings for financial institutions lacking an effective CMS across the entire consumer financial portfolio, or in which the company failed to adopt and follow comprehensive internal policies and procedures. In these instances, the finding held that this condition resulted in "a significant breakdown in compliance and numerous violations of Federal consumer financial law."

The corrective action required an adopting of appropriate policies and procedures, and establishing an effective CMS to ensure legal compliance, which had to include the "enhancement" of financial institutional regulatory knowledge and expertise to help ensure proper monitoring of business activities and prompt identification of potential risks to consumers.

In this regards, educating about and training employees in a company's policies and procedures should be fully implemented and routinely followed. I suggest a schedule of on-going education and training modules, given to both new hires and all active, affected personnel.