ISSUE BRIEF Unfair, Deceptive or Abusive Acts or Practices …

1 APRIL 2022. ISSUE BRIEF . unfair , Deceptive , or Abusive Acts or Practices (UDAAP). NATIONAL ASSOCIATION OF FEDERALLY-INSURED CREDIT UNIONS | TABLE OF CONTENTS. unfair , Deceptive , or Abusive Acts or Practices (UDAAP). Setting the Stage: The Political Landscape and the Need for Clarity Explaining unfair Acts or Practices I. The act or practice must cause or be likely to cause substantial injury to consumers. II. Consumers must not be reasonably able to avoid the substantial injury. III. Substantial injury must not be outweighed by countervailing benefits to consumers or competition. Explaining Deceptive Acts or Practices I. The act or practice must cause or be likely to cause substantial injury to consumers. II. The consumer's interpretation of the representation is reasonable under the circumstances. III. The misleading representation is material. Explaining Abusive Acts or Practices I. The act or practice materially interferes with the ability of a consumer to understand a term or condition of a consumer financial product or service.

2 II. The act or practice takes unreasonable advantage of . A. The lack of understanding on the part of the consumer of the material risks, costs, or conditions of the product or service. B. The inability of the consumer to protect the interests of the consumer in selecting or using a consumer financial product or service. C. The reasonable reliance by the consumer on a covered person to act in the interests of the consumer. Finding Patterns in Abusive Enforcement Actions NATIONAL ASSOCIATION OF FEDERALLY-INSURED CREDIT UNIONS | | 1. unfair , Deceptive , OR Abusive ACTS OR Practices . (UDAAP). In response to the Great Recession, Congress enacted the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) in 2010. Under the Dodd- Frank Act, it is unlawful for a provider of consumer financial products or services to engage in any unfair , Deceptive , or Abusive acts or Practices (UDAAP). See 12 5531(a); 5536(a)(1). Through the Dodd-Frank Act, Congress granted the Consumer Financial Protection Bureau (CFPB) the ability to define unfair , Deceptive , or Abusive acts or Practices in any transaction with a consumer for a consumer financial product or service.

3 The CFPB was granted broad and unprecedented rulemaking and enforcement authority regarding unfair , Deceptive , and Abusive acts or Practices and prohibits depository institutions and nonbanks from engaging in those Practices . Therefore, all entities that fall under the CFPB's purview, including credit unions, need to closely monitor the Bureau's use of its UDAAP authority. However, credit unions with $10 billion or less in assets will be examined and supervised for compliance with federal consumer financial laws by the National Credit Union Administration (NCUA) or their state regulator. See 12 5516. Although the CFPB does not have direct enforcement or UDAAP authority over credit unions with $10 billion or less in assets, the Bureau will notify and coordinate with the NCUA if it suspects a violation of federal consumer financial laws. See 12 5516 (d). The NCUA has a Federal Consumer Financial Protection Guide available on its website to help credit unions within this threshold comply with most federal consumer protection laws.

4 As such, this ISSUE BRIEF is primarily intended to assist with UDAAP compliance for larger credit unions directly subject to the CFPB's enforcement authority by explaining what makes an act or practice unfair , Deceptive , or Abusive . The Dodd-Frank Act expanded the scope of UDAAP from unfair or Deceptive to unfair , Deceptive , or Abusive . In so doing, it expanded the CFPB's authority to identify acts or Practices as Abusive to consumers even though those acts or Practices may not have met the test of being either unfair or Deceptive in the past. The Bureau has used its UDAAP authority to target hot button issues such as credit card add-on products, credit card advertising, debt collection, credit reporting and monitoring, auto lending, and mortgage servicing. In creating the new consumer protection category, Congress did not provide guidance to the Bureau as to what an Abusive act or practice is. Additionally, Congress did not NATIONAL ASSOCIATION OF FEDERALLY-INSURED CREDIT UNIONS | | 2.

5 Require the CFPB to ISSUE implementing regulations through notice and comment rulemaking. Since the passage of the Dodd-Frank Act, the UDAAP statute has created significant compliance challenges for financial institutions. Moreover, financial institutions paid billions to train employees and develop UDAAP compliance programs. The abusiveness prong of UDAAP has been a particular source of uncertainty since the passage of the Dodd-Frank Act. Because the Dodd-Frank Act was the first federal law to broadly prohibit Abusive acts or Practices , there is little, if any, basis for how to approach and apply the standards. Of particular concern is the absence of a body of jurisprudence addressing the parameters of Abusive conduct and the desired legal response to such enforcement actions. The prevailing uncertainty has created challenges for covered persons in complying with UDAAP and may impede the lawful use of financial products or services that are beneficial to consumers.

6 SETTING THE STAGE: THE POLITICAL LANDSCAPE AND. THE NEED FOR CLARITY. Under President Joe Biden, the CFPB has already started taking a different approach to supervision and regulation. During the Trump administration, critics complained that the CFPB had become toothless, initiating only 77 enforcement actions compared to 235 during former President Obama's first term. Now, under Director Rohit Chopra, the CFPB is poised to increase the rate of its enforcement actions in the interest of consumer protection. Although most banking laws are accompanied with detailed regulations, UDAAP has no implementing regulations. A BRIEF review of the Bureau's historical approach to UDAAP highlights the political divide surrounding this authority. Former CFPB Director Richard Cordray, nominated by President Obama, defined and expanded the Bureau's UDAAP authority through enforcement actions, consent orders, and occasional supervisory guidance. Keeping UDAAP over-broad, flexible, and vague makes compliance a challenge for depository institutions.

7 In 2017, President Trump appointed Mick Mulvaney as Acting Director of the Bureau and, in stark contrast to Cordray, Mulvaney chose not to regulate by enforcement as strictly but rather to scale back its enforcement actions regarding UDAAP. When Director Kathy Kraninger was confirmed in 2018, she chose to focus CFPB's attention on preventative measures to discourage UDAAP among depository and nonbank institutions. In January 2020, then-Director Kraninger announced that the Bureau would clarify the murky abusiveness standard in UDAAP with the release of a Policy Statement. NATIONAL ASSOCIATION OF FEDERALLY-INSURED CREDIT UNIONS | | 3. The 2020 Policy Statement set forth a three-part set of principles stating that the Bureau would: 1. Focus on citing or challenging conduct as Abusive in supervision and enforcement matters only when the harm to consumers outweighs the benefit;. 2. Generally avoiding dual pleading of abusiveness and unfairness or Deceptive violations arising from all or nearly all the same facts; and alleging stand alone.

8 Abusiveness violations that demonstrate clearly the nexus between cited facts and the Bureau's legal analysis; and 3. Seek monetary relief for abusiveness only when there has been a lack of a good-faith effort to comply with the law, except that the Bureau will continue to seek restitution for injured consumers regardless of a good-faith consideration. In March 2021, under former Acting Director Uejio, the Bureau rescinded this Policy Statement, claiming it was inconsistent with the Bureau's duty to enforce Congress's standard and that its rescission will better serve the CFPB's objective to protect consumers from Abusive Practices . Now, credit unions are back to square one with the CFPB intent on returning to the regulation by enforcement approach seen under former Director Richard Cordray. NAFCU has consistently highlighted UDAAP as an area where the CFPB could further clarify its expectations for credit unions and the specific factual basis for violations.

9 Under Director Chopra, certain guidance has been issued that has the potential to massively expand the scope of prohibited acts and Practices . On March 16, 2022, the Bureau published a revised examination procedure guide for UDAAP that indicated the agency is targeting discrimination as an unfair practice in connection with all financial products and services and not just credit products. This is a serious shift in the CFPB's stance on UDAAP that is likely to expand the reach of the Bureau's anti- discrimination enforcement beyond the scope of the Equal Credit Opportunity Act (ECOA). Under ECOA, creditors are prohibited from discriminating against a consumer on the basis of race, color, religion, national origin, sex, marital status, or age. Discrimination does not need to be intentional in order to constitute a violation under ECOA. While the Bureau has yet to explicitly discuss what types of discrimination are covered under the CFPB's new stance, it appears that the Bureau may begin engaging in disparate impact enforcements.

10 Disparate impact occurs when a neutral credit union NATIONAL ASSOCIATION OF FEDERALLY-INSURED CREDIT UNIONS | | 4. policy results in discrimination against members in a protected class or on a prohibited basis that results in fewer services or access to information than other members. Credit unions may wish to begin looking at their policies, Practices , and procedures for non- credit financial products and services to assess their UDAAP risk under this recent guidance. EXPLAINING unfair ACTS OR Practices . According to the CFPB's Supervision and Examination Manual and recent consent orders, an act or practice is unfair when it meets the following three-part test: 1. It causes or is likely to cause substantial injury to consumers;. 2. The injury is not reasonably avoidable by consumers; and 3. The injury is not outweighed by countervailing benefits to consumers or to competition. 12 5531(c)(1)(a)-(b). I. The act or practice must cause or be likely to cause substantial injury to consumers.