ROYAL OAK, Mich.—The CFPB’s focus on unfair, deceptive or abusive acts or practices (UDAAP) among FIs and recent fines on banks for deceptive free checking advertising certainly sends chills up the backs of even the most confident compliance officers.
To avoid the CFPB ominously descending on the credit union—and some terrifying consequences—CUs must understand this Dodd-Frank mandate and reduce UDAAP risks.
Steven Van Beek, attorney at Howard & Howard, shared seven tips for ensuring the credit union does not run afoul of the CFPB standard.
1. Understand UDAAP
The credit union should conduct a comprehensive review of its products and services.
“Importantly, a particular act or practice does not need to be a regulatory violation for it to be considered a UDAAP violation. Thus, credit unions must have a strong risk management program to review, analyze and mitigate potential UDAAP risks.”
2. Draft A UDAAP Policy
A UDAAP policy should be the starting point for all credit unions, said Van Beek.
“A policy outlines the credit union's commitment to refrain from acts or practices that could be considered unfair, deceptive or abusive. The policy should also discuss the steps the credit union will take to review and prevent UDAAP concerns. The policy does not need to go into the details. Rather, your existing procedures will explain the precise steps the credit union is taking. The UDAAP policy highlights those existing practices and reiterates the credit union's commitment to offering products and services to members that are understandable and fair.”
3. Review Marketing Content
Van Beek stressed that a key component in reducing UDAAP risk is clear, understandable marketing language.
“This goes beyond the technical advertising disclosure requirements and extends to the overall message conveyed to members and potential members. Credit unions should set up consistent procedures to review marketing and advertising content to ensure regulatory compliance and review for potential UDAAP concerns. Additionally, credit unions should monitor members' actual usage of the product or service and determine if the usage matches how the product or service was described in the advertisement.”
4. Review the Fine Print
In most UDAAP situations, the financial institution's practice differed from their written disclosure or contract, explained Van Beek. And, in most cases, the marketing of the product or service differed as well.
“Credit unions need to ensure their marketing language matches their disclosures and that both of these are consistent with their actual practices. The easiest way to increase UDAAP risk is to market a product or service in a manner that is inconsistent with the credit union's full disclosures or practices. Credit unions that consistently review their actual contractual terms and existing procedures will be able to easily identify situations where the marketing approach is inconsistent and take actions to align all three aspects—marketing, disclosures and practices.”
5. Monitor Your Vendors
A common theme in UDAAP violations is unmonitored third-party service providers, said Van Beek.
“Your credit union's reputation is on the line every time a member conducts a transaction with you—and your third-party partners. A credit union's vendor management program should include a UDAAP risk assessment and there should be ongoing monitoring of the relationship over time.”
6. Manage Complaints
Member complaints are the number-one way regulators learn of potential UDAAP violations. Therefore, robust member complaint procedures should be a part of the credit union's overall UDAAP policy, stressed Van Beek.
“Complaints, formal and informal, are the perfect place to determine if there is something about the product or service that is not straightforward or clear. And, rather than just address the complaints and fix the errors, credit unions should track the information and monitor the trends over time. Are certain third-party service providers generating more complaints? If so, that is a clear indicator that additional monitoring is required.”
7. Train Staff
When it comes to UDAAP, there are not black and white regulatory requirements. The issues are more subjective and open to interpretation, offered Van Beek.
“This only heightens the need for staff training so that employees are aware of UDAAP risks and are empowered to speak up if they identify an area that needs to be reviewed more thoroughly to ensure the credit union's marketing, disclosures and practices are properly aligned.”