Brian Brunkow - All right.

Hey, welcome everybody to Unfair, Deceptive, or Abusive Acts or Practices UDAAP. Trust me, you will know it when you see it and if you work in financial services, you will see it a lot. Probably a good way to think about UDAAP is think about Al Capone, gangster Al Capone. The feds tried to get him on racketeering gambling, extortion, and nothing would stick. So they had to try to find a side door. That side door was tax evasion and they took him down and UDAAP is kind of that side door in the mortgage industry. Trust me, if you work at a shop, there will be UDAAP violations every single day. So we're just trying to manage those limit the number of UDAAP violations and try to get after the ones that are pretty severe. So my name is Brian Brunkow. I'm a Seattle-based California and Washington Attorney. I also have a California and Washington real estate license and a background in mortgage compliance training and compliance itself. I've held positions in the industry everywhere from an admin assistant to a paralegal, to a mid-level compliance officer. I've worked as a mortgage trainer. I've worked as in-house council. I've worked as outside council, and I've also worked as executive level Chief Compliance Officer.

So I've seen the industry in all the shenanigans that happen from a lot of different areas and levels within the compliance world. Timeframe, I've been around the block a few times in the industry yet I worked in mortgage compliance back right after the dot-com crash. I worked in compliance in that '03 to '08 fun bubble time. I mean, the recession that was just brutal watching what happened there. So I saw the good, the bad and the ugly there. And then I've also recently been in the industry during the Obama administration, Trump administration and Biden administration working at mortgage companies and whoever's in the big office really has an impact on how the regulations are handled because they appoint the federal directors for the agencies like the Consumer Financial Protection Bureau. So that has a big impact and it really shifts how the industry is regulated. Also, I've worked at a bunch of different shops. I've worked at mom-and-pop single office shops, big banks, midsize lenders, direct lenders, depository institutions, credit union. So I've seen the industry from a bunch of different positions and timeframes and different size shops. So I have a pretty good idea of what's important to the regulators and what lenders should be doing to protect themselves and that's where we come in as compliance attorneys and compliance officers. Three big takeaways for today, just based on what I've seen in the industry over the years.

First, client selection is critical for attorneys that work for banks and lenders. It's a tough industry. It's highly competitive. It's very complex. You have hard deadlines with the disclosures and the closings and there's gonna be a lot of pressure placed on you to kind of manage things and move things along and we gotta get loans closed. You gotta be aware of that if you're new to the industry. It can be rough. And you've gotta be really clear on the differences between misfeasance some malfeasance. We saw what happened back in the recession in '08 companies were going outta business left and right foreclosures left and right, gotta be accountable as an attorney. Market shifts, any kinda shift it could be shifts with interest rates or it could be shifts in the administration, presidential administration that impacts how the industry is handled and regulated. Anytime you have a big shift that leads to panic, anytime you have panic, that leads to bad decision making. Third UDAAP is going to be the most important regulation that you train on and handle as a compliance attorney with a lender. UDAAP impacts everything. It impacts every department. It impacts every regulation. It impacts every single part of the loan cycle from advertising to servicing closed loans.

So you gotta know UDAAP inside and out, and you gotta make sure that you're training staff at the level they're at so they have a good understanding of what their obligations are. So let's jump into page two, the roadmap, what are we gonna do today? Man, there is nothing more fun than regulatory compliance. I'm sure everybody would agree with me on that. So here's what we're gonna talk about today for UDAAP. We're gonna do an introduction. Look at kind of the history of the industry briefly. Then we will jump into the UDAAP test. We've got unfair, deceptive, or abusive. These are three separate tests and three separate paths to go down to find out if you have a UDAAP violation. You can have something that's unfair. You can have something that's unfair and deceptive. You can have something that's unfair, deceptive, and abusive. Then we'll look at UDAAP impact on the industry. We'll briefly cover the compliance management system, which is sort of the umbrella and the framework for how you protect the company.

We'll briefly cover the importance of consumer complaints. Do not go light on consumer complaints. That's one of the main things that regulators will look at to see if you have UDAAP issues within your company. And then we'll close it up with some best practices for attorneys. I'll jump up on the soapbox and kind of give you some advice on what we should be doing and not doing and what we should be tolerating and not tolerating as a compliance attorney for some of these lenders. And let's talk a little bit about the blame game and why not the '08 recession was just absolutely horrible for everybody. If you saw the big short, that's kind of a good fictional summary of what happened back in the day, and everybody wanted to blame the lenders and yeah, the lenders get a ton of the blame. They put together horrible loan products that were marketed to people who had no business getting the loan.

So the lenders take a lot of the blame, but that would be kind of taken it easy on the industry if we stopped there. It's the lenders putting together bad products, trying to get that profit together, focusing on the bonuses. It was the problem of the consumers. A mortgage fraud was rampant. They were lying about assets and debts to try to get a loan. They shouldn't have been in those loans to begin with. We had problems with investors, not really investigating and the loans that they were purchasing and bundling up. And then we had the regulators kind of sitting on the sidelines, doing their job, but checking those boxes when they came out to do the exams. And that's what led to the bubble and the recession of '08 it's the lenders, it's the consumers, the investors, and the regulators. And it includes compliance as well. Everybody in compliance, we had a part in that. So everybody gets the blame on what happened in '08 and we're trying to make corrections in the industry going forward.

So on page five, little bit of history here. So as a result of the recession, Congress passed the Dodd-Frank Act in 2010 and they created the Consumer Financial Protection Bureau that started in 2011. And they're sort of the big federal shop that handles big shops for rules, supervision, and enforcement. Now not every shop is regulated directly by the CFPB. For example, if you have a credit union with assets, less than $10 billion, that credit union would be regulated by the NCUA or by the state regulator, but fear not the CFPB the NCUA, the state regulators, they all communicate with each other. And if there's a problem and the issue for some reason gets sent to the wrong agency, they will kick it over to the correct agency for corrective action. UDAAP the, what? UDAAP covers and again, this is unfair, deceptive or abusive acts or practices UDAAP covers companies that provide financial products or services, banking, home loans, car loans, credit cards to consumers. So depository institutions, Wells Fargo, direct lenders, and then also credit union. So that's kind of our target for today.

So why do we have UDAAP? What's it supposed to do? Why the fuss? Well, the purpose behind UDAAP is to protect against financial injuries to consumers and to maintain confidence within the industry. Now UDAAP has been around for a long time. The FTCs version of UDAAP is unfair, deceptive acts or practices, and under Dodd-Frank and the CFPB, they added the abusive prong. So now it's unfair, deceptive or abusive acts or practices within the CFPB. But just kind of keep in mind that we're trying to prevent financial injury to consumers and we are trying to protect the confidence within the market so the market works correctly. So on page six, can't stress us enough. These are three standalone tests. And if you have a new rookie within the industry loan processor, something like that, it gets really mushy. You just sort of think as UDAAP as one test.

These are three individual tests. Now under the Trump administration, they tried to pull back a little bit on the enforcement actions under the CFPB. And they wanted to run with the policy that said, we want to avoid dual pleading, which meant if you have a single set of facts and that set of facts is both unfair or deceptive and abusive, we're gonna avoid that dual pleading. We only wanna run with one of these factors here. It could be unfair or deceptive or abusive, but we're not gonna plea out all three of those when we have a single set of facts that meet all three of those tests. So when Biden came in and the new CFPB director was put in place, they put out a policy that rescinded that they said, we're not doing dual pleading. We're not gonna worry about that. Each of these tests is a stand alone test. So unfair, deceptive, abusive those are three stand alone tests, and you gotta keep that in mind, don't allow staff to get mushy with the UDAAP and how it's handled. Enforcement actions. We're not gonna get political here, but just kind of keep in mind, whoever's in the big house kind of impacts how the industry is regulated through the CFPB, because again, the president will appoint the director of agencies like the CFPB.

So under Obama, his first four years, he had 235 enforcement actions under the CFPB versus Trump who had 77. So pros and cons on both sides. We want the industry to work well but we want it to be regulated. I have no clue what the answer is, but this is just an example of the difference between how active the CFPB is in relation to who's in the office. And then also as we do the introduction here, again, that UDAAP impacts everything, it's everything from new product development, advertising to loan servicing. So it's gonna impact every part of the loan cycle and every regulation. So you gotta bake this in to your training with onboarding your regular training complaints. Everything that you're putting together is gonna have some component of UDAAP attached to it. All right, so let's jump into the fun stuff. Here on page eight, we've got the unfair test, and these are the three elements that you have to go through to determine if an act or practice, think of practices as a pattern, if it's gonna be considered unfair to the consumer. So an unfair actor practice causes or is likely to cause substantial injury. The injury is not reasonably avoidable by the consumer, and then you do the balance test. The injury is not outweighed by the benefits. So on page nine, this is kind of what we have to look at when we're thinking of how the agency interpret the unfair test. So with substantial injury, yeah, it's gonna be financial harm, time and money of the consumer. Wouldn't normally be emotional harm, but it can be emotional harm, can be a substantial injury such as when you have excessively aggressive debt collection efforts that can lead to emotional harm and that can rise to the level of substantial injury under the unfair test. Could be a very small amount of harm committed against a large number of customers that would rise to the level of substantial injury.

You think about some of those class action sues like companies overcharging consumers 5 cents per month, not a whole lot of money, but 5 cents across 20 million customers every month that adds up. And then this one's always kind of fun if you're in compliance, actual injury is not required if the act creates a significant risk of injury that can rise to the level of substantial injury. Avoiding the injury, is the company doing something that interferes with the decision-making of the consumer? That would be something that's gonna look at with how possible, how reasonable is it that this consumer could avoid the injury? An example would be if a company is providing information that is inaccurate, or if a company modifies terms and conditions after the agreement gets signed. There's no way for the customer to avoid that injury.

So that's the kind of stuff that they're gonna look at to see could a reasonable consumer take reasonable action to avoid this injury. And then benefits, you gotta do a cost benefit analysis. Think about it this way when it comes to the balance test, you can catch a Southwest flight from Los Angeles to Las Vegas for $99. Pretty good deal, sweet deal. However, what happens if the regulators say airlines, you have to guarantee a 100% safety record, right? You gotta do that balance test. What does that do to the price of the airline ticket from LA to Las Vegas? It's just not manageable. So you gotta do a balance test. So we're gonna look at each one of those prongs to make sure that each one of those is met when we come up with an issue and it could rise to the level of being unfair to consumers. So pretty famous case.

This goes back to the FTC. So predate a CFPB, which came into being in 2011, but the CFPB and the FTC, all these agencies kind of work together so they will cite each other here and there. So the allegations and I stress that these are allegations not proven because I don't wanna get sued, but also a lot of times the company settle with the agencies and fork over a bunch of money and life moves on. So allegations. Lender refused to release a lien on a property after the consumers had paid the debt in full. So why wouldn't they release a lien? Who knows, but they were lazy or just didn't do it. Didn't wanna do it, didn't get around to it. It could be negligence, could be something more intentional, but they didn't release the liens after the loan had been paid off. So not good for the consumers. Was there an injury, yes. Time and money to get that done, got a bunch of consumers calling on their lunch hour to find out why the lien has not been released when they're trying to refire or sell time and money to the consumers and no reason for that. Could the consumers avoid that? No, because consumers choose who is going to originate their loan. However, the consumers don't have any control over who services that loan. A lot of times lenders, they will fund a loan and then they will send the servicing rights to a different company 'cause they don't wanna deal with it. So consumers can't really control that it's not reasonably avoidable 'cause consumers can't control who is servicing that loan. And then the benefits, obviously there's no offset there. There's no reason for the regulators to say, well, we're not gonna worry about this. It's not a big deal. Allowing these lenders to refuse to release a loan. It's good for the industry overall. There is no benefit there. So that one's kind of the slam dunk.

All right, so that is unfair. Let's look at the deceptive test. Deceptive act or practices, the CFPB sites back to the FTC Act Section V for the definition of deceptive. And again, the FTCs version of UDAAP is unfair, deceptive acts or practices. Then under the CFPB, they added the abuse prongs so it's unfair, deceptive or abusive act or practices. Again, it gets complicated when you see all these agencies and rules, it is just something to keep in mind. So with the CFPB, a deceptive act or practice, this is a rep omission act or practice that misleads or is likely to mislead. Again, that's always that tough one likely to mislead. And then you gotta go through the reasonable consumer test. How do they interpret it? And then we look at whether that rep is material to the transaction. So this is kind of how it works on page 13, kinda gives you an idea of what the agencies are looking for. Is it likely to mislead? Intent is not required. That's always kind of fun.

So when you think of deception, we're thinking of malfeasance, we are thinking of knowing conduct, but under the UDAAP test, you don't require intent. That's not the men's array that's required. All they're asking for is, was there a big mistake and did that deceive the consumer? They were confused about what was going on so the lender's not trying to confuse the consumer, but they made a mistake and that mistake resulted in the consumer not really knowing what's going on, that can rise to the level of being misleading. So the information also can be accurate, but it might be too complex for the reasonable consumer to understand that would be misleading. So it's such a hard regulation to work with 'cause you've got all these very subjective fact intensive inquiries to go down and that's what makes it really tough to deal with and why you have to really hammer it home on a daily basis if you go to work for a lender. And again, the misleading statements, they can be expressed, they can be implied, they can be written, they can be oral. You have a loan officer that has a phone call with the customer and they forget what they were talking about. And then they do something different in writing down the road. That of course would be misleading.

The reasonable consumer test, who is the intended consumer? You gotta look at it from their point of view. Easy enough if you have a statement, a comment, a contract clause, and there is at least a significant minority of consumers that could be misled by that contract clause, that would be enough to meet that test of the reasonable consumer being misled or being likely to be misled. And then it's gotta be material. The rep omission act or practice has to be material to the transaction. What does that mean? It impacts the consumer's choice. They're looking at different shops to get a loan. And they're looking at the cost, the benefits, the restrictions availability. If you say something that's false or just wrong or it's accurate and it's too complex and it impacts their choice, then it would be material. And then also, information that's just important to a consumer. It may not be typically material, but if a consumer says something like, and this is an example I use with staff, if a consumer lets a lender know that they are very interested in only doing business with companies that are local, it's gotta be based outta Seattle. I only do business us with companies based out of Seattle. So the loan officer at the branch says, oh yeah, we're based outta Seattle. Sure, we gotcha. But it turns out that lender has a branch in Seattle, but it's actually headquartered down in San Diego, that's misleading. It's not really material to the transaction. They gotta branch up in Seattle. They're licensed, but the consumer made it known they wanna do business with a company base out of Seattle. So that would be a material misrepresentation.

Page 14, a seminal case FTC versus chase financial allegations, mortgage broker misrepresented, an option arm as fixed. The minimum payments that were allowed under this option arm would result in not all the due interest being paid per month, which would lead to negative amortization. That interest that not paid gets tacked onto the principal and it builds up the loan again and the again over month over month and the advertisement said, think about this as a first time home buyer. Kate is 22 years old, she inherits 50,000 bucks. She wants to get a house and she reads this advertisement is 3% fixed payment, 30-year loan. The reasonable consumers are gonna look at that and say, yes, it's 3.5% fixed for 30 years, nothing's gonna change. And that was misleading because this company, the advertisement compared a true and an actual 30-year fixed loan to the arm loan they were advertising and they advertised their arm loan with the initial interest payment for that first year.

So of course, if it's an adjustable loan, you're gonna have a very low interest on the front end for that first year, first three years. But over time it may go up and that is something that has to be taken into consideration. So when you advertise a true 30-year fixed loan against an arm alone, which is a separate product that has lower initial payments, that is misleading. So the reasonable consumer, of course, when you see the phrase 3.5 fixed 30 years, a reasonable consumer is gonna say it's fixed for 30 years slam dunk. And was a material yes, we had consumers who relied on the reps to refinance out of a fixed loan to the advertise arm loan thinking it was gonna save them some money, but it was actually gonna cost them more over time because the advertisement was false because it presented it as a fixed loan. Not good. So some other examples on page 15 from the CFPB on what is deceptive, it's kind of the classic bread and butter deceptive examples, misleading cost or price, offering products and services not available bait and switch, omitting material information, and failing to provide the promised services.

Keep in mind, puffery is not deception if you saw Will Ferrell and "Elf" the Christmas movie and he goes to the diner and the diner on the front, it says world's best coffee. That is puffery. No reasonable person thinks it's gonna be the world's best coffee and sort of the dividing line between puffery and deception. If you make a claim and that claim is testable, that can be found as deceptive. For example, if a lender says we close every loan in 10 days, it doesn't matter if it's purchase, refi, veterans, FHA, conventional, we close every loan in 10 days, that is testable. So that cannot be considered puffy. World's best coffee, puffery. We close every single loan guaranteed within 10 days, that is not puffery. And so we've covered unfair, we have covered deceptive and now we'll go down to the third test on page 17 and it is the abusive test. And again, this was added in the Dodd-Frank Act and with the CFPB. So we added the abuse of prong to the UDAAP test. It's now unfair deceptive abuse act or practices within the CFPB. So what does that mean? It's a new toy. It was added 2011 and there's not a lot of history to it. When Congress passed this, they didn't offer a whole lot of guidance. They said, here you go. Here's your new toy, it's now unfair, deceptive or abusive actual practices have at it.

So the problem is right now, we're only 10, 11, 12, 13, 14, 15 years into it. So there's not a lot of history on how to use the abusive test, the scope, what is abusive? And how strictly should it be enforced by the regulators. It's only been 12, 13 years. So it's still kind of shaken itself out. The abuse of act or practices. Here's the test on page 18 and it is a mouthful. Again, keep in mind with new staff, if their mortgage industry rookies, this can be really tough. So you gotta use a lot of stories and examples and consent orders and cases to kinda get the point across on how all these tests work together and what the differences are between these tests. So with abusive, it could be something that materially... It could be an act or practice that materially interferes with the consumer's understanding of the terms or conditions or act or practice that takes unreasonable advantage of a consumer's lack of understanding of the risk costs and conditions or the inability of the consumer to protect their interests or the consumer's reliance on the lender for protection.

So I kind of think of abusive as being almost deceptive plus. It's deceptive plus doing something just vicious to the consumer. That's sort of how I think about it when we're looking at that difference between deceptive and abusive. You're really dialing in on some of the characteristics of the consumer, like their elderly or military, and you're taking advantage of that. So it kind of rises above deceptive and it becomes abuse. Now it's not a perfect explanation, but you're just trying to drive home that there are differences between these tests when it comes to unfair, deceptive, and abusive.

Here's the case on page 19, the CFPB versus pension funding. And this one goes to the material interference that's that first prong under abusive. So the allegations, again, allegations are not proven. So the allegations were that the credit are marketed alone as a pension advance. They called a loan something different, a loan as a loan, but they called it a pension advance. The average consumer is busy. They don't know what that is. They don't know the difference. And so what the CFPB said is that this company obscured the product and that calling alone a pension advanced materially interfered with the consumer's ability to understand the loan terms. Called a loan a loan, call a pension advance a pension advance, but you gotta make sure that you are not materially obscuring what the actual product is before the consumer signs the documents. Second case, CFPB versus D & D Marketing. This goes to the lack of understanding prong, allegations, that the company falsely claimed sort of a middle man between consumers and lenders matching them up a matchmaker. So the claims that the company falsely claimed it would match consumers with best grade lenders. And what they actually did is this company steered consumers to higher rate lenders. So they mischaracterize whose side of the table they're really on. And they sort of took advantage of consumer's lack of understanding of the relationship between the consumer, the lenders, and D & D Marketing. So that goes to the lack of understanding of the consumer slam dunk case.

 So this one, oh man, this one bugs me. It's the CFPB versus ITT Educational Services. I mean, student loans are absolutely absurd and they just keep going up. So here in this when we have allegations of a, it's a for profit college and they offered kids a no interest gap loan that had be repaid by year end. So if you're a student at the school and you get this no interest gap loan, and you can't repay it by the end of the year, you gotta do something. And so what this educational institution did they're kind of presenting themselves as being on the students side and looking out for the students best interest that goes to reasonable reliance. So they funded the gap loan. Then at the end of the year, when the students hadn't paid it off, they steered the students into high risk private loans that ITT Educational Services controlled. So the students who were busy uninformed doing the best they can don't really understand how this is working for them. They get the new interest gap loan. Can't repay it all, get steered into a private loan that's controlled by that company. That is an example of students showing a reasonable reliance on that college to protect their interests. And so those are the three tests for UDAAP. Three independent tests, we talked about unfair. we talked about deceptive, talked about abusive. So if you go to work for a big bank credit union, a direct lender, you're gonna be dealing with UDAAP all day long. So get yourself a cup of coffee and have at it.

So let's talk about UDAAP impact a little bit on page 23. Can't stress this enough, UDAAP is gonna show up all the time with the other regulations. UDAAP literally impacts every other regulation in the industry, pretty much. So the say fact, this is licensing. If you are a loan originator, you need to have a license or be registered to get this done. If you have a non-licensed loan processor, just doing admin work, and that loan processor is telling consumers that he or she can do the work of a licensed loan originator, like taking a loan application, negotiating loan terms, that would be a non-licensed person promoting themselves as being able to handle license work that would be a safe act violation and that would be by definition, deceptive, 'cause they are not licensed. So you have a licensing violation and then you automatically have UDAAP violation.

How about all the staff that is working remote at this point? I mean, that's just such a red flag and danger point for where the industry is. Working remote, get a little casual and not really taking care of the documents. You might have physical documents going into the garbage can. You might have staff using personal devices. They're not on encrypting emails, getting sloppy with things, leaving documents out when guests are coming over, that would be a privacy, a data protection violation because chances are the company really promotes how it takes consumers privacy and data protection seriously, they're promoting that as a selling point as a material and if you have remote staff who are being very sloppy with documents, putting confidential information in the trash, that would be a privacy and data protection violation, which by definition would be deceptive and unfair to the consumers.

Fair lending violations. If you have a company that is the doing things that violate fair lending, that would be by definition unfair to protected classes. So you'd have a fair lending violation and a UDAAP violation and on and on it goes, you get the point, whatever regulations you're talking about, there's going to be a UDAAP component to it. So you gotta be training on this stuff all the time with staff. All right, let's jump into the lending cycle. Page 24 UDAAP impacts every regulation and it impacts the entire lending cycle. So new product development, marketing developing or investing in new software to spit out those disclosures and calculations. Anything you're doing, anything you're doing is gonna involve UDAAP. Advertising and marketing, UDAAP, staff training, onboarding, annual remediation training, UDDAP. And it's gonna impact every level of the company from the entry level employee to managers, senior execs and BoD, UDAAP will impact them. And again, loan application through processing, underwriting, closing, funding and servicing there's UDAAP components at every cycle. So you gotta be working with staff and you gotta be working with these regulations like UDAAP and tailor it to the specific department to the employees level within the company and also their experience level.

Okay, next page 25. This is kind of what I call my 3D program, just from working in the industry for so long. Regulators have a busy day. They can't be out at every company. They're not standing outside the door waiting for you to screw up. They're busy. They only show up once a year or so. And they can't be everywhere. They can where everything. This is what agencies are really focused on and what you have to drive home it's gonna be kind of that difference between misfeasance and malfeasants. And you wanna focus on what I call the 3D program. This is really where the agencies are gonna focus their time and effort. Mistakes, yeah, we'll get those fixed. You might get dinged for those a little slap on the wrist, but if there's systemic issues with discrimination, if there's any kind of deception going on UDAAP or anything involving data security and privacy with the consumers, the agencies will hammer you on this. So the 3D program, these are the three that you gotta drive home with the companies is discrimination, deception, and data security. If you get these three right within your legal and compliance department, you are ahead of the game and I can't give you too many specific examples, but trust me, these are the three that agencies are gonna be looking at with your lender. And so that's really the impact of UDAAP.

It's gonna show up in every regulation, every department, every part of the loan cycle. Bake it in, bake it in some more and have fun with it. Try to make a game of it in some way, 'cause it can be a little bit dry when you're having these conversations with staff. What I try to do is I'll bring in examples from outside the industry, maybe in sports and entertainment and try to draw parallels to it because you can only talk about the regulation of statute so many times before they tune out. So just try to find fun, creative ways to talk about UDAAP and the more slapstick the example, the better 'cause it'll be sticky and they'll be able to use that as they go along. So we're up on page 27. We're gonna talk about the compliance management system, the CMS, and those are the bones. That's the framework for how the legal and compliance department protects the company. So that has to do with setting up testing and monitoring and auditing and hiring and firing and training and complaint management, all that kind of fun stuff.

So the CMS is comprised of two main parts. It's gonna be the board of director and management oversight of the company, kind of the big high level decisions. And then also the more granular compliance program. So you've got the high level and then you've got the daily stuff to keep track of. Within the compliance program, you've gotta have a comprehensive and meaningful policy and procedure program, staff training, monitoring and auditing of staff and loan files and then also consumer complaints. When it comes to policies and procedures, if you are working at a mom-and-pop shop, they have one office and they're only licensed in one state and you show up with a boiler plate UDAAP policy and procedure that's written for a big box shop like Wells Fargo or Chase Bank. When the agency comes out for an exam and they see this BS policy and procedure, they will not be happy about it. Probably the only thing worse than having no policy and procedure 'cause you forgot about it is having a BS policy procedure 'cause you're basically slapping the agency in the face and the consumers and saying, we don't really care about this stuff, we're just checking boxes.

So it's gotta be a policy and procedure that's tailored to your company, the size and the complexity of the market that you deal with training. Training, make sure the training is appropriate to the staff. That means what level are they within the company? You don't have to train UDAAP to the CEO the same way you would to a brand new rookie loan processor. Those are two different training programs on UDAAP because they have different job functions. Monitoring and audits gotta make sure you have fairly routine monitoring, audits will be a little bit more formal. No companies do it the same way. Find the way that works best for your company and consumer complaints agencies are all over consumer complaints because you have a company. They're on social media, they're on the website and they're talking about how great they are. They've got this mission statement and man, it is polished and they must be the best in the industry. Nothing can go wrong. Great agency shows up. They dig into the consumer complaints and you have 57 complaints alleging the same UDAAP issue. Things look differently at that point, when they see that trend, they will dive into camping out at the office to start their examination or their investigation, which will not be fun.

So pay attention to this stuff, the compliance program policies and procedures, training, monitoring, consumer complaints. You gotta have all four under the compliance program, which is a requirement under the CMS. Statement from the CFPB on consumer complaints and UDAAP and how they are tied together. The CFPB said complaints are an essential source of information for examinations and enforcement actions and complaints can indicate weaknesses in the compliance management system, such as training internal controls or monitoring. So again, surface level stuff is not gonna get it done when we have complaints and investigations and examinations that come up and there will always be a pear portrayal so you gotta get out in front of the staff. And also with complaints, you gotta have a system that sets up your ability to receive and respond to complaints submitted to your company, any affiliates of your company, and then also third party vendor. So if you're not doing the servicing you're hiring a different company to take care of the servicing, you would have systems in place to track any complaints submitted to the vendor about the vendor or about your company.

So if a complaint goes with the vendor, you gotta make sure that you receive a copy of that so you can handle it and look for those. Otherwise, if you don't do that, if you're outsourcing everything and you're not tracking those complaints with vendors, agencies are not gonna be too thrilled with that. You gotta be on top of vendor management. All right, examinations on page 29, this is what the regulators are gonna look at. Whether you are directly regulated by the CFPB or the state agencies, this is kind of what they're gonna be dealing with when they come out to look over your processes documents. They wanna see how you train and who shows up for training. Policies and procedures. Do they make sense for your company? Is the BoD involved? And do you have a comp plan composition plan that incentivizes as bad behavior, they will hammer you. That's one of the areas where they really hammer companies when they have a compensation plan that incentivizes bad behavior, they will come after you for that kind of stuff. And there was a big, probably about a five or six-year stretch where that was really the main focus from the agencies. Head on the sand, they will look closely at how management and the BoD handles the company.

Back in the day, it used to be just management and BoD saying, oh, we had no way to know about this. No clue, not in our wheelhouse. Don't know about that. Can't do that anymore. Management and the BoD has to be tied in with the legal and compliance department. There's gotta be a mechanism to have regular channels of communication between the legal and compliance department, any committees and senior management and the BoD they gotta be working together. The BoD and the senior management doesn't have to know every single daily detail that's going on, but the trends, the complaints, the main issues you gotta get that kicked up to senior management so changes can be made. And then also transactions. When they come out to examine the company, they will look at your marketing, your federal and state disclosures, your vendor contracts, and how you manage your vendors. And if necessary, agencies can do consumer interviews to try to find out what their experience was like with your company. Again, these are licensed industry. If you're a mortgage lender, you're licensed, that's a privilege.

An agency can come out, suspend you, take your license away. They can kick out employees from the company if a company has a problem employee, but they make a bunch of money for the company. The agency can come out and kick that employee out of the industry for doing bad acts. So that's kind of the deal with an industry like mortgage lending. So to kind of summarize this section, you go to work for a mortgage lender. You are gonna be required to have a compliance management system that involves high level oversight by the BoD and senior management and the mortgage granular day-to-day functions of compliance department. And that means policies and procedures that make for the company. You have a training program, you do monitoring and auditing, and then you also have a responsible way to receive, respond to, and track consumer complaints because consumer complaints show you the negative trends within the company and agencies will pay attention to that. So that's what we gotta worry about or take care of with the complaints and the CMS.

So let's jump into the next section. It's going to be best practices. We're up on page 30 for this one. Let's get going on some just kinda some overall best practices to kind of keep in mind. Maybe you're new to the industry as an attorney or as a compliance officer, or if you are possibly going to a shop that has maybe some shady dealings in the past, and they wanna kind of get things turned around. These are things that you want to kind of keep in mind as in-house council.

First, let's do a rundown of where we are in 2021, 2022. So the CFPB came into being in 2011 as part of the Dodd-Frank Act as response to the great recession of 2008. So on the 10th anniversary, the CFPB sent a birthday card to itself, a self congratulatory birthday card, which is always good. You gotta have some confidence to do that, I guess. So what they said in this press release was in the wake of the financial crisis of 2007, 2008, it became clear that the country needed a regulator solely focused on looking out for consumers. The housing financial bubble and great recession were fueled by the reckless practices of the mortgage industry, not the negligent practices, but the reckless practices. Words are important. This conduct trapped millions of homeowners and mortgages they could not afford and Congress created the CFPB to ensure that it does not happen again. CFPB officially opened to stores as an independent agency in 2011, with a simple message to American families and consumers, we've got your back. So the CFPB does not wanna see a repeat of that devastating period of 2007 and 2008, where bunch of lenders went out of business. You had a bunch of people losing their jobs, a bunch of foreclosures. It was an absolute mess, and they don't wanna go back to that. So they will be ruling by enforcement and they've done that for the past 11, 12 years. They are ruling by enforcement to make sure that we don't go back to those battle days. Page 32, we're gonna look at what the CFPB has accomplished as of its 10th anniversary. Again, happy birthday to the CFPB.

So these were some of their enforcement actions and what they've been able to claw back in the past 10 years. $14 billion in consumer relief over 10 years, 1.7 billion in civil penalties. They've helped 183 million consumers and 3 million consumer complaints over 10 years. So over 10 years, 14 billion bucks back to consumers, and they've worked on 3 million consumer complaints. So that kind of tells you how active the CFPB is and how much of a role they're taking to protect consumers as they go out and get these home loans and credit cards and that kind of stuff, because you only get how many houses does a person get over their life? Average consumer, they might get three to five home loans over their lifetime. It's an incredibly complicated experience. You've got these days, maybe a thousand pages of loan documents between the bank statements and the credit cards and that disclosures. It's a massive amount of material that you can't reasonably expect consumers to understand completely. So the CFPB is there to kind of guide them along and protect them along the way.

And let's take one or look at UDAAP. And the reason we wanna do this on page 33 is to really drive home that point that these are in fact three separate tests and under the Biden administration and the director that was appointed, they made it clear that we gotta treat these as three different tests. So with new staff, they're confused about all this stuff. We wanna really explain how these work and where the dividing line is. So under the unfair test on page 33, think of that as a mortgage lender. And they just for whatever they screw up and they forget to say end out the mortgage bill on time, there's a computer malfunction and the software's not working, there's a glitch. So the bill gets sent out late resulting in the consumer getting the bill too late to pay it on time. And the consumer's assessed a late fee could be a home loan, car loan, credit card bill, whatever it is, there's a computer go glitch. The bill gets sent out late, resulting in a late payment and a late fee being assessed to the consumer. Is that fair? Not fair at all, because it was the bank's fault with the computer glitch and the consumer had no way to protect him or herself. So that would be unfair. It's not deceptive, it's not abusive. It's just simply a computer malfunction resulting in an unfair fee to the consumer. So that's kind of what we wanna drive home with staff. So we have this substantial injury. It's a late fee, it's unavoidable consumer can't do anything about the computer glitch and the balance test slam dunk. There's no reason for the regulators to let the industry get away with something like that, 'cause it has no benefit going back to the consumer. And again, that balance test, we're always kind of thinking about that Southwest flight from LA to Vegas cost 99 bucks. Well, if the airlines had to guarantee a 100% safety, that ticket would go up to 9 million bucks maybe. So that's the unfair test. Bill goes out late, payment gets sent in late, nothing the consumer can do about it. Not deceptive, not abusive, it's just simply unfair. So the deceptive test think of that as a classic bait and switch, we all kind of know what deceptive is. It's the free checking account with no strings attached. You see that advertisement online, you get signed up. What do you know you find out that you have to keep a certain minimum balance. And there has to be a certain level of activity during the month to ensure the free checking, consumer knows nothing about it because it said no strings attached. There's no disclosures, unclear.

So the consumer ends up getting switched from the free account to a paid account. That would be deceptive. That is a bait and switch. It's misleading. When you go to the consumer's point of view, there is no description of how that free checking is gonna work. So yeah, that's misleading to them. And is it material? Yeah, you're offering them a free checking account. So that impacts their decision making. So we've got the unfair test, which is the late fee due to do a computer. We've got the deceptive test, which is the classic bait and switch. Lastly, we have the abusive test. Think of this one again. It's not perfect, but I just sort of think of it as deception plus. It is deception on steroids. And the way that the agencies are kind of gearing this one up is abusive is when a lender is targeting a protected class. So a bait and switch under deception, a bait and switch applies to all consumers across the board, but abusive might be targeting a specific class like the elderly with misreps on a reverse mortgage or maybe it's a VA loan and you're targeting military personnel with untrue, oppressive, aggressive information that would be abusive. So deceptive, you're doing something shady across the board. Abusive, you are targeting a protected class with a bad program and that would be deceptive, kind of predatory and oppressive. And it's going after a specific target like the elderly, like the military, like minorities. And again, that test is material interference or takes unreasonable advantage of their lack of understanding on the terms of the loan or the inability of the consumer to protect themselves or reasonable reliance on the consumer of the lender to protect their interests. So that's kind of the dividing line for how to view unfair, deceptive or abusive.

Again, it's not perfect. And these will shift over time. It's not like these are set in stone. It's very fact intensive. So you gotta keep up to date on the consent orders are coming out from the agencies. So you kind of know how the agencies are interpreting these tests, but again, these are three separate tests, unfair, deceptive, and abusive. Gotta make sure the staff knows each of these and they don't just throw it into a mosh pit and treat it as one single test. All right, so where are we at here? We are on page 34, some final tips here from the soapbox. Let's go through a few of these. Again, this is just from what I've seen from working at a bunch of different shops in a bunch of different industries or a bunch of different shops from credit unions and direct lenders and big box shops, across a pretty good range of time from the pre-create recession up until now and then at a bunch of different positions from admin assistant up to executive level Chief Compliance Officer. So these are the things that I would pay attention to if you're a new mortgage compliance attorney, or if you're gonna be a Chief Compliance Officer down the road. All right, and here we go.

Some final tips. From the compliance soapbox, you gotta make sure that you make a really strong effort to review the new enforcement actions, consent orders and supervisory guidance that comes out from the CFPB provided links to their website. You just go there and they have separate pages for supervisory guidance and they update it. There's stuff coming out almost on a daily basis regarding fair lending and UDAAP and data protection. And you wanna keep track of that. So you know how the agencies are interpreting this stuff and what they find important and they will, they're not playing the show game. They will tell the graph what's important to them, each year they'll say these are the things we're focusing on. Get your act together when we come out to check out what you're doing.

UDAAP, it is so subjective and it's so difficult to defend and it's gonna happen on a daily basis. There's no way around it. There's gonna be minor UDAAP violation every day in every single company. What we're trying to do is educate staff so they know what UDAAP is. They know how important it is, how prevalent it is. And we wanna kind of limit it as much as possible, but we wanna manage it. Manage the minor UDAAP violations and try to avoid these severe UDAAP violations. The big fair lending issues that's about as serious as it gets. And when you have that fair lending violation, it is a big UDAAP violation. So that's kinda what we're trying to do, manage the small stuff, and then prevent the big stuff. Work in remote with COVID and kind of that shift of everybody working offsite and at home data security encryption, using personal devices. This is more important than ever. And it's harder to control because you don't have staff in the office where you can do desk checks to see if they're leaving confidential documents on the table or the fax machine. They're at home. And you are trusting them to ensure that they're taking care of this stuff and if they're not, it's going to be a big problem 'cause you go back to those big three. It's the discrimination, it's the deception and the data security. If you're being sloppy with data and a consumer gets caught up in identity theft, I read that in the article, it can take up to somewhere between six months and up to 200 hours from A to Z to fix identity theft. So that's a problem that the company unnecessarily put onto the consumer. Consumers gotta go handle that identity theft and the hacking on their own. They will probably have a problem with your company and will be contacting agencies if that was due to your negligence. And again, there's gonna be a paper trail and everything that happens. So you gotta be very aware of this stuff on the front end to try to educate staff and try to regulate it the best you can.

UDAAP impacts every regulation. Every department gotta keep hammering that home. You gotta make sure you have training and consequences for bad acts by staff. It's not enough to just train staff, check the box, have them sign in and off you go. If you have staff that are continuously violating UDAAP or any of the other regulations, you need to have consequences. You wanna have kind of a sort of a step by step sequence of events that is going to happen when they mess up and you probably wanna be consistent with it to protect the company. If you're inconsistent with it, it can lead to fair employment claims. You gotta be careful with that. So just be consistent. If you have an all star employee, he or she is making the company a ton of cash, but they never go order training. They use their own personal devices. They're handling all their business on Facebook pages and things that are outside your control. And you know about it. You gotta get that stuff sorted out because if you're treating that all star employee differently because they're bringing in a ton of cash, but they don't know what the hell they're doing with the compliance regulations, that is gonna be a problem because sooner or later it's gonna come back on the company. It might be the employee itself. Something happens where they submit a whistleblower complaint on something else. And this comes out. It could be a competitor. It could be a former employee who contacts an agency. There's all kinds of sideway side doors for this stuff to come out so you gotta be really careful.

Perfection versus effort. The agencies don't expect perfection. It's an impossible industry to be perfect and what they do want is effort. What they do wanna see is that you have systems in place to cover this stuff. Those systems have to make sense for your company. It's not a mom-and-pop shop with the Wells Fargo policy and procedure. That makes no sense. They wanna have systems. It's gotta make sense and you actually do follow those systems. That's what they're looking for. They wanna wanna get rid of the knuckleheads, the bad actor companies get rid of the bad apples but they don't expect profession, they want effort. Big difference when issues come up between misfeasance and malfeasants, you wanna try to make sure you have the correct staff, the correct systems ready to go, that are gonna protect the company. If you don't have anything set up for training and policies and procedures and staff is just off doing their own thing, that's going to look more and more. It's gonna shade more and more towards malfeasance 'cause you were taking shortcuts on staffing and training because training and policies and procedures are not exactly a great income producer. So you gotta be aware of that and that agencies will. Be aware of that too. And then side swiping can't stress this enough, when problems come up, it's usually gonna be from a side door, it's gonna be a competitor turning into your company. It's gonna be a former employee. It's gonna be a whistleblower complaint. That's how this stuff gets to see the I day 'cause agencies, you can't be everywhere every day. So you gotta be aware of that.

So really hope this helps out. UDAAP again, it is really the most important regulation that you're gonna deal with in the industry. You gotta know it. You gotta have plans to deal with it. And if you have any questions, comments, follow up, feel free to reach out to me. My contact information is on the next page. Hope everybody has a great 2022. And if you're new to mortgage lending, welcome to the industry, it's a great industry to be in 'cause we make such a difference for these consumers to go out there and buy the biggest investment of their life with that comes a lot of responsibility and it's up to who meet that obligation. All right, thanks again take care.