After the cataclysmic financial meltdown of 2008, Congress reacted with the Dodd-Frank Act to correct market misbehavior, stabilize the economy and shield consumers from exploitation by financial institutions. Out of this far-reaching legislation emerged a new, independent consumer protection agency with the potential to transform the relationship between financial institutions and consumers. The Consumer Financial Protection Bureau (CFPB), America’s first federal agency focused solely on consumer financial protection, is spearheading a fundamental culture shift in financial compliance and operation. With its single director and insulation from executive and legislative control, the CFPB is vested with broad and sweeping power to control, supervise and enforce promulgated rules for consumer financial providers. One of the CFPB’s primary goals, and the source of most controversy and risk for covered persons, is the prevention of “unfair, deceptive or abusive [consumer financial] acts or practices.” Armed with powerful regulatory and enforcement abilities and an arsenal of loosely-defined statutory terms, the CFPB is leading a crusade against unfairness toward consumers with respect to financial products, the extent of which is yet to be determined.
What has come to be known as “UDAAP” is Dodd-Frank’s prohibition of the use of an “unfair, deceptive, or abusive act or practice” by “any covered person,” defined as any person (or entity) that “engages in offering or providing a consumer financial product or service,” and that person’s “service provider.” “Service provider” means “any person that provides a material service to a covered person” in connection with the covered person’s offering of a financial product or service.
Although Dodd-Frank does not include a definition of “deceptive,” the CFPB has issued guidance in the form of a supervision and examination manual outlining a three-part test for deceptiveness, and providing examples. For an act or practice to be deceptive, it must mislead or be likely to mislead the consumer, it must be material and the consumer’s interpretation of the act or practice must be reasonable. Despite this guidance, the lack of any definition in the statute itself appears to give the CFPB extra leeway to expand the scope of “deceptiveness” either through application of the current guidance or the issuance, at any time, of additional guidance redefining the deceptiveness standard with no statutory limitation.
The inherent subjectivity and indistinctness of each component of UDAAP is likely to create numerous difficulties for financial institutions. The UDAAP definitions are replete with vague and nebulous terms, such as “substantial,” “likely” and “reasonable,” that allow the CFPB unfettered discretion to declare acts or practices unfair, deceptive or abusive. Actual harm is not required for an act to be unfair or deceptive. Thus, the CFPB can target practices that are not harming consumers, but that create a significant risk of harm. For example, when a consumer is not misled into purchasing a certain financial product or service, but a covered person did something that was likely to mislead that consumer, the practice is deceptive. Conversely, if a consumer does not understand the product or service, the covered person may not take “unreasonable advantage” of that lack of understanding. According to the manual, even emotional effects can amount to substantial injury in some cases. Financial institutions now have to gauge the myriad diverse personalities and comprehension levels of each of their customers.