You Can Achieve Vendor Management & Mortgage Closing Success In a Post-TRID World. Copyright 2016 ATS Secured. All Rights Reserved.

Transcription

1 You Can Achieve Vendor Management & Mortgage Closing Success In a Post-TRID World Copyright 2016 ATS Secured. All Rights Reserved.

2 Get relief, with guidance from a former CFPB regulator on safely navigating:» Liability» Responsibility for disclosures» The true definition of service provider» The most important CFPB and TILA-RESPA rule expectations Lenders, Settlement Agents and other mortgage-loan stakeholders:» Risk assessment and planning» Accuracy of disclosures and permissible changes Your vendor management responsibilities and regulatory expectations are proving more complex and costly than ever. Presented by: Ben Olson, partner at BuckleySandler LLP, former Deputy Assistant Director for the Office of Regulations at the CFPB. He has extensive experience providing guidance on regulatory requirements and led the development of the mortgage disclosure rule and forms. Wes Miller, CEO of ATS Secured, a leader in software development and business strategy including financial and operational excellence. He has extensive experience developing and marketing both core and ancillary products for the mortgage and title industries. 2

3 CONTENTS: 1. Introduction 2. Key regulatory expectations regarding service providers 3. Who is a service provider? 4. CFPB guidance 5. Prudential regulator guidance 6. TILA-RESPA Liability 7. Responsibility and accuracy of disclosures 8. Preparation of the Loan Estimate and permissible changes 9. Preparation of the Borrower's Closing Disclosure and permissible changes 10. Preparation of the Seller s Closing Disclosure 11. Post-Consummation changes 3

4 INTRODUCTION Since TRID took effect in October 2015, more than 70% of mortgage loans have shown violations. Whether the lender or a vendor on the loan made an error, the lender is held responsible. There are at least three reasons this is bad for the lender: Regulatory fines Reduced loan value on the secondary market Reduced consumer trust Lenders, as regulated entities, must carefully manage internal processes as well as third and fourth-party actions. They need to know what regulators expect of them and how to execute on those expectations. When lenders achieve regulatory compliance they can enjoy: Increased profits Greater efficiency Earned consumer trust On the following pages, you ll learn exactly what the CFPB and other regulators want from lenders, to achieve TRID and TILA-RESPA compliance. This review was prepared for the sole benefit of ATS Secured. No other person or entity is entitled to rely on its contents. Any copy of this review received by another person or entity is for informational purposes only and does not constitute legal advice. Any recipient should consult and rely upon the advice of the recipient s own counsel. 4

5 Five Common TRID Violations 1 The Loan Estimate and Closing Disclosure both have the same issue date. 2 Title fees do not have Title in the description. 3 Contact information, often the real estate/broker s license number, is not included in the correct format. 4 A refinance using an alternative Closing Disclosure form to show subordinate financing when this math isn t even required. 5 Settlement agent fails to include their file number on page 1. Source: Lakeside Title Company 5

6 KEY REGULATORY EXPECTATIONS REGARDING SERVICE PROVIDERS Federal regulators recognize that entities subject to their supervision may outsource certain functions to service providers due to resource constraints, use service providers to develop and market additional products or services, or rely on expertise from service providers that would not otherwise be available without significant investment. Whether regulated by the CFPB, OCC, Federal Reserve, FDIC or NCUA: a. A supervised entity (e.g., a lender) generally must ensure that activities performed by a service provider are conducted in compliance with applicable laws and regulations and do not present a risk to consumers or to the safety and soundness of the supervised entity. b. A service provider that would not otherwise be subject to supervision by a federal regulator can become subject to such supervision by providing services to a supervised entity. i iii ii Three regulators (the CFPB, Federal Reserve and OCC) have issued new or updated guidance on managing outsourcing risk within the last several years. In addition, detailed guidance issued by the NCUA and FDIC in 2007 and 2008, respectively, remains in effect. v Regulators have stated that the use of third-party service providers or vendors presents a variety of risks, including compliance, reputational, operational and legal risks. vi Example: CFPB Director Richard Cordray has stated that: Consumers are at a real disadvantage because they do not get to choose the service providers they deal with the financial institution does. Consumers must not be hurt by unfair, deceptive or abusive practices of service providers. Banks and nonbanks must manage these relationships carefully and can be held accountable if they break the law. Note: this is not a comprehensive review of all regulatory guidance on this subject. Additional information can be found in the endnotes and in the supervisory materials for the relevant agency. viii iv vii 6

7 WHO IS A SERVICE PROVIDER? Under the Dodd-Frank Act, a service provider is any person that provides a material service to a [supervised entity] in connection with the offering or provision by such [entity] of a consumer financial product or service, including a person that: Participates in designing, operating, or maintaining the consumer financial product or service; or Processes transactions relating to the consumer financial product or service. ix Although the agency guidance uses the terms service provider, vendor, or third party, it generally applies to any entity that has entered into a business relationship with a supervised entity. Only the Federal Reserve s guidance is limited to contractual relationships. For convenience, this review uses the term service provider. x 7

8 Neither the Dodd-Frank Act nor the agency guidance lists the specific types of entities that are considered service providers. In particular, they do not address whether a settlement or title agent is considered a service provider of a mortgage lender. A settlement agent is generally selected by the borrower in a real estate transaction but may provide services to or on behalf of the lender, such as preparing and providing required disclosures, recording the lien, and disbursing funds. Even if a particular settlement agent is not considered a service provider, the CFPB has the authority to bring enforcement actions against settlement agents to the extent that: They have engaged in any conduct that is a violation of any provision of Federal consumer financial law, such as RESPA; They have engaged in unfair, deceptive, or abusive acts or practices ( UDAAPs ) in the course of providing real estate settlement services, other than appraisals and the business of insurance; or They knowingly or recklessly provide substantial assistance to a covered person [such as a lender] or service provider that has engaged in a UDAAP or other violation of a Federal consumer financial law. xi 8

9 CFPB GUIDANCE Oversight of service providers should include steps to ensure that business arrangements with service providers do not present unwarranted risk to consumers. xii These steps should include, but are not limited to: a. Conducting thorough due diligence of service providers to verify that they understand and comply with the law; b. c. d. e. Reviewing service providers policies, procedures, internal controls, and training materials to ensure that they conduct appropriate training and oversight of employees or agents that have consumer contact or compliance responsibilities; Including in contracts with service providers clear expectations about compliance, as well as appropriate and enforceable consequences for violating any compliance-related responsibilities, including engaging in unfair, deceptive, or abusive acts or practices; Establishing internal controls and on-going monitoring to determine whether the service provider is complying with the law; and Taking prompt action to address fully any problems identified through the monitoring process, including terminating the relationship where appropriate. xiii 9

10 PRUDENTIAL REGULATOR GUIDANCE The OCC, Federal Reserve, FDIC, and NCUA (collectively, the prudential regulators ) have provided more detailed guidance that addresses the need to create a risk management program that evaluates and manages risks associated with outsourcing. Although the prudential regulators did not issue identical guidance, their guidance is similar in many respects. The prudential regulators agree that outsourcing does not relieve a supervised entity of its responsibility to ensure that outsourced activities are conducted in a safe-and-sound manner and in compliance with applicable laws and regulations. xiv As the FDIC put it, [t]he key to the effective use of a third party in any capacity is for the financial institution s management to appropriately assess, measure, monitor, and control the risks associated with the relationship. xv The precise use of a service provider risk management process depends upon the nature of the third-party relationship, the scope and magnitude of the activity, and the risks identified. Supervised entities are expected to develop a risk management program that is riskfocused and provide[s] oversight and controls commensurate with the level of risk presented by the outsourcing arrangements. xvii 10

11 Key elements of prudential regulator guidance: a. Risk Assessment and Planning Supervised entities generally should plan before outsourcing and assess the risks associated with it. b. Due Diligence Supervised entities should evaluate and perform necessary due diligence before selecting a service provider. According to the Federal Reserve, assessing the risk of a business activity and the implications of performing the activity in-house or having the activity performed by a service provider are fundamental to the decision of whether or not to outsource. Before deciding whether to enter a relationship, the OCC advises that supervised entities should develop a plan commensurate with the level of risk and complexity of the third-party relationship that assesses issues such as inherent risks, strategic purposes, legal and compliance aspects, complexity, costs/benefits, client impact, and information security implications. xix xviii The prudential regulators all agree that due diligence should be commensurate with the level of risk and complexity of the third-party relationship. xx The FDIC provides that [c]omprehensive due diligence involves a review of all available information about a potential third party, focusing on the entity's financial condition, its specific relevant experience, its knowledge of applicable laws and regulations, its reputation, and the scope and effectiveness of its operations and controls. xxi 11

12 Prudential regulator guidance continued: c. Contract Negotiation and Implementation After selecting a service provider, but before entering into an arrangement, supervised entities should ensure that the specific expectations and obligations of both the financial institution and the third party are outlined in a written contract. d. Oversight/Ongoing Relationship Monitoring To minimize exposure to potential significant financial loss, reputation damage, and supervisory action, a supervised entity should maintain adequate oversight and quality control over products and services provided through its service providers. The oversight program should be tailored to the specific nature of considered programs, the materiality of risks identified, and the [supervised entity s] overall complexity. xxiv The prudential regulators list a variety of requirements and suggestions covering a broad range of issues (from the service provider s financial condition to the supervised entity s monitoring capabilities to subcontractor management) to accomplish this. xxii xxiii Examples: The FDIC suggests that [t]he institution s compliance management system should ensure continuing compliance with applicable federal and state laws, rules, and regulations, as well as internal policies and procedures. The NCUA requires credit unions to have an infrastructure (i.e. staffing, equipment, technology, etc.) sufficient to monitor the performance of third party arrangements, and recommends establishing ongoing expectations and limitations, compar[ing] program performance to expectations, and ensur[ing] all parties to the arrangement are fulfilling their responsibilities. The OCC suggests monitoring for changes to the service provider s ability to effectively manage risk by identifying and addressing issues before they are cited in audit reports. xxvii The FDIC recommends that management periodically review the third party s operations in order to verify that they are consistent with the terms of the written agreement and that risks are being controlled. Additionally, it provides that an oversight program will generally include monitoring of the third party s quality of service, risk management practices, financial condition, and applicable controls and reports. xxix xxviii xxv xxvi 12

13 The CFPB s rule combining the mortgage disclosures consumers receive under the Truth in Lending Act ( TILA ) and the Real Estate Settlement Procedures Act ( RESPA ) xxx applies to covered transactions for which the creditor or mortgage broker received an application on or after October 3, xxxi TILA-RESPA LIABILITY The new rule requires that disclosures be provided earlier in the origination process, tightens the existing limitations on changes to disclosed amounts, and makes lenders ultimately responsible for disclosure of many of the settlement costs that were previously the responsibility of settlement agents. xxxii Key TILA-RESPA changes, which are expected to require heightened coordination between lenders and settlement agents: 1. TILA provides a private right of action for violations of its disclosure requirements, whereas RESPA does not. xxxiii Liability for failure to comply with relevant TILA provisions includes actual damages, attorney s fees and costs, as well as statutory penalties of up to $4,000 for failures to properly provide certain disclosures (including the finance charge and annual percentage rate). xxxiv 13

14 TILA-RESPA Liability Continued 2. The CFPB did not specify which aspects of the new combined disclosures are subject to TILA liability and which are subject to RESPA liability. Instead, the CFPB stated that the detailed discussions [in the final rule s preamble] of the statutory authority for each of the integrated disclosure provisions provide sufficient guidance for industry, consumers, and the courts regarding the liability issues raised by the commenters. Most provisions of the new rule, however, rely on both TILA and RESPA. Recently, the CFPB issued annotated versions of the Loan Estimate and Closing Disclosure that are intended to help the industry understand which disclosure requirements may carry a private right of action. However, these annotations are not binding on the CFPB or any court. xxxv xxxvi 3. Under the Dodd-Frank Act, the CFPB has the authority to issue civil penalties for violations of consumer finance laws, which would include the new integrated disclosure rule, in the following amounts: a. $5,000 per day per violation; b. $25,000 per day for reckless violations; and c. $1,000,000 per day for knowing violations. xxxvii 14

15 SURVEY: TRID has increased costs, decreased product offerings Realtors Respond to TRID s Effects on the Mortgage Process 54.5% 50% 48.1% $ 67% experienced increased legal and regulatory costs 10.1% Transactions delayed Found electronic transactions quicker than manual transactions Closing documents with errors Difficulty obtaining closing documents 77% reported increased delays in closings (1-20 days; average of 8 days) 75% have eliminated products construction loans, home equity loans, and ARMs out of concern that TRID lacks adequate compliance direction. Of 548 banks surveyed Source: National Associations of Realtors 15

16 The Loan Estimate The Loan Estimate must be provided either by the creditor or the mortgage broker who received the consumer s application. xxxviii However, the creditor retains ultimate responsibility and liability for ensuring the Loan Estimate is provided in accordance with the rule, even if the mortgage broker delivers it. xxxix RESPONSIBILITY AND ACCURACY OF DISCLOSURES The Closing Disclosure The Closing Disclosure must be provided by either the creditor or a settlement agent. However, as with the Loan Estimate, the creditor retains ultimate responsibility and liability for ensuring that the disclosure is provided in accordance with the rule. Accuracy of disclosures and permissible changes: Both TILA and RESPA require that consumers receive good faith estimates of loan terms and costs. xli While the CFPB generally retained the limitations on changes previously adopted by HUD under RESPA s good faith requirement, the CFPB also relies on the TILA good faith requirement, which means TILA liability may apply. xlii xl 16

17 PREPARATION OF THE LOAN ESTIMATE AND PERMISSIBLE CHANGES The Loan Estimate, which must be provided within three business days of receipt of an application, combines the initial Truth in Lending Statement and the Good Faith Estimate, and provides consumers with a good faith estimate of the closing costs, which includes an estimate of loan costs and settlement costs. xliii 17

18 An estimate is in good faith if the charge paid by or imposed on the consumer does not exceed the amount originally disclosed, subject to certain tolerances and exceptions. xliv For purposes of determining what constitutes a good faith estimate, charges are sorted into three categories: 1. No Changes The amounts 2. 10% Limit The aggregate 3. disclosed on the Loan Estimate for the above costs cannot increase unless one of the exceptions listed below applies: a. The creditor s or broker s charges for their own services; b. Charges for services provided by an affiliate of the creditor or broker; c. Charges for services for which the consumer is not permitted to shop; and d. Transfer taxes. xlv disclosed amount for recording fees and third-party services selected from the creditor s list of providers cannot increase by more than 10%. xlvi No Limitations The above amounts must be disclosed based on the best information reasonably available at the time using reasonable due diligence, but there is otherwise no limitation on increases: a. Prepaid interest; b. Property insurance premiums; c. Amounts placed into escrow or impound; d. Charges paid to consumer-selected, third-party service providers not on the creditor s list of providers; and e. Charges paid for third-party services not required by the creditor, even if paid to an affiliate of the creditor. xlvii Exceptions: Disclosed amounts may increase beyond the limits discussed above only if one of the following exceptions applies: a. Changed circumstances affecting settlement charges or eligibility; b. Consumer requested change; c. Change in points or lender credits because rate was not locked; d. Expiration of estimate; or e. Delayed settlement date on a construction loan. xlviii 18

19 PREPARATION OF THE BORROWER S CLOSING DISCLOSURE AND PERMISSIBLE CHANGES Seller Information For transactions involving a seller, the creditor may choose to provide a copy of the Closing Disclosure to the borrower that also contains all of the information relating to the seller s transaction or it may choose to separate the borrower s and seller s information. If the creditor Ii chooses to separate the borrower s and seller s information, the summary of the seller s transaction may be left blank, but the seller-paid columns on page 2 of the Closing Disclosure must still be completed to include all of the sellerpaid loan costs and other costs. This includes seller-paid loan costs and other costs that may appear to be completely unrelated to the borrower s transaction. Therefore, creditors should develop a process to obtain this information from the settlement agent before providing the borrower s Closing Disclosure. Initial reports suggest that some creditors have struggled to obtain this information from some settlement agents. I The Closing Disclosure, which must be received by the borrower no later than three business days prior to closing (and, if mailed, sent as many as six business days before closing), combines the final Truth in Lending Statement and HUD-1/1A Settlement Statement, and generally must state the actual terms of the credit transaction, and the actual costs associated with the settlement of that transaction. xlix Fee Names Fee names on the Closing Disclosure must be consistent with the descriptions or prescribed labels, as applicable, used for such items on Iii the Loan Estimate. This generally means that the creditor must know very early in the application process exactly which fees a settlement agent who is listed on the creditor s list of providers will charge and how much they will cost because variations in the names or itemization could result in perceived tolerance violations. Changes If a change occurs after the initial provision of the Closing Disclosure but before consummation, the creditor is generally permitted to provide a revised Closing Disclosure at or before consummation. Iiii 19

20 Preparation of the Borrower s closing disclosure - continued However, tolerance limitations still apply and may only be reset using the Closing Disclosure during a narrow window of time. Iiv The following changes require re-disclosure and a new threebusiness-day waiting period: A change in the APR of more than 1/8 of 1 percentage point above or below the disclosed APR or, if the transaction is irregular (e.g., multiple advances or irregular payment periods), a change of more than 1/4 of 1 percentage point; Iv A change in the loan product (e.g., from adjustable rate to fixed rate); Ivi and In addition, if information is not known despite the creditor having exercised due diligence to obtain that information, the creditor may disclose in the Closing Disclosure an estimate based on the best information reasonably available, even if the creditor knows that more precise information will be available at or before consummation. Notably, the creditor does not comply with the due diligence requirement if the title insurance company that is providing the title insurance policies is acting as the settlement agent in connection with a transaction, but the creditor does not request the actual cost of the lender s title insurance policy that the consumer is purchasing from the title insurance company and instead discloses an estimate based on information from a different transaction. Iviii The addition of a prepayment penalty. Ivii 20

21 PREPARATION OF THE SELLER S CLOSING DISCLOSURE For transactions involving a seller, the seller must also receive a Closing Disclosure that discloses the actual terms of the seller s transaction at or before the day of consummation. Iix This requirement can be met in several ways. The settlement agent may provide: 1. A copy of the Closing Disclosure provided to the borrower if that disclosure also contains the information relating to the seller s transaction; 2. A separate, standard version of the Closing Disclosure that leaves certain borrower information blank; or If the borrower s and seller s disclosures are provided on separate documents, the settlement agent must provide to the creditor a copy of the Closing Disclosure provided to the seller. Ixi Initial reports suggest that some settlement agents are reluctant to provide the seller s Closing Disclosure to both the seller and to the creditor or to use one of the required forms, despite the rule s clear requirements. 3. an alternative seller s Closing Disclosure that is modified in accordance with Model Form H-25(I) to include only information relevant to the seller s transaction. Ix 21

22 Under certain circumstances, re-disclosure after consummation may be permitted or required to avoid a violation. Ixii POST-CONSUMMATION CHANGES Example 1: If an event in connection with the settlement of the transaction occurs that causes the Closing Disclosure provided to the borrower to become inaccurate, and that inaccuracy results in a change to the amount actually paid by the borrower from the amount disclosed, the creditor must provide a corrected Closing Disclosure to the borrower no later than 30 days after receiving information sufficient to establish that the change occurred. Ixiii Example 2: If an event in connection with the settlement of the transaction occurs that causes the Closing Disclosure provided to the seller to become inaccurate, and that inaccuracy results in a change to the amount actually paid by the seller from the amount disclosed, the settlement agent must provide a corrected Closing Disclosure to the seller no later than 30 days after receiving information sufficient to establish that the change occurred. Ixiv 22

23 51% of mortgage professionals believe all loans will be closed electronically in 4 years or less. Top benefits of going paperless: Accelerated Closing Disclosure process Accelerated document delivery process Decreased processing time & cost per loan Source: MReport Now that you know the impact TRID and vendor management requirements are having on the mortgage industry, the next step is mitigating your risk and keeping your operating costs down. Even with great planning and staff training, CFPB regulations can lead to headaches, loss of productivity and fines. The success of your business depends on the right tools. For more information, contact ATS Secured. ATS Secured s complete mortgage software solution for all parties in the closing process includes vendor management, file collaboration and disbursements designed to meet all regulatory expectations. Lenders, settlement agents, realtors and vendors collaborate on ONE mortgage file to reduce errors and closing times while also mitigating and controlling risk. For more information visit atssecured.com, or call

24 i Consumer Financial Protection Bureau, Bulletin , Service Providers, p. 1 (Apr. 12, 2012) ( CFPB Bulletin ). ii See CFPB Bulletin , p. 1 (stating that supervised entities must oversee service providers in a manner that ensures compliance with Federal consumer financial law, which is designed to protect the interests of consumers and avoid consumer harm ); Office of the Comptroller of the Currency, Bulletin , Third-Party Relationships, p. 1 (Oct. 30, 2013) ( OCC Bulletin ) (stating that all activities must be performed in a safe and sound manner and in compliance with applicable laws ); Board of Governors of the Federal Reserve System, Supervision and Regulation Letter 13-19, Guidance on Managing Outsourcing Risk, p. 2 (Dec. 5, 2013) ( FRB Supervision and Regulation Letter ); Federal Deposit Insurance Corporation, Financial Institution Letter , Third-Party Risk Guidance for Managing Third-Party Risk, p. 2 (June 6, 2008) ( FIL ) (stating that using a third party in no way diminishes the responsibility of the board of directors and management to ensure that the thirdparty activity is conducted in a safe and sound manner and in compliance with applicable laws, regulations, and internal policies ); National Credit Union Association, Supervisory Letter No , Evaluating Third Party Relationships, p. 2, 7 (Oct. 2007) ( NCUA Supervisory Letter No ) (stating that credit unions are responsible for safeguarding member assets and ensuring sound operations irrespective of whether or not a third party is involved and should ensure compliance with state and federal laws and regulations ). iii See 12 U.S.C. 1867(c) ( [W]henever a depository institution that is regularly examined by an appropriate Federal banking agency, or any subsidiary or affiliate of such a depository institution that is subject to examination by that agency, causes to be performed for itself, by contract or otherwise, any services authorized under this chapter, whether on or off its premises... such performance shall be subject to regulation and examination by such agency to the same extent as if such services were being performed by the depository institution itself on its own premises ); 12 U.S.C. 5514(e) (stating that a service provider to a non-depository institution that is subject to CFPB supervision shall be subject to the authority of the Bureau under this section, to the same extent as if such service provider were engaged in a service relationship with a bank, and the Bureau were an appropriate Federal banking agency under [12 U.S.C. 1867(c)]. ); 12 U.S.C. 5515(d) (stating that a service provider to a depository institution or credit union with total assets over $10 billion shall be subject to the authority of the Bureau under this section, to the same extent as if the Bureau were an appropriate Federal banking agency under [12 U.S.C. 1867(c)]. ); 12 U.S.C (stating that a service provider to a substantial number of depository institutions or credit unions with total assets of $10 billion or less shall be subject to the authority of the Bureau under [12 U.S.C. 5515] to the same extent as if the Bureau were an appropriate Federal bank agency under [12 U.S.C. 1867(c)]. ). v See NCUA Supervisory Letter No ; FIL vi vii viii ix 12 U.S.C. 5481(26). x FRB Supervision and Regulation Letter 13-19, p. 1-2; see also FIL (listing as examples of risk strategic, reputation, operational, transaction, credit, compliance, and other risks). Press Release: CFPB to Hold Financial Institutions and their Service Providers Accountable (Apr. 13, 2012) (available at: newsroom/consumer-financial-protection-bureau-to-hold-financial-institutions-andtheir-service-providers-accountable/). For more information, please visit: regulations/laws/; and CFPB defines service providers as generally defined in section 1002(26) of the Dodd-Frank Act as any person that provides a material service to a covered person in connection with the offering or provision by such covered person of a consumer financial product or service. (12 U.S.C. 5481(26)). A service provider may or may not be affiliated with the person to which it provides services. CFPB Bulletin , p. 1. OCC provides that [t]hird-party relationships include activities that involve outsourced products and services, use of independent consultants, networking arrangements, merchant payment processing services, services provided by affiliates and subsidiaries, joint ventures, and other business arrangements where the bank has an ongoing relationship or may have responsibility for the associated records. Affiliate relationships are also subject to sections 23A and 23B of the Federal Reserve Act (12 USC 371c and 12 USC 371c-1) as implemented in Regulation W (12 CFR 223). Third-party relationships generally do not include customer relationships. OCC Bulletin , n. 1. Federal Reserve defines service provider as all entities that have entered into a contractual relationship with a financial institution to provide business functions or activities. FRB Supervision and Regulation Letter 13-19, p. 1. FDIC explains that a third party is any entity that has entered into a business relationship with a financial institution, whether the third party is a bank or nonbank, affiliated or not affiliated, regulated or nonregulated, or domestic or foreign. FIL , p. 2. NCUA does not define third party in its guidance. xi The CFPB has the authority to conduct investigations including the authority to issue subpoenas (civil investigative demands or CIDs ) for the purpose of ascertaining whether any person is or has been engaged in any conduct that is a violation of any provision of Federal consumer financial law. 12 U.S.C. 5561, If a violation is found, the CFPB may being an enforcement action under 12 U.S.C or Federal consumer financial laws include the enumerated consumer laws, such as ECOA, HOEPA, RESPA, and TILA. 12 U.S.C. 5481(12) (defining enumerated consumer laws ), (14) (defining Federal consumer financial law ). Notably, the CFPB recently commenced an administrative action against PHH Corporation and its affiliates for an alleged mortgage insurance kickback scheme in violation of section 8 of RESPA. In its notice of charges, the CFPB stated that [m]ortgage insurance constitutes business incident to or a part of a real estate settlement service within the meaning of Section 8 of RESPA. 12 C.F.R (b). Notice of Charges Seeking Disgorgement, Other Equitable Relief, and Civil Money Penalty In the Matter of: PHH Corp., PHH Mortgage Corp., PHH Home Loans LLC, Atrium Ins. Corp., and Atrium Reins. Corp. 11, (File No CFPB-0002) (Jan. 29, 2014) (available at Federal consumer financial laws also include the provisions of title X of the Dodd- Frank Act, including the prohibition on unfair, deceptive, or abusive practices ( UDAAPs ) by a covered person that engages in offering or providing a consumer financial product or service, such as providing real estate settlement services (other than appraisals, the business of insurance, or electronic conduit services ). 12 U.S.C. 5536(a)(1)(B) (stating that it shall be unlawful for any covered person or service provider to, among other things, engage in any unfair, deceptive, or abusive act or practice ); see also 12 U.S.C. 5481(3) (defining the business of insurance as the writing of insurance or the reinsuring of risks by an insurer, including all acts necessary to such writing or reinsuring and the activities relating to the writing of insurance or the reinsuring of risks conducted by persons who act as, or are, officers, directors, agents, or employees of insurers or who are other persons authorized to act on behalf of such persons ), (5) (defining consumer financial product or service as a financial product or service that is, among other things, offered or provided for use by consumers primarily for personal, family, or household purposes or, in the case of real estate settlement services, is delivered, offered, or provided in connection with a consumer financial product or service, such as extending credit ), (6) (defining covered person ), (14) (defining Federal consumer financial law ), (15) (defining financial product or service as including providing real estate settlement services other than appraisals, the business of insurance, or electronic conduit services ). iv See CFPB Bulletin ; OCC Bulletin ; FRB Supervision and Regulation Letter

25 Title X also prohibits any person [from] knowingly or recklessly provid[ing] substantial assistance to a covered person or service provider in violation of the [prohibition on UDAAPs in 12 U.S.C. 5531], or any rule or order issued thereunder. 12 U.S.C. 5536(a)(3) (further stating that, notwithstanding any provision of [title X of the Dodd-Frank Act], the provider of such substantial assistance shall be deemed to be in violation of that section to the same extent as the person to whom such assistance is provided ). xii CFPB Bulletin , p. 2. xiii xiv CFPB Bulletin , pp The Bulletin directs readers to the CFPB s Supervision and Examination Manual: Compliance Management and Review and Unfair, Deceptive, and Abusive Acts or Practices sections for more information pertaining to the responsibilities of supervised entities that have business arrangements with service providers. Notably, the examination manual requires examiners to [r]eview policies and procedures designed to ensure that the entity s service providers comply with legal obligations applicable to the product or service of the examined entity and the provider. CFPB s Supervision and Examination Manual Version 2, CMR 7 (p. 40). FRB Supervision and Regulation Letter 13-19, p. 2; see also OCC Bulletin ( A bank s use of third parties does not diminish the responsibility of its board of directors and senior management to ensure that the activity is performed in a safe and sound manner and in compliance with applicable laws. ); NCUA Supervisory Letter No , p. 2 (stating credit unions are responsible for safeguarding member assets and ensuring sound operations irrespective of whether or not a third party is involved ). xv FIL , p. 4. xvi FIL , p. 4. xvii xviii xix xx FRB Supervision and Regulation Letter 13-19, p. 2. The activities necessary to implement an effective service provider risk management program can vary based on the scope and nature of a financial institution's outsourced activities, including the criticality, complexity, and number of material business activities being outsourced. Id. at 2-3. For example, a community banking organization may have critical business activities being outsourced, but the number may be few and to highly reputable service providers. Therefore, the risk management program may be simpler and use less elements and considerations. For those financial institutions that may use hundreds or thousands of service providers for numerous business activities that have material risk, the financial institution may find that they need to use many more elements and considerations of a service provider risk management program to manage the higher level of risk and reliance on service providers. Id. at 3. Put another way, [l]ess complex risk profiles and third party arrangements typically require less analysis and documentation. NCUA Supervisory Letter No , p. 2. The OCC similarly provides that a bank s risk management processes should be commensurate with the level of risk and complexity of its third-party relationships and the bank s organizational structures. OCC Bulletin , p. 2. For example, if critical activities are involved, then the bank should have more comprehensive and rigorous oversight and management of the service provider. Id. FRB Supervision and Regulation Letter 13-19, p. 3; see also FIL , p. 4 ( Risk assessment is fundamental to the initial decision of whether or not to enter into a third-party relationship. ). OCC Bulletin , p. 3. For additional guidance, see OCC Bulletin , p. 3 (providing guidance on Planning ); FRB Supervision and Regulation Letter 13-19, p. 3 (addressing Risk Assessment considerations); FIL , p. 4-5 (providing guidance on Risk Assessment ); NCUA Supervisory Letter No , p. 2-4 (addressing Risk Assessment and Planning Considerations for Third Party Relationships ). OCC Bulletin , p. 3; see also FRB Supervision and Regulation Letter 13-19, p. 3-4 ( The depth and formality of the due diligence performed will vary depending on the scope, complexity, and importance of the planned outsourcing arrangement, the financial institution's familiarity with prospective service providers, and the reputation and industry standing of the service provider. ); FIL , p. 5 (stating that [t]he scope and depth of due diligence is directly related to the importance and magnitude of the institution s relationship with the third party ); NCUA Supervisory Letter No , p. 4 (providing that [d]ue diligence should be tailored to the complexity of the third party relationship and may consist of reasonable alternative procedures to accomplish acceptable risk mitigation ). xxi xxii xxiii xxiv xxv FIL , p. 5. For additional guidance, see OCC Bulletin , p. 3-5 (providing guidance for Due Diligence and Third-Party Selection ); FRB Supervision and Regulation Letter 13-19, p. 3-5, (providing guidance for Due Diligence and Selection of Service Providers ); FIL , p. 5-6 (providing guidance for Due Diligence in Selecting a Third Party ); NCUA Supervisory Letter No , p. 4-8 (providing guidance regarding Due Diligence for Third Party Relationships ). FIL , p. 6. See also OCC Bulletin (stating that management should negotiate a contract that clearly specifies the rights and responsibilities of each party to the contract ); FRB Supervision and Regulation Letter 13-19, p. 5 ( The terms of service agreements should be defined in written contracts that have been reviewed by the financial institution's legal counsel prior to execution. ). For additional guidance, see OCC Bulletin , p. 5-8 (providing guidance on Contract Negotiation ); FRB Supervision and Regulation Letter 13-19, p. 5-9 (providing guidance on Contract Provisions and Considerations ); FIL , p. 6-9 (providing guidance on Contract Structuring and Review ); NCUA Supervisory Letter No , p. 6-7 (giving guidance on Contract Issues and Legal Review ). OCC Bulletin ( Ongoing monitoring for the duration of the third-party relationship is an essential component of the bank s risk management process. ); FRB Supervision and Regulation Letter 13-19, p. 9 ( To effectively monitor contractual requirements, financial institutions should establish acceptable performance metrics that the business line or relationship management determines to be indicative of acceptable performance levels. ); FIL , p. 9 ( Institutions should maintain adequate oversight of third-party activities and adequate quality control over those products and services provided through third-party arrangements in order to minimize exposure to potential significant financial loss, reputation damage, and supervisory action. ). NCUA Supervisory Letter No , p. 8; see also OCC Bulletin , p. 8 ( More comprehensive monitoring is necessary when the third-party relationship involves critical activities. ); FRB Supervision and Regulation Letter 13-19, p. 10 ( Higher risk service providers may require more frequent assessment and monitoring and may require financial institutions to designate individuals or a group as a point of contact for those service providers. ); FIL , p. 9 ( The extent of oversight of a particular third-party relationship will depend upon the potential risks and the scope and magnitude of the arrangement. ). FIL , p. 9; see also OCC Bulletin , p. 8 (suggesting key areas of consideration for ongoing monitoring, which includes compliance with legal and regulatory requirements). xxvi NCUA Supervisory Letter No , p

26 xxvii xxviii xxix xxx xxxi xxxii OCC Bulletin , p. 8. FIL , p. 9. It also suggests allocating sufficient qualified staff to monitor significant third-party relationships and provide the necessary oversight. Management should consider designating a specific officer to coordinate the oversight activities with respect to significant relationships, and involve their compliance management function and, as necessary, involve other operational areas such as audit and information technology, in the monitoring process. Id. FIL , p. 9. This performance monitoring should generally include a variety of factors set forth in the guidance, which includes reviewing reports relating to the third party s performance in the context of contractual requirements and performance standards, with appropriate follow-up as needed. Id. at 10. For additional guidance, see OCC Bulletin , p. 8 (addressing Ongoing Monitoring considerations); FRB Supervision and Regulation Letter 13-19, p (providing guidance on Oversight and Monitoring of Service Providers ); FIL , p (discussing Oversight of third party service providers); NCUA Supervisory Letter No , p. 8-9 (providing guidance on Risk Measurement, Monitoring and Control of Third Party Relationships ). Bureau of Consumer Financial Protection, Final Rule, Integrated Mortgage Disclosures under the Real Estate Settlement Procedures Act (Regulation X) and the Truth in Lending Act (Regulation Z), 78 Fed. Reg (Dec. 31, 2013). 80 Fed. Reg (July 24, 2015). The rule was originally scheduled to take effect on August 1, Fed. Reg. at However, the Bureau explained in its proposal to delay the rule that due to an administrative error on the Bureau s part in complying with the [Congressional Review Act], the [TRID] Rule cannot take effect until at the earliest August 15, Because some delay in the effective date is now required, the Bureau believes that a brief additional delay may benefit both consumers and industry more than would allowing the new rules to take effect on [August 15]. 80 Fed. Reg , (June 26, 2015). 12 C.F.R (e)(1)(ii) and (f)(1)(v). Unless otherwise noted, all citations to the Code of Federal Regulations and the commentary are to the revised version adopted in the CFPB s rule. xxxvi As of May 2016, these annotated forms are available at under the Forms section. xxxvii 12 U.S.C. 5565(c). xxxviii 12 C.F.R (e)(1)(i)-(ii). xxxix 12 C.F.R (e)(1)(ii). xl 12 C.F.R (f)(1)(v). xli 15 U.S.C. 1638(2)(a); 12 U.S.C. 2604(c). xlii 78 Fed. Reg. at xliii 12 C.F.R (e)(1)(i), (e)(1)(iii), (e)(3)(i), and xliv 12 C.F.R (e)(3). xlv 12 C.F.R (e); comment 19(e)(3)(i)-1. xlvi 12 C.F.R (e)(3)(i)-(ii). xlvii 12 C.F.R (e)(3)(iii). xlviii 12 C.F.R (e)(3)(iv). xlix 12 C.F.R (f)(1)(ii); Comment 19(f)(1)(i)-1. l li Comment 19(f)(4)(i)-1; 12 C.F.R (t)(v); BuckleySandler Unofficial Transcript of April 12, 2016 CFPB Staff Webinar Addressing Post-Effective Date Questions and Guidance, p. 31, available at uploads/1082/doc/april_2016_webinar_transcript.pdf. 12 C.F.R (t)(5)(v); BuckleySandler Unofficial Transcript of April 12, 2016 CFPB Staff Webinar Addressing Post-Effective Date Questions and Guidance, p. 31, available at doc/april_2016_webinar_transcript.pdf. lii 12 C.F.R (h)(4). liii 12 C.F.R (f)(2)(i). The consumer must be permitted to inspect the Closing Disclosure, completed with all information known to the creditor at the time of the inspection, during the business day immediately preceding consummation, but the creditor may omit from the inspection items relating only to the seller s transaction. 12 C.F.R (f)(2)(i). liv Comment 19(e)(4)(ii)-1. lv lvi lvii lviii lvx lx lxi lxii lxiii lxiv 12 C.F.R (f)(2)(ii), 22(a). 12 C.F.R (f)(2)(ii), 37(a)(10). 12 C.F.R (f)(2)(ii). Comment 19(f)(1)(i)-2.ii. This requires the creditor to act in good faith to exercise due diligence in obtaining the information. Comment 19(f)(1)(i)-2.i. 12 C.F.R (f)(4). Comment 19(f)(4)(i)-1; 12 C.F.R (t)(5)(v)-(vi); BuckleySandler Unofficial Transcript of April 12, 2016 CFPB Staff Webinar Addressing Post-Effective Date Questions and Guidance, p , available at uploads/1082/doc/april_2016_webinar_transcript.pdf. 12 C.F.R (f)(4)(iv); BuckleySandler Unofficial Transcript of April 12, 2016 CFPB Staff Webinar Addressing Post-Effective Date Questions and Guidance, p. 29, available at April_2016_Webinar_Transcript.pdf. 12 C.F.R (f)(2) and (4). 12 C.F.R (f)(2)(iii). 12 C.F.R (f)(4)(ii). xxxiii xxxiv xxxv 12 U.S.C et seq. See 15 U.S.C Fed. Reg. at