The CFPB focuses on mobile phone carrier payment processing If you think you are not a Financial Services Company You may want to think again

Transcription

1 The CFPB focuses on mobile phone carrier payment processing If you think you are not a Financial Services Company You may want to think again January 2015

2 If you think you are not a Financial Services Company you may want to think again Because consumers are increasingly using their phones for all sorts of financial activities, they need to be able to trust that their wireless carriers and other payment processors are keeping their accounts safe. - Rich Cordray Director of the CFPB Overview On December 17, 2014, the Consumer Financial Protection Bureau ( CFPB ) announced that it was filing a lawsuit against one of the nation s largest providers of wireless services, for allegedly allowing third parties to illegally cram customers bills with unauthorized charges. Significantly, this action is a signal of the CFPB s willingness to exercise its enforcement authority beyond traditional financial services companies. As such, it should serve as a wake-up call to other companies that do not fit the mold of a traditional financial services company, but whose payment processing or other financial-type activities could result in consumer harm and CFPB attention. The CFPB release announcing the action describes the principal allegations as follows: The billing system established by the wireless carrier made it easy for third-party scammers to attach charges to consumer s bills; Consumers were automatically enrolled in a third party billing system without their consent and an ability to opt-out; The company disregarded red flags, including lawsuits about cramming against the same aggregators that the company used and prior law enforcement action related to the issue; The company ignored complaints about unauthorized charges, for example, by failing to track customer complaints about unauthorized charges, and failing to provide full and prompt remediation to consumers affected by these charges. The CFPB concludes that this alleged conduct constitutes unfair acts or practices, covered by the Dodd-Frank Act prohibition against unfair, deceptive or abusive acts or practices (UDAAP) in connection with a consumer financial product or service. 1 We describe below what makes this action different from other CFPB enforcement actions, what other companies may be affected by the CFPB s approach, and four things potentially affected companies can do now to reduce the risk of a CFPB enforcement action. Background As the CFPB lawsuit explains, in the 1990s, telephone companies opened up their billing platforms to third parties. That is, phone companies placed charges on a consumer s bill for services provided by another company. Wireless carriers adopted the same model. Among the third parties that billed through wireless carrier payments systems were companies selling ring tones, wallpaper, horoscopes, etc. According to the CFPB, many of those companies engaged in cramming, or charging consumers for services they had not actually purchased or authorized. 1 Codified at 12 U.S.C. 5531; 5536(a)(1)(B). The CFPB focuses on mobile phone carrier payment processing 1

3 If you think you are not a Financial Services Company you may want to think again Over the past year, the Federal Trade Commission (FTC) has brought cramming-based actions against a number of wireless carriers for engaging in unfair or deceptive acts or practices (UDAP) in violation of Section 5 of the Federal Trade Commission Act (FTCA). Unlike UDAAP, under the Dodd-Frank Act, UDAP under the FTCA is not limited to acts or practices in connection with a consumer financial act or practice. The facts alleged in the FTC actions were similar to those alleged in the CFPB action described above. Some of those actions have resulted in large settlements (e.g., agreements to pay at least $90 million on one case and at least $80 million in another case) and orders shutting down certain cramming operations. 2 The case we described above, however, is the first wireless carrier cramming case in which the CFPB rather than the FTC has initiated the action. While CFPB settlements often are similar to the FTC s settlement in these cases (i.e., including remediation, restitution, civil money penalties, reporting, and compliance monitoring), it is may be useful to also recognize that CFPB examination and supervision has historically focused on both (1) detecting and correcting violations, and (2) ensuring that companies have in place the Compliance Managements Systems and other infrastructure necessary to prevent future violations. 3 It remains to be seen how this approach or other factors might affect the CFPB s approach to this action and to similar circumstances in the future. What makes this action different from other CFPB enforcement actions? One thing that makes this action different from most other CFPB enforcement actions is that it is based on financial services that are provided by a company that is not principally in the business of offering those services. Rather, those services billing are offered principally to support the offering of telecommunication services. The CFPB s approach appears to be that the activities conducted by wireless carrier s billing system meet the Dodd-Frank Act s definition of consumer financial product or service, which makes the wireless carrier a covered person that can be subject to a CFPB enforcement action. 4 By taking that approach, the CFPB appears to be signalling that it is willing to exert its jurisdiction very broadly to address what it believes to be covered activities or practices resulting in consumer harm. As this action demonstrates, that includes a willingness to look at the activities of companies that may offer or provide consumer financial services only incidental to their main lines of business. This lawsuit also signals the CFPB s willingness to pursue actions against companies that the CFPB views as facilitating consumer harm that is actually perpetrated by third parties. This was demonstrated in the CFPB s approach to indirect auto lending (facilitating and benefiting from discriminatory actions by auto dealers) 5 and a CFPB enforcement action 2 See FTC press releases related to Mobile Cramming; 3 See CFPB Supervisory Highlights, Compliance Management Systems, Sec. 2.1, pp (Summer 2013). 4 See 12 U.S.C. 5481(6)(, (15(A)(i) & (iv). 5 See CFPB release and links (Dec. 20, 2013); see also CFPB Notice of Proposed Rulemaking; Defining Larger Participants of the Automobile Financing Market and Defining Certain Automobile Leasing Activity as a Financial Product or Service, 79 FR (published Oct. 8, 2014); CFPB release (April 30, 2014); and CFPB Bulletin (March 21, 2013). The CFPB focuses on mobile phone carrier payment processing 2

4 If you think you are not a Financial Services Company you may want to think again against a payment processor (facilitating debt settlement companies charging of illegal up-front fees). 6 This case is also another indication of the CFPB partnering with other agencies. What makes this one different is that the other agency is the Federal Communications Commission, rather than another federal or state financial institution regulatory agency, the U.S. Department of Justice, or the Federal Trade Commission. Who may be affected? It is hard to say with precision which companies may be affected by the CFPB s approach in this action. Companies that appear to be fundamentally nonfinancial in nature may nevertheless be viewed as providing consumer financial products and services if they are causing or facilitating consumer harm. However, projecting from the facts of this case, other companies whose operations could become subject to CFPB scrutiny and enforcement actions include other wireless providers, cable and satellite television companies. Payment processors without a direct bank affiliation like Apple, Google, and Bitcoin could also find themselves under CFPB regulatory scrutiny. Four things affected companies can do now While the above action creates uncertainty, companies potentially within the reach of the CFPB should not feel helpless. We believe that the four actions below can bring companies a long way toward reducing the risk of a CFPB action and possibly reducing the severity of a CFPB action should one nevertheless occur. 1. Identify consumer risk and develop consumer controls. The key driver of the action above appears to be consumer harm that persisted despite red flags. Therefore, the first thing a company that may fall within this new CFPB approach to consumer financial products and services should do is identify sources of consumer compliance risk and consumer risk that may have financial characteristics. Think broadly about risk, particularly if your payment processing or other financial systems also process third-party charges. Focusing broadly on consumer risk can help identify potential UDAAP violations. Notably, unfair acts or practices may involve consumer harm with no corresponding deception or dishonesty on the part of the company. This exercise may seem foreign to a company that has not previously been subject to CFPB supervision or supervision by a banking regulatory agency, but can substantially reduce a company s CFPB risk exposure. By building that inventory of consumer compliance risks and consumer risks generally, companies can develop controls to mitigate and manage those risks, and build them into the company s Compliance Management System. This includes developing and documenting necessary policies, procedures and training; conducting monitoring and testing; taking corrective actions; and bringing the relevant activities within the scope of compliance audits. 6 See CFPB release and links (Oct. 3, 2013). The CFPB focuses on mobile phone carrier payment processing 3

5 If you think you are not a Financial Services Company you may want to think again 2. Pay attention to customer complaints. Another key allegation in the action described above is the failure of the company to adequately address complaints. The volume and nature of the complaints was also cited as a red flag. It will be incumbent for any nonfinancial company working to avoid a CFPB enforcement action to note that they expect entities under their supervision to have a program in place (1) to respond appropriately to consumer complaints and inquiries, and (2) to monitor and analyze complaints to understand and correct weaknesses in their programs that could lead to consumer risks and violations of law. 7 Adopting such an approach to consumer complaints could go a long way toward reducing the risk of a CFPB action. 3. Manage all third-party relationships that could expose you to compliance risk. As this case highlights, managing third-party relationships means both managing thirdparty service providers and other third parties whose actions could expose your company to compliance risk. Look broadly when developing an inventory of all relevant third-party relationships, and develop appropriate controls to mitigate and manage the associated compliance risk, particularly the risk of financial harm to consumers. Be especially wary of any instances where third-party violations could result in exposure for your company, even where the third party could also be characterized as a customer. This includes both where the third party commits violations (think consumer harm) acting as an agent for the company as well as where the company could be viewed as in any way facilitating that third party s violations. If your systems process payments for third parties, or you provide similar services for third parties, a robust third-party relationship management process should be in place to protect the organization from those third parties actions. The CFPB and banking agencies have issued guidance on managing third-party relationship that describes the basic structure of programs to manage such relationships Recognize the impacts of financial incentives. The CFPB noted in this case that the company directly benefited from consumers payment of unauthorized third-party charges. This action s inclusion of a request for disgorgement of such ill-gotten revenues is typical of cases where a company is seen as having benefitted from wrongdoing, even wrongdoing by another party. Enterprise-level financial incentives can affect behavior in ways that may increase compliance risk. This can particularly be the case where one company may effectively be 7 See CFPB Supervision and Examination Manual, Compliance Management Review, CMR (v. 2.0, Oct. 2012). 8 See Federal Reserve Board, Guidance on Managing Outsourcing Risk (Dec ); OCC Bulletin (Oct. 30, 2013); CFPB Bulletin , Service Providers (April 13, 2012). For insights into additional steps that may be appropriate, see PwC s Financial Services Viewpoint, Significant Others: How financial institutions can effectively manage the risks of third-party relationships (Sept. 2013). The CFPB focuses on mobile phone carrier payment processing 4

6 If you think you are not a Financial Services Company you may want to think again facilitating another company s wrongdoing, where the fact that the facilitating company is somehow also benefitting from the wrongdoing can create a compliance blind spot. Companies need to objectively assess their compliance risk, in addition to assessing any potential financial incentives. A CFPB enforcement action can instantly reverse the apparent financial up-side to ignoring compliance risk. Individual financial incentives also can affect behavior in ways that affect compliance risk. For example, the CFPB has cited the financial incentives employees selling credit card add-on products realize by going off-script with false comments to earn higher commissions. Companies should either modify such incentives or develop and implement controls that can be effective despite those incentives. Conclusion Whether a company provides traditional consumer financial products or services, or provides consumers financial products or services principally in connection with a nonfinancial business, it is now clear that those services could now be subject to regulatory scrutiny by the CFPB. The companies that will most effectively prevent future CFPB enforcement actions will be those that identify and address consumer risks, pay attention to consumer complaints, manage their third-party relationships, and pay attention to financial incentives. In addition to reducing the risk of future CFPB enforcement actions, such actions are likely also to help those companies better manage risks generally and position for future consumer-related opportunities. The CFPB focuses on mobile phone carrier payment processing 5

7 PwC contacts PwC Consumer Finance contacts Martin Touhey Principal Doug Ekizian Senior Manager Craig Schleicher Manager William Laforet Manager Adam Kelly Manager PwC Financial Services Regulatory contacts Anthony Ricko Managing Director Bruce Oliver Director PwC Financial Services Irish contacts Ciaran Kelly Partner +353 (1) Feilim Harvey Director +353 (1) Follow us on The CFPB focuses on mobile phone carrier payment processing 6

8 PricewaterhouseCoopers. All rights reserved. PwC refers to the PwC network and/or one or more of its member firms, each of which is a separate legal entity. Please see for further details. PwC helps organisations and individuals create the value they re looking for. We re a network of fi rms in 157 countries with more than 184,000 people who are committed to delivering quality in assurance, tax and advisory services. Tell us what matters to you and fi nd out more by visiting us at