Compliance Blog

Written by John A. Howes, Jr., Regulatory Affairs Intern

In the July issue of NAFCU’s Compliance Monitor, I wrote about the Consumer Financial Protection Bureau’s (CFPB) new tool for enforcing the country’s consumer financial protection laws, the Civil Investigative Demand (CID).  I wanted to take a moment to tell you a little bit more about this unique device that will test credit unions’ compliance and record-keeping.

A CID is an administrative subpoena for documents, testimony, electronically stored information, and answers to written questions related to an investigation that the CFPB has the authority to conduct.  CIDs impose significant requests for information and short, definite timetables for responses, so credit unions must be prepared and quickly decide a course of action if one crosses their desks.  

Last year, the CFPB clarified these new powers in its Final Rules Relating to Investigations, located in the CFPB’s regulation 12 C.F.R. Part 1080. The CFPB can issue a CID to any institution – even credit unions with less than $10 billion in assets who are not under its primary supervisory authority.  The CFPB is only required to disclose CIDs when recipients have petitioned to modify or set them aside.  So far, we only know of three that have been made publicly available.

A CID recipient must quickly contact his or her attorney and assemble a response team that can ensure compliance with legal obligations, determine the scope and timing of the CID, and assess the feasibility of document collection.  The team must decide whether to petition to modify or set aside the CID or fully comply with it and produce the requested information based on the tight deadlines set in the rule. 

Within 10 calendar days of receipt, a CID recipient must decide whether to meet and confer with the CFPB’s enforcement attorneys to discuss appropriate limitations on the scope of the request, issues related to privileged and confidential information, and a reasonable timeframe for compliance.  This is crucial to any response plan because, if there is no meeting within 10 days, the CFPB will not allow a recipient to petition to modify or to quash the CID.  Moreover, if a recipient petitions to modify or set aside, he can only raise issues that were discussed during the meeting with CFPB attorneys.  Within 20 calendar days after service of the CID, a recipient must decide whether to fully comply with the CID or to petition the agency’s director to modify or set it aside.  

The petition must be as specific as possible regarding the burdens of complying with the CID.  It should offer specific alternatives and suggestions for responding to the requests instead of simply saying that it is “overly burdensome.”  Showing specific figures from a third party detailing the CID’s burdens and compliance costs would also be a good idea.  In addition, a recipient could try narrowing the dates or refining the searches for the requested information.

Be prepared if you receive a CID.  Promptly contact your attorney(s) and try to negotiate the CID’s potentially vast requests for information and short, definite timetables for responses.