The CFPB has issued three separate updates to its examination procedures in recent months, each introducing additional requirements for creditors who audit third-party debt collection agencies. Creditors must review their audit processes annually to accommodate these evolving expectations and may need to request updated documentation, policies, and procedures from their collection partners.
The CFPB emphasizes that institutions are expected to manage relationships with service providers to ensure that service providers effectively manage compliance with Federal consumer financial laws applicable to the product or service being provided.
September 2021: IT Risk Management Updates
This update introduced four modules addressing compliance oversight:
1. Board Management and Oversight
Agencies must demonstrate proper board oversight of compliance programs, and creditors must oversee their vendors' compliance management similarly.
2. Compliance Programs
Third-party vendors require solid compliance infrastructures including:
- Policies and Procedures
- Training
- Monitoring/Audit
- Consumer Complaint Response
3. Service Provider Oversight
While third-party providers are often necessary, engaging them does not relieve the institution's responsibility for compliance. Service providers must understand applicable legal requirements and maintain consumer protection processes. Under Dodd-Frank, both the service provider and institution face legal responsibility for unfair, deceptive, or abusive acts and practices (UDAAP) causing consumer harm.
4. Violations of Law and Consumer Harm
Examiners assess whether the institution's compliance management systems identified violations and what remediation followed.
March 2022: Debt Collection Exam Procedure Updates
Regulation F's November 30, 2021 enactment prompted these updates with seven modules relevant to auditing collection agencies:
1. Entity Business Model
Evaluates whether entities qualify as 'debt collectors' under the FDCPA and assesses vendor relationships, internal controls, and account management.
2. Communications in Connection with Debt Collection
Examines FDCPA and UDAAP compliance in consumer communications, including document reviews and call recordings.
3. Information Sharing, Privacy, and Interactions with Consumer Reporting Agencies
Addresses requirements under GLBA/Regulation P, FCRA/Regulation V, and FDCPA/Regulation F.
4. Validation Notice, Consumer FDCPA Disputes and Complaints
Focuses on consumer inquiries, complaints, FDCPA disputes, and debt verification obligations.
5. Payment Processing and Account Maintenance
Examines how payments are applied and other account management issues, including electronic fund transfers.
6. Equal Credit Opportunity Act
Determines creditor status and ECOA/Regulation B compliance.
7. Litigation Practices, Administrative Wage Garnishment and Repossessions
Addresses collection actions, repossession risks, and statute of limitations issues.
A critical point emerges: Monitoring, remediation, and action plans are no longer a 'nice to have', they are a 'must-have.'
March 2022: UDAAP Exam Manual Updates
The CFPB's updated procedures require companies to show their processes for assessing risks and discriminatory outcomes, including documentation of customer demographics and the impact of products and fees on different demographic groups.
The examination procedures provide guidance on:
- Defining unfairness, deception, and abuse in consumer financial products and services
- Assessing institutional risk for unfair, deceptive, or abusive practices
- Identifying such practices
- Understanding interplay with other consumer protection and anti-discrimination statutes
Collections specifically receive examination focus, examining both account forwarding decisions for discrimination and the collection agency's own treatment practices. Future updates may address credit bureau reporting, particularly medical debt.
