A recent blog by law firm Ballard Spahr reports the Consumer Financial Protection Bureau (CFPB) has begun to examine service providers on a regular, systematic basis, particularly those supporting the mortgage industry. The blog recounts information provided by the CFPB during an American Bar Association (ABA) Business Law Section meeting held May 7, 2017, stating: “The change represents a significant expansion of the CFPB’s use of its supervisory authority and will substantially increase the number and types of entities facing CFPB examinations.” To be fair, the blog does not specifically mention law firms or title and settlement agencies, but both law firms and title agencies are groups that clearly fall into the category of service providers “supporting the mortgage industry.”
Fortunately, there will be an opportunity to hear more detail about whether title and settlement agents will be subject to increased supervision. Ballard Spahr is conducting a free webinar June 13, 2017, from 12-1 p.m. (ET) which could provide an opportunity to specifically ask such questions.
For further background on this topic prior to the webinar, carefully read the CFPB’s Bulletin 2012-04, “CFPB to Hold Financial Institutions and Their Service Providers Accountable.” As is obvious from the title of this five-year-old bulletin, the 2017 announcement to directly examine third-party vendors is not an announcement of new policy, but clarification of how the CFPB intends to implement its longstanding policy to hold third parties accountable.
In that 2012 Bulletin, the CFPB cited its statutory ability under the Gramm-Leach-Bliley Act (GLBA) to oversee both supervised financial institutions and their service providers. It stated that Title X of GLBA “grants the CFPB supervisory and enforcement authority over supervised service providers, which included the authority to examine the operations of service providers on site.” It went on to state: “The CFPB will exercise the full extent of its supervisory authority over supervised service providers….” However, for the past few years, it appeared that all of the CFPB’s pressures and examination focus were only on the lending community. This latest pronouncement indicates CFPB’s focus could now be expanding to include “on site” examination of entities like law firms and settlement agencies.
It is not immediately clear how this recent message conveyed to the ABA can be reconciled with the more recent CFPB Bulletin 2016-02, which appeared to allow lenders flexibility in conducting due diligence over their third-party vendors. Even though that bulletin appeared to be designed solely to provide guidance to financial institutions, the CFPB took time to again reiterate its right to directly supervise third-party vendors of financial institutions. This 2016 bulletin states that the “…depth and formality of the risk management program for service providers may vary depending upon the service being performed – its size, scope, complexity, importance and potential for consumer harm – and the performance of the service provider in carrying out its activities in compliance with Federal consumer financial laws and regulations.” Some in the lending community have interpreted this 2016 bulletin to justify that the level of scrutiny a bank must exercise over smaller title or settlement firms need not be as rigorous or involved as that imposed on larger service providers. While that interpretation may come as a welcome relief to small title and settlement agents with limited resources, the CFPB’s recent announcement to directly supervise service providers “supporting the mortgage industry” may cause a new round of heartburn for those same agencies.
One possible way to reconcile the CFPB’s Bulletin 2012-04 with its message in Bulletin 2016-02 is to give lenders some leeway in their obligations to vet their small service providers. However, the CFPB’s expectation of those smaller service providers to comply with all aspects of the Real Estate Settlement Procedures Act, GLBA, and other federal laws remains undiminished. As such, even small service providers must be able to pass an evaluation of their aptitude to maintain the privacy of mortgage data they handle, provide evidence they have implemented data security measures to prevent unauthorized access, and demonstrate they are exercising due diligence over their “fourth party” service providers, etc.
Those and many other inquiry areas are covered in an ALTA Best Practices assessment, such as that provided by PYA. Providers who have completed PYA’s certification process should be well-positioned to afford both lenders and the CFPB the level of requisite confidence for handling consumer data and meeting lender expectations.
The webinar will provide more details about what the CFPB had to say in its presentation to the ABA in May. I anticipate there will be an opportunity to submit questions if the issue of title and settlement agencies is not otherwise mentioned. If you would like to find out more, or have further questions, I’d encourage you to sign up for the webinar for thoughtful discussion on this important topic.