On February 7, 2018, the Consumer Financial Protection Bureau (“CFPB” or “Bureau”) published the latest in its growing series of Requests for Information (“RFI”), this one seeking comment on the Bureau’s enforcement process.[1]  As with earlier RFIs, the Bureau recognizes that the enforcement process may impose burdens on regulated entities and is seeking information on how to improve enforcement processes while remaining faithful to the Bureau’s objectives and “ensuring a fair and transparent process for parties subject to [the Bureau’s] enforcement authority.”

This RFI, following on RFIs relating to Civil Investigative Demands[2] and Administrative Adjudications,[3] is further evidence that the CFPB, under new leadership, is closely evaluating a broad range of Bureau activities and their impact on the industry.

While the RFI broadly seeks suggestions on “potential updates or modifications” to the enforcement process,[4] the Bureau emphasizes seven aspects of the process that “may be deserving of more immediate focus.”[5]  Because the CFPB’s enforcement process is a series of inter-related steps, changes to any one of these areas may impact, or be impacted by, changes to other areas.

Before delving into the RFI’s seven focus areas, it is important to recognize an over-arching concern with the Bureau’s enforcement process — namely, the virtual inability to resolve a matter in the supervisory context once it has been referred to the Office of Enforcement.

Inability to Resolve Enforcement Matters Short of Public Enforcement Actions:  The Action Review Committee (“ARC”) and ‘Reverse’ ARC

The Bureau has a formal process — known as the Action Review Committee, or ARC — for moving a matter from a supervisory examination to the Office of Enforcement.  Although the Bureau has taken the position that it technically has a ‘reverse’ ARC process by which matters may be returned to Supervision, this appears to occur on only rare occasions.  The result is that the Office of Enforcement, in practice, appears to have only one means to resolve an issue (other than to drop a case), and that is to bring a public enforcement action.  Meanwhile, the Bureau’s Office of Supervision can address matters through various non-public means, such as a Memorandum of Understanding.

Even assuming a reverse ARC process exists, that process appears to be nowhere near as robust as the ARC process.  The Bureau (and the institutions it regulates) could benefit from an accepted process that encourages Enforcement to consider, after appropriate investigation, whether the matter should remain in Enforcement or be sent back to Supervision for some type of non-public supervisory resolution.  The absence of such a process means the Bureau and the institutions under investigation are deprived of a resolution mechanism for those cases where a public enforcement action is too onerous, yet the Bureau staff is uncomfortable simply closing the case.  As a result, in cases involving more minor or technical violations, Enforcement staff is forced to choose between dropping the case (unlikely) or bringing a public enforcement action, with all the accompanying unwarranted collateral consequences, such as the impact on the subject’s public standing.

Thus, to improve its enforcement process and enhance flexibility, the Bureau should consider formally building out a ‘reverse’ ARC process that allows the Bureau a full opportunity to consider whether a non-public resolution may be more appropriate. While the Bureau did not raise this issue in its current RFI, the RFI nevertheless provides a platform for the Bureau to consider this issue, in addition to the seven RFI areas identified, each of which is discussed below.

Communications Between the Bureau and Subjects of Investigations

The RFI’s first focus area is on communications between Bureau staff and the parties subject to an investigation, with an emphasis on the timing and frequency of such communications and the amount of information shared by Bureau staff.[6]  Currently, communications between Bureau staff and the institutions under investigation appear to occur at the discretion of the Enforcement staff.  Some Enforcement staff are relatively open to explaining the nature of the Bureau’s concerns and perhaps the likely time-line for considering those concerns; other staff are less forthcoming, often leaving an institution wondering about both the substance of the Bureau’s investigation and the related timing.  While flexibility in the nature and extent of communications is obviously necessary, the Bureau’s process could be improved if staff were encouraged to communicate more frequently with the investigation subjects, both about the status of the investigation and the likely time-line.  Such an approach would also allow institutions to respond to the staff’s concerns more directly and perhaps adopt new practices or take other actions during the pendency of an investigation that benefit impacted consumers.  In sum, more regular communications may result in more efficient investigations and a reduced burden for all parties.

Length of Investigations

The RFI next addresses the length of Bureau investigations,[7] which regularly take many months and sometimes years.  Anecdotally, CFPB investigations seem to go on longer than comparable investigations at other banking agencies, a concern compounded by the communication challenges noted above.  Moreover, notwithstanding the length of the investigations, it often appears that institutions are pressed to respond to Bureau requests for documents or other information on very tight time-lines.  While it plainly is in everyone’s interest for all parties to have adequate time during an investigation, perhaps the Bureau could consider a policy whereby, if an investigation has been pending for more than a year, an institution (at its option) could request a closing letter to which the Bureau would be required to respond substantively.

NORA Process

Prior to submitting a proposed enforcement action to the Bureau’s Director for approval, Bureau staff typically provide the subject of an investigation with some information on the staff’s pending recommendation.  This is referred to as the Notice and Opportunity to Respond and Advise, or NORA, process.  The RFI asks for comment on this process, including whether it should be mandatory, and the content of NORA letters.[8]

While in practice many subjects are given some warning under the NORA process of an upcoming enforcement action, making the NORA notice mandatory (with exceptions for extenuating circumstances and permitting subjects to waive the NORA process), could help ensure consistency across Bureau matters.  Furthermore, under the current system, Bureau staff typically call the subject of the investigation prior to sending the NORA letter to advise the institution of the Bureau’s concerns.  However, the level of detail and the willingness to answer questions appears to be subject to staff discretion.  The Bureau should consider requiring staff to provide sufficient detail so that institutions are given a more complete understanding of the Bureau’s allegations, both with respect to the facts and specific legal provisions at issue.  Such an approach could benefit both the Bureau and the institution by allowing the institution to develop a more targeted response for the Bureau to consider.

Relatedly, while one appreciates the need for staff to move the NORA process along expeditiously, the Bureau should consider either extending the default response timeframe of 14 days or updating its policy to allow extensions of time to be granted more liberally.  For the NORA process to be meaningful after a long investigation, subjects need sufficient time to prepare a comprehensive response that addresses both the legal and factual issues raised by the Bureau.

Presentations to the Bureau

The RFI next raises whether the Bureau should allow the subject of a potential enforcement action to make an in-person presentation before the Bureau makes a final decision on whether to bring the enforcement action.[9]  Presently, such an opportunity appears to be discretionary and, when provided, may be limited to presentations to the staff and first-line managers, who have spent months or years on the investigation.

Allowing institutions to meet with appropriate Bureau staff may provide the Bureau with important context and a clearer understanding of the institution’s position in ways that written communications do not. However, to be meaningful, these meetings should be more than “check-the-box” exercises and should likely include more senior Enforcement managers who have decision-making responsibility but who are not so immersed in the matter that they have already formed firm opinions on the matter.  Relatedly, such presentations typically should take place before the staff has submitted its enforcement recommendation to the Director and preferably even before staff has formally submitted a recommendation to senior management in the Office of Enforcement.

Finally, the importance of meeting with the Bureau should not be limited to the end of an investigation. In many cases, Bureau staff (including more senior managers who are not the front-line lawyers on the case) would greatly benefit from meeting with subjects during the pendency of an investigation.  In some cases, institutions may have sufficient information to address the Bureau’s concerns and answer questions in ways that a review of documents cannot.   Thus, such a process may help streamline investigations and reduce the burden for all involved.


The RFI also asks about the calculation of Civil Money Penalties (CMPs), “consistent with the penalty amounts and mitigating factors set out in 12 U.S.C. § 5565.”[10]  The RFI specifically asks whether the Bureau should adopt a CMP matrix and, if so, what it should include.[11]

The lack of clarity in how the Bureau sets CMPs during settlement negotiations has been another source of frustration and does not appear to benefit the Bureau.  This lack of transparency can extend and complicate negotiations over consent orders and the proper application of different factors.  Moving toward a CMP matrix, like that used by Office of the Comptroller of the Currency, which explicitly includes the factors in § 5565, could be a step in the right direction.  Such an approach could provide more predictability and promote more fairness and efficiency in Bureau negotiations and resolutions.

Consent Order Language

Bureau consent orders contain many standard provisions that are part of the Bureau’s template.  The RFI asks interested parties to address those standard provisions, including “conduct, compliance, monetary relief, and administrative provisions.”[12]  While a standard template does offer efficiency and consistency, an entirely inflexible approach that does not account for the particular facts of a case or the nature of the institution signing the consent order may go too far in that direction.  Allowing more case-specific options for Bureau staff to use in drafting consent orders could result in orders that are better tailored to circumstances and reduce unnecessary burdens, without having to be redrafted from scratch each time.


The final RFI question asks for comment on the “manner and extent to which the Bureau can and should coordinate its enforcement activity with other Federal and/or State agencies that may have overlapping jurisdiction.”[13]  This topic has been a major concern since the Bureau’s earliest days and, despite some improvement over time, remains an area where many believe the Bureau (and other regulatory agencies) could benefit from a further review.  As a matter of fairness and efficiency, subjects of investigations deserve a coordinated approach that avoids having multiple regulators pile on, each with their own particular hook in a matter.  Where multiple agencies are focused on the same underlying conduct, it may be appropriate to have a single agency take the lead, while the others address their specific concerns through non-public resolutions, if necessary.  In sum, a multi-agency investigation and resolution should perhaps be the exception, not the rule.


Many overlapping aspects of the CFPB’s enforcement process may benefit from a fresh look, given the six years of experience that both the Bureau and industry have had with the process.  Moreover, this RFI may provide the opportunity for the Bureau to consider more broadly the interaction between its supervisory and enforcement activities, including whether there should be a more meaningful process by which enforcement matters could be resolved through supervisory action.  The RFI process hopefully will give the Bureau ideas about how to reshape its enforcement policies in ways that benefit both those under investigation and the Bureau.

This article was originally published in Law360.

[1] Bureau of Consumer Financial Protection, Request for Information Regarding Bureau Enforcement Process (hereinafter “Enforcement RFI”), available at http://files.consumerfinance.gov/f/documents/cfpb_rfi_enforcement-processes_022018.pdf/.

[2] Bureau of Consumer Financial Protection, Request for Information Regarding Bureau Civil Investigative Demands and Associated Processes, available at http://files.consumerfinance.gov/f/documents/cfpb_rfi_civil-investigative-demands_012018.pdf.  See Jean Veta, Jason Grimes and Eitan Levisohn, Potential Revamp Of CFPB Civil Investigative Demand Process, Law360 (Jan. 31, 2018), available at https://www.cov.com/-/media/files /corporate/publications/2018/01/potential_revamp_of_cfpb_civil_investigative_demand_process.pdf?_lrsc=d3f7768a-c8fb-42ec-a89d-a27e652c20db&utm_source=linkedin&utm_medium =social&utm_campaign=elevate.

[3] Bureau of Consumer Financial Protection, Request for Information Regarding Bureau Rules of Practice for Adjudication Proceedings, available at http://files.consumerfinance.gov/f/documents/cfpb_rfi_administrative-adjudications_012018.pdf.

[4] Id. at 3.

[5] Id. at 4.  The RFI recognizes that there is some overlap with the RFIs for Civil Investigative Demands and Administrative Adjudications but requests that specific comments on those processes be provided in response to the relevant RFIs.  Id.

[6] Id.

[7] Id.

[8] Id. at 4-5.

[9] Id. at 5.

[10] Id.  Mitigating factors include the financial resources of the subject, the severity of the risk to consumers, and the subject’s history of prior violations.

[11] Id.

[12] Id.

[13] Id.