Blog Posts

Blogs

THE DANGER WITHIN: ALMOST 35% OF DATA BREACHES RESULT FROM INTERNAL EMPLOYEES AND HOW YOU CAN REDUCE YOUR RISK

11/15/2018

0 Comments

A total of 3,676 breaches involving over 3.6 billion records were reported in the first nine months of this year alone, according to Risk Based Security, which analyzes data pertaining to breaches gathered from public sources, through automated and proprietary processes, and other means.

As has been the case for several years, a recent study by Risk Based Security found insiders posed the biggest threat to data. Fraud — a term that Risk Based Security uses to describe any sort of malicious insider activity or no-technical methods of illegally accessing data — accounted for nearly 36% of the records compromised.

The reasons for such internal misbehavior vary from the obvious profit motive to a desire to cause harm to the dealership and its customers. Many criminal elements approach auto dealer employees with a proposal to pilfer consumer non-public personal information (“NPI”) in exchange for cash payments or other benefits. To some employees, the risk is worth taking

What’s a Dealer to Do?
To address the problem of insider misbehavior, there are a number of steps you can and should be taking.

It begins with the hiring process. Unless prohibited by law, a criminal background check should be undertaken for any candidate who if employed will have access to NPI. An investigative consumer credit report is another good step to take although you will have to notify the employee that you are doing so and, if asked, give the general information learned in such a report. But you don’t want questionable and potentially unreliable people in your dealership especially if they will have access to your most valuable resource of NPI.

Another thing you need to do is limit access permissions. How many employees in your stores can access NPI even though it may be unrelated to their positions? I bet it is a lot. Limit employee access to only that NPI they need to do their jobs and no more. This alone will reduce your risk.

The next step is that you must educate them and monitor their activity. Most electronic record-keeping systems and DMS systems have the ability to create access logs on who did what and when on the system. Maintain and review access logs of how often individual employees access NPI and watch carefully for spikes in activity. Do this with paper records as well. Appoint a gatekeeper or librarian who records the persons who access paper files with NPI and watch for spikes in that activity as well. An increase in file access may indicate the employee has been compromised by a hacker but may also indicate the employee has decided to go over to the dark side.

Your Employee Handbook should be clear that accessing NPI without a legitimate business purpose is cause for immediate termination in the sole discretion of management.

Another step you can take is to prohibit the downloading of NPI onto any external storage device like a USB, an external hard drive, or other electronic media. Access to NPI should be “read only” with no ability to download or transmit any of the information to any person not authorized by senior management.

Protect your NPI by putting it on a separate server not connected to the Internet. Use two factor authentication (a password and a code sent to the real user’s device are examples) to enable access and access only to the extent of the employee’s permissions. In one New Jersey case, a salesperson from a large dealer had resigned to go to a smaller competitor. Before doing so, the employee copied the large dealer’s DMS system onto a USB drive. No doubt similar activity goes on elsewhere. Pay careful attention to an employee’s access logs for about a month before and at all times after they give notice and prior to leaving the building. Watch their incidence of copying physical papers as well. This may be when you are most at risk.

Finally, make clear in employee training that anyone who suspects a colleague of taking NPI for non-company purposes is obligated to report that suspicion to the Chief Compliance Officer, anonymously if necessary. And let the employees know that not only will immediate termination follow but that the dealership is prepared to swear out a criminal complaint for any such behavior.

A little prevention like the type described in this blog can prevent your dealership from being the next victim of a safeguards breach. And that is a good thing too. A 2016 Verizon study found that among small to mid-size businesses that experienced a data security breach, three out of five went out of business within six months. Exercise diligence and hopefully you can mitigate at least this 36% of your safeguards risk.

0 Comments

TWO RECENT CASES SHOW NEED FOR A COMPLIANCE MANAGEMENT SYSTEM

10/1/2018

0 Comments

Two recent cases, one in Pennsylvania, the second in Arizona, have resulted in or are seeking large monetary damages awards against dealers and their principals personally. Both involved situations in which the dealers failed to have in place a Compliance Management System (CMS). The case already resolved—the one in Pennsylvania—required the dealership to implement a Code of Conduct and CMS to avoid further damage liability.

Both cases involved patterns and practices of unlawful conduct that had been going on for years and could have been prevented by application of an effective CMS. In Pennsylvania, the dealer entered into a deferred prosecution agreement which essentially means that if it takes certain action, it will not be prosecuted further under federal criminal laws.

The Department of Justice (DOJ) sued the dealer and its principal for falsifying loan documents over a period of six years. These actions, if proven, would constitute the felony of bank fraud under federal criminal law. To stave off prosecution, the dealer agreed to pay a monetary penalty of $1.4 million and more than $737,000 in restitution to various finance companies. It also agreed to implement a substantial corporate compliance and ethics program and a vigorous monitoring and audit regime. If it fails to do so, the DOJ will prosecute for the criminal violations.

The second case in Arizona involves the FTC suing a five-store dealer group and its principals personally for falsifying customer income on credit applications and down payments on contracts. This is the first time the FTC has brought a lawsuit against an auto dealer for misrepresenting consumer income to financial institutions. If true, these activities would also violate federal criminal law and likely result in multi-million-dollar fines and penalties against the dealer. Like the dealer in Pennsylvania, the Arizona dealer had no CMS in place and that will be a contributing factor to how the lawsuit is resolved.

What is a CMS and How Do You Implement One?

A CMS begins with a Code of Conduct issued by the Board of Directors or senior management if the dealer does not have a Board. It sets the tone from the top. The first step toward implementation of a compliance program is management’s communication of their commitment and the responsibility of all employees to adhere to the Code of Conduct in all dealings.

The CMS is composed of several elements addressing risks identified by the Board and a Chief Compliance Officer who is appointed to head up the CMS. All aspects of the dealership from manufacturer relations to environmental shop risks need to be reviewed and addressed. Management of risks and controls over process are the essence of a CMS.

It is critical that the dealership establish compliance standards (policies and procedures) that prescribe the internal control framework necessary to provide reasonable assurance of compliance with applicable laws and policies, including those designed to protect consumer privacy during the conduct of dealer activities. Employees will not come forward with complaints or reports of failure to adhere to processes or procedures if they fear retaliation or do not believe their reporting will change anything. For a CMS to work effectively throughout the organization, a formal investigation process and controls must be put into place to assure that non-retaliation, privacy, and a swift change to processes necessary to effect change are implemented and publicized to the employees

Policies and Procedures

High level policies and individual processes and procedures to control compliance risks must be developed and employees need to be trained on overall policies applicable to all employees (e.g., harassment and discrimination prohibitions, complaint or compliance violation reporting and anti-retaliation policies) as well as specific policies and procedures applicable to their positions. So, for example, f & I personnel would need to be educated about Truth in Lending, the Consumer Leasing Act, unfair and deceptive practices and given procedures for the conduct of business in the f&I office such as transparently presenting products and avoiding things like payment packing, discriminating in credit terms offered to customers, and presenting products honestly and fairly to customers.

Managers are the first line of defense in monitoring employees and all required behaviors should be monitored. An example is accessing non-public customer information. Policies would limit permissions to only what an employee needs to do their job and the frequency and nature of customer information accessed would be regularly monitored using data logs and a gatekeeper for paper files. If any spikes in activity appear, the Chief Compliance Officer and appropriate staff would begin an investigation to see if the employee had been compromised or become dishonest personally in stealing customer information. Appropriate safeguards and process improvements would be promptly identified and implemented.

Compliance must be implemented in all new products and programs including by giving the Compliance Officer a “seat at the table” as they are developed. Policies and procedures for implementation follow with monitoring established to ensure compliance or remediate a failure to comply.

Education and Training

Critical to any CMS is a process of training new hires and re-training existing employees on the Code of Conduct, overall dealership policies and procedures that apply to all employees, as well as the policies and procedures that apply to their specific positions. This needs to be an ongoing interactive process. Training and compliance need to be built into performance reviews and promotional decisions. This systemizes the CMS throughout the dealership.

Auditing and Investigation

Periodic audits need to be performed by internal or external auditors of the various controls established as well as reported incidents and matters identified from monitoring. Auditing should be done regularly as well as in response to specific situations. The auditors work with the Chief Compliance Officer, identify process failures and transgressions, and make reports and recommendations to the Board or a committee of the Board for correction and improvement. A periodic review of customer deal jackets is an example of an audit process designed to identify acts or omissions that are out of compliance.

Both the auditors and Chief Compliance Officer should be independent of the business and the business units being investigated. The dealer needs to provide ample resources and access to dealer materials to enable the CMS to function effectively and assess the dealership’s compliance in all areas.

Managing Incidents of Non-Compliance

Compliance incidents, however identified, must be swiftly contained and investigated; and, appropriate corrective action taken. Upon reporting of a potential incident, the dealership must conduct compliance incident management activities by applying the relevant policy, assessing authorities, and/or legal issues, taking corrective action, and responding to the needs of the organization’s internal and external overseers. In addition, the CMS evaluation must identify the root cause and assess the impact of incidents to continuously frame the evolution of the CMS.

A ”root cause” analysis is required to correct an underlying process or failure of control that caused the event. A root cause is a factor that caused a nonconformance and should be permanently eliminated through process improvement. A root cause analysis is a collective term that describes a wide range of approaches, tools, and techniques used to uncover causes of problems.

One approach is to drill down to the root cause by asking a series of “why” questions. For example, if vehicle titles are not getting timely processed, a “why” analysis would look at the timeframes and factors that cause the delays. A solution might be to hire an external titling vendor with contractual assurances of timeliness if information is timely provided. The timely provision of information to the titling vendor would be a change in procedure and a process that could be monitored and audited to make sure titles get timely processed.

Customer Complaints

Regulators require a process for handling customer complaints as part of a dealer’s CMS.

Procedures should be established for addressing complaints, and individuals or departments responsible for handling them should be designated and known to all institution personnel to expedite responses. How complaints are identified and defined is critical, as consumer inquiries may also highlight areas with increased risk of consumer harm and/or regulatory compliance concerns.

Complaints may indicate a compliance weakness in a process, function or department. Therefore, the Chief Compliance Officer should be aware of the complaints received and act to ensure a timely resolution. A compliance officer should determine the cause of the complaint and act to improve the institution’s business practices, as appropriate.

A procedure should also be established for handling garden-variety customer sales or service complaints. The Chief Compliance Officer or his or her staff should log the complaints pursuant to a process and either the Chief Compliance Officer or another dealer senior executive should endeavor to resolve the complaint to the customer’s satisfaction.

Do a cost-benefit analysis of not satisfying the customer in terms of legal fees, bad publicity, low CSI scores, etc. that may outweigh what even unreasonable customer requests entail. Regulators begin investigations with customer complaints, whether or not well founded. Try to resolve complaints with “funny money,” this being free or discounted goods or services. Endeavor to preserve a positive relationship with the customer, one way or another. Use arbitration and pay filing costs if a resolution is not possible as a last resort.

Oversight and Improvement

An effective CMS is a process of constant evaluation. The key is to strive for and demonstrate a process for continually improving on compliance activities and evolving your compliance program and its activities. The Chief Compliance Officer can spearhead this process, but oversight must remain with and be exercised by the Board.

Keep abreast of legal, regulatory and case law developments and change policies and procedures as appropriate. Engage with state and local dealer associations and 20 groups.
Attend compliance update training programs and subscribe to industry publications.

Risks are also not static. Annual (or more frequent) risk assessments should be conducted by Board’s risk/compliance committee and Chief Compliance Officer as business and legal risks evolve. Identify impacted areas. Change policies, procedures and training as appropriate. Enlist managers in making the changes with staff.

Continue to monitor and audit for compliance and respond accordingly even if no complaint has been reported about compliance shortfalls. Continuously improve processes and procedures.

Summary

An effective CMS could have saved the two dealerships described above millions of dollars in fines, penalties, attorney’s fees, and bad publicity. Third parties exist to help you begin or improve your CMS. An effective CMS is a factor that a regulator will consider in deciding whether to bring an enforcement action or assess fines and penalties. It is also a factor to be considered by courts under the U.S. Sentencing Guidelines. While it will involve costs and implementing procedures, the two dealerships described above certainly show the result of failing to have an effective CMS. Begin or enhance your CMS today and your dealership will be better off for doing so.

0 Comments

FTC Active in New Actions Against Auto Dealers for Compliance Violations

8/13/2018

0 Comments

After a period of relative quiet since slapping a Texas dealer for deceptive advertising in January 2018, the FTC recently launched two aggressive actions against auto dealers. It certainly seems like the FTC has auto dealers in their headlights and is enforcing compliance on violations it has not aggressively pursued in the past.
New Used Car Guide Sweep
The first initiative was a 20 -state sweep in partnership with local law enforcement authorities for compliance with the new Used Car Rule. The FTC amended the Rule and published a new Buyer’s Guide form in November 2016. It requires the new Buyer’s Guide to be conspicuously placed on all used vehicles for sale. The mandatory compliance date was January 28, 2018.
In their sweep, the FTC and its partners conducted on site reviews of 94 dealers and found that only 14 had the new Buyer’s Guides on all their used vehicle sales inventory. That’s less than 15%. 33 had the new Guides on half of their used cars and the remaining dealers did not. Not good.
According to the FTC,
“Following the sweep, the FTC sent letters to each dealership detailing the results of the inspections and providing material to help them come into full compliance with the amended Rule. Over the coming weeks, dealerships that were not displaying the revised Buyers Guide can expect follow-up inspections to ensure they have brought themselves into compliance with the amended Rule. Under the FTC Act, dealers who fail to comply face penalties of up to $41,484 per violation. State and local law enforcement agencies also enforce the recently amended [Used Car] Rule.”
Several years ago, when the penalties were only $16,000 per violation, another sweep and follow-up led to the FTC fining an Arkansas dealer $88,000 for not displaying Used Car Buyer’s Guides on its used vehicles. Expect more sweeps and higher fines for those dealers that do not have the new Buyer’s Guides on all, or substantially all, of their used vehicles that are offered to the public for sale or lease.
The new Used Car Buyer’s Guide focuses on dealer warranties and there are two forms. One for states that permit “as is” sales disclaiming all warranties and one for states that do not permit disclaimer of implied warranties. You can find the English version of both forms at https://www.consumer.ftc.gov/articles/pdf-0083-buyers-guide.pdf
Remember that if you conduct the sale in Spanish, you must use a Spanish version of the Used Car Buyer’s Guide. You can find these at https://www.ftc.gov/es/system/files/documents/plain-language/cfr_buyers_guides_spanish_form.pdf
It is not required but it is a good idea to get the customer to sign the Buyer’s Guide acknowledging receipt. The FTC allows you to put a customer signature line on the back of the Buyer’s Guide provided it is preceded by the following words: “I hereby acknowledge receipt of the Buyer’s Guide at the closing of this sale.”
The FTC’s Initiative Against Falsifying Credit Applications and Deceptive Advertising
This past month, the FTC filed a lawsuit in a federal court in Arizona seeking injunctive and monetary relief against a four-store group. They also sued the principals of the group in their personal capacities. That alone is an important reason to take notice of this lawsuit.
The FTC had never brought an action against dealers (or their principals) who falsify credit applications such as, in this case, by inflating customer’s income and down payments to get deals funded by lenders. One of the four stores was found to have inflated income or down payment amounts 44% of the time! And it wasn’t nickel and dime stuff. One customer cited by the FTC told the dealership she had a fixed monthly income of about $1,200, but a dealer’s staffer allegedly inflated it to $5,200 in the paperwork.
The complaint also charges that the defendants often used tactics that prevented people from reviewing the documents. The dealer’s personnel allegedly rushed some consumers through the process; had them fill out forms over the phone or in places like grocery store parking lots or restaurants; or altered the documents after consumers signed them.
This behavior went on for several years until one lender that experienced a disproportionately high default rate from the dealer’s customers did an audit and uncovered the schemes.
The dealer group was also charged with false advertising. The first thing the FTC looks at in dealer advertising is whether “triggered terms” required by federal Truth in Lending (“TILA) and the Consumer Leasing Act (“CLA”) were made in the ads. In many instances, they were not and that creates another unfair or deceptive practice.
As a refresher, in credit sales, if you advertise any payment amount, the term, amount or percentage of down payment, or the amount of any finance charge, then you must include (the triggered terms) the APR or annual percentage rate using one of those terms, the down payment, and the terms of repayment.
For leases, if you advertise the amount of any payment, a statement of any capitalized cost reduction or even that no up front payment is required ($0 down), then the triggered terms you must advertise are the fact the transaction is a lease, the amount due prior to lease signing or delivery, the number, amount and due dates of payments, and whether or not a security deposit is required.
The FTC always starts by looking for triggered terms in an ad. In this case, they also found that deceptive advertising took other forms. For example, one YouTube ad claimed the featured car “can be in your driveway for only $169 per month.” In fact, consumers can’t buy that car for the advertised monthly payment. That amount applies only to a lease. What’s more, the FTC says the ad didn’t clearly disclose that to get that monthly payment, consumers must shell out $2899 plus other fees at lease signing.
Then there’s the online ad where the company touted an “incentive” discount of $5,250. But buried behind multiple hyperlinks was the fact that the discount was available only to consumers who trade in a 1995 or newer vehicle or terminate a lease from another car company 30 days before or 90 days after delivery. In addition, the lawsuit charges that the dealer’s social media posts failed to disclose required triggered terms.

Takeaways
These two initiatives will almost certainly result in some huge monetary penalties against select dealerships. And both initiatives show that the FTC is prepared to go into new areas and partner with State Attorneys General and other local law enforcement to assemble data against rogue dealerships. You don’t want to be one of those rogue dealerships. Here are some strategies you might want to think about using:

Make certain that the new Used Car Buyer’s Guide is attached to every used vehicle that is being offered for sale on the lot and keep vehicles without the Guide in an area where customers cannot get to them.
Get a hand or electronically completed credit application from each customer and make sure there are no changes made. If a customer wants to change something on the credit app, get them to fill out a new one.
No deal is worth incurring the ire of the FTC. The FTC gets its dealer list to investigate from consumer complaints, referrals from agencies like the Better Business Bureau, and state and local law enforcement. Implement a mediation process so aggrieved customers don’t go to these sources and weight the process in the customer’s favor. An arbitration clause is not binding on the FTC.
Understand the FTC does “mystery shopping” of the entire car buying experience from initial contact to final delivery. Treat every deal as though an FTC officer were sitting across the table because they may be doing so. Honesty, transparency, and doing the right thing for the customer should be a part of your dealership’s operating philosophy.
Remember that fines have increased from $16,000 per violation to $41,484 per violation. FTC settlements in the past year have frequently exceeded $1,000,000 in fines, penalties and customer redress. Something to think about when trying to squeeze the customer in the F&I office.

“Buying a car is one of the biggest purchases consumers make. When consumers tell an auto dealer how much they make and how much they can pay upfront, the dealer can’t turn those facts into fiction,” said Andrew Smith, Director of the FTC’s Bureau of Consumer Protection. “The FTC expects auto dealers to be honest with consumers from the first advertisement to the final purchase.”

0 Comments

Congress Repeals CFPB Auto Finance Guidance: The Compliance Implications for Auto Dealers

6/29/2018

0 Comments

On May 21, 2018, President Trump signed legislation passed by Congress to repeal the Auto Finance Guidance issued by the Consumer Financial Protection Bureau (“CFPB”) in March 2013. The legislation prohibits the CFPB from issuing similar rules or regulations without first obtaining Congressional approval and is a win for auto dealers and lenders everywhere.

The Guidance was an attempt by the CFPB to do an end run around the agency’s lack of authority over auto dealers. By using flawed statistics to claim that dealers and the lenders who bought their consumer finance agreements charged higher APRs (the sell rate) to protected classes of people (race, color, religion, national origin, sex, marital status, age or because a person receives public assistance), the CFPB alleged lenders (over which they do have supervisory and enforcement jurisdiction) violated the Equal Credit Opportunity Act (“ECOA”). Their theory was a “disparate impact” credit discrimination where there is no need to show intent to discriminate, only a negative result in credit terms to protected persons. Disparate treatment requires showing an intent to discriminate.

The Practical Effect of Repealing the Guidance

So, what does the repeal of the Guidance mean for dealers? Is “disparate impact” credit discrimination no longer prohibited? Have ECOA standards for showing discrimination been relaxed? Can dealers let up on documenting their lack of variable pricing to customers from which a disparate impact can be inferred?

The answer is no. ECOA is still the law and the Guidance merely consisted of the CFPB’s interpretation of how rate participation was allegedly abused to cause a disparate impact resulting in higher APRs on protected persons. The U.S. Supreme Court declined in 2015 to rule that “disparate impact” is not a viable cause of action under ECOA. But it will be another agency, not the CFPB, or a private plaintiff that brings the charge. What are some of those agencies?

Start with the U.S. Department of Justice (“DOJ”). The DOJ could make assertions like those in the Guidance, either alone or in concert with federal banking regulators or the FTC, although the 2015 U.S. Supreme Court case made the standard of proof higher. Nevertheless, lenders will continue to be sensitive to the issue and many will continue to want dealers to demonstrate to them that they have a Fair Lending Policy in place (such as the NADA/NAMAD/AIAD Fair Credit Compliance Policy and Program) (“NADA Program”) and can document a “legitimate business reason” for varying a standard dealership rate participation amount to a lower rate because a legitimate business reason is a defense to a disparate impact charge.

The FTC can refer ECOA violation charges to the Department of Justice to bring a civil action for actual or punitive damages and injunctive relief. Actual damages and punitive damages are not to exceed $10,000 per violation. Class action damages are available up to the lesser of $500,000 or 1% of the dealer’s net worth.

Twenty state Attorneys General (“AGs”) indicated they will continue to enforce the Guidance as written in their states as well. Those AGs have direct supervisory and enforcement jurisdiction over your dealership and the Dodd-Frank Act which established the CFPB gives AGs the authority to enforce federal laws such as ECOA as well as state laws. States also have anti-discrimination laws that may be broader than ECOA in terms of the categories of protected persons and provide a lower standard of proof to make a disparate impact credit discrimination claim. State law damages are in addition to federal law damages such as those permitted by ECOA. Most state laws also require a defendant to pay the plaintiffs’ attorney’s fees.

Consumer groups are also taking up the cause. The AFL-CIO and a group of pro-consumer organizations such as the Committee for Better Banks are sending letters to and appearing at Santander Bank’s annual meeting to press the bank to end dealer markups to prevent racial discrimination in auto lending. It can be expected that they will send similar letters to other banks and bank regulators and press a legislative agenda both in Washington and in the statehouses.

“In addition to harming consumers, the racially disparate impact of indirect vehicle lending creates risks to the company’s reputation and exposes the company to potential legal liability,” the AFL-CIO and its partners said in a draft letter provided to Bloomberg News.

The legal liability can also come from plaintiffs’ class action lawyers. Aggrieved consumers have the right to bring actions under ECOA for credit discrimination of any type. While the burden of proof may be higher in the aftermath of the Supreme Court’s 2015 ruling, the costs to defend a class action can be staggering and a successful plaintiff can recover its attorney’s fees and court costs in addition to the damages referenced above.

What’s a Dealer to Do?

First of all, it is important to understand that the liability risk is not diminished by the repeal of the Auto Finance Guidance. The repeal did not affect the requirements of ECOA and the FTC, State AGs, and other parties described above can still bring an action against a dealer for disparate impact credit discrimination if they have reason to believe you are not pricing all customers in a non-discriminatory manner. Lenders will continue to monitor and audit you as well.

If you have established and implemented the NADA Program, continue to monitor and document all finance transactions and note the legitimate business reason any transaction’s APR falls below the standard dealership participation rate. Keep this documentation in the deal jacket as it will be your best defense if a lender or regulator seeks an audit. Be prepared to defend your legitimate business reasons for giving some customers sell rates that are marked up less than other customers.

You can’t legally keep a record of the race or other protected characteristics of a buyer, but you can use the NADA Program to show you treat all persons the same. You give them what you establish as the dealership standard rate participation and adjust it downward (never upward) only when there is a legitimate business reason to do so. The NADA Program lists several legitimate business reasons but there are others you should review with your attorney and include them on the list if acceptable as well.

If you have not implemented a fair lending program, now would be a good time to do so. The NADA Program is available for download online at https://www.nada.org/WorkArea/DownloadAsset.aspx?id=21474838176.

The NADA Program contains a model policy and forms to use. NADA provides online training assistance to its members as well. So do third party compliance providers who may also be able to help you implement your program and policy. With entities such as the AFL-CIO pressuring banks and regulators, it is important that you be able to defend your practices and the NADA Program is the best way I know to do so.

If you have never received a lender’s fair credit audit request or an inquiry by a regulator, consider yourself fortunate. It is very likely to happen at some point in the future. By having the NADA Dealer Participation Certification Form in your deal jackets, you will stand an excellent chance of not having to go through the time and effort that many dealers did in the aftermath of the CFPB’s issuance of the Guidance when lenders were all over dealers about “disparate impact” and compliance.

It was great to see the Congress repeal the Guidance but don’t get complacent about compliance. Do the right thing and follow your anti-discrimination policy and document your doing so. A little time now can save a lot of time and money down the road.

0 Comments

USING 20 GROUPS TO ENHANCE DEALER COMPLIANCE PRACTICES

5/3/2018

0 Comments

20 Groups and dealer trade association meetings can be a great source to obtain information on compliance requirements and best practices. Many aspects of not only business but compliance as well are moving very quickly and your fellow dealers or trade associations can be a good source for what is happening in the real world.

First, a caveat. Discussions among competitors always present an antitrust risk and, for that reason, a knowledgeable antitrust lawyer should be present at the meeting. Discussing best practices for compliance with federal and state laws should not be considered to be any type of conspiracy in restraint of trade but sidebars and other issues that come up may cross the line. Trade association meetings generally have counsel present and your 20 group meetings should as well.

Many compliance issues such as Safeguards programs and Red Flags Identity Theft Prevention Program are risk-based. Assessing risks includes learning the experiences of similarly-situated dealers in your area or elsewhere. Here are some topics that your next 20 Group meeting might want to address to enhance everyone's compliance and risk mitigation especially in this age of regulator activism and real world threats.

Red Flags and Identity Theft Risks - Identity thieves tend to zero in on communities for a short time and use new tricks and deceptions to finance a vehicle. A dealer in Long Island, NY sold and financed a $61,000 Range Rover to an identity thief whose picture was published in a local community newspaper. The thief used a fake New Jersey driver’s license and obviously beat the dealer’s red flags program. It is not known if this individual attempted identity fraud with other dealers but it is certainly a possibility. In Nevada, dealers reported a ring of identity thieves that had two common threads: all of them wanted to buy two vehicles and all came in late in the day or at night.

Equifax’s 2016 data breach of 144 million U.S. residents has made identity fraud a much greater risk with all that information published on the dark Web. As your fellow dealers experience attempted identity theft, sharing the ways, times, and patterns of attempted identity fraud purchases can only help you refine your own Red Flags program and be less likely to become victimized.

Safeguards - Hackers and fraudsters are always staying one step ahead. Zero day attacks are launched every day before security protection software can identify and prevent them. What types of attacks are your fellow dealers seeing? Since the majority of data breaches are caused by socially engineering end users to click on phishing links, reveal passwords, or download malware-laden software, what types of emails and social media schemes are being seen? Are any risks being identified with widely-used DMS systems and what are the solutions? What software and training programs have your members found to be effective? Attempted hacking occurs daily and your 20 group counterparts can be an invaluable source for steps to take or training to incorporate so the hacks can be identified before becoming successful.

Regulator and plaintiffs’ attorney concerns - Most dealers get periodically audited by regulators, particularly State Attorneys General ("AGs). What issues do the regulators seem particularly concerned about? What alleged advertising shortfalls are they citing?

IN 2015, the New York AG shut down an aftermarket credit repair service called Credit or Forget It. Since then, the New York AG has brought a number of enforcement actions against dealers who sold the product, including ordering one dealer to pay in excess of $13 million and two dealers to pay in excess of $1 million in fines and restitution for allegedly payment packing the product to consumers. The aggressive nature of an AG towards particular products or processes is something all dealers should become aware of to guide their own conduct.
The Arizona Attorney General shut down two dealerships and banned their principals from engaging in the auto business in Arizona for unfair and deceptive practices consisting largely of deceptive advertising.
The New York City Department of Consumer Affairs issued regulations concerning used cars that effectively prohibit spot deliveries, provide a 2-day right of consumer cancellation, and other such pro-consumer provisions. Discussing what those regulations do and do not allow can be helpful in dealers avoiding inadvertent violations in a very pro-consumer venue.

The Pennsylvania AG has set up his own mini-CFPB division and the Massachusetts AG has been particularly active in auto financing. The Massachusetts and Delaware AGs entered into a $22 million settlement with Santander Consumer USA essentially for buying dealer contracts with very high default rates. The AGs concluded that this showed Santander was financing car purchases without having a reasonable basis to believe that buyers could afford them which constituted an unfair and deceptive practice.

Shortly after President Trump appointed Mick Mulvaney as the interim CFPB Director, 17 State AGs sent a letter of protest to the President promising that if the CFPB tempered its watchdog behavior, the signing state AGs would "redouble [their] efforts at the state level to root out. . . misconduct and hold those responsible to account."

The Department of Defense’s December 2017 interpreting the Military Lending Act (“MLA”) to apply if GAP and credit insurance products are sold to MLA covered borrowers is another subject that dealers needed to get a handle on quickly given the punitive consequences of not complying with MLA requirements. See our article in this blog for more information on this MLA interpretation.

How about plaintiffs’ attorneys?

It seems that plaintiffs’ lawyers go on suing sprees after conferences and meetings where war stories of success against dealers are publicized. Apart from routine customer disputes, are dealers seeing a pattern of claims and suits such as occurred several years ago after the FCC issued a rule that made sending commercial text messages to a cell phone without a prior written signed consent from the recipient containing magic words a violation of law? With that rule, every noncompliant marketing text message triggered a potential penalty of $1,500 and one large dealer group paid in excess of $2.3 million to settle a class action.

Legislative Affairs - At any given point during a state legislative session, bills that can directly or indirectly affect auto dealers are pending in the state house. It is a good strategy to ask the local dealer association legislative affairs expert to make a presentation to your 20 group to identify such legislation and advise if action such as personal visits to legislators is desirable. The plaintiffs’ bar always has its people working to fit what they consider to be pro-consumer legislation into transportation and appropriations bills. No one wants to get blindsided so make some review of legislative issues a must any time your state legislature is in session.

Manufacturer Issues - You need to be a little careful here lest a manufacturer claim an antitrust violation but many actions of manufacturers can be fair points for discussion. An example is ads that manufacturers push to dealers that touch on credit issues, a subject that I have found few manufacturers understand let alone prioritize. A manufacturer sells vehicles, a dealer sells vehicles and credit and the potential for unfair or deceptive advertising in credit advertising is not something you can count on manufacturers or their ad agencies to address.

One example is conditioning vehicle price discounts on credit standing. I’ve seen many manufacturer ads that require customers to finance with their captive to be able to take advantage of pricing discounts on vehicles. This is not the same as offering discounts to recent college grads or veterans. Under federal Truth in Lending, the additional sums paid by credit-challenged customers (the lost discounts) who are declined by the captive and financed by another lender at the dealership can be considered a prepaid finance charge and must be disclosed as such and factored into the APR. A better approach is to condition the discount on financing through the dealership. This will avoid the circumstance of a consumer losing a credit-based discount if the dealer needs to use a subprime or other lender to finance the consumer without the discount.

Compliance events move quickly and keeping your 20 group members in the loop or brainstorming what compliance requires can be a valuable way to avoid being defrauded by identity fraud or a data breach, or penalized by a regulator for unintended consequences. Make compliance a topic for your 20 group meetings and all participants should benefit from doing so.

0 Comments

IMPLICATIONS FOR AUTO DEALERS IN THE AFTERMATH OF CFPB DIRECTOR RICHARD CORDRAY'S RESIGNATION

2/20/2018

0 Comments

Most of us in the auto finance industry were very happy to see Consumer Financial Protection Bureau (CFPB) Director Richard Cordray resign his position. Despite Cordray's effort to replace himself with a consumer activist clone, the federal courts have affirmed President Trump's appointment of Mick Mulvaney as the Acting Director pending a successor Director being confirmed by the Senate.

Mulvaney's approach to the enforcement powers of the CFPB is quite different from Cordray's. Most significantly, Mulvaney has expressed strong doubts about Cordray's philosophy of regulation by enforcement, the practice by which a target company doesn't know they violated any law or regulation until the CFPB shows up with an enforcement action claiming they did so. We are more likely to see traditional Administrative Procedures Act rulemaking processes of the CFPB publishing notice of proposed rules, giving an opportunity for all affected constituencies to provide comments, and then issue final rules taking the comments into consideration. There is also no indication that Mulvaney will continue Cordray's active efforts to indirectly regulate franchised auto dealers.

The FTC's More Aggressive Role Against Dealers

But that doesn't mean dealers can ease up on compliance activities. The Federal Trade Commission (FTC) became a much more aggressive agency pursuing auto dealers during the past several years and there is no indication that this trend is going to abate. Last year, the FTC entered two consent decrees with auto dealers, imposing penalties of $2.4 million against one dealer and $1.6 million against another. Penalties for FTC Act Section 5 unfair and deceptive practice violations also increased from $16,000 per violation to $40,654 per violation.

Primary violations cited by the FTC consist of unfair and deceptive advertising. Advertising is perennially at the top of the FTC's list of unfair and deceptive dealer practices. The first thing the FTC typically looks at in an ad is whether "triggered" terms required by federal Truth in Lending or the Consumer Leasing Act are clearly and conspicuously disclosed. For credit sales, among other things, if you advertise payment amount, term of payment, or down payment, then you must disclose the others of these along with the APR (advertising APR alone is not a triggering term). For leases, if you advertise payment amount, lease term, the amount due at signing or any capitalized cost reduction, you must disclose the transaction is a lease, the full amount due at lease inception (all-in except for tax and registration), lease payment amounts, and lease term, along with whether or not a security deposit is required. Scrolling or mouse-type disclosures don't cut it. Required disclosures must be such that a reasonable consumer can read and understand them.

One of these cases also marked the first time the FTC had fined a dealer for what it called "yo-yo financing," a term used by consumer advocates for spot deliveries. The FTC also issued a blog to auto dealers, "Don't toy with yo-yo financing." In the blog piece, the FTC described the practice as "Some buyers told us that they financed a car through a dealership, signed a contract, and drove the car home, only to be told that the financing didn't go through and they had to sign a new deal or lose their down payment. There’s a name for that: it’s called a “yo-yo” financing tactic." It was one of a handful of unfair and deceptive practices in the $2.4 million fine case and, given the absence of any FTC prior rule on spot delivery practices, may indicate that regulation by enforcement is very much alive at the FTC.

Payment packing also was cited by the FTC in dealer enforcement actions in 2017. In one case, the dealer was accused of preprinting contracts or addenda with GAP, extended service contracts, vehicle etch or other aftermarket products and indicating either they were required to obtain credit or were free to the consumers.

The FTC described one dealer's payment packing process as follows:

                Information about the add-on products is often included in a stack of lengthy, complex, highly technical documents presented at the close of a long financing process after an already lengthy process of selecting a car and negotiating over its price. Consumers report that Defendants’ employees, in numerous instances, have rushed consumers through the closing process and        have simply indicated to consumers where to sign. In some cases, Defendants have obtained          consumer signatures purporting to indicate assent to purchase add-on products even though                 consumers did not, in fact, authorize the purchase. For instance, a third-party audit found that Defendant . . . required consumers to sign for GAP and service contracts regardless of whether         the consumers were actually purchasing the add-on products. The third-         party audit also found    that other dealerships were having consumers sign blank documents.

The FTC has field agents posing as consumers on site to identify unfair and deceptive practices. For example, a dealer in Arkansas was fined $89,000 for not having Used Car Buyer's Guides displayed on all of its vehicles on its used car lots.

The FTC has an excellent Web site that summarizes its policies and positions on auto dealer conduct and is especially valuable in the advertising context. The site is:

https://www.ftc.gov/tips-advice/business-center/selected-industries/automobiles

Check it regularly to make sure your activities are within FTC guidelines.

State Attorneys General - Your Local Regulator On the Scene

State Attorneys General (AGs) have made clear that they intend to take up the activist consumer protection activities established by the CFPB. The state AGs have tools at their disposal to help them fill any void that may be left by scaled-back CFPB enforcement. The Dodd Frank Act grants state AGs the ability to enforce the Dodd-Frank Act and regulations promulgated under the Act’s authority against entities within their jurisdiction. Section 1042 authorizes state AGs to secure the remedies provided by the Dodd-Frank Act, which include civil money penalties of up to $1 million per day for knowing violations of law. While AGs must give notice of their intended actions to the CFPB and any prudential regulators, the CFPB does not have the power to veto any proposed AG action but only the power to intervene. Several other federal laws such as Truth in Lending and the Fair Credit Reporting Act give State AGs the right to enforce certain provisions as well.

State unfair and deceptive practice laws offer another alternative for relief with penalties in some states that vastly exceed those under federal laws and allow for private rights of action as well. A somewhat dated but good starting place to learn the laws of your state is maintained by the National Consumer Law Center, a consumer activist think tank, at the following Web sites:

https://www.nclc.org/images/pdf/udap/analysis-state-summaries.pdf
https://www.nclc.org/images/pdf/udap/report_50_states.pdf

Pennsylvania has effectively established its own mini-Consumer Financial Protection Bureau under its State AG and Maryland is pursuing a similar initiative. Other states have also been active against auto dealers:

·         New York: AG Eric Schneiderman has prosecuted and settled with dealers for over $15 million in the past three years for deceptive advertising and aftermarket product selling and has convicted a dealer of felony charges regarding the burial of hazardous waste. The New York AG also settled two payment packing suits in December 2017 for restitution totaling $1.6 million. Since 2015, he has obtained more than $17 million in restitution and penalties as part of his office’s crackdown on the practice of “jamming,” or payment packing.

· Massachusetts: The Massachusetts AG entered into a $13 million settlement regarding GAP.

· Washington: The Washington AG sued and settled with a dealer for discriminating against Spanish consumers, misrepresenting finance terms, interest rates, title branding and warranties. The dealer paid $250,000 in its settlement and was forced to provide Spanish translated contracts in the future.

· Delaware and Massachusetts: The Attorneys General of these two states settled with a major financing source for $26 million regarding purchasing retail installment sale contracts for thousands of consumers who could not afford them. These contracts were all originated by auto dealers.

·   Missouri: The Missouri AG settled with a used car dealer for failing to provide titles and complete repair work under service contracts. The dealer will pay $38,067 in restitution to 23 consumers with a potential for an another $46,000 in fines. Additionally, for the next five years, the dealer principal will be prohibited from selling or leasing motor vehicles; accepting any payment for any work selling, leasing or purchasing any motor vehicles; and owning, operating or controlling any businesses engaged in buying, selling or leasing of motor vehicles.

· New Jersey - A New Jersey used car dealer was ordered to pay $693.645.91 in restitution, penalties, and attorney's fees for, among other things, advertising used motor vehicles for sale without disclosing to consumers the vehicle’s prior damage or prior use; selling vehicles “as is” when they qualified for a warranty; and permitting third parties to advertise, offer for sale and/or sell used motor vehicles on Craigslist that were titled to the dealer.

An association of Democratic Attorneys General has made clear that it intends to fill any gap resulting from decreased enforcement by the Trump Administration. DAGA stands for the Democratic Attorney General Association and its statements on its website tell you their goals:

“Our Democratic Attorneys General provide crucial checks and balances on a new federal administration that often refuses to follow the rule of law.”

“Democratic Attorneys General Are The First Line Of Defense Against The New Administration.”

Summary

In case you haven't noticed, the fines and penalties for enforcement violations have multiplied geometrically from years back when $10,000 to $50,000 was more of the norm. Assume six to seven figures plus attorney's fees, management time, and customer ill will as additional costs from a regulatory enforcement proceeding. And the regulator you will probably most often see is your state AG. State AGs have and continue to consider dealer advertising and other misconduct as the "low hanging fruit" to fill state coffers. Consumer complaints, BBB complaints, notices from competing dealers and referrals from the CFPB and FTC who operate online complaint lines are ways that State AGs identify potential targets.   Make sure your Compliance Management System (CMS) has a procedure for addressing and resolving consumer complaints and give the consumer the benefit of all doubts. Easier and more reasonable to pay several hundred or even several thousand dollars to an aggrieved consumer than having a regulator question the transaction and poke around for others in a compliance exam.

So make sure you have a comprehensive CMS and audit the processes and procedures so you can demonstrate your good faith compliance to a regulator. The CFPB may be off the board for a while but the FTC and your State Attorney General are more than making up the enforcement of federal and state consumer protection laws. Be forewarned and forearmed.

0 Comments

DEPARTMENT OF DEFENSE MILITARY LENDING ACT INTERPRETATION PROVIDES RISK TO SELLING GAP TO SERVICE MEMBERS AND DEPENDENTS

12/27/2017

1 Comment

The Military Lending Act ("MLA") is a law enacted by Congress in 2006, and amended in 2013, to protect the rights of service members in certain types of financial transactions. As originally crafted, the MLA covered three types of consumer credit: payday loans, auto title loans, and tax refund anticipation loans. That changed in 2013 when the MLA and regulations were broadened to cover consumer credit generally except for mortgages and certain exempt transactions which include purchase money auto financing secured by the vehicle. The MLA final rules and regulations are issued by the Department of Defense ("DOD") but enforced by the Department of Justice, the Federal Trade Commission, and the Consumer Financial Protection Bureau.
Under the revised DOD regulations effective October 3, 2016, the auto finance exemption covered financing of vehicles and vehicle-related products and services. It has been generally understood that credit insurance and GAP relating to the vehicle financing do not bring the transaction outside of the auto financing exemption. However, if non-auto finance-related items were financed in the transaction, such as would be the case, for example, if the customer took a large amount of cash out of the financing, then the transaction would be covered by the MLA.

What the Military Lending Act Requires
If a transaction is subject to the MLA, federal regulations require detailed disclosure requirements, both written and oral, as well as the calculation and disclosure to the covered service member of a "military APR" in addition to the customary Truth in Lending ("TILA") APR. The military APR adds a lot more things into the "finance charge" and hence the APR calculation such as fees, aftermarket products, GAP costs, and credit related insurance premiums. If including these things along with traditional finance charges creates a military APR of over 36%, the transaction is void and prohibited.

Mandatory disclosures under MLA regulations.
In addition to disclosing both the military APR along with the TILA APR, you must disclose in writing "a clear description of the payment obligation." The regulations also give a 110-word model statement essentially describing the military APR. This, or some substantially similar disclosure, must also be given. Additional oral disclosures (which may be made either personally or by using a dedicated toll-free telephone number) are another requirement. If you use the toll-free number, its number must be on the credit application or the written disclosures. In either event, you will need to effectively document your giving the written and oral disclosures in the deal jacket.
If this seems like a difficult process for your everyday sales or f & i manager, you are correct.
It is also difficult to identify who is a "covered borrower" under the MLA to whom the law applies The term is not synonymous with the general definition of “service members” and their dependents under the Service Members Civil Relief Act (e.g., dependents are more broadly defined for purposes of the MLA).
However, there is a “safe harbor” way to determine whether an individual is a MLA covered borrower. The individual can be checked against the DOD’s online database (for new transactions only) at https://mla.dmdc.osd.mil/mla/#/home and then link from there to https://mla.dmdc.osd.mil/mla/#/single-record for entry of one person. Alternatively, a dealer can get the person’s status as an MLA covered borrower from a national consumer reporting agency in connection with their credit report. Check with your credit report provider who may impose an additional charge for this notation but getting the covered borrower status on a credit report seems to be the easier way to go.

Department of Defense Changes to MLA Motor Vehicle Financing Exemption
On December 14, 2017, the DOD issued its second interpretation of the Military Lending Act. Its first interpretation which took effect October 3, 2016 issued revised regulations in response to MLA statutory amendments in 2013. As noted above, it effectively clarified that the exemption from the MLA for purchase money auto financing credit secured by the vehicle generally included within the exemption advances for financing items related to the vehicle which included credit insurance and GAP.
DOD’s second interpretation indicated a transaction was exempt from the MLA “that finances the [vehicle] itself and any costs expressly related to that [vehicle]. . . provided it does not also finance any credit-related product or service.” This means if the auto financing transaction includes GAP or credit insurance, the whole transaction is arguably outside of the exemption and subject to the MLA. The DOD further stated that its second interpretation did not change the original regulations that took effect in October 2016, but merely stated DOD’s "pre-existing interpretations an existing regulation." This puts at risk any vehicle financing transaction beginning October 3, 2016 that financed credit insurance or GAP for an MLA covered borrower but which does not comply with the MLA’s extensive disclosure requirements or fails to disclose the “military APR” complex calculation which is capped at 36%.

MLA Penalties for Non-Compliance
Since financing of credit insurance or GAP now may put a transaction outside of the MLA exclusion for purchase money auto financing, substantial penalties for violating the MLA could apply to non-MLA conforming transactions, both looking back to October 3, 2016 and looking forward. These penalties include federal criminal misdemeanors imposing fines and up to one year in prison for knowing violations; voiding of contracts from inception; civil liability of actual damages or $500 statutory damages recoverable in class actions; punitive damages; costs and attorney’s fees. The MLA expressly forbids and will not enforce arbitration clauses and requires other protections for the MLA covered borrower as well.

Possible Actions in Response to the DOD's December 2017 Interpretation
Until legislative, judicial, or agency clarification can be obtained, it appears dealers have two options. One is to simply not offer credit insurance or GAP to any customer which will avoid the MLA problem totally.
The second alternative is not to offer credit insurance or GAP to MLA covered borrowers. This means you will have to check every customer using one of the "safe harbors" described above (DOD MLA site or a credit report indicating the person's MLA status) before selling them GAP or credit insurance. Do so at the time the consumer submits a credit application or within 30 days earlier if, for example, you are doing a pre-screening mailing. Document your doing so in the deal jacket.
At least 11 states have military anti-discrimination statutes. Each state interprets its law differently. In response to a claim of military discrimination for not selling GAP to MLA covered borrowers, the dealer could argue that it has a legitimate business interest in not doing so. The legitimate business interest would be not wanting to incur the excessive compliance costs imposed by the federal government (principally oral disclosure requirements and calculation of the military APR) to be able to sell these products to MLA covered borrowers. I don't believe this argument--which derives from successful cases under the federal Equal Opportunity Act charging disparate impact discrimination on federally protected classes of people--has been tested under any state's anti-military discrimination act case. Plus each state's law is different. Consult your local attorney or compliance professional on the law in your state to get a sense of whether a "legitimate business interest" is a defense to alleged credit discrimination against protected military members under your state's law.

Summary and Conclusion
There are good arguments to be made that the DOD exceeded its authority in issuing the December 2017 interpretation and trying to make it retroactive. It did not publish proposed regulations or seek comments for this new "interpretation" which sure seems like a regulation. It's attempt to give it retroactive effect is also very dubious. These arguments, and others, will be raised in court cases or before the agency. But you don't want to be the one who has to incur the expense to do that.
I think the approach of offering GAP and credit insurance to every customer except a safe harbor-checked MLA covered borrower is the best business approach, subject to a state anti-military lending discrimination statute that might suggest otherwise. The legitimate business defense in not incurring the compliance cost and burden of MLA transactions seems reasonable to me.
Also, lobby your Congress people and state legislators on this one. Dealerships near large military bases stand to lose a lot of revenue if the DOD's interpretation is legitimized. I know NADA will work this issue hard in Washington and hopefully a more rational interpretation that GAP and credit insurance on a vehicle financing transaction do not risk the auto financing MLA exemption will prevail.

1 Comment

INDIVIDUAL SUED IN PERSONAL CAPACITY FOR AUTO LENDER VIOLATIONS

12/13/2017

0 Comments

12/13/17 REUTERS LEGAL 01:17:58
REUTERS LEGAL
Copyright (c) 2017 Thomson Reuters
December 13, 2017
Judge rejects tribal immunity for manager of auto lender
Dena Aubin
(Reuters) - A former co-manager of a tribal lender accused of collecting illegally high interest rates cannot escape the lawsuit against him by claiming tribal sovereign immunity, a federal judge in Philadelphia ruled.
In a decision on Monday, U.S. District Judge Gerald Pappert said Craig Mansfield, former co-manager of Michigan-based Sovereign Lending Solutions, was not protected by an Indian tribe's immunity because he was sued in his individual capacity.
An auto lending arm of the Lac Vieux Desert Band of Lake Superior Chippewa Indians in Michigan, Sovereign Lending closed its business in 2014.
Philadelphia resident Daniel Pennachietti sued Mansfield in June, alleging that he was charged triple-digit interest rates on an auto loan he took out in 2013 from the lender. Pennsylvania caps rates at 6 percent for unlicensed lenders, according to Pennachietti's lawsuit.
The lawsuit alleged that Mansfield ran the day-to-day operations of Sovereign Lending, directed it to collect unlawfully high interest rates, and ordered the repossession of vehicles when the illegal interest was not paid.
The lawsuit is asking for triple damages under the U.S. Racketeer Influenced and Corrupt Organizations (RICO) Act, which bars the collection of unlawful debt. RICO imposes personal liability on individuals who operate an enterprise that collects unlawful debt, Pennachietti's lawsuit said.
James Williams, chairman of the Indian tribe, said in an email that the tribe is exploring all options, including an appeal.
"The tribe will continue to take necessary steps to defend its interests and protect its sovereignty and its current and former employees," he said.
Robert Salvin, a lawyer for Pennachietti, said Indian tribes "are doing a lot of unlicensed, illegal, usurious lending, using tribal immunity as a shield."
Pennachietti's complaint said his sports utility vehicle was repossessed by Sovereign Lending in 2014 after he was late on a final balloon payment of $6,696 on a $5,050 loan. Pennachietti said he had already paid over $6,300 and had to pay another $7,000 to get his vehicle returned.
Mansfield, a Wisconsin resident and member of the tribe, had asked the court to dismiss the complaint in June, asserting that the tribe's immunity extends to tribal employees when they are acting in their official capacity.
Mansfield said he had no individual liability because he did not act independently, and any employee in his role would have performed his duties in essentially the same way.
In response, Pennachietti said Mansfield is not entitled to immunity under the recent U.S. Supreme Court decision in Lewis v. Clarke, in which the high court held that tribal immunity does not protect an individual from personal liability arising from the course of tribal employment.
In Monday's decision, Pappert agreed that tribal immunity does not apply.
"What matters is not the capacity in which Mansfield acted while employed by Sovereign, but rather the capacity in which he is currently being sued," Pappert said. Because the lawsuit is asking the court to impose only personal liability on Mansfield, he is not entitled to tribal immunity, the judge said.
The case is Pennachietti v. Mansfield, U.S. District Court, Eastern District of Pennsylvania, No. 17-2582.
For the plaintiff: Robert Salvin at Philadelphia Debt Clinic and Consumer Law Center
For the defendant: Joel Frank at Lamb McErlane and Justin Gray at the Rosette law firm
---- Index References ----
Company: JUDGE GROUP INC (THE)
News Subject: (Judicial Cases & Rulings (1JU36); Legal (1LE33); Liability (1LI55))
Industry: (Banking (1BA20); Financial Services (1FI37); Loans (1LO12); Retail Banking Services (1RE38))
Region: (Americas (1AM92); Asia (1AS61); Indian Subcontinent (1IN32); Michigan (1MI45); North America (1NO39); Pennsylvania (1PE71); Southern Asia (1SO52); U.S. Mid-Atlantic Region (1MI18); U.S. Midwest Region (1MI19); USA (1US73))
Language: EN
Other Indexing: (Sovereign Lending Solutions) (James Williams; Craig Mansfield; Daniel Pennachietti; Robert Salvin; Gerald Pappert; McErlane; Joel Frank; Justin Gray)
Keywords: banking; fedlit (N2:USA); (OCC:OLRTXT); (N2:US)Keywords:

0 Comments

COMPLIANCE 2017 AND A LOOK AHEAD TO 2018

12/4/2017

0 Comments

2017 brought a lot of changes in the compliance landscape and more are likely to come in 2018. Let's review some of the high and low points of the past year and look ahead.

Perhaps the most important development was the Congress' repeal of the Consumer Financial Protection Bureau's ("CFPB") Arbitration Rule. The Rule was published by the CFPB in June and would have prohibited waivers of class action rights in virtually all consumer finance contracts. Fortunately, the Congress used its authority under the Congressional Review Act to repeal the Arbitration Rule in November and President Trump signed the repeal. The CFPB's own studies revealed that consumers fare better in arbitration than class actions, the only beneficiaries of which seem to be trial lawyers.

Richard Cordray stepped down as CFPB Director in November 2017. After his attempt to appoint his successor failed in the courts, President Trump appointed Mick Mulveney, the OMB Director and a frequent CFPB critic, to be the Acting Director until a replacement for Cordray is named and confirmed by the Senate.

Before you get too excited about the coming direction of the CFPB, you should know that the FTC and State Attorneys General took very tough enforcement actions against dealers in 2017 for advertising violations and deceptive trade practices. They will likely continue to do so in 2018.

FTC Activity in 2017

The FTC assessed a $1.4 million penalty against a 12-store California group for violating a 2014 consent decree relating to unfair and deceptive advertising. As with similar two time violators, the penalties were harsh and the violations did not match those for which the initial consent decree was issued.

The FTC's complaint--along with several others it filed in 2017--led with what is becoming its leading charge against dealers which is the failure to disclose terms required by Truth in Lending and the Consumer Leasing Act to qualify misleading headlines in advertisements. To review once more, if a credit ad discloses payment amount, term of obligations, down payment or finance charges, it must disclose all of those (except for finance charges) plus the APR. If a lease ad discloses the lease payment or amount of capitalized cost reduction or payment due at lease signing, it must disclose that the transaction is a lease, lease payment amounts, the number of lease payments, the amount due at lease signing (all-in), and whether or not a security deposit is required. Back-end lease obligations and allowable mileage and excess mileage fees may also be required by federal or state law and should be included as well. Be careful advertising payment amounts as that is the triggering term that seems to catch dealers in most of the cases

State Attorneys General Activity in 2017

Attorneys General come in two varieties: Democrats and Republicans. DAGA stands for the Democratic Attorney General Association and its statements on its website tell you their goals:
“Our Democratic Attorneys General provide crucial checks and balances on a new federal administration that often refuses to follow the rule of law.”
“Democratic Attorneys General Are The First Line Of Defense Against The New Administration.”

Democratic AGs will maintain many of the policies of the CFPB. For example, California is considering its own disparate impact enforcement. Pennsylvania has created its own mini-CFPB to help consumers deal with claims against auto dealers and other creditors.

DAGA members have taken strong actions against dealers in the past few years:

· New York: AG Eric Schneiderman has prosecuted and settled with dealers for over $15 million in the past three years for deceptive advertising and aftermarket product selling and has convicted a dealer of felony charges regarding the burial of hazardous waste.
· Massachusetts: The Massachusetts AG entered into a $13 million settlement regarding GAP.
· Washington: The Washington AG sued and settled with a dealer for discriminating against Spanish consumers, misrepresenting finance terms, interest rates, title branding and warranties. The dealer paid $250,000 in its settlement and was forced to provide Spanish translated contracts in the future.
· Delaware and Massachusetts: The Attorneys General of these two states settled with a major financing source for $26 million regarding purchasing retail installment sale contracts from thousands of consumers who could not afford them. These contracts were all originated by auto dealers.

The corresponding organization to DAGA is the Republican Attorneys General Association or RAGA. RAGA members are generally supportive of the Trump administration. But all Attorneys General are required to discharge their legal responsibilities which include responding to consumer complaints. Consumer complaints against auto dealers are generally within the top three classes of complaints AGs receive each year.

New Risks to Dealers
Regulatory action in 2018 could also be manifested in new ways:

Autonomous Vehicles and Franchise Dealers: Autonomous vehicles have been attracting a great deal of attention from software companies like Apple and Google that are not traditionally affiliated with the automobile industry. A number of these companies are attempting to fashion artificial intelligence, which will drive vehicles without the need of a human driver.

It is also rumored that these software companies are quietly lobbying Congress to enact legislation, which would allow them to bypass franchise law and sell these vehicles directly to the public. The FTC has already welcomed this idea. If Congress enacted such a law, it could override state franchise law pursuant to the Commerce Clause of the U.S. Constitution.

An “All In” 36% APR: In November 2016, South Dakota voters approved a referendum which bars licensees from contracting for or receiving greater than a 36% maximum finance charge on financing. The finance charge calculation, as in the Military Lending Act APR calculation (MAPR), is an “all-in” calculation, and would include all interest, fees, and charges, including any ancillary products or services.

A violation of the 36% finance charge cap is deemed void and uncollectable, and the financing source could face a criminal misdemeanor charge as well. Adding products such as GAP, service contracts, and other ancillary products very quickly may increase the interest rate beyond the 36% cap. This means that dealers will have less opportunity to sell ancillary products to their customers. Profit opportunities will be lost and consumers will have fewer options.

Creditor Liability in Underwriting: As the Delaware and Massachusetts case showed, regulators may be targeting creditors for not denying credit to those consumers who will, most likely, default on their retail installment sale contracts or lease contracts.

Dealers should recall that they are creditors by law and share in this potential liability. In other words, dealers and financing sources may be liable for advancing sales when the consumer’s ability to discharge their contractual obligations is limited. The law used for these prosecutions is the familiar unfair and deceptive trade practices act (UDAP), which grants federal and state regulators great leeway and flexibility and can provide significant financial penalties such as the $1.4 million levied against the 12-store California group by the FTC.

ADA-Compliant Websites: Groups of consumer lawyers are filing lawsuits against companies whose websites are not compliant with the Americans with Disabilities Act. Courts have held that websites are "places of public accommodation" and despite a lack of regulations from the Department of Justice, websites may have to comply with an industry standard such as the Web Content Accessibility Guidelines (WCAG) 2.0 level AA. This standard is based on four principles. Websites should be: (1) perceivable; (2) operable; (3) understandable; and (4) robust for people with disabilities. Such persons should be able to perceive website content using their available senses and a variety of assistive technologies, understand the content and how to operate the website, and websites should continue to be compatible as technology improves. Courts have gone both ways on this issue and it will be one to watch for in 2018.

What we saw in 2017 included substantial increases in fines for violations, more aggressive enforcement action by the FTC and Attorneys General, and new issues on the horizon. Expect more of the same in 2018

_________________

0 Comments

THE EQUIFAX SECURITY BREACH AND ITS IMPLICATIONS FOR YOUR DEALERSHIP

10/11/2017

0 Comments

On September 7, the credit bureau Equifax revealed that it had undergone a massive security breach that compromised the names, addresses, birthdates, Social Security numbers, and in some cases drivers license numbers of approximately 143 million U.S. consumers. The compromise creates a potential treasure trove for identity thieves and will have effects on your dealership, now and in the future. Let's consider a few of them and how you might deal with the situation.

Consumer Inquiries and Credit Freezes

Many consumers will be nervous about sharing personal information with dealerships. You will want to explain to them that the data breach came from Equifax, not your dealership, and that you maintain effective safeguards to protect customer non-public personal information (NPI) in both physical and electronic form (you do, don't you?). If your dealership has never suffered a data breach (or is not aware of having suffered one), assure the consumer with that fact as well.

Many consumers will put fraud alerts and security freezes on their credit files. A fraud alert requires you to contact the consumer in the manner specified by the fraud alert (you should document doing this). A security freeze locks down the customer's credit file so you can't access it without the consumer giving the credit bureau a PIN that was issued to them at the time they froze the security file. Most likely, the consumer will not have brought their PIN to the dealership.

In the past, consumers would have to contact the credit bureau and wait to be mailed a new PIN. However, as of this writing, consumers can now recover their PINs and temporarily thaw their credit files by calling the consumer affairs numbers at Trans Union (800-916-8800) and Equifax (866-349-5191) or going online to Experian at https://www.experian.com/ncaconline/freezepin. Two words of caution. There may be a long wait time for the customer to get their PIN and the credit bureaus may change these phone numbers and webpage to do so at any time. If possible, have the consumer use their personal smart phone to do this so it does not appear that your dealership took action to access a customer's PIN.

Red Flags Issues

The access of 143 million consumers' NPI is almost certain to increase the incidence of attempted identity thefts at your dealership, whether now or in the future. Identity thieves warehouse stolen personal information and may sell it on the "Dark Web" as long as years later. So this might be a good time to dust off your Red Flags program, retrain your sales and f&i people, and heighten your customer identification procedures. If an identity thief obtains and finances a vehicle from an auto dealer, you will be the ultimate loser.   The creditor will in all likelihood make you repurchase the contract and the vehicle will be long gone, often sent to a "chop shop" for parts or exported out of the country. The longer it takes to discover the identity theft (the customer not making the first scheduled payment is often the initial clue), the less likely you will be able to recover the vehicle.

So what's a dealer to do? Revisit your dealership's red flags and make sure that you raise your due diligence on any discrepancies from your customer identification service (you do use a customer identification service, don't you?) to satisfy the red flags that are identified. If a customer's full identity is being used by the thief, chances are you will get a valid Social Security number, date of birth, and address. And possibly a valid driver's license number as well. One way to enhance this process is to ask the customer to provide additional information such as previous addresses and employers and see if your customer identification service can evaluate those as well.

Compare all physical documents carefully. Does the driver's license appear forged in any way or does the customer not appear to be the age of the named consumer? Does any of the information on the credit application not match what your customer identification service reports. If so, find out why and try to get documentation to support the answer. For example, if there is an address discrepancy, most utility companies have online accounts from which a customer can access an electronic utility bill. Get one and keep it in the file.

It would be prudent to ask knowledge-based authentication questions (also called out-of-wallet questions) to every credit applicant. These questions are available from your customer identification service and ask things that would not appear in a credit file such as related persons, prior addresses and their location, and vehicles the customer has owned. If the customer doesn't answer them all correctly, get another set. You may want to explain to the customer why you are doing this--to protect their identity and those of other customers and that it is not because you don't believe the customer, even if you don't.

Talk with the customer and try to get a sense of whether they may be lying. Identity thieves are typically in a rush to complete the transaction, will be amenable to paying a favorable price for the vehicle--perhaps making the deal literally too good to be true--and want to finance close to 100% of it (identity thieves don't pay in cash). They may do things like answer questions with questions, repeat themselves, give inconsistent answers, or become aggravated and flustered. Asking the customer questions that you don't know the answer to but which the customer thinks you do (where did you go to high school? what was your high school's mascot?) can also make an identity thief uncomfortable. Watch for signs and trust your instincts. Many identity thieves will just walk out rather than go through an extended questioning process.

A word about Internet sales. Now more than ever, you want the customer to come to your store so you can speak with them. An identity thief on the Web may have the real person's credit report right in front of them and it will be more difficult to establish their identity without making an in-person connection. For this reason, more identity theft transactions occur online than face-to-face. Adopt a policy of requiring the customer to come to the store even if it is only to pick up the vehicle, prior to which you can engage in your Red Flags due diligence personally with the customer.
Resolving Tough Red Flags Cases

You should involve your Red Flags Program Manager (you do have one, don't you?) in any situations where Red Flags appear and cannot be quickly resolved. The Program Manager should also speak to the customer. Remember that identity thieves, who often come in at the end of the month near the end of the day to make a quick sale, want to get in and out quickly and the longer you can speak to them and get a feeling about their legitimacy, the more likely they may just get up and leave the store. That is not a lost sale; that is a saved identity fraud transaction.

The Equifax breach may also cause larger numbers of "synthetic identity thieves." These are persons who use a valid Social Security number with a different name and address and establish a thin but current credit file (it is very easy to do). These require particular diligence. If your customer identity verification service raises any questions about the legitimacy of this customer with the Social Security number (probably the number one Red Flag), here is a way you can address it:

Every person can establish an electronic account on the Social Security Administration's website, www.ssa.gov. In fact, this is the only way you can get your Earnings Statement as the Social Security Administration doesn't mail them out any more as they did in the past unless you go on the site and request a copy to be mailed to you. Have the customer use their own device (smart phone, tablet) and not a dealer device to pull up their Social Security earnings statement and show it to you. Don't make a copy. Just look it over to see that it is legitimate for the customer.   If the customer is a synthetic identity thief, they will be unable to do this and that request may cause them to leave. Credit bureaus set up many people with the same Social Security number but only the real person with the number should be able to access their account on the Social Security website. Again, use technology to smoke out or verify someone whose information suggests they may not be who they claim to be.

If you haven't done Red Flags training, now would be a good time to do so. The Equifax breach will only make the process more difficult especially with identity thieves looking to purchase and finance a vehicle. Also, the Red Flags Rule requires you to report to your Board or senior management at least once a year on the program and update your Red Flags and Identity Theft Prevention Program as well. The Equifax breach has given you cause to do both. Good luck.
__________________

0 Comments

<<Previous

Forward>>

Author

Randy Henrick is a leading auto industry compliance consultant. This article is not intended as legal or compliance advice due to the unique nature of a dealer's situation in each state. Randy's articles do provide issues and best practices that you may want to discuss with your attorney or compliance advisor for possible adoption in your dealership. Email Randy at AutoDealerCompliance@gmail.com
Follow us on Twitter @randyh44

​

Author

Archives