Managing Evolving CFPB Regulatory Risk through Effective Change - PowerPoint PPT Presentation

Managing Evolving CFPB Regulatory Risk through Effective Change Management Click to edit Master title style June 17, 2015 Click to edit Master subtitle style DISPUTES & INVESTIGATIONS ● ECONOMICS ● FINANCIAL ADVISORY ● MANAGEMENT CONSULTING Strictly Private & Confidential D I S P U T E S & I N V E S T I G AT I O N S • E C O N O M I C S • F I N A N C I A L A D V I S O R Y • M A N A G E M E N T C O N S U LT I N G D I S P U T E S & I N V E S T I G AT I O N S • E C O N O M I C S • F I N A N C I A L A D V I S O R Y • M A N A G E M E N T C O N S U LT I N G DISPUTES & INVESTIGATIONS ● ECONOMICS ● FINANCIAL ADVISORY ● MANAGEMENT CONSULTING

Presenting to You Today Jonathan L. Pompan Venable LLP Partner and Co-Chair of CFPB Task Force 202.344.4383 jlpompan@Venable.com Christopher P. Sicuranza Navigant Consulting Managing Director and Banking Services Leader 202.973.6545 csicuranza@navigant.com Page 2 Strictly Private & Confidential

Introduction Rapid Pace of Regulatory Change • • CFPB and Other Regulatory Drivers of Expectations • Compliance Management System • The Evolving Regulatory Environment Poses a Significant Challenge • Regulatory Change Management Deployment • Key Challenges and Opportunities • Questions Page 3 Strictly Private & Confidential

Rapid Pace of Regulatory Change Consumer Financial Protection Bureau (FY 2016) — 1,690 FTE (Projected) • o Supervision, Enforcement, and Fair Lending — 747 FTE o Budget — $171,691,956 Percent of American Families that Rely on One or More Financial Product Source: CFPB Strategic Plan (Feb. 2015) Page 4 Strictly Private & Confidential

Rapid Pace of Regulatory Change Supervision and Enforcement Financial Recent Rulemaking Activity Results (Between Oct. 1 – March 1, 2015) • Small Dollar/Payday Rule Proposal • Supervision • NPRM for Prepaid Market – would require • $114 million in consumer redress to prepaid companies to limit consumers’ over 700,000 consumers losses when prepaid funds are stolen or • Enforcement cards are lost, investigate and resolve errors, • $19 million in consumer redress provide easy and free access to account (plus $480 million in student loan information, and adhere to credit card forgiveness to Corinthian students) protections if a credit product is offered in • $32 million in civil money penalties relation to a prepaid account. • Proposals to Amend Various Mortgage Consumer Complaints (July 2011-March Servicing Rules 2015): 582,600 Several reports and other publications • Medical debt • Snapshot of complaints on reverse mortgages • Consumer perspectives on credit scores and credit reports • Consumer arbitration and “Know Before You Owe” mortgage toolkit Page 5 Strictly Private & Confidential

Rapid Pace of Regulatory Change (cont’d) Debt Collection Market Highlights Education Market Highlights • • Debt collection rulemaking • Debt collection practices • Bulletins • Lending practices (UDAAP) • Furnishing • Servicing • Supervision and Enforcement What’s next? General Trends of Note • • Supervisory Reports of • Auto Lending Market Highlights Examination • Supervisory Exams • Appeals Process • Fair Lending Focus • Advertising and Marketing What’s next? Payment Processing • • • Debt Collection • Small Dollar/Payday Lending • Focus on Advertising/Lead Generation Rulemaking Proposal • • What’s next? Page 6 Strictly Private & Confidential

CFPB and Other Regulatory Drivers of Expectations Page 7 Strictly Private & Confidential

CFPB and Other Regulatory Drivers of Expectations CFPB and UDAAP Page 8 Strictly Private & Confidential

Compliance Management System – Role and Benefits A compliance management system is how a supervised entity: • Establishes its compliance responsibilities; Communicates those responsibilities to employees; • • Ensures that responsibilities for meeting legal requirements and internal policies are incorporated into business processes; • Reviews operations to ensure responsibilities are carried out and legal requirements are met; and Takes corrective action and updates tools, systems, and materials as • necessary. An effective compliance management system commonly has four interdependent control components: Board and management oversight; • • Compliance program; • Response to consumer complaints; and • Compliance audit. Page 9 Strictly Private & Confidential

The Evolving Regulatory Environment Poses a Significant Challenge High Cost of Operationalizing and High Cost of Operationalizing and Shifting Regulatory Landscape Shifting Regulatory Landscape Increased Enforcement Actions Increased Enforcement Actions Maintaining Compliance Maintaining Compliance Numerous regulatory changes since  Volume of enforcement actions is Numerous updates need to be made to   Dodd-Frank Act in 2010 increasing (CFPB enforcement actions remain compliant, often concurrently increased by 29% from 2013 to 2014)  Regulations origination from various  Areas requiring updates include: sources (CFPB, FRB, OCC, states)  Enforcement actions have resulted in Business Processes • fines and remediation to customers in Systems •  In addition to federal regulations, the millions and even billions Reporting • changing state laws have become more Policies and Procedures • complex to manage Controls • Complex Legacy Systems Complex Legacy Systems Difficulty Demonstrating Compliance Difficulty Demonstrating Compliance Managing Ongoing Compliance Managing Ongoing Compliance Institutions must be able to identify Complex legacy systems resulting from Regulators require increased    changes to laws and regulations to earlier acquisitions transparency into proving compliance maintain compliance  Require additional work to ensure  Expectation for sufficiently documented  Changes to laws and regulations may regulatory compliance across multiple compliance process require updates and revisions to systems various business processes Page 10 Strictly Private & Confidential

Deploy an End-to-End Regulatory Change Management Process to Address Evolving Landscape Determine Determine Understand Understand Maintain and Maintain and 1 2 Impact, Link Impact, Link 3 Test Test 4 Remediate Remediate 5 Requirements Requirements Communicate Communicate and Prioritize and Prioritize  Identify sources of  Identify sources of  Identify and link  Identify and link  Test Design  Test Design  Update processes,  Update processes,  Deploy updated  Deploy updated regulatory requirements regulatory requirements impacted business impacted business procedures, and controls procedures, and controls processes, procedures, processes, procedures, • Determine whether the • Determine whether the processes, systems, processes, systems, to address any gaps in to address any gaps in and controls to address and controls to address procedures and procedures and  Compile and centralize  Compile and centralize controls, and procedures controls, and procedures design and / or design and / or any gaps in design and / any gaps in design and / controls are designed controls are designed applicable regulatory applicable regulatory effectiveness effectiveness or effectiveness or effectiveness to mitigate risk and to mitigate risk and requirements requirements  Determine the risk rating  Determine the risk rating ensure compliance ensure compliance Actions Actions  Communicate with  Communicate with  Translate as appropriate  Translate as appropriate  Prioritize regulatory  Prioritize regulatory impacted parties and impacted parties and  Test Effectiveness  Test Effectiveness requirements by risk requirements by risk business units for business units for • Determine whether the • Determine whether the rating rating ongoing monitoring ongoing monitoring procedures and procedures and controls in place are controls in place are effective effective  Regulatory  Regulatory  Impacted parties and  Impacted parties and  Current state  Current state  New and enhanced  New and enhanced  Changes to procedures,  Changes to procedures, Requirements Requirements business units business units assessment of design assessment of design procedures, processes, procedures, processes, processes, and controls processes, and controls Outputs Outputs and effectiveness and effectiveness and controls and controls  Risk rating and priority  Risk rating and priority regulations regulations  Gaps  Gaps Page 11 Strictly Private & Confidential