InfoBytes Blog
New York Financial Services Regulator First To Sue Under Dodd-Frank's UDAAP Provisions
On April 23, New York State Department of Financial Services (NYS DFS) Superintendent Benjamin Lawsky became the first state regulator to sue a financial services company to enforce the Dodd-Frank Act’s Title X prohibitions against unfair, deceptive, and abusive practices (UDAAP). Last month, Illinois Attorney General Lisa Madigan filed what appears to be the first suit by a state attorney general to enforce Dodd-Frank’s UDAAP provisions. Although state authorities generally are limited to enforcing Title X against state banks and non-bank financial service companies—except that state attorneys general may enforce rules of the CFPB against national banks and thrifts—these actions bring into sharp focus the full scope and reach of the Title X’s enforcement provisions and are likely to inspire similar state actions.
Mr. Lawsky’s complaint accuses a nonbank auto finance company of violating Sections 1031 and 1036 of the Dodd-Frank Act, as well as Section 408 of the New York Financial Services Law and Section 499 of the New York Banking Law by, among other things, “systematically hid[ing] from its customers the fact that they have refundable positive credit balances.” The complaint alleges that the company concealed its customers’ positive account balances—from insurance payoffs, overpayments, trade-ins, and other reasons—by programming its customer-facing web portal to shut down a customer’s access to his or her loan account once the loan was paid off, even if a positive credit balance existed. The company allegedly failed to refund such balances absent a specific request from a customer. In addition, the complaint charges that the company hid the existence of positive credit balances by submitting to the New York State Comptroller’s Office false and misleading “negative” unclaimed property reports, which represented under penalty of perjury that the company had no unrefunded customer credit balances.The complaint claims that DFS’s examination findings for the company “demonstrate the persistent refusal and failure of [the company] and its owner . . . to implement even the most basic policies, procedures and controls necessary to manage a $300 million, state-licensed lending institution.” Further, Mr. Lawsky asserts that the company rejected “virtually all of those findings” and ignored or refused, based largely on economic considerations, to comply with written directives to institute proper policies, procedures, and controls.
In addition to being the first of its kind, the suit is notable for several other reasons. First, the suit names the company’s individual owner and CEO. Mr. Lawsky recently urged financial services regulators to consider taking more actions against individuals. His remarks added to a trend among regulators and enforcement authorities to more aggressively pursue individual alleged bad actors. In the complaint, Mr. Lawsky argues that “as the person responsible for oversight of [the company’s] operations and for setting and effectuating policies” the owner caused the company to adopt a policy of “stealing, converting, and retaining for its positive credit balances belonging to its customers.”
Second, Mr. Lawsky claims that certain of the alleged practices violate Dodd-Frank’s prohibition against “abusive” acts or practices. Although defined in the statute, the government has yet to provide additional guidance as to which acts or practices might be considered “abusive.” For instance, the CFPB, which has authority to draft regulations defining abusive practices, has declined to do so. Instead it has elected to develop the abusive standard through enforcement, most recently in an action against a for-profit educational institution, though no court has yet ruled on what constitutes an abusive practice.
Third, Mr. Lawsky filed the suit with the help of an outside plaintiffs’ firm. The practice of state agencies hiring outside counsel to represent them in investigations has been the subject of lawsuits and criticisms. The practice has been criticized in part because it creates an incentive for the outside lawyers to find violations in order to be paid. It also has been the subject of litigation where the law firm assisting the agency also represented other clients adverse to the target of the investigation.
Fourth, the complaint alleges that the finance company violated Section 1036 with regard to its data security and privacy practices and representations. Mr. Lawsky claims that the finance company falsely represented to its customers, in connection with servicing automobile loans, that it implemented reasonable and appropriate measures to protect borrowers’ personal information against unauthorized access. Instead, the complaint charges the company failed to take such reasonable and necessary actions and/or expend resources necessary to provide such protection, and in doing so took unreasonable advantage of (i) the inability of its customers to protect their own interests; and (ii) the reasonable reliance by its customers on the company to act it their interests.
Finally, the suit demonstrates the significant level of regulatory and enforcement activity originating from the NYS DFS. In recent months, Mr. Lawsky has moved to exercise the full scope of his authorities and has positioned himself at the forefront of numerous financial services issues, including, for example, by: (i) developing a regulatory framework for virtual currencies; (ii) aggressively supervising mortgage servicing rights transfers; (iii) obtaining a substantial settlement in a state licensing enforcement action; and (iv) conducting an expansive investigation related to online payday lending.