iOn December 11, 2012, the U.S. Senate passed House Bill 4014 (HR 4014) without amendment and sent it to the President for signature. HR 4014 is the long-awaited and much sought after legislation that amends the Federal Deposit Insurance Act (FDIA)1 in order to protect banks2 and non-banks3 that are subject to the Consumer Financial Protection Bureau’s (CFPB or Bureau) supervision and examination authority from unintended waiver or destruction of a privilege that they could have otherwise claimed as to third parties. And while there is cause to be somewhat comforted or alleviated even there are still some real risks and considerations that lie ahead as examined entities are asked to turn over their privileged documents and communications.
The CFPB itself is the impetus of some of the uncertainty that lies ahead as it continues to pursue Memorandums of Understanding with state regulators4 not covered under the FDIA, and has repeatedly professed policy statements that lack solid footing under the law.5 In fairness to the CFPB, however, the CFPB is in a bit of a quagmire. Concerning large banks, it is supposed to coordinate and share exam reports with the prudential regulators, though it has no responsibility for safety and soundness reviews.6 Concerning non-banks, some of which are regulated by state agencies, the CFPB is to conduct similar examinations.7 This raises all sorts of questions related to sharing information not answered by Dodd-Frank. HR 4014 answers some but not all of these questions, and privilege protection continues to be a source of consternation.
Below we explore HR 4014, its history and its intended benefits, as well as the murky waters that lie ahead and, what this means for banks and non-banks falling under the CFPB’s supervision and examination authority in days ahead.
The Skinny on HR 4014: Why it was needed and what it does.
To begin, we step back in time to January 2012 — the CFPB had just released its Bulletin 12-01 which was intended to provide guidance regarding the “confidentiality protections,” that its supervisory process would afford to supervised depository institutions with more than $10 billion in deposits, e.g. Section 1025 large banks, and their respective affiliates.8 In that Bulletin the CFPB, in almost a monarchial fashion, decreed that, “the provision of information to the Bureau pursuant to a supervisory request would not waive any privilege that may attach to such information.” The CFPB backed up its decree with a single district court decision,9 a 1991 OCC interpretive letter,10 as well as the Dodd-Frank transference of authority provision as to Federal consumer financial law11 from the prudential regulators to the CFPB.
In the face of multiple Circuit Court decisions12 which found that voluntary disclosure to the government waived any applicable privilege, the CFPB’s back-up was hardly the clear legislative footing needed to provide comfort to depository institutions that they were not “voluntarily” disclosing privileged materials and thus, waiving privilege by turning records over to the CFPB. Nonetheless, in that Bulletin, the CFPB advised that, “it will not consider waiver concerns to be a valid basis for the withholding of privileged information .…” Even more, the CFPB, unlike its comparative prudential regulator counter-parts, did not propose in that Bulletin or in its Supervision and Examination Manual, that its examiners limit requests to situations where there was a clear “material risk.”13 The CFPB did, however, state that its policy was to seek information material to its supervisory objectives from non-privileged sources first, to limit the request for privileged materials, and it noted that it would take all reasonable steps to assist supervised institutions in rebutting any claims of waiver.
Bulletin 12-01 also included the CFPB’s position with regards to the sharing of confidential information with government agencies, even those not engaged in supervision. To that point, the CFPB stated that while it will not “routinely share” confidential supervisory information with those not engaged in supervision, its policy is to share with law enforcement, including states’ Attorneys General, in very limited circumstances. This policy on sharing raised a myriad of privilege, trade secret, and other disclosure concerns. At the end of the day, large banks were left with little to no assurance that their confidential records would not end up in the hands of third parties who had little to no accountability when it came to disclosure.
Fast forward a few months — the CFPB in March 2012 published notice and requested comment on its proposal to a rule addition concerning confidential treatment of privileged information submitted during the supervisory process.14 The stated intent was to afford the same protections that apply to the submission of privileged information to prudential regulators and State and foreign bank regulators.15 This rule proposal expanded Bulletin 12-01 with the addition of non-depository institutions that the CFPB supervises, but otherwise was a mere restatement of the monarchial non-waiver decree contained in the Bulletin.
The CFPB received twenty-six comment letters to the rule proposal, but to no avail. In the end, the CFPB professed again that it had the authority to issue a rule that would govern third parties’ claims of waiver.16 The Bureau also restated its policy on asking for privileged information as contained in the Bulletin, comparing its policy to that of the prudential regulators, and directly quoted its prior statement on sharing of information with other agencies and law enforcement.17
The rule on confidential treatment of privileged information, which became effective on August 6, 2012, did provide some comfort on the “voluntary” disclosure issue, but fears remained as the rule was footed in statutory language, e.g., the FDIA, that applied directly to prudential regulators but not explicitly to the CFPB. More than that, the intent of the CFPB to share confidential information with other agencies raised significant concerns of privilege waiver or worse yet, confidential records ending up in the hands of adverse litigants.
Simultaneous to the CFPB’s rule proposal, the Congress was busy working on legislation to address the privilege waiver concerns raised by the industry. Ultimately what passed the House on March 26, 2012 was HR 4014. United States Representative Huizenga of Michigan, the bill’s sponsor, recognized that Dodd-Frank failed to provide necessary privilege protections and introduced the bill in order to provide a real solution and protect information that depository and non-depository institutions may provide during an exam.18 Along that line, HR 4014 does several things — but primarily it amends 12 USC 1821(t)(2)(A) and 1828(x), (Section 11(t)(2)(A), and Section 18(x), respectively), of the FDIA, to insert the CFPB in order to afford privilege protections to “any person” submitting information to the CFPB in relation to the CFPB’s supervisory responsibilities.
More precisely, Section 18(x), the provision that traditionally has shielded privileged information provided by “any person” to any Federal banking agency, state bank supervisor, or foreign banking authority for any purpose in the supervisory or regulatory process was amended to include the CFPB. Section 11(t)(2)(A), the provision that allows a “covered agency” to share privileged information with another “covered agency”19 or other agency of the Federal government without waiving privilege was amended to include the CFPB. Thus, the result of HR 4014 is that “any person,”20 whether a depository or non-depository, can share privileged information with the CFPB within the context of the CFPB’s supervisory responsibilities and not be deemed to have voluntarily disclosed and waived any applicable attorney-client or work product privileges. The CFPB can also share that information with any other explicitly listed agency and not be deemed to have waived the privilege.
The Senate passed HR 4014 on December 11, 2012 without amendment and sent it to the President for signature.21
Present day, where does HR 4014 leave the CFPB’s supervised entities?
Despite HR 4014’s good intentions, a gaping hole remains that supervised entities need to be aware of. Specifically, Section 11(t), which protects information shared by and between a list of “covered agencies,” does not include State bank supervisors and State non-bank supervisors as “covered agencies.” Thus, if the CFPB shares information with these state agencies, as it has stated it will, then the concerns regarding waiver of privilege and possible disclosure of confidential documents to adverse litigants remain.
Notably, this hole exists independent of the creation of the CFPB — in other words, depository institutions who turned over privileged documents to federal banking agencies were subject to similar risks before, if their documents were turned over to a non-covered State agency or law enforcement. But the advent of the CFPB and the CFPB’s very clear policy statements on sharing information with State agencies and law enforcement bring this issue to the forefront.
Aware of this concern, the CFPB has sought to enter into a Memorandum of Understanding22 (MOU) with various State authorities . One stated purpose of this MOU is to “preserve the confidential nature of the information the parties share by and among themselves.”23 A few observations — this MOU raises all the same concerns the supervised entities had upon the release of Bulletin 12-01 discussed above. It is lacking in any solid statutory footing, like the FDIA. Consequently, if the CFPB does in fact share privileged and confidential information with State authorities, supervised entities are at a real risk of effectively waiving privilege and having their records produced to third parties, including adverse litigants.
A sure way to resolve this issue would be to legislatively limit who the CFPB can share with or list such germane State agencies in the FDIA, or a combination of the two. In the meantime, supervised entities should seek a commitment from the CFPB that it will not share its privileged information with State bank supervisors, State non-bank supervisors and/or law enforcement absent a court order compelling same. And even in that instance, an assurance from the CFPB that it will seek to have court ordered protections in place to prevent subsequent disclosure of the privileged information. Along that line, the CFPB should notify the supervised entity of when its been requested to share information so the supervised entity has an opportunity to respond and object if needed.
This Begs the Long-Standing Question Raised by the American Bar Association ("ABA"): Why Do the Regulators Even Need to Ask For Privileged Information?
HR 4014 provides some of the needed protection for privileged materials once produced to the CFPB, but does not address the threshold question whether the CFPB has authority to compel production in the first place. This is troubling given the importance of the attorney-client privilege and work product doctrine and the need for unfettered communication between attorney and client.24 No one doubts that. So how then does the CFPB assert authority to compel production?
This question was directly addressed by the ABA’s letter to CFPB dated April 12, 2012.25 While the letter urged the CFPB to pull down its proposed rule in favor of seeking legislation such as HR 4014, the letter emphasizes that preservation of the privilege is secondary to the primary question of whether the CFPB has authority to compel production. The ABA argues that neither Dodd-Frank nor any other Federal statute grants this authority. It further argues that the fact that financial institutions have a history of cooperating with the prudential regulators is not a basis for claiming authority. Overall, “the ABA is not aware of any reported Federal appellate court case holding that the Federal banking regulators – or any other Federal agencies – can require production of privileged materials.”
Regrettably this question will not resolve itself quickly. This tug-of-war over privileged materials is apt to continue absent court rulings, legislation,26 executive order, or the adoption of reasonable agency policies.27
In conclusion…
It is true that HR 4014 is good news for supervised entities. But this piece of legislation does not resolve all the privilege issues. How murky the waters get in this area in days ahead will depend largely upon the CFPB’s policy regarding requesting privileged materials and sharing those materials. Supervised entities should remain vigilant and seek assurances as described above when providing privileged information.
1 12 USC 1811 et. seq. up
2 See Sections 1025 and 1026, of Title X to the Dodd Frank Consumer Financial Protection Act (Dodd-Frank). up
3 See Section 1024, Title X, Dodd-Frank. up
4 See CFPB Press Release, Federal Consumer Agency to Partner with State Regulators on Supervision of Providers of Consumer Financial Products and Services, Including Mortgage Lenders, Private Student Lenders and Payday Lenders, dated January 4, 2011, http://www.consumerfinance.gov/pressreleases/consumer-agency-to-partner-with-state-regulators/; and see the Memorandum of Understanding Between the Consumer Financial Protection Bureau, the Conference of State Bank Supervisors, and the Other Signatories Hereto On the Sharing of Information for Consumer Protection Purposes, dated January 4, 2011 (MOU). up
5 See CFPB Bulletin 12-01, Re: The Bureau’s Supervision Authority and Treatment of Confidential Supervisory Information, dated January 4, 2012; and the Bureau’s commentary to 12 CFR Part 1070, Confidential Treatment of Privileged Information, effective August 6, 2012. up
6 Section 1025(b), Title X, Dodd-Frank. up
7 See Section 1024(b), Title X, Dodd-Frank. up
8 See CFPB Bulletin 12-01, Re: The Bureau’s Supervision Authority and Treatment of Confidential Supervisory Information, dated January 4, 2012. up
9 See Boston Auction Co., Ltd. v. Western Farm Credit Bank, 925 F.Supp. 1478, 1482 (D. Hawaii 1196). up
10 See OCC Interpretative Letter, 1991 WL 338409 (Dec. 3, 1991). up
11 See Section 1061, Title X, Dodd-Frank, concerning transfer of consumer financial protection functions; and see Section 1002(14), Title X, Dodd-Frank. defining “Federal consumer financial law,” to include: 1) the provisions of Title X, such as Sec. 1031’s prohibition of unfair, deceptive or abusive acts or practices (“UDAAP”); 2) the enumerated laws found at Sec. 1002(12), which include the Alternative Mortgage Transaction Parity Act of 1982, the Consumer Leasing Act of 1976, the Electronic Fund Transfer Act, the Equal Credit Opportunity Act, the Fair Credit Billing Act, the Fair Credit Reporting Act, the Home Owners Protection Act of 1998, the Fair Debt Collection Practices Act, subsections (b) - (f) of section 43 of the Federal Deposit Insurance Act, sections 502 - 509 of the Gramm-Leach-Bliley Act, the Home Mortgage Disclosure Act of 1975, the Home Ownership and Equity Protection Act of 1994, the Real Estate Settlement Procedures Act of 1974, the S.A.F.E. Mortgage Licensing Act of 2008, the Truth in Lending Act, the Truth in Savings Act, section 626 of the Omnibus Appropriations Act, 2009, and the Interstate Land Sales Full Disclosure Act; 3) the laws for which authorities are transferred under Subtitles F and H; and 4) any rule or order prescribed by the Bureau under Title X, enumerated consumer law or authorities transferred under subtitles F & H. Federal consumer financial law does not include the Federal Trade Commission Act (FTC Act). up
12 See Permian Corp. v. U.S., 665 F. 2d 1214 (D.C. Cir. 1981); In re Martin Marietta Corp., 856 F. 2d 619 (4th Cir. 1988); U.S. v. Billmyer, 57 F. 3d 31 (1st Cir. 1995); and Westinghouse Elec. Corp. v. Republic of Philippines, 951 F. 2d 1414 (3rd Cir. 1991). up
13 See the OCC’s Litigation and Other Legal Matters, Comptroller’s Handbook, at 7, February 2000. up
14 See 77 Fed. Reg. 15286 (March 15, 2012). up
15 See 77 Fed. Reg. at 15287. up
16 See 77 Fed. Reg. 39617, at 39620, relying on Westinghouse Elec. Corp. v. Republic of Philippines, 951 F. 2d 1414, 1427, n. 15 (3rd Cir. 1991). up
17 See 77 Fed. Reg. 39617, at 39620 - 39621. up
18 See FDIA Amendments Regarding Disclosures to the Bureau of Consumer Financial Protection -- (House of Representatives - March 26, 2012) [Page: H1555]. See also 112th Congress, 2d Session, House of Representatives, Report 112-417, Amending the Federal Deposit Insurance Act with Respect to Information Provided to the Bureau of Consumer Financial Protection, dated March 20, 2012. up
19 Covered Agency includes: any Federal banking agency, the Farm Credit Administration, the Farm Credit System Insurance Corporation, the National Credit Union Administration, the Government Accountability Office, the Federal Housing Finance Agency, and now the CFPB. up
20 The Report by the House Committee on Financial Services states that, “It is the Committee’s intent that “any person” shall be construed to include any individual, partnership, company, corporation, association (incorporated or unincorporated), trust, estate, cooperative organization, firm, society, joint stock company, or other entity.” See 112th Congress, 2d Session, House of Representatives, Report 112-417, Amending the Federal Deposit Insurance Act with Respect to Information Provided to the Bureau of Consumer Financial Protection, dated March 20, 2012. up
21 See Amending the Federal Deposit Insurance Act — (Senate - December 11, 2012) [Page: S7751]. up
22 See FN 4. up
23 See FN 4. up
24Upjohn Co. v. United States, 449 U.S. 383 (1981). up
25 Letter by William T. (Bill) Robinson III, President, American Bar Association, to Monica Jackson, Office of the Executive Secretary, Consumer Financial Protection Bureau, April 12, 2012. up
26 A proposed “Attorney-Client Privilege Protection Act” was considered in 2007 by the 110th Congress (S. 3217; and H.R. 3013) and in 2009 by the 111th Congress (S. 445; and H.R. 4326), but did not pass. up
27 As one bright spot, the ABA reports that certain agencies have rewritten their policies and procedures to disallow or curtail requests for privileged materials. The Department of Justice’s policy is considered by some to be a “best practices” policy, though it does not solve the problem. Section 9-28.710 of The Department of Justice’s U.S. Attorneys’ Manual, for example, provides in part:
The Department understands that the attorney-client privilege and attorney work product protection are essential and long-recognized components of the American legal system. What the government seeks and needs to advance its legitimate (indeed, essential) law enforcement mission is not waiver of those protections, but rather the facts known to the corporation about the putative criminal misconduct under review. In addition, while a corporation remains free to convey non-factual or "core" attorney-client communications or work product-if and only if the corporation voluntarily chooses to do so-prosecutors should not ask for such waivers and are directed not to do so. The critical factor is whether the corporation has provided the facts about the events, as explained further herein. up
