On September 20, 2017, the Federal Reserve’s Office of Inspector General (“OIG”) issued a report on the CFPB’s process for issuing Civil Investigative Demands (“CID”). The OIG found that the CFPB “generally complied” with requirements for issuing CIDs, with two exceptions. First, the CFPB failed to use notifications of purpose that adequately informed recipients about the nature of the investigation. Second, the CFPB failed to keep complete organized records of challenges to CIDs.

First, the OIG found that the CFPB’s internal policy manual encouraged investigators to “describe the nature of the conduct and the potentially applicable law in very broad terms.” Investigators apparently told the OIG that the notifications of purpose must be “necessarily broad.” This, they said, is to allow the investigation to “develop over time.” The OIG found that such notifications of purpose might “increase the risk that the language in the CID’s [] notification of purpose does not comply with [] case law.” Such notifications “may [also] limit the recipient’s ability to understand the basis for requests and thereby heighten the risk that the CID may face a legal challenge. . . .” These findings are not new. As we mentioned earlier this year, the D.C. Circuit recently affirmed a lower court’s determination that a CID was invalid because the notification of purpose was impermissibly vague. The OIG noted that the CFPB took steps to correct this deficiency. It found that those steps effectively cured the problem.

Second, the OIG found that the CFPB could do a better job at records management. It found that the CFPB maintained only decentralized records of CID challenges and lacked a centralized record-keeping system. In reaching this conclusion, the OIG noted that “The lack of a centralized record of all petitions and supporting documents may have contributed to the Office of the Executive Secretariat’s delay in responding to our request for the number of petitions filed to date.” The decentralized record-keeping issue is relevant to the public and the industry because the CFPB posts CID challenges on its website. The OIG noted that the CFPB took steps to centralize its record-keeping. It indicated, however, that further follow-up was needed to verify that the new system addressed the issue.