A quick scan of recent issues of Supervisory Highlights released by the CFPB tells us that ferreting out false, misleading, and incomplete statements in marketing messages is still very much in the CFPB’s crosshairs. As recently as the Summer 2020 issue, there are references to misleading advertisements of bonus offers on deposit accounts, misleading representations about the ability to apply for a loan online, and false representations that no credit check will be conducted on loan applicants. With the presidential administration change and a new CFPB director, enforcement actions are likely to increase. With that backdrop, now is the time to review the bank’s marketing and advertising plans with an eye on potential UDAAP pitfalls.
The Definitions
Before we tackle the marketing plan, we should define “unfair” and “deceptive.” Note that Dodd Frank’s UDAAP and the FTC’s UDAP rely on the same principles but will collectively be referred to as “UDAAP” here.
A practice is unfair when:
- It causes or is likely to cause substantial customer injury, typically in the form of monetary harm; AND
- Customers cannot reasonably avoid the injury; AND
- The injury is not outweighed by the benefits.
A review of representative UDAAP consent orders and civil money penalty cases involving marketing practices from 2016 to 2020 identified very few classified as unfair. The cases noted as unfair were related to marketing of deposit account add-on products such as identity theft protection. In these cases, consumers were not informed of the extra steps required to activate the product after the initial enrollment. The unfair standard was met because consumers were enrolled in the products and charged monthly fees (monetary harm), were not informed of the additional activation process (omission of material information), and were not provided the promised protection despite being enrolled and paying the fees (benefits did not outweigh the injury).
A practice is deceptive when:
- A representation, omission, act, or practice misleads or is likely to mislead the customer; AND
- The customer’s interpretation of the act or practice is reasonable; AND
- The misrepresentation, omission, or practice is material such as costs, benefits, or restrictions.
Most of the marketing practice cases researched for this article were categorized as deceptive and covered various financial services and products including overdraft services, mortgage loans, payday loans, auto loan add-on products, credit cards, and check cashing fees, among others.
As an example of the application of the criteria for determining a deceptive act, a money service business advertised its tax refund check cashing service for “1.99.” What the online advertisements did not disclose was that the figure represented the percentage of the check amount of 1.99% rather than a flat fee amount of $1.99. Price figures with two decimal points typically refer to dollar amounts, so the advertisements were likely to mislead consumers whose interpretation of $1.99 rather than 1.99% was reasonable, and the difference would be material. The omission of the percent sign was due to an error that occurred in preparing the advertisements that should have been identified as part of a thorough review before the advertisements were published.
A practice is abusive when:
- The practice materially interferes with the ability of a consumer to understand a term or condition of the product or service, OR
- The practice takes unreasonable advantage of:
- The consumer’s lack of understanding of the material risks, costs, or conditions; OR
- The consumer’s inability to protect his or her interests in selecting the product; OR
- The consumer’s reliance on the service provider to act in the consumer’s best interests.
Of the marketing practice consent orders issued from 2016 to 2020, only one had been categorized as abusive and was related to a bank’s offering of overdraft services for automated clearing house and one-time debit card transactions covered by Regulation E. In this case, the CFPB determined that bank employees materially interfered with consumers’ ability to understand the terms and conditions of the service by:
- Not providing written disclosures before obtaining the consumers’ oral assent to opt-in; and by
- Advertising the overdraft service as a “free” part of the account package rather than explaining the full costs of the service.
In addition, written disclosures presented for signature at the end of the account-opening process were pre-checked for the acceptance of the service. This further interfered with the customers’ understanding of the terms and conditions because customers might not have understood they could change their opt-in selection.
UDAAP Policy Elements
As with all areas of the bank’s operations, the foundation of the marketing plan begins with effective policies and procedures, which should include UDAAP as either a standalone policy or incorporated as part of the marketing/advertising policies. Many of the CFPB’s consent orders related to marketing UDAAP include the definition of “clearly and prominently,” and the CFPB’s UDAAP examination-procedures reference the FTC’s “four Ps” test, so these are elements that should be considered in the policies and procedures. The FTC’s four Ps of Prominence, Presentation, Placement, and Proximity tie into the CFPB’s “Clearly and Prominently” definitions:
- Written disclosures (e.g., printed publications or words displayed on the screen of an electronic device) must be of a type size and location sufficiently noticeable for an ordinary consumer to read and comprehend, in print that contrasts with the background in which it appears.
- In communications disseminated orally or through audible means (e.g., radio or streaming audio), the disclosure must be delivered in a volume and cadence sufficient for an ordinary consumer to hear and comprehend it.
- In video communications (e.g., television or streaming video), disclosures must be in writing consistent with written disclosures as noted above and must appear on the screen for a duration sufficient for an ordinary consumer to read and comprehend it.
- In communications that contain both audio and visual portions, the disclosure must be presented simultaneously in both the audio and visual portions of the communications.
Marketing Media and UDAAP – It Cannot Be One Size Fits All
Another consideration in the marketing plan should be the types of media to be used. It is not just the bank’s newspaper and radio advertisements that should be of concern. Any medium or device that serves as a marketing platform is a potential UDAAP hazard, including social media sites, digital advertising, emails, text messages, telemarketing scripts, statement stuffers and messages, and even flyers and brochures displayed inside the branch. If an advertisement without a disclosure would not meet the clear and prominent or four Ps standards on a particular device or platform, that device or platform should not be used.
Additionally, certain messages and postings may be outside of the bank’s control, but there are ways to mitigate the risk. Employees’ use of social media is a potential risk. To mitigate this risk, you should:
- Implement employee policies that convey expectations for posting about the bank and its products and services on personal social media sites;
- Train employees periodically on those policies; and
- Monitor usage to the extent possible.
Other sources of UDAAP risk are third-party service providers who market and/or provide products and services on the bank’s behalf. A robust vendor management program is the best mitigant for this type of risk.
UDAAP Considerations for Content
Moving beyond the infrastructure of the marketing plan, consider the message you want to convey and the advertised terms and conditions including:
The target audience: The message must be consistent with the targeted market’s capacity for understanding, particularly vulnerable populations such as older consumers, students, service members and veterans, and the economically disadvantaged. For example, as noted in one CFPB consent order, a credit card issuer marketing a debt cancellation product failed to inform cardholders—who had disclosed they were retired during the telemarketing call—that they would be ineligible for the product because they were retired. The telemarketers should have informed the customers they were ineligible and ended the call. However, the credit card issuer enrolled the customers in the debt cancellation product anyway, despite being aware the cardholders were ineligible because of their retirement status.
Another example related to the target audience, involves the consent orders issued in 2020 against nine lenders who used deceptive direct mail campaigns to advertise mortgages guaranteed by the Veterans Administration. The deceptive advertising included, among other issues, under-disclosed annual percentage rates and misleading statements about application and processing fees, and they falsely implied the lenders were affiliated with the federal government.
Qualifying conditions: If many of the consumers to which the advertising is targeted, would not qualify for the advertised terms of the product, it is a deceptive advertisement. An example of this would be a “bait-and-switch” tactic in which an advertised loan rate would only be available to consumers with very high credit scores while the advertiser knows that many of the consumers receiving the offer likely would not qualify.
Support for claims: Any claims made in an advertisement must be fully supported and testable. Even a claim as innocuous as “We have the lowest rates in town” could spell trouble. You must do the research and document that such claims are accurate before the advertisement is published.
Testimonials and endorsements: It might be tempting to make up testimonials and endorsements, but if these are used in an advertisement, they must be supported. Document retention requirements should extend to evidence that testimonials and endorsements were factually made and were provided freely.
Language matters: On January 13, 2021, the CFPB issued its Statement Regarding the Provision of Financial Products and Services to Consumers with Limited English Proficiency (LEP) that “…outlines compliance principles and guidelines that encourage financial institutions to expand access to products and services for LEP consumers.” If the bank decides to implement a marketing campaign directed at LEP consumers, that decision should be made as part of a rigorous change management process that includes documenting the reasons certain languages, products, and/or services were selected to demonstrate such selections were not made in a way that could be deemed unfair, deceptive, or abusive.
For example, document the reasons one language was chosen over another based on the marketing area’s demographic data or demonstrate that a particular product was chosen based on the bank’s analysis of internal data focusing on customer usage of that product. Additionally, any decisions made should be based on availability of translation over the full life-cycle of the product. (For more information on limited English proficiency, see Speaking to Our Consumer’s Hearts: Considerations for Serving Limited English Proficiency Consumers on page 28 of the May-June 2021 issue of ABA Bank Compliance)
Complete and accurate disclosure: Do not forget that violations of the “alphabet regs” can be accompanied by UDAAP violations. If advertisements include triggering terms according to Regulation Z or DD, the omission of the triggered terms could be considered a deceptive practice. Both regulations include a provision that aligns with UDAAP–Regulation Z, §1026.24(b) requires a “clear and conspicuous” standard, and subsections of §1026.16 prohibit misleading terms. Regulation DD, §1060.8(a) prohibits misleading or inaccurate advertisements. (The consent order referenced earlier related to overdraft services resulted in not only an abusive practice violation but also Regulation E violations.)
Follow Through on Implementation
The marketing plan does not end when the advertising has been published or the calls and texts have been made. The bank still needs to deliver on the claims and offered terms. Marketing, production, and operations staff must work together to ensure marketing messages offer terms and promises that can be supported operationally. Production and operations staff must be informed of current campaigns, and documentation must be maintained that identifies all consumers who received an offer so that at the time of account opening, the offer will be applied as advertised even if the consumer does not mention it.
Likewise, documentation must be maintained that allows for post-consummation testing to confirm that all eligible consumers were provided the terms as advertised. For campaigns requiring post-consummation action by the consumer such as product activation, procedures for follow-up should be implemented to verify that action was completed.
Third-Party Service Provider Relationships in the Marketing Plan
Banks often look to service providers to fill gaps in their marketing campaigns. Telemarketing firms may be an efficient way to reach more consumers without adding staff, or the bank may contract with a third party to jointly offer a product that the bank does not have the capability to offer on its own. Banks are also increasingly partnering with fintechs to offer products and services more efficiently without the investment of time and resources needed to create the requisite systems that fintechs have already perfected. While any of these solutions may increase the bottom line, they are not without UDAAP risk, which can be mitigated with an effective third-party oversight program.
Before contracting with a third party who will engage in marketing and advertising on the bank’s behalf, the bank should perform due diligence to determine the effectiveness of the vendor’s policies and procedures related to regulatory requirements, including UDAAP. The bank should also review audit reports covering marketing practices, compliance training requirements, and complaint management. Service level agreements and the right to audit the vendor’s marketing operations should be part of the contract.
The bank must have final approval for all marketing materials, telemarketing scripts, and incentive plans involving bank products. The bank should perform ongoing quality assurance reviews to include real-time monitoring and recording of telemarketing and customer service calls to confirm that representatives are “sticking to the script” and not conveying information to consumers that would create additional UDAAP risk. An appropriate channel should be established to allow bank management to monitor complaints received by the service provider.
Marketing’s Impact on the Compliance Management System
It should be no surprise that an effective Compliance Management System (CMS) should incorporate marketing and advertising activities into the compliance risk assessment, and compliance staff should act accordingly based on aggregate risk. Notable Marketing areas to be considered in the administration of the CMS are:
- Implementation of Appropriate Policies and Procedures. These include coverage of UDAAP elements as addressed earlier, followed by periodic updates as marketing plans and strategies evolve over time.
- Compliance Training. Be sure to address UDAAP risk as well as requirements of applicable regulations and assign training to appropriate marketing staff members.
- Compliance Monitoring and Testing. Be sure to include, at a minimum, 1) review and approval of marketing collateral before it is published or distributed, 2) review and approval of marketing scripts before they are put into production, and 3) post-consummation review of marketing campaigns to confirm consumers received the terms to which they were entitled.
- Complaint Monitoring. Review for complaints specific to marketing campaigns, including complaints received through third-party service providers. Complaints can be an early warning that a campaign is not working as intended, allowing management to be proactive in adjusting the marketing campaign, or the product or the service, before a larger UDAAP issue emerges.
- Change Management for new or changed products and services. Review of marketing plans related to changing products or services should be an integral part of the change management process to avoid creating UDAAPs because collateral and scripts were not kept up to date.
Marketing’s Impact on Examination Management
Examiners will review the bank’s UDAAP risk as part of compliance examinations. Marketing staff should be proactive in maintaining documentation that “tells the story” of how UDAAP risk has been mitigated, so examiners are not left to make assumptions. Detailed records of all campaigns should also be maintained including records of consumers who responded to and accepted offers. As mentioned earlier in this article, documentation should be maintained to demonstrate how decisions are made—for example, to provide marketing messages to LEP consumers.
Consumer complaints related to the bank’s marketing practices should be documented with final resolution to demonstrate an effective complaint management program. Marketing managers would be well-advised to maintain the aforementioned documentation in a centralized location with updates as situations warrant.
When examiners arrive to perform the examination, this well-organized documentation could be handed over and should be able to withstand critical examiner review with little follow-up required. You don’t want a consent order that requires a multi-year lookback of all advertising to confirm all consumers received the terms they were offered—and you don’t want to make restitution if they did not. Having organized records will likely prevent such an occurrence in the first place, but if not, the restitution process would be much less painful.
Conclusion
With the potential for multi-million-dollar civil money penalties, UDAAP risk should be on the mind of every bank’s marketing manager. Marketing managers can be the first and most important mitigating control factor by implementing a marketing plan that recognizes and addresses the risk through messaging that leaves nothing to chance. If disclosures in an advertisement are truly clear and prominent, consumers should not have to hunt for them or read the fine print to get the full picture. By considering the four Ps in all messaging and scripts, the disclosures should reach out and grab the consumer’s attention. Following the ideas and suggestions presented here will help you make that happen.
As published in ABA Bank Compliance (now ABA Risk and Compliance), May/June 2021
