The Consumer Financial Protection Bureau Completes A Hat Trick With Two More Large Settlements With Financial Services Firms and Provides Warnings For the Road Ahead

November 20, 2012

The Consumer Financial Protection Bureau (“CFPB”) recently announced its latest round of multi-hundred million dollar settlements of enforcement actions, all against major credit card issuers.  Since July, three enforcement actions led by the CFPB have resulted in restitution payments and penalties in excess of $536 million payable to more than five and a half million customers, the CFPB, and other coordinating federal agencies.  On September 24, 2012, the CFPB and the Federal Deposit Insurance Corporation (“FDIC”) agreed to a joint settlement with Discover Bank (“Discover”) to resolve enforcement actions.  Pursuant to the Consent Order, Discover agreed to refund $200 million to three and a half million customers who purchased its credit card “add-on” products and to pay a $14 million fine, half payable to the CFPB’s Civil Penalty Fund and half going to the FDIC.1  One week later, on October 1, 2012, the CFPB and several other federal and state agencies reached a settlement with another major credit card issuer and certain affiliates, ordering the companies to refund $85 million to approximately 250,000 customers and to pay penalties of $27.5 million for alleged illegal credit card marketing and debt collection practices.2  These settlements come hard on the heels of the CFPB’s inaugural settlement with Capital One Bank (USA), N.A. (“Capital One”) on July 17, 2012, under which the credit card issuer paid a total of $210 million in reimbursements and penalties to two million customers, the CFPB, and the Office of the Comptroller of the Currency (the “OCC”).

The Discover enforcement action concerned allegations similar to those made by the CFPB in the settlement with Capital One.  The CFPB and the FDIC alleged that Discover violated the consumer financial protection laws through deceptive marketing and sales practices perpetrated by its representatives relating to credit card add-on products, including debt cancellation, identity-theft protection and credit score monitoring services.4 

As is typical in the resolution of enforcement actions, Discover stipulated to the Consent Order without admitting or denying the allegations brought by the CFPB and the FDIC.5

The Consumer Financial Protection Bureau6

The CFPB was created by the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”)7 to implement and enforce federal consumer financial laws and to promote fair, transparent, competitive and accessible markets for consumer financial services and products.8  The CFPB consolidates the consumer financial protection responsibilities (including with respect to rulemaking, supervision and enforcement) that previously had been the province of seven federal agencies.9  In exercising its enforcement powers, the CFPB has the discretion to craft any appropriate legal or equitable remedy to address violations of the consumer financial protection laws, including temporary and permanent cease-and-desist orders, rescission, reformation of contracts, refunds, disgorgements, damages and civil money penalties.10  In addition, the CFPB has wide and exclusive authority – except where it shares rulemaking power with the FTC – to promulgate rules “as may be necessary or appropriate to enable the Bureau to administer . . . enforce and otherwise implement the provisions of Federal consumer financial law.”11

The CFPB has extensive enforcement powers and operates with unique and controversial independence from Congressional or Executive oversight.  Its budget is statutorily tied as a fixed ratio to the Federal Reserve’s operating expenses.  CFPB final rules can be overturned only by a determination by two-thirds of the members of the Financial Stability Oversight Council (the “FSOC”) that the rule threatens the “safety and soundness of the United States banking system or the stability of the financial system.”12  Courts must defer to the CFPB’s determinations regarding the meaning or interpretation of federal consumer financial law.13  While a cease-and-desist order issued by the CFPB may be appealed within 30 days of service to the D.C. circuit or to the federal circuit court in which the principal office of the defendant resides, such appeal does not operate as a stay of the CFPB’s order.14  Finally, the CFPB is headed by a single Director, appointed by the President with the consent of the Senate to a five-year term and is removable only for cause by the President for “inefficiency, neglect of duty or malfeasance of office.”15

The result is a powerful regulatory agency that has sweeping oversight authority, including exclusive jurisdiction to oversee compliance with consumer protection laws for banks with assets exceeding $10 billion, limited powers to monitor smaller banks and depository institutions, as well as supervisory authority over credit unions, residential mortgage companies (including originators, brokers and servicers, and providers of loan modification or foreclosure relief services), payday lenders and private education lenders.16  The CFPB also has the authority to supervise nonbank “larger participants,” including credit reporting companies and certain other consumer reporting companies. 

The Discover Settlement

According to the CFPB and FDIC, between December 1, 2007 and August 31, 2011, Discover violated the consumer financial protection laws by marketing and enrolling approximately 4.7 million customers into its credit card add-on products.17  Discover’s add-on products included “Payment Protection,” which allowed consumers to suspend payments for up to two years in the event of “life events” such as unemployment or hospitalization; “Identify Theft Protection,” allowing daily credit monitoring; “Wallet Protection,” marketed as a service that helped customers cancel credit cards in the event of theft; and “Credit Score Tracker,” allowing a customer unlimited access to credit reports and credit scores.18  Discover’s representatives allegedly promoted the add-on products during both inbound and outbound calls, where telemarketing vendors disguised sales calls as “courtesy calls.”19  On these calls, Discover’s representatives allegedly “spoke more rapidly during the mandatory disclosure portion of the sales call” and “downplayed” the importance of the terms and conditions of the add-on products.20

The CFPB and FDIC alleged that Discover engaged in the  following deceptive practices:

  • Misrepresented the cost of the products.  Discover’s telemarketing scripts allegedly misled customers into believing that the products were “free benefits” rather than products available for a fee.21  In addition, the scripts allegedly suggested that customers would be able to review printed materials before incurring fees; however, Discover allegedly processed payments for the products before sending informational materials.22
  • Withheld Key Eligibility Requirements.  According to the CFPB and the FDIC, Discover’s representatives allegedly marketed the products while failing to disclose eligibility requirements, including terms that precluded individuals that are self-employed, unemployed, employed part-time or suffering from a pre-existing medical condition from obtaining certain benefits of the Payment Protection add-on product.23 
  • Downplayed Mandatory Disclosures.  Telemarketers allegedly “downplayed” the mandatory disclosures made regarding the add-on products’ price and certain of the material terms and conditions by doing such things as allegedly speaking more rapidly (an aggressive and amorphous position for the CFPB to assert).24

In the Discover Consent Order, the CFPB and the FDIC alleged that Discover violated Sections 1031 and 1036 of the CFPA and Section 5 of the Federal Trade Commission Act in connection with its practices relating to the marketing, sales and operation of its credit card add-on products.  The settlement with Discover provides the following:

  • Pay $200 million in restitution.  Discover will pay $200 million in refunds to 3.5 million customers for fees and interest related to the add-on products.25 
  • Pay $14 million to the CFPB Civil Penalty Fund and to the U.S. Treasury.  Discover will pay a $7 million penalty to the Civil Penalty Fund, and will not seek or accept indemnification for such payment from any third party.26   Discover also agreed to pay a $7 million penalty to the U.S. Treasury in connection with the FDIC’s allegations.27
  • Complete a compliance plan.  Discover will submit a compliance plan that to ensure the lawful marketing, sale and operation of the add-on products.28  In addition, Discover will create an “Oversight Committee” to monitor compliance with the provisions in the Discover Consent Order and to report to the Board of Directors.29
  • Engage an independent auditor.  Discover will retain an independent auditor, subject to CFPB approval, to monitor and report on Discover’s compliance with the terms of the Discover Consent Order.30 


The CFPB has sent a loud and clear message to financial services firms that large settlements in the hundreds of millions of dollars may become the norm for companies that are deemed by the CFPB to have violated the consumer protection laws.  CFPB Director Richard Cordray warned that “we are signaling as clearly as we can that other financial institutions should review their marketing practices to ensure that they are not deceiving or misleading consumers into purchasing financial products or services.”31   In less than three months, the CFPB has led the resolution of investigations coordinated with multiple federal and state agencies to extract $435 million in reimbursements to customers, more than $46 million in civil monetary penalties payable to the Civil Penalty Fund, and fines in excess of $55 million payable to other federal agencies. 

In light of the aggressive posture adopted by the CFPB, and repeated warnings that these settlements are a harbinger of things to come, companies should strongly consider retaining outside legal counsel to review their marketing and sales practices for compliance with consumer financial protection laws and CFPB expectations,32 including ensuring that:

  • Marketing materials accurately reflect the terms and conditions of offered consumer financial products;
  • Scripts used by in-house and call-center representatives do not mislead customers and accurately state the terms and conditions of offered consumer financial products, including clearly identifying limitations on eligibility for benefits.  As learned from these recent CFPB settlements, special attention should be given not only to what is said by representatives but also what is emphasized;
  • Manuals and handbooks used by in-house and call-center representatives instruct representatives to accurately state the terms and conditions of offered consumer financial products, require clear affirmative consent before enrolling customers in consumer financial products, and provide that cancellation requests are handled in a lawful manner that does not mislead customers;
  • Effective oversight and quality assurance reviews of call-center vendors hold representatives to the same standards applied to the company and prevent material deviation from approved scripts;
  • Debt collection efforts accurately disclose the benefits of debt resolution to customers;  
  • A comprehensive training program educates employees in lawful marketing and sales practices regarding consumer financial products; and
  • Employee compensation programs relating to the sale and marketing of consumer financial products do not incentivize employees to mislead customers. 

In addition to meeting CFPB expectations, we recommend the following:

  • Clients should pay special attention to the marketing of credit protection or other add-on products, and should consider conducting a thorough program review of such products in light of the recent enforcement actions by the CFPB and the banking agencies to confirm that compliance with respect to credit protection and add-on products is no less robust than with respect to its traditional credit and deposit products;
  • Clients should ensure that employees and third party sales associates are thoroughly trained with respect to the terms and conditions of the product offered, as well as with respect to the relevant laws and regulations, including but not limited to the Truth-in-Lending Act, the Fair Credit Reporting Act, the Fair Debt Collection Practices Act, and the Real Estate Settlement Procedures Act;
  • Sales metrics should be reviewed periodically for aberrations or other indications of inconsistent or unauthorized marketing practices, or for evidence of higher sales penetration among protected classes or less affluent customers;
  • Any third-party provider or vendor should be thoroughly reviewed in accordance with reputational risk and risk management guidelines previously issued by the banking agencies,33 both before selecting the provider or vendor, and periodically thereafter;  
  • Consumer complaints should be logged and periodically reviewed to identify recurring consumer concerns, which may be indicative of marketing or sales practice concerns or issues with the underlying product or service being sold; and
  • Clients should monitor regulatory guidance (including but not limited to the CFPB’s periodic Supervisory Highlights), for indications of best practices, areas of regulatory scrutiny, and enforcement trends,

Diligent and ongoing review of marketing and sales practices is crucial to ensuring compliance under this new regulatory regime.

1    Press Release, Consumer Financial Protection Bureau, Federal Deposit Insurance Corporation and Consumer Financial Protection Bureau Order Discover to Pay $200 Million Consumer Refund for Deceptive Marketing (Sept. 24, 2012) (“CFPB Discover Press Release”), available at

2    Press Release, Consumer Financial Protection Bureau, CFPB Orders American Express to Pay $85 Million Refund to Consumers Harmed by Illegal Credit Card Practices (Oct. 1, 2012) (“CFPB American Express Press Release”), available at          

4    CFPB Discover Press Release.

5    In re Discover Bank, Admin. Proc. No. 2012-CFPB-0005, Joint Consent Order, Order for Restitution, and Order to Pay Civil Monetary Penalty (Sept. 24, 2012) (“Discover Consent Order”), available at

6    For a detailed discussion of the CFPB and its enforcement powers, please see The Consumer Financial Protection Bureau: The New, Powerful Regulator of Financial Products and Services (Mar. 6, 2012), available at

7    Pub. L. No. 111-203 (2010).

8    Dodd-Frank § 1021.

9    The seven agencies are the Board of Governors of the Federal Reserve System, Department of Housing and Urban Development (“HUD”), the FDIC, Federal Trade Commission (“FTC”), National Credit Union Administration, the OCC, and Office of Thrift Supervision.  Dodd-Frank § 1061(b)(1)-(7).

10   Dodd-Frank § 1055(a)(2).  Until the timely filing of an appeal, the CFPB may, at any time, modify, terminate, or set aside any order that it has issued.

11   Dodd-Frank §§ 1022(a)-(b), 1061(b)(5)(B).

12  Dodd-Frank § 1023.  Notably, by statute, the CFPB Director is one of the twelve members of the FSOC.  Id. § 111(b)(1)(D).

13   Dodd-Frank § 1022(b)(4)(A)-(B).

14  Dodd-Frank § 1053(b)(4).

15  Dodd-Frank § 1011(c)(3).  The combination of the CFPB’s broad powers and unique lack of accountability to other branches of government has raised constitutional concerns.  

16   Dodd-Frank § 1025.

17   Discover Consent Order  at 2-6.

18  CFPB Discover Press Release.

19  Discover Consent Order at 3.

20  Id. at 4.

21   Id. at 3-4.

22   Id.

23   Id. at 5.

24  Id. at 4.

25   Id. at 23-25.

26   Id. at 28.

27  Id. at 28.

28  Id. at 13.

29  Id. at 17.

30  Id. at 27.

31  Prepared Remarks by Richard Cordray on the Press Call on FDIC and CFPB Joint Enforcement Action (Sept. 24, 2012), available at

32   CFPB Bulletin 2012-06, Marketing of Credit Card Add-on Products (July 18, 2012), available at    

33 See, e.g., Third Party Relationships, OCC Bulletin 2001-47 (Nov. 1, 2001).