1

Fair and Responsible Lending Training including UDAAP

Arvest Bank

April/May 2014

Carl Pry

Managing Director

2

Unfair, Deceptive or Abusive Acts or Practices

(UDAAP)

• Penalties for Non-Compliance

Civil penalties of not more than $10,000 for each violation,

which may be recovered in a civil action brought by the

Attorney General

• Key Points to Remember

UDAAP principles have been applied to commercial

transactions

Consider both what the bank says and what the customer

understands

Complaints are the key to detecting UDAAP issues

3

UDAAP Fairness Principles

• Value

‒ The consumer receives value that is reasonably related to the cost

of the product or service

• Predictability

‒ The consumer can predict how the product or service will perform

• Understanding

‒ The consumer understands the terms and conditions of the product

or service (particularly any limitations or exclusions)

• Appropriateness

‒ The bank provides products that are appropriate for their customers

and their customers can rely on the bank to show them the most

appropriate product

4

“Bonus Principle”

• Simplicity

– Only two clicks?

5

Treliant Product Fairness Map

Increasing Bank Benefit

Incr

easi

ng

Co

nsu

mer

Ben

efit

Product Fairness Map Instructions

1. List the features of the potential product

2. Divide the features between the following

categories:

• Good for the Bank

• Good for the Customer

• Good for Both

• Bad for the Bank

• Bad for the Customer

• Bad for Both

3. For each category, determine the

magnitude of each feature

4. Plot each one on the Fairness Map

5. Determine where there is a cluster-these

are the most dominant characteristics

6. Features that are bad for the customer

and the Bank should be eliminated from

the product

7. Consider whether negative features can

be altered to improve their benefits for

both (the goal should be that the product

should be good for both the customer

and the bank)

8. Carefully scrutinize any product in the

“good for the Bank; bad for the

Customer” category. This is a UDAAP

red flag

6

CFPB Priorities

• The “Four D’s”

– Deception

– Discrimination

– Dead ends

– Debt traps

• The “S”

– Structure

7

UDAAP is #1 risk

• Regulatory/litigation intensity

• Size of penalties

• Retroactive new standards

• Costs of risk management

• Difficulty of getting it right

8

UDAAP Hot Spots

• Identify high-risk areas

– Ancillary products

– Fees of all kinds

– Credit Life Insurance/Debt cancellation/payment protection

– Collections practices

– Foreclosure practices

– Identity theft protection

– Third parties/Structure

– Misaligned incentives

– Force-placed insurance

– Mortgage servicing

– COMPLAINTS

9

UDAAP

COMPLIANCE

PROGRAM

10

UDAAP Program Building

Governance

• Senior Leadership Involvement

• Board of Director engagement

• Oversight Committees

• Line of Business participation

10

11

UDAAP Strategy

• Align UDAAP with overall organization strategy

• UDAAP strategy should consider marketing plans

• Should help to integrate risk silos

• Strategy should address all UDAAP program

elements

11

12

Fairness Mission Statement

• Public, customer-facing commitment to

fairness

• Can be stand-alone or added to the overall

organizational mission statement

• Should be used for cultural impact

12

13

Enterprise UDAAP Policy

• Foundation for the fairness program

• Commit to fairness and transparency in all

customer interactions

• Policy should cover all types of transactions,

products and services, throughout their lifecycle

• Should cover third party relationships

• Be approved by the board of directors

13

14

Program Leadership

• Should report to compliance

• Level in organization should be similar to the fair

lending officer

• Allocate sufficient resources within the compliance

function, including business line liaisons,

monitoring and testing functions

• Can combine with a fair and responsible banking

function or establish a stand-alone area

14

15

UDAAP Training

• Include all appropriate employees

• Utilize general and job-specific training

• Concentrate on new and emerging risks

• Use complaint data

• Use formal training and informal messaging

15

16

UDAAP Job Aids

• Formulate checklists for high risk jobs

• Use decision trees and charts where

appropriate

• Should be updated and maintained by

UDAAP compliance function

16

17

Consumer Advocate

• Purpose is to perceive bank transactions from a

consumer’s perspective

• Review

– Marketing

– New products and services

– Questionable transactions or fairness based complaints

• Can be housed in compliance or in a business unit

17

18

Advertising and Marketing Reviews

• No customer communication should be

released without a UDAAP review

• Ad copy should be reviewed every time;

even if content does not change

• Complaints may also prompt mid-stream

advertising reviews

18

19

UDAAP Procedures

• Procedures integrated into business

procedures are ideal

• Should be approved both by the line of

business and compliance

19

20

New Product Initiatives

• Integrate UDAAP reviews in new product design

and approval

• New product design governance structures should

incorporate UDAAP reviews

• UDAAP compliance SMEs should participate in the

new product design and approval

• Consider giving a “kill switch” to compliance for

new products

20

21

Existing Products

• Significant changes to existing products

should have the same UDAAP governance

as new products

21

22

UDAAP Monitoring and Testing

• Compliance functions/business functions

should incorporate UDAAP monitoring

procedures to regularly monitor all functions

• Compliance monitoring is housed in the

compliance function but is often done in

conjunction with the business

22

23

UDAAP Auditing

• Internal audit function

• Must be appropriately scoped

• Should focus on high risk areas

• Use risk assessment and complaints in

scoping

23

24

Consumer Outreach

• Focus groups

• Consumer/Community group outreach

• Consumer Advisory Council

24

25

Culture

• Active cultivation of a fairness culture

• “Tone at the Top” is important

• Establish culture barometers

• All culture components should be reviewed

for fairness (compensation, corporate

messaging, etc.)

25

26

UDAAP RISK

ASSESSMENT

27

Practical Steps for UDAAP Risk Assessments

1. Prepare the bank

2. Consider pre-assessment “fixes”

3. Set scope

4. Map the approach

5. Assess risks and controls

6. Report

7. Remediate & launch change management

27

28

1. Prepare the Bank

• Engage top leaders

• Engage business lines

• Seek business-side partner

• Explain why this is different

28

29

2. Consider Pre-assessment “Fixes”?

• It’s a first-time process

• Either find, fix and document, or

• Fix obvious problems first

29

30

3. Set Scope

• Leverage Consumer Complaint Data to Identify

High Risk Areas

– Refine consumer complaint models to identify potential

UDAAP or fairness gaps

– Train consumer complaint analysts to be highly skilled at

identifying potential UDAAP or fairness issues

– Ensure consumer complaint management system uses

the information most effectively

30

31

3. Set Scope (continued)

• Consider refining scope using Consumer Impact

Filter:

– Consumer Impact is potential harm to the consumer from

a breakdown or deficiency in a specific function

– Three levels:

• High = Potential for material harm to consumer

• Medium = Potential for significant harm

• Low = Limited potential for non-material harm

31

32

4. Map the Approach

• Product life cycle by product

• Life cycle stage across different product

• Specific stages in each product

• Across Different Risk Disciplines

• Different approaches can result in a holistic risk

assessment

32

33

Product Life Cycle

33

34

Across Products

34

35

One Product Line

35

36

One Specific Product Element

36

37

5. Assess Risk and Controls

• By product life cycle

• By risk discipline

37

38

Assessing Risk By Product Life Cycle

• Approach is closer to the way the Bureau

reviews products

• Allows a holistic view of the product lifecycle

38

39 39

40

Assessing Risk Across All Risk Disciplines

• UDAAP Risk exists in all risk disciplines

• Risks can fall into “cracks” between them

• Assessing UDAAP risks within each

discipline can identify these risks

40

41 41

42

Assess Risk and Controls

• Assess inherent risks

• Assess the effectiveness of controls

• Determine the residual risks after controls

are applied

42

43

Example: Overdraft Risk Assessment

43

44

6. Report

• Report to right people

• Build metrics

• Catch attention

44

45

Example: Reporting

45

46

7. Remediate & Launch Change Management

• Corrective Action – Centerpiece of Remediation

• Centralize Complaint Administration

• Incorporate complaint “lessons learned” into

Change Management processes

• Consider focused issue escalation and reporting

protocols for items that could harm consumers

• Do corrective action re-training on non-traditional

issues and concerns

46

47

THE

UDAAP

TESTING

CHALLENGE

48

Shift #1: Customer Centric

Old practice:

- Process-centric

- Product-centric, and/or

- Rule-centric

New best practice:

- Customer-centric

49

Shift #2: Principles-based

Old practice:

- Rules-based

- Objective

- Measurable

New best practice:

- Principles-based

– Subjective

– Hard to quantify

50

Shift #3: Holistic

Old practice:

- Siloed by product

- Siloed by product life-stage

New best practice:

- Integrated in data and process

- Integrated with risk groups and LOB’s

51

THE

TESTING

PROGRAM

52

Fairness risks can hide

in the cracks

53

Developing UDAAP Testing Processes

Auditing and testing plans

• Include UDAAP in annual audits and ensure that high

risk areas are tested regularly

• Plans from year to year should cover the entire

organization within the schedule

• All planning should have built in flexibility to respond to

the regulatory environment (emerging risks) or for new

products or services

54

Product Lifecycle UDAAP Testing

55

Areas to Consider

• Governance systems

• Vendors and third parties

• Product features

• Marketing and sales practices

• Underwriting practices

• Solicitation

• Fulfillment

• Servicing

• Collections

56

Scoping the Test

• What are you testing?

– Products

• Simplicity vs. complexity

– Services

• Understandable, transparent

– Processes

• Predictable

• Hot spots: at your bank + regulatory focus

• Vulnerable populations

57

Developing Checklists

• Design

– Lifecycles of products, services

– Where are consumer touch points, risk areas?

– Focus on areas of the bank

– Combine different approaches

• Look at your complaints

• What information do you have?

– Who do you need to talk to?

– What should you ask them?

58

Developing Checklists

59

60

Measuring and Rating Fairness Risks

Rating Scales

High—Moderate—Low

or

1-5

or

Something else?

61

Measuring and Rating Fairness Risks

Examples:

High Risk Failure to fulfill promises

Moderate Risk Lack of clarity in product

marketing material

Isn’t everything high risk?

62

Reporting Results: Example

Mortgage Findings

Risk Type Risk Level Risk Management Effectiveness Outlook

Overall

Governance Systems

Marketing

Sales

Third Party Vendors

Underwriting

Solicitation

Fulfillment

Servicing

Collections

Unfair, Deceptive or Abusive Acts and Practices Risk Matrix

63