I. TRIGGER AND AUTHORITY

CFPB Office of Enforcement has 4 triggers:

1. Consumer complaints via Consumer Complaint Database
2. Supervision exam findings
3. Whistleblower / Referral from state AG, FTC, prudential regulator
4. Market monitoring - HMDA, credit reporting data

Statutory powers: Unfair, Deceptive, Abusive Acts or Practices [UDAAP] under 12 U.S.C. 5531, 5536, plus specific statutes: TILA, RESPA, EFTA, FCRA, FDCPA, ECOA.

II. INVESTIGATION LIFECYCLE - Detailed

Step 1: Informal Inquiry
Staff sends voluntary request for information. Non-public.

Step 2: Civil Investigative Demand [CID] - Formal Investigation
This is administrative subpoena. Under 12 U.S.C. 5562(c), each CID must "state the nature of the conduct constituting the alleged violation which is under investigation and the provision of law applicable".

CID can demand:

• Documents, emails, reports
• Written interrogatories
• Oral testimony under oath

Procedure:

• Within 10 days of service, CFPB personnel must "meet and confer" with recipient to discuss scope, burden, privilege.
• Recipient can file Petition to Modify or Set Aside CID within 20 days to Executive Secretary. CFPB Director decides. Standard is very deferential to CFPB.
• If recipient fails to comply, CFPB must file petition for enforcement in federal district court - CID is NOT self-enforcing.

Step 3: Investigative Hearings / Further CIDs
Can last months to years. CFPB may issue multiple CIDs.

Step 4: NORA - Notice and Opportunity to Respond and Advise
Traditional process: Enforcement staff calls company's designated representative and explains they are prepared to request Director authority to file action. Sends NORA letter outlining potential violations, factual basis.

Company gets 14-30 days to file NORA response - present legal, factual, policy arguments why action should not be brought. This is reviewed by Enforcement Director and Action Review Committee.

Step 5: Action Review Committee & Director Decision
Recommendation goes to CFPB Director. Director decides to:

• Close with No Action
• Close with supervisory remediation (MOU)
• File enforcement action via Consent Order, Administrative Proceeding, or Federal District Court Complaint.

Penalties: Tier 1: $5,437 per violation, Tier 2 reckless: $27,186, Tier 3 knowing: $1,359,300 per day (adjusted annually for inflation).

III. LANDMARK CASE LAWS

1. PHH Corporation v. CFPB, 881 F.3d 75 (D.C. Cir. 2018) - Foundation Case for Limits

Facts: PHH, mortgage lender, referred consumers to mortgage insurers who bought reinsurance from PHH subsidiary - alleged kickback under RESPA Section 8(a). ALJ imposed $6m fine. Director Cordray sua sponte increased to $109 million, applying new interpretation of RESPA retroactively.

DC Circuit Holdings - Two Critical Limits:

a) CFPB Structure Unconstitutional (initially): Single director removable only for cause violates separation of powers. Later modified by Seila Law, remedy is sever for-cause provision.

b) Statute of Limitations Applies to CFPB: CFPB argued it has no statute of limitations. Court held: CFPB enforcement actions are confined to statute of limitations of underlying statute - 3 years for RESPA, 5 years for FDCPA, etc. Going forward, CFPB cannot punish violations older than that.

c) Due Process: Cannot retroactively apply new interpretation without notice.

This case ended with PHH settling after Supreme Court denied cert.

2. Seila Law LLC v. CFPB, 591 U.S. 197 (2020) - Supreme Court on Constitutionality

Facts: Law firm Seila Law refused to comply with CID in debt relief investigation, arguing CFPB unconstitutional.

Held 5-4: For-cause removal protection for single CFPB Director is unconstitutional. Under Article II, President must have power to remove Director at will. Court severed for-cause provision, left CFPB otherwise intact.

Impact: Director now removable at will. All prior CFPB actions ratified by subsequent Directors to cure potential invalidity.

3. CFPB v. Accrediting Council for Independent Colleges and Schools, D.C. Cir. 2016 - CID Enforcement Standard

CFPB issued CID to ACICS with Notification of Purpose: "to determine whether any entity has engaged in unfair, deceptive, abusive practices in connection with accrediting for-profit colleges".

Court Test for Enforceability of CID:

1. Investigation within authority
2. Demand not too indefinite
3. Information reasonably relevant

Court held CID that states investigation is to determine possible violation of "any federal consumer financial law" satisfies statutory requirement of stating nature of conduct. Very low bar - recipient must comply. Established that CFPB does NOT need to state specific suspected violation at CID stage.

4. CFPB v. Community Financial Services Association of America (CFSA), 601 U.S. ___ (2024) - Funding Constitutionality

Facts: Payday lenders trade association argued CFPB funding mechanism violates Appropriations Clause - CFPB receives funding directly from Federal Reserve earnings, not annual congressional appropriation, amount determined by Director.

5th Circuit held funding unconstitutional. Supreme Court reversed 7-2.

Held: Funding mechanism is constitutional. Appropriations Clause requires only law authorizing withdrawal from Treasury. Dodd-Frank is such law, specifies cap (12% of Fed operating expenses). CFPB funding is not unprecedented - similar to OCC, FDIC.

Significance: After Seila Law and CFSA, CFPB's existence is fully constitutional. Ended 4 years of challenges where defendants moved to dismiss enforcement actions arguing funding defect.

5. CFPB v. Wells Fargo Bank, N.A. - Enforcement Actions - Largest Cases

2016 Fake Accounts Scandal:
Investigation found thousands of employees opened 3.5 million deposit and credit accounts without customer consent to meet sales goals. CFPB action led to $100m CFPB fine + $85m to OCC/LA. Required independent consultant and refund of $2.5m fees. Pattern was UDAAP - unfair practice.

2022 Widespread Mismanagement - $3.7 Billion Order:
CFPB ordered Wells Fargo to pay $2 billion+ in consumer redress and $1.7 billion civil penalty - largest ever. Investigation covered 16 million consumer accounts across auto loans (illegal repossessions), mortgages (illegal foreclosure fees), deposit accounts (unfair overdraft fees). Under Dodd-Frank, CFPB found violations of CFPA UDAAP, FCRA, EFTA.

Consent Order required: Compliance with federal consumer financial law, remediation plan, board oversight.

2022 Joint Action - Mortgage Kickbacks:
Wells Fargo + JPMorgan Chase paid kickbacks to Genuine Title for mortgage referrals. Over 100 loan officers at Wells Fargo involved. CFPB + Maryland AG joint action: Wells Fargo $10m redress + $21m penalty + $3m to Maryland.

6. CheckSmart / Community Choice Financial - CID Challenge Failure

CheckSmart filed Petition to Set Aside CID arguing CID too vague. CFPB Denial: Statutory requirement satisfied if CID states investigation to determine possible violation of any federal consumer financial law. Court upheld - demonstrates difficulty of quashing CID.

IV. DEFENSE STRATEGY

1. At CID stage: File timely petition to modify - argue overbreadth, privilege, undue burden. Meet and confer within 10 days mandatory.
2. Preserve NORA opportunity - NORA response is only chance to avoid public action. Present statute of limitations defense per PHH.
3. Challenge CID enforcement in district court on relevance grounds per ACICS test, but expect low success.
4. Post Seila Law/CFSA, constitutional defenses are largely foreclosed - focus on merits: lack of UDAAP, lack of substantial injury.