Fintech Focus: CFPB Settles an Enforcement Action Against Lending Platform

The Consumer Financial Protection Bureau (CFPB) entered into a Consent Order with a lending platform that services and facilitates the origination of consumer loans through a merchant network. The platform agreed to provide up to $9 million of refunds and loan cancellations for affected consumers and pay a $2.5 million civil penalty. The platform also agreed to implement compliance changes to its merchant oversight and complaint management policies and procedures that provide guidance for Fintechs more generally.

The CFPB alleged that the platform engaged in unfair acts and practices in violation of the Consumer Financial Protection Act by processing and servicing unauthorized loans and structuring its loan origination and servicing program in a manner that enabled the unauthorized conduct. More specifically, the CFPB alleged that the platform’s merchants, which were required to apply to participate in the platform’s financing program, submitted, and the platform approved, thousands of applications on consumers’ behalf without the consumers’ knowledge or consent.  

According to the CFPB, the platform received over 6,000 consumer complaints alleging unauthorized loans between 2014 and 2019, and some consumers reported becoming aware of the loans for the first time when they noticed that the loans appeared on their credit reports, received billing statements, or were subject to collection activity. The CFPB further alleged that, after receiving consumer complaints about the allegedly unauthorized loans, the platform was inconsistent in its remediation. As a result, at least some consumers allegedly did not receive refunds or write-offs of the allegedly unauthorized loans. 

In addition to consumer restitution and redress, the platform is required to implement a consumer complaint management program that is designed to “efficiently and accurately intake, investigate, document, resolve and track consumer complaints”; analyze consumer complaints on a routine basis for the purpose of identifying trends, emerging issues, and merchants that may be involved; and periodically revise and update its policies and procedures based on those consumer complaint trends. The platform is also required to establish a compliance committee that is responsible for monitoring and coordinating the platform’s compliance with the consent order, including creation of a board-approved compliance plan. 

Key Takeaways and Implications

The consent order flags the challenges of managing lending platforms that leverage third-party merchants; however, it also lays out several guardrails with respect to managing risk: 

1. Controls: According to the CFPB, the platform lacked “appropriate and effective” controls designed to detect or address the fraudulent activity during loan application, approval, and funding processes.  For example, the CFPB alleged that until at least April 2019, the platform did not require consumers to sign and return loan documentation to consummate the loan, which allowed merchants to apply for loans without the consumer’s consent or knowledge.  Accordingly, participants in lending platform ecosystems should review their fraud detection and resolution procedures in light of the CFPB’s allegations in the Consent Order.
2. Merchant Training and Oversight: According to the CFPB, the platform had “inadequate and inconsistent” merchant training and oversight. Specifically, the CFPB alleged that (i) the platform’s training did not “adequately teach merchants how to comply with consumer protection laws”; (ii) there was often a delay in the merchants receiving training prior to taking applications; (iii) the platform did not require annual compliance training or training when the platform made changes to its lending program; and (iv) the platform did not obtain verification that merchants’ employees received training before taking applications. In addition, the CFPB alleged that merchants skirting the platform’s requirements often faced no discipline or termination, and in some cases, the platform took a lenient approach for high-volume merchants. In this respect, the Consent Order underscores the CFPB’s continuing expectation that all consumer-facing aspects of a consumer credit programs have effective training and are subject to effective oversight and monitoring.
3. Consumer Compliance Management Program: According to the CFPB, the deficiencies in the platform’s complaint management program caused the platform to miss red flags indicating fraudulent conduct on the part of certain merchants obtaining unauthorized loans. The CFPB alleged that the platform’s complaint management program was understaffed and there was frequent staff turnover, resulting in delays in resolving consumer complaints (for example, 75 days to investigate and resolve complaints) or the closure of consumer complaints without resolution. Platform providers should evaluate the resources necessary to staff a complaint management program, including efficiently and accurately addressing consumer complaints and analyzing and acting on complaint trends. 

The consent order reflects expected heightened regulatory scrutiny of Fintechs, but also may present a framework for how Fintechs can mitigate risk.