Source: http://www.jdsupra.com/legalnews/which-one-of-us-is-the-service-provider-15581/
Timestamp: 2015-06-03 03:57:35
Document Index: 314580261

Matched Legal Cases: ['§ 929', '§ 53', '§ 5466', '§ 5481', '§ 5481', 'Arts 419', '§ 5481', '§ 4002', '§ 5481', '§ 4002']

Which One Of Us Is The Service Provider? The Dodd-Frank Act's Infinite Loop Of Oversight | BuckleySandler LLP - JDSupra
Valerie Hletko | BuckleySandler LLP Tweet Send
Prudential regulators have advised supervised banks for nearly 30 years about the need for careful diligence of their service providers, but the expectations of the Consumer Financial Protection Bureau (“CFPB” or the “Bureau”) raise both the intensity of these warnings, and the stakes. Title X of the Dodd-Frank Wall Street Reform Act (“DFA”) places under the supervisory authority of the CFPB any “covered person” involved in the provision of any consumer financial product or service. The CFPB Examination Manual views these business-to-business relationships through the lens of consumer experience rather than safety and soundness. Now, more than ever, CFPB-supervised institutions stand in the shoes of their service providers for purposes of evaluating regulatory, litigation, or compliance risk.
Service provider oversight is now a centerpiece of CFPB supervision, but assigning roles is not always straightforward. CFPB Guidance issued in April 2012 sets forth expectations for oversight and imposes expensive and burdensome obligations on both sides of the table. A lack of clarity may lead to duplicative, simultaneous oversight. Specifically, an institution may consider itself to be the service receiver but may be considered by its contract partner to be the service provider—and vice versa—in connection with the same product or transaction. Moreover, an entity considered to be a service provider subject to oversight by one of its contract partners may find that another business partner views the nature of its function very differently.
Originally Published in LexisNexis Emerging Issues Analysis - August 2013.
Please see full Article below for more information. Download PDF LexisNexis® Emerging Issues Analysis Research Solutions | August 2013 LexisNexis and the Knowledge Burst logo are registered trademarks of Reed Elsevier Properties Inc., used under license. Other products or services may be trademarks or registered trademarks of their respective companies. Click here for more Emerging Issues Analyses related to this Area of Law. Prudential regulators have advised supervised banks for nearly 30 years about the need for careful diligence of their service providers, but the expectations of the Consumer Financial Protection Bureau (“CFPB” or the “Bureau”) raise both the intensity of these warnings, and the stakes. Title X of the Dodd-Frank Wall Street Reform Act (“DFA”) places under the supervisory authority of the CFPB any “covered person” involved in the provision of any consumer financial product or service.1 The CFPB Examination Manual views these business-to-business relationships through the lens of consumer experience rather than safety and soundness. Now, more than ever, CFPB-supervised institutions stand in the shoes of their service providers for purposes of evaluating regulatory, litigation, or compliance risk. Service provider oversight is now a centerpiece of CFPB supervision, but assigning roles is not always straightforward. CFPB Guidance issued in April 2012 sets forth expectations for oversight and imposes expensive and burdensome obligations on both sides of the table.2 A lack of clarity may lead to duplicative, simultaneous oversight. Specifically, an institution may consider itself to be the service receiver but may be considered by its contract partner to be the service provider—and vice versa—in connection with the same product or transaction. Moreover, an entity considered to be a service provider subject to oversight by one of its contract partners may find that another business partner views the nature of its function very differently. In short, while there is substantial guidance as to the what in service provider oversight, there is little guidance as to the who. In our view, consideration of both the evolution of the DFA’s statutory language and its legislative history offers a way out of the infinite oversight loop. Covered Persons and Service Providers under the DFA The DFA gives the CFPB authority to regulate any “Consumer Financial Product or Service”3 1 Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203, § 929-Z, 124 Stat. 1376, 1871 (2010) (codified at offered by any covered person. Specific enumerated activities include a broad spectrum of transactions—12 U.S.C. § 53). “Whenever a service integral to the operation of a designated financial market utility is performed for the designated financial market utility by another entity, whether an affiliate or non-affiliate and whether on or off the premises of the designated financial market utility, the Supervisory Agency may examine whether the provision of that service is in compliance with applicable law, rules, orders, and standards to the same extent as if the designated financial market utility were performing the service on its own premises.” 124 Stat 1376, 1814, 12 U.S.C § 5466(b). 2 Consumer Financial Protection Bureau, Bulletin 2012-03, Service Providers. April 13, 2012, http://files.consumerfinance.gov/f/201204_cfpb_bulletin_service-providers.pdf. 3 “Consumer Financial Product or Service” is defined as those that are offered or provided for use by consumers primarily for personal, family, or household purposes, or that which is offered or provided in connection with such products. 12 U.S.C § 5481(5). Valerie L. Hletko and Sarah E. Hager on Which One of Us Is the Service Provider? The Dodd-Frank Act's Infinite Loop of Oversight 2013 Emerging Issues 7051 LexisNexis® Emerging Issues Analysis Research Solutions | August 2013 LexisNexis and the Knowledge Burst logo are registered trademarks of Reed Elsevier Properties Inc., used under license. Other products or services may be trademarks or registered trademarks of their respective companies. from extending credit and servicing loans, to engaging in deposit-taking activities, to providing payments or other financial data processing products or services to a consumer by any technological means, including processing or storing payments made through online banking systems or mobile telecommunications networks.4 The statute includes “catch-all” authority to regulate products or services “entered into or conducted as a subterfuge to evade consumer financial law or permissible for a bank or financial holding company to offer or provide and has or likely will have a material aspect on consumers.”5 A covered person is any person engaged in offering or providing a consumer financial product or service, and any affiliate if such affiliate acts as a service provider.6 A service provider is defined to include “any person that provides a material service to a covered person in connection with the offering or provision by such covered person of a consumer financial product or service.”7 This includes providers that design, operate or maintain the product or service, or that process transactions. It does not include ministerial or non-material support services offered to businesses generally and those who provide advertising space. Finally, the DFA includes a rule of construction, stating a service provider shall be deemed a covered person to the extent it engages in the offering or provision of its own consumer financial product or service.8 CFPB Bulletin 2012-03 CFPB Bulletin 2012-03 (April 13, 2012) (“the Bulletin”) sets forth the Bureau’s expectations regarding “service providers to supervised banks and non-banks and service providers to a substantial number of small insured depository institutions or small insured credit unions.”9 While the Bulletin notes “the mere fact that a supervised bank or nonbank enters into a business relationship with a service provider does not absolve the supervised bank or nonbank of responsibility for complying with Federal consumer financial law to avoid consumer harm,” it is also careful to admonish that “legal responsibility may lie with the supervised bank or nonbank as well as with the supervised service provider.”10 This has caused mutual wariness on the part of both service providers and service receivers. The Bulletin requires the following of the service receiver: • Thorough due diligence to verify the service provider understands and is capable of complying with Federal consumer financial law; • Review of the service provider’s policies, procedures, internal controls, and training materials to ensure the service provider conducts appropriate training and oversight of employees or agents with consumer contact or compliance responsibilities; 4 The full designation of financial services can be found in Section 1002 (15)(A) of the Act, 124 Stat. 1376, 1957-60. 5 Id. 6 Id. 7 12 U.S.C § 5481(26). 8 Id. 9 Consumer Financial Protection Bureau, Bulletin 2012-03, Service Providers. April 13, 2012, http://files.consumerfinance.gov/f/201204_cfpb_bulletin_service-providers.pdf. 10 Id. LexisNexis® Emerging Issues Analysis Research Solutions | August 2013 LexisNexis and the Knowledge Burst logo are registered trademarks of Reed Elsevier Properties Inc., used under license. Other products or services may be trademarks or registered trademarks of their respective companies. • Inclusion in the service contract with the service provider clear expectations about compliance, as well as appropriate and enforceable consequences for violating any compliance-related responsibilities, including engaging in unfair, deceptive, or abusive acts or practices; and • Establishment of internal controls and on-going monitoring to determine whether the service provider is complying with Federal consumer financial law; and taking prompt action to address fully any problems identified through the monitoring process, including terminating the relationship where appropriate.11 Who is the Service Provider? While the CFPB acknowledges that institutions may take a risk-based approach to implementing this guidance, compliance with expectations is unavoidably labor-intensive and expensive. Business-to-business relationships do not necessarily sort into easy categories. For example, consumers use smart phones to complete point-of-sale transactions, transfer money, pay bills, and purchase ring tones or games. Mobile carriers are not financial services companies, but their networks are often the conduits for financial services. Most use vendors to develop these services and process transactions, but some also process the transfer of funds by either deducting the value of purchases from a pre-paid account and submitting the funds to the merchant or adding the cost to the subscriber’s monthly bill.12 CFPB Assistant Director for Card and Payments Markets testified in Congress in 2012 that, “to the extent that technology companies begin to play roles traditionally performed by banking institutions, we may need to reconsider how well our existing regulations apply to a changed environment.”13 Even service provider guidance issued just over a year ago may not be keeping up. Is a mobile carrier a service provider to a bank or credit card issuer insofar as it effectuates transactions, while the bank or credit card issuer is a service provider to the mobile carrier in effectuating a money transfer?14 Does each individual bank or credit card issuer have an obligation to monitor the mobile carrier, and does the mobile carrier then have an obligation to monitor each individual bank or credit card issuer that assists in transaction processing? Despite clear statements by the CFPB of its authority over mobile payment processing, is the mobile carrier still exempt from being a service provider because it is acting as a retailer during any point of the process, or only when customers purchase ringtones and games?15 11 Id. 12 Id at 427-28. See also, Timothy R. McTaggart & David W. Freese, Wireless Carriers and Mobile Payments: What’s the Call on Regulation?, 31 No. 9 Banking & Fin. Services Pol’y Rep. 1 (2012). 13 Erin F. Fonte, Mobile Payment in the United States: How Disintermediation May Affect Delivery of Payment Functions, Financial Inclusion and Anti-Money Laundering Issues, 8 Wash. J. L. Tech, & Arts 419, 436 (2013). The author concludes agencies and regulators assume mobile payments are already covered under existing law based on the “type of activity” being performed, not on whether the entity is a financial institution. 14 A Federal Trade Commission report released this year on mobile payments noted “15 of 19 providers allowed consumers to fund their mobile payments via credit or debit cards, 7 of 19 allowed funding by bank account debit, 4 of 19 allowed billing to a mobile carrier account, and 7 of 19allowed multiple funding sources.” Federal Trade Commission, Paper, Plastic...or Mobile? An FTC Workshop on Mobile Payments, FTC Staff Report March 2013, http://www.ftc.gov/os/2013/03/130306mobilereport.pdf. 15 124 Stat. 1376, 1959, 12 U.S.C § 5481(A)(vii)(I). However, the retailer exemption itself appears subject to an increasingly blurry line, as major retailers such as Costco and Walmart push further into the financial services arena. See, Lindsay Wise, Big-box Store Offering Loans, Other Financial Services, The Olympian, Apr. 15, 2013, http://www.theolympian.com/2013/04/15/2506599/big-box-stores-offering-loans.html. LexisNexis® Emerging Issues Analysis Research Solutions | August 2013 LexisNexis and the Knowledge Burst logo are registered trademarks of Reed Elsevier Properties Inc., used under license. Other products or services may be trademarks or registered trademarks of their respective companies. Business-to-business relationships far from the cutting edge of technology can present similarly complex analyses. For example, is a credit card issuer a service provider to the payment processing network or is it the other way around? The natural reading appears to be that entities are both covered persons and service providers vis-à-vis one another. As a practical matter, they must provide and require audit rights at the same time. Can this really be right? Legislative History The DFA was first introduced in the House of Representatives in December 2009. The first version of the bill lacks language specifically providing CFPB with jurisdiction over service providers. Further, service providers are defined to include persons who have “direct interaction with a consumer, or “facilitate, or make easier, the design or operation of a transaction.”16 The original exemptions are significantly broader, providing that the statute does not apply where “a service . . . does not materially affect the terms or conditions of the consumer financial product or service, its performance or operation, or the propensity of a consumer to obtain or use such product or service.”17 The version of the bill engrossed in the House nine days later reflected no changes to any of these provisions and did not provide supervisory authority over service providers when it was referred to the Senate on January 20, 2010. The first public printing of the bill occurred on May 20, 2010, when the following language is incorporated into the text: • Modification of the definition of a service provider from one that “facilitates” a transaction to one that “participates” in a transaction; • Insertion of language specifically designating examination authority over service providers to the CFPB; • Removal of language in the definition relating to direct interactions with consumers, as well as the lengthier description of material support services within the exception; and • Introduction of the rule of construction providing “A person that is a service provider shall be deemed to be a covered person to the extent that such person engages in the offering or provision of its own consumer financial product or service.”18 The testimony and committee records suggest minimal attention was given to these changes. The bulk of discussion relating to service providers reflects concerns that a “financial service provider” might be conflated with a “service provider.” For example, Senator Johanns (R-NE) worried that merchants offering installment payment plans to customers would be subject to unnecessary regulation.19 Prior debate in the House was marked by similar concern.20 16 H.R. 4173, 111th Congress § 4002(35)(A) (as introduced in the House, December 2, 2009). While the retailer 17 Id. 18 124 Stat. 1376, 1963, 12 U.S.C § 5481(26)(C). 19 156 Cong. Rec. S3296-04 (daily ed. May 6, 2010) (statement of Sen. Johanns). (“What are you doing? I don’t know about anyone else, but I can make the case without any hesitation that my local florist doesn’t come to mind when I think about the players who brought our economy to the edge.” 156 Cong. Rec. S3299.) LexisNexis® Emerging Issues Analysis Research Solutions | August 2013 LexisNexis and the Knowledge Burst logo are registered trademarks of Reed Elsevier Properties Inc., used under license. Other products or services may be trademarks or registered trademarks of their respective companies. exception would largely address this, there was an unsettled sense that the DFA would reach a range of business, such as technology providers, and would “impose significant new costs on businesses for which ‘consumer finance’ is well outside their core business.”21 To this end, Senator Dodd (D-CT) submitted a report to the Committee on Banking, Housing, and Urban Affairs on April 30, 2010, emphasizing modesty in the definition of “service provider”: “[It] is designed to create authority that is generally comparable to the authority that federal banking regulators have under the Bank Service Company Act. It is included in this Act in order to ensure that material outsourced services by a covered person in connection with the offering or provision of a consumer financial product or service are subject to the regulation and supervision of the CFPB for the activities that could be done directly by the covered person. Without such authority, covered persons could remove many important functions that bear directly on consumers from the CFPB's oversight simply by contracting those functions out to service providers, thereby escaping the jurisdiction of the CFPB and leading to significant regulatory arbitrage.”22 A few weeks later, on May 19, 2010, Senator Johanns asked for further clarification: “Mr. JOHANNS. Mr. President, it is my understanding that title X of the bill would give the Bureau of Consumer Financial Protection the power to regulate not only businesses that provide financial products and services to consumers but also companies that provide services to these businesses. I understand that the purpose of giving the bureau the power to regulate these service providers is to prevent a financial service company's use of a service provider to frustrate the efforts of the bureau to protect consumers because important functions that bear directly on consumers are contracted out to service providers. I also understand that this approach is designed to provide the bureau with authority comparable to the authority that Federal bank regulators have over service providers to banks under the Bank Service Company Act. Am I correct in understanding that it is the intent of the service provider provisions for the bureau to focus on the service contracted out, not the terms of the service contract? Further, am I correct that it is not the intent of the service provider provisions for the bureau to subject the terms of business-to-business contracts, or the agreements between providers of consumer financial products and services and 20 Impact Financial Regulatory Overhaul on Small Businesses and Community Lenders: Hearing Before the H. Select Comm. on Small Business, 111th Cong. (2009) (statement of David T. Hirschmann, President and CEO, Center for Capital Markets Competitiveness, U.S. Chamber of Commerce). (“The definitions included in Section 101 of the bill vastly expand the scope of the CFPA to businesses that simply extend credit to their customers.”). 21 Id. 22 S. Rep. No. 111-176, at 160-61, (2010). LexisNexis® Emerging Issues Analysis Research Solutions | August 2013 LexisNexis and the Knowledge Burst logo are registered trademarks of Reed Elsevier Properties Inc., used under license. Other products or services may be trademarks or registered trademarks of their respective companies. their own service providers, to the jurisdiction of the bureau, even when there may be disputes between these business parties? Mr. DODD. Mr. President, the gentleman is correct; the purpose of the Bureau of Consumer Protection is to protect consumers and not to address disputes between businesses over the terms of their business relationships.”23 While the legislative history is both minimal and understated, it suggests two things: (i) Congress did not intend to make business-to-business relationships a principal focus of the Bureau; and (ii) the intent of the focus by the supervisory authority over service providers is to be the financial product or service contracted out.24 A Way Out of the Infinite Loop Notwithstanding the legislative history, the Bureau’s expectations for service provider relationships are by now an integral part of its examinations. Service providers and service receivers struggle to determine in some cases which entity will play which role, and frequently err on the side of expensive over-inclusion. The evolution of the DFA’s statutory language offers three interpretive guideposts going forward. • Because Congress deliberately required participation, institutions merely facilitating financial transactions should not be considered service providers. • Because the regulatory focus was intended to be on the consumer-facing service, an entity cannot be a service provider and a financial service provider simultaneously with respect to the same product or transaction. • While the service provider exemption ultimately was limited to advertising and ministerial services, it originally excluded services that did not “materially affect the terms or conditions of the consumer financial product or service, its performance or operation, or the propensity of a consumer to obtain or use such a product or service.”25 This relatively modest change created a sweeping scope of authority over a far broader range of activities that could be deemed to fall under the rubric of a service provider. In light of this language and the legislative focus on the actual product or service, it would be appropriate to apply a materiality standard. These guideposts help to resolve, for example, the questions posed earlier about the relationship between mobile payment services and banks and credit card issuers. First, with respect to the processing of a mobile payment transaction, banks and credit card issuers are the entities that should exercise oversight of the carriers that design, operate or maintain the programs used to complete mobile payment transactions. Second, with respect to the issue of defining a service receiver versus service provider, the mobile carrier is a service provider unless it bills consumer 23 156 Cong. Rec. S3965-03 (2010). 24 In this regard, the Bulletin’s guidance relating to the terms of service contracts is not consistent with the legislative intent. 25 H.R. 4173, 111th Congress § 4002(35)(A) (as introduced in the House, December 2, 2009). LexisNexis® Emerging Issues Analysis Research Solutions | August 2013 LexisNexis and the Knowledge Burst logo are registered trademarks of Reed Elsevier Properties Inc., used under license. Other products or services may be trademarks or registered trademarks of their respective companies. accounts directly for products or service it provides. At that point, the entity crosses the line the DFA anticipated and becomes a financial service provider itself. Finally, applying a materiality standard, the mobile carrier is strictly a service provider to the extent that it bills for products and services it does not itself offer and as to which it has no material effect on terms or conditions. Application of the guideposts in other contexts would put appropriate limits on the business-to-business relationships understood to fall under CFPB authority, while ensuring that institutions cannot “frustrate the efforts of the bureau to protect consumers;” the motivation for CFPB supervision in the first place. More critically, they would eliminate the phenomenon of simultaneous service providers. As to any given product or service, one entity will always have the more material effect on the terms and conditions of a product or service. The one that does is the more appropriate target of the CFPB’s supervisory attention. Click here for more Emerging Issues Analyses related to this Area of Law. About the Authors. VALERIE L. HLETKO is a Partner and SARAH E. HAGER is a Regulatory Attorney with the Washington, D.C. office of BuckleySandler LLP. They represent financial services companies in connection with government enforcement proceedings, including those of the CFPB, in regulatory examinations, investigations, and litigation. The authors’ e-mail addresses are vhletko@buckleysandler.com and shager@buckleysandler.com. Emerging Issues Analysis is the title of this LexisNexis® publication. All information provided in this publication is provided for educational purposes. For legal advice applicable to the facts of your particular situation, you should obtain the services of a qualified attorney licensed to practice law in your state.
Alabama Clarifies Supervision Authority Over Bank Affiliates, Service Providers