Responding to civil investigative demands (CIDs) issued by the CFPB is one of the larger challenges faced by financial institutions in acclimatizing to the new regulatory agency. Moreover, the CFPB has demonstrated that it will serve CIDs on smaller companies and individuals, who may have even more difficulty addressing the specific procedural and evidentiary challenges inherent in compliance.
Substantively, the CFPB has authority under the Dodd-Frank Act to issue CIDs requiring documents, responses to interrogatories, tangible items and deposition testimony. Once a CID is served, there is a very short time frame for compliance. The respondent must "meet and confer" with CFPB representatives within 10 days of receipt. At that initial meeting, the respondent must be prepared to discuss any and all issues it has with the CID, including objections. This is a mandatory requirement. The CFPB has stated that it will not consider subsequent petitions to set aside or modify a CID unless the respondent has meaningfully engaged in the meet and confer process, and will only consider issues raised during that process.
If the respondent wants to object to some or all of the topics or demands included in the CID, there are some very high hurdles to be jumped. The respondent has 20 days from receipt of the CID to file a petition to amend or set it aside. The petition must contain all factual and legal objections to the CID, including all arguments and supporting affidavits or other documentation.
Obviously, this is an extraordinarily tall order for any organization, much less a large company which in civil litigation might require more than 20 days just to identify the appropriate witnesses, investigate and locate responsive documents. Respondents may request extensions from the CFPB, but the decision on such a request is entirely within the CFPB's discretion.
Filing a petition to set aside or amend presents another difficult consequence. While the CFPB generally considers investigations private in their early stages, the agency has announced that once a petition to amend or set aside is filed, the investigation becomes public. Thus, the respondent is faced with having to either address an unduly broad CID privately, or face public scrutiny and potential reputation loss in order to raise legal objections. This is a very significant issue for many companies.
When organizations have requested confidential treatment of their petition to amend a CID, the results have not been favorable. In 2012, the CFPB issued a decision on a request by two companies for confidential treatment and for advance notice of a decision to disclose the existence of the investigation. The CFPB declined the request, holding that the companies had not demonstrated "good cause" for confidential treatment. Basing its analysis on the nondisclosure standards from the Administrative Procedures Act, the CFPB announced that it would agree to keep information confidential when the information includes privileged commercial or financial information obtained from a person or individual. None of the specific information the two companies sought to withhold (i.e., their names, the existence of the investigation and the respondents' corporate documents, including their articles of incorporation) met this standard. The CFPB acknowledged that "good cause" might be met by showing substantial harm to the respondent's competitive position, which could be caused by the disclosure of specific business, strategy or operational plans or structures.
The vast majority of investigations are not going to involve information or documentation that meets this high standard. As a result, financial institutions and other CID recipients should anticipate that a motion to set aside a CID will make the investigation public.
If the respondent opts to file a motion to set aside, there is little reason to be optimistic about the result. The review and determination of the motion is made by the Director of the CFPB. To date, there have been no reports that a motion to set aside was actually granted. As a legal matter, the CFPB states that it will uphold a CID as long as the information sought is relevant to an authorized investigation and the procedural requirements are followed.
As a result, in the vast majority of cases, the question for a person or entity served with a CID is how best to fully comply while limiting the amount of disclosure required by the CFPB. The best opportunity to limit the scope of a CID is with a genuine, realistic and informed discussion at the "meet and confer" meeting within 10 days of receipt. It is therefore critically important once served to hit the ground running and to engage legal counsel immediately. If the goal is to extend the time frame for compliance, the respondent should send people to the initial meeting who are well versed in the specific challenges the respondent faces in gathering the necessary information, including technical staff or third party vendor representatives for electronically stored information, if necessary. If the goal is to substantively limit the scope of the information and documents sought, the respondent must simply persuade the CFPB that the necessary information can be provided in a different and more streamlined manner. In either case, the respondent is relying on the discretion of the CFPB lawyer. There are certainly cases where investigations have been limited and timelines extended, however, so it is worth the effort and expense to properly prepare.
Finally, if a respondent cannot respond to a CID to the CFPB's satisfaction, the CFPB may decide to bring an action in federal court to enforce compliance. At this stage, the focus for the respondent should be on demonstrating that they attempted in good faith to comply with the CFPB at all relevant times.