RATING SYSTEMS—Consumer Compliance

The Federal Financial Institutions Examination Council (FFIEC) member agencies (agencies) promote compliance with federal consumer protection laws and regulations through supervisory and outreach programs.¹ The agencies engage in consumer compliance supervision to assess whether a financial institution is meeting its responsibility to comply with these requirements.

This Uniform Interagency Consumer Compliance Rating System (CC Rating System) provides a general framework for assessing risks during the supervisory process using certain compliance factors and assigning an overall consumer compliance rating to each federally regulated financial institution.² The primary purpose of the CC Rating System is to ensure that regulated financial institutions are evaluated in a comprehensive and consistent manner, and that supervisory resources are appropriately focused on areas exhibiting risk of consumer harm and on institutions that warrant elevated supervisory attention.

The CC Rating System is composed of guidance and definitions. The guidance provides examiners with direction on how to use the definitions when assigning a consumer compliance rating to an institution. The definitions consist of qualitative descriptions for each rating category and include compliance management system (CMS) elements reflecting risk control processes designed to manage consumer compliance risk and considerations regarding violations of laws, consumer harm, and the size, complexity, and risk profile of an institution. The consumer compliance rating reflects the effectiveness of an institution’s CMS to ensure compliance with consumer protection laws and regulations and reduce the risk of harm to consumers.

The agencies developed the following principles to serve as a foundation for the CC Rating System.

Risk-based. Recognize and communicate clearly that CMS vary based on the size, complexity, and risk profile of supervised institutions.

Transparent. Provide clear distinctions between rating categories to support consistent application by the agencies across supervised institutions. Reflect the scope of the review that formed the basis of the overall rating.

Actionable. Identify areas of strength and direct appropriate attention to specific areas of weakness, reflecting a risk-based supervisory approach. Convey examiners’ assessment of the effectiveness of an institution’s CMS, including its ability to prevent consumer harm and ensure compliance with consumer protection laws and regulations.

Incent compliance. Incent the institution to establish an effective consumer compliance system across the institution and to identify and address issues promptly, including self-identification and correction of consumer compliance weaknesses. Reflect the potential impact of any consumer harm identified in examination findings.

The CC Rating System is based upon a numeric scale of 1 through 5 in increasing order of supervisory concern. Thus, 1 represents the highest rating and consequently the lowest degree of supervisory concern, while 5 represents the lowest rating and the most critically deficient level of performance, and therefore, the highest degree of supervisory concern.³ Ratings of 1 or 2 represent satisfactory or better performance. Ratings of 3, 4, or 5 indicate performance that is less than satisfactory. Consistent with the previously described principles, the rating system incents a financial institution to establish an effective CMS across the institution, to self-identify risks, and to take the necessary actions to reduce the risk of noncompliance and consumer harm.

The CC Rating System is organized under three broad categories:

The Consumer Compliance Rating Definitions below (see table) list the assessment factors considered within each category, along with narrative descriptions of performance.

The first two categories, Board and Management Oversight and Compliance Program, are used to assess a financial institution’s CMS. As such, examiners should evaluate the assessment factors within these two categories commensurate with the institution’s size, complexity, and risk profile. All institutions, regardless of size, should maintain an effective CMS. The sophistication and formality of the CMS typically will increase commensurate with the size, complexity, and risk profile of the entity.

Additionally, compliance expectations contained within the narrative descriptions of these two categories extend to third-party relationships into which the financial institution has entered. There can be certain benefits to financial institutions engaging in relationships with third parties, including gaining operational efficiencies or an ability to deliver additional products and services, but such arrangements also may expose financial institutions to risks if not managed effectively. The prudential agencies, the CFPB, and some states have issued guidance describing expectations regarding oversight of third-party relationships. While an institution’s management may make the business decision to outsource some or all of the operational aspects of a product or service, the institution cannot outsource the responsibility for complying with laws and regulations or managing the risks associated with third-party relationships.

As noted in the Consumer Compliance Rating Definitions, examiners should evaluate activities conducted through third-party relationships as though the activities were performed by the institution itself. Examiners should review a financial institution’s management of third-party relationships and servicers as part of its overall compliance program.

The third category, Violations of Law and Consumer Harm, includes assessment factors that evaluate the dimensions of any identified violation or consumer harm. Examiners should weigh each of these four factors—root cause, severity, duration, and pervasiveness—in evaluating relevant violations of law and any resulting consumer harm.

Under Board and Management Oversight, the examiner should assess the financial institution’s board of directors and management, as appropriate for their respective roles and responsibilities, based on the following assessment factors:

Under Compliance Program, the examiner should assess other elements of an effective CMS, based on the following assessment factors:

Under Violations of Law and Consumer Harm, the examiner should analyze the following assessment factors:

As a result of a violation of law, consumer harm may occur. While many instances of consumer harm can be quantified as a dollar amount associated with financial loss, such as charging higher fees for a product than was initially disclosed, consumer harm may also result from a denial of an opportunity. For example, a consumer could be harmed when a financial institution denies the consumer credit or discourages an application in violation of the Equal Credit Opportunity Act,⁴ whether or not there is resulting financial harm.

This category of the Consumer Compliance Rating Definitions defines four factors by which examiners can assess violations of law and consumer harm.

Root cause. The root cause assessment factor analyzes the degree to which weaknesses in the CMS gave rise to the violations. In many instances, the root cause of a violation is tied to a weakness in one or more elements of the CMS. Violations that result from critical deficiencies in the CMS evidence a critical absence of management oversight and are of the highest supervisory concern.

Severity. The severity assessment factor of the Consumer Compliance Rating Definitions weighs the type of consumer harm, if any, that resulted from violations of law. More severe harm results in a higher level of supervisory concern under this factor. For example, some consumer protection violations may cause significant financial harm to a consumer, while other violations may cause negligible harm, based on the specific facts involved.

Duration. The duration assessment factor considers the length of time over which the violations occurred. Violations that persist over an extended period of time will raise greater supervisory concerns than violations that occur for only a brief period of time. When violations are brought to the attention of an institution’s management and management allows those violations to remain unaddressed, such violations are of the highest supervisory concern.

Pervasiveness. The pervasiveness assessment factor evaluates the extent of the violation(s) and resulting consumer harm, if any. Violations that affect a large number of consumers will raise greater supervisory concern than violations that impact a limited number of consumers. If violations become so pervasive that they are considered to be widespread or present in multiple products or services, the institution’s performance under this factor is of the highest supervisory concern.

Strong compliance programs are proactive. They promote consumer protection by preventing, self-identifying, and addressing compliance issues in a proactive manner. Accordingly, the CC Rating System provides incentives for such practices through the definitions associated with a 1 rating.

The agencies believe that self-identification and prompt correction of violations of law reflect strengths in an institution’s CMS. A robust CMS appropriate for the size, complexity, and risk profile of an institution’s business often will prevent violations or will facilitate early detection of potential violations. This early detection can limit the size and scope of consumer harm. Moreover, self-identification and prompt correction of serious violations represents concrete evidence of an institution’s commitment to responsibly address underlying risks. In addition, appropriate corrective action, including both correction of programmatic weaknesses and full redress for injured parties, limits consumer harm and prevents violations from recurring in the future. Thus, the CC Rating System recognizes institutions that consistently adopt these strategies as reflected in the Consumer Compliance Rating Definitions.

The consumer compliance rating is derived through an evaluation of the financial institution’s performance under each of the assessment factors described above. The consumer compliance rating reflects the effectiveness of an institution’s CMS to identify and manage compliance risk in the institution’s products and services and to prevent violations of law and consumer harm, as evidenced by the financial institution’s performance under each of the assessment factors.

The consumer compliance rating reflects a comprehensive evaluation of the financial institution’s performance under the CC Rating System by considering the categories and assessment factors in the context of the size, complexity, and risk profile of an institution. It is not based on a numeric average or any other quantitative calculation. Specific numeric ratings will not be assigned to any of the 12 assessment factors. Thus, an institution need not achieve a satisfactory assessment in all categories in order to be assigned an overall satisfactory rating. Conversely, an institution may be assigned a less than satisfactory rating even if some of its assessments were satisfactory.

The relative importance of each category or assessment factor may differ based on the size, complexity, and risk profile of an individual institution. Accordingly, one or more category or assessment factor may be more or less relevant at one financial institution as compared to another institution. While the expectations for compliance with consumer protection laws and regulations are the same across institutions of varying sizes, the methods for accomplishing an effective CMS may differ across institutions.

The evaluation of an institution’s performance within the violations of law and consumer harm category of the CC Rating Definitions considers each of the four assessment factors: root cause, severity, duration, and pervasiveness. At the levels of 4 and 5 in this category, the distinctions in the definitions are focused on the root cause assessment factor rather than severity, duration, and pervasiveness. This approach is consistent with the other categories where the difference between a 4 and a 5 is driven by the institution’s capacity and willingness to maintain a sound consumer compliance system.

In arriving at the final rating, the examiner must balance potentially differing conclusions about the effectiveness of the financial institution’s CMS over the individual products, services, and activities of the organization. Depending on the relative materiality of a product line to the institution, an observed weakness in the management of that product line may or may not impact the conclusion about the institution’s overall performance in the associated assessment factor(s). For example, serious weaknesses in the policies and procedures or audit program of the mortgage department at a mortgage lender would be of greater supervisory concern than those same gaps at an institution that makes very few mortgage loans and strictly as an accommodation. Greater weight should apply to the financial institution’s management of material products with significant potential consumer compliance risk.

An institution may receive a less than satisfactory rating even when no violations were identified, based on deficiencies or weaknesses identified in the institution’s CMS. For example, examiners may identify weaknesses in elements of the CMS in a new loan product. Because the presence of those weaknesses left unaddressed could result in future violations of law and consumer harm, the CMS deficiencies could impact the overall consumer compliance rating, even if no violations were identified.

Similarly, an institution may receive a 1 or 2 rating even when violations were present, if the CMS is commensurate with the risk profile and complexity of the institution. For example, when violations involve limited impact on consumers, were self-identified, and resolved promptly, the evaluation may result in a 1 or 2 rating. After evaluating the institution’s performance in the two CMS categories, Board and Management Oversight and Compliance Program, and the dimensions of the violations in the third category, the examiner may conclude that the overall strength of the CMS and the nature of observed violations viewed together do not present significant supervisory concerns.

The prudential regulators will continue to assign and update, as appropriate, consumer compliance ratings for institutions they supervise, including those with total assets of more than $10 billion.⁵ As a member of the FFIEC, the CFPB will also use the CC Rating System to assign a consumer compliance rating, as appropriate, for institutions with total assets of more than $10 billion, as well as for nonbanks for which it has jurisdiction regarding the enforcement of federal consumer financial laws as defined under the Dodd-Frank Act.⁶ The prudential regulators will take into consideration any material supervisory information provided by the CFPB, as that information relates to covered supervisory activities or covered examinations.⁷ Similarly, the CFPB will take into consideration any material supervisory information provided by prudential regulators in appropriate supervisory situations.

State regulators maintain supervisory authority to conduct examinations of state-chartered depository institutions and licensed entities. As such, states may assign consumer compliance ratings to evaluate compliance with both state and federal laws and regulations. States will collaborate and consider material supervisory information from other state and federal regulatory agencies during the course of examinations.