I. INTRODUCTION
The Office of the Comptroller of the Currency (OCC) has issued a bulletin providing guidance to national banks and federal savings associations (“banks”) on the application of consumer protection requirements and safe and sound banking practices to consumer debt-sale arrangements with third parties (e.g., debt buyers) that intend to pursue collection of the underlying obligations. The bulletin is a statement of policy intended to advise banks about the OCC’s supervisory expectations for structuring debt-sale arrangements in a manner that is consistent with safety and soundness and promotes fair treatment of customers.
II. BACKGROUND
Pursuant to the Uniform Retail Classification and Account Management Policy guidelines, banks are generally required to charge off certain consumer debt when the debt is 180 days past due, and in some instances, earlier than 180 days past due. The majority of debt that banks charge off and sell to debt buyers is credit card debt, but banks also sell to debt buyers other delinquent debts, such as auto, home-equity, mortgage, and student loans.
Although banks charge off severely delinquent accounts, the underlying debt obligations may remain legally valid and consumers can remain obligated to repay the debts. Banks may pursue collection of delinquent accounts by (1) handling the collections internally, (2) using third parties as agents in collecting the debt, or (3) selling the debt to debt buyers for a fee. The guidance focuses on the third category of bank practice for fully charged-off debt.
Most debt-sale arrangements involve banks selling debt outright to debt buyers. Banks may price debt based on a small percentage of the outstanding contractual account balances. Typically, debt buyers obtain the right to collect the full amount of the debts. The OCC recognizes that banks can benefit from debt-sale arrangements by turning nonperforming assets into immediate cash proceeds and reducing the use of internal resources to collect delinquent accounts. In connection with charged-off loans, banks have a responsibility to their shareholders to recover losses. Still, banks must be cognizant of the significant risks associated with debt-sale arrangements, including operational, compliance, reputation, and strategic risks. Accordingly, banks that engage in debt sales should do so in a safe and sound manner and in compliance with applicable laws—including consumer protection laws—taking into consideration relevant guidance.
III. RISKS ASSOCIATED WITH SALE OF DEBT TO DEBT BUYERS
Selling debt to a debt buyer can significantly increase a bank’s risk profile, particularly in the areas of operational, reputation, compliance, and strategic risks. Increased risk most often arises from poor planning and oversight by the bank, and from inferior performance or service on the part of the debt buyer, and may result in legal costs or loss of business.
A. Operational risk. Operational risk is the risk of loss to earnings or capital from inadequate or failed internal processes, people, and systems or from external events. Banks face increased operational risk when they sell debt to debt buyers. Inadequate systems and controls can place the bank at risk for providing inaccurate information regarding the characteristics of accounts, including balances and length of time that the balance has been overdue. In addition, banks should be cognizant of the potential for fraud, human error, and system failures when selling debt to debt buyers.
B. Reputation risk. Reputation risk is the risk to a bank’s earnings or capital arising from negative public opinion. Banks should be keenly aware that debt buyers pursue collection from former or current bank customers. Even though a bank may have sold consumers’ debt to a debt buyer, the debt buyer’s behavior can affect the bank’s reputation if consumers continue to view themselves as bank customers. Moreover, abusive practices by debt purchasers, and other inappropriate debt-buyer tactics (including those that cause violations of law), are receiving significant levels of negative news media coverage and public scrutiny. When banks sell debt to debt buyers that engage in practices perceived to be unfair or detrimental to customers, banks can lose community support and business.
C. Compliance risk. Compliance risk is the risk to earnings or capital arising from violations of laws, rules, or regulations, or from nonconformance with internal policies and procedures or ethical standards. This risk exists when banks do not appropriately assess a debt buyer’s collection practices for compliance, or when the debt buyer’s operations are inconsistent with law, ethical standards, or the bank’s policies and procedures. The potential for serious or frequent violations or noncompliance exists when the bank’s oversight program does not include appropriate audit and control features, particularly when the debt buyer implements new collection strategies or expands existing ones. Compliance risk increases when privacy of consumer and customer records is not adequately protected, such as when confidential consumer data are released before a sale of the data, or when conflicts of interest between a bank and debt buyers are not appropriately managed, such as when the debt buyers pursue questionable collection tactics.
D. Strategic risk. Strategic risk is the risk to earnings or capital arising from adverse business decisions or improper implementation of those decisions. Strategic risk arises when a bank makes business decisions that are incompatible with the bank’s strategic goals or that do not provide an adequate return on investment. Strategic risk increases when bank management introduces new business decisions without performing adequate due diligence reviews or without implementing an appropriate risk management infrastructure to oversee the activity. Strategic risk also increases when management does not have adequate expertise and experience to properly carry out decisions. Decisions to sell debt to debt buyers must be carefully analyzed to ensure consistency with the bank’s strategic goals. Selling debt to debt buyers without first performing appropriate due diligence, or without taking steps to implement an appropriate risk management structure, including having capable management and staff in place to carry out debt sales, increases the bank’s strategic risks.
IV. SUPERVISORY CONCERNS WITH DEBT-SALE ARRANGEMENTS
Debt-sale arrangements can pose considerable risk to banks that do not conduct appropriate due diligence to assess and manage those risks. Through its supervisory process, the OCC has identified instances in which banks agreed to sell debt to debt buyers without full understanding of the debt buyers’ collection practices. Banks should know what resources debt buyers use to manage and pursue collections and consider the debt buyers’ past performance with consumer protection laws and regulations.
The OCC has identified situations in which banks inappropriately transferred customer information to debt buyers. In these instances, banks gave debt buyers access to customer files so they could assess credit quality before the debt sale, without the banks first making proper customer disclosures, which was inconsistent with the banks’ internal privacy policies and applicable laws and regulations. The OCC also has identified instances in which banks, debt buyers, or both had inadequate controls in place to protect the transfer of customer information. In addition, the OCC has identified debt-sale arrangements between banks and debt buyers that lacked confidentiality and information security provisions. Debt-sale arrangements between banks and debt buyers should clearly specify each party’s duties and obligations regarding confidential customer information, and should include provisions requiring debt buyers to comply with applicable laws and consumer protections.
Through its supervisory process, the OCC also has identified issues related to the adequacy of customer account information transferred from banks to debt buyers, including situations in which the transferred customer files lack information as basic as account numbers or customer payment histories. In these circumstances, because the debt buyers pursue collection without complete and accurate customer information, the debt buyers may employ inappropriate collection tactics or engage in conduct that is prohibited based on the facts of a particular case (e.g., pursue collection on a debt that was previously discharged in bankruptcy or after the applicable statute of limitations).
V. SUPERVISORY EXPECTATIONS OF DEBT SALES
The OCC expects banks to structure debt-sale arrangements in a prudent and safe and sound manner to promote the fair treatment of customers. OCC examinations assess management oversight of debt-sale arrangements and focus on compliance with applicable consumer protection statutes and potential safety and soundness issues. The OCC takes appropriate supervisory action to address any unsafe or unsound banking practices associated with debt sales to prevent harm to consumers and to ensure compliance with applicable laws.
OCC-supervised banks are expected to adopt appropriate practices in connection with debt sales. The OCC considers the following practices to be consistent with safety and soundness.
A. Ensure appropriate internal policies and procedures are developed and implemented to govern debt-sale arrangements consistently across the bank. Policies and procedures should:
B. Perform appropriate due diligence when selecting a debt buyer. Debt buyers pursue collection from former or current bank customers, so banks should fully understand the debt buyers’ collection practices, including the resources that debt buyers or their agents use to manage and pursue collection. Banks should perform appropriate due diligence before entering into debt-sale arrangements with debt buyers. For example, banks should assess the potential debt buyers’ background, experience, and past performance, including consumer complaints about the debt buyers, and assess steps taken by debt buyers to investigate and resolve the complaints. Before entering into any arrangements with debt buyers, banks should review all pertinent information (including audited financial statements) to confirm that debt buyers are financially sound and appropriately licensed and insured. In addition, before entering into debt-sale arrangements, banks should determine what repurchase and litigation reserves should be established given the size and type of debt sales contemplated.
Before a bank enters into a contract with a debt buyer, the debt buyer should be able to demonstrate that it maintains tight control over its network of debt buyers and that it conducts activities in a manner that will not harm the bank’s reputation. In particular, a debt buyer’s staff should be appropriately trained to ensure that it follows applicable consumer protection laws and treats customers fairly throughout the collection process. In addition, banks contemplating entering into a relationship with debt buyers should first assess the debt buyer’s record of compliance with consumer protection laws and regulations. Banks should conduct this level of due diligence before entering into new relationships with debt buyers, and periodically when forward-flow contractual arrangements are in place. Banks should reserve the right to terminate such relationships when appropriate. This means banks should develop and implement controls and processes to ensure risks are properly measured, monitored, and controlled, and develop and implement appropriate performance review systems.
C. Ensure debt-sale arrangements with debt buyers cover all important considerations. The structure of the arrangements between the banks and the debt buyers depends on the written contracts between the parties. The contracts should reflect clear, consistent terminology. To the extent that more than one business line at the bank sells debt, banks, if appropriate, should use standard language for all business lines’ debt-sale arrangements. Regardless of the structure of the arrangements, the duties and obligations of the parties, particularly provisions for confidentiality and information security, should be clearly delineated in the contracts, as should responsibility for compliance with applicable consumer protection laws. This includes a termination plan to ensure that customer information is returned to the bank or destroyed in accordance with the debt-sale arrangement. In addition, banks should include minimum-service-level agreements in debt-sale arrangements to promote fair and consistent treatment of customers, applicable whether debt buyers conduct the collection activities or employ other collection agents.
Banks should ensure that the debt-sale arrangements address the extent to which the debt buyers can resell debt. Each time account information changes hands, risk increases that key information will be lost or corrupted, calling into question the legal validity and ownership of the underlying debt. Moreover, resales of debt increase the possibility that subsequent purchasers will pursue collection efforts against the wrong individual, seek to collect the wrong amount, or both. Therefore, in drafting debt-sale arrangements, banks should address whether subsequent resales of former bank debt would be permitted. If so, debt-sale arrangements should obligate the initial debt buyer to conduct thorough due diligence on the proposed purchaser and to pass on all account information and documentation in its possession to a subsequent buyer.
Banks should ensure that contracts with debt buyers address the volume of accounts (both in terms of the total dollar amount and percentage of debt sold, as well as aggregate numbers of accounts) and the reasons why the debt buyer can litigate. Debt-sale arrangements should address the debt buyers’ obligations to engage in ongoing efforts to maintain the accuracy of the information provided by banks. Lastly, where applicable, banks should ensure that contracts do not include compensation provisions that incent debt buyers to act aggressively or improperly.
D. Provide accurate and comprehensive information regarding each debt sold, at the time of sale. Banks should ensure that their debt buyers have accurate and complete information necessary to enable them to pursue collections in compliance with applicable laws and consumer protections. Banks that engage in debt sales should have a strong risk management culture, including a quality control function that evaluates all proposed debt sales before they occur. This may involve the use of “data scrubs” and transactional sampling to ensure that account data are complete and accurate before accounts are transferred to the buyer.
For each account, the bank should provide the debt buyer with copies of underlying account documents, and the related account information, as applicable and in compliance with record retention requirements, including the following:
E. Certain types of debt are not appropriate for sale. Debt clearly not appropriate for sale, because it likely fails to meet the basic requirements to be an ongoing legal debt, includes the following:
In addition, banks should refrain from the sale of certain additional types of debt because the sales of these types of accounts may pose greater potential compliance and reputational risk. These include:
If banks are required to repurchase accounts from debt buyers after sales are completed, the banks’ quality control personnel should evaluate why the accounts were returned and determine whether additional quality controls need to be implemented. If necessary, banks should complete look-back reviews to determine whether they or the debt buyers engaged in practices that hurt consumers.
F. Comply with applicable laws and regulations. Banks should implement effective compliance risk management systems, including processes and procedures to appropriately manage risks in connection with debt-sale arrangements. Examiners review banks’ debt-sale arrangements for compliance with applicable consumer protection statutes and regulations. In particular, banks should ensure that all parties involved in the debt-sale arrangement have strong controls in place to ensure that sensitive customer information is appropriately protected.
Federal laws and regulations applicable to debt sales include the following:
G. Implement appropriate oversight of the debt-sale arrangement. The bank’s oversight responsibilities will vary depending on the structure of the arrangement between the bank and the debt buyer. Regardless of the structure of the arrangement, the bank’s appropriate oversight of the debt-sale arrangement is important to minimize the bank’s exposure to potential reputation damage and supervisory action. In addition to monitoring the implementation of the sales contract, particularly when the bank is engaged in a forward-flow arrangement with a debt buyer, the bank should consider, as applicable, (1) reviewing the debt-buyer’s annual financial statements to ensure ongoing financial strength, (2) remaining alert for any relevant adverse information about the debt-buyer’s principals, and (3) monitoring the bank’s complaints for any potential adverse treatment of consumers by the debt buyer. In addition, the bank’s ongoing due diligence should be focused on the volume of, and reasons for, repurchases by the bank. The bank’s audit program should periodically evaluate its compliance with its debt-sale policies and procedures. Results of all oversight activities should be reported periodically to the bank’s board of directors or designated committee, including identified weaknesses, which should be documented and properly addressed.
VI. CONCLUSION
Examiners determine whether bank management has established controls and implemented a rigorous analytical process to identify, measure, monitor, and manage the risks associated with debt sales. If examiners find unsafe or unsound practices or practices that fail to comply with applicable laws or regulations, the OCC will take appropriate supervisory action, including enforcement actions, when warranted. When the OCC becomes aware of concerns with nonbank debt buyers, the agency refers those issues to the CFPB, which has jurisdiction over these entities.