CFPB Faces Increasing Challenges to Its Authority to Investigate Violations of Consumer Financial Laws

Lucy  Morris Erik Kosa

By Lucy Morris & Erik Kosa

Lucy Morris is a partner in the Washington, D.C., offices of Hudson Cook, LLP, where she heads the firm's Government Investigations, Examinations, and Enforcement Practice Group. Before joining Hudson Cook, Lucy worked at the Consumer Financial Protection Bureau for four years as a Deputy Enforcement Director for Litigation. Erik Kosa is a Senior Associate at Hudson Cook and a member of the firm's Government Investigations, Examinations, and Enforcement Practice Group.

Six years into its existence, the Consumer Financial Protection Bureau is facing increasing challenges to its authority. While Congress is contemplating dramatic changes to the Bureau’s powers and structure, several challenges to the Bureau’s law enforcement powers are proceeding in the federal courts.

As a relatively new agency, the CFPB is bound to test the limits of its authority, and in return, companies are increasingly fighting back against what they perceive as regulatory overreach. This is especially true when it comes to enforcement investigations, where several recipients of civil investigative demands (administrative subpoenas) have challenged the Bureau’s jurisdictional limits in federal court.

These cases serve as important reminders that the CFPB’s enforcement powers are far-reaching and, with few exceptions, federal courts are largely deferential to the Bureau’s ability to issue civil investigative demands. Taken together, these cases provide important insight into whether and how to challenge the issuance of a civil investigative demand (“CID”).

The recent jurisdictional challenges fall into a few broad categories: (1) procedural defects in the CID, (2) whether the CFPB has authority over the product; and (3) whether the Bureau has authority over the entity itself.

In CFPB v. Accrediting Council for Independent Colleges and Schools, a procedural defect in the CID resulted in the Bureau’s most clear-cut defeat so far. There, the CFPB issued a CID to an entity that accredits for-profit colleges, seeking to investigate its role in the accreditation process. Among other things, the CID sought a list of all schools ACICS had accredited since 2010 and a list of all individuals involved in the accreditation of 21 enumerated schools.

Rejecting the CFPB’s argument that it could investigate school accreditation because it also had authority over for-profit schools’ lending, the district court held there was no nexus between the consumer financial laws and the accreditation of for-profit schools. On April 21, 2017, the D.C. Circuit affirmed the district court’s dismissal of the CFPB’s CID enforcement action. But this decision is less of a setback for the CFPB than it may seem.

In rejecting the CFPB’s CID, the court based its holding on narrower ground than the district court, limiting its ruling to a procedural defect in the CID.The D.C. Circuit focused solely on the wording of the CID’s Notification of Purpose—the statutorily required preface to every CID that sets out the scope of the investigation.

Courts routinely uphold broad statements of purpose in evaluating agency demands for information, but the statement here was so broad as to be useless. Here, the Notification of Purpose said:

The purpose of this investigation is to determine whether any entity or person has engaged or is engaging in unlawful acts and practices in connection with accrediting for-profit colleges[.]

While a Notification of Purpose may use broad terms to describe an investigation’s purpose, it must provide the recipient of the CID with sufficient notice as to the nature of the alleged conduct under investigation. The D.C. Circuit found that this CID did not explain what the vague phrase “unlawful acts and practices” meant in this investigation. Because the Notification of Purpose did not adequately describe the conduct the CFPB was investigating, the court could not determine whether the information sought by the CID was reasonably relevant to a valid investigation. The court’s focus on the drafting of the Notification of Purpose is significant because presumably a better-drafted Notification of Purpose could pass muster, making this less than a categorical defeat for the CFPB.

CID recipients have also been challenging the CFPB’s authority over their products. In CFPB v. Harbour Portfolio Advisors, the CFPB issued a CID investigating financial products called Agreements for Deed (also known as Contracts for Deed). Agreements for Deed are written agreements to purchase residential property in exchange for a sum of money where the seller agrees to deliver the deed to the purchaser upon payment in full of the purchase price. There, the seller argued that this product was not subject to the CFPB’s jurisdiction because it did not involve extending credit and that it was more like a residential lease or rent-to-own transaction, neither of which constitute “credit” subject to CFPB jurisdiction.

The district court adopted a very deferential view of the CFPB’s investigatory powers, deciding that it was too early in the investigation to determine whether these products constitute “credit” and rejecting the notion that the investigation into Agreements for Deed was subject to a facial challenge.

Holding that the applicable standard was only whether jurisdiction was “plainly lacking,” the court declined to reach the ultimate issue of whether Agreements for Deed are in fact “credit,” and punted to allow more factual development of that issue. The upshot of this approach—that whether a product is “credit” is a factually sensitive question—is that companies in similar situations will likely have to bear the costs of responding to a CID, waiting for any subsequent lawsuit, litigating a motion to dismiss, and possibly proceeding to summary judgment before obtaining a ruling on whether their product is subject to CFPB jurisdiction. This is a very deferential view of the CID power.

In CFPB v. J.D. Wentworth, the CFPB is seeking to investigate a company that advances funds in exchange for the rights to future payments from structured settlements. Structured settlements, which are legally binding obligations to pay a set amount of money in installments over time, are commonly used to compensate plaintiffs in tort settlements. Wentworth argues that its products are not “credit” subject to the Truth-in-Lending Act or a “consumer financial product or service” subject to the Dodd-Frank Act because structured settlements represent the sale of the right to receive payments, and are essentially assignments of contractual rights rather than anything akin to credit.

The CFPB’s petition to enforce its CID has been briefed, though the parties are currently briefing how they believe the ACICS and Harbour opinions should affect the outcome. The district court has yet to issue an opinion. This case has dragged on for a considerable length of time: the CFPB issued the initial CID in September 2015, modified it in March 2016, filed a petition to enforce the CID in June 2016, and there is not yet a decision from the court. Once the district court rules, an appeal could follow.

The extent of the CFPB’s authority over entities themselves is currently being tested by tribal-controlled lenders who contend they are cloaked in sovereign immunity. In CFPB v. Great Plains Lending, the Ninth Circuit enforced CIDs issued to three limited liability companies established and controlled by three Indian tribes that each provide financial products and services to a broad consumer base extending beyond tribal Indians. In contesting the CFPB’s jurisdiction to investigate them, the tribal entities argued that they are not “persons” subject to investigation under the Consumer Financial Protection Act (“CFPA”). The Ninth Circuit rejected this argument, reasoning that while the CFPA defines “state” to include Indian tribe, the definition of “persons” subject to the Bureau’s enforcement authority did not specifically exclude tribes, and thus jurisdiction is not “plainly lacking.” The tribal entities were unsuccessful in their attempts to stay the court’s order to enforce the CIDs while they petitioned the Supreme Court for review, though a Supreme Court review of the merits is still possible while the case proceeds.

Read together, these cases indicate that federal courts on the whole are quite deferential to the CFPB’s power to conduct investigations and are hesitant to curb those powers at the outset of an investigation.

Apart from the merits, an important consideration in deciding whether to challenge the issuance of a CID is maintaining the confidentiality of the investigation. The Bureau’s rules for investigation provide an administrative process by which a recipient of CID may petition to modify or set aside the demand. Importantly, a petition becomes part of the public record—making public the fact of the investigation—unless the Bureau determines good cause exists that it should remain confidential.

Thus, the sweeping nature of the Bureau’s statutory and regulatory authority make it difficult to challenge a CID while keeping the fact of the investigation confidential. Note also how broad the CFPB’s statutory investigative authority is: section 1052 of the Dodd-Frank Act states that the Bureau may issue a civil investigative demand to “ any person” who has information “relevant to a violation.” Thus, even if you are not a covered person under the Dodd-Frank Act, the CFPB can still investigate, with the only limitation being that it has reason to believe you have information “relevant to a violation.” And, as discussed above, if you attempt to challenge the CID, the fact of the investigation can become public. And while not all recipients of CIDs are the subjects of the investigation—sometimes CIDs are issued to third parties purely to seek information—there is often reputational harm involved with the disclosure of a recipient’s identity.


Challenging a CID is an uphill battle and carries risk. At the same time, the CFPB’s investigative authority is not unlimited, as shown by the court’s dismissal of the CID to the accrediting council. It is also important to remember that CIDs are not self-enforcing: a CID challenge stays the Bureau’s investigation until the CFPB obtains a court order enforcing the CID. Moreover, to the extent a CID is overbroad and a party has not obtained relief through the agency’s administrative process, challenging a CID in court can be another way to address unduly burdensome requests. And while parties continue to challenge the CFPB’s CID authority, a far more serious challenge to the CFPB’s authority is playing out in Congress. It remains to be seen whether the CFPB will continue to hold its vast investigative authority.

Copyright © 2017 The Bureau of National Affairs, Inc. All Rights Reserved.