Office of the Comptroller of the Currency Updates “Unfair or Deceptive Acts or Practices and Unfair, Deceptive, or Abusive Acts or Practices” Booklet

Financial institutions that are regulated and supervised by the Office of the Comptroller of the Currency (OCC) should know that the OCC has recently updated its booklet on Unfair or Deceptive Acts or Practices (UDAP) and Unfair, Deceptive, or Abusive Acts or Practices (UDAAP). The booklet — which is designed to inform examiners about the risks of banks and their third parties engaging in lending, marketing, overdraft programs, or other practices that may constitute UDA(A)P — was last updated in June 2020.

Federal law has long prohibited UDAP (under section 5 of the Federal Trade Commission Act, as enforced by the Federal Trade Commission) and UDAAP (under the Consumer Financial Protection Act of 2010, as enforced by the Consumer Financial Protection Bureau), but the OCC’s update sets forth expanded procedures for examiners to evaluate risks under those laws and serves as a reminder that the OCC will continue to emphasize them in its supervisory and enforcement matters.

In its updated booklet, the OCC:

• Offers clarity on sound risk management practices for third-party relationships, emphasizing that risk can increase when a bank offers products or services through third parties or outsources origination, servicing, or operational processes to such parties; 
• Guides examiners on overdraft services and overdraft protection program risk management;
• Incorporates Consumer Financial Protection Bureau updates on data protection and information security policies and procedures;
• Offers detail about loan and deposit account management, identifying activities that heighten regulatory risk;
• Updates the “Appendix B: UDAP and UDAAP Risk Indicators;” and
• Incorporates OCC and interagency issuances that have been published or rescinded since June 2020;

OCC-regulated entities can use the booklet as a resource as they manage the regulatory compliance landscape. The appendices at the booklet’s conclusion are particularly beneficial, as they outline a structured approach to assess risk and provide a framework for evaluating the effectiveness of an institution’s compliance management systems. That said, given the expansive nature of the UDA(A)P prohibitions, there is no one-size-fits all approach. Effectively managing UDAAP risk requires a detailed, institution-specific analysis that takes into account the unique characteristics of the underlying products and services and how they are marketed and delivered to consumers.

Foley’s consumer finance practice is well-versed in helping financial institutions, fintech clients, and other regulated entities to assess and mitigate risk and compliance management, including in areas such as:

• Managing third party relationships (e.g., with marketing companies, mortgage brokers, mortgage loan originators, financial technology partners, or collection companies);
• Developing and/or assessing the sufficiency of consumer disclosures, including as they relate to new products or programs;
• Troubleshooting information technology (IT) systems and applications, including data protection for consumer information and how it could affect UDA(A)P risk;
• Reviewing marketing materials and contract terms to ensure they remain accurate and do not potentially mislead consumers about a product or service; and
• Evaluating any fees connected to a product or service that a regulator could deem to be a “junk fee.”