Dodd-Frank Regulations: Consumer Financial Protection Bureau Needs a Systematic Process to Prioritize Consumer Risks

The Dodd-Frank Act created CFPB to regulate the provision of consumer financial products and services. Congress included a provision in statute for GAO to study financial services regulations annually, including CFPB’s related activities. This eighth annual report examines steps CFPB has taken to (1) identify, monitor, and report on risks to consumers in support of its rulemakings and other functions and (2) retrospectively assess the effectiveness of certain rules within 5 years of their effective dates.

GAO reviewed CFPB policies and procedures, internal and public reports, and memorandums documenting key decisions, assessment plans, and requests for public comment. GAO also interviewed officials from CFPB, three federal agencies with which it coordinated, and representatives of consumer and industry groups.

In accordance with the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), the Consumer Financial Protection Bureau (CFPB) has routinely monitored the consumer financial markets to identify potential risks to consumers related to financial products and services. CFPB monitors consumer complaints, analyzes market data, and gathers market intelligence from external groups (see figure for sources of CFPB’s monitoring). CFPB has used risk-monitoring findings to inform its rulemakings, supervision, and other functions. In 2015, CFPB initiated a bureau-wide process for using market data and other information to set policy priorities related to addressing risks to consumers. However, CFPB has not yet decided whether it will continue to use this process to set priorities. CFPB currently lacks a systematic, bureau-wide process for prioritizing financial risks to consumers and considering how it will use its tools—such as rulemaking, supervision, and consumer education—to address them. Federal internal control standards state that management should use quality information to achieve agency objectives and that it should also identify, analyze, and respond to risks related to achieving those objectives. Implementing a bureau-wide prioritization process could help to ensure that CFPB effectively focuses its resources on the most significant financial risks to consumers and enhances its ability to meet its statutory consumer protection objectives.

CFPB has taken steps to retrospectively assess its significant rules within 5 years of these rules becoming effective, as required by the Dodd-Frank Act. CFPB developed and applied criteria to identify three rules as significant and requiring a retrospective assessment. For these three rules, CFPB created assessment plans, issued public requests for comment and information, and reached out to external parties for additional data and evidence. In October 2018, CFPB issued its first assessment report on a rule related to cross-border money transfers. Among other things, the report found that certain trends, such as increasing volume of these transfers, continued after the rule took effect. CFPB expects to complete the other two assessments by the January 2019 deadline.

GAO recommends that CFPB implement a systematic process for prioritizing risks to consumers and considering how to use its available policy tools—such as rulemaking, supervision, enforcement, and consumer education—to address these risks. CFPB did not agree or disagree with the recommendation but agreed with the importance of having processes in place to prioritize and address consumer financial risks.

The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd- Frank Act) created the Bureau of Consumer Financial Protection (also  known as the Consumer Financial Protection Bureau, or CFPB) to  regulate the offering and provision of financial products or services under  federal consumer financial laws. The act consolidated many of the  consumer financial protection authorities previously shared by seven  federal agencies into one. It also provided CFPB additional authorities  related to supervising for compliance with and enforcing federal consumer  financial laws, handling consumer complaints, promoting financial  education, and monitoring the functioning of consumer financial products  markets for risks to consumers.

The Dodd-Frank Act set forth deadlines for CFPB to complete  rulemakings in certain areas and also granted CFPB authority to take  additional actions needed to carry out the purpose and objectives of  federal consumer financial laws. Section 1022 of the act contained  requirements related to CFPB’s rulemaking authority. Among other  requirements, it directed CFPB to monitor consumer financial markets for  risks to consumers in the offering or provision of consumer financial  products or services in support of its rulemaking and other functions. It  also required CFPB to retrospectively assess, among other things, the  effectiveness of its significant rules or orders and publish a report of such  assessment within 5 years of the rule or order’s effective date.

Section 1573(a) of the Department of Defense and Full-Year Continuing  Appropriations Act of 2011 amended the Dodd-Frank Act and included a  provision for us to annually review financial services regulations, including  those of CFPB. We have previously issued seven reports under this  mandate. This report examines steps CFPB has taken to (1) identify,  monitor, and report on risks to consumers in support of its rulemakings  and other functions and (2) retrospectively assess the effectiveness of  certain rules within 5 years of their effective dates.

To evaluate how CFPB identifies, monitors, and reports on risks to  consumers, we reviewed CFPB policies, procedures, and other  documentation of its processes. These documents included the values  statement for the offices that conduct market monitoring and policies on  data governance, information sharing, and advisory groups. We also  reviewed CFPB’s public reports, such as its semiannual reports to  Congress; its rulemaking agendas; and more than 100 internal market  intelligence reports from July 2016 through July 2018.

To evaluate the steps CFPB has taken to retrospectively assess certain  rules, we reviewed internal CFPB memorandums and presentations from  early 2015 to mid-2018 documenting key decisions about the process, as  well as the assessment plans and requests for public comment for the  three rules CFPB has chosen to retrospectively assess. In addition, we  reviewed CFPB’s retrospective assessment report on its Remittance  Rule—the only assessment report to be issued within our reporting time  frames. For both objectives, we compared CFPB’s efforts to Dodd-Frank  Act requirements and federal internal control standards. We also  interviewed officials from CFPB and three federal agencies with which  CFPB coordinated for its risk-monitoring or retrospective assessment  efforts—the Federal Housing Finance Agency, Board of Governors of the  Federal Reserve System (Federal Reserve), and Office of the Comptroller  of the Currency. Finally, we interviewed representatives of three  consumer groups and four industry groups about their communication  with CFPB regarding these efforts.

We conducted this performance audit from April 2018 to December 2018  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

CFPB’s Research, Markets, and Regulations Division has primary  responsibility for CFPB’s efforts to monitor market developments and  risks to consumers and to retrospectively assess rules. As shown in  figure 1, the division is composed of the Office of Research, the Office of  Regulations, and the following four offices (collectively known as the  “Markets Offices”), which are focused on different consumer financial  markets:

The Office of Card, Payment, and Deposit Markets monitors credit  cards, deposit accounts, prepaid cards, and remittances, as well as  other emerging forms of payment and related technologies, such as  mobile payments and virtual currencies. It also monitors data  aggregation services.

The Office of Consumer Lending, Reporting, and Collection Markets  monitors debt collection, debt relief, and consumer reporting and  scoring, as well as student, auto, and the small-dollar and personal  lending markets.

The Office of Mortgage Markets monitors the mortgage markets,  including originations, servicing, and secondary markets.

The Office of Small Business Lending Markets monitors credit to small  businesses, including traditional lenders, specialty financing, and  emerging technologies.

The four Markets Offices are responsible for collecting and sharing  market intelligence, helping to shape CFPB policy (including through  participation on rulemaking teams), and helping to inform the marketplace  through research and outreach. The Office of Research is responsible for  conducting research to support the design and implementation of CFPB’s  consumer protection policies, including developing and writing any  required cost-benefit analyses for rulemakings. Among other things, these  offices research, analyze, and report on consumer financial markets  issues. These offices also help inform the work of the Office of  Regulations, which supports and provides strategic direction for CFPB’s  rulemaking, guidance, and regulatory implementation functions.

The Markets Offices and the Office of Research contribute to CFPB’s  efforts to address the Dodd-Frank Act requirement that CFPB monitor for  certain risks to consumers in support of its rulemaking and other  functions. This provision states that CFPB may consider a number of  factors in allocating its resources for risk-monitoring efforts with regard to  consumer financial products and the markets for those products, such as  consumers’ understanding of a type of product’s risks, the extent to which  existing law is likely to protect consumers, and any disproportionate  effects on traditionally underserved consumers. Further, the Dodd-Frank  Act gives CFPB authority in connection with such monitoring to gather  information from time to time regarding the organization, business  conduct, markets, and activities of covered persons or service providers  from a variety of sources, including several sources specified in the act.  Finally, this provision requires CFPB to issue at least one report of  significant findings from its risk monitoring each calendar year.

The Office of Research has led CFPB’s efforts to address the Dodd-Frank  Act requirement that CFPB conduct assessments of each significant final  rule or order it adopts and publish a report of the assessment no later  than 5 years after the rule or order’s effective date. Before publishing a  report of its assessment, CFPB must invite public comment on whether  the rule or order should be modified, expanded, or eliminated. In addition,  the Dodd-Frank Act provides CFPB authority to require covered persons  or service providers to provide information to help support these  assessments, as well as to support its risk-monitoring activities.

In addition to the Research, Markets, and Regulations Division, other  CFPB divisions and offices conduct outreach to help inform CFPB policy  making. For example, CFPB’s External Affairs Division facilitates  conversation with stakeholders, such as Congress, financial institutions,  state governments, and the public. In addition, in the Consumer  Education and Engagement Division, the Office of Consumer Response  manages the intake of and response to complaints about consumer  financial products and services. All of the divisions report to the Director.  In November 2017, the President designated a new Acting Director of  CFPB, and in December 2018, the Senate voted to confirm a new  Director of the bureau.

CFPB Monitors Consumer Financial Markets to Inform Policy but Does Not Systematically Prioritize Consumer Risks

CFPB Routinely Monitors Market Trends and Collects Targeted Information for Rulemaking and Other Purposes

To address the Dodd-Frank Act consumer risk-monitoring requirement,  CFPB routinely monitors consumer financial markets through a variety of  methods. It also conducts more targeted market monitoring to support  rulemaking and other agency functions.

CFPB collects and monitors routine market data and other market  intelligence through a combination of internal and external data sources  and outreach (see fig. 2). Markets Offices staff use information from these  sources to analyze market trends and identify emerging risks that may  require greater attention. Staff produce monthly and quarterly reports that  summarize or analyze observed market developments and trends, and  they distribute them bureau-wide.

CFPB internal data and research. Staff in CFPB’s Markets Offices use  CFPB data and research to identify and monitor risks. For example, in our  review of CFPB’s market intelligence reports from July 2016 through July  2018, we observed the following frequently cited internal CFPB data  sources:

Consumer complaints submitted to CFPB. Markets Offices staff  monitor consumer complaints to track trends and potential problems  in the marketplace. For example, monthly mortgage trend reports we  reviewed cited changes in total numbers of mortgage complaints, as  well as in complaints related to private mortgage insurance, escrow  accounts, and other mortgage-related topics.

Consumer Credit Trends tool. This tool is based on a nationally  representative sample of commercially available, anonymized credit  records. Markets Offices staff use this tool to monitor conditions and  outcomes for specific groups of consumers in markets for mortgages,  credit cards, auto loans, and student loans. For example, CFPB  monthly auto market trend reports cited the tool as a source for  information on changes in the volume of auto loans by neighborhood  income.

Home Mortgage Disclosure Act data. CFPB maintains loan-level  data that mortgage lenders report pursuant to the Home Mortgage  Disclosure Act. According to CFPB, Markets Offices staff use the  data for their market monitoring, which can include analysis to  determine whether lenders are serving the housing needs of their  communities and to identify potentially discriminatory lending patterns.

External data and research. In addition to its internal databases, CFPB  obtains external market data from a number of public and proprietary data  sources. The market intelligence reports we reviewed included the  following commonly cited external sources, among others:  federal databases and research, such as the Federal Reserve Bank of  New York’s Quarterly Report on Household Debt and Credit; publicly available information from sources such as industry websites,  mainstream news publications, and publicly traded companies’  financial statements. proprietary data from sources such as data analytics services and  credit reporting agencies.

Engagement with industry representatives. CFPB also gathers market  intelligence from engagement with industry representatives. Market  intelligence reports we reviewed cited several meetings with industry  representatives and regular CFPB attendance at industry conferences.  Representatives of two trade groups we interviewed told us that CFPB  had sometimes proactively reached out to them regarding areas of  potential risk. According to CFPB, in fiscal year 2018, Markets Offices  staff conducted an average of about 50 meetings with industry per month  and held intelligence-gathering meetings across various consumer  financial markets throughout the year.

Engagement with consumer organizations. CFPB’s External Affairs  Division, which is responsible for engagement with the nonprofit sector,  facilitates most communication between Markets Offices staff and  consumer organizations to help inform staff’s risk monitoring efforts.  According to CFPB, between January and September 2018, staff from the  External Affairs and Research, Markets, and Regulation divisions held an  average of about four meetings per month with consumer organizations  and nonprofit stakeholders, and Markets Offices staff said these meetings  provided information useful in monitoring markets. Two of the three  consumer organizations we interviewed noted that their communication  with CFPB had decreased since late 2017. However, one group noted  that external engagement has typically been greater when CFPB is going  through a rulemaking and that rulemaking activity had slowed in the last  year.

Advisory committees and other formal outreach. CFPB obtains  information on consumer financial issues and emerging market trends  from various advisory groups and other formal outreach. In 2012, CFPB  established a consumer advisory board, in accordance with a Dodd-Frank  Act requirement. It also established three additional advisory councils  (community bank, credit union, and academic) to obtain external  perspectives on issues affecting its mission. The groups, which include  subgroups focused on various consumer financial market areas or issues,  met regularly through 2017. CFPB dismissed the existing members of the  consumer advisory board and community bank and credit union advisory  councils in June 2018 and reconstituted the groups with new, smaller  memberships that resumed meeting in September 2018. In addition,  from July 2016 to mid-November 2018, CFPB solicited public input  through public field hearings and town hall meetings on issues such as  debt collection, consumer access to financial records, and elder financial  abuse, among other issues.

Coordination with other regulators. CFPB engages with the federal  prudential regulators and other federal and state agencies to inform its  routine market-monitoring efforts. This engagement can occur through  mechanisms such as working groups, task forces, and information- sharing agreements. For example, CFPB is a member of a working group of federal housing agencies, whose members share market intelligence  and discuss risks they have observed in the mortgage markets. Markets  Offices staff also receive quarterly, publicly available bank and credit  union call report data through the Federal Financial Institutions  Examination Council and the National Credit Union Administration, with  which it has information-sharing agreements.

CFPB has supplemented its routine monitoring by conducting targeted  research and data collection to inform rulemaking efforts, meet statutory  reporting requirements, and learn more about a particular market for  consumer financial products. As noted earlier, the Dodd-Frank Act  authorizes CFPB to collect certain data from covered persons and service  providers.

Since July 2016, to support bureau rulemaking efforts, Markets Offices  staff have augmented their routine monitoring with targeted use of  supervisory data collected through CFPB’s examinations of covered  persons and service providers. The Research, Markets, and Regulations  Division has a formal information-sharing agreement with CFPB’s  Supervision, Enforcement, and Fair Lending Division. Under this  agreement, staff in the Office of Small Business Lending Markets used  supervisory information on common data terminology used by business  lenders to inform recommendations on data elements that should be  included in a potential small business data collection rule. In addition, as  discussed below, Markets Offices staff reviewed aggregated and  anonymized supervisory information from CFPB’s examinations of  payday lenders for research that informed the November 2017 Payday,  Vehicle Title, and Certain High-Cost Installment Loans Rule, also referred  to as the Payday Rule.

In addition to rulemaking, CFPB has conducted targeted risk-monitoring  activities to support certain statutory reporting requirements. For its  mandated biennial credit card study, CFPB used its data-collection  authorities under the Dodd-Frank Act to make four mandatory information  requests to a total of 15 credit card issuers. According to CFPB officials,  this study and other statutory reporting efforts—such as the bureau’s  annual report on the Fair Debt Collection Practices Act—also support  their market-monitoring efforts under the Dodd-Frank Act. CFPB notified  the relevant federal and state regulators of its impending requests to the  credit card issuers under those regulators’ supervision.

Finally, CFPB has sometimes engaged in targeted data collection to learn  more about specific areas of potential consumer financial risk. In some  cases, CFPB has used its Dodd-Frank Act data collection authority under  Section 1022 to require a company to provide data. For example, to  understand developments with respect to person-to-person payments,  CFPB required a payment processing company to provide certain  information regarding its system. In other cases, CFPB has obtained  targeted data through voluntary agreements with other regulators. For  instance, in January 2018, CFPB reached an agreement with the Federal  Reserve to obtain supervisory data on bank holding companies’ and  intermediate holding companies’ mortgage and home equity loan  portfolios. According to CFPB officials, they plan to use the data to  monitor trends and risks in the mortgage market and inform bureau policy  making.

Monitoring of Consumer Risks Has Informed CFPB’s Rulemaking and Other Efforts

The market monitoring conducted by CFPB’s Markets Offices staff  contributes to bureau rulemaking and other functions, such as  supervision, guidance to industry, consumer education, and reporting.

Rulemaking. Since July 2016, CFPB’s market-monitoring efforts have  informed certain rulemaking efforts. For example, Markets Offices  analysis of the small-dollar lending market informed CFPB’s November  2017 Payday Rule, according to staff and the proposed and final rules.  Staff said they had found that some borrowers were caught in a cycle of  using payday loan products without the ability to repay the loans. Under  the final rule, lenders for certain loans must reasonably determine up front  that borrowers can afford to make the payments on their loans without  needing to re-borrow within 30 days, while still meeting their basic living  and other expenses. In addition, CFPB’s November 2016 Prepaid  Accounts Rule reflected market-monitoring information and other  research that staff helped collect on prepaid accounts. The rule  incorporated findings from CFPB’s 2014 analysis of prepaid account  agreements, which CFPB conducted to understand the potential costs  and benefits of extending existing regulatory provisions—such as error  resolution protections—to such agreements. Further, CFPB’s market  intelligence reports we reviewed from 2017 and 2018 reflected Markets  Offices staff’s communication with industry regarding a debt-collection  rule—a topic that has been on CFPB’s public rulemaking agenda since  2013, based in part on market-monitoring findings.

Industry supervision and policy positions. Markets Offices staff’s  market-monitoring findings have informed CFPB’s efforts to supervise  institutions and communicate policy positions to industry participants.  Staff assist the Supervision, Enforcement, and Fair Lending Division in its  annual risk-based prioritization process. In 2018, for example, staff  provided information on market size and risk for more than a dozen  market areas, which helped the supervision division prioritize its coverage  of those market areas in its examination schedule. Markets Offices staff  told us they also have met frequently with supervision staff to share  issues identified through monitoring and determine whether supervisory  guidance or related actions would be appropriate to address them.  Further, according to CFPB, market-monitoring information supported  bureau leadership’s public statements on selected market developments  and informed policy documents, such as consumer protection principles  on financial technology.

Consumer education. CFPB’s risk monitoring has informed its broader  consumer education efforts. CFPB’s Consumer Education and  Engagement Division provides financial education tools, including blogs  and print and online guides on financial topics such as buying a home,  choosing a bank or credit union, or responding to debt collectors. Markets  Offices staff provided us with several examples of consumer education  materials for which they had contributed subject-matter expertise since  July 2016. Examples included a consumer advisory on credit repair  services and blog posts on mortgage closing scams and tax refund  advance loans.

Public reports. CFPB’s market-monitoring findings have informed  several of its public reports since July 2016. According to CFPB officials,  when Markets Offices staff identify risks they think could be mitigated by  public communications to consumers, they work with the Consumer  Education and Engagement Division, as well as other divisions, to publish  relevant material. As noted earlier, the Dodd-Frank Act requires CFPB  to issue at least one report annually of significant findings from its  monitoring of risks to consumers in the offering or provision of consumer  financial products or services. CFPB officials stated that this requirement  is addressed by the first section of CFPB’s semiannual reports to  Congress, which discusses significant problems consumers face in  shopping for or obtaining consumer financial products and services.  CFPB officials further noted that other public CFPB reports include  information related to risks to consumers and may also respond to the  annual Dodd-Frank Act reporting requirement. For example, CFPB’s  December 2017 biennial report on the consumer credit card market  discussed credit card debt collection and persistent indebtedness faced  by some consumers, among other consumer financial risks. In addition,  CFPB’s quarterly consumer credit trend reports have discussed risks  related to consumers financing auto purchases with longer-term loans.

CFPB Lacks a Systematic Bureau-Wide Process for Prioritizing Which Consumer Financial Risks to Address

CFPB currently lacks a systematic, bureau-wide process for prioritizing  financial risks facing consumers—using information from its market  monitoring, among other sources—and for considering how it will use its  tools to address those risks. In 2015, CFPB initiated such a process, but  CFPB officials said that the most recent round of this process was  completed in 2017 and that its leadership has not yet decided whether to  continue using the process. In a February 2016 public report, CFPB  described this process (which CFPB refers to internally as “One Bureau”)  for deploying shared bureau-wide resources to address some of the most  troubling problems facing consumers. According to the report, through  this One Bureau process, CFPB prioritized problems that pose risks to  consumers based on the extent of the consumer harm CFPB had  identified and its capacity to eliminate or mitigate that harm. The report  identified near-term priority goals in nine areas where CFPB hoped to  make substantial progress within 2 years. It provided evidence of the  nature or extent of risks facing consumers and described how CFPB  planned to use its tools—such as rulemaking, supervision, enforcement,  research, and consumer education—to address the priority goals.

As part of the One Bureau process, CFPB created several cross-bureau  working groups, which were focused on specific market areas and tasked  with helping ensure progress toward CFPB’s near-term priority goals,  among other responsibilities. The bureau revisited its stated priorities in  June 2017 to guide its work through fiscal year 2018. However, officials  said that while the working groups continue to facilitate communication,  informal collaboration, and strategy-setting across the bureau, CFPB has  not decided whether to engage in a third round of prioritization under the  One Bureau process. The bureau was without a permanent Director from  November 2017 until December 2018, when the Senate confirmed a new  Director. CFPB officials told us that CFPB may revise its approach to  prioritization under new leadership.

Federal internal control standards state that management should use  quality information to achieve agency objectives, such as by using quality  information to make informed decisions. In addition, the standards state  that management should identify, analyze, and respond to risks related to  achieving the defined objectives. Through One Bureau, CFPB had a  process to use the large amount of data and market intelligence it  collected on consumer risks to make informed decisions about its bureau- wide policy priorities and how it would address them. CFPB has mechanisms in place for the Markets Offices to inform the work of  individual divisions. For example, as noted, Markets Offices staff  contribute to rulemaking efforts (including through participation on  rulemaking teams) and to the annual setting of supervisory priorities.  However, although the Markets Offices continue to collect market  intelligence and contribute to cross-bureau working groups, CFPB  currently lacks a process for systematically prioritizing risks or problems  facing consumers and identifying the most effective tools to address  those risks.

CFPB officials noted that the bureau issued 12 requests for information in  early 2018 to seek public input to inform its priorities. Topics covered by  these requests for public input have included the bureau’s rulemaking  process and its inherited and adopted rules. In an October 2018  statement, CFPB announced that it expected to publish an updated  statement of rulemaking priorities by spring 2019 based on consideration  of various activities, including its ongoing market monitoring and its  analysis of the public comments from the requests for information.  However, this prioritization effort focuses on setting rulemaking priorities  and does not incorporate all of CFPB’s other tools to respond to  consumer financial risks.

While CFPB has continued to take steps to consider information to inform  its policy priorities, a systematic, bureau-wide process to prioritize risks to  consumers and consider how CFPB will use its full set of tools to address  them could help to ensure that CFPB effectively focuses its resources on  the most significant risks to consumers. This, in turn, could enhance  CFPB’s capacity to meet its statutory consumer protection objectives.

CFPB Has Taken Steps to Meet Statutory Requirements for Retrospectively Assessing Significant Rules

CFPB Developed Criteria to Identify and Assess Relevant Rules

In two internal memorandums, CFPB documented an initial process for  meeting the Dodd-Frank Act requirement to retrospectively assess  significant rules or orders and issue reports of such assessments within 5  years of the rule or order’s effective date. According to CFPB officials,  the bureau may modify the process for future work after it has completed  its first three assessments. The assessments will be in addition to other  regulatory reviews conducted by CFPB.

To determine which of its final rules were significant for purposes of the  Dodd-Frank Act retrospective assessment requirement, CFPB created a  four-factor test. In applying this test, CFPB analyzes the rule’s  1.  cumulative annual cost to covered persons of over $100 million,  2.  effects on the features of consumer financial products and services,  3.  effects on business operations of providers that support the product or  4.  effects on the market, including the availability of consumer financial  products and services.

The memorandums recommended weighing the first factor more heavily  and considering factors two through four cumulatively, so that high-cost  rules tend to be considered significant. If a rule’s cumulative annual costs  exceed $100 million, CFPB may consider the rule to be significant even if  the cumulative effect from factors two through four is small. If the rule’s  costs do not exceed $100 million, there must be a large cumulative effect  from factors two through four for the rule to be considered significant.

After applying the test to nine rules in early 2017, CFPB determined that  three were significant for retrospective assessment purposes:

Remittance Rule. This rule covers remittances, which are a cross- border transfer of funds.

Ability-to-Repay/Qualified Mortgage Rule (ATR/QM Rule). This  rule covers consumers’ ability to repay mortgage loans and categories  of mortgage loans that meet the ability-to-repay requirement (qualified  mortgages).

Real Estate Settlement Procedures Act (RESPA) Servicing Rule.

This rule covers loan servicing requirements under RESPA.

CFPB staff told us that in the future they plan to apply the four-factor test  to rules not already subject to an assessment within 3 years of the rules’  effective dates, pending new leadership’s review of the test. As of  November 2018, staff told us they had not yet formally applied the test to  any additional rules. However, they told us that they plan to apply the test  to the TILA-RESPA Integrated Disclosure Rule in 2019. If CFPB  determines that the rule is significant, CFPB officials said they plan to  complete an assessment in late 2020.

In addition to outlining the four-factor test, a March 2016 memorandum  documented CFPB’s decision to generally focus any significant new data  collection efforts on a rule’s effects on consumer and market-wide  outcomes rather than effects on businesses. In the memorandum, CFPB  noted that the objectives of many of its rules focus on improved consumer  experiences and outcomes, such as reductions in loan-default risk and  improved access to financial product information and credit. However, the  memorandum also noted that CFPB would assess outcomes for  businesses when data were available at minimal cost. In addition, the  memorandum explained that CFPB would consider spending additional  resources to collect data on business outcomes under certain conditions,  such as when unfavorable outcomes for businesses could meaningfully  affect significant numbers of consumers. Although CFPB stated in its  March 2016 memorandum that it did not plan to formally assess the  previously mentioned three rules’ costs or benefits to providers, it stated  in its October 2018 Remittance Rule Assessment Report that it may  reconsider that decision for future rule assessments.

In the March 2016 memorandum, CFPB also documented a decision to  not make specific policy recommendations in the final reports for the  retrospective assessments. CFPB expects the findings from its final  assessment reports to inform its policy development process, through  which it makes decisions about future rulemaking efforts. In the March  2016 memorandum, CFPB explained that separating the assessments  from policy recommendations would keep the assessments focused on  evidence-based descriptions. As previously described, CFPB also issued  requests for information to obtain public input on effects of its inherited  and adopted rules, in addition to the required retrospective assessments.

CFPB staff stated that they plan to use the lessons learned from the initial  assessment process to inform their procedures for future assessments.  According to CFPB, a future procedures document is to outline its  process for the retrospective assessments required by the Dodd-Frank  Act as well as for similar assessments CFPB may conduct pursuant to  other statutes or executive orders.

CFPB Has Made Progress toward Completing Its First Three Assessments

For each of the three rules it determined to be significant, CFPB created  detailed assessment plans and a timeline for completion (see table 1).  Each plan defined which aspects of the rules the assessment would focus on; outlined the scope and methodology, including challenges for the  assessment and potential limitations of methodology; and  identified data CFPB planned to gather and compile, including CFPB’s own and third-party data, and explained how the data will be used to evaluate the effects of the rule.

CFPB issued requests for information between March and June of 2017  to collect public input on each assessment and created plans for  incorporating the comments in each assessment report. As required by  the Dodd-Frank Act, these requests solicited comments on modifying,  expanding, or eliminating the rules. In addition, CFPB requested  comments on the assessment plans and invited suggestions on other  data that might be useful for evaluating the rules’ effects. In a document  provided to us, CFPB described its preliminary plan to summarize  comments received from the public and use the information received.  CFPB staff told us they adjusted their research questions and data  sources on all three assessments in response to comments. For example,  based on comments, they added a question to an industry survey about a  provision of the Remittance Rule and incorporated a new data source into  the ATR/QM Rule and RESPA Servicing Rule assessments.

Other data sources used for the assessments include federal and state  agencies, voluntary surveys of providers of consumer financial products,  and loan data from servicers. For example, for the Remittance Rule  assessment, CFPB sent a voluntary industry survey to 600 money  transmitters, banks, and credit unions on how the rule has affected their  business practices and costs, as well as potential problems in specific  market segments. For the RESPA Servicing Rule assessment, CFPB  conducted qualitative structured interviews with mortgage servicers to  learn about changes servicers had to make in response to the rule.

CFPB published its Remittance Rule Assessment Report in October  2018. The report analyzed trends in the volume of remittance transfers,  the number of providers, and the price of transfers. For example, CFPB  found that declining remittance prices and an increase in the volume of  remittances—trends that had begun before the rule’s effective date— continued afterward. However, CFPB was unable to conclude whether  these trends would have changed without the rule. In addition, the report  noted that new technology has increased access to remittances but has  also complicated CFPB’s attempts to measure the effects of the  Remittance Rule on consumers. The report also estimated the rule’s  initial and continued compliance costs for businesses, estimating that  they added between 30 and 33 cents for the one-time cost in 2014 and  between 7 and 37 cents in continuing costs per remittance in 2017. In  addition, the report summarized comments and information CFPB  received from a request for information in March 2017.

In monitoring risks of financial products and services to consumers, CFPB  has drawn from a wide range of sources, and its findings have informed  its key consumer protection tools, such as rulemakings and consumer  education materials. In 2016 and 2017, CFPB’s One Bureau process  allowed it to consider the market information it collected to prioritize the  most important risks to consumers and determine how to most effectively  address those risks on a bureau-wide basis. However, CFPB has not yet  decided whether to use the One Bureau process to reexamine its  priorities and has instead relied on prioritization mechanisms that focus  on its use of individual policy tools, such as its processes for setting  rulemaking and supervision priorities. Putting a systematic bureau-wide  prioritization process in place could help CFPB ensure that it focuses on  the most significant risks to consumers and effectively meets its statutory  consumer protection objectives.

The Director of CFPB should implement a systematic process for  prioritizing risks to consumers and considering how to use the bureau’s  available policy tools—such as rulemaking, supervision, enforcement,  and consumer education—to address these risks. Such a process could  incorporate principles from the prior One Bureau process, such as an  assessment of the extent of potential harm to consumers in financial  markets, to prioritize the most significant risks. (Recommendation 1)

We provided a draft of this product to CFPB for comment. We also  provided the relevant excerpts of the draft report to the Federal Housing  Finance Agency, the Federal Reserve, and the Office of the Comptroller  of the Currency for their review and technical comments. CFPB provided  oral and written comments, which are summarized below. CFPB’s written  comments are reproduced in appendix I. In addition, CFPB and the  Federal Housing Finance Agency provided technical comments, which we  incorporated as appropriate. The Federal Reserve and the Office of the  Comptroller of the Currency had no comments.

In oral comments provided on November 29, 2018, CFPB’s Acting Deputy  Director and other CFPB officials clarified the status of the One Bureau  process. The officials clarified that while CFPB officials had previously  told us that the One Bureau process was on hold, work on One Bureau  priorities has continued with support from a set of cross-bureau working  groups. The officials noted that CFPB had not yet determined whether to  engage in another round of the One Bureau priority-setting process. In  addition, in its written comments, CFPB highlighted the role of the cross- bureau working groups in its market monitoring and other efforts. In  response to these comments, we made edits to clarify the status of the  One Bureau process and describe the role of the cross-bureau working  groups.

In its written comments, CFPB did not agree or disagree with our  recommendation but stated that it will endeavor to improve its processes  for identifying and addressing consumer financial risks. CFPB stated that  it recognizes the importance of having processes in place to prioritize and  address risks to consumers in the financial marketplace. CFPB cited  examples of existing processes—such as its processes for setting its  rulemaking agenda and supervisory priorities—that were designed to  ensure that its risk monitoring informs its work. In the oral comments,  CFPB officials expressed concern that the draft report’s characterization  of a lack of a systematic process for prioritizing risks to consumers might  suggest that CFPB entirely lacks processes in this regard. We note that  the draft report described CFPB’s existing processes for setting  rulemaking and supervisory priorities. While we agree that these  processes help CFPB to prioritize work in these areas, we maintain that  these processes do not reflect a systematic, bureau-wide process for  prioritizing risks to consumers and determining how to most effectively  address them. We made minor edits to the report to clarify that the  process CFPB lacks is a bureau-wide process that considers how it will  use its full set of tools to address risks to consumers. We maintain that  having such a process would help to ensure that CFPB focuses its  resources on the most significant consumer risks and is well positioned to  meet its consumer protection objectives.

We are sending copies of this report to CFPB, the Federal Housing  Finance Agency, the Federal Reserve, the Office of the Comptroller of the  Currency, the appropriate congressional committees and members, and  other interested parties. In addition, the report is available at no charge on  the GAO website at http://www.gao.gov.

If you or your staff have any questions concerning this report, please  contact me at (202) 512-8678 or clementsm@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. GAO staff who made major contributions to  this report are listed in appendix II.

Appendix I: Comments from the Consumer Financial Protection Bureau

Appendix II: GAO Contact and Staff Acknowledgments

In addition to the contact above, John Fisher (Assistant Director), Lisa  Reynolds (Analyst-in-Charge), Bethany Benitez, Joseph Hackett, Marc  Molino, Jennifer Schwartz, and Tyler Spunaugle made key contributions  to this report.

Some companies that offer financial products and services—such as credit cards and loan servicing—may engage in practices that pose financial risks to consumers. For example, companies may obscure the costs of a product or use lending practices that can trap consumers in a cycle of debt.

The Consumer Financial Protection Bureau (CFPB) is responsible for watching out for consumers. CFPB monitors complaints, analyzes market data, and conducts outreach to inform its regulations and other functions.

While CFPB collects a wide range of market intelligence, we made a recommendation to help it identify the most significant risks to consumers.


VA Health Care: Improved Oversight Needed for Reviewing and Reporting Providers for Quality and Safety Concerns

This testimony summarizes the information contained in GAO's November 2017 report, entitled VA Health Care: Improved Policies and Oversight Needed for Reviewing and Reporting Providers for Quality and Safety Concerns ( GAO-18-63 ).

Department of Veterans Affairs (VA) medical center (VAMC) officials are responsible for reviewing the clinical care delivered by their privileged providers—physicians and dentists who are approved to independently perform specific services—after concerns are raised. The five VAMCs GAO selected for review collectively required review of 148 providers from October 2013 through March 2017 after concerns were raised about their clinical care. GAO found that these reviews were not always documented or conducted in a timely manner. GAO identified these providers by reviewing meeting minutes from the committee responsible for requiring these types of reviews at the respective VAMCs, and through interviews with VAMC officials. The selected VAMCs were unable to provide documentation of these reviews for almost half of the 148 providers. Additionally, the VAMCs did not start the reviews of 16 providers for 3 months to multiple years after the concerns were identified. GAO found that VHA policies do not require documentation of all types of clinical care reviews and do not establish timeliness requirements. GAO also found that the Veterans Health Administration (VHA) does not adequately oversee these reviews at VAMCs through its Veterans Integrated Service Networks (VISN), which are responsible for overseeing the VAMCs. Without documentation and timely reviews of providers' clinical care, VAMC officials may lack information needed to reasonably ensure that VA providers are competent to provide safe, high quality care to veterans and to make appropriate decisions about these providers' privileges.

GAO also found that from October 2013 through March 2017, the five selected VAMCs did not report most of the providers who should have been reported to the National Practitioner Data Bank (NPDB) or state licensing boards (SLB) in accordance with VHA policy. The NPDB is an electronic repository for critical information about the professional conduct and competence of providers. GAO found that

selected VAMCs did not report to the NPDB eight of nine providers who had adverse privileging actions taken against them or who resigned during an investigation related to professional competence or conduct, as required by VHA policy, and

none of these nine providers had been reported to SLBs.

GAO found that officials at the selected VAMCs misinterpreted or were not aware of VHA policies and guidance related to NPDB and SLB reporting processes resulting in providers not being reported. GAO also found that VHA and the VISNs do not conduct adequate oversight of NPDB and SLB reporting practices and cannot reasonably ensure appropriate reporting of providers. As a result, VHA's ability to provide safe, high quality care to veterans is hindered because other VAMCs, as well as non-VA health care entities, will be unaware of serious concerns raised about a provider's care. For example, GAO found that after one VAMC failed to report to the NPDB or SLBs a provider who resigned to avoid an adverse privileging action, a non-VA hospital in the same city took an adverse privileging action against that same provider for the same reason 2 years later.

I am pleased to be here today to discuss our recent report on provider  quality and safety concerns at the Department of Veterans Affairs (VA).  VA’s Veterans Health Administration (VHA) operates one of the largest  health care systems in the nation, and nearly 40,000 providers hold  privileges at its 170 VA medical centers. Like other health care facilities,  VA medical centers are responsible for ensuring that their providers  deliver safe care to patients. As part of this responsibility, VA medical  centers are required to investigate and, if warranted, address any  concerns that may arise about the clinical care their providers deliver.  Concerns about a provider’s clinical care can be raised for many reasons,  ranging from providers not adequately documenting information about a  patient’s visit to practicing in a manner that is unsafe or inconsistent with  industry standards of care. If VA medical centers fail to properly review  and address concerns that have been raised about their providers, they  may be exposing veterans to unsafe care.

Depending on the nature of the concern and the findings from their  review, VA medical center officials may take adverse privileging actions  against providers that either limit the care the providers are allowed to  deliver at the facility or prevent the providers from delivering care  altogether. VA medical center officials are required to report the providers  against whom they take adverse privileging actions to the National  Practitioner Data Bank (NPDB). The NPDB is used by other VA medical  centers, non-VA hospitals, and other health care entities to obtain  information on a provider’s history of substandard care and misconduct.  VA medical center officials are also required to report providers to state  licensing boards when there are serious concerns about the providers’  clinical care. State licensing boards can then investigate and determine if  the providers’ conduct or ability to deliver care warrants action against the  providers’ medical license.

My testimony today summarizes the findings from the report, which  analyzed the implementation and oversight of VHA processes for  reviewing and reporting providers after quality and safety concerns have  been raised at selected VA medical centers. Accordingly, this testimony  addresses:  1.  VA medical centers’ reviews of providers’ clinical care after concerns  are raised and VHA’s oversight of these reviews, and  2.  VA medical centers’ reporting of providers to the NPDB and state  licensing boards and VHA’s oversight of these processes.

To conduct our work, we reviewed VHA policies and guidance related to  reviewing and reporting clinical care concerns about providers and  interviewed relevant VHA officials. We also visited a nongeneralizable  selection of five VA medical centers, selected based on the complexity of  the medical services they offer veterans and to achieve variation in  geography. At each VA medical center we reviewed documentation and  interviewed medical center staff to 1) identify providers whose clinical  care was reviewed after a concern was raised about that care and 2)  determine whether the VA medical center took an adverse privileging  action against any of these identified providers. In addition, we evaluated  the extent to which each medical center adhered to applicable VHA  policies from October 2013 through the time we completed our site visits  in March 2017. We also interviewed officials from the five Veterans  Integrated Service Networks (networks) that oversee the five selected  medical centers. We compared VHA and the networks’ oversight of the  VA medical centers’ reviewing and reporting of providers to VHA’s related  policy requirements and to federal standards for internal control related to  monitoring. Further details on our scope and methodology are included  in our report. The work this statement is based on was performed in  accordance with generally accepted government auditing standards.

Selected VA Medical Centers’ Reviews of Providers’ Clinical Care Were Not Always Documented or Timely

We found that from October 2013 through March 2017, the five selected  VA medical centers required reviews of a total of 148 providers’ clinical  care after concerns were raised about their care, but officials at these  medical centers could not provide documentation to show that almost half  of these reviews were conducted. We found that all five VA medical  centers lacked at least some documentation of the reviews they told us  they conducted, and in some cases, we found that the required reviews  were not conducted at all. Specifically, across the five VA medical  centers, we found the following:

The medical centers lacked documentation showing that one type of  review—focused professional practice evaluations (FPPE) for  cause—had been conducted for 26 providers after concerns had been  raised about their care. FPPEs for cause are reviews of providers’  care over a specified period of time, during which the provider  continues to see patients and has the opportunity to demonstrate  improvement. Documentation of these reviews is explicitly required  under VHA policy. Additionally, VA medical center officials confirmed  that FPPEs for cause that were required for another 21 providers  were never conducted.

The medical centers lacked documentation showing that retrospective  reviews—which assess the care previously delivered by a provider  during a specific period of time— had been conducted for 8 providers  after concerns had been raised about their clinical care.

One medical center lacked documentation showing that reviews had  been conducted for another 12 providers after concerns had been  raised about their care. In the absence of any documentation, we  were unable to identify the types of reviews, if any, that were  conducted for these 12 providers.

We also found that the five selected VA medical centers did not always  conduct reviews of providers’ clinical care in a timely manner. Specifically,  of the 148 providers, the VA medical centers did not initiate reviews of 16  providers for 3 months, and in some cases, for multiple years, after  concerns had been raised about the providers’ care. In a few of these  cases, additional concerns about the providers’ clinical care were raised  before the reviews began.

We found that two factors were largely responsible for the inadequate  documentation and untimely reviews of providers’ clinical care we  identified at the selected VA medical centers.

First, VHA policy does not require VA medical centers to document all types of reviews of providers’ clinical care, including retrospective reviews, and VHA has not established a timeliness requirement for initiating reviews of providers’ clinical care.

Second, VHA’s oversight of the reviews of providers’ clinical care is  inadequate. Under VHA policy, networks are responsible for  overseeing the credentialing and privileging processes at their  respective VA medical centers. While reviews of providers’ clinical  care after concerns are raised are a component of credentialing and  privileging, we found that none of the network officials we spoke with  described any routine oversight of such reviews. This may be in part  because the standardized tool that VHA requires the networks to use  during their routine audits does not direct network officials to ensure  that all reviews of providers’ clinical care have been conducted and  documented. Further, some of the VISN officials we interviewed told  us they were not using the standardized audit tool as required.

Without adequate documentation and timely completion of reviews of  providers’ clinical care, VA medical center officials lack the information  they need to make decisions about providers’ privileges, including  whether or not to take adverse privileging actions against providers.  Furthermore, because of its inadequate oversight, VHA lacks reasonable  assurance that VA medical center officials are reviewing all providers  about whom clinical care concerns have been raised and are taking  adverse privileging actions against the providers when appropriate. To  address these shortcomings, we recommended that VHA 1) require  documentation of all reviews of providers’ clinical care after concerns  have been raised, 2) establish a timeliness requirement for initiating such  reviews, and 3) strengthen its oversight by requiring networks to oversee  VA medical centers to ensure that such reviews are documented and  initiated in a timely manner. VA concurred with these recommendations  and described plans for VHA to revise existing policy and update the  standardized audit tool used by the networks to include more  comprehensive oversight of VA medical centers’ reviews of providers’  clinical care after concerns have been raised.

Selected VA Medical Centers Did Not Report All Providers to the NPDB or to State Licensing Boards as Required

We found that from October 2013 through March 2017, the five VA  medical centers we reviewed had only reported one of nine providers  required to be reported to the NPDB under VHA policy. These nine  providers either had adverse privileging actions taken against them or  resigned or retired while under investigation before an adverse privileging  action could be taken. None of these nine providers were reported to  state licensing boards as required by VHA policy.

The VA medical centers documented that these nine providers had  significant clinical deficiencies that sometimes resulted in adverse  outcomes for veterans. For example, the documentation shows that one  provider’s surgical incompetence resulted in numerous repeat surgeries  for veterans. Another provider’s opportunity to improve through an FPPE  for cause had to be halted and the provider was removed from providing  care after only a week due to concerns that continuing the review would  potentially harm patients.

In addition to these nine providers, one VA medical center terminated the  services of four contract providers based on deficiencies in the providers’  clinical performance, but the facility did not follow any of the required  steps for reporting providers to the NPDB or relevant state licensing  boards. This is concerning, given that the VA medical center documented  that one of these providers was terminated for cause related to patient  abuse after only 2 weeks of work at the facility.

Two of the five VA medical centers we reviewed each reported one  provider to the state licensing boards for failing to meet generally  accepted standards of clinical practice to the point that it raised concerns  for the safety of veterans. However, we found that the medical centers’  reporting to the state licensing board took over 500 days to complete in  both cases, which was significantly longer than the 100 days suggested in  VHA policy.

Across the five VA medical centers, we found that providers were not  reported to the NPDB and state licensing boards as required for two  reasons.

First, VA medical center officials were generally not familiar with or  misinterpreted VHA policies related to NPDB and state licensing board  reporting. For example, at one VA medical center, we found that  officials failed to report six providers to the NPDB because they were  unaware that they had been delegated responsibility for NPDB  reporting. Officials at two other VA medical centers incorrectly told us  that VHA cannot report contract providers to the NDPB. At another VA  medical facility, officials did not report a provider to the NPDB or to any  of the state licensing boards where the provider held a medical license  because medical center officials learned that one state licensing board  had already found out about the issue independently. Therefore, VA  officials did not believe that they needed to report the provider. This  misinterpretation of VHA policy meant that the NPDB and the state  licensing boards in other states where the provider held licenses were  not alerted to concerns about the provider’s clinical practice.

Second, VHA policy does not require the networks to oversee whether VA medical centers are reporting providers to the NPDB or state licensing boards when warranted. We found, for example, that network officials were unaware of situations in which VA medical center officials failed to report providers to the NPDB. We concluded that VHA lacks reasonable assurance that all providers who should be reported to these entities are reported.

VHA’s failure to report providers to the NPDB and state licensing boards  as required facilitates providers who provide substandard care at one  facility obtaining privileges at another VA medical center or at hospitals  outside of VA’s health care system. We found several cases of this  occurring among the providers who were not reported to the NPDB or  state licensing boards by the five VA medical centers we reviewed. For  example, we found that two of the four contract providers whose contracts  were terminated for clinical deficiencies remained eligible to provide care  to veterans outside of that VA medical center. At the time of our review,  one of these providers held privileges at another VA medical center, and  another participated in the network of providers that can provide care for  veterans in the community. We also found that a provider who was not  reported as required to the NPDB during the period we reviewed had their  privileges revoked 2 years later by a non-VA hospital in the same city for  the same reason the provider was under investigation at the VA medical  center. Officials at this VA medical center did not report this provider  following a settlement agreement under which the provider agreed to  resign. A committee within the VA medical center had recommended that  the provider’s privileges be revoked prior to the agreement. There was no  documentation of the reasons why this provider was not reported to the  NPDB under VHA policy.

To improve VA medical centers’ reporting of providers to the NPDB and  state licensing boards and VHA oversight of these processes, we  recommended that VHA require its networks to establish a process for   overseeing VA medical centers to ensure they are reporting to the NPDB  and to state licensing boards and to ensure that this reporting is timely.  VA concurred with this recommendation and told us that it plans to  include oversight of timely reporting to the NPDB and state licensing  boards as part of the standard audit tool used by the networks.

If you or your staff members have any questions concerning this  testimony, please contact me at (202) 512-7114 (williamsonr@gao.gov).  Contact points for our Office of Congressional Relations and Public  Affairs may be found on the last page of this statement. Other individuals  who made key contributions to this testimony include Marcia A. Mann  (Assistant Director), Kaitlin M. McConnell (Analyst-in-Charge), Summar  C. Corley, Krister Friday, and Jacquelyn Hamilton.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

The Department of Veterans Affairs requires its medical centers to review a doctor’s care if quality or safety concerns arise. If the concerns are substantiated, medical center officials are required to inform hospitals and other health care entities by reporting the doctors to a national database and to the states where the doctor is licensed.

However, we visited 5 VA medical centers and found that their reviews were not always timely and that VA officials did not report 8 of the 9 doctors who should have been reported.

In the report on which this testimony is based we recommended VA improve oversight of clinical care reviews and reporting.