Fair Lending 2.0: You’ve Built Your Basic Fair Lending Program, Now What?
How to Take Your Fair Lending Program to the Next Level Without Breaking the Bank
By Nima J. Vahdat
So, you’ve bought your off-the-shelf fair lending training, did a find-and-replace on that downloadable fair lending policy you just googled to replace “[INSERT LENDER NAME HERE]” with your own company’s name, opened up your HMDA LAR to “monitor” it, and also asked your neighbor who helps file your taxes to be your independent auditor when she’s not working a shift at the local Red Lobster. You even flagged some guy in your facilities department for customers to call if they’re upset about something and told your board all about the great things you’ve done.
What more do you need?
- Board and Management Oversight – DONE (They’re impressed by your “can-do” attitude)
- Compliance Program:
- Policies and Procedures – DONE (Isn’t find-and-replace great?)
- Training – DONE ($15 is a lot of money to spend on a training, but it was worth it!)
- Monitoring and Corrective Action – DONE (You did technically “look” at your LAR)
- Consumer Complaint Response – DONE (That facilities guy is great in his backup role as customer service representative)
- Compliance Audit – DONE (During Red Lobster breaks)
You’re done—time for that martini lunch to celebrate. Now all you need to do is tell your payroll department whether you want 401(k) proceeds deducted from your bonus or not.
Wait, what was that? One needs a Fair Lending CMS that is “comprehensive and commensurate” with the size and risk profile of one’s organization? Next thing you’re going to tell me is that a fair lending program needs to be more than just the bare minimum. Seriously, since when?
Most all of you have the basics of a fair lending program. You’ve satisfied the minimum components of a Fair Lending CMS and should do “OK” if examined. But what about all of the ancillary stuff that will take your program to the next level?
This article will focus on one or two things you can do in each of the four pillars of your Fair Lending CMS to help take your organization to the next level without a ton of staff or resources. These changes will show a regulator your commitment to fair lending compliance, but, most importantly, continue your journey of the overall goal of any effective CMS: ensuring that your organization does not discriminate (deliberately or accidentally) against a member of a protected class.
1 – Board and Management Oversight
Think of Your Regulators When Creating Minutes. How do you prove adequate board oversight? Well, I can tell you how you can’t—not having well documented minutes. Make sure that your board minutes adequately reflect the discussions that you have with the Board regarding your fair lending program, risks, and industry developments. Lack of board oversight is something often proved in the negative, as in, “I see you have this defect here. Well, you clearly wouldn’t have had this defect if you had adequate oversight from the Board, and they gave you the resources you needed.” Having thorough and detailed minutes on your discussions with the board will help you combat these types of findings. As with all documentation, you must prepare these with the customer in mind. In this case, the customer is your regulator, and the customer is always right.
Get Information in the Hands of People Who Can Use It. If your organization is set up like most, the board is made up of a small group of individuals who aren’t always in control of day-to-day operations. The real “doers” in your organization are the managers and senior managers. These are the individuals most capable of effecting change. To have an effective fair lending program, you will need a mechanism of getting information to these “doers.” A couple of ways to disseminate information is to establish a Fair & Responsible Lending Committee made up of these managers and senior managers, or develop a newsletter that can be used to distribute this information even more broadly. Updates should include changes to the program, risks employees can look out for, and the results of your monitoring efforts. All too often, information gets stuck in bottlenecks. Spread the information to those who can act on it.
2 – Compliance Program:
A – Policies and Procedures
Catalog and Curate. Policies and procedures (P&P) are a primary source of truth for regulators. They describe how your organization operates and become a testing manual of sorts for regulators to comb through. If specific tasks or functions are described in your P&P, it becomes very easy for a third party to verify the accuracy of those statements. To ensure the accuracy and completeness of your P&P, you should take these steps:
- Make an inventory of all your P&P that touch on fair lending. These are more than just the typical fair lending program related documents. These also include documents such as underwriting policies, sales practices policies, pricing policies, etc.
- Once you perform the cataloguing exercise, you may find that many of these P&P are redundant or duplicative. If that’s the case, then eliminate the policy. You may also find that some policies are simply no longer applicable to your organization. Eliminate those as well. Sometimes less is truly more.
- Identify Owners/Confirm Accuracy. Many of these policies describe very specific tasks. Have the owners of these tasks review the language to ensure that what is being described reflects current practices. If not, then delete the language or fix it.
B – Training
Job Specific/Organization Specific. Training is an area where organizations generally do a decent job. There is a lot of very good training material out there that very clearly defines the requirements of fair lending. The problem with externally purchased materials is that they’re not customized to your organization or specific job roles.
- Organization Specific. If there are tasks required of all employees of your organization, they should be highlighted in your training materials. For example, if all employees are required to escalate fair lending related complaints, make sure that process is outlined in your training.
- Job Specific. Regulators often focus on whether your training materials are job specific. The core fulfillment roles that should be highlighted are for sales, processing, and underwriting. For example, in the processing and sales roles, providing the same “level of service” to all consumers is always a concern. This can be as simple as having standardized Service Level Agreements for all files—e.g., call back all customers at least once every three days, return voicemails in the order received, etc. Try to add at least a few slides for each role so those employees can understand the importance of fair lending for their specific role.
Monitoring and Corrective Action
Be creative. There are numerous options for monitoring. Most organizations have a good handle on the very traditional compliance monitoring functions:
- Risk assessments – holistic reviewing of your organization to determine where the greatest fair lending risks lie
- Loan file testing – the standard review of approved, withdrawn, and declined files for accuracy, discrimination concerns, etc.
- Exception monitoring – pricing exceptions, underwriting exceptions, etc.
Beyond these core functions are any number of other ways that you can conduct monitoring to provide additional insights into the fair lending risks present in your organization. One tool used by consumer advocacy groups and regulators alike is mystery shopping. There are a number of firms that will do this for you (for a cost of course), but your teams can do this in a more limited fashion for a very minimal cost. For example, you could leave voicemail messages to your loan officer teams in the early morning hours (before they’ve arrived for the day) with different genders or ethnicities very obviously delineated, and see who your employees call back first. You could do the same with e-mails to your teams. Who do they call back sooner—Grayson Weatherford III or Maria Hernandez? This type of monitoring serves two purposes: (1) it gives you a sense of how effective your program and training is, and (2) it brings awareness to your production teams that discrimination comes in a variety of different forms.
Close the Loop. This will undoubtedly be obvious to most of you, but if your monitoring makes clear a fair lending concern, you will need to document how you’ve remediated that concern. If additional training was required, make sure that is tracked. Keep a library of all of your remediation efforts for regulators to see. An un-remediated finding for an identified risk is worse than an un-identified finding. The latter is a weakness in your monitoring program (which, while problematic, can be enhanced). The former shows a disregard of fixing identified problems (perhaps even an unwillingness to do the right thing).
3 – Consumer Complaint Response
Identify the Universe. Do you know how many fair lending complaints you have? How sure are you about that? Regulators will take your complaint logs and sift through them with a fine-toothed comb looking for anything that should have been characterized as a fair lending complaint and wasn’t. There are a few failure points that must be addressed to truly have an effective consumer complaint program:
- Does everyone understand what a complaint is? The CFPB has established its definition of a complaint as a consumer who has “express[ed] dissatisfaction with, or communicate[d] suspicion of wrongful conduct by, an identifiable entity related to a consumer’s personal experience with a financial product or service.” Your organization may have expanded on that definition. In either scenario, your production employees need to know the definition.
- Are all complaints being escalated? This seems obvious, but you have to make it easy for a complaint to be escalated, or risk people not escalating at all. Having a centralized complaint team and standardized escalation procedure are the easiest ways to do that.
- Are fair lending complaints being categorized correctly? If you’re relying on your production employees to categorize your complaints correctly as fair lending or otherwise, you can rest assured that they won’t always get it right. You need a backstop to ensure complaints are categorized correctly to flag those that need to be reviewed. Consider creating a lexicon of terms that you know might indicate a high likelihood of a fair lending complaint. For example, if you find the word “discriminate” or “racist” you’re likely dealing with a fair lending complaint. While seeming fairly obvious, you’d be surprised how many people don’t categorize those correctly.
Try not to think about the volume of fair lending complaints as a bad thing. You just need to try to catch them all (before your regulator tells you you’ve missed one). Once you have a population, review them for trending, areas of concerns, valid fair lending issues, etc. And of course, if necessary, make sure to remediate.
4 – Compliance Audit
Independence. Your fair lending audit function needs to be truly independent from your compliance function. If you have an internal audit group, meet with them and explain your regulator’s requirements as it relates to audit. If you don’t have an internal audit group, find a team outside of compliance or the production teams that can manage this process. If that group has the expertise to perform the audit on its own, then rely on them to perform that task and remediate any recommendations they identify. If not, there are numerous vendors out there that perform this function. The vendors vary in terms of cost, expertise, etc. Connect your audit owner with a list of possible vendors and have them start interviewing. This isn’t a task that can be skipped, but it is one you can help drive forward.
Fair lending isn’t always the sexiest task but it is an essential task (Who am I kidding? It’s super sexy—great dinner party conversation). Never think of your fair lending program as a finished product. There is always work to be done, and you don’t have to spend a lot of money to do it.
Nima Vahdat, CRCM, CAMS, is SVP and associate general counsel at loanDepot. You can reach him at NVahdat@loanDepot.com.
-  Although not technically listed as a pillar of the CMS, there is an unofficial fifth pillar of “Service Provider Oversight” which will not be addressed in this article
-  http://files.consumerfinance.gov/f/201510_cfpb_ecoa-baseline-review-modules.pdf, Module 2 “Fair Lending Compliance Management System (CMS),” page 6
-  CFPB Consumer Response Annual Report