A number of entities supervised by the Consumer Financial Protection Bureau (“CFPB” or “Bureau”), lawyers and the American Bar Association have expressed concern that providing privileged information to Bureau supervisory personnel could waive the entities’ privilege with respect to third parties. On Friday, June 29, 2012 the Bureau issued a final rule on confidential treatment of privileged information submitted to the Bureau by the financial institutions it regulates. The Bureau’s rule is significant because its examiners will take the position that they are entitled to review all of an examinee’s documents, regardless of attorney-client privilege, in the course of their examination. While there are specific statutory protections afforded to information submitted to Federal banking agencies, Congress did not include similar express protections for privileged information submitted to the CFPB.
In January 2012, the CFPB advised banks and nonbank financial institutions that it supervises that the submission of privileged information to the CFPB does not waive any applicable privilege with respect to third parties. The new rule provides supervised entities the CFPB’s further assurances that providing privileged information to the Bureau will not adversely affect the confidentiality of such information. The new rule also makes clear that in the CFPB’s view the transfer of privileged information to another Federal or State agency does not result in a waiver of any applicable privilege. At the same time, the Bureau has indicated that it would only request privileged information from supervised entities when it determines that such information is material to its supervisory objectives and that it cannot practicably obtain the same information from non-privileged sources.
The Bureau’s statements on the topic also offer a roadmap to one aspect of how to survive a CFPB exam. The Bureau believes, based on the historical experience of the banking regulators, and its experience to date, that effective supervision may often require review of supervised entities’ privileged information. For example, part of a strong compliance program is self-monitoring for consumer protection issues. Supervised entities often employ inside or outside counsel to conduct analyses regarding whether the entity is in compliance with Federal consumer financial law. The Bureau may require access to these analyses, which may be subject to the attorney-client privilege, to assess effectively the adequacy of supervised entities’ compliance with Federal consumer financial law as well as these entities’ systems and procedures for compliance with Federal consumer financial law. Nonetheless important issues remain including how far the Bureau will go to demand privileged documents, whether courts will agree with the Bureau’s position that no waiver of privilege would occur, and how state regulatory agencies and state Attorneys General may seek to use the information they obtain from the Bureau. There also is a move afoot in Congress to shore up the protections afforded to privileged materials turned over to the Bureau.
The Bureau has the authority to supervise insured depository insinuations with total assets of more than $10,000,000. In addition, the Bureau has supervisory and regulatory authority over nonbank financial institutions ranging from mortgage lenders, private educational lenders, and payday lenders to “larger participants” in other nonbank markets, and nonbank entities that pose a risk to consumers, along with their service providers. Interestingly, disclosure issues related to privileged material are treated differently in CFPB investigations. Unlike in examinations, the Bureau will allow a recipient of civil investigative demand to withhold producing privileged material subject to the use of a privilege log.