May 13, 2020
Download this alert as a PDF
During the past month, banks have scrambled to accommodate customers—working around the clock to process emergency requests for loan modifications and thousands of applications under the Payroll Protection Program (PPP). They have done this with reduced staff, and while simultaneously overhauling delivery and workflow systems in an attempt to keep customers, employees and their families safe. In this unfamiliar and chaotic environment where everyone is hyper-focused on mission-critical priorities, it is easy to push compliance to the background. That may be a dangerous move, however, in light of the consistent regulatory emphasis on consumer protection.
While recent regulatory guidance gives banks a great deal of latitude on classification, accounting and even capital treatment for COVID-related loan programs, the regulatory agencies are not handing out any passes on the consumer protection front. In fact, the guidance consistently emphasizes banks’ consumer compliance obligations, stating that “[w]hen working with borrowers, lenders and servicers should adhere to consumer protection requirements.” With respect to the various COVID-lending programs, compliance with the Equal Credit Opportunity Act (ECOA) seems to be a particular focus. Specifically, in terms of the ECOA’s adverse action and fair lending requirements.
Adverse Action Notices are Required for PPP Loans.
The limited nature of the PPP funds, and the fact that loans were approved by the SBA on a first come, first served basis resulted in a frenzied “race to the money,” with many banks receiving far more applications than their resources could accommodate. This was especially true for banks that, in a good-faith effort to respond to COVID safety concerns, offered online PPP application websites, resulting in applications from thousands of desperate businesses operating well outside of the banks’ geographic markets. In a very short period of time, banks had to collect the right information, review mountains of quickly thrown together documents, and submit all of the necessary paperwork to the SBA. Despite herculean efforts to accommodate, many applicants simply had to be refused. Banks were forced to decide (quickly and without guidance) whether to prioritize existing customers, local customers, or to simply process applications in the order in which they were received. There was initially some hope that the regulators would recognize banks’ good-faith efforts in these overwhelming circumstances by waiving any additional requirement to provide formal ECOA adverse action notices to all of those businesses that were turned away. Those hopes died on May 6, 2020.
The Consumer Financial Protection Bureau (CFPB) clarified in a release that the ECOA’s normal adverse action notice requirements have not been waived for PPP loans. Under the ECOA and its implementing Regulation B, creditors are generally required to notify an applicant of action taken within 30 days after receiving a “completed application” concerning the creditor’s approval of, counteroffer to, or adverse action on the application. For PPP loan applications that are actually submitted to the SBA, the CFPB clarified that the 30-day timeline to notify the applicant of the action taken will not begin until the bank has received a loan number from the SBA or a response about the availability of funds. But this clarification is somewhat unhelpful—because most applications that will not be eventually funded will not be submitted to the SBA. Banks are more concerned with those thousands of applicants that were turned away before ever reaching SBA submission. For those loans, it appears an adverse action notice will still be required.
In its May 6release, the CFPB stated that if a creditor receives a PPP loan application and refuses to grant the credit request without ever submitting the PPP loan to the SBA, the creditor does need to provide a Regulation B adverse action notification. The CFPB clarified that if an application is missing information but provides sufficient data for a credit decision, the creditor may evaluate the application, make its credit decision and notify the applicant accordingly. If credit is denied, the applicant must give the specific reason for the denial, or alternatively, notice of the applicant’s right to receive those reasons. Moreover, a lender may not deny a loan application citing a reason of incompleteness when it has sufficient information for a credit decision but has yet to receive an SBA loan number or a response regarding available funds.
Unfortunately, the CFPB did not specifically address the various unique reasons for denial under the PPP. The good-faith reason for denial by many banks— “We have limited resources available for processing PPP applications and so must limit availability to existing or local customers”—is not on any of the model forms. It may be that we eventually get additional clarification around these issues, but under the current guidance, the safe route is to provide the notice and, when required, a specific reason for denial. The 30-day timeline is likely running for many institutions; and so, if adverse action notices were not part of a bank’s initial or automated PPP process, completing that final step should be an immediate priority.
Fair Lending Laws are Applicable to PPP Loans and COVID-related Loan Modifications.
The challenges of allocating access to PPP loans and formulating reasons for turning applicants away highlight the potential footfalls for lenders under the ECOA’s fair lending requirements. As with its adverse action requirements, the ECOA’s fair lending provisions remain applicable to PPP loans. They are also equally applicable to COVID-related loan modifications.
The necessity of fair lending compliance in connection with COVID loan programs was highlighted by the joint bank regulatory agencies in its Interagency Statement on Loan Modifications and Reporting for Financial Institutions Working with Customers Affected by the Coronavirus (Revised). There, the regulators concede they will take the national emergency into account “when exercising supervisory and enforcement responsibilities,” and that they do not expect to take “consumer compliance public enforcement action” against banks that “make good-faith efforts demonstrably designed to support consumers and comply with consumer protection laws.” However, the underlying message is crystal clear: the agencies will eventually exercise their enforcement responsibilities, that everything up to public enforcement is still on the table; and remediation or corrective action may be required.
As reinforcement of this message, the CFPB is actively inviting complaints against lenders who may have discriminated against loan applicants in connection with COVID-related programs. In a blog post directed at women- and minority-owned businesses, the CFPB listed the following examples of potential warning signs of lending discrimination based on race, sex, or other protected categories:
- Refusal of available loan or workout option even though you qualify for it based on advertised requirements
- Offers of credit or workout options with a higher rate or worse terms than the one you applied for, even though you qualify for the lower rate
- Discouragement from applying for credit by the lender because of a protected characteristic
- Denial of credit without being given a reason why or being told how to find out why
- Negative comments about race, national origin, sex, or other protected statuses
Following the above-described list, the CFPB invited consumers or businesses that believe they may have been discriminated against to file a complaint through its online system. For smaller institutions which are not directly supervised by the CFPB, these complaints will be forwarded to the applicable federal banking agencies, thus forming the basis for careful scrutiny during future compliance examinations.
Consistency and documentation will be critical in responding to any such future fair lending challenge. The ECOA prohibits a lender from treating any loan applicant differently in any aspect of a credit transaction because that loan applicant belongs to a protected class. Under interagency examination procedures, the regulatory agency may presume that any unexplained disparity is due to protected class status, unless the creditor can demonstrate a legitimate business necessity for the difference in treatment. Put another way, if you process and grant a PPP loan for a non-minority-owned small business, but you do not process and grant a PPP loan for a minority-owned small business, there should be a legitimate, non-discriminatory and well-documented reason for the difference in treatment. On a similar note, objective eligibility criteria for any COVID-related loan modification programs should be well-documented and should be consistently applied. If you grant a loan modification to a male borrower, but deny the same modification (or offer the modification on less favorable terms) to a female borrower, the objective, non-discriminatory reason for that difference in treatment should be clearly documented in the loan file. Finally, any exceptions to these policies should be consistently applied and carefully tracked. If one loan officer makes exceptions to the bank’s policy based upon different factors than other loan officers, there will inevitably be unexplained disparities that increase fair lending risk.
To mitigate the risk of fair lending violations, banks should consider formal documentation for any COVID-related programs. This documentation could be in the form of an addendum or similar addition to the bank’s board-approved loan policy. The documented program should expressly acknowledge the bank’s fair lending obligations, and prohibit discrimination based upon any applicant status that is protected under the ECOA. The program should incorporate the controls recommended above – setting forth objective eligibility criteria, requiring consistency in the application of those criteria and mandating that a detailed process for any exceptions be approved and tracked. Banks should also be prepared to demonstrate that the terms of the COVID-related programs have been communicated to all implementing personnel and, if practical, that lending personnel have received specific training on these issues.
While it is difficult to think about additional compliance burdens when staff is already working overtime to ease the impact of this crisis, these actions will ultimately be worth the effort. Banks implementing these controls will be in a much better position to respond to complaints filed by dissatisfied loan applicants and to otherwise demonstrate their “good-faith efforts demonstrably designed to support consumers and comply with consumer protection laws.”