World421_TG_03

We've just received an MRA from the CFPB for our policies and procedures, so I need your help to draft our response.

Can you let me know if our Complaint Response and Regulatory Investigation Protocols fail to meet any of the examination objectives for policies and procedures that are outlined by the CFPB’s compliance management review? For each objective identified, please include an explanation in one or two sentences and note if SLL has likely addressed the objective through another document...

You’ve asked me to review our Complaint Response and Regulatory Investigation Protocols ("Protocols") to identify if we satisfy the examination objectives for policies and procedures outlined by the CFPB's Compliance Management Review ("CMR"). To that end, I’ve compared the CFPB’s CMR against our Protocols and determined the following:

1. Insufficient maintenance of compliance policies
The Protocols do not include sufficiently ensure that compliance policies are "maintained and modified to remain current and complete, and to serve as a reference for employees in their day-to-day activities.” (CMR Page 7, No. 5). The CMR provides guidance on how to maintain the compliance policies such as including a specific period of time by which the compliance policies should be reviewed (e.g. annually) and triggers for when compliance policies should be reviewed and amended outside of an established monitoring period (e.g. after a process changes, regulatory finding, Testing finding, etc.), which our Protocols fail to include. 

Note: The "SLL Telemarketing Policies Manual.docx" addresses this objective by including an annual review of compliance program effectiveness (page 3), as well as monthly reports that include comprehensive compliance metrics and risk assessment updates (page 9).

2. No Board-Approved Compliance Policy
The Protocols do not include a reference to a Board-approved compliance policy (CMR Page 7, No. 2). The Protocols must reference and align with a board-approved enterprise wide policy that governs its content and serve as the driver of its creation.

3. Failure to effectively manage compliance risks in the Products, Services and Activities
The Protocols fail to ensure that compliance policies are “designed to effectively manage compliance risk in the products, services and activities of the institution.” (CMR Page 7, No. 3). The Protocols only articulate the telemarketing activities of SLL, but fail to articulate what products or services are actually offered by SLL, much less review the compliance risks associated with particular products and services.

4., Insufficient coverage of Products and Services
The Protocols do not cover the full life-cycle of all products and/or services offered (CMR Page 7, No. 4). As noted above, the Protocols fail to articulate what products or services are actually offered by SLL, so they fail to further identify the points in time within a specific product's or service's lifecycle that a complaint may arise (.e.g. account opening, loan disbursement, repayment, pay-off, etc.).

5. Insufficient compliance with applicable federal consumer financial laws
Although the Protocols mention the heightened regulatory scrutiny of elder-targeted financial services marketing, they fail to sufficiently "address compliance with applicable Federal consumer financial laws in a manner designed to minimize violations and to detect and minimize associated risks of harm to consumers" (CMR Page 7, No. 3).

Note: The "SLL CFPB Oversight of Senior-Focused Mortgage Marketing Memo.docx" and "SLL Telemarketing Policies Manual.docx" documents are likely to satisfy this objective because the analysis of practices that minimize risks of providing financial services to elders in the memo appear to inform many of the practices in the policy.