Board of Governors of the Federal Reserve System

Consumer Compliance Supervision Bulletin - December 2019

This Federal Reserve publication provides high-level summaries of consumer compliance issues for senior executives in banking organizations and serves to complement other aspects of the Federal Reserve's outreach program for its supervised institutions, including Consumer Compliance Outlook, a Federal Reserve System publication focused on consumer compliance issues, and its companion webinar series, Outlook Live.

The Federal Reserve Board's Division of Consumer and Community Affairs publishes the Consumer Compliance Supervision Bulletin to enhance transparency regarding the Federal Reserve's consumer compliance supervisory activities by

• sharing information about our examiners' observations and noteworthy developments related to consumer protection, and
• providing practical steps that institutions may consider when addressing certain consumer compliance risks.

This issue of the Consumer Compliance Supervision Bulletin discusses Federal Reserve supervisory observations regarding financial technology, otherwise known as "fintech," which is simply the use of technological innovation to provide financial products and services.

Fintech has the potential to provide significant benefits to consumers, small businesses, and financial institutions. Yet the use of technology related to consumer financial services is not immune to the same consumer protection risks that occur in more traditional financial services and may pose new risks. The good news is that most banks can use their existing experience in consumer compliance management to evaluate a new fintech collaboration or fintech activity. This resource is intended to enhance the understanding of common fact patterns and emerging risks so that institutions can manage fintech risk appropriately and efficiently.

Promoting Effective Fintech Risk Management

Background and Observations

Recent discussions on the future of banking seem to focus on "fintech," "disruption," "automation," "artificial intelligence," and other aspects of innovation. Many bank boards are exploring whether a fintech collaboration makes sense for their bank.¹ According to a recent survey, about 82 percent of financial institution respondents expected to increase partnerships with fintech companies over the next three to five years.² Although there may be many motivations for these partnerships, the survey found that 88 percent of financial institution respondents were increasingly concerned that they were losing revenue to innovators.³ For example, community banks have long been a primary source of credit for small businesses, but these businesses are increasingly turning to online alternative lenders that can offer streamlined loan applications, expedited loan decisions, and quick access to funds.⁴

The Federal Reserve is committed to working with banks as they engage in responsible innovation to meet customer expectations, offer competitive products and services, and develop appropriate collaborations that fit the bank's business model and risk appetite. Some research has found that small businesses may prefer to work with banks, which indicates that there are opportunities for community banks in this area.⁵ Over the past few years, the Federal Reserve has promoted a variety of efforts to support community banks as they explore new technologies.⁶ This article provides some general guideposts for engaging in innovation while also promoting effective risk management.

How Do Banks Engage with Fintech?

There are a variety of ways in which fintech can help provide financial products and services. For example, banks can incorporate fintech when underwriting and originating loans to consumers and businesses as well as when facilitating payments between individuals. Alternatively, banks can collaborate with fintech firms to provide new or enhanced products or services.

Fintech collaborations may help banks enhance the customer experience by combining their strengths, such as strong compliance expertise and deep customer relationships, with the fintech firm's innovative approach. As highlighted by Federal Reserve Board Governor Michelle Bowman: "Rather than fear fintech, more and more community bankers are trying to determine how to adjust their businesses to make the best use of new technologies."⁷

Why Is Fintech Risk Management Important?

For banks, there are several benefits to collaborating with a fintech firm. For example, banks can work with fintech firms to enhance the customer experience through greater convenience, lower costs, increased financial inclusion, faster services, and improved security.

However, as with any new product or service, the management of compliance and third-party risk is crucial. Although most banks have extensive experience managing these issues, some banks may face challenges in collaborating with fintech partners who are less familiar with the risks and consequences in the highly regulated field of consumer finance. As noted by Federal Reserve Board Governor Lael Brainard: "There are more serious and lasting consequences for a consumer who gets, for instance, an unsustainable loan on his or her smartphone than for a consumer who downloads the wrong movie or listens to a bad podcast."⁸

The good news is that most banks can use their experience in managing risk for conventional products and services to evaluate a potential new fintech collaboration. Generally, the same consumer laws and regulations apply, and the same basic principles of risk management will serve to mitigate risks and potential consumer harm while maintaining the benefits of the collaboration. In connection with a recent settlement with a fintech firm, the Federal Trade Commission stated: "[E]ven when innovative products enter the market—for example, new platforms offering financial services—fundamental consumer protection principles remain constant."⁹

Managing Risks

The Federal Reserve is committed to working with banks to ensure that the risks of fintech collaborations are evaluated and managed in a manner that promotes a fair and transparent consumer financial services marketplace. In our experience, strong institutions typically identify and mitigate risks before introducing new fintech collaborations. Conversely, we have found that when the risks are not identified and mitigated in advance, the unintended consequences may harm consumers, result in legal violations, and be costly for the bank to resolve, both from a monetary and reputational perspective.

There are several areas that a bank can consider to manage the risks of a fintech collaboration:

• Board and senior management oversight. Strong institutions typically identify, understand, and manage the potential risks arising from the fintech collaboration. They also dedicate sufficient resources to the fintech collaboration. The assigned staff is knowledgeable, empowered, and held accountable for compliance with consumer laws and regulations. Finally, strong institutions proactively identify issues and promptly respond to risks and deficiencies.

• Policies, procedures, and training. Strong institutions typically have documented, repeatable, and auditable processes, which are approved by the board and are appropriate to the risks found in the fintech collaboration. The policies and procedures communicate management's commitment and expectations related to risk management. Moreover, training is comprehensive and tailored for the staff receiving it and to the specific risk of the fintech collaboration. The training program is updated in advance of the introduction of the new fintech collaboration, product, or service.
   
• Risk monitoring. Strong institutions typically develop risk-monitoring and auditing processes that are sufficient to identify and address the potential risks of the fintech collaboration. The risk monitoring programs are monitored proactively to identify weaknesses and promptly make changes to minimize the risk of violations and consumer harm. In particular, strong institutions tend to proactively monitor consumer complaints, including those submitted to third parties, to identify risks and take appropriate action. Finally, where the fintech business model relies on algorithms, machine learning, or artificial intelligence, strong institutions typically ensure that they understand the risks and controls for these models.
   
• Third-party oversight. Strong institutions typically understand that they will need to evaluate the fintech firm's activities as though the bank performed the activities itself. For example, strong institutions tend to conduct comprehensive and ongoing due diligence and oversight of the third party to ensure consistent compliance with consumer protection laws and regulations. Strong oversight controls include comprehensive contract provisions, appropriate compensation and incentive structures, and clear performance metrics. In particular, strong institutions typically ensure that they monitor and analyze any complaints that consumers send directly to the fintech firm.¹⁰

Online and Mobile Banking

Background and Observations

Many community banks offer online and mobile banking services that allow consumers to conduct financial transactions from a computer or smartphone.¹¹ In 2018, more than 40 percent of Americans managed their bank accounts online¹² and about half of U.S. adults with bank accounts used a mobile phone to access a bank account in the past year.¹³ These online and mobile banking platforms offer convenient ways for consumers to check account balances and recent transactions, transfer funds, deposit checks, or pay bills.¹⁴ These tools not only allow consumers to manage their money, but also make informed financial decisions.¹⁵ While online and mobile banking services provide many benefits, the technology also presents security and privacy concerns for consumers and may result in heightened risks of unfair or deceptive practices (UDAP) in violation of Section 5 of the Federal Trade Commission Act.¹⁶

Certain bank practices related to online and mobile banking services have resulted in UDAP violations. UDAP risks have been identified when a bank fails to provide consumers accurate account information and disclosures on their online and mobile banking platforms. In addition, unfair or deceptive practices have arisen when a bank fails to evaluate and validate any modifications to its online and mobile banking platforms or monitor its compliance risk-management systems. As explained below, these UDAP risks can be readily mitigated with standard risk-management practices.

Recently, the Federal Reserve has cited UDAP violations based on the failure to disclose accurate payment information in online and mobile banking platforms. In one matter, a UDAP violation occurred with respect to the bank's mobile banking platform for overdraft line of credit accounts when the bank failed to disclose any finance charges or late fees owed with the minimum payment required, or the repayment amount necessary to pay the account in full. In another matter, a UDAP violation occurred with respect to the bank's online and mobile banking platform for installment loans when the bank failed to disclose any past due amounts or late fees with the payment amount due. In both matters, each violation resulted in consumers being harmed with additional finance charges, late fees, or negative credit reporting.

Managing Risks

Banks can identify and manage their UDAP risks related to online and mobile banking by taking the following steps:

• capturing and comparing disclosures on online and mobile banking platforms for consistency and accuracy,
• confirming the consumer experience with the bank's understanding of how the product should work, and
• regularly monitoring complaints for potential concerns.

Managing the Fair Lending Risks of Targeted Internet-Based Marketing

Sophisticated technology- and data-driven techniques have made it easier for businesses—including financial institutions—to target marketing to particular segments of consumers. Fair lending risks may arise from internet-based targeted marketing. We are still learning about how these platforms handle advertising, and it is an area that warrants attention. We offer some strategies that may help banks manage risk as our understanding of these issues continues to develop.

Background and Observations

Businesses now have access to sophisticated advertising analytics to help them reach specific segments of their markets. The algorithms that determine which ads a particular consumer sees are often based on highly detailed consumer profiles culled from such sources as website browsing histories, retailers, and credit card providers. Advertisers use these consumer data to target consumers by their locations, online habits, or the activities that they are predicted to engage in in the future.¹⁷ Using these analytics has resulted in websites displaying higher prices to some consumers based on perceptions about consumer preference due to, for example, the type of computer operating system used and websites varying a product's price or availability based on geography.¹⁸

While targeted advertisements may offer benefits to consumers, targeted marketing based on consumer data can raise a range of consumer protection and fair lending risks. When the advertisements displayed via the internet vary by individual, we can no longer assume that consumers will broadly have access to the same options, even if they were to do their best to research and seek out as many choices as possible online. Unequal access to information about credit can raise fair lending risks and lead to redlining or steering as discussed below.

Fair Lending Risk and Internet-Based Targeted Marketing

The Federal Reserve enforces the two primary federal laws that ensure fairness in lending: the Equal Credit Opportunity Act (ECOA) and the Fair Housing Act (FHA).¹⁹ Pursuant to the Dodd-Frank Wall Street Reform and Consumer Protection Act, the Federal Reserve has supervisory authority under the ECOA for state member banks with assets of $10 billion or less. For all state member banks, regardless of asset size, the Federal Reserve enforces the FHA.

The ECOA prohibits credit discrimination on the basis of race, color, religion, national origin, sex, marital status, age, receipt of income from any public assistance program, or because a person has exercised certain legal rights under the ECOA and other financial statutes. The ECOA and its implementing regulation apply to both consumer and commercial credit. Through Regulation B, the ECOA prohibits creditors from making oral or written representations in advertising or other formats that would discourage, on a prohibited basis, a reasonable person from making or pursuing a credit application.²⁰

The FHA applies to credit related to housing and prohibits discrimination on the basis of race or color, national origin, religion, sex, familial status, and handicap. With respect to marketing, the FHA prohibits discrimination in advertising regarding the sale or rental of a dwelling, which includes credit discrimination.²¹

Both laws prohibit redlining, which is a form of illegal discrimination in which an institution provides unequal access to credit based on the race, color, or national origin of a neighborhood.²² Fair lending laws also protect against the steering of an applicant to specific loan products based on prohibited characteristics, such as race or national origin, rather than the applicant's need or other legitimate factors.²³

Recent developments regarding the social media company Facebook highlight the risks of relying on technology for advertising, including any advertising platform that uses algorithms or filters, without also considering the fair lending implications of such technology.

Facebook's Marketing Settlement with Civil Rights Advocates and Housing Discrimination Charge by HUD

A number of technology companies, including Facebook, provide sophisticated targeted marketing services to businesses seeking to advertise online. Facebook's advertising platform is designed to help businesses reach a "core target audience" based on consumers' locations, demographics, behavior, interests, and similarity to current customers.²⁴

Investigations by a news organization concluded that Facebook's platform could result in ads that excluded viewers by characteristics such as race or gender. For example, it was possible to post a real estate ad that would not be shown to African American, Hispanic, or Asian American viewers or to post ads for a job driving for a car service that were only shown to male viewers.²⁵

In March 2019, several civil rights and other organizations announced a settlement with Facebook over similar allegations that Facebook's advertising platform allowed discrimination in housing, employment, and credit advertising. The platform also allegedly allowed advertisers to limit advertising to narrow geographic areas and to target audiences of Facebook users with common characteristics with the advertiser's current customers or other groups (called a "Lookalike Audience"), which the organizations argued could have a negative impact on various groups, including based on gender, race, and age.²⁶

Also in March 2019, the U.S. Department of Housing and Urban Development (HUD) charged Facebook with housing discrimination as a result of the targeting and filtering practices permitted by the company's ad platform.²⁷ HUD also alleged that Facebook itself discriminates by using machine learning and other techniques to decide how and to whom to deliver specific advertisements. These practices included identifying which users would or would not see particular advertisements, varying the price of advertisements charged to advertisers based on the characteristics of the users who would see them, and classifying users in a way that is related to protected characteristics, such as sex or race.

Managing Risks

Both the Facebook settlement and HUD's discrimination charge underscore that fair lending laws apply equally to internet-based advertising as they apply to traditional advertising. Many of the considerations for developing traditional advertising also are present when developing online advertising.

While we are still learning about this issue, below are some steps that banks can take to manage this fair lending risk:

• reviewing for and eliminating any geographic filters used in internet-based advertising, such as filters by ZIP code or branch radius, that would exclude predominantly minority neighborhoods;
• reviewing other elective filters in use to ensure that the they do not prevent (even unintentionally) viewers with characteristics protected by the ECOA or the FHA from seeing an online ad;
• reviewing any information available from the internet-based advertising service regarding the audience that viewed each online ad;²⁸
• establishing policies and procedures to evaluate fair lending risk for all marketing and outreach initiatives, including those that are internet-based and those that are not;
• monitoring marketing and outreach activities to ensure that those activities are reaching the entire assessment or credit market area, including any predominantly minority neighborhoods;
• ensuring that vendor management policies are in place; and
• understanding what marketing practices are being employed by the bank or on its behalf, and having appropriate controls to assess and manage any risk associated with those practices.²⁹

Federal Reserve Fintech Resources

The Federal Reserve is actively engaged in interacting with, learning about, and providing perspectives on financial technology. Below is a sample of the various Federal Reserve resources related to fintech.

Board Member Speeches

• Michelle Bowman, "Community Banking in the Age of Innovation" (April 11, 2019), https://www.federalreserve.gov/newsevents/speech/bowman20190411a.htm.
• Lael Brainard, "What Are We Learning about Artificial Intelligence in Financial Services?" (November 13, 2018), https://www.federalreserve.gov/newsevents/speech/brainard20181113a.htm.
• Lael Brainard, "Fintech and the Search for Full Stack Financial Inclusion" (October 17, 2018), https://www.federalreserve.gov/newsevents/speech/brainard20181017a.htm.
• Lael Brainard, "Cryptocurrencies, Digital Currencies, and Distributed Ledger Technologies: What Are We Learning?" (May 15, 2018), https://www.federalreserve.gov/newsevents/speech/brainard20180515a.htm.
• Randal K. Quarles, "Thoughts on Prudent Innovation in the Payment System" (November 30, 2017), https://www.federalreserve.gov/newsevents/speech/quarles20171130a.htm.
• Lael Brainard, "Where Do Consumers Fit in the Fintech Stack?" (November 16, 2017), https://www.federalreserve.gov/newsevents/speech/brainard20171116a.htm.
• Jerome H. Powell, "Financial Innovation: A World in Transition" (October 18, 2017), https://www.federalreserve.gov/newsevents/speech/powell20171018a.htm.
• Lael Brainard, "Where Do Banks Fit in the Fintech Stack?" (April 28, 2017), https://www.federalreserve.gov/newsevents/speech/brainard20170428a.htm.
• Lael Brainard, "The Opportunities and Challenges of Fintech" (December 2, 2016), https://www.federalreserve.gov/newsevents/speech/brainard20161202a.htm.
• Lael Brainard, "Community Banks, Small Business Credit, and Online Lending" (September 30, 2015), https://www.federalreserve.gov/newsevents/speech/brainard20150930a.htm.

Consumer Compliance Outlook Articles

• Carol A. Evans, "Keeping Fintech Fair: Thinking about Fair Lending and UDAP Risk," Consumer Compliance Outlook (second issue, 2017), https://www.consumercomplianceoutlook.org/2017/second-issue/keeping-fintech-fair-thinking-about-fair-lending-and-udap-risks/.
• "Perspectives on Fintech: A Conversation with Governor Lael Brainard," Consumer Compliance Outlook (third issue, 2016), https://www.consumercomplianceoutlook.org/2016/third-issue/perspectives-on-fintech-a-conversation-with-governor-lael-brainard/.
• Teresa Curran, "Fintech: Balancing the Promises and Risks of Innovation," Consumer Compliance Outlook (third issue, 2016), https://www.consumercomplianceoutlook.org/2016/third-issue/fintech-balancing-the-promise-and-risks-of-innovation/.
• Tim Marder, "Fintech for the Consumer Market: An Overview," Consumer Compliance Outlook (third issue, 2016), https://www.consumercomplianceoutlook.org/2016/third-issue/fintech-for-the-consumer-market-an-overview/.

Federal Reserve Conferences

• Federal Reserve Bank of New York, "The First New York Fed Research Conference on Fintech" (March 22, 2019). Conference materials available by clicking on the agenda at https://www.newyorkfed.org/research/conference/2019/fintech.
• Federal Reserve Bank of Philadelphia, "Fintech and the New Financial Landscape" (November 13–14, 2018). Conference materials available by clicking on the agenda at https://philadelphiafed.org/bank-resources/supervision-and-regulation/events/2018/fintech.
• Federal Reserve Bank of Boston, "Fintech, Financial Inclusion, and the Potential to Transform Financial Services" (October 17, 2018). Conference presentations available at https://www.bostonfed.org/news-and-events/events/fintech-conference/2018.aspx.
• Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, and Conference of State Bank Supervisors, "Community Banking in the 21st Century" (October 3–4, 2018), https://www.communitybanking.org/conferences/2018.

Federal Reserve Working Groups

• Federal Reserve Bank of San Francisco, Navigate: The Reserve Bank's fintech staff helps facilitate responsible innovations while protecting consumers and ensuring the safety and soundness of banks. Staff holds public office hours the first and third Tuesdays every month from 2:00 p.m.–5:00 p.m. (Pacific Time) or by appointment, available at https://www.frbsf.org/banking/fintech/navigate/. The Reserve Bank also maintains a website with fintech resources, available at https://www.frbsf.org/banking/fintech/.
• Federal Reserve Bank of New York, Fintech Advisory Group: Fintech experts meet twice a year to present views and perspectives on emerging issues related to financial technologies and the application and market impact of these technologies. Member and meeting information available at https://www.newyorkfed.org/aboutthefed/ag_fintech.html.
• Federal Reserve Bank of Atlanta, Center for Financial Innovation and Stability: The purpose of the Center is to improve knowledge of financial innovation and financial stability as well as the connection between the two, especially as it pertains to Federal Reserve policymaking, available at https://www.atlantafed.org/cenfis.aspx.
• Federal Reserve Bank of Boston, Mobile Payment Industry Workgroup: The group meets regularly to inform and consider potential resolutions for shared issues and the elimination of barriers to adoption of retail mobile/digital payments, available at https://www.bostonfed.org/publications/mobile-payments-industry-workgroup.aspx.

Footnotes