Practical Advice and Implementation Tips

To avoid information breaches and violations of important state and federal regulations, it’s important to build and adopt a Compliance Management System (CMS). This will give you the ability to monitor dealership activity and reduce compliance risks.

#StayCompliant

Learn what your CMS should include

Compliance Tips Recommended Practices

Did you know?

A principal cause of data security breaches is simply employee oversight and negligence, so it’s important to have regular training on your compliance policies.

Compliance Tip

Have a formal program in place for tracking and responding to consumer complaints to meet the expectations of regulators.

Recommended Practice

Adopt a dealer-wide ECOA/Fair Lending policy and consider naming a senior officer to be in charge of the policy.

Compliance is a critical priority for any auto dealer. Done properly, it will save costs, expenses, and help dealerships avoid practices that could result in fines, damages, and penalties from regulators or Attorney General investigations – not to mention consumer claims and lawsuits. In today’s business environment, it’s more than a best practice to adopt a Compliance Management System (“CMS”). It’s a business necessity, just as it is critical to bring a culture of compliance into your dealership, one that starts with senior management support.

CMS Implementation

A CMS consists of your policies, procedures and operational practices and is designed to promote compliance with applicable laws and regulations. It does not have to be a hugely complex undertaking; you may have many of the necessary policies and procedures described in this Compliance Guide – as well as corresponding practices – already in place. Effectively documenting and maintaining your policies, procedures and practices can be key to your defense if you are ever investigated.

An effective CMS starts from the top. It should be approved and championed by your Board of Directors or, if you don’t have a Board, your executive officers and dealer principal(s). The senior officer in charge of the CMS should report to your Board or senior management group on dealership compliance at least semi-annually and preferably quarterly, so that omissions or potential violations are quickly identified and corrected.

CMS Policies and Procedures

The bottom line? Your CMS program and documentation should be aligned with your dealership’s policies and practices and be in full compliance with the requirements of consumer protection laws. It should develop and maintain a sound policy and compliance program for the entire set of products and services offered to consumers. The CFPB has issued guidance about the components of a CMS for financial institutions. These represent best practices for dealers not subject to CFPB jurisdiction as well. A CMS must have control procedures to ensure your dealership stays compliant. Compliance audits, policy reviews, corrective action, and policy and procedure modifications on an ongoing basis are required. The CMS and component policies should also provide that dealership employees be held accountable for conduct that does not meet the requirements under the CMS, whether in the form of adverse compensation consequences and/or termination of employment for repeat offenders.

Much of your CMS will include a compilation of policies that we have discussed in this Compliance Guide. These include your Privacy, Safeguards, Data Destruction, Red Flags, Fair Credit, Fair Lending, UDAAP, Advertising and Marketing, Customer Complaints, Record Retention, and other subject matters referenced within the preceding Topics.

Training and Monitoring Employees

A CMS is only effective if properly implemented. A critical component of an effective CMS is to train your employees and monitor for their compliance. For example, a principal cause of data security breaches is simply employee negligence. The training must include legal requirements and security requirements that you include in your Safeguards program. Employees should also be trained on unfair, deceptive, and abusive acts and practices and the expectations for conduct as a representative of your dealership. Monitoring employee conduct in individual transactions, as well as monitoring data flow in your system and user activity to identify possible patterns of irregularities, is also critical.

Tracking and Responding to Consumer Complaints

As part of your CMS, regulators expect that you will have in place a formal program for tracking and responding to consumer complaints. The CFPB has established an online consumer complaint database and the FTC encourages consumers and businesses to file complaints about auto dealerships as well. Consumer complaints go a long way toward establishing which dealerships the FTC and State Attorneys General will investigate for violations. You want to stay off the regulatory radar screens and seek to resolve consumer complaints informally through the dealership. This is not just about increasing customer satisfaction scores. It’s about avoiding the costs, expenses, and divergence of management time related to a regulatory investigation. Your CMS should describe the process for customer complaints, timelines for responding, escalation and mediation processes, the resolution by a senior dealership officer or neutral third party, if necessary, as well as establish a mechanism for tracking complaints. Consider going the extra mile to resolve consumer complaints even if it means the consumer may receive more than you believe they are entitled. Treat every customer individually but use a consistent process of initiating complaint responses within a short period of time and having appropriate escalation procedures. Do whatever you can to resolve the complaint within your dealership.

Vendor Management

The FTC and CFPB have been particularly concerned with vendor management oversight policies and functions, as some of your compliance work and many of your business processes may be outsourced to third parties. While your dealership can outsource services, it cannot outsource responsibility for compliance. You are ultimately responsible for the performance and any failures to perform or comply by your vendors. Your CMS should contain a policy for selecting, managing, auditing, and resolving service, security, and performance issues with third-party service providers, and include the right to audit. It is not enough to delegate any of your compliance obligations to third parties. You need to stay on top of them and make sure they are following your policies, particularly if they will have the ability to access your customers’ nonpublic personal information. In the CFPB CFPB’s 2012 Bulletin on service providers, which was amended and re-issued in 2016, the agency indicated that it is critical for those subject to its jurisdiction to:

Conduct thorough due diligence of service providers
Review service providers’ compliance policies, procedures, internal controls, and training materials
Include clear compliance expectations in service provider contracts as well as appropriate and enforceable consequences for non-compliance
Regularly monitor service providers for compliance
Take prompt and appropriate action for non-compliance, including termination of contracts

While the CFPB’s guidance applies to those subject to its jurisdiction, it can be used by any organization as a foundation for a customized program.

Dealer Finance Participation

Dealers, if they have not already done so, should consider adopting, implementing, and monitoring compliance with an ECOA/Fair Lending policy that states the dealership’s policy to not discriminate in any aspect of a credit transaction. Staff training and monitoring buy rate participation can be a part of the policy. One good practice, originally developed by the Department of Justice (DOJ) as part of a prior enforcement action, is to implement a consistent buy rate participation amount for all customers and permit markdowns only, based on significant, nondiscriminatory, pre-identified legitimate business reasons. The reasons should be documented in the deal jacket to demonstrate the legitimacy of the action should a finance source or regulator audit the dealer’s practices. This documentation should be a purely internal document and not something to give to the customer. This approach is the foundation of the NADA-NAMAD-AIADA Fair Credit Compliance Policy and Program Certification Form (“NADA Form”) which closely tracks not only the approach of the DOJ but also provides a list of the specific legitimate business reasons it approved in the case settlements it entered into in 2007 with two dealers. You can obtain a copy of the NADA Form from NADA.

Examples of legitimate business reasons that justify differences in participation are many and you should consult with your counsel to determine those applicable to your dealership. But using the seven reasons “blessed” by the DOJ in 2007 may be the safest course of action. These are:

The finance source’s restriction on rate participation being lower than the dealers’ standardized rate participation;
A constraint on the customer’s ability to satisfy monthly payment requirements;
Customer has a competing offer from another dealer or finance source;
A special promotional offer extended to all customers on the same terms;
The fact that the transaction was eligible for a captive’s or other finance source’s subvented interest rates (a rate typically subsidized by a vehicle manufacturer such that the APR the customer pays is below the finance source’s typical buy rates, such as a 0% APR program);
The fact that the transaction is eligible for the dealership’s employee incentive program; or
Documented inventory reduction considerations related to specific vehicles.

For example, if the customer has another offer of credit from a bank, credit union, or another dealer meeting or beating your APR, this could be a legitimate, non-discriminatory business practice. Your ECOA/Fair Lending policy should have the specific requirements of your program, for example, whether you meet or beat a competing APR and, if you beat it, by how much. A good practice is to document in the deal jacket the name of the other creditor and the terms of the competitive offer. While such a practice will certainly not guarantee immunity from a credit discrimination claim, you will at least have a consistent policy and process to justify potential disparities in your portfolio.

In each credit sale deal jacket, you would insert the NADA Form (or similar form) indicating either that you charged the customer the dealership’s standard participation rate or the pre-identified reasons for decreasing that rate down. Doing this consistently on every credit sale deal is one way to help protect your dealership from a credit discrimination claim. In creating the standardized non-discriminatory business reasons for a reduced participation, you should discuss your choices with your attorney prior to implementation. Consider using the DOJ reasons identified above as a guide to developing your reasons. Note that the CFPB has informally indicated that an open-ended “other” reason is not acceptable because they believe such a practice creates an opportunity for a dealer to apply its rate participation exception policy in an inconsistent manner.

When coupled with training, monitoring for rate deviations, and taking remedial action as needed, this dealer participation practice positions a dealer to be better able to respond to a fair lending inquiry. Note that despite the CFPB’s activity in the indirect auto finance market, the consent decrees and other regulatory resolutions have not produced the CFPB’s desired result of eliminating rate participation in the market generally.

Recommended Practices

Adopt a dealer-wide ECOA/Fair Lending policy and consider naming a senior officer to be in charge of the policy if you have not already done so. The policy should state clearly the dealership’s commitment to equal treatment and non-discrimination in all aspects of a credit transaction. Sales and F&I personnel who set prices or rates to consumers should be trained and tested regularly with respect to the policy. Monitor rate markups to ensure consistent application of the policy. Make the policy available to finance sources who send you communications about fair lending issues and be prepared to show the affirmative steps your dealership takes to make fair lending a priority.
Begin all negotiations with a set rate markup amount for credit transactions. Starting each customer with the same rate markup (and hopefully completing a large number of your deals at that figure or close to it) will provide good evidence of the absence of discriminatory pricing. It is critical that you monitor rate markups for similarly-qualified customers, and if you observe material differences that you speak with the dealership personnel involved and learn the reasons. Make redress to customers if appropriate. Document your final rate markup on each credit sale – be it the standard rate markup or a lower rate based on the pre-identified list of legitimate business reasons – in the deal jacket using something like the NADA Form. Include supporting documentation if you are deviating from the standard rate markup.
Develop and implement a Compliance Management System. All dealerships should create and implement a compliance management system that addresses the various issues addressed in this guide including, but not limited to: Privacy, Safeguards, Data Destruction, Red Flags, Fair Credit, Fair Lending, UDAAP, Advertising and Marketing, Customer Complaints, Record Retention, and other subject matters. All employees should be trained on the applicable laws as well as the dealer’s policy on the respective issue. For example, what is the dealer’s process for accepting and responding to consumer complaints? A best practice is to delegate a senior level official or manager in the development and implementation of the CMS. The senior leadership of the dealership should approve of the CMS and be made aware of any compliance-related issues. A periodic audit of the CMS of at least one year should be conducted in order to identify any concerns, potential issues or violations. Where applicable, the dealer’s processes and procedures should be updated to avoid any issue or violation. The senior leadership should be involved in any corrective or remedial measures.
Review FTC, CFPB and other industry guidance. We also recommend that the dealer delegate an employee, senior official or work with outside counsel to monitor applicable federal and state laws. This is a dynamic industry and with the regulatory changes at the federal and state level, a dealer minimizes risk if they monitor changes in the law and updates their CMS accordingly.