Recommendation: The Director of the Consumer Financial Protection Bureau should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 9)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: The Consumer Financial Protection Bureau concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the bureau states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The CFPB Director should work with FHA to complete an agreement for sharing the results of CFPB examinations of HECM servicers with FHA. (Recommendation 7)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: As of April 2020, CFPB has begun to take steps to complete an information sharing agreement to facilitate the process of sharing confidential information with FHA, including the results of HECM examinations. However, work on the agreement remains ongoing and CFPB noted it looks forward to finalizing the agreement as soon as practicable.

Recommendation: The Director of CFPB should communicate to CRAs its expectations regarding reasonable procedures for assuring maximum possible accuracy of consumer report information. (Recommendation 1)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: In a January 2020 update, CFPB reemphasized statements made in its comment letter, including its expectation for CRAs to fully comply with applicable federal consumer financial laws and the role of case law in providing guidance to CRAs. CFPB additionally noted that its publicly available examination procedures discuss factors that CFPB will consider in evaluating compliance with the reasonableness standard under the Fair Credit Reporting Act (FCRA). CFPB stated that since publication of the report, it has taken actions to convey expectations to CRAs, including holding a joint workshop with FTC in December 2019 on consumer reporting accuracy and publishing a Supervisory Highlights special edition focused on consumer reporting. More direct communication of CFPB's expectations can provide CRAs with clearer information on what actions might constitute a FCRA violation and how CRAs should comply with the reasonableness standard. We maintain that providing additional information to CRAs about its expectations for key FCRA requirements could help CFPB to promote consistency and transparency in its supervisory approach and that the recommendation should be addressed.

Recommendation: The Director of CFPB should communicate to CRAs its expectations regarding reasonable investigations of consumer disputes. (Recommendation 2)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: In a January 2020 update, CFPB restated the requirements for a reasonable investigation under the Fair Credit Reporting Act (FCRA) and noted that court cases have articulated what qualifies as a reasonable investigation. CFPB also noted that a 2011 FTC report summarizes how the courts and FTC have interpreted these obligations, and that CFPB issued a bulletin on reasonable investigations in September 2013. CFPB stated that it has and will continue to communicate its expectations to CRAs regarding applicable provisions of FCRA. We maintain that providing additional information to CRAs about its expectations for key FCRA requirements could help CFPB to promote consistency and transparency in its supervisory approach and that the recommendation should be addressed.

Recommendation: The Director of the Consumer Financial Protection Bureau (CFPB) should finalize its draft policy for posting comments and their identity information, particularly for duplicate comments, and clearly communicate it to the public on the CFPB website. (Recommendation 3)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: CFPB concurred with the recommendation. In December 2019, CFPB indicated that it will develop new language for consumerfinance.gov to better explain the Bureau's "post all" policy, and any exceptions to it. Additionally, CFPB is finalizing internal procedures for posting comments. Until these items are completed, our recommendation to CFPB remains open.

Recommendation: The Director of CFPB should provide written clarification to nonbank private student loan lenders on their authorities under the Fair Credit Reporting Act to offer private student loan rehabilitation programs that include removing information from credit reports. (Recommendation 1)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: As of November 2019, CFBP does not plan to act on this recommendation because the law does not require nonbank private student loan lenders to seek CFPB's approval of student loan rehabilitation programs. CFPB stated that if a financial institution chooses to offer a private student loan rehabilitation program it would be protected under the Fair Credit Reporting Act. We maintain that clarification from CFPB that nonbank lenders have the authority to offer these programs could--depending on CFPB's interpretation--result in additional lenders offering rehabilitation programs that would allow more borrowers the opportunity to participate, or it could help ensure that only those entities CFPB has interpreted as being eligible to offer programs are doing so.

Recommendation: The Director of CFPB, after consulting with the prudential regulators and relevant industry groups, should provide written clarification on what information in a consumer's credit report constitutes a private student loan reported "default" that may be removed after successful completion of a private student loan rehabilitation program. (Recommendation 2)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: As of November 2019, CFPB stated that action on this recommendation is premature pending ongoing work by an industry association on what information may be removed from a credit report after successful completion of a private student loan rehabilitation program. We will continue to follow up with CFPB on its monitoring of this effort and consultation with relevant regulators.

Recommendation: The Director of CFPB should identify additional sources of information, such as through registering CRAs or leveraging state information, that would help ensure the agency is tracking all CRAs that meet the larger participant threshold. (Recommendation 1)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: In July 2020, CFPB staff noted that they have reviewed state CRA registration information available to them, are working to obtain additional state registration information, and are exploring additional ways to leverage the information. GAO will continue to monitor CFPB's progress in leveraging additional sources of information that would help identify larger participant CRAs.

Recommendation: The Director of CFPB should assess whether its process for prioritizing CRA examinations sufficiently incorporates the data security risks CRAs pose to consumers, and take any needed steps identified by the assessment to more sufficiently incorporate these risks. (Recommendation 2)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: In July 2020, CFPB staff noted that they were assessing whether, and if so, how and when, to incorporate data security risks into their supervisory prioritization. As part of that evaluation, CFPB is assessing whether those processes should incorporate data security risks CRAs pose to consumers in light of the agency's statutory authorities, supervisory responsibilities, and resources. GAO will continue monitoring CFPB's assessment of prioritization of CRA data security risks.

Recommendation: The Director of CFPB should implement a systematic process for prioritizing risks to consumers and considering how to use the bureau's available policy tools—such as rulemaking, supervision, enforcement, and consumer education—to address these risks. Such a process could incorporate principles from the prior One Bureau process, such as an assessment of the extent of potential harm to consumers in financial markets, to prioritize the most significant risks. (Recommendation 1)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: In October 2019, CFPB staff told us that the CFPB Director approved a proposal to implement a short-term policy prioritization exercise. According to a memorandum describing this exercise, CFPB anticipates that it will involve CFPB's Strategy Office engaging members of cross-bureau working groups to review and update priorities related to addressing risks to consumers. According to CFPB staff, the working groups will need up to a few months to complete this work, and the results should be available in the second quarter of 2020. To fully address this recommendation, CFPB needs to make further progress in implementing this planned prioritization exercise, including by demonstrating steps taken to prioritize risks to consumers and considering how to use CFPB's various policy tools to address these risks.

Recommendation: The Director of the Bureau of Consumer Financial Protection should, in coordination with the federal banking regulators and with input from relevant stakeholders, communicate in writing to fintech lenders on the appropriate use of alternative data in the underwriting process, including issues to consider when selecting types of alternative data to use. (Recommendation 1)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: In December 2019, the Board of Governors of the Federal Reserve System, the Consumer Financial Protection Bureau, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency (the agencies) issued an interagency statement on the use of alternative data in credit underwriting. The statement broadly highlights some potential benefits and risks of using alternative data and encourages firms to responsibly use alternative data, but does not provide firms or banks with specific direction on the appropriate use of alternative data, including issues to consider when selecting types of alternative data to use. We will continue to monitor the agencies' actions related to this recommendation.

Recommendation: The Director of the Consumer Financial Protection Bureau should engage in collaborative discussions with other relevant financial regulators in a group that includes all relevant stakeholders and has defined agency roles and outcomes to address issues related to consumers' use of account aggregation services. (Recommendation 5)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: In a May 2018 letter, the Acting Director of the Bureau stated that the Bureau has previously issued principles that include reasonable and practical means for consumers to dispute and resolve instances of unauthorized payments conducted in connection with or as a result of authorized or unauthorized data sharing access. The letter notes that the Bureau is committed to monitoring developments in data aggregation markets and will continue to assess how the Bureau's consumer protection principles may be best realized, including engaging in discussions with other relevant federal and state financial regulators. In October 2018, Bureau staff advised us that they made a presentation on existing consumer protections that would appear to be applicable to consumers using data aggregators at the June 28, 2018 meeting of the Fintech Interagency Discussion Group, which includes OCC, the Federal Reserve, the Federal Deposit Insurance Corporation, and the National Credit Union Administration. They noted they are monitoring private sector efforts related to resolving data aggregation issues and that additional discussions among the regulators about these issues will be held in the future. We will recontact the agency in the future to obtain information on additional actions it has taken. In January 2020, GAO met with CFPB to discuss the recommendation and potential outcomes that could close the recommendation. CFPB officials stated that they will be hosting a public forum on data aggregation in February 2020. They noted that results from the public forum could include action related to the data aggregation recommendation.

Recommendation: The Director of CFPB should issue public information on its plans for reviewing regulations applicable to banks and credit unions, including information describing the scope of regulations the timing and frequency of the reviews, and the extent to which the reviews will be coordinated with the federal depository institution regulators as part of their periodic EGRPRA reviews. (Recommendation 2)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: CFPB staff noted in a letter in April 2018 that CFPB had issued requests for information (RFI) on the regulations their agency had adopted and inherited from other agencies. These requests seek public comment on the need to amend these regulations. They noted that they included in their spring and fall 2017 Semiannual Regulatory Agenda descriptions of two initiatives intended to review their regulations to identify opportunities to modernize and streamline provisions. In addition, they noted they had created an internal task force to coordinate and bolster continuing efforts to identify and relieve regulatory burdens. They stated that they would continue to publish information on their plans for reviewing regulations as appropriate. We plan to continue following up with CFPB to determine the extent to which they have published information on their plans to review the burden of their agency's regulations.

Recommendation: To help state credit union supervisors and privately insured credit unions better interpret Regulation I and inform consumers when an institution is not federally insured, CFPB should issue guidance to clarify whether drive-through windows require disclosures.

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: CFPB agreed with this recommendation. As of January 2020, CFPB said it had explored options for addressing the recommendation and determined it would require notice-and-comment rulemaking. CFPB said that because the agency had other, higher regulatory priorities, it did not currently have plans to implement the recommendation.

Recommendation: To help state credit union supervisors and privately insured credit unions better interpret Regulation I and inform consumers when an institution is not federally insured, CFPB should issue guidance to describe what constitutes clear and conspicuous disclosure, including minimum signage dimensions and font size for disclosures.

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: CFPB agreed with this recommendation. As of January 2020, CFPB said it had explored options that would most effectively and efficiently provide guidance regarding Regulation I and said that notice-and-comment rulemaking would be necessary to address GAO's recommendation with regard to "clear and conspicuous" disclosures. CFPB said that because the agency had other, higher regulatory priorities, it did not currently have plans to implement the recommendation.

Recommendation: To help state credit union supervisors and privately insured credit unions better interpret Regulation I and inform consumers when an institution is not federally insured, CFPB should issue guidance to explain and provide examples of which communications are advertising.

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: CFPB agreed with this recommendation. As of January 2020, CFPB said it had explored options that would most effectively and efficiently provide guidance regarding Regulation I and said that notice-and-comment rulemaking would be necessary to address GAO's recommendation. CFPB said that because the agency had other, higher regulatory priorities, it did not currently have plans to implement the recommendation.

Recommendation: To better ensure that servicemembers with private student loans benefit from the SCRA interest rate cap, the Director of the Consumer Financial Protection Bureau and the Attorney General of the Department of Justice should coordinate with each other, and with the four federal financial regulators, as appropriate, to determine the best way to ensure routine oversight of SCRA compliance for all nonbank private student loan lenders and servicers. If CFPB and DOJ determine that additional statutory authority is needed to facilitate such oversight, CFPB and DOJ should develop a legislative proposal for Congress.

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: The Consumer Financial Protection Bureau (CFPB) stated that it is committed to working with the Department of Justice (DOJ) and federal financial regulators, when possible, to facilitate oversight of SCRA compliance and that it will support all relevant federal agencies in using their respective authorities to identify and address SCRA violations as efficiently and effectively as possible. While CFPB coordinates with DOJ and other federal regulators in general, there is still no single agency authorized to enforce SCRA compliance among nonbank private student loan lenders and servicers, and no entity is conducting onsite supervisory reviews of these lenders and servicers. In addition, while CFPB may refer complaints from servicemembers about the SCRA rate cap for private student loans to DOJ and other financial regulators, we believe this does not constitute routine, proactive oversight and also presumes servicemembers are aware of the SCRA rate cap. GAO will consider closing this recommendation when the bureau has provided evidence of actions it has taken to facilitate routine oversight of SCRA compliance for all nonbank private student loan lenders and servicers. CFPB did not provide an update for 2020.

Recommendation: To provide reasonable assurance that the property, equipment, and software transactions are properly tracked and capitalized or expensed as appropriate, the Director of CFPB should direct the program offices to require vendors to provide detailed invoices with costs broken out by project.

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: During our fiscal year 2019 audit, we continued to find control deficiencies over CFPB's accounting for its property, equipment, and software. CFPB was still in the process of working with its Office of Procurement and program offices to require more detailed invoices with costs broken out by project. We will continue to evaluate CFPB's actions to address this recommendation during our fiscal year 2020 financial statement audit.