With many federal and state agencies investigating dealership sales practices lately it is strongly recommended that dealers conduct an audit of their own sales practices to ensure that they are in full compliance with federal regulatory requirements. Failure to adhere to the regulatory requirements can subject the dealership to civil penalties up to $16,000 per violation. The following is a summary of five regulations where dealers commonly fall out of compliance.
Information Privacy/Information Safeguards
The Gramm Leach Bliley Act ("Privacy Act") requires dealers to protect the security and confidentiality of customer personal, non-public information (such as social security numbers, dates of birth, etc.).
Under the Privacy Act dealers must:
- Provide every customer who receives a credit application with a Privacy Notice; and
- Safeguard all customer non-public information.
The Privacy Notice informs the customer what the dealer does with the non-public information it collects during the credit application process. The Privacy Notice must be distributed to the customer at the time the customer receives a credit application.
The Safeguard Rule requires dealers to restrict access to customer non-public information. Any and all documents which contain non-public information must be secure at all times and the public must not have access to non-public documents or information. This is true for paper documents and information stored in dealership computer systems and databases.
If you have not revised your Privacy Notice in several years or are not currently providing a Privacy Notice call the LaBonte Law Group today for a free
personalized
Privacy Notice.
Adverse Action Notices
Under the Equal Credit Opportunity Act (ECOA), adverse action is defined as "a denial or revocation of credit, a change in the terms of an existing credit arrangement, or a refusal to grant credit in substantially the amount or on substantially the terms requested." The Fair Credit Reporting Act (FCRA) incorporates the same definition as in the ECOA, and then adds a "catch-all" definition that includes "any action taken or determination that is ... adverse to the interests of the consumer."
In most instances the dealer submits the credit application directly to the lender and the lender makes a determination on whether or not to extend credit to the customer. If credit is subsequently denied then the lender generally issues an Adverse Action Notice. However, there are circumstances where a dealer must issue an Adverse Action Notice to a customer.
Under what circumstances do dealers have to issue Adverse Action Notices?
Notices should be issued when:
- The dealer takes a credit application from a customer but does not send the application to a financing source (this generally occurs when a dealer learns of some negative credit information about the customer and unilaterally decides not to submit the application to a bank for consideration);
- The dealer unwinds or recontracts a spot delivery deal; and
- The customer rejects a counteroffer from the bank which includes terms different than originally requested (i.e increased APR, down payment, monthly payment, etc.)
Adverse Action Notices can be generated from dealer management software such as DealerTrack and Route One. If you have questions on how to generate the notices or if you would like to discuss the situations in which a dealer must issue the notices please contact the LaBonte Law Group.
Identity Theft Red Flags
What is a red flag? A red flag is simply any warning sign that might indicate that a customer is not who he or she claims to be. Under federal law every employee who processes financial transactions must be able to:
- detect and evaluate identity theft red flags in connection with individual credit transactions; and
- respond to identity theft red flags in an appropriate way to prevent identity theft.
Red Flags can take many forms but most are discovered by using simple common sense. For example, Red Flags include situations when:
- There is an address discrepancy between the ID provided and the information noted in the sales documents;
- Documents provided for ID appear to have been altered or forged;
- The photograph or physical description on the ID is not consistent with the appearance of the applicant or customer presenting the identification; and
- The person applying for credit fails to provide all required personal identifying information on an application
Upon detection of a red flag, employees must notify a manager of a potential ID theft situation. The manager can then ask the customer additional questions based on the information on their credit report or request additional documentation to verify the customer's identity.
RISK BASED PRICING NOTICES
The Federal Reserve System and the Federal Trade Commission (FTC) jointly issued the Risk-Based Pricing Regulations to implement the risk-based pricing provisions in the Fair and Accurate Credit Transactions Act of 2003 ('FACT Act').
The Risk-Based Pricing Rules require a dealer to provide a risk-based pricing notice to a consumer when the creditor uses a consumer report to grant or extend credit to the consumer on material terms (generally meaning the APR) that are materially less favorable than the most favorable terms available to a substantial proportion of consumers from or through that creditor (dealer) in connection with credit that is primarily for personal, household or family purposes.
If this sounds confusing to you then you are not alone. As a result of this confusion the FTC now allows dealers to issue Risk Based Pricing Exception Notices to all customers who apply for credit. These notices provide the
customer
with information on their current credit score, statements that are intended to educate the consumer about credit reports, credit scores, and how the consumer may obtain a free annual credit report, a range of possible credit scores with a bar graph or statement indicating how the consumer's score compares to other consumer scores.
The Risk Based Pricing Exception Notice must be provided to the customer prior to the execution of the loan agreements.
OFAC
Federal law prohibits businesses from transacting business with anyone listed on the United States Treasury Department's Office of Foreign Assets Control (OFAC) list. The "OFAC list" includes thousands of the country's "most wanted" criminals and/or terrorists. Willful violations of the OFAC requirements can subject the owner to fines up to $20 million and a prison term of up to 30 years.
All financial institutions and lenders generally cross reference a customer's name against the OFAC list. Therefore, in all credit transactions the bank should be checking the list before issuing a credit approval. However, dealers should still verify that their lending institutions are checking the OFAC list.
The area of most exposure is with cash transactions. When a customer is paying with cash (or check) the dealer alone is responsible for checking the OFAC list. This applies regardless of whether the customer is purchasing a vehicle, service, maintenance or parts.
Checking the List
The best method is to subscribe to a service (i.e. DealerTrack, Reynolds & Reynolds, ADP, etc.) which will automatically check the OFAC list and determine if your customer's name appears on the list.
If you do not subscribe to any OFAC services then you can manually access the list of "Specially Designated Nationals" via the Internet at www.
treasury.gov/resource-center/sanctions/SDN-List/Pages/default.aspx.
If you get a match don't panic. It does not automatically mean the customer is a terrorist. First make sure you have entered the information correctly. If the information is correct then it is possible to receive a "false hit." If the name is a match call OFAC's "hotline" at 1-800-540-6322 for name verification. The Treasury Department will assist you to determine if the search result is a false hit or a match.
REGULATORY
TRAINING
The LaBonte Law Group regularly conducts in-house training sessions for dealers on all federal regulatory requirements. For more information on scheduling an in-house training session call the LaBonte Law Group at 516-280-8580.
