FEDERAL DEPOSIT INSURANCE CORPORATION
WASHINGTON, D.C.
|
In the Matter of
|
)
|
AMENDED
|
|
|
|
)
|
CONSENT ORDER,
|
|
|
THE BANCORP BANK
|
)
|
ORDER FOR RESTITUTION
|
|
|
WILMINGTON, DELAWARE
|
)
|
AND ORDER TO PAY
|
|
|
|
)
|
CIVIL MONEY PENALTY
|
|
|
|
)
|
|
|
|
(INSURED STATE NONMEMBER BANK)
|
)
|
FDIC-11-698b
|
|
|
|
)
|
FDIC-15-0318b
|
|
|
|
)
|
FDIC-15-0211k
|
|
The Federal Deposit Insurance Corporation ("FDIC") is the appropriate Federal banking agency for The Bancorp Bank, Wilmington, Delaware ("Bank"), under section 3(q) of the Federal Deposit Insurance Act ("FDI Act"), 12 U.S.C. § 1813(q).
The FDIC has reason to believe that the Bank has engaged in unsafe or unsound banking practices and engaged in deceptive and unfair acts and practices in or affecting commerce, in violation of Section 5 of the Federal Trade Commission Act ("Section 5"), 15 U.S.C. § 45(a)(1), in connection with the error resolution, account termination and fee practices for certain consumer products.
The Bank, by and through its duly elected and acting Board of Directors, has executed a STIPULATION AND CONSENT TO THE ISSUANCE OF AN AMENDED CONSENT ORDER, ORDER FOR RESTITUTION, AND ORDER TO PAY CIVIL MONEY PENALTY
("Consent Agreement"), dated
December 21, 2015,
that is accepted by the FDIC. With the
Consent Agreement, the Bank has consented, without admitting or denying any charges of unsafe or unsound banking practices or violations of law or regulation, to the issuance of this AMENDED CONSENT ORDER, ORDER FOR RESTITUTION, AND ORDER TO PAY CIVIL MONEY PENALTY (these orders collectively "ORDER") by the FDIC, which amends and restates the CONSENT ORDER AND ORDER TO PAY CIVIL MONEY PENALTY dated August 7, 2012.
Having determined that the requirements for issuance of an order under sections 8(b) and 8(i)(2) if the FDI Act, 12 U.S.C. §§ 1818(b) and 1818(i)(2), have been satisfied, the FDIC hereby issues the following:
CONSENT ORDER
SUPERVISION BY BOARD
1.
The Board of Directors (the Board of Directors and its duly appointed committees, "the Board") shall increase its oversight of the affairs of the Bank by approving sound policies and objectives and by supervising all of the Bank's activities relating to the Bank's consumer and commercial deposit, lending, and other products and services (collectively, "Products and Services") consistent with the role and expertise commonly expected for directors of banks of comparable size and complexity and offering comparable banking products and services. Without limiting the generality of the foregoing, the Board shall increase its oversight activities of the Bank's compliance management system. Activities of the Board shall be documented in the minutes of Board meetings. The Board shall approve sound policies and objectives for the
Bank's Products and Services offered to consumers ("Consumer Products"), including any of the Bank's Consumer Products offered in conjunction with a third party ("Third-Party Products"). The Board shall require that any such Consumer Products comply with applicable consumer protection and fair lending laws, including Section 5, implementing rules and regulations, and regulatory guidance and statements of policy (collectively "Consumer Protection Laws").
COMPLIANCE MANAGEMENT SYSTEM
2.
(a)
The Bank, on an ongoing basis, shall review, revise, and implement changes to its risk-based compliance management system, including the written compliance program ("Compliance Program"), to ensure that the Bank's Consumer Products, including any Third- Party Products, comply with Consumer Protection Laws. Without limiting the generality of the foregoing, and to the extent the Bank maintains any Third-Party Products, the Bank shall ensure that the Compliance Program includes effective monitoring systems for the Bank's Third-Party Products with provisions requiring:
(i)
review, approval, and maintenance by the Bank of copies of (1) all marketing, advertising, and solicitation materials, including direct mail, electronic or telephonic marketing, or internet solicitations, promotional materials, and telemarketing scripts and rebuttals; (2) other materials provided or disseminated to customers or potential customers generated in connection with the marketing, administration and servicing of such Third-Party Products, including account agreements, privacy policies, periodic statements, and account histories and other transaction-related information; and (3) any material changes or amendments to any such materials;
(ii)
timely and regular notification to the Bank by its Third-Party Product partners, vendors, or servicers of any regulatory agency inquiries or legal actions and any legal actions commenced by any customer or potential customer;
(iii)
review and approval by the Bank of all materials related to customer service; monitoring by the Bank of customer service calls on a regular basis; and review by the Bank of service-level reports;
(iv)
monitoring by the Bank of the performance of marketing and solicitation programs, including numbers of accounts offered, the products in each campaign and the response rate for each Third-Party Product;
(v)
increase the comprehensiveness of periodic compliance reviews, including on-site visits, by the Bank as appropriate of all Third-Party Product providers, partners, vendors, or servicers and any of their material Third-Party Product-related service providers or sub- servicers (collectively "Third-Party Product Contributors") and comprehensively document such compliance reviews;
(vi)
periodic review of all the Bank's business and strategic plans relating to agreements with Third-Party Product Contributors;
(vii)
maintenance of records by the Bank of all approved materials, complaints and responses, solicitation materials, administration materials, and agreements related to its Third-Party Products;
(viii) maintenance of records by the Bank documenting the service-level standards for those services provided by Third-Party Product Contributors, including due diligence reports, monitoring and audit results, and financial materials;
(ix)
quarterly consumer compliance meetings between the Bank and its material Third-Party Product partners, vendors, and servicers, for which written notes will be taken and maintained; and
(x)
periodic monitoring of the use of confidential and nonpublic personal information about Bank customers and consumers by its Third-Party Product Contributors and of the information security programs of such Third-Party Product Contributors.
(b)
The Bank shall ensure that its Compliance Program provides for the establishment and implementation of an effective training program for appropriate Bank personnel that
includes regular, specific, comprehensive training on applicable Consumer Protection Laws for employees having responsibilities that relate to Consumer Protection Laws, including senior management and the Board, commensurate with their individual job functions and duties.
(c)
The Bank shall ensure that its Compliance Program includes procedures for promptly addressing and resolving consumer complaints arising from any Third-Party Product regardless of the source of the complaints, for monitoring such complaints and identifying any trends concerning the nature of the complaints, and for promptly addressing any root causes of such complaints.
(d)
The Compliance Program shall be administered by compliance personnel with sufficient experience in, and knowledge of, Consumer Protection Laws and shall provide for sufficient personnel in order to fully comply with all requirements of this ORDER.
COMPLIANCE AUDIT PROGRAM
3.
(a)
Within 60 days from the Effective Date of this ORDER, the Bank shall review and revise its internal compliance audit program to ensure an effective and independent review of the Bank's internal policies and procedures and compliance with Consumer Protection Laws. The revised internal compliance audit program shall take into account the size of the Bank and the complexity and risks identified with the Bank's product, services, and business model, and shall at a minimum include policies, procedures, and processes that ensure:
(i) audit practices and procedures that are consistent with Generally Accepted Auditing Standards, including provisions to ensure that the internal compliance audits, including audits of the Bank's Third-Party Products, are independent and adequate in scope;
(ii)
annual risk assessments of each Third-Party Product type to ensure that internal compliance audits are performed with reasonable frequency;
(iii)
completion of a risk-based compliance audit plan each calendar year that considers the Bank's products, services, and business model in their entirety and that is reviewed and approved by the Board;
(iv)
the assignment of ratings or expressions of opinion as to the adequacy, effectiveness, and efficiency of the internal control environment of each line of business which offers one or more Third-Party Products; and
(v)
provisions for an adequate formal tracking and monitoring system for exceptions identified by internal compliance audits and regulatory examinations.
(b)
Internal compliance audit findings, deficiencies, and recommendations shall be promptly documented in a written report and provided to the Audit Committee of the Board at its next meeting. The Bank shall promptly forward a copy of each internal compliance audit written report and the minutes reflecting the Board's review of such report to the Regional Director of
the FDIC's New York Regional Office ("Regional Director"). Within thirty (30) days of receipt of the internal compliance audit written report, the Board shall take action to address the internal compliance audit's findings, correct or take steps to correct any deficiencies noted in a timely manner, implement any recommendations, and establish follow-up measures to monitor the effectiveness of corrective actions. The Board's review of the internal compliance audit written report shall be fully documented in its minutes, together with a report of the Board's actions in response to the internal compliance audit, including where applicable an explanation why a recommendation has not been implemented.
MANAGING THIRD-PARTY RISK
4.
(a)
The Bank shall maintain, review, revise, and implement a Board-approved Third- Party Risk Management Program ("Third-Party Program") which shall set forth the Bank's plan for managing the risks of its Third-Party Product Contributors, vendors, and service providers. The Bank's relationship risk committee ("Third-Party Relationship Risk Committee") shall keep minutes that shall be regularly reviewed by the Board Risk Committee, and shall enhance its efforts to ensure proper management of third-party risk, consistent with the risk profile of any activity outsourced to Third-Party Product Contributors, vendors and service providers. At a minimum, the Bank's Third-Party Program shall include, consistent with the
Guidance for Managing Third-Party Risk
(FIL-44-2008, issued June 6, 2008):
(i) a risk assessment process to identify the risks associated with the use of Third-Party Product Contributors, vendors and service providers, including but not limited to, operational and transactional risks;
(ii)
procedures adequate to conduct initial and ongoing due diligence with respect to activities of Third-Party Product Contributors, including but not limited to the marketing, processing, and servicing of Products and Services;
(iii)
procedures for terminating Third-Party Product Contributor relationships in the event that any such relationship fails to comply with the Bank's systems and controls;
(iv)
procedures to review contract terms with respect to Third-Party Product
Contributors; and
(v)
effective oversight of Third-Party Product Contributors to maintain compliance with Bank systems and controls.
(b)
The Bank shall enhance its Third-Party Program to include a specific evaluation of the adequacy of compliance training provided to employees of Third-Party Product Contributors on applicable Consumer Protection Laws, and the Bank will ensure that any deficiencies in training are remediated in a manner consistent with the Bank's compliance training program.
(c)
On a quarterly basis, the Third-Party Relationship Risk Committee shall report to the Board: (i) any new or substantive changes in any Third-Party Product Contributor relationships, (ii) notable actions taken under subparagraph (a) above and recommendations made to Bank management regarding the same, and (iii) the status of any ongoing reviews and audits and any corrective actions taken pursuant to subparagraph (a) above. The Board minutes
shall contain evidence of the Board's review and discussion of the foregoing and shall include an evaluation of the overall effectiveness of the Third-Party Program.
THIRD PARTY RELATIONSHIPS
5.
(a)
In the event that the Bank shall desire to introduce any Third-Party Product, or enter into any new Third-Party Product relationship, or enter into any new agreement which materially changes any existing Third-Party Product or Third-Party Product relationship, the Bank shall provide 20 days' advance notice thereof to the Regional Director or the Regional Director's designee prior thereto, except no such notice shall be required by this ORDER to the extent specified in writing by the Regional Director.
(b)
The Bank shall submit the following to the Regional Director or the Regional
Director's designee with any such notice of any Third-Party Product relationship or agreement:
(i) a full and complete description of the Third-Party Product relationship or agreement into which the Bank is entering and any due diligence that was performed in relation thereto;
(ii)
a full and complete description of any Third-Party Product Contributors and of any functions or services they are to provide in connection with any proposed Third-Party Product; and
(iii)
the projected increase or decrease in the volume of the Bank's business related to the Third-Party Product.
(c)
In the event the Bank terminates any relationship with a Third-Party Product Contributor, the Bank shall provide notice of such termination to the Regional Director or the Regional Director's designee within 10 days after the termination.
COMPLAINT AND ERROR CLAIM OVERSIGHT AND REVIEW COMMITTEE
6.
(a)
Within 60 days from the Effective Date of this ORDER, the Board shall establish a Complaint and Error Claim Oversight and Review Committee ("Complaint and Error Claim Committee") composed of three directors, including at least one director who is not an officer of the Bank or any affiliate of the Bank, and the compliance officer. The Complaint and Error Claim Committee shall meet at least monthly and, at a minimum, the following areas shall be reviewed and, if applicable, approved:
(i)
minutes of the previous Complaint and Error Claim Committee;
(ii)
i
n regard to oral and written complaints:
A.
the process for handling, monitoring and resolving all complaints received directly by the Bank or through its Third-Party Product Contributors;
B.
complaint trend analyses regarding complaints received directly by the Bank or through its Third Party Product Contributors;
C.
management's identification of weaknesses within the Bank or its Third-Party Product Contributors associated with complaint trends that impact the Bank's operations, policies, procedures, consumer accounts, products or services, or compliance with applicable Consumer Protection Laws;
D.
management's planned corrective action steps (pending, implemented, and timing therefor) related to any identified complaint trends; and
E.
any follow-through testing and reporting to ensure corrective actions are completed timely and effective.
(iii)
i
n regard to claims of "errors" related to electronic fund transfers or inquiries related to such transfers, as that term is defined in 12 C.F.R.
§
1005.11(a):
A.
the process for handling, monitoring and resolving all error claims
received directly by the Bank or through its Third-Party Product Contributors;
B.
a review of the Bank's and Third-Party Product Contributors' error claims practices and the identification of any weaknesses that impact the Bank's compliance operations, policies, procedures, consumer accounts,
products or services offered through third parties, or compliance with any Consumer Protection Laws;
C.
error claim trend analyses;
D.
management's planned corrective action steps related to identified weaknesses within the Bank's and any Third-Party Product Contributors' error claims practices including due dates, names of individuals assigned responsibility for the corrective action; and
E.
any follow-through testing and reporting to ensure corrective actions are completed timely and effective.
(b)
The Bank shall take steps necessary to cause each Third-Party Product Contributor that performs customer service functions on behalf of the Bank to provide the Bank with written monthly reports, in a generally standardized format to be determined by the Bank, for any Third-Party Products. These reports shall include, to the extent the applicable customer service function is performed by the Third-Party Product Contributor, the following data:
(i)
volume of error claims received with a breakdown by status;
(ii)
volume and nature of oral and written complaints received from consumers with a breakdown by status;
(iii)
volume of inquiries received from consumers and the nature of the inquiry, to the extent such data is capable of being captured;
(iv)
volume and nature of inquiries or legal actions received from regulatory agencies;
(v)
volume and nature of legal actions commenced by any customer or potential customer.
To the extent any Third-Party Product Contributor is unable to produce the data referenced in this Subsection (b), the Bank shall report the same to the Complaint and Error Claim Committee and the Bank shall thereafter collaborate with such Third Party Product Contributor to establish a written action plan in order to allow for the reporting of the referenced data, to the extent possible, within a reasonable period of time, subject to approval and ongoing monitoring by the Complaint and Error Claim Committee.
(c)
The Complaint and Error Claims Committee shall report the minutes of its meetings and provide any relevant attachments to the Board at each regularly scheduled Board meeting, including:
(i)
its review and identification of complaint trends; its analysis of root causes of complaints; and its recommendations for, and progress on, corrective actions to reduce complaints; and
(ii)
its review and analysis of a compilation of the written monthly reports received for each Third-Party Product as outlined in Section 6(b) of this ORDER; its review and identification of weaknesses within the error claim practices of the Bank or any Third-Party Product Contributor; and its recommendations for, and progress towards, corrective action to address identified weaknesses within the error resolution practices.
(d)
The Board minutes shall document the review and approval of all Complaint and
Error Claims Committee items before the Board, including the names of any dissenting directors.
(e)
The Board, in conjunction with the Complaint and Error Claims Committee shall allocate resources that are commensurate with the recommended corrective actions approved and any follow-through testing and reporting that are sufficient to ensure that corrective actions are completed and effective to ensure the Bank's compliance with all Consumer Protection Laws.
(f)
Copies of the Complaint and Error Claims Committee minutes, including any applicable attachments shall be submitted to the Regional Director as part of the progress reports required by this ORDER.
CORRECTION OF VIOLATIONS OF LAW
7.
Within sixty (60) days from the effective date of this ORDER, the Bank shall eliminate or correct violations of Consumer Protection Laws cited in the FDIC's most recent Compliance Report of Examination. The Bank shall take all necessary steps to maintain ongoing compliance with such Consumer Protection Laws, including promptly implementing practices, and causing its Third-Party Product Contributors to implement practices, to properly execute the intake, investigation and resolution of error claims and comply with all error resolution and provisional credit provisions set forth in applicable cardholder agreements ("CHAs") for all prepaid cardholders and, for cardholders receiving federal benefits on their cards through the ACH system, affording the appropriate protections set forth in the applicable CHAs, in the rule issued by the Treasury Department that governs the use of the ACH system to deliver federal payments to prepaid cards, 31 C.F.R, § 210 (the "Treasury Rule"), and in Regulation E, 12 C.F.R. § 1005 ("Regulation E").
NO MISREPRESENTATIONS/OMISSIONS
8.
Within sixty (60) days from the effective date of this ORDER, the Bank shall take all action necessary to comply with the guidance set forth in
Unfair or Deceptive Acts or Practices by State-Chartered Banks
(FIL-26-2004, issued March 11, 2004). Without limiting the
foregoing, in any advertising, marketing, offering, soliciting, billing, or servicing of any Products and Services, including any Third-Party Product, the Bank shall not make, or allow to be made, any misleading or deceptive representation, statement, or omission, expressly or by implication.
RESTITUTION AND CORRECTIVE ACTION PLAN
9.
(a)
Within 30 days of the effective date of this ORDER, the Bank shall commence the Bank's Corrective Action Plan, which the Board adopted by resolution on December 16,
2015 and which addresses remedial measures to be taken by the Bank with regard to the certain prepaid cardholders who asserted or attempted to assert error claims. The Corrective Action Plan includes steps to:
(i)
identify prepaid card programs for review, identify the scope and nature of review of such programs and develop a schedule for review of the programs;
(ii)
review the error resolution practices of certain prepaid card programs for compliance with the requirements of applicable laws, regulations and CHAs;
(iii)
provide restitution to cardholders harmed by certain error resolution practices;
(iv)
correct certain error resolution practices identified by the review and determined by the Bank to violate the requirements of applicable laws, regulations or CHAs; and
(v) maintain certain records relevant to the review for a specified period of time.
(b)
The Board shall ensure that the Bank adheres to the Corrective Action Plan.
(c)
The Board shall hire an independent auditor who is acceptable to the Regional Director, who shall verify that the Bank is providing restitution to affected prepaid cardholders with respect to whom restitution payments are to be made in accordance with this ORDER and the Corrective Action Plan. The independent auditor shall prepare written reports verifying whether the Bank is adhering to the processes and procedures for determining and making restitution as set forth in the Corrective Action Plan. Such reports shall be submitted to the Regional Director for review, comment, and/or non-objection within 180 days from the effective
date of this ORDER, and then every 60 days thereafter until completion of the restitution required by this ORDER.
ORDER TO PAY CIVIL MONEY PENALTY
10.
IT IS FURTHER ORDERED THAT, by reason of the alleged violations of law and/or regulations, and after taking into account the CONSENT AGREEMENT, the appropriateness of the penalty with respect to the financial resources and good faith of the Bank, the gravity of the conduct by the Bank, the history of previous conduct by the Bank, and such other matters as justice may require, pursuant to section 8 (i)(2) of the FDI Act, 12 U.S.C. § 1818(i)(2), a civil money penalty of $3 million is assessed against the Bank. The Bank shall pay the civil money penalty to the Treasury of the United States. The Bank shall pay such civil money penalty itself, and is prohibited from seeking or accepting indemnification for such payment from any third- party.
PROGRESS REPORTS
11.
Within thirty (30) days from the end of each calendar quarter following the effective date of this ORDER, the Bank shall furnish to the Regional Director written progress reports detailing the form, manner, and results of any actions taken to secure compliance with this ORDER. All progress reports and other written responses to this ORDER shall be reviewed by the Board and such review shall be documented in the Board minutes.
SHAREHOLDERS
12. Within thirty (30) days from the effective date of this ORDER, the Bank shall send a copy of this ORDER, or otherwise furnish a description of this ORDER, to its parent holding company. The description shall fully describe the ORDER in all material respects.
BOARD COMMITTEE TO MONITOR ORDER
13.
(a)
The Board shall maintain an oversight committee ("Oversight Committee") charged with the responsibility of ensuring compliance with the provisions of this ORDER. A majority of the Oversight Committee shall be comprised of members who are not now, and have never been, involved in the daily operations of the Bank and who shall be acceptable to the Regional Director.
(b)
The Oversight Committee shall monitor compliance with this ORDER and submit a written report quarterly to the entire Board, and a copy of the report and any discussion related to the report or this ORDER shall be part of the minutes of the Board meeting. Copies of the quarterly report shall be submitted to the Regional Director as part of the progress reports required by this ORDER. Nothing contained herein shall diminish the responsibility of the entire Board to ensure compliance with the provisions of this ORDER.
SAVINGS CLAUSE
14.
(a)
This ORDER shall not bar, estop or otherwise prevent the FDIC or any other federal or state agency or department from taking any action against the Bank, or any of its directors, officers, employees, and agents, or any of the Bank's affiliates, their successors or assigns, or any of their respective directors, officers, employees, and agents, or any of the Bank's current or former institution-affiliated parties, or any of their respective directors, officers, employees, and agents.
(b)
The FDIC expressly reserves all rights against each Third-Party Product Contributor. Nothing in the CONSENT AGREEMENT or this ORDER shall require the FDIC or any other party to reduce, compromise, or otherwise limit any claims against any Third-Party Product Contributor.
(c)
Nothing in the CONSENT AGREEMENT or this ORDER shall require the FDIC or any other party to reduce, compromise, or otherwise limit any claims because of any contractual or other commitments of the Bank to indemnify, defend, or hold harmless any Third- Party Product Contributor.
15.
Nothing herein shall prevent the FDIC from conducting on-site reviews and/or examinations of the Bank, its affiliates, agents, service providers, and any other institution- affiliated parties of the Bank at any time to monitor compliance with this ORDER.
16.
This ORDER shall be effective on the date of issuance.
17.
The provisions of this ORDER shall be binding on the Bank, its institution-affiliated parties, and any of successors or assigns thereof.
18.
Each provision of the ORDER shall continue in full force and effect until such time as it shall have been modified, suspended or terminated in writing by the FDIC.
Issued pursuant to delegated authority.
Dated at Washington, D.C., this
23
rd
day of
December
, 2015.
|
|
/s/
|
|
|
Sylvia H. Plunkett
|
|
|
Senior Deputy Director
|
|
|
Division of Depositor and Consumer Protection
|