Jonathan Foxx
President & Managing Director
Generating
leads is an important way to reach consumers. It is also fraught with
regulatory risk. A lead is consumer information that signals consumer interest
or inquiry into products or services offered by a business, such as residential
mortgage lenders and originators. There are several factors to be considered,
not just licensing. I will list some rudimentary guidelines in this article,
specifically with respect to contact with the consumer. Caution is urged to
consult with a risk management professional to ensure compliance with federal
and state guidelines required by a marketing campaign to generate leads.
Although my focus is primarily on the online lead generation process, virtually
all the guidelines provided herein may be extrapolated for use in offline lead
generation campaigns.
My
firm often is requested by clients to vet a lead generator, which I will call a
Lead Generation Company. Careful risk management advice should be considered
when developing and managing leads, whether obtained from an outsourced entity
or a loan originator’s own website, in-house, or through online lead generation
advertisements. Certainly, any loan originator that uses leads must have an internal
compliance function that accounts for proper licensing of the Lead Generation
Company (where required), monitoring of the data integrity derived therefrom,
testing conformance with the originator’s policies, and training of staff in
the appropriate use of lead generated, consumer data.
Banking
departments these days are not just looking at licensing qua licensing. They are looking for loan originator compensation violations
that are triggered by lead generation. For instance, they know that loans may
have different cost structures depending on how the loans were initially
received by the lender. A lead generated by the loan originator may be
compensated differently than those generated by the creditor. As long as this
doesn’t constitute a proxy for a loan term or condition, it is generally acceptable;
that is, the loan officer may also be reimbursed for lead generation and other
legitimate business costs, but the creditor must beware of how this may serve
as a proxy for terms and conditions. It is up to the lender to make this
determination (and properly document it).
Four
Rules
In
any lead generating marketing, the following four rules should be implemented:
1. Complete,
accessible, and straightforward disclosure of all parties’ intent regarding
data collection and usage is essential;
2.
Data
should not be brokered or sold without consent (or notice and choice) of all
parties involved, including the consumer and the loan originator;
3.
Both
the consumer, Lead Generation Company, and the loan originator should be made
aware, through clear notices, of all parties involved in data collection and
sharing; and,
4.
All
parties should be educated and aware of current regulations regarding consumer
protection and privacy.
These
four rules become the bases of the policies, procedures, contractual
arrangements, and protocols that ensure a viable marketing campaign that
relies, in whole or in part, on lead generation.
Regulatory
Focus
The
regulators involved in enforcement of compliance with lead generation rules
include, but are not limited to, state banking departments, state Attorneys
General, the Federal Trade Commission (“FTC”),[i]
and the Consumer Financial Protection Bureau (“Bureau”). We already know that
the Bureau examines for whether the lead generator is a third-party provider
and reviews the terms and appropriateness of the relationship. The Bureau
reviews advertisements and advertising sources. It will review TV, radio, print
media, Internet, scripts, recordings, and so forth. It will determine if there
was proper consumer disclosure all along the way, from point of contact with
the consumer to point of contact with the lender, including any intimation of
fees and other terms and conditions. Plus, a review is conducted for online
data security and sharing of consumer information.
Although
the new loan originator qualification standards do not impose licensing
requirements, every lender must ensure that each loan originator in its employ
is licensed and registered in compliance with laws related to Secure and Fair
Enforcement for Mortgage Licensing Act (SAFE), if applicable. Further, entities
engaged in lead generation and marketing activities, as well as the companies
that do business with such entities, need to pay particular attention to their
activities to ensure that they do not inadvertently engage in loan originator
activity. If they do, they’ll need to make sure that they meet the new loan
originator qualification standards, including licensing requirements. Failure
to meet these standards will give rise to severe civil liability that could
impair the collectability of the loan.
The
Bureau has stated that anytime a consumer gives out sensitive personal and
financial information on the Internet there are risks involved to the consumer.
In the context of Pay Day Loans, for instance, the Bureau has already warned
consumers that if a consumer applies for a loan online, the consumer could be
increasing risk significantly.
The
Bureau has expressed concern that an online application or form that consumers
fill out could be sold to a loan originator that offers to originate a loan on
behalf of the consumer. Indeed, the Bureau also has indicated it has concerns
that multiple lenders or other settlement service providers could pay for this
information, thereby causing them to contact or email the consumer.
Consumer
Advocacy
In
a November 11, 2013 announcement to consumers, the Bureau stated, “Lead
generators might not find you the lowest cost loans, and you should be cautious
of sites that promise they will. Many consumers can also be confused about who
actually made the loan, which makes getting help when you need it harder.”[ii]
In addition, the Bureau has provided caution regarding key words, tags, and
tactics.
Importantly,
the Bureau’s view toward the Pay Day lead generator should be applied to residential
mortgage lenders and originators that purchase leads from a Lead Generation
company. Here’s the point: the Bureau has clearly issued an answer to the
question, "What is the difference between an online payday lender and one
with a storefront?" Its answer was that consumers need to make sure the
online website is licensed to do business in the consumer's state and whether
the lead generator follows the state's [payday] lending laws. Consider it a
warning to all residential loan originators!
Therefore,
when the Bureau starts looking at online lead generation involving residential
mortgage loans, it is somewhat certain that it applies an even stricter
standard to the Lead Generation Company that solicits mortgage information or a
mortgage conversation from consumers and sells it or even passes it on to a loan
originator. Questions that the Bureau would resolve, either by promulgating
rules or through enforcement action, will likely be: (1) Is the Lead Generation
Company violating the SAFE Act if it is not licensed in the state it is
operating in?, and (2) If it is licensed under SAFE will it be violating the
broadly defined Loan Officer Compensation Rule?
Lead
Generation as Advertising
Depending
on the advertising used to find a consumer for a loan originator, the Bureau
may deem the communication to be an advertisement to generate a lead by using
certain phrases, such as “Let us help you find a mortgage! Call us! Or Click Here
for More Information!” If deemed an advertisement, the Bureau will move to the
view that such advertising is a solicitation for a mortgage conversation from a
consumer. The outcome of that position would likely lead to a violation of
SAFE, because most states consider such a solicitation a violation of SAFE even
if no payment is made by the lender or loan officer to the Lead Generation Company
- because this type of solicitation would trigger a license requirement.
Even
if the Lead Generation Company is properly licensed under a particular state's
SAFE Act, if it sells that lead to an unlicensed loan originator in that state
the Bureau could pursue an action against the Lead Generation Company because it
assisted or facilitated a consumer’s information to be sold to an unlicensed
entity, pursuant to various third party vendor management bulletins.
Some
states already require a Lead Generation Company collecting consumer information
to be licensed as "mortgage brokers" such as Arizona and Virginia. The
licensing requirement varies from state to state. Referencing Pay Day lenders,
most of the Pay Day lenders in Ohio, for example, have become Mortgage Brokers
under the SAFE Act as it takes them out of the state usury statute for Pay Day
lenders.
Three Concerns
What
type of online Lead Generation Company could cause issues of concern?
(1)
Unlicensed Lead Generation Company that tells consumers, for instance, whether
they are "Qualified for a Loan or Not";
(2)
Online Lead Generation Company that collects any sort of non-public personal
information data (the definition of what is “NPI” may vary from state to state,
but is also federally settled in Gramm-Leach-Bliley, et alia) and fails to inform and obtain the consumers consent that
their information will be shared with a third party; and,
(3)
Online Lead Generation Company where it has spoken directly with the consumer
and then transfers the "Live Handoff" over to the loan originator
(especially if the Lead Generation Company is not licensed, where required by
state law). If the Lead Generation company acts as a special kind of mortgage
broker then it may be best to stay away because this could violate the standards
associated with the Loan Officer Qualifying Rule, mentioned above, which became
effective on January 1, 2014.
Additionally,
please note that the Bureau has broad authority to enforce Fair Lending Laws, the
Telemarketing Sales Rule, Mortgage Lending and Regulations, Mortgage Acts and
Practices Advertising Rule, and most certainly Unfair, Deceptive and Abusive
Acts or Practices (UDAAP).[iii]
Scope
of Lead Generation Review
The
scope of review involved in managing the relationship with a Lead Generation
Company or administering an in-house lead generating campaign is complex. A
loan originator should retain competent risk management to ensure that the
entire campaign is fully vetted and is based on statutory and case review, as
well as clear and unambiguous regulatory compliance mandates.
I
suggest that you consider adopting the following guidelines for lead generation
marketing.[iv]
The list is not exhaustive, because each loan originator often has different
ways to generate leads, and the overall review should reflect a loan
originating company’s size, risk profile, and complexity.
Privacy
Policy Disclosures
- A
privacy policy is essential to properly obtain permission and communicate the
intended use of the data collected from consumers.
o The privacy policy should:
§ Disclose and outline the practice of data collection, usage, and sharing. Data Practices should be easy to find, easy to read and easy for consumers to act upon.
§ The privacy policy should be posted in a clear and conspicuous fashion when accepting the consumer’s information on the Lead Generation Company’s and/or loan originator’s registration page and online lead generation form.
- Consumers should be given adequate notice of any privacy policy change.
- Lead Generation Company and/or a loan originator’s in-house campaign should have notice on their home page(s) that their privacy policy has been updated. Highlight the updates and list the dates of the revisions at the top of their privacy policy. Strongly consider email notification to all consumers covered by the original privacy policy.
- Implement technical and management controls to comply with the privacy policy.
- Conduct a regular, periodic evaluation of their privacy policy to ensure compliance.
Data
Collection Disclosures
- Do not hide fields without consumer disclosure.
- For both simple and custom offer types, if the Lead Generation Company chooses not to show one or more fields, it should either:
o Include clear and conspicuous notice prominently on the offer page or via a prominently displayed link indicating which fields will be collected and shared with the loan originator(s), or
o Include text next to each offer on the page that specifically lists each field that will be collected and shared with the purchaser of the lead.
- The Lead Generation Company should include a clickable link to its privacy policy within each offer.
- The Lead Generation Company should not sell data that the consumer has provided during registration or on an advertised offer form to other companies to use to market itself to the consumer without the consumer’s knowledge or choice.
Data
Licensing & List Management
- The Lead Generation Company should disclose if the data collected will be shared with third parties.
- No sharing of NPI with 3rd party marketers for the purpose of sending email, without the consumer’s consent.
- Loan originators that use third parties to manage their email list should have a formal data licensing agreement.
- Loan originators working with list management partners should also create a review process to monitor their partners’ activity.
- Loan originators should appoint a compliance manager who is knowledgeable in Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM) and additional privacy law and standards to oversee the review process.
Consumer
Experience
- The Lead Generation Company should allow consumers to easily skip offers if they do not want to share the data being requested by the loan originator or if they are no longer interested in the offer.
- The Lead Generation Company should ensure that the skip function is clear and conspicuous and is not hidden or difficult to locate on the offer. In addition, the skip function should be displayed in equal prominence to the submit function.
- In a webpage set-up, a Lead Generation Company may pre-select loan originator offers on a multi-listing page to present consumers with offers they believe may best fit their needs. Pre-selected offers are acceptable for custom offers where additional data is collected, but should be considered opt-out. Importantly, offers made based on the Fair Credit Report Act (FCRA) require very careful implementation and only after thorough review by a risk management professional.
- Simple offers - usually not asking for additional information or custom form fields and generally characterized by only a “yes/no” answer or opt-in box - should not be pre-selected. Note: The practice of pre-selecting the “yes” or the opt-in box - which, in effect, automatically signs up the consumer for that offer without the consumer having to take any further affirmative action - is considered to be an opt-out offer and therefore should not be used.
- The Lead Generation Company should use clear language when using pre-selected custom offers; and it should not insinuate that the consumer must select an offer in order to continue through the registration process.
Software
Applications (Internet)
- The Lead Generation Company and/or the loan originator may request that consumers download software applications that can connect through the Internet to their computer or mobile device. Any such download should only be initiated after affirmative consent from the consumer.
- After completion of the download, Internet-connected software applications should:
o Only launch with the consumer’s knowledge; that is, be visible to the consumer and not run invisibly in the background, until such time as a consumer configures options to allow such behavior;
o Clearly indicate the name and contact information of the loan originator and provide a reasonable method to obtain further information about the loan originator; and
o Provide functionality that enables an average consumer to completely uninstall the application from his/her computer or mobile device without any negative impact on the consumer’s device.
Consumer
Data Sharing from Loan Originator
- After submission, the lead data should be transferred from the Lead Generation Company in real-time or batch in a standard, secure format.
Disclosure:
Offer Requirements and Obligations
- Prior to accepting any consumer information, the terms and conditions must be clearly and conspicuously disclosed so that a reasonable consumer may understand the essence of the proposed exchange. The terms and conditions should be compiled, reviewed and updated by a risk management professional who is knowledgeable about, among other things, consumer disclosure mandates.
- Terms and conditions should be accessible and prominent during the registration or offer selection process.
- When using the term “free” or “complimentary” or other similar terms, the loan originator should ensure proper disclosures are made in proximity to the term, if some form of obligation is needed by the consumer to receive the offer. Note: such terms are considered “trigger terms” under the Truth in Lending Act. Seek professional guidance prior to using any incentive language.
- Loan originators should include a summary of consumer obligations and requirements. Note: the summary of obligations and requirements is used to additionally educate consumers and not to replace a detailed terms and conditions link that should be prominently displayed for consumers.
Promotional
Site Disclosures
Promotional
sites offer consumers rewards such as a free gift, a free newsletter, a free
quote, or other reward items when registering. A subset of promotional sites
may include lead generation offers that are incentivized. Incentivized Offers
are offers that are required for the consumer to select in order to qualify for
the reward.
The
Lead Generation Company may run a combination of incentivized and
non-incentivized offers throughout its registration process and website flow.
The offer type - either required or optional - should be clearly and
conspicuously articulated to the consumer on the offer pages. This disclosure
should be at the top of such page before the consumer engages in any loan
originator offers. If multiple pages are used with various offer requirements,
consumers should be able to navigate freely between the “offer pages” to better
understand the scope of the incentive requirements.
Promotional
sites that have incentivized offers should follow all disclosure points
outlined above and take the following additional steps:
- The Lead Generation Company must disclose directly on the registration page exactly what the consumer needs to do in order to receive the reward.
- A summary of key requirements of the consumer should be disclosed on the first registration page.
- If the consumer must sign up for various offers to qualify for the reward, the Lead Generation Company should disclose to the consumer the cost associated with each offer presented.
- If there is some form of monetary obligation needed to qualify for a gift, the Lead Generation Company should, at a minimum, provide the consumer with a representative estimate of such costs.
Planning for the Bureau’s visit
The
Bureau will surely look to the source and use of a loan originator’s leads from
a Lead Generation Company. It will hold the loan originator responsible for
leads obtained from a Lead Generation Company as seamlessly as if the lead was
generated by an in-house lead generation campaign.
Areas
subject to the Bureau’s and/or a federal or state regulator’s examination would
include determining if the relationship with the Lead Generation Company is
properly disclosed; whether a review was implemented for privacy and how the
consumers’ data was shared; that there is identification whether the party is a
third party provider or not; if there was a thorough, documented review of the
lead generation website or advertising portal itself; and whether the consumer
was appropriately notified of all fees, terms, and conditions throughout the
lead generation process.
The
Bureau will investigate a Lead Generation Company involved in generating leads
on behalf of residential mortgage lenders and originators. Any company involved
in the lead generation business, and any loan originator using a Lead
Generation Company, should actively assess the compliance risks associated with
online lead generation.
Indeed,
each state where the Lead Generation Company is licensed (or ought to be
licensed) must be researched for statutory licensing requirements and
compliance therewith.
[i] For instance, see United States of
America, Plaintiff, v. Intermundo Media, LLC, a limited liability company, also
doing business as Delta Prime Refinance, Delta Prime Mortgages, and American
Dream Quotes, Defendant. FTC Matter/File Number: 122 3225, Federal Court:
District of Colorado, September 12, 2014
[ii] Is
applying for a payday loan online safe?, 11/6/2013, http://www.consumerfinance.gov/askcfpb/1577/applying-payday-loan-online-safe.html
[iii] Section 5(a) of the Federal Trade
Commission (FTC) Act prohibits “unfair or deceptive acts or practices in or
affecting commerce”. The FTC standards are broad and apply to any unfair or
deceptive practices affecting consumers or commercial businesses. The
Dodd-Frank Act introduced UDAAP and directed the Consumer Financial Protection
Bureau to issue regulations designed to prevent UDAAP.
[iv] In preparing this section, I found
helpful and relied partly on Online Lead
Generation: B2C and B2B Best Practices for U.S.-based Advertisers and
Publishers, February 7, 2008
