CFPB Sues Large Non-Depository Mortgage Company for Filing Inaccurate HMDA Data and Violating Prior 2019 Consent Order Regarding HMDA Violations

Today, October 10, 2023, the CFPB filed a complaint against a large non-depository mortgage company alleging “widespread and significant errors” in the company’s 2020 HMDA data.  This comes after a 2019 consent order issued by the CFPB against the company specifically prohibiting future violations of HMDA, and a 2023 consent order based on alleged RESPA section 8 violations (which we wrote about here).  In this new lawsuit against the company, the CFPB alleges violations of HMDA and the 2019 consent order, and seeks civil money penalties and other relief. 

The CFPB alleged that the company’s HMDA data errors included the following:

1.     improper classification of certain loan applications as “approved but not accepted” that were actually withdrawn, causing errors in other related fields;

2.     errors in entering data related to subordinate lien loans and purchased loans;

3.     loans reported in HMDA that did not meet the HMDA definition of reportable application;

4.     inaccurate purchaser type for tens of thousands of loans;

5.     inaccurate calculations of rate spread, causing errors in other related fields; and

6.     inaccurate data reported for lender credits.

The CFPB stated that, in 2020, the company originated more than 389,000 loans worth almost $100 billion, making it the third-largest originator in the country, and also reported an additional 389,000 applications and purchased loans that year.  The CFPB alleged that a revised submission of 2020 data submitted by the company included changes to almost 20% of all of its covered loans, and changes to over 174,000 data entries in dozens of data fields.  The CFPB alleged that these errors were caused by “systemic issues and compliance management systems failures, not isolated one-off mistakes,” which included:

1.     inconsistent or incomplete data entry policies and procedures;

2.     failure to update information in the company’s internal systems; and

3.     systems-wide data mapping issues.

The CFPB alleged that the company’s own internal audit team, covering Sept. 2020 to Aug. 2021, found that the company’s HMDA-related processes had serious deficiencies and needed improvement.  The CFPB also alleged that the company “did not have or use an effective system for sampling and validating loan files against the data reported to ensure that that [sic] the 2020 HMDA data submission was accurate,” and that the errors were not “bona fide errors” (which would not have been considered violations under the CFPB’s rules). 

The subject of the CFPB’s previous 2019 consent order against the company was also HMDA data inaccuracies in the company’s 2014-2017 data.  Those alleged errors involved the intentional misreporting of race, ethnicity, and sex data.  That consent order required the company to pay a $1.75 million civil money penalty.  In addition, this August 2023, the CFPB issued a consent order against the company alleging RESPA section 8 violations and imposing a $1.75 million civil money penalty, which we wrote about here.  

This lawsuit, the third enforcement action by the CFPB against the company, shows that the CFPB takes the accuracy of HMDA data seriously and also is looking for “repeat offenders.”  Director Chopra stated in the CFPB’s press release for this lawsuit that the CFPB “will continue to focus on ending the cycle of misconduct by repeat offenders in the financial industry.”  Although this particular lawsuit does not appear to involve race, ethnicity, or sex information, the CFPB sees HMDA enforcement as part of its fair lending mission, which is a stated priority for the agency.  It is important for lenders to ensure they have proper policies and procedures to ensure accurate reporting of HMDA data.  It also remains to be seen whether the company will challenge the CFPB’s lawsuit or eventually settle with the CFPB. 

The CFPB’s press release is available here.

Please contact rich@garrishorn.com to discuss the issues in this blog post.

Previous
Previous

FTC Amends Safeguard Rule to Require Nonbank Financial Institutions to Report Data Breaches

Next
Next

CFPB Just Got Checked - Using UDAAP to Regulate Discrimination Is Out of Bounds – At Least for Some