Portfolio Media. Inc. | 860 Broadway, 6th Floor | New York, NY 10003 | www.law360.com
Phone: +1 646 783 7100 | Fax: +1 646 783 7161 | [email protected]
DOL Whistleblower Rule Will Have Far-Reaching Effects
Law360, New York (May 05, 2014, 12:05 PM ET) -- On April 4, 2014,
the U.S. Department of Labor issued an interim final rule establishing
procedures concerning the manner in which the U.S. Occupational
Safety and Health Administration will address employee
whistleblower complaints under the Consumer Financial Protection
Act.[1] Although the interim final rule is effective immediately, the
DOL will accept comments on the rule until June 2, 2014.
The DOL based the OSHA CFPA whistleblower rule on existing OSHA
procedures. The DOL’s commentary to the rule relies frequently on
guidance from other whistleblower provisions that OSHA
administers, such as the whistleblower protections in the SarbanesOxley Act.[2] Familiarity with the complaint procedures, however, is
unlikely to provide comfort to the banks, nonbanks and service
providers that have had to deal with Consumer Financial Protection Bureau supervisory examinations
and investigations for more than two years now. Rather, the rule adds another regulatory layer that will
continue to keep compliance officers and attorneys busy with the rule’s wide scope of covered
employees and protected activities.
Since the CFPB became fully operational in 2012, its power to enforce the CFPA is extremely broad. The
CFPB has exercised jurisdiction over any person or entity that: (1) may have violated a law that the
bureau enforces or (2) may provide evidence of a violation of a law that the bureau enforces. It will be
interesting to see whether OSHA interprets and enforces the rule with the same vigor that the CFPB has
been interpreting and enforcing the federal laws that it enforces.
What Employees are Covered by the Interim Final Rule?
The interim final rule applies to all “covered employees.”[3] The term “covered employees” is broadly
defined to include “any individual performing tasks related to the offering or provision of a consumer
financial product or service.”[4] Further expanding the rule’s coverage, a “covered employee” includes
current, former and prospective employees.[5] Finally, a “covered employee” also includes any person
“whose employment could be affected by a covered person [under the CFPA] or service provider where
such an individual was performing tasks related to the offering or provision of a consumer financial
product or service at the time the individual engaged in protected activity under the CFPA.”[6] Thus,
unlike SOX's whistleblower provisions, the CFPA’s whistleblower rule applies to both public and private
companies that fall within the CFPA’s definition of “covered person” or “service provider.”[7]
The broad scope of the term “covered employee” is not surprising given that the CFPA provides the
CFPB with the broad authority to investigate, and initiate enforcement actions against, people and
companies that allegedly violate one of the 18 federal consumer financial protection laws that the CFPB
enforces.[8] The scope of the term “covered employees” also likely includes employees of businesses
that are, in most cases, statutorily exempt from the CFPB’s jurisdiction, such as employees of
attorneys.[9] It appears that, like the CFPB, OSHA will be allowed to exercise jurisdiction over these
employees if these employees are whistleblowers with respect to any of the laws that the CFPB
enforces.
The potential inclusion of otherwise exempt categories of employees is not unexpected because the
CFPB has filed enforcement actions against persons and entities — like attorneys and insurers — arising
out of alleged violations of one of the laws that the CFPB enforces.[10]
The term “covered employee” is far-reaching in other ways. For example, the CFPB has been
investigating and executing consent orders with banks arising out of alleged Equal Credit Opportunity
Act violations with respect to indirect auto lending.[11] The CFPB, however, has yet to execute a consent
order or file a public enforcement action against an auto dealer for allegedly engaging in supposed ECOA
violations. Although the CFPB’s indirect auto lending enforcement actions have focused on the lender’s
alleged wrongdoing,[12] it is likely that a covered employee under the DOL’s CFPA-related whistleblower
rule would include an employee of an auto dealer who claims to have suffered adverse employment
action after raising issues to an employer that may concern equal credit opportunities for buyers.
The examples of the potentially far-reaching scope of the rule do not stop there. An employee of a
service provider that solicits customers to purchase credit card add-on products on behalf of a large
bank would also likely fall within the definition of a covered employee if he or she incurs adverse
employment action for reporting the violation of a law that the CFPB enforces. However, the CFPB has
so far executed consent orders only with the banks issuing the credit cards, not with the service
providers soliciting the add-on products.[13]
What Acts Fall Within the Scope of Protected Whistleblower Activity?
A “covered employee” may file a complaint with OSHA if the employee believes that an employer
retaliated against the employee for any of the following reasons:
Reporting violations of any law that the CFPB enforces to his or her employer or to a
government agency;
Reporting what the employee “reasonably believes” to be a violation of a law that the CFPB
enforces to his or her employer or to a government agency;
Participating in an investigation of potential violations of a law that the CFPB enforces; or
Refusing to participate in acts that the employee believes to be violations of a law that the CFPB
enforces.[14]
The CFPA’s list of protected whistlebower activities has the potential to be incredibly broad. “Covered
employees” are protected for reporting alleged violations not only of the 18 federal consumer
protection laws that were transferred, in whole or in part, to the CFPB,[15] but also for “violation[s] of
any law ... subject to the jurisdiction of, or enforceable by, the [CFPB].”[16] This would therefore include
the CFPB’s wide-ranging catchall authority to regulate “unfair, deceptive, or abusive acts or practices”
("UDAAP") related to the provision of consumer financial products or services.[17]
Because a UDAAP violation can potentially include virtually any act or omission that does not pass the
CFPB’s smell test, the scope of protected activities is potentially broad. The CFPB’s UDAAP-related
enforcement actions and public statements concerning the broad scope of UDAAP provide a roadmap
that OSHA may follow.[18]
When Must an Employee File a Whistleblower Complaint and What Happens After the Filing?
A covered employee must file a complaint with OSHA within 180 days of the adverse action giving rise to
the complaint.[19] The CFPB investigates potential violations of the 18 consumer protection laws that it
enforces despite whether the limitations period for the underlying alleged violation has expired.[20]
Therefore, employers should not be shocked if OSHA deems a whistleblower complaint to be timely if it
is filed within this 180-day period, even if a CFPB enforcement action for the alleged underlying CFPA
violation is time barred.
Once a covered employee files a timely complaint, the interim final rule establishes a low threshold for
OSHA to proceed with a CFPA whistleblower investigation; the employee need only make a “prima facie
showing” that he or she was retaliated against in violation of the CFPA.[21] The interim final rule,
however, presents employers with two opportunities to dismiss a CFPA whistleblower complaint early in
the complaint process. OSHA must dismiss a CFPA whistleblower complaint if: (1) the employee fails to
make the required prima facie showing; or (2) the employer “rebuts that showing by clear and
convincing evidence that it would have taken the same adverse action absent the protected
[whistleblowing] activity.”[22]
If OSHA does not dismiss the whistleblower complaint after the initial stage, OSHA must “determine
whether there is reasonable cause to believe that protected activity was a contributing factor in the
alleged adverse action.”[23] Providing some degree of predictability, in its commentary to the interim
final rule, the DOL indicated that OSHA will interpret the term “contributing factor” the same way that it
interprets the term in the other whistleblower protection statutes that OSHA administers. Thus, a
contributing factor is “‘any factor which, alone or in connection with other factors, tends to affect in any
way the outcome of the decision.’”[24] Even if OSHA determines that there is “reasonable cause” that
“the alleged protected activity was a contributing factor in the adverse action, OSHA may not order
relief if the employer demonstrates by ‘clear and convincing evidence’ that it would have taken the
same action in the absence of the protected activity.”[25]
Following its investigation, OSHA must issue findings on whether “there is reasonable cause to believe
that the complaint has merit” within 60 days of the filing of the whistleblower complaint.[26] OSHA
must also order appropriate relief, if any, within this 60-day period.[27] The relief may include
preliminary reinstatement, or salary and benefits without returning to work “in appropriate
circumstances,” “affirmative action to abate the violation, back pay with interest and compensatory
damages.”[28] Other than the foregoing relief, as well as attorneys’ fees and other costs, the interim
final rule does not provide for any other monetary relief for an employee, such as a cash reward
independent of salary and benefits. This stands in contrast to SOX's whistleblower rules, under which a
whistleblower may receive a bounty for his or her tip.
OSHA’s findings will be final unless either party files objections. If a party objects, there will be a hearing
before an administrative law judge, after which either party may seek appellate relief. Either party may
appeal the administrative law judge's decision to the DOL’s Administrative Review Board and, after that,
to the appropriate federal court of appeals.[29] However, this is not the only avenue for judicial review.
Placing an emphasis on quickly resolving whistleblower disputes, the CFPA provides that if “there has
been no final decision ... within 210 days after the date of the filing of the complaint, or within 90 days
after the receipt of a written determination” following OSHA’s investigation, the employee may file a de
novo action in a federal district court.[30] Employers must keep in mind that the dismissal of a
whistleblower complaint does not necessarily mean that the regulators will disappear. The CFPB will
investigate whether the claim underlying the adverse action against the employee has merit.
Despite the rule’s coexistence with OSHA’s established procedural rules, the broad definition of the
term “covered employees” and the scope of the rule’s protected activities create uncertainty that will
have a significant impact on all persons and entities that engage in acts that may violate any law that the
CFPB enforces.
—By Keith J. Barnett and Charles M. Kruly, Sutherland Asbill & Brennan LLP
Keith Barnett is a partner in Sutherland Asbill & Brennan's Atlanta office.
Charles Kruly was previously an associate in Sutherland Asbill & Brennan’s Washington, D.C., office.
The opinions expressed are those of the author(s) and do not necessarily reflect the views of the firm, its
clients, or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general
information purposes and is not intended to be and should not be taken as legal advice.
[1] Procedures for Handling Retaliation Complaints Under the Employee Protection Provision of the
Consumer Financial Protection Act of 2010, 79 Fed. Reg. 18,630 (April 3, 2014) (to be codified at 29
C.F.R. pt. 1985).
[2] See, e.g., id. at 18,633.
[3] Id.
[4] 12 U.S.C. § 5567(b) (emphasis added).
[5] 79 Fed. Reg. at 18,633.
[6] Id.
[7] Id.
[8] See Consumer Financial Protection Act of 2010, § 1002(12) (listing the consumer protection laws
within the CFPB’s jurisdiction); id. §§ 1051-58 (granting the CFPB enforcement authority).
[9] Id. § 1027(e) (providing that, generally, the CFPB may not “exercise any supervisory or enforcement
authority with respect to an activity engaged in by an attorney as part of the practice of law”); id. §
1027(i) (providing that “[t]he CFPB shall have no authority to exercise any power to enforce [the CFPA]
with respect to a person regulated by the [SEC]” but requiring the CFPB and the SEC to “consult and
coordinate” regarding SEC rules that might affect products or services regulated by the CFPB).
[10] See, e.g., CFPB v. Chance Edward Gordon, 12-CV-06147, Complaint (C.D. Cal., July 18, 2012),
available at http://files.consumerfinance.gov/f/201207_cfpb_enforcement-complaint-filed_gordonlaw.pdf (CFPB enforcement action against an attorney and entities controlled by the attorney for
“engag[ing] in an ongoing, unlawful mortgage relief scheme that prey[ed] on financially distressed
homeowners nationwide by falsely promising a loan
modification in exchange for an advance fee”).
[11] See, e.g., In re Ally Financial, Inc., Consent Order, 2013-CFPB-0010 (CFPB Dec. 20, 2013), available at
http://files.consumerfinance.gov/f/201312_cfpb_consent-order_ally.pdf.
[12] See CFPB Bulletin 2013-02, Indirect Auto Lending and Compliance with the Equal Credit Opportunity
Act, Mar. 21, 2013, available at http://files.consumerfinance.gov/f/201303_cfpb_march_-Auto-FinanceBulletin.pdf.
[13] See In re Bank of America, N.A. and FIA Card Services, N.A., Consent Order, 2014-CFPB-0004 (CFPB
Apr. 9, 2014), available at http://files.consumerfinance.gov/f/201404_cfpb_bankofamerica_consentorder.pdf.
[14] Id.
[15] See Consumer Financial Protection Act of 2010, § 1002(12) (listing the consumer protection laws
within the CFPB’s jurisdiction).
[16] 79 Fed. Reg. at 18,633.
[17] Consumer Financial Protection Act of 2010, § 1031(b) (authorizing the CFPB to prohibit “unfair,
deceptive, or abusive acts or practices”).
[18] See, e.g., CFPB v. Am. Debt Settlement Solutions, Inc., No. 9:13-cv-80548-DMM, Stipulated Final
Judgment and Order (S.D. Fla. June 7, 2013), available at
http://files.consumerfinance.gov/f/201306_cfpb_finalorder_adss_signed-judgment.pdf (stipulated
order finding that debt relief services were “abusive”); CFPB Bulletin 2013-07, Prohibition of Unfair,
Deceptive, or Abusive Acts or Practices in the Collection of Consumer Debts, July 10, 2013, available at
http://files.consumerfinance.gov/f/201307_cfpb_bulletin_unfair-deceptive-abusive-practices.pdf.
[19] 79 Fed. Reg. at 18,633.
[20] See In re PHH Corp., Decision and Order on Petition to Modify or Set Aside Civil Investigative
Demand, 2012-MISC-PHH Corp-0001 at 7 (Sept. 20, 2012), available at
http://files.consumerfinance.gov/f/201209_cfpb_setaside_phhcorp_0001.pdf (requiring a firm to
produce documents and information “outside the applicable limitations period” because “the issue . . . is
not whether all such information is itself actionable; rather the issue is whether such information is
relevant to conduct for which liability can be lawfully imposed”).
[21] Id. at 18,633-634.
[22] Id. at 18,634.
[23] Id. (emphasis added).
[24] Id. (quoting Marano v. Dep’t of Justice, 2 F.3d 1137, 1140 (Fed. Cir. 1993).
[25] Id. (quoting 12 U.S.C. § 5567(c)(3)(C)) (emphasis added).
[26] Id.
[27] Id.
[28] Id. at 18,636-37.
[29] Id. at 18,636-637.
[30] 12 U.S.C. § 5567(c)(4)(D).
All Content © 2003-2014, Portfolio Media, Inc.