Full text
FEDERAL DEPOSIT INSURANCE CORPORATION
WASHINGTON, D.C.
)
In the Matter of )
) CONSENT ORDER
CROSS RIVER BANK )
TEANECK, NEW JERSEY )
)
)
(INSURED STATE NONMEMBER BANK) ) FDIC-22-0040b
)
)
The Federal Deposit Insurance Corporation (FDIC) is the appropriate Federal banking
agency for Cross River Bank, Teaneck, New Jersey (Bank), under section 3(q) of the Federal
Deposit Insurance Act (Act), 12 U.S.C. § 1813(q).
The FDIC considered the matter and determined, and the Bank neither admits or denies,
that it engaged in the unsafe or unsound banking practices related to its compliance with
applicable fair lending laws and regulations by failing to establish and maintain internal controls,
information systems, and prudent credit underwriting practices in conformance with the Safety
and Soundness Standards contained in Appendix A of 12 C.F.R. Part 364, or the violations of the
Equal Credit Opportunity Act, 15 U.S.C. § 1691, et seq., as implemented by Regulation B, 12
C.F.R. Part 1002, and the Truth-in-Lending Act, 15 U.S.C. § 1601, et seq., as implemented by
Regulation Z, 12 C.F.R. Part 1026, as described in the May 3, 2021 Consumer Compliance
Report of Examination (2021 ROE).
The Bank, by and through its duly elected and acting Board of Directors (Board), has
executed a STIPULATION AND CONSENT TO THE ISSUANCE OF A CONSENT ORDER
(CONSENT AGREEMENT), dated March 8, 2023, that is accepted by the FDIC. With the
Page 1 of 34
CONSENT AGREEMENT, the Bank, without admitting or denying any charges of unsafe or
unsound banking practices or violations of law or regulation, has consented to the issuance of
this CONSENT ORDER (ORDER) under section 8(b) of the Act, 12 U.S.C. § 1818(b), by the
FDIC.
Having determined that the requirements for issuance of an order under section 8(b) of
the Act, 12 U.S.C. § 1818(b), have been satisfied, the FDIC hereby issues the following
ORDER:
CONSENT ORDER
IT IS HEREBY ORDERED that the Bank, its institution-affiliated parties (IAPs), as that
term is defined in section 3(u) of the Act, 12 U.S.C. § 1813(u), and its successors and assigns,
take the following action:
1. Board Requirements
A. Supervision, Direction, and Oversight. The Board must immediately:
1. increase its supervision and direction of management, and its oversight
and monitoring of the Bank’s system of internal controls, information systems, credit
underwriting practices, and internal audit systems related to consumer protection laws and
regulations (referred to by the Bank as the Marketplace Lending Compliance Management
System and in this ORDER as Marketplace Lending CMS);
2. assume responsibility, consistent with the Bank’s risk profile, size,
considering its total assets and volume of credit transactions (for purposes of this ORDER, the
terms “credit” and “credit transaction” have the meanings ascribed to them in Regulation B, 12
C.F.R. § 1002.2(j) and (m), hereinafter Credit and Credit Transaction, respectively), and
Page 2 of 34
operational complexity, considering the number of Credit products offered and number of third
parties involved, for ensuring on a continuous basis that:
(a) prudent Credit underwriting practices appropriate to the nature and
scope of the Bank’s activities are established and maintained;
(b) the Bank’s compliance with applicable fair lending laws and
regulations is satisfactorily monitored;
(c) violations of applicable fair lending laws and regulations are
prevented, or identified and self-corrected; and
(d) the Bank’s internal audit system with respect to applicable fair
lending laws and regulations:
(1) is appropriate to the size of the Bank and the nature and
scope of its activities;
(2) appropriately considers the risk assessments, studies,
reports, plans, policies, procedures, and/or processes required by this ORDER; and
(3) appropriately assesses the Bank’s implementation of and
adherence to any plans, policies, procedures, or processes adopted by the Board in
accordance with Paragraph 7 of this ORDER.
B. Corrective Action. The Board must also ensure that the Bank takes all steps
necessary, consistent with other provisions of this ORDER and safe and sound banking practices,
to:
1. eliminate or correct, and prevent the unsafe or unsound banking practices
identified and the violations of law or regulation cited in the 2021 ROE and establish policies,
procedures, and/or processes to eliminate or correct, and prevent any unsafe or unsound banking
Page 3 of 34
practices identified and violations of law or regulation cited in future consumer compliance
reports of examination, visitation reports or supervisory letters;
2. appropriately address the deficiencies and weaknesses identified in the
2021 ROE and establish processes to appropriately address any deficiencies or weaknesses
identified in future consumer compliance reports of examination, visitation reports or
supervisory letters; and
3. fully comply with the provisions of this ORDER in a timely manner.
2. New CRB Credit Products and New Third Parties
A. Identification of Current CRB Credit Products and Third Parties. The Bank must,
within 15 days from the effective date of this ORDER:
1. identify each product through which Credit is being offered by, through,
or in conjunction with the Bank (CRB Credit Product); and
2. identify any entity other than the Bank offering a CRB Credit Product
(Third Party) and the CRB Credit Product(s) it is offering.
B. Current CRB Credit Products and Third Party List. The Bank must, within 30
days from the effective date of the ORDER, prepare and submit a list of all CRB Credit Products
with an appropriately detailed description of each such CRB Credit Product and the Third Party
offering it (Current CRB Credit Products and Third Parties List) to the Regional Director of
the FDIC’s New York Regional Office (Regional Director) for review, and comment or non-
objection as to the adequacy of the descriptions in accordance with Paragraph 7.
Page 4 of 34
C. New CRB Credit Products and New Third Parties. For purposes of this ORDER:
1. any CRB Credit Product not included on the Current CRB Credit Products
and Third Parties List and any CRB Credit Product offered or to be offered by a Third Party not
identified as offering the CRB Credit Product on the Current CRB Credit Products and Third
Parties List is a new CRB Credit Product (New CRB Credit Product); and
2. any Third Party not included on the Current CRB Credit Products and
Third Parties List submitted to the Regional Director is a new Third Party (New Third Party).
D. Non-Objection Required for All New Third Parties and New CRB Credit
Products. The Bank will not (i) execute a binding commitment or agreement with a New Third
Party; (ii) allow a New Third Party to offer a Credit product through, or in conjunction with the
Bank; and/or (iii) offer a New CRB Credit Product, either directly or indirectly, without first
receiving the Regional Director’s written non-objection to do so. The Bank must submit a New
Third Party or New CRB Credit Product non-objection request with, at a minimum, the
documentation and analysis outlined below, to the Regional Director for review, and comment or
non-objection in accordance with Paragraph 7.
1. A New Third Party non-objection request must, at a minimum, include:
(a) a New Third-Party Risk Assessment, as defined below in
paragraph 5.H.2, for the proposed New Third Party;
(b) an appropriately detailed description of the procedures, processes,
and/or other actions that the Bank will take to ensure compliance with applicable fair lending
laws and regulations and satisfactorily mitigate any risks identified in the New Third-Party Risk
Assessment;
Page 5 of 34
(c) an appropriately detailed description of the procedures and/or
processes that will be established by the Bank for the on-going monitoring of the proposed New
Third Party for compliance with applicable fair lending laws and regulations and for
appropriately addressing and preventing any noncompliance with such laws or regulations;
(d) an appropriately detailed description of the procedures and
processes that will be established by the Bank with respect to Information, as defined below in
paragraph 3.A, related to the proposed New Third Party and the New CRB Credit Products it
proposes to offer;
(e) the proposed written agreement with the proposed New Third
Party; and
(f) the written assessment and recommendation submitted to the
Board as to whether the proposed New Third Party meets the Bank’s due diligence standards and
the Bank should proceed with executing a binding commitment or agreement with the New Third
Party for approval; and, the minutes of the meeting of the Board authorizing the submission of
the proposed New Third Party to the Regional Director for review, and comment or non-
objection in accordance with Paragraph 7.
2. A New CRB Credit Product non-objection request must, at a minimum,
include:
(a) a New CRB Credit Product Risk Assessment, as defined below in
paragraph 5.I.2, for the proposed New CRB Credit Product;
(b) an appropriately detailed description of the procedures, processes,
and/or other actions that the Bank will take to ensure compliance with applicable fair lending
Page 6 of 34
laws and regulations and satisfactorily mitigate any risks identified in the New CRB Credit
Product Risk Assessment;
(c) an appropriately detailed description of the procedures and/or
processes that will be established by the Bank for the on-going monitoring of the proposed New
CRB Credit Product for compliance with applicable fair lending laws and regulations and for
appropriately addressing and preventing any noncompliance with such laws or regulations;
(d) an appropriately detailed description of the procedures and
processes that will be established by the Bank with respect to Information, as defined below in
paragraph 3.A, related to the proposed New CRB Credit Product;
(e) any proposed amendments to the written agreement with the Third
Party proposed to offer the New CRB Credit Product; and
(f) the written assessment and recommendation submitted to the
Board as to whether the proposed New CRB Credit Product meets the Bank’s due diligence
standards and the Bank should proceed with offering the New CRB Credit Product for review
and approval; and, the minutes of the meeting of the Board authorizing the submission of the
proposed New CRB Credit Product to the Regional Director for review, and comment or non-
objection in accordance with Paragraph 7.
3. The Regional Director will provide written notification to the Bank of the
date on which a New Third Party or New CRB Credit Product non-objection request is deemed
to be substantially complete, but may request additional information or analysis any time. The
Regional Director will act on a New Third Party or New CRB Credit Product non-objection
request within 45 days of the date on which the request was deemed to be substantially complete,
Page 7 of 34
but the failure of the Regional Director to act within this timeframe does not constitute non-
objection to a New Third Party or New CRB Credit Product non-objection request.
E. Updating Current CRB Credit Products and Third Party List: The Bank must,
within 7 days of its receipt of a written non-objection from the Regional Director regarding a
New Third Party or a New CRB Credit Product, update and resubmit the Current CRB Credit
Products and Third Parties List to the Regional Director for review, and comment or non-
objection as to the adequacy of the descriptions in accordance with Paragraph 7.
3. Information Systems
A. Information Systems Review. Within 60 days from the effective date of this ORDER,
the Bank must submit a proposed engagement letter or contract to the Regional Director for
review, and comment or non-objection in accordance with Paragraph 7 to engage an independent
third party acceptable to the Regional Director to: (i) assess whether the data, documents,
records and/or any other information, in any medium or form, including textual, numerical,
graphic, cartographic, narrative, or audiovisual (collectively, Information), related to each CRB
Credit Product, every Third Party, and any models or systems, including any variables or
weightings, used or relied on in connection with a CRB Credit Product (CRB Credit Model) is
sufficiently complete, accurate, and accessible to enable the Bank to appropriately determine and
monitor the compliance of such CRB Credit Products, Third Parties, and CRB Credit Models
with all applicable fair lending laws and regulations; (ii) assess whether the networks, systems,
devices, software, hardware and/or other information resource, tool, mechanism, or
compensating control used by the Bank to collect, process, maintain, use, share, disseminate, or
dispose of Information pertaining to a CRB Credit Product, Third Party, or a CRB Credit Model
Page 8 of 34
(Information Systems) satisfactorily enable the Bank to access, collect, and analyze the
Information necessary to appropriately monitor, in a timely manner, each CRB Credit Product,
every Third Party, and any CRB Credit Models and ensure each such CRB Credit Product is
offered and every Third Party and CRB Credit Model operates in compliance with applicable fair
lending laws and regulations (Information Systems Assessment); and (iii) prepare a written
report reflecting the findings of the Information Systems Assessment (Information Systems
Report) at its conclusion. The Information Systems Assessment must include a review and
analysis of the Information Systems Report components required by Paragraph 3.B. below as of
the date on which the Information Systems Assessment is commenced. The engagement letter or
contract must, at a minimum:
1. describe the work to be performed under the engagement letter or contract;
2. provide for unrestricted access to workpapers and personnel of the third
party by the FDIC; and
3. require that the Information Systems Assessment be completed and
summarized in the Information Systems Report and delivered to the Bank within 90 days of the
Regional Director’s non-objection to the proposed engagement letter or contract, with a copy
delivered simultaneously to the Bank’s Directors’ Compliance Oversight Committee (DOC), the
continuance and maintenance of which is required by Paragraph 6 of this ORDER, the Bank’s
Internal Audit Department (IAD), and the Regional Director for review, and comment or non-
objection in accordance with Paragraph 7 of this ORDER.
Page 9 of 34
B. Information Systems Report: The Information Systems Report must, at a
minimum, include:
1. a detailed schedule of the CRB Credit Products, Third Parties, and CRB
Credit Models assessed;
2. a review and assessment of whether the Bank’s Information pertaining to
each CRB Credit Product, Third Party, and CRB Credit Model assessed appropriately enables
the Bank to determine whether such CRB Credit Products, Third Parties, and CRB Credit
Models comply with applicable fair lending laws and regulations and to effectively monitor such
compliance;
3. a detailed schedule and description of any issues or concerns with respect
to the completeness, quality, accuracy, and accessibility of the Information identified during the
assessment;
4. recommendations to address any Information issues and concerns
identified;
5. a review and assessment of whether the Information Systems satisfactorily
enable the Bank to access, collect, and analyze the Information necessary to appropriately
monitor, in a timely manner, each CRB Credit Product, every Third Party, and any CRB Credit
Models and ensure each such CRB Credit Product is offered and every Third Party and CRB
Credit Model operates in compliance with applicable fair lending laws and regulations; and
6. recommendations to address any identified Information Systems issues
and concerns.
C. Information Systems Plan: Within 45 days of receipt of the Regional Director’s
non-objection to the Information Systems Report, the Bank must develop a written plan of action
Page 10 of 34
(Information Systems Plan) appropriately addressing each recommendation contained in the
Information Systems Report with a time frame for completing the recommended action; an
alternative proposal to the recommended action with a satisfactory justification for such
alternative and a time frame for completing it; or a satisfactory justification as to why the
recommended action is not necessary or appropriate. The Information Systems Plan must be
submitted to the Regional Director for review, and comment or non-objection in accordance with
Paragraph 7 of this ORDER. In the event the Information Systems Plan, or any portion thereof,
is not implemented or adhered to after its adoption by the Board, the DOC must promptly, but in
no instance more than 7 days from such event, advise the Regional Director in writing of the
specific reasons for deviating from the Information Systems Plan and the action it will take to
address the deviation. The Regional Director may either provide written non-objection to any
such deviation or require compliance with the Information Systems Plan.
4. Fair Lending Compliance Risk Management
A. Fair Lending Risk Assessment. Within 60 days from the Regional Director’s
non-objection to the Current CRB Credit Products and Third Parties List, the Bank must: (i)
conduct an initial risk assessment of all CRB Credit Products and all Third Parties on the Current
CRB Credit Products and Third Parties List to identify fair lending risks, including any risks
associated with an application (for purposes of this ORDER, the term “application” has the
meaning ascribed to it in Regulation B, 12 C.F.R. § 1002.2(f), hereinafter, Application) and/or
Credit Transaction c onducted by, through or in conjunction with the Bank (CRB Credit
Transaction) for compliance with applicable fair lending laws and regulations (Fair Lending
Risk Assessment), and (ii) submit the initial Fair Lending Risk Assessment, and any subsequent
Page 11 of 34
Fair Lending Risk Assessments prepared prior to the termination of this ORDER, to the Regional
Director for review, and comment or non-objection in accordance with Paragraph 7 of this
ORDER and to the IAD upon receipt of the Regional Director’s non-objection. The Bank must
ensure that its Marketplace Lending CMS includes written policies, procedures, and/or processes
requiring comprehensive periodic risk-based Fair Lending Risk Assessments and their timing.
These policies, procedures, and/or processes must appropriately take into account prior Fair
Lending Risk Assessments, audit findings contained in audit reports prepared by or on behalf of
the IAD or by or on behalf of a Third Party, and must incorporate the results of the Bank’s
annual underwriting and pricing analyses. The Bank must also ensure these policies, procedures,
and/or processes require that: (i) risk ratings resulting from the Fair Lending Risk Assessments
are accurate and well supported by qualitative and quantitative data; and (ii) Fair Lending Risk
Assessments conducted after the termination of the ORDER are submitted to the DOC for review
and provided to the IAD after receipt of the DOC’s approval.
B. Fair Lending Resources Study and Report. Within 60 days from the effective date
of this ORDER, the Bank must submit a proposed engagement letter or contract retaining an
independent third party acceptable to the Regional Director to conduct a fair lending resources
study (Fair Lending Resources Study) and to prepare a written summary of the Fair Lending
Resources Study (Fair Lending Resources Report) at its conclusion to the Regional Director
for review, and comment or non-objection in accordance with Paragraph 7. The Fair Lending
Resources Study must appropriately consider the Bank’s size and growth plans; the current and
anticipated number of CRB Credit Products and their respective volumes; the current and
anticipated number of Third Parties; and the current and anticipated number of merchants
offering one or more CRB Credit Products through or in conjunction with a Third Party (Third-
Page 12 of 34
Party Merchants); the volume of decisions made by the Bank or on behalf of the Bank by a
Third Party in connection with an Application, including Credit underwriting practices, a CRB
Credit Transaction and/or any decisions made in connection with marketing of a CRB Credit
Product, including the terms and conditions described in the marketing of a CRB Credit Product
(CRB Decisions); and the Bank’s use of non-staff resources, including software, automated
systems, and/or other technology (Non-Staff Fair Lending Resources), and must, at a minimum
include a review and analysis of Non-Staff Fair Lending Resources, management, and other
staffing necessary to ensure compliance with applicable fair lending laws and regulations for all
CRB Credit Products offered, and CRB Credit Transactions, and appropriately address the fair
lending weaknesses and deficiencies identified in the 2021 ROE. The Fair Lending Resources
Study must also assess the adequacy and effectiveness of Non-Staff Fair Lending Resources to
accomplish stated objectives related to their use and reliance by the Bank for compliance with
applicable fair lending laws and regulations, and the abilities, experience, and other
qualifications of management and other staff having duties and responsibilities related to the
Bank’s compliance with applicable fair lending laws and regulations (Fair Lending Personnel)
to satisfactorily perform their present and anticipated fair lending-related duties and
responsibilities, including those to ensure complete and timely compliance with the requirements
of this ORDER. The Fair Lending Resources Study must also include a review and analysis of
each Fair Lending Resources Report component required by Paragraph 4.B.2. below as of the
date on which the Fair Lending Resources Study is commenced.
Page 13 of 34
1. Engagement Letter. The engagement letter or contract must, at a
minimum:
(a) describe the work to be performed under the engagement letter or
contract;
(b) provide for unrestricted access to workpapers and personnel of the
third party by the FDIC; and
(c) require that the Fair Lending Resources Study be completed and
summarized in the Fair Lending Resources Report and delivered to the Bank within 90 days of
the Regional Director’s non-objection to the proposed engagement letter or contract, with a copy
delivered simultaneously to the Regional Director for review, and comment or non-objection in
accordance with Paragraph 7.
2. Fair Lending Resources Report. At a minimum, the Fair Lending
Resources Report must:
(a) identify any Non-Staff Fair Lending Resources and/or any
enhancements to existing Non-Staff Fair Lending Resources necessary for complete and timely
compliance with this ORDER, applicable fair lending laws and regulations, and the Fair Lending
Internal Controls detailing any deficiencies in such resources and additional needs with
appropriate consideration to any statutory or regulatory requirements; the size, complexity, and
growth plans of the Bank; the current and anticipated number of CRB Credit Products and their
respective volumes; current and anticipated number of Third Parties offering a CRB Credit
Product by or in conjunction with the Bank; the current and anticipated number of Third-Party
Merchants; and volume of CRB Decisions, and provide a clear and concise description of any
Non-Staff Fair Lending Resource needs and/or enhancements recommended to existing Non-
Staff Fair Lending Resources;
Page 14 of 34
(b) identify the type and number of managers needed to supervise Fair
Lending Personnel, including those necessary to ensure the Bank’s complete and timely
compliance with this ORDER, and the internal controls established to provide for compliance
with applicable fair lending laws and regulations (Fair Lending Internal Controls), detailing
any vacancies and additional needs with appropriate consideration to any statutory or regulatory
requirements; the size, complexity, and growth plans of the Bank; the current and anticipated
number of CRB Credit Products and their respective volumes; current and anticipated number of
Third Parties; the current and anticipated number of Third-Party Merchants; the volume of CRB
Decisions, and the Bank’s use of Non-Staff Fair Lending Resources;
(c) identify the type and number of Fair Lending Personnel positions
needed for complete and timely compliance with this ORDER, applicable fair lending laws and
regulations, and the Fair Lending Internal Controls noting the duties and responsibilities
attributable to each position, providing a clear and concise description of the relevant knowledge,
skills, abilities, and experience necessary for each position, including delegations of authority,
reporting lines, and performance objectives, and detailing any vacancies and additional needs
with appropriate consideration to any statutory or regulatory requirements; the size, complexity,
and growth plans of the Bank, the current and anticipated number of CRB Credit Products and
their respective volumes, current and anticipated number of Third Parties offering a CRB Credit
Product by or in conjunction with the Bank and the current and anticipated number of Third-
Party Merchants, the volume of CRB Decisions, and the Bank’s use of Non-Staff Fair Lending
Resources; and
(d) recommend actions to be taken to retain and/or recruit qualified
Fair Lending Personnel.
Page 15 of 34
3. Fair Lending Resources Plan. Within 45 days of receipt of the Regional
Director’s non-objection to the Fair Lending Resources Report, the Bank must develop a written
plan of action (Fair Lending Resources Plan) addressing each recommendation contained in
the Fair Lending Resources Report with a time frame for completing the recommended action;
an alternative proposal to the recommended action with a satisfactory justification for such
alternative and a time frame for completing it; or a satisfactory justification as to why the
recommended action is not necessary or appropriate. The Fair Lending Resources Plan and any
subsequent modification thereto must be submitted to the Regional Director for review, and
comment or non-objection in accordance with Paragraph 7. In the event the Fair Lending
Resources Plan, or any portion thereof, is not implemented or adhered to after its adoption by the
Board, the DOC must promptly, but in no instance more than 7 days from such event, advise the
Regional Director in writing of the specific reasons for deviating from the Fair Lending
Resources Plan and the action it will take to address the deviation. The Regional Director may
either provide written non-objection to any such deviation or require compliance with the Fair
Lending Resources Plan. The Fair Lending Resources Plan must, at a minimum:
(a) contain a proposed organizational chart identifying proposed fair
lending staff and manager positions delineating lines of authority and reporting (Proposed Fair
Lending Org Chart);
(b) summarize the duties and responsibilities, by position, of all Fair
Lending Personnel;
(c) contain clear and concise descriptions of the relevant knowledge,
skills, abilities and experience necessary for each position on the Proposed Fair Lending Org
Chart;
Page 16 of 34
(d) establish requirements and processes to periodically evaluate each
individual’s job performance;
(e) establish processes to promote successful filling of positions
identified by the Proposed Fair Lending Org Chart and their retention;
(f) include a list and description of all Non-Staff Fair Lending
Resources;
(g) establish requirements and processes to periodically evaluate all
Non-Staff Fair Lending Resources and replace, upgrade and/or enhance as appropriate; and
(h) establish procedures to periodically review and update the Fair
Lending Resources Plan.
C. Fair Lending Internal Controls. Within 45 days of receipt of the Regional
Director’s non-objection to the Information Systems Plan, the Fair Lending Resources Plan, and
the Fair lending Compliance Plan, the Bank must, to the extent not already developed, develop
and submit the Bank’s Fair Lending Internal Controls to the Regional Director for review, and
comment or non-objection in accordance with Paragraph 7 of this ORDER. The Fair Lending
Internal Controls must be reviewed periodically on a risk basis, but not less than annually, and
adjusted as appropriate. The Fair Lending Internal Controls must, at a minimum, include:
1. Fair Lending Policies, Procedures, and/or Processes. The Fair Lending
Internal Controls must include policies, procedures, and/or processes (Fair Lending Policies
and Procedures) designed to appropriately address and mitigate any risks identified in the Fair
Lending Risk Assessment; require appropriate oversight and monitoring of all CRB Decisions to
ensure compliance with applicable fair lending laws and regulations; and identify statistically
significant disparities involving a prohibited basis (for purposes of this ORDER, the term
Page 17 of 34
“prohibited basis” has the meaning ascribed to it in Regulation B, 12 C.F.R. § 1002.2(z)) under
applicable fair lending laws and regulations (Disparities). The Fair Lending Policies and
Procedures must appropriately take into account and be consistent with the Third-Party
Compliance Policies and Procedures, as defined in Paragraph 5 of this ORDER, and all other
requirements of this ORDER. The Fair Lending Policies and Procedures must include processes
to: (i) determine whether detected Disparities appear to be the result of one or more acts or
practices that do not comply with applicable fair lending laws and regulations (Discriminatory
Practice); (ii) determine the appropriate corrective measures and/or remedial action, including,
e.g., restitution or Credit offers (Remedial Action) to address the apparent Discriminatory
Practice and/or mitigation steps necessary to prevent reoccurrences of such apparent
Discriminatory Practice; (iii) implement the appropriate corrective action and/or Remedial
Action to address the apparent Discriminatory Practice; and (iv) establish appropriate mitigation
steps to prevent reoccurrences of any apparent Discriminatory Practices;
2. Fair Lending Training. The Fair Lending Internal Controls must provide
for appropriate fair lending training (Fair Lending Training) of all members of the Board; all
compliance personnel, including Fair Lending Personnel; and any managers, IAD personnel, and
other personnel with roles and responsibilities related to or involving CRB Credit Products
(Trainee or Trainees). The Fair Lending Internal Controls related to Fair Lending Training
must, at a minimum, include:
(a) policies, procedures, and/or processes to provide training designed
to be commensurate with the Trainee’s respective duties and responsibilities with respect to the
CRB Credit Products on the Current CRB Credit Products and Third Parties List, including
Applications, CRB Decisions, and CRB Credit Transactions; and any Third Parties on the
Page 18 of 34
Current CRB Credit Products and Third Parties List (Current Third Parties) and their Third-
Party Merchants, including any due diligence, oversight, and monitoring of the Current Third
Parties, to enable the Trainee to satisfactorily fulfill their role(s) and responsibilities with respect
to applicable fair lending laws and regulations;
(b) policies, procedures, and/or processes to provide training designed
to be commensurate with the Trainee’s respective duties and responsibilities with respect to
compliance with this ORDER and any risk assessments, studies, reports, plans, policies,
procedures, and processes required by this ORDER;
(c) policies, procedures, and/or processes to update and promptly
provide Fair Lending Training to appropriate Trainees to address: (i) any New CRB Credit
Products; (ii) any new or revised policy, procedure, process, plan or program related to Fair
Lending; and/or (iii) the results of the training assessments required below;
(d) policies, procedures, and/or processes to require initial and
periodic assessments of training effectiveness (training assessments); and
(e) policies, procedures, and/or processes to satisfactorily document
training activities and training assessments.
3. Fair Lending Monitoring. The Fair Lending Internal Controls must
provide for the satisfactory monitoring of CRB Decisions, CRB Credit Products, and Third
Parties for compliance with applicable fair lending laws and regulations; and identify, analyze,
and determine whether any Disparities resulted in an apparent Discriminatory Practice (Fair
Lending Monitoring). The Fair Lending Internal Controls related to Fair Lending Monitoring
must, at minimum:
(a) include policies, procedures, and/or processes designed to:
Page 19 of 34
(1) appropriately monitor identified risks, including the risks
identified in Fair Lending Risk Assessments, audit reports, whether issued by the IAD or an
auditor associated with a Third Party, Fair Lending Compliance Reports, as defined in Paragraph
4.C.4. of this ORDER, reports prepared by or on behalf of a Third Party pertaining in any way to
the Third Party’s compliance with applicable fair lending laws and regulations, and any other
analyses and reviews related to compliance with applicable fair lending laws and regulations;
(2) establish statistical analysis and/or transaction testing
requirements that appropriately consider actual underwriting and pricing factors used in
connection with all CRB Decisions, CRB Credit Products and Third Parties; and
(3) identify Disparities and then investigate, analyze, and
determine whether any such Disparities resulted in an apparent Discriminatory Practice;
(b) include policies, procedures, and/or processes to appropriately
correct and prevent reoccurrences of any apparent Discriminatory Practices identified in a Semi-
Annual Fair Lending Monitoring Report required by Paragraph 4.C.3.(d) below or otherwise
coming to the attention of the Bank;
(c) include policies, procedures, and/or processes to appropriately
assess whether Remedial Action to those affected by an apparent Discriminatory Practice
identified in a Semi-Annual Fair Lending Monitoring Report or otherwise coming to the
attention of the Bank is warranted; to determine the appropriate Remedial Action to be taken,
and when and how such Remedial Action should be taken; and to monitor the completion of any
such Remedial Action;
(d) require the issuance of semi-annual written reports analyzing the
fair lending monitoring data and results, including: (i) a detailed description of any identified
Page 20 of 34
Disparity and the status of the Bank’s investigation and analysis of such Disparity to determine
whether it resulted in an apparent Discriminatory Practice; (ii) a detailed description of any
apparent Discriminatory Practice identified; (iii) a detailed description of the actions taken by the
Bank to correct and prevent reoccurrences of any apparent Discriminatory Practices identified;
and (iv) a detailed summary regarding any Remedial Action taken or to be taken to address any
apparent Discriminatory Practice identified and if no Remedial Action has been or will be taken,
a detailed explanation of why Remedial Action is not necessary (Semi-Annual Fair Lending
Monitoring Report). Until the ORDER is terminated, Semi-Annual Fair Lending Monitoring
Reports must be submitted to the Regional Director for review, and comment or non-objection in
accordance with Paragraph 7 of this ORDER immediately after completion, and must be
provided to the DOC and IAD after receipt of the Regional Director’s non-objection.
Subsequent to the termination of the ORDER, Semi-Annual Fair Lending Monitoring Reports
must be submitted to the DOC for review immediately after completion, and must be provided to
the IAD after receipt of the DOC’s approval.
4. Fair Lending Compliance Assessment. Within 60 days from the effective
date of this ORDER, the Bank must submit a proposed engagement letter or contract to the
Regional Director for review, and comment or non-objection in accordance with Paragraph 7 to
engage an independent third party acceptable to the Regional Director to: (i) assess whether,
during the timeframe starting January 1, 2021, through December 31, 2022, each Third Party
offering one or more CRB Credit Products for a period of six months or more during such time
frame offered these CRB Credit Products in compliance with applicable fair lending laws and
regulations (Fair Lending Compliance Assessment); and (ii) prepare a written report reflecting
the findings of the Fair Lending Compliance Assessment (Fair Lending Compliance Report).
Page 21 of 34
The Fair Lending Compliance Assessment must, at a minimum, include a review and analysis of
the Fair Lending Compliance Report components required by Paragraph 4.C.4.(b) below.
(a) Engagement Letter. The engagement letter or contract must, at a
minimum:
(1) describe the work to be performed under the engagement
letter or contract;
(2) provide for unrestricted access to workpapers and
personnel of the third party by the FDIC; and
(3) require that the Fair Lending Compliance Assessment be
completed and summarized in a Fair Lending Compliance Report and delivered to the Bank
within 90 days of the Regional Director’s non-objection to the proposed engagement letter or
contract, with a copy delivered simultaneously to the DOC, the IAD, and the Regional Director
for review, and comment or non-objection in accordance with Paragraph 7 of this ORDER.
(b) Fair Lending Compliance Report. The Fair Lending Compliance
Report must, at a minimum, include:
(1) a detailed description of each CRB Credit Product(s)
offered by each Third Party assessed;
(2) a review and assessment of each Third Party’s policies and
procedures related to each CRB Credit Product offered as to whether the policies and procedures
ensure compliance with applicable fair lending laws and regulations with any recommended
changes or enhancements;
(3) a detailed description of any CRB Decisions that do not
appear to have been made in compliance with the Third Party’s policies or procedures and/or
Page 22 of 34
applicable fair lending laws and regulations indicating whether the CRB Decision involved a
Disparity;
(4) an analysis of whether any of the CRB Decisions involving
a Disparity resulted in an apparent Discriminatory Practice;
(5) recommendations for the appropriate actions, including any
corrective and preventive actions, where a Third Party is not in compliance with applicable fair
lending laws and regulations;
(6) recommendations as to whether Remedial Action to those
affected by an apparent Discriminatory Practice or violation of applicable fair lending laws or
regulations is warranted; the appropriate type and amount of any such Remedial Action; when
and how the Remedial Action should be taken; and how the Remedial Action should be
monitored and tracked.
(c) Fair Lending Compliance Plan. Within 45 days of receipt of the
Regional Director’s non-objection to the Fair Lending Compliance Report, the Bank must
develop a written plan of action (Fair Lending Compliance Plan) appropriately addressing each
recommendation contained in the Fair Lending Compliance Report with a time frame for
completing the recommended action; an alternative proposal to the recommended action with a
satisfactory justification for such alternative and a time frame for completing it; or a satisfactory
justification as to why the recommended action is not necessary or appropriate. The Fair
Lending Compliance Plan must be submitted to the Regional Director for review, and comment
or non-objection in accordance with Paragraph 7 of this ORDER. In the event a Fair Lending
Compliance Plan, or any portion thereof, is not implemented or adhered to after adoption by the
Board, the DOC must promptly, but in no instance more than 7 days from such event, advise the
Page 23 of 34
Regional Director in writing of the specific reasons for deviating from the Fair Lending
Compliance Plan and the action it will take to address the deviation. The Regional Director may
either provide a written non-objection to any such deviation or require compliance with the Fair
Lending Compliance Plan.
(d) Fair Lending Compliance Assessments by CRB. The Bank must,
to the extent not already developed, develop policies, procedures, and/or processes to conduct
periodic, but not less than annual, assessments of whether each Third Party offering one or more
CRB Credit Products for a period of six months or more during the calendar year preceding such
assessment offered these CRB Credit Products in compliance with applicable fair lending laws
and regulations. These policies, procedures, and/or processes must be submitted to the Regional
Director for review, and comment or non-objection in accordance with Paragraph 7 of this
ORDER within 90 days from receipt of the Regional Director’s non-objection to the Fair
Lending Compliance Report.
5. Third-Party Compliance Internal Controls
Within 45 days of receipt of the Regional Director’s non-objection to the Information
Systems Plan, the Fair Lending Resources Plan, and the Fair Lending Compliance Plan, the Bank
must, to the extent not already developed, develop and submit the Bank’s Third-Party
compliance internal controls (Third-Party Compliance Internal Controls) related to applicable
fair lending laws and regulations to the Regional Director for review, and comment or non-
objection in accordance with Paragraph 7 of this ORDER. The Bank’s Third-Party Compliance
Internal Controls must include policies, procedures, and/or processes designed to ensure
Page 24 of 34
compliance with applicable fair lending laws and regulations (Third-Party Compliance Policies
and Procedures). The Third-Party Compliance Policies and Procedures must, at a minimum:
A. Consistent with Other Provisions. The Third-Party Compliance Policies and
Procedures must appropriately take all available Fair Lending Risk Assessments, Semi-Annual
Fair Lending Monitoring Reports, Fair Lending Compliance Reports, and Fair Lending
Compliance Plans into account and be consistent with the Fair Lending Policies and Procedures,
and all other requirements of this ORDER;
B. Corrective Action. The Third-Party Compliance Policies and Procedures must
require that any deficiencies, weaknesses and/or instances of noncompliance with applicable fair
lending laws or regulations involving or related to a Third Party identified in the 2021 ROE
and/or any subsequent consumer compliance report of examination, visitation report, or
supervisory letter, Fair Lending Risk Assessment, Third-Party Compliance Risk Report and/or
Third-Party Compliance Risk Management Plan are appropriately addressed and/or corrected;
C. CRB Decision Records. The Third-Party Compliance Policies and Procedures
must require that all Information related to a CRB Decision or CRB Credit Model (collectively,
CRB Decision Records) be collected by the Bank or a Third Party and readily accessible by the
Bank; satisfactorily sampled to ensure the information necessary to perform fair lending
monitoring, audits, and system validations is included, accurate, and complete; and the CRB
Decision Records are retained in compliance with all applicable regulations and are fully
accessible to Bank personnel and Federal and State regulatory agencies;
D. Oversight and Monitoring. The Third-Party Compliance Policies and Procedures
must require appropriate oversight and monitoring of all CRB Decisions made by a Third Party,
Page 25 of 34
and establish standards and processes for such oversight and monitoring, appropriately taking
into account the complexity, risk profile, and transaction volume of such Third Party’s
operations, including the CRB Credit Products offered by the Third Party, the adequacy of the
Third Party’s compliance program, the number of Third-Party Merchants, transaction volume of
the Third-Party Merchants, and the Third Party’s oversight of Third-Party Merchants;
E. Third Party/Third-Party Merchant Corrective and Preventive Action. The Third-
Party Compliance Policies and Procedures must require appropriate corrective and preventive
action when noncompliance with applicable fair lending laws or regulations by either a Third
Party or a Third-Party Merchant is identified and require the establishment of appropriate
mitigation steps to prevent reoccurrences of any such noncompliance;
F. Third Party/Third-Party Merchant Remedial Action. The Third-Party Compliance
Policies and Procedures must require appropriate Remedial Action when apparent
Discriminatory Practices by either a Third Party or a Third-Party Merchant are identified;
G. Third Party/Third-Party Merchant Marketing Materials. The Third-Party
Compliance Policies and Procedures must establish appropriate oversight and on-going
monitoring and validation of all marketing materials, including the availability of terms and
conditions offered in connection with a CRB Credit Product, distributed by a Third Party and/or
a Third-Party Merchant; and
H. New Third Party Due Diligence. The Third-Party Compliance Policies and
Procedures must establish appropriate due diligence policies and procedures for any proposed
Page 26 of 34
New Third Party that:
1. set standards for and require the collection of sufficient information about
the New Third Party to appropriately assess risks associated with the New Third Party; such
standards must, at a minimum, include the New Third Party’s name and address, the New CRB
Credit Products it proposes to offer, and any categories of merchants that will offer one or more
of these proposed New CRB Credit Products through or in conjunction with the New Third Party
and the Bank (New Third-Party Merchants);
2. require an initial thorough and well-documented review and assessment of
risks associated with the New Third Party (New Third-Party Risk Assessment), including the
internal controls established by the New Third Party to ensure compliance with applicable
consumer protection laws and regulations, including any related information systems and internal
audit procedures, Credit policies and procedures, any models or systems, including any variables
or weightings, used or relied on in connection with a proposed New CRB Credit Product,
Application forms, marketing materials, and oversight and monitoring procedures related to any
New Third-Party Merchants (collectively, New Third-Party Internal Controls) and then
periodic, but not less than annual, risk assessments of the New Third-Party Internal Controls;
3. require a written assessment and recommendation of the actions necessary
to satisfactorily mitigate any risks identified in a New Third-Party Risk Assessment and ensure
compliance with applicable fair lending laws and regulations for all proposed New CRB Credit
Products;
4. require written recommendations for the establishment of processes for the
on-going monitoring of New Third Parties and New Third-Party Internal Controls, including the
Page 27 of 34
monitoring of Third-Party Merchants, for compliance with applicable fair lending laws and
regulations and for appropriately addressing and preventing any noncompliance with such laws
or regulations;
5. require a comprehensive written agreement with a New Third Party clearly
documenting and defining the specific duties and responsibilities of each party in connection
with the offering of all proposed New CRB Credit Products. Such agreements must, at a
minimum:
(a) ensure full and timely access by Bank employees and the
appropriate federal and state regulatory agencies to all information necessary to perform fair
lending monitoring, audits, and validations of the New Third-Party Internal Controls;
(b) require initial and then periodic training for all New Third Party
personnel assigned any duties or responsibilities related to the New Third-Party Internal Controls
commensurate with their assigned duties and responsibilities with training assessments to
appropriately assess the effectiveness of their training and satisfactory documentation of all
training activities and training assessments. Such training must be promptly updated and
provided to appropriately address any New CRB Credit Products added to the Current CRB
Credit Products and Third Parties List, any changes in the New Third-Party Internal Controls,
and the results of the required training assessments;
(c) require the New Third Party to collect and maintain information
and documentation necessary for the appropriate oversight and monitoring of its Third-Party
Merchants offering CRB Credit Products, including related Application forms, Credit terms and
Page 28 of 34
conditions, and marketing materials for compliance with applicable consumer protection laws
and regulations;
6. require all due diligence processes be satisfactorily completed; and
7. require a written assessment and recommendation as to whether the
proposed New Third Party meets the due diligence standards and the Bank should proceed with
executing a binding commitment or agreement with the New Third Party be submitted to the
Board for approval and that no binding commitment or agreement with a New Third Party be
executed by the Bank unless and until the approval of the Board has been provided.
I. New CRB Credit Product Due Diligence. The Third-Party Compliance Policies
and Procedures must establish appropriate due diligence policies and procedures for any
proposed New CRB Credit Product that:
1. require the collection of detailed information about the New CRB Credit
Product and any Third Parties and the categories of Third-Party Merchants that plan to offer the
New CRB Credit Product through or in conjunction with these Third Parties;
2. require an initial thorough and well-documented review and assessment of
risks associated with the New CRB Credit Product (New CRB Credit Product Risk
Assessment), including any modifications of internal controls established by Third Parties
identified on the Current CRB Credit Product and Third Parties List and then periodic, but not
less than annually, risk assessments of these internal controls;
3. require a written assessment and recommendation of the actions that
would be required of a Third Party to satisfactorily mitigate any risks identified in a New CRB
Page 29 of 34
Credit Product Risk Assessment and ensure compliance with applicable consumer protection
laws and regulations when offered through or in conjunction with the Bank;
4. require written recommendations for the establishment of processes for the
on-going monitoring of the Third Party proposing to offer the New CRB Credit Product for
compliance with applicable consumer protection laws and regulations and for appropriately
addressing and preventing any noncompliance with such laws or regulations;
5. require all due diligence processes be satisfactorily completed; and
6. require a written assessment and recommendation as to whether the
proposed New CRB Credit Product meets the due diligence standards and the Bank should
proceed with adding the New CRB Credit Product be submitted to the Board for approval and
that no New CRB Credit Product be offered unless and until the written approval of the Board
has been provided.
6. Directors’ Compliance Oversight Committee
A. DOC Maintenance. The Board must continue and maintain its DOC and ensure
that it is comprised of at least three independent directors (directors who are independent of
management and are not, and within the preceding fiscal year have not been, an officer or
employee of the institution or any affiliate of the institution) acceptable to the Regional Director.
Nothing herein diminishes the responsibility of the entire Board to ensure compliance with the
provisions of this ORDER in a timely manner.
B. DOC Plan. Within 45 days of the effective date of this ORDER, the DOC must
submit a written plan detailing how the Board will ensure the requirements of this ORDER are
Page 30 of 34
met in a timely manner (DOC Plan) to the Regional Director for review, and comment or non-
objection in accordance with Paragraph 7 of this ORDER. The DOC Plan must, at a minimum:
(i) note the action to be taken to meet the requirements of this ORDER; (ii) establish the date by
which such actions will be taken; and (iii) establish the means by which the DOC will monitor
the status of these corrective actions and ensure timely compliance with this ORDER.
C. DOC Report. The DOC must submit a written report (DOC Report) detailing the
status of all actions required in connection with this ORDER to the Board for consideration at
each regularly scheduled meeting occurring after the effective date of this ORDER. The DOC
Report and any discussion related to it or this ORDER must be included in the minutes of the
corresponding Board meeting. The DOC Report must be submitted to the Regional Director as
part of the progress reports required by Paragraph 8 of this ORDER, noting any action taken by
the Board based on them.
7. Non-objection, Implementation and Adherence
A. Review, Comment or Non-objection: When a provision of this ORDER requires
the Bank to submit new proposed plans, policies, or processes; proposed revisions or additions to
an existing plan, policy, or process; or any other matter to the Regional Director for review, and
comment or non-objection (Submission), the Bank will make the Submission to the Regional
Director as a PDF document through the FDIC’s Secure Email portal (securemail.fdic.gov) using
e-mail address: NYMailRoomfdic.gov. The Regional Director may request in writing additional
information or analysis in support of or in connection with any Submission from the Bank, and
the Bank may request clarification of the Regional Director’s request for additional information
or analysis, but must provide such information or analysis or request additional time to provide
Page 31 of 34
the information or analysis with a reasonable justification of such request within the time frame
set in the written request. Within 45 days of receipt of comments from the Regional Director,
the Bank will make such modifications as may be necessary to respond to the Regional
Director’s comments and resubmit the Submission for review, additional comments or non-
objection. If the Bank fails to make such modifications, or otherwise fails to address the
comments of the Regional Director within such 45 day period, the Bank will provide a
comprehensive written explanation of its failure to take action to the Regional Director.
B. Adoption, Implementation and Adherence: For Submissions receiving the written
non-objection of the Regional Director, the Board will, at its next regularly scheduled meeting,
adopt the plan, policy, or process as non-objected to by the Regional Director; incorporate the
revision or addition to the plan, policy, or process as non-objected to by the Regional Director
into the plan, policy, or process and adopt the plan, policy, or process with the pertinent revision
or addition; or adopt any other matter for which it received non-objection. These actions must be
appropriately reflected in the Board minutes. Thereafter, the Board must ensure that the Bank
fully implements and adheres to the plan, policy, process, or other matter as adopted and enforce
full and complete compliance with these plans, policies, processes, or other matters. In the event
these plans, policies, processes, or other matters as adopted by the Board, or any portion thereof,
are not fully implemented or adhered to, the Board must promptly, in no instance more than 7
days from the event, advise the Regional Director in writing of the specific reasons for the
deviation or delay and the action it will take to address the deviation or delay. The Regional
Director may either provide a written non-objection to any such deviation or delay or require
compliance with the plan, policy, process, or other matter.
Page 32 of 34
8. Progress Reports
Within 60 days from the end of each calendar quarter following the effective date of this
ORDER, the Bank must furnish written progress reports detailing the form, manner, and results
of any actions taken to secure compliance with this ORDER to the Regional Director. All
progress reports must be reviewed and approved by the Board and be made a part of the Board
minutes.
9. Shareholder Disclosure
Within 30 days from the effective date of this ORDER, the Board must provide its parent
holding company, CRB Group, Inc., with either an accurate and complete description of all
material aspects of the ORDER or a copy of the ORDER.
10. Miscellaneous
A. Other Actions. The provisions of this ORDER do not bar, estop, or otherwise
prevent the FDIC or any other federal or state agency or department from taking any other action
against the Bank or any of the Bank’s current or former any IAPs, including any action under 12
U.S.C. § 1818(b)(6) or 12 U.S.C. § 1818(i), arising from, out of, or related to the facts and
circumstances forming the basis of this ORDER; or in any way prevent the FDIC from
conducting on-site reviews, visitations, and/or examinations of the Bank, its affiliates, agents, or
Third-Parties at any time to monitor compliance with this ORDER.
B. Successors and Assigns. The provisions of this ORDER are binding on the Bank,
its IAPs, and any successors and assigns thereof.
Page 33 of 34
C. Effective Date. This ORDER is effective on the date of issuance, and its
provisions will remain effective and enforceable unless and until it is modified, terminated,
suspended, or set aside in writing by the FDIC.
Issued Under Delegated Authority this 8th day of March, 2023.
/s/
Frank R. Hughes
Regional Director
New York Region
Federal Deposit Insurance Corporation
Page 34 of 34