Decision # 135

Commissioner’s reasons for Decision

Summary

1. By notice of violation issued on December 17, 2018, in accordance with subsection 22(2) of the Financial Consumer Agency of Canada Act (Act), staff of the Supervision and Enforcement Branch of the Financial Consumer Agency of Canada (FCAC Staff) allege that the Canadian Imperial Bank of Commerce (Bank or CIBC) committed five violations of the Cost of Borrowing (Banks) Regulations (Regulations) in relation to credit card products.

2. I have considered the record before me, including the compliance report attached to the notice of violation issued by FCAC Staff on its investigation of this matter, and the Bank’s representations dated January 25, 2019 (Representations).

3. For the reasons that follow, I find that, on a balance of probabilities, CIBC has committed each of the five violations related to non-compliant disclosure of fees and other charges on credit cards.

4. The penalties imposed for violations #1, #2 and #5 are in the amounts proposed in the notice of violation. The amount of the penalty imposed for violations #3 and #4 is reduced to reflect a lesser finding of negligence. Accordingly, the total amount payable is $1,225,000.

5. Furthermore, I have determined to make public the name of the Bank, together with the nature of the violations and the amount of the penalties imposed. A clear and transparent publication of my decision in this proceeding will enhance the understanding and awareness of financial consumers on such matters and incentivize regulated entities to invest appropriate resources to achieve the highest levels of compliance.

Alleged Violations and Proposed Penalties

6. FCAC Staff allege that the Bank failed to:

1. provide an initial disclosure statement to borrowers that discloses the nature and amounts of non-interest charges—in this case over limit fees—during the period from February 2003 until June 2018 (violation #1);
2. provide an initial disclosure statement to borrowers that discloses information about an optional service relating to the credit card product and the charges for each optional service—in this case an optional insurance service—during the period from February 2003 until September 2018 (violation #2);
3. provide an initial disclosure statement to borrowers that discloses the date on and after which interest accrues, during the period from February 2003 until September 2018 (violation #3);
4. make the disclosure on interest charges in language, and to present it in a manner, that is clear, simple and not misleading, during the period from February 2003 until September 2018 (violation #4); and
5. provide a supplementary disclosure statement to borrowers that discloses required information, such as interest and non-interest charges, insurance premiums and minimum payment amounts, during the period from February 2003 until September 2018 (violation #5).

7. The penalties proposed by FCAC Staff in the notice of violation are as follows:

1. $450,000 for violation #1
2. $400,000 for violation #2
3. $150,000 for violation #3
4. $150,000 for violation #4
5. $125,000 for violation #5

Factual Background

Posting Delay

8. The facts on the root cause of this proceeding are undisputed. In February 2003, CIBC changed the vendor and the system which administers the payment processing for its credit card accounts. The new vendor’s system for processing payments to a cardholder’s account introduced a delay of two to three days between the receipt of certain payments by the Bank, including payment by a digital transfer of funds from a CIBC account (Verified Payments), and the posting of those payments to the cardholder’s account (Posting Delay).

9. The date of posting is important as this is the date that the system used to determine whether the payment was received in time to avoid interest and other charges. The Posting Delay was not disclosed to cardholders as a relevant factor in the timing of the receipt of payment by CIBC. Following the change in vendor, the actual system operation was at odds with CIBC’s disclosure in the cardholder agreement which explicitly set out the circumstances and timing under which Verified Payments could be made and received by CIBC.

10. The CIBC initial disclosure statement in question informed consumers that “Payments are not credited to [the] Credit Card Account until [the Bank] has received them”. It then details the options available to cardholders to ensure that their payment is made (and received) on time.

11. In addition, once a cardholder made a Verified Payment they were provided with digital confirmation of the payment and an automatic recalculation of the available credit to reflect the payment, despite the fact that the actual payment would not be posted to the account for two to three days.

12. The result was that cardholders could be charged over-limit fees, insurance premiums and interest when, according to the disclosure they received, they had every reason to expect that their payment was made and received in time to avoid these costs.

13. CIBC became aware of the impact of the Posting Delay for over-limit fees in November 2016—some 13 years after it was introduced. A change in the Bank’s charges and internal operations in response to consumer complaints brought the issue to light. CIBC self-reported the issue to FCAC Staff in January 2017.

14. In July 2017, during the course of the investigation by FCAC Staff, it was determined that the disclosure of the calculation of credit insurance premiums and of interest were also at issue.

Remediation

15. CIBC implemented an interim system change in February 2017 that reversed over-limit fees related to the Posting Delay. As a result of system limitations, this interim solution applied to all payments—not just Verified Payments.

16. In November 2017, CIBC implemented an interim solution to address any credit insurance premium overcharge and reimbursed such charges, including any related interest.

17. In June 2018, CIBC implemented a permanent solution that prevented over-limit fees from being charged in most cases. However, its disclosure statement remained the same. CIBC also retained the interim solution (reversing the over-limit fee charged) for those remaining cases where an incorrect charge was possible.

18. In September 2018, CIBC implemented amendments to the cardholder agreement with information on when payments are posted to the cardholder’s account.

19. Through a remediation plan that satisfied FCAC Staff, CIBC has refunded any over-limit fees and credit insurance premiums charged in error to those cardholders affected from February 2003 to the implementation of the interim solutions (February 2017 for over-limit fees and November 2017 for credit insurance premiums). In addition, CIBC agreed to reimburse additional amounts relating to interest charges and to compensate for opportunity costs resulting from these charges.

20. The remediation plan covered 1.3 million accounts, and CIBC paid refunds, interest and opportunity costs amounting to $65.4 million in total. These amounts do not include amounts reversed subsequent to the implementation of the interim solution (766,340 accounts and $22.2 million for over-limit fees; 398,575 accounts and $2.2 million for credit insurance premiums).

21. CIBC refunded cardholders by credit to their account or by cheque. The average amount refunded was approximately $50 per account. Any uncashed cheques followed procedures for unclaimed balances and any amounts owing to untraceable account holders were contributed to a recognized charity.

Analysis and Decisions

22. My analysis is organized by violation. First, I determine whether the record supports a finding that a violation has occurred on a balance of probabilities and can be maintained as alleged. Next, I review the penalty proposed and exercise my authority to decide whether to impose the amount proposed, a lesser amount, or to impose no penalty. Finally, I consider whether to make public the name of the Bank, together with the nature of the violations and the amount of the penalties imposed.

Analysis of the Alleged Violations

Violation #1—Over-limit fees

23. Violation #1 engages the disclosure requirements under subsection 12(1) of the Regulations relating to over-limit fees. Subsection 12(1) reads as follows:

12(1) A bank that enters into a credit agreement for a credit card must provide the borrower with an initial disclosure statement that includes the following information in addition to that required by paragraphs10(1)(a) and (c) to (k): […]

24. When a bank enters into a credit agreement for a credit card, subsection 12(1) of the Regulations incorporates the requirements in paragraph 10(1)(c) of the Regulations and provides that the initial disclosure statement must include information on “the nature and amount of non-interest charges”.

25. CIBC does not dispute that, as a result of the Posting Delay, the processing of Verified Payments did not match the disclosure in the credit agreement, and that cardholders were erroneously charged over-limit fees between February 2003 and June 2018. Violation #1 is accordingly maintained.

Violation #2—Insurance premiums

26. Violation #2 engages the disclosure requirements under subsection 12(1) of the Regulations relating to optional services such as insurance.

27. When a bank enters into a credit agreement for a credit card, subsection 12(1) of the Regulations incorporates the requirements in paragraph 10(1)(i) of the Regulations, and provides that the initial disclosure statement must include:

10(1)(i) information about any optional service in relation to the credit agreement that the borrower accepts, the charges for each optional service and the conditions under which the borrower may cancel the service if that information is not disclosed in a separate statement before the optional service is provided;

28. The Bank does not dispute that the Posting Delay similarly affected the calculation of premiums for the optional credit insurance product from February 2003 until September 2018 in a manner that was not consistent with the disclosure. Violation #2 is also maintained.

Violations #3 and #4—Interest charges

29. Violations #3 and #4 allege the Bank’s non-compliance with two separate requirements for the disclosure of interest charges to a cardholder. As such, I will address them together.

30. The first requirement relates to the disclosure of information on the calculation of interest charges. Specifically, subsection 12(1) of the Regulations provides that when a bank enters into a credit agreement for a credit card, the initial disclosure statement must include the information in paragraph 10(1)(f) of the Regulations, namely:

10(1)(f) the date on and after which interest accrues and information concerning any grace period that applies; […].

31. The second requirement is under subsection 6(4) of the Regulations:

6 (4) Any disclosure that is required to be made by a bank under these Regulations must be made in language, and presented in a manner, that is clear, simple and not misleading.

32. Since February 2003, as a result of the Posting Delay, cardholders making a payment close to the end of a billing cycle would be charged interest on that month’s statement as though a payment had not been made.

33. In contrast to the over-limit fees and the insurance premiums discussed in Violations #1 and #2, in these circumstances, the system automatically reversed the interest charge on the next billing statement. This difference is the result of the fact that interest is calculated based on the transaction date rather than the posting date.

34. CIBC disputes the FCAC Staff’s allegation that interest was charged in error and that the cardholder disclosure was inadequate to reflect this circumstance.

35. The Bank asserts that no error or breach occurred because the interest charge was reversed on the next month’s statement. CIBC asserts that this circumstance reflected known system limitations, not an error. The calculation of interest was based on the information available at the time (i.e. not capturing payments made but not posted to the account) but “looked back” in the next cycle to identify these payments and the new calculation included a reversal of the previous interest charge.

36. CIBC points to the following paragraph in the cardholder agreement in question as evidence of adequate disclosure of a charge and subsequent reversal being a possible outcome depending on payment method and timing:

”Payments made by cash or cheque will be subject to customary hold periods. Your available credit and your available cash may not be adjusted to reflect your payment until a few days after your payment is received. In certain cases, a payment which is received by us by the payment due date may not be reflected on your next monthly statement, but it will be updated on the following monthly statement”.

37. I find that the inaccurate disclosure, which was uncontested by CIBC with respect to Violations#1 and #2, also resulted in inaccurate disclosure relating to interest charges. CIBC does not dispute that the interest should not have been charged and acknowledges the potential for confusion as a result of the more specific disclosure related to Verified Payments.

38. The main difference between Violations #1, #2 and #3, #4 is in the degree of harm to the cardholders. In the case of interest charges, the system incorporated an automatic remedy to reverse the charges on the next statement when payments were made but not appropriately captured as at the statement date.

39. This difference is not relevant to my analysis on whether a breach has occurred. This remedy cannot be used as evidence that the cardholder disclosure was compliant and suitable to capture the circumstances created by the Posting Delay.

40. Similarly, the fact that the disclosure was sufficiently vague to allow for it to be put forward as informing the cardholder of a delay in processing that had not yet been identified by CIBC is not a compelling argument in favour of it being clear, simple and not misleading.

41. I agree with FCAC Staff that the disclosure on interest charges does not meet the requirements in subsections 12(1) and 6(4) of the Regulations. Accordingly, Violations #3 and #4 are maintained.

Violation #5—Monthly statements

42. Violation #5 refers to the information requirements that apply to banks for supplementary (i.e., monthly) disclosure. To comply with subsection 12(5) of the Regulations, a bank must provide a supplementary disclosure statement at least once per month that accurately sets out the required information elements, including the over-limit fees and interest payable.

43. Subsection 12(5) of the Regulations reads in part as follows:

12 (5) Subject to subsections(8) and (9), a bank that issues credit cards must provide borrowers with supplementary disclosure statements on a regular periodic basis, at least once a month, that disclose the information referred to in paragraphs10(3)(a) and (d) to (h) and that, in addition, contain the following information:

(a)an itemized statement of account that describes each transaction and discloses each amount credited or charged, including interest, and the dates when those amounts were posted to the account;

(b)the amount that the borrower must pay, on or before a specified due date, in order to have the benefit of a grace period;

(c)the sum for payments and the sum for purchases, credit advances and interest and non-interest charges; […].

44. As a result of the Posting Delay, the monthly cardholder statements provided from February 2003 to September 2018, reflected incorrect information regarding the over-limit fees, insurance premiums, interest charges and minimum payments, contrary to subsection 12(5) of the Regulations.

45. This is not in dispute, nor has CIBC put forth any representations related to this matter. Violation #5 is therefore maintained.

Analysis on the Penalty Amount

46. In considering the penalties for each violation, the relevant factors to consider are set out in section 20 of the Act, namely the degree of intent or negligence, the harm done, and the Bank’s history of prior violations.

47. FCAC Staff recognized the full remediation of all erroneous charges and fees, including interest and opportunity costs to as many customers as possible. FCAC Staff acknowledged that CIBC engaged a third party and expended considerable human and financial resources to identify the affected customers as far back as 2003.

48. FCAC Staff also acknowledged CIBC’s good compliance history in that there have been no prior violations within the past five years.

49. CIBC points to the self-identification and the unintentional nature of the root cause which led to the breaches, along with its demonstrated commitments to its regulatory obligations and to improving its processes and controls. In addition, CIBC highlights that it expended considerable financial and human resources in implementing interim solutions and in rectifying the underlying issue, as well as reimbursing any financial harm, including interest and opportunity costs.

Violation #1—Over-limit fees

50. FCAC Staff have proposed a penalty of $450,000 for this violation citing the level of financial harm to cardholders, the degree of negligence as indicated by the long duration of the breach—13 years—and the failure of the control mechanisms, for which CIBC is responsible, in identifying this issue earlier. Specifically, prior to the interim solution put in place as of February 7, 2017, $42.4 million in over-limit fees, interest and opportunity costs were incorrectly incurred by cardholders, covering 677,807 accounts. Subsequent to the implementation of the interim solution, the erroneous charges continued, but were reversed until a permanent solution and disclosure changes were implemented in September 2018 ($22.2 million over-limit fees and 766,340 accounts from February 2017 to May 2018).

51. CIBC made no specific representations regarding the proposed penalty in relation to Violation #1.

52. I have identified no reason for reducing the amount of the penalty proposed and therefore it stands.

Violation #2—Insurance premiums

53. FCAC Staff have proposed a penalty of $400,000 for this violation, citing the level of financial harm to cardholders, the degree of negligence as indicated by the long duration of the breach and the failure of the control mechanisms, for which CIBC is responsible, in identifying this issue earlier. Prior to the interim solution put in place as of November 2, 2017, $22.9 million in insurance premiums, interest and opportunity costs were incorrectly incurred by cardholders, covering 914,435 accounts. Subsequent to the implementation of the interim solution, the erroneous charges continued but were reversed until a permanent solution and disclosure changes were implemented in September 2018 ($2.2 million credit insurance premiums and 398,575 accounts from November 2017 to May 2018).

54. CIBC made no specific representations regarding the proposed penalty in relation to Violation #2.

55. I have identified no reason for reducing the amount of the penalty proposed and therefore it stands.

Violations #3 and #4—Interest charges

56. FCAC Staff have proposed a penalty of $150,000 for each of Violations #3 and #4, citing an unspecified level of non-financial harm to cardholders, the degree of negligence as indicated by long duration of the breach and the failure of control mechanisms in identifying the issue earlier. In addition, FCAC Staff cite, as an aggravating factor, the fact that the issue of interest charges and reverses was not identified by CIBC. FCAC Staff assert that this raises concerns about CIBC’s awareness of its regulatory requirements and, along with the resultant lack of self-reporting, demonstrates negligence.

57. CIBC disputes these assertions and requests a reduction in the amount of the penalty to the extent that it was based on the allegation of negligence. CIBC asserts that all issues were self-reported as they stem from the same root cause. CIBC also asserts that taking a different interpretation than FCAC Staff on whether or not a breach has occurred is not an indication of lack of awareness of regulatory responsibilities or an indication of negligence.

58. Finally, CIBC questions the validity of the FCAC Staff’s position on the issue of non-financial harm to cardholders. Specifically, FCAC Staff argued that although there was no financial harm to cardholders, they did have to “contend with” interest charges that should not have been made. CIBC does not agree that “contend with” equates to harm.

59. I disagree with the CIBC position that no financial harm equates to no harm at all. The purpose of clear, simple and not misleading disclosure is to provide cardholders with reliable information to manage their affairs properly. Unanticipated charges, even if they are reversed, can only serve to confuse this information and may create challenges for cardholders that we cannot foresee.

60. I agree with FCAC Staff that negligence is evident in the long duration of the breach and the failure of the control mechanisms in identifying this issue earlier. I agree with CIBC that a financial institution has every right to defend itself against allegations and may reasonably and in good faith present their view of the facts that is different than FCAC staff.

61. Regulated entities are expected to be aware of and to report their compliance issues. However, in these circumstances, I am not convinced that FCAC Staff have demonstrated an additional degree of negligence that would affect the penalty amount.

62. I therefore find it appropriate to decrease the penalty to reflect this assessment and have reduced the amount to $125,000 for each of Violation #3 and #4.

Violation #5—Monthly statements

63. FCAC Staff have proposed a penalty of $125,000, citing the large number of accounts impacted (over 1 million) and the 13-year span of the breach as the factors in determining the amount.

64. CIBC made no representations regarding the penalty amount.

65. I have identified no reason to reduce the amount of the penalty proposed, therefore the penalty stands.

Publication

66. The last issue for decision is whether to make public the name of the Bank, together with the nature of the violations and the amount of the penalties imposed.

67. In its Representations, CIBC asserts that it has satisfied the factors to consider when deciding not to publish the name of the bank. Namely, CIBC asserts that it has taken responsibility for the breach, demonstrated a commitment to learn from the non-compliance and dedicated considerable resources to improve its processes and operations. In addition, CIBC states that naming is not necessary for deterrence as the financial and non-financial costs incurred by CIBC to remediate serve as ample deterrence. Finally, CIBC points to the damage it may incur to its reputation and its public trust through publication.

68. I have considered the factors raised by CIBC. I acknowledge that CIBC self-identified misconduct, remediated customers, and demonstrated commitment to process improvements.

69. It is important for consumers to know that when issues arise, appropriate investigations occur and regulatory standards are upheld. Consumers should also be aware of the types of issues that can occur and why they must be diligent in verifying their statements, charges and fees. I note here that it was as a result of client complaints regarding unanticipated charges that this issue was originally identified.

70. Full publication can also serve as specific and general deterrence by incentivizing banks to invest appropriate resources in their control processes to identify issues earlier, especially as it relates to systems’ changes.

71. Finally, I note that CIBC has communicated publicly with its customers regarding this issue and has made every effort for full restitution. As such, I am not convinced that the impact of publication on the Bank’s reputation will be significant.

72. It is my view that the publication of these facts will enhance the understanding of consumers that when errors occur, restitution is made, and appropriate standards are maintained.

73. On balance, therefore, I have determined to make public the name of the Bank, together with the issues raised by these violations, and the penalty amounts.

Judith N. Robertson
Commissioner
Financial Consumer Agency of Canada

Ottawa, June 15, 2020