Decision #139

Commissioner’s decision and reasons

Summary

1. By notice of violation issued on May 6, 2019, in accordance with subsection 22(2) of the Financial Consumer Agency of Canada Act (Act), staff of the Supervision and Enforcement Branch of the Financial Consumer Agency of Canada (FCAC Staff) allege that the Royal Bank of Canada (RBC or Bank) committed a violation of the Credit Business Practices (Banks, Authorized Foreign Banks, Trust and Loan Companies, Retail Associations, Canadian Insurance Companies and Foreign Insurance Companies) Regulations (Regulations) in relation to credit card limit increases (Notice of Violation).

2. Specifically, and as discussed more fully in the compliance report issued on April 12, 2019 and attached to the Notice of Violation (Compliance Report), FCAC Staff allege that from February 1, 2015 to March 16, 2017 (the dates covered by the FCAC investigation), the Bank failed to obtain the express consent of certain credit card holders to increase their credit limits as required under the Regulations.

3. In representations dated June 6, 2019 (Representations), the Bank accepts that FCAC’s investigation identified specific instances where consent did not occur as required. However, RBC submits that it exercised all reasonable steps to prevent this violation and seeks to avail itself of the due diligence defence under section 28 of the Act. In addition, RBC submits that in the event that a violation is found to have occurred, the proposed penalty amount of $350,000 should be reduced to $175,000 to reflect its view of a lesser degree of negligence and harm. Finally, the Bank objects to its name being made public.

4. Consequently, the issues for decision in this case are whether to (i) find that a violation has occurred as alleged in the Notice of Violation; ii) impose the penalty amount proposed, a lesser amount or no penalty; and (iii) make public the name of the Bank in accordance with section 31 of the Act.

5. I have considered the record before me, including the Compliance Report, the Notice of Violation and the Representations. I have determined, on a balance of probabilities, that the violation occurred as alleged. I have identified no reason to reduce the amount of the penalty proposed in the Notice of Violation, therefore it stands as proposed at $350,000. I have also decided that making the name of the Bank public in this case would be appropriate. My reasons follow.

Background

6. As part of its regular supervisory activities, in May 2017, FCAC requested complaint information from RBC relating to express consent for various retail banking products.

7. FCAC reviewed the complaint information and ultimately focused its investigation on pre-approved credit card limit increases.

8. Pre-approved credit card limit increases are offered to eligible customers through various channels, typically as part of an unrelated customer interaction. RBC employees in the branch or on the phone were alerted to a customer’s eligibility for a pre-approved credit limit increase through their client management systems. RBC employees were expected to monitor the client management system for this type of alert and offer the pre-approved credit limit increase while engaging with the customer. The RBC employee would process the increase immediately and a written confirmation letter would be automatically sent to each customer.

9. Subsection 6(1) of the Regulations states:

An institution may not increase the credit limit on a borrower’s credit card account without first obtaining the borrower’s express consent to do so.

10. FCAC’s investigation focused on whether consent was properly obtained for pre-approved credit limit increases offered in branches or over the phone and applied to cardholders’ accounts between February 1, 2015 and March 16, 2017.

11. FCAC Staff reviewed RBC’s control framework, including sales procedures, training materials and oversight policies and practices relating to pre-approved credit limit increases and found that:

i. The sales procedures for both in-branch and phone-channel sales did not include scripts to guide the employee on how to present the offer or how to properly obtain the customer’s consent. FCAC Staff found that the procedures did not present the regulatory requirement for express consent and did not capture the expectation that the offer be presented clearly and simply, with a clear explanation and a clear request to either accept or decline the offer.

 ii. RBC’s training manual in place at the time for pre-approved credit limit increases was also inadequate as it contained only one reference to express consent, which related to joint cards.

iii. RBC’s sales and cancellation tracking capabilities hampered the effectiveness of RBC’s control framework. RBC was unable to identify the channel through which 21% of pre-approved credit limit increases were sold or to capture the reasons for cancellations for pre-approved credit limit increases, thus limiting the Bank’s ability to investigate and identify issues in a proactive manner.

12. FCAC Staff also reviewed escalated complaint records, sample call recordings and cancellations relating to pre-approved credit limit increases during this period. FCAC found that:

i. 40 in-branch sales and 14 phone-channel sales resulted in reportable complaints^{Footnote 1}  where the customer stated that they did not provide consent or could not recall providing consent to the pre-approved credit limit increase.

 ii. Of the 13 originating call transcripts reviewed relating to the phone-channel escalated complaints,^{Footnote 2} in 2 instances the customer refused the offer, in 2 instances consent was not obtained from both cardholders on joint accounts and in 8 instances the RBC employee did not clearly request the customers’ consent to apply the pre-approved credit limit increase.

iii. A review of a sample of 118 call recordings relating to early cancellations^{Footnote 3}  of pre-approved credit limit increases sold in-branch showed that 96 customers stated they had not consented to the limit increase and an additional 12 did not recall this discussion.

iv. A review of a sample of 118 call recordings relating to early cancellations of pre-approved credit limit increases sold over the phone showed that 34 customers stated they had not consented to the limit increase and an additional 10 did not recall this discussion.

v. A review of 44 of the originating call recordings relating to the phone channel cancellations highlighted in (iv) above showed that in 39 of the calls the RBC employee did not obtain consent, according to FCAC, while in 5 the RBC employee did obtain consent.

13. As a result of the investigation findings summarized in the preceding paragraph, and the deficiencies in the control framework summarized in paragraph 11, FCAC Staff concluded that there were reasonable grounds to believe that RBC had breached subsection 6(1) of the Regulations.

14. In its Representations, RBC agrees that the Regulations require express consent by the credit cardholder for any credit limit increase, but also highlights that the Regulations neither prescribe how verbal consent is to be obtained nor provide a definition of express consent. 

15. It is RBC’s view that its policies and procedures in place at the time of the relevant period did, in fact, adequately cover the requirement for express consent. As evidence, RBC provides a reference from the training manual for the phone channel in force at the time that states the requirement for authorization and/or consent of both the primary and the co-applicant in the case of a joint account.

16. In several instances, RBC came to a different conclusion than FCAC Staff when reviewing call recordings and transcripts as to whether the RBC employee had presented the offer clearly and had correctly obtained the customer’s consent. 

17. RBC recognizes that the lack of a prescribed script may have allowed an opportunity for error in certain cases and that this error would be evidence of a potential gap in RBC’s prevention and detection controls. However, RBC is of the view that any error of this nature would have occurred in contravention of the instructions it provided to its employees and the policies and procedures that it put in place. 

18. In addition, RBC points out that a written confirmation was sent automatically following each pre-approved credit limit increase, as required by the Regulations for oral consent. It is RBC’s view that this written confirmation forms part of RBC’s control framework as it serves to inform customers of any increases to their credit limit and therefore acts as an additional protection against credit limit increases being implemented without customer knowledge and consent.

19. Finally, RBC’s view is that the concept of express consent has evolved since the Regulations came into force on January 1, 2010. RBC states that it recognized the potential to improve its process for obtaining consent for pre-approved credit limit increases as early as November 2016 and implemented significant enhancements in April 2018, as noted by FCAC Staff. In RBC’s view, these improvements demonstrate the Bank’s commitment to compliance and on-going due diligence.

20. As a result, RBC believes it exercised all reasonable steps to comply with the Regulations, has demonstrated its commitment to continuing to improve, and invokes the due diligence defence under section 28 of the Act.

Analysis and conclusion

21. I have reviewed the record before me, including the Notice of Violation, the Compliance Report, and the Representations.

22. While RBC does not dispute that instances of a failure to obtain express consent were discovered by the FCAC investigation, they dispute that those instances give rise to a violation. RBC asserts that it took all reasonable steps to ensure compliance both through the preventative measures taken (policies and procedures) and the corrective action taken when customers complained of an unauthorized credit limit increase (the credit limit increases were reversed).

23. I agree that isolated instances of non-compliance do not necessarily lead to violation proceedings. However, the clear purpose of the Regulations is that no customer should find themselves with an increase to their credit limit without their explicit consent, no matter how advantageous it may appear to others. 

24. The requirement for express consent cannot be satisfied by a lack of objection or an apparent acquiescence. It is the obligation of the regulated entity to ensure that the customer has the relevant information regarding the proposed credit limit increase, is presented with an offer in a form that is clear, simple and not misleading and is given the opportunity to accept or decline the offer.

25. I am also not persuaded that RBC’s assertion of an evolving standard for express consent is a relevant factor to consider. I note that the requirement for express consent of credit limit increases has been in force since 2010. In 2011, through CG-5, Consent for increases in credit limits, FCAC provided additional guidance on acceptable methods of obtaining consent. FCAC outlined that the intent of the Regulations was to limit practices that were deemed not to be beneficial to consumers and stated that the requirement for express consent allows consumers to be more informed about their credit situation and, therefore, make better financial decisions. 

26. I find no ambiguity in the expression of the Regulations or in the guidance offered by FCAC. FCAC and other regulators routinely offer reminders and examples of compliance best practices through supervisory communications with financial institutions, as in Bulletin 5, Consent for New Products or Services, February 3, 2017. This is not an indication of an evolving standard, but of routine regulatory oversight practises.

27. The basis of the due diligence defence recognizes that the required standard of compliance is not perfection. However, it is well-settled that in order for the defence to apply, regulated entities must provide affirmative proof that they took all reasonable steps to achieve compliance.^{Footnote 4}  The threshold for proving the defence is high. 

28. In this case, it is clear to me that the steps taken by RBC fell short in several areas.

29. First, the weakness of the RBC preventative measures is apparent from a review of the training material, call recordings, transcripts, and other documentation. There was a failure to consistently establish the requirement for consent as being a regulatory requirement in both sales channels and for all customers and a failure to set out clearly how RBC employees were to demonstrate compliance. 

30. In some of the cases reviewed, the credit limit increase was not discussed at all.  In other cases, the pre-approved credit limit increases were presented as a ‘fait accompli’ or as a benefit for being a good customer. Customer reactions of “hmm” and “okay” were accepted as consent. This only positive positioning shows no appreciation for the regulatory intent of requiring express consent—that having access to additional credit is a serious matter for the customer to consider, requiring appropriate information and a clear decision of ‘yes’ or ‘no’.

31. The weakness in preventative measures is also demonstrated in the relatively high instances of non-compliance found in the samples of early cancellations examined. Of the sample of 118 pre-approved credit limit increases that were subject to early cancellation, in 81% of those sold in-branch and in 33% of those sold over the phone, the customer stated that they had not consented to the increase.^{Footnote 5}

32. Second, the control measures RBC had in place to detect non-compliance were inadequate. RBC did not focus on compliance with express consent when monitoring calls or spot checking pre-approved credit limit increases. It appears that the Bank relied on the generation of the confirmation letter to trigger a customer complaint as the primary detection method. While the confirmation letter is required by the Regulations for oral consent, and is an important consumer protection, it should be a supplement to, and not a substitute for, the active oversight and supervisory efforts of a regulated entity. 

33. Further, even when RBC was presented with evidence of non-compliance through customer complaints, RBC’s response in most cases was to simply reverse the credit limit increase. Based on the transcripts reviewed, there appeared to be no consistent mechanism to ensure that the instances of failure, when revealed, triggered action to correct employee behaviour and promote future compliance. In only a small minority of the cancellation calls was there an indication that further action would be taken to identify and remediate this failure in the regulatory obligation to obtain consent. 

34. The onus should not fall to the customer to identify and reverse a credit limit increase that they did not initiate or consent to.

35. RBC did not track the lack of consent as a reason for cancellation, so it could not investigate further in a systematic way. This weakness persisted at the time of the Notice of Violation. The lack of root cause investigation, analysis and testing for systemic issues also raises concerns regarding the effectiveness of RBC’s compliance programs with regard to express consent in this product.

36. As a result, I am of the view that the evidence presented by RBC is not sufficient to support the defence of due diligence in this case. Therefore, I have determined that, on a balance of probabilities, a violation occurred as alleged in the Notice of Violation.

Penalty amounts

37. In considering the penalty amount proposed for the violation, the relevant factors to consider are set out in section 20 of the Act, namely the degree of intent or negligence, the harm done, and the Bank’s history of prior violations.

38. In its Representations, RBC requests a reduction in the proposed penalty amount from $350,000 to $175,000. In support of this request, RBC disputes the degree of negligence or intent as well as the extent of harm as presented in the Notice of Violation.

39. With regard to the factor of intent or negligence, FCAC Staff point to RBC’s lack of appropriate controls to prevent and detect this breach. RBC highlights as mitigating factors its culture of compliance and its commitment to a strengthened control environment regarding express consent. Specifically, RBC highlights the initiation of scripts, reviews, and monitoring in April 2018, as acknowledged by FCAC Staff. They point out that the identification of the need for improvement had started prior to the FCAC review.

40. In addition, RBC committed to a remediation plan where all cardholders would be advised of their current credit limit and provided the opportunity to change, thereby ensuring there was no lack of knowledge. Further, RBC states that they have made good faith efforts to address the client issues raised through the complaint process. 

41. While I agree that there is no evidence of RBC intentionally disregarding the regulatory requirement of obtaining consent for pre-approved credit limit increases, the identified weaknesses in their preventative controls and the shortcomings of their detection and corrective controls indicate negligence in meeting their regulatory obligation. In particular, the lack of consistent further compliance action as a result of issues identified through complaints supports this finding.

42. Turning to the factor of harm, as has already been discussed, it is not possible to precisely identify all clients who did not provide consent. RBC’s data is lacking as they do not record the reasons for cancellations and have not provided other research to ascertain the full extent of potential non-compliance.

43. FCAC Staff attempted to quantify the potential number of customers affected by identifying the total number of sales of credit limit increases during this period and inferring the number of these that could have been harmed by RBC’s failure to obtain consent by applying the same percentage of non-consent found in the sample of early cancellation calls.

44. RBC believes that the results of this sample are not representative of the total population of credit limit increases and therefore do not demonstrate a systemic problem. 

45. RBC points out that the number of early cancellations, regardless of the reason, was a small fraction of the total number of credit limit increases sold and is inherently a skewed sample—because early cancellations can reasonably be expected to be more likely initiated by customers who did not consent to the increase.^{Footnote 6}  Further, RBC points to the fact that total sales of credit limit increases would have included client-initiated increases that should be excluded from the analysis as consent can be assumed in these cases.

46. The use of a sample is a well-established method of identifying issues, especially, as in this case, where RBC is unable to provide the complete data, such as the reasons for cancellations. In general, extrapolating the results of the sample to the population from which the sample was taken is also an appropriate methodology to determine the potential scale of an issue. 

47. In my view, the number of potentially affected customers revealed through a conservative analysis of the sample of early cancellations is a serious enough level of harm to warrant consideration of the penalty amount proposed even without the extension to the total population of credit limit increases sold.

48. If one applies the percentage of non-compliant cases by sales channel to only the early cancellations during the review period it would result in a potential of approximately 700 in-branch sales and 10,000 phone-channel sales that may have been cancelled as a result of non-consent.^{Footnote 7}  The hypothetical addition of those that may have been affected but did not notice, complain, or cancel, of which there were undoubtably some, is not strictly necessary to conclude that a level of harm occurred that is sufficient to warrant the consideration of this penalty amount.

49. As for the degree of harm experienced by each customer, FCAC Staff points to the potential for both financial and non-financial harm resulting from increasing the credit limit without the customer’s knowledge or consent. While acknowledging that there is no initial cost for an increased credit limit, FCAC Staff asserts that customers may have been exposed to higher credit card balances, interest, and other charges as well as a negative impact on their credit score, as a result of the unauthorized credit limit increase. FCAC Staff highlights that some complaining customers stated that they deliberately chose not to have access to additional credit in order to better manage their finances.  

50. RBC disputes that customers lacked knowledge of a credit limit increase and points to the confirmation letter that was automatically sent in each instance. RBC also disputes a direct causal link between the lack of express consent and financial harm in this case. According to RBC, whether the customer experiences increased fees or interest is dependent on additional factors, under the control of the customer, that are independent of the credit limit. In addition, RBC asserts that an increased credit limit can also have a positive financial impact, for example, the customer may avoid over-limit fees. 

51. I agree that the extent of harm for an individual customer cannot be readily estimated. However, this individuality of circumstance demonstrates the importance of express consent. As the complaint calls show, what may be a positive feature for one may present an unwelcome burden to another. Therefore, those customers whose express consent was not obtained have experienced a degree of harm particular to their circumstances.

52. It is also reasonable to estimate that there would be a corrosive effect on the customer’s confidence in the Bank and the banking system when their right to express consent is not respected. This is contrary to RBC’s assertion of there being no on-going impact to the customer whose unauthorized limit increase was reversed.

53. The investigation covered a period of two years and the samples taken were random but evenly distributed, leading me to conclude the problem was longstanding. RBC’s compliance history with FCAC reveals one previous violation in the past five years.

54. In light of the above analysis of the relevant factors, I have found no reason to reduce the proposed penalty amount and find it appropriate to encourage compliance. The penalty amount stands as proposed.

Publication

55. I now turn to the matter of the exercise of my discretion to make public the name of the Bank. RBC objects and raises the concern that publication of its name would have a damaging effect on its reputation and on the confidence customers have in its compliance programs.

56. RBC highlights its remediation plan of contacting all clients, its extensive improvements in its policies and procedures to ensure compliance and its recognition of the need for enhanced monitoring and testing. In addition, RBC asserts that publication is not necessary to promote compliance and would be disproportionate and excessive in this case. 

57. I have considered the Bank’s Representations relative to this issue and note that while RBC was responsive to FCAC during the investigation, they did not self-identify this issue.

58. It is my view that publication would serve to encourage RBC to continue its program of compliance improvement and enhance its ability to prevent and detect future non-compliance.

59. I am also of the view that any potential negative impact on the Bank’s reputation is outweighed by the positive impact of transparency and clear regulatory response on consumer confidence in Canada’s banking system and consumer protection.

60. As a general deterrent, publication will also serve to increase the understanding of the importance of the requirement for express consent within the financial community and amongst consumers.

61. Therefore, I conclude that it is appropriate to exercise my discretion in this case to make public the name of the Bank together with the nature of the violation and the penalty amount.

Judith N. Robertson
Commissioner
Financial Consumer Agency of Canada

Ottawa, December 15, 2020