Decision #127

Commissioner’s reasons for decision

(Financial Consumer Agency of Canada Act subsection 23(2))

This decision concerns non-compliance by the Bank with the requirement that the cost of borrowing be expressed as an amount in dollars and cents set out in the Bank Act and the Cost of Borrowing (Banks) Regulations (Regulations). 

In October 2016, the Deputy Commissioner of the Financial Consumer Agency of Canada (FCAC or Agency) issued a Notice of Violation to the Bank, alleging reasonable grounds to believe that from September 2001 to November 2015, the Bank failed to provide borrowers with accurate disclosure of the cost of borrowing as an amount in dollars and cents on fixed and variable interest rate mortgages and loans, and renewals of same. A proposed penalty was assessed at $100,000. The Notice of Violation also provided that the Bank had 30 days to make representations, as contemplated in subsection 22(2) of the Financial Consumer Agency of Canada Act (Act). 

In its representations dated November 2016 (Submission), the Bank takes the position that this matter related to a self-reported deficiency that resulted in limited harm to consumers and that it took active steps to identify and remediate same. The Bank relies on this argument and its compliance history and asks that I set aside the finding of violation and penalty.  

The facts relevant to this matter are not in dispute. Having considered the evidence, including the Submission, I find that, on a balance of probabilities, the Bank has committed the violation that it self-reported as a deficiency in October 2014. I am also satisfied that the penalty proposed in the Notice of Violation of $100,000 should stand. My reasons are as follows.

Factual background

I draw from the facts set out in detail in FCAC’s Compliance Report of September 2016, and in the Submission to briefly outline the factual background to this matter.  

From September 2001 to November 2015, the amount of the cost of borrowing in the Bank’s statement of disclosure to borrowers for mortgages and loans was lower than the amount that ought to have been disclosed to borrowers based on the Bank’s system which calculates and accrues the actual cost of borrowing. 

The Bank’s back-end processing system – that calculates and accrues the actual interest to a borrower’s mortgage or loan account – credits payments made subject to an exception: payments made to an account on a non-business day are only applied on the next business day. However, the Bank’s disclosure statement featured an amount for the cost of borrowing that was calculated based on payments being credited to the borrower’s account on the date made, without exception. As a result, interest was charged to borrowers’ accounts in a manner inconsistent with the Bank’s disclosure. 

More than [text omitted] accounts have been affected. The exact number of accounts cannot be determined as the Bank’s information retrieval capacity only goes back to January 2006, with the result that the period between September 2001 and December 2005 remains unaccounted for.  

The Bank has estimated that the maximum financial impact (and compensation amount) for the period between January 2006 and November 2015 is $2,048,605. The remediation plan is being implemented in two phases. The payout for Phase I is $845,250 and $1,203,355 for Phase II.

Relevant provisions

The Bank Act provisions relevant to my analysis are as follows:

The Regulations prescribe that the cost of borrowing must be expressed as an amount in the case of fixed interest loans for a fixed amount per paragraph 8(1)(d), variable interest loans for a fixed amount per subsection 9(1) and any renewal of same per subsection 14(1).

Preliminary considerations

I note, at the outset, that the Bank self-reported the matter as a disclosure discrepancy and properly indicated that the obligations under sections 450 to 452 of the Bank Act, and related Regulations, were engaged.

The Deputy Commissioner considered the evidence on the affected lending products and decided to issue a single violation against the Bank. I agree to proceed on this basis though the evidence before me could be sufficient to support separate violations of paragraph 8(1)(d), subsections 9(1) and 14(1) of the Regulations. 

Analysis and Conclusions

As I understand it, the Bank has asked that I reconsider the finding of violation and the penalty on the grounds that: (i) the self-reported deficiency has caused limited harm to consumers; (ii) active steps were taken to identify and remediate the deficiency; and (iii) the Bank’s history of compliance. It has also requested that I not make public its name pursuant to section 31 of the Act, on the basis that there is a risk of significant damage to its reputation that could undermine consumer confidence in its compliance framework. I consider each of these issues in turn.

The violation

In its Submission, the Bank provides an analysis of the financial harm to those mortgage and loan account holders that are part of the post January 1, 2006 group of affected consumers and explains the strategy of rounding up the compensation amount payable under Phase I and Phase II of the remediation plan. The Bank concludes that the actual harm to most affected consumers (i.e., the harm in monetary terms) has not been significant. 

At the same time, the Bank admits that the deficiency was not detected for nearly 13 years through normal system testing; this is despite system updates or changes.  The bank attributes this to the amount of the variance in the cost of borrowing amount being infinitesimal.  

There is little doubt that the Bank must comply with the disclosure requirements under the Bank Act, along with all other applicable consumer provisions. Breach of a consumer provision subjects a regulated entity to strict liability such that it can be found in violation, in accordance with the Act, absent a defence to excuse the non-compliance. Importantly, this is so, even where the harm done is limited. In Mega International Commercial Bank (Canada) v. Canada (Attorney General)^{Footnote 1}  (Mega), the Federal Court stated that:

I see no reason to approach this matter differently. The bank has provided inaccurate disclosure to well over [text omitted] accounts. From September 2001 to November 2015 (i.e., more than 14 years), the cost of borrowing amount disclosed has been different from that charged to borrowers as a result of the discrepancy between the calculators used by the Bank for disclosure versus processing purposes.

[text omitted]

In the absence of evidence of due diligence, I see no grounds for excusing the Bank for its non-compliance. Accordingly, I find that, on a balance of probabilities, the Bank has committed the violation in question.

The penalty

Turning to the issue of the amount of the penalty, I have considered the analysis in the Notice of Violation, including the Deputy Commissioner’s findings on negligence, harm done and history of compliance. In its Submission, the Bank has focused on the financial harm to consumers on an individual basis, concluding that it is limited. However, the aggregate amount of $2,048,605 in financial impact to the Bank’s consumers subject to remediation and the [text omitted] accounts affected are certainly not indicators of limited harm. 

Furthermore, the Bank asserts that despite the discrepancy in the amount, consumers’ ability to assess the cost of borrowing was not impaired. I am not able to follow such an assertion and caution that, as held in the Mega case, a breach of a consumer provision is sufficient harm for there to be a finding of violation. 

I also note that the Bank took more than a year to return to compliance after the deficiency was detected in August 2014. Furthermore, it took probing by FCAC before the Bank proceeded with its remediation plan; one that I recognize as financially appropriate in the circumstances. Based on these considerations, I see no reason to determine a lesser penalty and find that the penalty of $100,000 should stand.

Publication

The last issue for decision is whether to make public the name of the Bank. In its Submission, the Bank argues that given its past compliance history, customers rely on its commitment to having a robust and effective compliance program and stresses a risk of significant damage to its reputation that could undermine consumer confidence in its compliance framework, should I decide to make its name public. 

Furthermore, the Bank is of the view that the harming effect on its reputation would be excessive and disproportional to, inter alia, the nature of the deficiency involved, the limited degree of harm that it maintains is done and the careful remedial measures put in place.  

In deciding whether to make public the name of a regulated entity, I consider a number of factors, including the egregiousness of the entity’s actions or inactions, its willingness to assume responsibility for the breach and compensate affected consumers, the impact of the breach on consumers and consumer confidence, and deterrence. I also look at the degree of collaboration shown to FCAC throughout the investigative process and the regulated entity’s commitment to improving its management of risks against future breaches.  

Importantly, my analysis is premised on the principle that any exercise of my statutory discretion to make public the name of a regulated entity is necessarily coherent with the scheme designed by Parliament. As such, a resulting decision to make public would not be punitive or contrary to the enforcement principles underlying the Act. 

In this case, I am persuaded by the Bank’s argument that it relies greatly on its public trust and reputation in the financial marketplace and find that the violation and penalty serve as sufficient deterrence to help the Bank bolster its efforts to deliver on its stated commitment to having a robust and effective compliance program. I expect that, going forward, more will be done to more effectively control and test systems and design appropriate compliance programs to prevent future breaches. For these reasons, I am satisfied that it is appropriate to not make public the Bank’s name.

February 21, 2017

Lucie M.A. Tedesco
Commissioner