Decision #138

Commissioner’s reasons for decision

Summary

1. By notice of violation issued on April 11, 2019, in accordance with subsection 22(2) of the Financial Consumer Agency of Canada Act (Act), staff of the Supervision and Enforcement Branch of the Financial Consumer Agency of Canada (FCAC Staff) alleged that the Bank of Montreal (BMO or Bank) committed two violations of the Negative Option Billing Regulations (Regulations) in relation to BMO’s credit card balance protection product (Creditor Insurance).

2. Creditor Insurance is an optional insurance product that covers a customer’s credit card balance or monthly payments in certain circumstances. Banks are required by the Regulations to obtain a customer’s express consent before providing an optional product like Creditor Insurance. If the customer consents to the product orally, banks must provide the customer with confirmation in writing, without delay, of the customer’s express consent to purchase the product.

3. In the notice of violation, FCAC Staff alleged that from October 2014 until March 2017 the Bank failed to:

1. obtain express consent before providing customers with Creditor Insurance in accordance with subsection 3(1) of the Regulations (violation #1); and
2. provide customers written confirmation when consent to receive Creditor Insurance was provided orally in accordance with subsection 3(2) of the Regulations (violation #2).

The amount of the penalty proposed for violations #1 and #2 is $350,000 and $150,000, respectively.

4. On May 13, 2019, BMO paid the penalties proposed in the notice of violation, but made representations objecting to its name being made public in this case. By paying the penalties, BMO is deemed to have committed the violations. Therefore, the sole issue for decision is whether I should exercise my discretion under section 31 of the Act to make public the name of the Bank.

5. After considering the record before me, including the compliance report attached to the notice of violation and BMO’s representations dated May 13, 2019 (Representations), I am of the view that it is appropriate to make the name of the Bank public in this case together with the nature of the violations and the amount of the penalties. My reasons follow.

Factual background

6. I have relied on the following facts that describe the nature of the violations.

7. Creditor Insurance is an optional insurance product that provides payments in the event of death, critical illness, job loss or disability. Depending on the claim and subject to exclusions, the insurance company (in this case [text omitted]) would pay to BMO either the outstanding balance owing on a credit card or a monthly payment to cover the required minimum payment. As a result, the credit card would stay current and the cardholder’s credit history would be protected.

8. Between October 2014 and March 2017, BMO sold Creditor Insurance to 29,341 customers through its branches. Branch employees who sold Creditor Insurance were required to complete mandatory training, initially and at least once a year thereafter. The training was intended to impart the relevant knowledge regarding the product, the procedures, and the regulatory requirements.

9. On March 7, 2017, following media reports on improper sales of Creditor Insurance without consent, a customer complained to BMO branch personnel, and directly to BMO senior management, that Creditor Insurance had been sold by a BMO branch employee without that customer’s consent. BMO states that this was when it first learned of the issue and began its investigation. On May 8, 2017, BMO submitted a reportable compliance issue report to FCAC regarding employees failing to follow the Bank’s procedures for offering Creditor Insurance.

10. BMO conducted a sampling of Creditor Insurance product sales in several branches [text omitted]. BMO identified that 10 out of 19 employees (53%) did not follow Bank procedures and did not print the application and/or have the customer sign to demonstrate their receipt of disclosure and their confirmation of purchasing Creditor Insurance.

11. BMO branch employees maintained that they had properly received oral consent even when they did not follow the BMO procedures that required a signed application form. However, they could not produce any evidence to confirm that consent was received. Within 14-30 days of purchasing Creditor Insurance, each purchaser was mailed a certificate that contained the effective date of coverage, terms, limitations, and exclusions. BMO maintained that the certificates satisfy the requirement to provide each Creditor Insurance purchaser with confirmation in writing of their express consent, if given orally. FCAC Staff did not agree that the certificates satisfied the requirement for written confirmation of consent.

12. Responding to a request from FCAC Staff, BMO reviewed a sample of 40 Creditor Insurance applications and found that 24 (60%) were not signed by customers. Responding to further requests from FCAC Staff, BMO reported that 25% of Creditor Insurance purchases were cancelled within 1-180 days of activation. FCAC Staff reviewed 80 recordings of randomly selected cancellation calls and found that in 44 calls (55%) customers indicated that they had not consented to purchase Creditor Insurance and BMO could not produce signed application forms.

13. BMO initially contended that the root of the problem was a staff training issue, and that there was no evidence of a widespread or systemic issue. BMO ultimately conceded that “Based on the information and surrounding context, such as total sales, total cancellations, and reasons for cancellation, we believe that there likely have been isolated instances where customers did not consent to [Creditor Insurance].”

14. In March 2017, BMO turned off the Creditor Insurance sales prompt for branches, and [text omitted]. The Bank initiated several enhancements to its training and oversight systems to better monitor compliance with express consent regulatory requirements. In addition, BMO initiated one-time and ongoing customer communications to ensure that customers were aware they had purchased Creditor Insurance and to inform them of their right to cancel. Finally, BMO continued its policy of refunding premium payments to those customers who indicated that they had not consented to purchase Creditor Insurance.

Analysis and conclusion

15. BMO has paid the penalties proposed for the two violations, namely a total of $500,000. In so doing, the Bank is deemed to have committed the violations under the Act. Accordingly, the only issue for decision is whether to make public the name of the Bank together with the nature of the violations and the amount of the penalties. Section 31 of the Act grants me the discretion to do so.

16. In its Representations, BMO strongly opposes the publication of its name and views this to be unprecedented and unwarranted under the circumstances. The Bank puts forth several arguments to support its position that it should not be named.

17. BMO contends that the combined deterrent effect of violation proceedings, penalties, and the other actions it has taken mean that further deterrence is not required and would be punitive.

18. BMO asserts that FCAC’s statutory objectives to supervise and promote compliance with market conduct obligations have already been achieved as evidenced by BMO’s actions and its acceptance of further commitments which the FCAC will monitor.

19. BMO asserts that the violations resulted from an operational process failure which was neither intentional nor egregious. BMO states that its employees’ failure to follow the Bank’s procedure and obtain written confirmation of oral consent was inadvertent and that there was no evidence of intentional or knowing breaches of the Regulations.

20. BMO highlights its cooperation and responsiveness with the FCAC’s investigation, as was noted by FCAC Staff. BMO notes that it self-reported the issue and adopted a multi-pronged and voluntary remediation plan which included refunding affected customers and improving oversight and express consent disclosure. In addition, BMO argues that publication of its name in this case would undermine consumer confidence in its operations and compliance framework.

21. The Bank points out that recent Commissioner’s decisions have not named the regulated entity, despite the seriousness of the contraventions, including those with repeated contraventions and lack of remediation. These examples are justification for not naming the Bank in this case, according to BMO.

22. I have considered the factors raised by the Bank in its Representations. While there is no indication of intent on the part of the Bank to commit the violations, there is evidence that BMO’s training and oversight were inadequate to achieve the express consent required. The breaches took place over two years and affected thousands of customers.

23. Although the Regulations allow for oral consent, they mitigate the risks associated with this option by requiring that customers receive a written confirmation of their express consent without delay. BMO also recognized these risks and had procedures designed to effect compliance. BMO stated “we recognize the difficulty in measuring compliance and proving oral consent in a face-to-face branch setting. Accordingly, we developed an operational process […] that included a customer providing written evidence of consent […].”

24. However, BMO did not have an effective oversight program to monitor the process, to verify that oral consent was obtained, and to ensure that appropriate documents were signed and retained. BMO compliance personnel only reviewed complaints that were escalated. Three of these escalated complaints indicated lack of express consent for Creditor Insurance during the period, yet BMO took no further investigative or other action until a fourth complaint was made in March 2017, which was coincident with media reports and FCAC Staff inquiries.

25. I acknowledge that BMO has self-reported this issue and made improvements to its oversight and compliance regimes. In addition, I note that BMO has taken action to inform its customers, initially and quarterly, of their Creditor Insurance product purchases and costs. BMO has continued and enhanced a policy of refunding premiums where consent was not appropriately obtained, constituting an appropriate remediation effort of this issue.

26. However, BMO’s violation history suggests that publication of its name in this case may be an appropriate specific deterrent. Publication would encourage BMO to learn from this issue and improve its management of the risk of future breaches.

27. Publication would also have a deterrent effect on other institutions generally, to ensure that products are only sold when a customer’s express consent is obtained. Publication is therefore consistent with FCAC’s purpose to promote compliance, including the adoption by financial institutions of policies and procedures to obtain consumers’ express consent.

28. Publication would also serve to advance the awareness of financial consumers of their rights and responsibilities. I note that this issue came to light as a result of a customer complaint. Improving consumer awareness of the requirement for express consent is an important outcome consistent with FCAC’s purpose.

29. Finally, I am not convinced that publication would undermine consumer confidence. To the contrary, publication in this case would provide a measure of transparency that can contribute to public confidence in BMO, Canada’s banking system and Canada’s consumer protection regime.

30. Therefore, I conclude that it is appropriate to exercise my discretion in this case to make public the name of the Bank together with the nature of the violations and the penalty amounts.

Judith N. Robertson

Commissioner
Financial Consumer Agency of Canada

Ottawa, June 22, 2020