First National Bank of Omaha

Agency: Consumer Financial Protection Bureau
Type: enforcement action
Source: consumerfinance.gov/enforcement/actions/first-national-bank-omaha/
Pages: 48
PDFs: 3 documents (links below)

Documents in this case

Consent order · 41 p.
Stipulation · 5 p.
Consent order · 1 p.

Case summary

The Consumer Financial Protection Bureau (CFPB) has ordered First

National Bank of Omaha to provide $27.75 million in relief to roughly 257,000

consumers harmed by illegal practices with credit card add-on products. The

bank used deceptive marketing to lure consumers into debt cancellation add-on

products and it charged consumers for credit monitoring services they did not

receive. First National Bank of Omaha will also pay a $4.5 million civil money

penalty to the CFPB.

Under the Dodd-Frank Wall Street Reform and Consumer Protection Act,

the CFPB has the authority to take action against institutions engaging in

unfair, deceptive, or abusive practices. The CFPB’s order requires that First

National Bank of Omaha repay $27.75 million to affected consumers, end unfair

billing and other illegal practices, and pay a $4.5 million penalty.

Consent order

PDF of this document (41 pages)

Page 2

UNITED STATES OF AMERICA CONSUMER FINANCIAL PROTECTION BUREAU ADMINISTRATIVE PROCEEDING File No. 2016-CFPB-0014 In the Matter of:

CONSENT ORDER First National Bank of Omaha The Consumer Financial Protection Bureau (Bureau) has reviewed the marketing, sales, and administration of credit card add-on products by First National Bank of Omaha (Respondent, as defined below) and has identified unfair and deceptive acts or practices in violation of sections 1031 and 1036(a)(1)(B) of the Consumer Financial Protection Act of 2010 (CFPA), 12 U.S.C. §§ 5531 and 5536(a)(1)(B). Under sections 1053 and 1055 of the CFPA, 12 U.S.C. §§ 5563, 5565, the Bureau issues this Consent Order (Consent Order).

I Jurisdiction 1.

The Bureau has jurisdiction over this matter under sections 1053 and 1055 of the CFPA, 12 U.S.C. §§ 5563 and 5565.

2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 1 of 41

Page 3

II Stipulation 2.

Respondent has executed a “Stipulation and Consent to the Issuance of a Consent Order,” dated August 16, 2016 (Stipulation), which is incorporated by reference and is accepted by the Bureau. By this Stipulation, Respondent has consented to the issuance of this Consent Order by the Bureau under sections 1053 and 1055 of the CFPA, 12 U.S.C. §§ 5563 and 5565, without admitting or denying any findings of fact or violations of law, except that Respondent admits the facts necessary to establish the Bureau’s jurisdiction over it and the subject matter of this action. III Definitions 3.

The following definitions apply to this Consent Order: a.

“Add-On Product” means any consumer financial products or services, as defined by section 1002(5) of the CFPA, 12 U.S.C. § 5481(5), that Respondent marketed or offered to Cardholders as an optional add-on product to Respondent’s credit cards and that were supplementary to the credit provided by the credit cards, and includes Respondent’s Credit Monitoring and Debt Cancellation Products.

“Affected Consumer” means any person that is an Affected Debt Cancellation Customer or an Affected Credit Monitoring Customer. c.

“Affected Credit Monitoring Customer” means any Cardholder that enrolled in Respondent’s Credit Monitoring Products in or after December 1997 and was “Unprocessable.”

2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 2 of 41

Page 4

“Affected Debt Cancellation Customer” means any Cardholder that either enrolled in Respondent’s Debt Cancellation Products between January 1, 2010 and October 2012 through inbound or outbound telemarketing and did not opt in for continued enrollment in response to a communication from Respondent in June 2013, or who submitted a claim for benefits that was denied between January 2010 and August 2012. e.

“Affinion” means Affinion Group, including its subsidiary, Trilegiant Corporation.

“Board” means Respondent’s duly-elected and acting Board of Directors. g.

“Cardholder” means any person who opened a credit card account issued by Respondent.

“Credit Monitoring Products” means Add-On Products that offer credit monitoring or credit report retrieval services, including “PrivacyGuard” and “IdentitySecure.”

“Debt Cancellation Products” means Add-On Products that provide credits to a Cardholder’s account if the Cardholder’s income is interrupted for covered reasons or if the Cardholder experienced certain covered events, including Respondent’s Secure Credit and Payment Protection Products, among others.

“Effective Date” means the date on which the Consent Order is issued. k.

“Regional Director” means the Regional Director for the West Region for the Office of Supervision for the Consumer Financial Protection Bureau, or the Regional Director’s delegate.

2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 3 of 41

Page 5

“Related Consumer Action” means a private action by or on behalf of one or more consumers or an enforcement action by another governmental agency brought against Respondent based on substantially the same facts as described in Section IV of this Consent Order. m.

“Respondent” means First National Bank of Omaha, and its successors and assigns.

“Service Provider” means any service provider, as defined in Section 1002(26) of the CFPA, 12 U.S.C. § 5481, that provides or provided a material service to Respondent in connection with the offering or provision by Respondent of a consumer financial product or service. o.

“Unprocessable” means the status of a Cardholder who, at a given time, was billed for a Credit Monitoring Product but who, for any reason did not receive full credit monitoring or credit report retrieval features of the Credit Monitoring Product.

IV Bureau Findings and Conclusions The Bureau finds the following:

Respondent is a national bank headquartered in Omaha, Nebraska. As of March 31, 2016, Respondent had approximately $18.4 billion in total assets. 5.

Respondent is an insured depository institution with assets greater than $10 billion within the meaning of 12 U.S.C. § 5515(a). 6.

Respondent is a “covered person” as that term is defined by 12 U.S.C. § 5481(6). 7.

From at least 2002 until August 2013, Respondent marketed, sold, or administered a proprietary Debt Cancellation Product, Secure Credit, to its 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 4 of 41

Page 6

Cardholders. Respondent also marketed, sold, or administered the proprietary Debt Cancellation Product, Payment Protection, to its Cardholders from approximately 2009 until August 2013.

Respondent marketed that its Debt Cancellation Products would “credit a monthly payment to the Cardholder’s account balance” if a consumer experienced a covered event, such as involuntary unemployment, accidental death, disability, or hospitalization.

Cardholders enrolled in Respondent’s Debt Cancellation Products were charged a monthly fee, often 0.89% of the balance (i.e., $0.89/$100) as of the Cardholder’s statement closing date, to their First National Bank of Omaha-issued credit card. 10.

Secure Credit and Payment Protection were similar, except that Payment Protection did not include benefits for unemployment or family leave and Respondent marketed Payment Protection primarily to “senior” and “retired” Cardholders.

11.

Respondent represented that these products would provide Cardholders with access to credit reports, monitor Cardholders’ credit, and assist with credit repair and financial loss in the case of identity theft. 13.

Respondent used three primary telemarketing channels to sell these Add-On Products: (a) inbound telemarketing to Cardholders who called to activate a new 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 5 of 41

Page 7

credit card; (b) inbound telemarketing to Cardholders who called Respondent for customer service; and (c) 0utbound telemarketing to existing Cardholders. 14.

For the Debt Cancellation Products, Respondent ceased outbound telemarketing in April 2012 and inbound telemarketing and direct mail marketing in October 2012.

15.

For Debt Cancellation Products and Credit Monitoring Products, Respondent often drafted the scripts, trained employees and Service Providers, and monitored the marketing of these Add-On Products by in-house representatives as well as Service Provider representatives.

16.

For the Debt Cancellation Products, Respondent and its Service Providers designed the product, managed fulfillment, determined eligibility, and administered benefits to Cardholders.

17.

For the Credit Monitoring Products, Respondent marketed and sold the products to its Cardholders through inbound telemarketing, but left the administration of the product primarily to Affinion.

18.

Respondent ceased telemarketing the Credit Monitoring Products in September 2012.

19.

Respondent engaged in deceptive acts or practices to enroll its Cardholders into its Debt Cancellation Products, unfairly obstructed Cardholders from obtaining benefits from Debt Cancellation Products, or unfairly billed Cardholders for Credit Monitoring Products.

20.

Respondent’s compliance monitoring, Service Provider management, and quality assurance resulted in ineffective oversight, which failed to prevent, identify, or correct these unfair or deceptive acts or practices. 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 6 of 41

Page 8

Findings and Conclusions as to Misrepresentations in Soliciting Cardholders to Purchase Debt Cancellation Products 21.

From at least January 2010 until approximately October 2012, during inbound and outbound telemarketing calls, Respondent engaged in various deceptive acts or practices when enrolling some Cardholders into its Debt Cancellation Products.

22.

During credit card activation calls, Respondent and its Service Providers began a sales pitch for the Debt Cancellation Products on by stating “while your card is activating …” or similar language before they started the sales pitch, implying that Cardholders had to stay on the line to listen to a sales pitch for the Debt Cancellation Products while the Cardholders’ cards were activating. 23.

In reality, the activation process was nearly instantaneous and Cardholders were not obliged to listen to Respondent’s solicitations to complete activation of their credit cards.

24.

During inbound and outbound telemarketing calls, Respondent and its Service Providers frequently misrepresented the nature of the solicitation, including by representing, expressly or impliedly:

that Respondent was notifying Cardholders of “an important account feature;” and b.

that Respondent was offering the Debt Cancellation Product “as our way of saying thanks.”

25.

In reality, Respondent was soliciting Cardholders to purchase an optional product for which Cardholders would be charged a monthly fee. 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 7 of 41

Page 9

26.

During inbound and outbound telemarketing calls, Respondent and its Service Providers enrolled some Cardholders in Debt Cancellation Products without adequately informing the Cardholders that they were purchasing the product, including by:

representing, expressly or impliedly, that Cardholders were being sent the product “welcome kit” so the Cardholders could review the product conditions and exclusions; and b.

obtaining Cardholders’ purported consent to purchase the product by telling Cardholders that to “verify … approval to enroll” Cardholders in the product, that the Cardholders needed to provide their city of birth and then construing the Cardholders’ confirmation of their city of birth as consent to purchase the product.

27.

In reality, Cardholders who agreed to receive information about the product and who verified their city of birth were purportedly consenting to purchase the product, at which point Respondent would enroll the Cardholder. 28.

Section 1036(a)(1)(B) of the CFPA prohibits “unfair, deceptive, or abusive” acts or practices. 12 U.S.C. § 5536(a)(1)(B).

29.

As described in paragraphs 21-27, in connection with the advertising, marketing, promotion, offer or sale of Debt Cancellation Products, Respondent misrepresented the activation process and the existence of a purchase transaction to which Cardholders were purportedly “consenting.” 30.

Therefore, Respondent’s representations, as described in paragraphs 21-27, constitute deceptive acts or practices in violation of sections 1031 and 1036(a)(1)(B) of the CFPA, 12 U.S.C. §§ 5531 and 5536(a)(1)(B). 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 8 of 41

Page 10

Findings and Conclusions as to Misrepresentations of the Terms, Conditions, and Benefits of the Debt Cancellation Products 31.

From at least January 2010 until approximately October 2012, during inbound and outbound telemarketing calls, Respondent and its Service Providers frequently misrepresented the Debt Cancellation Products’ terms, exclusions, and benefits, including by:

failing to inform Cardholders or correct confusion on the part of some Cardholders who had disclosed information suggesting they would be ineligible for one or more of the product benefits that those Cardholders would be ineligible for one or more of the product benefits; b.

representing, expressly or impliedly, that Cardholders were “eligible” for the product without information that allowed Respondent to determine whether the Cardholder was actually eligible for the product’s benefits; and c.

misrepresenting the limitations of the product benefits. 32.

Section 1036(a)(1)(B) of the CFPA prohibits “unfair, deceptive, or abusive” acts or practices. 12 U.S.C. § 5536(a)(1)(B).

33.

As described in paragraph 31, in connection with the marketing and sales of its Debt Cancellation Products, Respondent misrepresented, expressly or impliedly, the terms, exclusions, and benefits of those products. 34.

Therefore, Respondent’s representations or omissions described in paragraph 31 constitute deceptive acts or practices in violation of sections 1031 and 1036(a)(1)(B) of the CFPA, 12 U.S.C. §§ 5531 and 5536(a)(1)(B). 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 9 of 41

Page 11

Findings and Conclusions as to Misrepresentations of the Ease of Cancelling the Debt Cancellation Products

35.

From at least January 2010 until approximately October 2012, during inbound and outbound telemarketing calls, Respondent and its Service Providers misrepresented that it allowed Cardholders to cancel Debt Cancellation Products “anytime,” “immediately,” and with “no questions asked.” 36.

Respondent and its Service Providers also told Cardholders who wanted to review product terms before enrolling that they did not need the terms in writing first because they could cancel with no charge within the first 30 days. 37.

In fact, cancelling Respondent’s Debt Cancellation Products was not easy. Respondent’s customer service representatives often rebutted Cardholders’ requests to cancel several times before agreeing to cancel the Cardholders’ enrollment.

38.

Respondent had a sales incentive plan that awarded Respondent’s customer service representatives additional compensation for a “save,” which occurred when the customer service representative kept a Cardholder enrolled after attempting to cancel. Respondent referred to this incentive as a “save bounty.” 39.

For example, Respondent instructed its customer service representatives to rebut Cardholders’ requests to cancel and to employ assumptive statements (e.g., “Let’s keep your account protected, ok?”) in an attempt to keep the Cardholder enrolled in the product. Thus, consumers wishing to cancel were often unable to do so unless they were willing to demand cancellation multiple times in succession. 40.

Section 1036(a)(1)(B) of the CFPA prohibits “unfair, deceptive, or abusive” acts or practices. 12 U.S.C. § 5536(a)(1)(B).

2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 10 of 41

Page 12

41.

As described in the paragraphs 35-39, in connection with the marketing, sales, and administration of its Debt Cancellation Products, Respondent misrepresented, expressly or impliedly, the ease of cancellation for those products.

42.

Therefore, Respondent’s representations described in paragraphs 35-39 constitute deceptive acts or practices in violation of sections 1031 and 1036(a)(1)(B) of the CFPA, 12 U.S.C. §§ 5531 and 5536(a)(1)(B). Findings and Conclusions for Unfairly Obstructing Consumers from Obtaining Benefits of the Debt Cancellation Products

43.

From at least January 1, 2010 until approximately August 2012, Respondent administered the Debt Cancellation Products in such a way that it prevented the vast majority of Cardholders from obtaining several of the promised benefits. Respondent used many different restrictions, eligibility requirements, exclusions, and administrative hurdles, which collectively caused the widespread denial of benefits to Cardholders.

44.

Respondent employed eligibility requirements that denied many benefits to Cardholders who were employed fewer than 30 hours per week or who were selfemployed. Prior to August 2012, if Cardholders failed to provide evidence of fulltime employment, Cardholders were ineligible for unemployment benefits as well as disability, hospitalization, and family leave benefits. 45.

Respondent employed numerous exclusions to deny benefits to Cardholders for otherwise covered events. For example, Respondent denied benefits for “preexisting conditions,” which Respondent defined to include any condition that was diagnosed or occurred for up to six months after enrollment. Respondent’s Debt 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 11 of 41

Page 13

Cancellation Products variously excluded illness or disability caused by pregnancy, childbirth, alcohol, drug use, or self-infliction. And Respondent denied benefits for losses and for unemployment occurring in the first three months of enrollment; nearly fifteen percent of completed benefit requests were denied because the loss occurred in the first 90 days. As a result, some Cardholders sought benefits from Respondent after suffering a loss, only to learn that they were disqualified due to one of the many exclusions. 46.

Respondent employed onerous administrative requirements to deny benefits to Cardholders. For example, Cardholders were not eligible for unemployment benefits if they became unemployed within 90 days after enrolling in the product. Before applying, Cardholders had to have been continuously out of work for 30 days, but they must have called Respondent to request the application for their benefits within 45 days of their first day of unemployment. Therefore, those Cardholders had a 15-day window to apply for benefits–between the 30th and 45th day of continuous unemployment.

47.

Respondent also denied benefits when the Cardholder returned an application more than 45 days after the date of loss; for illness or disability, the Cardholder failed to send in “continuation forms” that included monthly signed verifications from their hospital or treating physician; for unemployment, the Cardholder failed to send in “continuation forms” that included monthly proof that the Cardholder was receiving unemployment benefits; or, for the accidental death benefit, failed to obtain a death certificate that expressly stated “accidental death” as the cause of death. Failure to comply with any step within the proper time could—and did—result in denials.

2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 12 of 41

Page 14

48.

Respondent did not disclose many of these exclusions and requirements to consumers prior to their enrollment. In addition, in many cases, Respondent affirmatively told Cardholders they were “eligible” for the products at the outset. 49.

As a result of these exclusions and requirements, Respondent regularly denied benefits to consumers who requested them. For example, during 2011 only 9% of Cardholders who initiated a claim for benefits succeeded in obtaining benefits. 50.

Section 1036(a)(1)(B) of the CFPA prohibits “unfair, deceptive, or abusive” acts or practices. 12 U.S.C. § 5536(a)(1)(B).

51.

The acts or practices described in paragraphs 43-49 caused or were likely to cause substantial injury to consumers that was not reasonably avoidable or not outweighed by any countervailing benefit to consumers or to competition. 52.

Respondent engaged in unfair acts or practices in violation of sections 1031 and 1036(a)(1)(B) of the CFPA, 12 U.S.C. §§ 5531 and 5536(a)(1)(B).

Findings and Conclusions for Unfairly Billing Consumers for Credit Monitoring Products

53.

From approximately December 1997 until September 2012, Respondent marketed and sold the Credit Monitoring Product PrivacyGuard. Respondent also marketed and sold the Credit Monitoring Product IdentitySecure from approximately September 2008 until September 2012. PrivacyGuard and IdentitySecure were administered by Respondent’s Service Provider, Affinion, and purported to provide consumers with copies of their credit reports and ongoing monitoring of their credit reports for potential identity theft or fraud. 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 13 of 41

Page 15

54.

Respondent and its Service Providers marketed and sold these Credit Monitoring Products to Cardholders and referred Cardholders to Affinion for administration of the Credit Monitoring Products.

55.

To provide the credit monitoring and credit report retrieval services, the Fair Credit Reporting Act, 15 U.S.C. § 1681b, required a “permissible purpose” to obtain a Cardholder’s credit information from the credit reporting companies. Among other reasons, a credit reporting company may release a credit report in accordance with a consumer’s “written instructions[.]” 15 U.S.C. § 1681b(a)(2). 56.

Before Respondent or its Service Provider could access the Cardholders’ credit information and provide credit monitoring services to Cardholders enrolled in PrivacyGuard and IdentitySecure, Respondent or its Service Providers were required to obtain sufficient written authorization and personal verification information from the Cardholders.

57.

In most cases, Cardholders did not receive these services because some time passed before a Cardholder’s authorization was obtained, or a Cardholder’s authorization was never obtained. In other instances, Cardholders provided their authorization, but one or more credit reporting companies could not process the authorization if they were unable to match the Cardholder’s identification information with the credit reporting company’s own records. 58.

In these circumstances, Cardholders were billed the full fee for Credit Monitoring Products even when they were not receiving the credit monitoring or credit report retrieval benefits of the product.

59.

Sections 1031 and 1036 of the CFPA prohibit “unfair, deceptive, or abusive” acts or practices. 12 U.S.C. §§ 5531, 5536(a)(1)(B).

2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 14 of 41

Page 16

60.

The acts or practices described in paragraphs 53-58 caused or were likely to cause substantial injury to consumers that was not reasonably avoidable or outweighed by any countervailing benefit to consumers or to competition. 61.

Therefore, Respondent engaged in unfair acts or practices in violation of sections 1031 and 1036(a)(1)(B) of the CFPA, 12 U.S.C. §§ 5531 and 5536(a)(1)(B). ORDER V Conduct Provisions

IT IS ORDERED, under sections 1053 and 1055 of the CFPA, that: 62.

Respondent and its officers, agents, servants, employees, and attorneys who have actual notice of this Consent Order, whether acting directly or indirectly, may not violate, including by taking reasonable measures to ensure that its Service Providers, affiliates, and other agents do not violate, sections 1031 and 1036 of the CFPA, 12 U.S.C. §§ 5531 and 5536, regarding the marketing, sales, and administration of Add-On Products.

63.

Respondent must correct all violations of law, as described in this Consent Order, and must maintain procedures to prevent their recurrence. 64.

Respondent, whether acting directly or indirectly, is prohibited from the marketing, sale, or administration of Add-On Products, or referring Cardholders to Service Providers who offer Add-On Products, without first securing a determination of non-objection from the Regional Director, as follows: a.

Respondent must submit to the Regional Director an Add-On Product Compliance Plan, as described in Section VI of this Consent Order; 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 15 of 41

Page 17

The Regional Director will have the discretion to make a determination of non-objection to the Add-On Product Compliance Plan or direct the Respondent to revise it. If the Regional Director directs the Respondent to revise the Add-On Product Compliance Plan, Respondent must make the revisions and resubmit the Add-On Product Compliance Plan to the Regional Director.

Respondent may market, sell, or administer Add-On Products, or refer Cardholders to third-parties who offer Add-On Products, only after receiving notification that the Regional Director has made a determination of non-objection to the Add-On Product Compliance Plan and only after adhering to the steps, recommendations, deadlines, and timeframes outlined in the Add-On Product Compliance Plan and this Consent Order. VI Add-On Product Compliance Plan

IT IS FURTHER ORDERED that:

65.

Any Add-On Product Compliance Plan must be a comprehensive compliance plan designed to ensure that Respondent’s marketing, sales, and administration of Add-On products comply with all applicable Federal consumer financial laws and the terms of this Consent Order. Any Add-On Product Compliance Plan must: a.

Include appropriate safeguards designed to ensure that Respondent and its officers, servants, employees, attorneys, Service Providers, affiliates, or other agents refrain from engaging in violations of Federal consumer 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 16 of 41

Page 18

financial laws in the marketing, sale, servicing (including member retention), billing, fulfillment, and administration of Add-On Products; b.

Include a plan for informing prospective and current Add-On Product customers of all fees, costs, expenses, charges, and billing arrangements associated with Add-On Products;

Include a plan for informing prospective and current Add-On Product customers of material conditions, benefits, and restrictions related to the Add-On Products, including how Respondent will inform prospective Add- On Product customers who disclose conditions that may make them ineligible for certain benefits (e.g., current disability or unemployment) of the restrictions and conditions relating to those conditions; d.

Include a plan for ensuring that Respondent does not enroll prospective customers in Add-On Products over the telephone who have not given express informed consent to purchase the Add-On Product; e.

Include a plan for ensuring that current and prospective customers are billed for Credit Monitoring Products only when they receive all of the purchased credit monitoring or credit report retrieval benefits of the product;

Require the development and implementation of written policies and procedures to effectively manage, detect, and mitigate, on an on-going basis, the risks identified in the written assessment required in paragraph 78;

Include comprehensive written policies and procedures for identifying and reporting any violation of Federal consumer financial laws or 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 17 of 41

Page 19

Respondent’s policies and procedures relating to Add-On Products by Respondent’s employees or Service Providers’ employees or agents, in a timely manner, to a specified executive risk or compliance manager at Respondent. The manager to whom such reports are made must be independent of the unit overseeing the sale and marketing of Add-On Products;

Require the development of training materials relating to identifying and addressing violations of Federal consumer financial laws relating to Add- On Products that will be incorporated into the existing annual compliance training for appropriate employees;

Include written policies and procedures to ensure that the appropriate employees and Respondent’s departments have the requisite authority and status within Respondent so that appropriate reviews of Add-On Products marketed or sold by Respondent or through Service Providers may occur and deficiencies are identified and properly remedied; and j.

Include specific timeframes and deadlines for implementation of the steps described above.

66.

Any proposed material changes to or deviations from the approved Add-On Products Compliance Plan must be submitted in writing to the Regional Director for determination of non-objection.

67.

Respondent’s internal audit department must periodically conduct an assessment of Respondent’s compliance with any approved Add-On Products Compliance Plan. Such assessments must occur within 120 days after Respondent’s receipt of a determination of non-objection to the Add-On Products Compliance Plan, and 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 18 of 41

Page 20

periodically but at least annually thereafter, and the finding must be memorialized in writing. Within 30 days of completing each assessment, the internal audit department must provide its written finding to the Board and Regional Director.

VII Compliance Committee and Compliance Plan

IT IS FURTHER ORDERED that:

68.

Within 30 days of the Effective Date, the Board must appoint a Compliance Committee of at least 3 members. The majority of the Compliance Committee will be comprised of outside directors. The Board must provide in writing to the Regional Director the name of each member of the Compliance Committee and, if there is a change of membership to the Compliance Committee, the Board must submit the name of any new member in writing to the Regional Director. 69.

The Compliance Committee will be responsible for monitoring and coordinating the Respondent’s adherence to the provisions of this Consent Order. The Compliance Committee must meet at least every two months, and must maintain minutes of its meetings.

70.

Within 120 days of the Effective Date, and thereafter within 30 days after the end of each quarter, the Compliance Committee must submit a Compliance Plan to the Board, which details the actions taken to comply with this Consent Order, and the results and status of those actions. The Compliance Plan must also, at a minimum, include:

detailed steps for addressing each action required by this Consent Order; and 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 19 of 41

Page 21

specific timeframes and deadlines for implementation of those steps. 71.

Within 10 days of receiving the initial Compliance Plan, the Board must submit a copy of the Compliance Plan, with any additional comments by the Board, to the Regional Director for review and determination of non-objection. 72.

The Regional Director will have the discretion to make a determination of nonobjection to the Compliance Plan or direct the Respondent to revise it. If the Regional Director directs the Respondent to revise the Compliance Plan, the Respondent must make the revisions and resubmit the Compliance Plan to the Regional Director within 15 days.

73.

After receiving notification that the Regional Director has made a determination of non-objection to the Compliance Plan, the Respondent must implement and adhere to the steps, recommendations, deadlines, and timeframes outlined in the Compliance Plan.

74.

Any proposed material changes to or deviations from the approved Compliance Plan must be submitted in writing to the Regional Director for determination of non-objection.

VIII Service Provider Monitoring

IT IS FURTHER ORDERED that:

75.

Within 120 days of the Effective Date, Respondent must submit its written policy governing the management of Service Providers with respect to the offering or provision of consumer financial products and services (“Service Provider Management Policy”) to the Regional Director for determination of nonobjection. At a minimum, the Service Provider Management Policy must require: 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 20 of 41

Page 22

an analysis, to be conducted by Respondent prior to Respondent entering into a contract with the Service Provider, of the ability of the Service Provider to perform the marketing, sales, delivery, servicing, and/or fulfillment of services for the consumer financial products or services in compliance with all applicable Federal consumer financial laws and Respondent’s policies and procedures.

for new and renewed contracts, a written contract between Respondent and the Service Provider, which sets forth the responsibilities of each party. At a minimum, the contract will set forth: i. the Service Provider’s specific performance responsibilities and duty to maintain adequate internal controls over the marketing, sales, delivery, servicing, and fulfillment of services for the consumer financial products or services;

ii. the Service Provider’s responsibilities and duty to provide adequate training on applicable Federal consumer financial laws and Respondent’s policies and procedures to all Service Provider employees or agents engaged in the marketing, sales, delivery, servicing, and fulfillment of services for the consumer financial products or services;

iii. a grant to Respondent of the authority to conduct periodic onsite reviews of the Service Provider’s controls, performance, and information systems as they relate to the marketing, sales, delivery, servicing, and fulfillment of services for the consumer financial products or services; and 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 21 of 41

Page 23

iv. Respondent’s right to terminate the contract if the Service Provider materially fails to comply with the terms specified in the contract, including the terms required by this paragraph. c.

periodic onsite review by Respondent of the Service Provider’s controls, performance, and information systems.

76.

Upon receipt of a determination of non-objection to the Service Provider Management Policy submitted pursuant to Paragraph 75 of this Consent Order, the Board must ensure that Respondent adheres to the Service Provider Management Policy. Any proposed changes to or deviations from the approved Service Provider Management Policy affecting the oversight of Service Providers described in this Consent Order must be submitted in writing to the Regional Director for review and determination of non-objection. 77.

Respondent’s internal audit department must periodically conduct an assessment of Respondent’s application of its Service Provider Management Policy to Service Providers, including the practices described in Paragraph 75 of this Consent Order. An assessment must occur within 180 days after Respondent’s receipt of a determination of non-objection to the Service Provider Management Policy, and periodically thereafter but at least annually thereafter, and the findings must be memorialized in writing. Within 30 days of completing each assessment, Respondent’s internal audit department must provide its written findings to the Audit Committee and the Regional Director.

2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 22 of 41

Page 24

IX UDAAP Risk Management Program

IT IS FURTHER ORDERED that:

78.

Within 120 days of the Effective Date, Respondent must develop a written enterprise-wide Unfair, Deceptive, and Abusive Acts or Practices (“UDAAP”) risk management program (“Risk Management Program”) for any consumer financial products or services offered by Respondent or through Service Providers, to prevent violations of Sections 1031 and 1036 of the CFPA. 79.

The Board must approve and cause Respondent to submit this Risk Management Program to the Regional Director for determination of non-objection. At a minimum, the Risk Management Program must require: a.

A written comprehensive assessment, to be conducted on an annual basis, of the UDAAP risk for these consumer financial products or services and for changes to these consumer financial products or services, including, but not limited to the UDAAP risk of the governance, control, marketing, sales, delivery, servicing, and fulfillment of services for new consumer financial products or services and existing consumer financial products or services, including the UDAAP risk of marketing and sales practices. b.

The development and implementation of written policies and procedures to effectively manage, prevent, detect, mitigate, and report, on an on-going basis, the risks identified in the written assessment required by this paragraph.

Comprehensive written procedures for providing appropriate training on applicable Federal consumer financial laws and Respondent’s policies and 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 23 of 41

Page 25

procedures, including but not limited to unfair, deceptive, or abusive acts or practices, to appropriate employees and Service Provider call agents. d.

Written policies and procedures to ensure that risk management, internal audit, and corporate compliance programs have the requisite authority and status so that appropriate reviews of products marketed or sold by the Respondent or through Service Providers may occur and deficiencies are identified and properly remedied.

80.

Upon receipt of a determination of non-objection to the Risk Management Program submitted under paragraph 78 of this Consent Order, the Board must ensure that Respondent implements and adheres to the Risk Management Program. Any proposed changes to or deviations from the approved Risk Management Program must be submitted in writing to the Regional Director for review and determination of non-objection.

81.

Respondent’s internal audit department must periodically conduct an assessment of Respondent’s compliance with the Risk Management Program. Such assessments must occur within 180 days after Respondent’s receipt of a determination of non-objection to the Risk Management Program, and periodically, but at least annually thereafter, and the findings must be memorialized in writing. Within 10 days of completing each assessment, Respondent’s internal audit department must provide its written findings to the Respondent’s Audit Committee and the Regional Director. 82.

Within 120 days of the Effective Date, Respondent must develop training materials relating to identifying and responding to unfair, deceptive, or abusive 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 24 of 41

Page 26

acts or practices and incorporate the new training materials into the existing annual compliance training for appropriate employees. 83.

The Board must ensure that there is oversight of the Risk Management Program required by this Section by Respondent’s senior risk managers and senior management.

X Role of the Board

IT IS FURTHER ORDERED that:

84.

The Board must review all submissions (including plans, reports, programs, policies, and procedures) required by this Consent Order prior to submission to the Bureau.

85.

Although this Consent Order requires the Respondent to submit certain documents for the review or non-objection by the Regional Director, the Board will have the ultimate responsibility for proper and sound management of Respondent and for ensuring that Respondent complies with Federal consumer financial laws and this Consent Order.

86.

With the prior non-objection of the Regional Director, the Board may delegate certain of the approval or reporting obligations included herein to the Compliance Committee.

87.

In each instance that this Consent Order requires the Board or the Compliance Committee to ensure adherence to, or perform certain obligations of Respondent, the Board, directly or through the Compliance Committee, must: a.

Authorize whatever actions are necessary for Respondent to fully comply with the Consent Order;

2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 25 of 41

Page 27

Require timely reporting by management to the Board on the status of compliance obligations; and c.

Require timely and appropriate corrective action to remedy any material non-compliance with any failure to comply with Board directives related to this Section.

XI Order to Pay Redress

IT IS FURTHER ORDERED that:

88.

Within 10 days of the Effective Date, Respondent must reserve or deposit into a segregated deposit account an amount not less than $27,750,000for the purpose of providing redress to approximately 257,000 Affected Consumers as required by this Section. This Section must not be construed to require Respondent to provide restitution payments to Affected Credit Monitoring Customers duplicative of payments provided pursuant to the order issued by the Comptroller of the Currency against Respondent in August 2016. 89.

Within 120 days of the Effective Date, Respondent must submit to the Regional Director for review and non-objection a comprehensive written plan for providing redress consistent with this Consent Order (Redress Plan). The Regional Director will have the discretion to make a determination of nonobjection to the Redress Plan or direct the Respondent to revise it. If the Regional Director directs the Respondent to revise the Redress Plan, the Respondent must make the revisions and resubmit the Redress Plan to the Regional Director within 30 days. After receiving notification that the Regional Director has made a determination of non-objection to the Redress Plan, the Respondent must 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 26 of 41

Page 28

implement and adhere to the steps, recommendations, deadlines, and timeframes outlined in the Redress Plan.

90.

The Redress Plan will apply to all Affected Consumers and must: a.

Specify how Respondent will identify all Affected Consumers; b.

Provide processes covering all Affected Consumers regardless of their current credit card account status with Respondent: i. for closed or open accounts with a balance, Respondent must provide a credit posted to the account; where the redress provided is greater than the balance and the Respondent delivered a statement credit reducing the balance down to zero, Respondent must send to the Affected Consumer a certified or bank check in the amount of the excess;

ii. for closed or open accounts with a zero balance, Respondent must send a certified or bank check to the Affected Consumer; iii. for any charged-off account, Respondent must issue redress consistent with the requirements for closed accounts in paragraph 90(b)(i). Where a credit would be issued that is greater than the existing charged-off balance, Respondent must mail to the Affected Consumer a certified or Bank check in the amount of the excess. Any letter, as described in paragraph 91 below, sent with regard to a charged-off account, must notify the Affected Consumer of the credit decreasing the charged-off balance as well as any additional money the Affected Consumer is receiving; and 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 27 of 41

Page 29

iv. with respect to any bankruptcy, estate, or accounts in litigation Respondent must make a refund in accordance with applicable law and as set forth in the Redress Plan.

Describe the method used to calculate redress to be paid to each Affected Consumer as required by this Consent Order;

Describe the procedures for issuance and tracking of redress to Affected Consumers; and e.

Describe the procedures for monitoring compliance with the Redress Plan. 91.

The Redress Plan must include the form of the letter to be sent notifying Affected Consumers of the redress and the form of the envelope that will contain the letter. The letter must include language explaining how the amount of redress was calculated, an explanation of the use of a credit or check as applicable, and a statement that the refund payment is being provided in compliance with the terms of this Consent Order. Respondent may not include in any envelope containing the notification letter any materials other than the approved letter, and when appropriate, redress checks, unless Respondent has obtained written confirmation from the Regional Director that the Bureau does not object to the inclusion of the additional materials.

92.

Respondent must make reasonable attempts to locate Affected Consumers whose notification letter or check is returned for any reason, including performing a standard address search using the National Change of Address System. Respondent must re-mail any returned letters or checks to corrected addresses within 90 days of receiving a return. Any unclaimed funds must be disposed of in compliance with the Redress Plan and this Consent Order. 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 28 of 41

Page 30

93.

The Redress Plan must require Respondent to provide the following amounts to each Affected Debt Cancellation Customer, less any fees refunded, benefits paid, and related charges previously provided:

If enrolled fewer than 12 months, all Debt Cancellation Product fees paid by the Affected Debt Cancellation Customer, and any finance charges, late fees, and over-limit fees associated with the product fees; or ii.

If enrolled for 12 months or longer, 12 months of Debt Cancellation Product fees (based on the average monthly fee paid by the customer over the entire course of their membership), and any finance charges, late fees, and over-limit fees associated with the product fees; and iii.

If the Affected Debt Cancellation Customer submitted a claim for benefits that was denied, all Debt Cancellation Product Fees, and any finance charges, late fees, and over-limit fees associated with the product fees.

94.

The Redress Plan must require Respondent to provide the following amounts to each Affected Credit Monitoring Customer:

a. All Credit Monitoring Product fees paid by the Affected Credit Monitoring Customer during any period in which the Affected Credit Monitoring Customer was Unprocessable, and any finance charges, late fees, and overlimit fees associated with the product fees, minus any amounts already refunded pursuant to the Stipulated and Final Judgment and Order in 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 29 of 41

Page 31

Consumer Financial Protection Bureau v. Affinion Group Holdings, Inc., et al., Case No. 15-cv-01005 (D. Conn. July 1, 2015). 95.

As Respondent complies with this Consent Order, Respondent must update or correct any information furnished to any consumer reporting company about the Cardholder’s account that is, or becomes, inaccurate. 96.

Within 90 days from completion of the Redress Plan, Respondent’s internal audit department must review and assess compliance with the terms of the Redress Plan (Redress Review).

97.

The Redress Review must include an assessment of the Redress Plan and the methodology used to determine the population of Affected Consumers, the amount of redress for each Affected Consumer; the procedures used to issue and track redress payments; the procedures used for reporting and requesting the reporting of updated balances to the credit reporting agencies; and the work of any independent consultants that Respondent has used to assist with the implementation of, and review its execution of, the Redress Plan. 98.

The Redress Review must be completed and summarized in a written report (Redress Review Report), which must be completed within 60 days of completion of the Redress Review. Within 10 days of its completion, the Redress Review Report must be submitted to the Board and the Regional Director. 99.

After completing the Redress Plan, if the amount of redress provided to Affected Consumers is less than $26,000,000, within 30 days of the completion of the Redress Plan, Respondent must pay to the Bureau, by wire transfer to the Bureau or to the Bureau’s agent, and according to the Bureau’s wiring instructions, the 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 30 of 41

Page 32

difference between the amount of redress provided to Affected Consumers and $26,000,000.

100. The Bureau may use these remaining funds to pay additional redress to Affected Consumers. If the Bureau determines, in its sole discretion, that additional redress is wholly or partially impracticable or otherwise inappropriate, or if funds remain after the additional redress is completed, the Bureau will deposit any remaining funds in the U.S. Treasury as disgorgement. Respondent will have no right to challenge any actions that the Bureau or its representatives may take under this Section.

101.

Respondent may not condition the payment of any redress to any Affected Consumer under this Consent Order on that Affected Consumer waiving any right.

XII Order to Pay Civil Money Penalties IT IS FURTHER ORDERED that:

102.

Under section 1055(c) of the CFPA, 12 U.S.C. § 5565(c), by reason of the violations of law described in Section IV of this Consent Order, and taking into account the factors in 12 U.S.C. § 5565(c)(3), Respondent must pay a civil money penalty of $4,500,000 to the Bureau.

103.

Within 10 days of the Effective Date, Respondent must pay the civil money penalty by wire transfer to the Bureau or to the Bureau’s agent in compliance with the Bureau’s wiring instructions.

2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 31 of 41

Page 33

104.

The civil money penalty paid under this Consent Order will be deposited in the Civil Penalty Fund of the Bureau as required by section 1017(d) of the CFPA, 12 U.S.C. § 5497(d).

105.

Respondent must treat the civil money penalty paid under this Consent Order as a penalty paid to the government for all purposes. Regardless of how the Bureau ultimately uses those funds, Respondent may not: a.

Claim, assert, or apply for a tax deduction, tax credit, or any other tax benefit for any civil money penalty paid under this Consent Order; or b.

Seek or accept, directly or indirectly, reimbursement or indemnification from any source, including but not limited to payment made under any insurance policy, with regard to any civil money penalty paid under this Consent Order.

106.

To preserve the deterrent effect of the civil money penalty in any Related Consumer Action, Respondent may not argue that Respondent is entitled to, nor may Respondent benefit by, any offset or reduction of any compensatory monetary remedies imposed in the Related Consumer Action because of the civil money penalty paid in this action (Penalty Offset). If the court in any Related Consumer Action grants such a Penalty Offset, Respondent must, within 30 days after entry of a final order granting the Penalty Offset, notify the Bureau, and pay the amount of the Penalty Offset to the U.S. Treasury. Such a payment will not be considered an additional civil money penalty and will not change the amount of the civil money penalty imposed in this action.

2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 32 of 41

Page 34

XIII Additional Monetary Provisions

IT IS FURTHER ORDERED that:

107.

In the event of any default on Respondent’s obligations to make payment under this Consent Order, interest, computed under 28 U.S.C. § 1961, as amended, will accrue on any outstanding amounts not paid from the date of default to the date of payment, and will immediately become due and payable. 108.

Respondent must relinquish all dominion, control, and title to the funds paid to the fullest extent permitted by law and no part of the funds may be returned to Respondent.

109.

Under 31 U.S.C. § 7701, Respondent, unless it already has done so, must furnish to the Bureau its taxpayer identifying numbers, which may be used for purposes of collecting and reporting on any delinquent amount arising out of this Consent Order.

110.

Within 30 days of the entry of a final judgment, consent order, or settlement in a Related Consumer Action, Respondent must notify the Regional Director of the final judgment, consent order, or settlement in writing. That notification must indicate the amount of redress, if any, that Respondent paid or is required to pay to consumers and describe the consumers or classes of consumers to whom that redress has been or will be paid.

2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 33 of 41

Page 35

XIV Reporting Requirements

IT IS FURTHER ORDERED that:

111.

Respondent must notify the Bureau of any development that may affect compliance obligations arising under this Consent Order, including but not limited to, a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor company; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this Consent Order; the filing of any bankruptcy or insolvency proceeding by or against Respondent; or a change in Respondent’s name or address. Respondent must provide this notice, if practicable, at least 30 days before the development, but in any case no later than 14 days after the development. 112.

As described in section VII of this Consent Order, Respondent must submit an Action Plan to the Regional Director within 120 days of the Effective Date, and quarterly progress reports thereafter, that have been approved by the Board, which, at a minimum:

Include the information required under Section VII of this Consent Order; b.

Attach a copy of each Order Acknowledgment obtained under Section XV, unless previously submitted to the Bureau.

2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 34 of 41

Page 36

XV Order Distribution and Acknowledgment

IT IS FURTHER ORDERED that, 113.

Within 30 days of the Effective Date, Respondent must deliver a copy of this Consent Order to each of its Board members and executive officers, as well as to any managers, employees, Service Providers, or other agents and representatives who have responsibilities related to the subject matter of the Consent Order. 114.

For 5 years from the Effective Date, Respondent must deliver a copy of this Consent Order to any business entity resulting from any change in structure referred to in Section XIV, any future board members and executive officers, as well as to any managers, employees, Service Providers, or other agents and representatives who will have responsibilities related to the subject matter of the Consent Order before they assume their responsibilities. 115.

Respondent must secure a signed and dated statement acknowledging receipt of a copy of this Consent Order, ensuring that any electronic signatures comply with the requirements of the E-Sign Act, 15 U.S.C. § 7001 et seq., within 30 days of delivery, from all persons receiving a copy of this Consent Order under this Section.

2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 35 of 41

Page 37

VI Recordkeeping

IT IS FURTHER ORDERED that 116.

Respondent must create, or if already created, must retain for at least 5 years from the Effective Date, the following business records: a.

All documents and records necessary to demonstrate full compliance with each provision of this Consent Order, including all submissions to the Bureau.

All documents and records pertaining to the Redress Program, described in Section XI above.

Copies of all sales scripts; training materials; advertisements; websites; and other marketing materials; and including any such materials used by a Service Provider on behalf of Respondent.

For each individual Affected Consumer and his or her enrollment in the Add-On Product: the consumer’s name, address, phone number, email address; amount paid, quantity of product purchased, description of the product purchased, the date on which the product was purchased, a copy of any promotional or welcome materials provided, and, if applicable, the date and reason consumer left the program.

All consumer complaints and refund requests regarding Add-On Products (whether received directly or indirectly, such as through a Service Provider), and any responses to those complaints or requests. 117.

Respondent must retain the documents identified in paragraph 116 for the duration of the Consent Order.

2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 36 of 41

Page 38

118.

Respondent must make the documents identified in paragraph 116 available to the Bureau upon the Bureau’s request.

XVII Notices IT IS FURTHER ORDERED that:

119.

Unless otherwise directed in writing by the Bureau, Respondent must provide all submissions, requests, communications, or other documents relating to this Consent Order in writing, with the subject line, “In re First National Bank of Omaha, File No. 2016-CFPB-0014,” and send them either: a.

By overnight courier (not the U.S. Postal Service), as follows: Regional Director, Bureau West Region Consumer Financial Protection Bureau 301 Howard Street, Suite 1200 San Francisco, CA 94105; or b.

By first-class mail to the below address and contemporaneously by email to [email protected] and any other email address as directed in writing by the Bureau:

Regional Director, Bureau West Region Consumer Financial Protection Bureau 301 Howard Street, Suite 1200 San Francisco, CA 94105 XVIII Cooperation with the Bureau IT IS FURTHER ORDERED that:

120.

Respondent must cooperate fully to help the Bureau determine the identity and location of, and the amount of injury sustained by, each Affected Consumer. 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 37 of 41

Page 39

Respondent must provide such information in its or its agents’ possession or control within 14 days of receiving a written request from the Bureau. XIX Compliance Monitoring IT IS FURTHER ORDERED that, to monitor Respondent’s compliance with this Consent Order:

121.

Within 14 days of receipt of a written request from the Bureau, Respondent must submit additional Compliance Reports or other requested information, which must be made under penalty of perjury; provide sworn testimony; or produce documents.

122.

Respondent must permit Bureau representatives to interview any employee or other person affiliated with Respondent who has agreed to such an interview. The person interviewed may have counsel present.

123.

Nothing in this Consent Order will limit the Bureau’s lawful use of civil investigative demands under 12 C.F.R. § 1080.6 or other compulsory process. XX Modifications to Non-Material Requirements IT IS FURTHER ORDERED that:

124.

Respondent may seek a modification to non-material requirements of this Consent Order (e.g., reasonable extensions of time and changes to reporting requirements) by submitting a written request to the Regional Director. 125.

The Regional Director may, in his/her discretion, modify any non-material requirements of this Consent Order (e.g., reasonable extensions of time and 2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 38 of 41

Page 40

changes to reporting requirements) if the Regional Director determines good cause justifies the modification. Any such modification by the Regional Director must be in writing.

XXI Administrative Provisions 126.

The provisions of this Consent Order do not bar, estop, or otherwise prevent the Bureau, or any other governmental agency, from taking any other action against Respondent, except as described in paragraph 127. 127.

The Bureau releases and discharges Respondent from all potential liability for law violations that the Bureau has or might have asserted based on the practices described in Section IV of this Consent Order, to the extent such practices occurred before the Effective Date and the Bureau knows about them as of the Effective Date. The Bureau may use the practices described in this Consent Order in future enforcement actions against Respondent and its affiliates, including, without limitation, to establish a pattern or practice of violations or the continuation of a pattern or practice of violations or to calculate the amount of any penalty. This release does not preclude or affect any right of the Bureau to determine and ensure compliance with the Consent Order, or to seek penalties for any violations of the Consent Order.

128.

This Consent Order is intended to be, and will be construed as, a final Consent Order issued under section 1053 of the CFPA, 12 U.S.C. § 5563, and expressly does not form, and may not be construed to form, a contract binding the Bureau or the United States.

2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 39 of 41

Page 41

129.

This Consent Order will terminate 5 years from the Effective Date or 5 years from the most recent date that the Bureau initiates an action alleging any violation of the Consent Order by Respondent. If such action is dismissed or the relevant adjudicative body rules that Respondent did not violate any provision of the Consent Order, and the dismissal or ruling is either not appealed or upheld on appeal, then the Consent Order will terminate as though the action had never been filed. The Consent Order will remain effective and enforceable until such time, except to the extent that any provisions of this Consent Order have been amended, suspended, waived, or terminated in writing by the Bureau or its designated agent.

130.

Calculation of time limitations will run from the Effective Date and be based on calendar days, unless otherwise noted.

131.

Should Respondent seek to transfer or assign all or part of its operations that are subject to this Consent Order, Respondent must, as a condition of sale, obtain the written agreement of the transferee or assignee to comply with all applicable provisions of this Consent Order.

132.

The provisions of this Consent Order will be enforceable by the Bureau. For any violation of this Consent Order, the Bureau may impose the maximum amount of civil money penalties allowed under section 1055(c) of the CFPA, 12 U.S.C. § 5565(c). In connection with any attempt by the Bureau to enforce this Consent Order in federal district court, the Bureau may serve Respondent wherever Respondent may be found and Respondent may not contest that court’s personal jurisdiction over Respondent.

2016-CFPB-0014 Document 1 Filed 08/25/2016 Page 40 of 41

Page 42

2016-CFPB-0014 Document’ Filed 08/25/2016 Page 41 of 41

133. This Consent Order and the accompanying Stipulation contain the complete agreement between the parties. The parties have made no promises, representations, or warranties other than what is contained in this Consent Order and the accompanying Stipulation. This Consent Order and the accompanying Stipulation supersede any prior oral or written communications, discussions, or understandings.

134. Nothing in this Consent Order or the accompanying Stipulation may be construed as allowing the Respondent, its Board, officers, or employees to violate

any law, rule, or regulation.

IT IS SO ORDERED, this 20 fay of August, 2016.

Hudak Cncbiog

Richard Cordray Director Consumer Financial Protection Bureau

Stipulation

PDF of this document (5 pages)

Page 43

UNITED STATES OF AMERICA CONSUMER FINANCIAL PROTECTION BUREAU ADMINISTRATNE PROCEEDING File No. 2016-CFPB-0014 In the matter of:

First National Bank of Omaha STIPULATION AND CONSENT TO THE ISSUANCE OF A CONSENT ORDER The Consumer Financial Protection Bureau (Bureau) intends to initiate an administrative proceeding against First National Bank of Omaha (Respondent), under 12 U.S.C. §§ 5563 and 5565, for its marketing, sales, and administration of credit card add-on products, in violation of the Consumer Financial Protection Act of 2010's prohibition on unfair, deceptive, or abusive acts or practices, 12 U.S.C. §§ 5531, 5536. Respondent, in the interest of compliance and resolution of the matter, consents to the issuance of a Consent Order substantially in the form of the one to which this Stipulation and Consent to the Issuance of a Consent Order is attached (Consent Order), and which is incorporated by reference.

2016-CFPB-0014 Document 2 Filed 08/25/2016 Page 1 of 5

Page 44

2016-CFPB-0014 Document2 Filed 08/25/2016 Page 2of5

In consideration of the above premises, Respondent agrees to the following: Jurisdiction

The Bureau has jurisdiction over this matter under sections 1053 and 1055 of the

Consumer Financial Protection Act (CFPA), 12 U.S.C. §§ 5563, 5565.

Consent Respondent agrees to the issuance of the Consent Order, without admitting or

denying any of the findings of fact or conclusions of law, except that Respondent admits the facts necessary to establish the Bureau’s jurisdiction over Respondent and the subject matter of this action.

Respondent agrees that the Consent Order will be deemed an “order issued with the consent of the person concerned” under 12 U.S.C. § 5563(b)(4), and agrees that the Order will become a final order, effective upon issuance, and will be fully enforceable by the Bureau under 12 U.S.C. §§ 5563(d)(1) and 5565.

Respondent voluntarily enters into this Stipulation and Consent to the Issuance of a Consent Order.

The Consent Order resolves only Respondent’s potential liability for law violations that the Bureau asserted or might have asserted based on the practices described in Section IV of the Consent Order, to the extent such practices occurred before the Effective Date and the Bureau knows about them as of the Effective Date. Respondent acknowledges that no promise or representation has been made by the Bureau or any employee, agent, or representative of the Bureau, about any liability outside of this action that may have arisen or may

arise from the facts underlying this action or immunity from any such liability.

Page 45

2016-CFPB-0014 Document2 Filed 08/25/2016 Page 3of5

Respondent agrees that the facts described in Section IV of the Consent Order will be taken as true and be given collateral estoppel effect, without further proof, in any proceeding before the Bureau to enforce the Consent Order, or in any subsequent civil litigation by the Bureau to enforce the Consent Order or its rights to any payment or monetary judgment under the Consent Order, such as a non-dischargeability complaint in any bankruptcy case.

The terms and provisions of this Stipulation and the Consent Order will be binding upon, and inure to the benefit of, the parties hereto and their successors in interest.

Respondent agrees that the Bureau may present the Consent Order to the Bureau

Director for signature and entry without further notice.

Waivers Respondent, by consenting to this Stipulation, waives:

a. Any right to service of the Consent Order, and agrees that issuance of the Consent Order will constitute notice to the Respondent of its terms and conditions;

b. Any objection to the jurisdiction of the Bureau, including, without limitation, under section 1053 of the CFPA, 12 U.S.C. § 5563;

c. The rights to all hearings under the statutory provisions under which the proceeding is to be or has been instituted; the filing of proposed findings of fact and conclusions of law; proceedings before, and a recommended decision by, a hearing officer; all post-hearing procedures; and any other procedural right available under section 1053 of the CFPA, 12 U.S.C. §

5563, or 12 CFR Part 1081;

Page 46

2016-CFPB-0014 Document2 Filed 08/25/2016 Page 4of5

d. The right to seek any administrative or judicial review of the Consent Order;

e. Any claim for fees, costs or expenses against the Bureau, or any of its agents or employees, and any other governmental entity, related in any way to this enforcement matter or the Consent Order, whether arising under common law or under the terms of any statute, including, but not limited to the Equal Access to Justice Act and the Small Business Regulatory Enforcement Fairness Act of 1996; for these purposes, Respondent agrees that Respondent is not the prevailing party in this action because the parties have reached a good faith settlement;

f. Any other right to challenge or contest the validity of the Consent Order; g. Such provisions of the Bureau’s rules or other requirements of law as may be construed to prevent any Bureau employee from participating in the preparation of, or advising the Director as to, any order, opinion, finding

of fact, or conclusion of law to be entered in connection with this Stipulation or the Consent Order; and

h. Any right to claim bias or prejudgment by the Director based on the

consideration of or discussions concerning settlement of all or any part of

the proceeding.

FIRST NATIONAL BANK OF OMAHA, BY:

Michael A. Summers August 16, 2016

Chief Financial Officer, First National Bank of Omaha

Page 47

2016-CFPB-0014 Document2_ Filed 08/25/2016 Page5of5

The undersigned directors of First National Bank of Omaha each acknowledges having read this Stipulation and at pee Order, and approves of First National Bank of

Omaha ania into this Di fon.

Nicholas W. Baxter eg August 16, 2016

Director, First National Bank of Omaha

Ct. 0. xh —~

Clarkson D. Lauritzen August 16, 2016

Director, First National Bank of Omaha

Consent order

PDF of this document (1 pages)

Page 48

UNITED ST A TES OF AMERICA BUREAU OF CONSUMER FINANCIAL PROTECTION In the Matter of:

First National Bank of Omaha ORDER TERMINATING THE CONSENT ORDER 2016-CFPB-OO 14 With the consent of First National Bank of Omaha (Respondent), by and through its Board of Directors, the Bureau of Consumer Financial Protection (Bureau) issued a Consent Order on August 20, 2016, for unfair and deceptive acts or practices in violation of sections I 03 I and I 036(a)( I )(B) of the Consumer Financial Protection Act of 20 IO (CFPA), 12 U.S.C. §§ 5531 and 5536(a)( 1 )(B).

To this date, the Bureau has detennined that the Respondent has fulfilled the obligations under the Consent Order, including, among other things, submitting and implementing the required Compliance and Redress Plans, and paying all required remediation. Accordingly, under Section XX[ of the Consent Order, the Bureau directs that the Consent Order be, and it hereby is, tenninated this Way of 2019. Kathleen L. Kraninger Director Bureau of Consumer Financial Protection