In this transcribe of the Used Car Dealer Podcast, Zach interviews Adam Crowell of ComplyNet. They discuss the importance of FTC Safeguard compliance for used car dealers, the proposed rules by CFPB and FTC, safety recalls and non-proper disclosure for dealers, and advice on how to get started with Safeguard Compliance.

Zach: Hello Zach here, Happy New Year 2023 we have a great guest on the podcast today, Adam Crowell, the president and general counsel of ComplyNet. Thanks so much for joining me on the podcast today.

Adam: Oh, you're welcome Zach, Thank you so much for having me on the podcast.

Zach: So let's get started for those of us listening, the dealers out there. Talk about your background on the legal side of automotive and what exactly you guys do at ComplyNet.

Adam: Well, Zach, I think you're asking me to age myself a little bit here, but I've been working with dealers for over 20 years now. I started working with dealers when I was in law school, I was working for a firm that represented one of the manufacturers. They used to have dealerships or the manufacturer get sued over lemon law cases. The dealerships would sometimes get sued as a consequence of that and that's when I first really started to get introduced with the dealerships. I wanted to be a trial attorney and I was a litigator for, for a big portion of my career and about 13 years ago is when I really, really started focusing very heavily on working with the dealers and of course, lots of times when I was getting involved with the dealers, it was because, you know, something bad had happened, it was almost reactionary and I got involved with compliant and learned what ComplyNet was doing and understood that complaint was actually taking very proactive steps to make sure that those bad things weren't happening and I was I was all in, I was just very excited about it and I've been involved with compliant now for almost five years now. It's gonna be five years coming up in April. Nice and lots of used car dealers out there, they're starting to become familiar with FTC safeguard. They've probably even senior ads in the NIADA magazine and website

Zach: Nice and lots of used car dealers out there, they're starting to become familiar with FTC safeguard. They've probably even seen your ads in the NIADA magazine and website, but what's most important for dealers, especially used car dealers to understand about FTC safeguard?

Adam: Yeah, so, so that's a great question. So ComplyNet, that is a complete compliance company and we do focus on safeguards and we're working with dealerships all across the country to help them comply with us and what I think that the dealer should understand that really haven't started with this process is that this rule requires help. You're not going to be able to comply with this new rule on your own. You're really going to need to have professionals that are involved. You're probably gonna need to be working with some sort of compliance provider like us and on top of that, you're probably also going to have to be working very closely with an IT firm because there are some technical requirements that are going to require that the IT team get involved to help resolve the issues that are being found because there it's going to be a very proactive solution and there there's reporting requirements that have to happen on an annual basis. And there's just a lot to do both on the administrative, physical and technical side. So it's really the one thing that I need to impress is that you're going to need help with this program. You're not going to be in compliance if you're really just trying to do it yourself.

Zach: And what would be a couple examples for context purposes of the technical or admin things that used car dealers might have to do to be in compliance?

Adam: So there's about 10 steps that we've identified to really become in compliance with this rule. And you know, there's things like making sure that you have someone that's designated to be in charge as a qualified individual but also having the right IT resources that are also involved with the program. It requires having a written information security program, having various access controls, performing a risk assessment, having a written incident response plan. But when it comes to like the technical side of things, there's certain things that have to occur. So for any information systems that are containing customer information to get in compliance with this rule, it's going to require doing things like having, making sure that there's encryption of those systems that there's multifactor authentication, that any sort of computer networks that you have there locally, that there's things like continuous monitoring that's happening and that it's also happening on any of these systems that are being utilized. Things like training is now mandatory, phishing is something that should also be conducted because 91% of all hacking starts with fishing according to the studies that are out there.

So there's, there's just a lot of things that the dealerships are gonna have to do to truly get in compliance and the FTC is not just requiring that you have a policy and you claim that you're doing training, but they're also requiring a report that has to be generated for the executive team to summarize everything that's happening because the FTC wants to be able to hold someone accountable if there is some sort of event that happens, such as a data breach.

Zach: So many dealers I hear from, especially used car dealers, they'll say, hey, I'm too small. Only the larger dealers get in trouble in regards to FTC safeguard and other kinds of compliance considerations. What do you think?

Adam: Well, I would have to say, I respectfully disagree because I pay attention across the country, of what's happening and really the state Attorney General's, it may not necessarily be the FTC that's getting involved. The FTC does go after small businesses to understand with a federal agency like the FTC, they tend to focus a lot on consumer complaints that are coming in. So it might take a little bit more to get their attention, but on the state level when you're talking about the state attorney general's, it can just be one complaint that ends up happening to them before they really start to get involved and they start investigating the processes and so we see a lot when it comes to the state attorney general's, we also see the plaintiff's attorneys that are, that are also enforcing these consumer protection laws,so there, there are, there is quite a bit of activity. You may not always hear about it in this industry. We don't always name a lot of names, but I promise you that there are dealers around you that are getting in trouble for these things. You may not know about it, but they're, they're certainly getting in trouble.

Zach: So, what were some of your observations as the dealer tried to comprehend FTC safeguard and put in measures originally for the December 9th deadline now extended to June?

Adam: Yeah, so there's always your early adopters that understand, okay, well, these are things that we're going to have to get in front of and we're gonna have to do and then there's a couple other categories, but, the one thing I did notice about this particular rule, as more and more dealers were becoming aware of what they had to do. There were some that were kind of waiting and they were kind of waiting till the last minute because they thought that, okay, there's a deadline of December 9th, but the reality is that some of these requirements are already in place. And there's some things that are very significant that you have to do such as testing your key information systems and conducting risk assessments and having a written information security program in place. And there's a bunch of other things that were supposed to go into effect on December the ninth that had been pushed back till basically until June the ninth. So there was a six month delay in those but a lot of people were looking to really start to get into compliance waiting till november for example to sign up here and there's no way that they were going to get in compliance in such a short amount. There's just so much to do here. I mean there's even a requirement to this new rule that any service providers that you're working with that have access to customer information and this could be one of your vendors that could be your DMS for example but you need to go through an assessment process of them.

So you understand what sort of things that they're doing to protect the information and it really should be all the things that you're required to do to protect the information. But there's also a requirement that there be contractual obligations. So an agreement put in place that they're going to maintain the appropriate safeguards. So just think about that whole process with, you know, having to reach out to your vendors and ask them to complete an assessment and get an agreement from them, all of that stuff takes time.
And from a small dealer perspective, you could try to do that, you can try to reach out, you can try to do it through paper or you could potentially also try to use a system where maybe some of the stuff has already been completed, but nevertheless, there's a lot to do here.
As I said, with putting all these things in place, including on the technical side and, you know, vetting your vendors and getting all these agreements in place.

So the one thing that I would say is that, you know, when it comes to it, don't delay on this.
You really need to start doing this stuff now. And on top of that, the FTC has other power and other authority as do the States. So if you're not protecting the information and a reasonable consumer would say, hey, I believe that you're protecting my information after all. You collect things like doc fees, or you collect other sorts of fees. And my understanding is that if you're protecting that information, you could potentially see some sort of action that's taken for what they call unfair and deceptive acts and practices and the FTC has used that type of authority to go after other businesses when they're having some sort of data breach. So waiting is not advisable. You should really have all of this stuff put in place if you don't have it now, you should really be looking to put it in place right now because you're already behind the eight ball.

Zach: So talk about new proposed rules by CFPB & FTC which impact used car dealers, especially buy here, pay here.

Adam: Yeah, absolutely. So on the buy here pay here side, you're seeing a couple new regulations that have been proposed by the CFBP & it does have direct authority over buy here, pay here dealers. So a couple of rules that they're proposing is they want to have an annual registry now of every non bank financial institution. And what they're looking for is their look for each one of these non bank financial institutions. So we're talking about potentially buy here, pay here dealer related finance company, and so on and so forth. But they're looking for someone to be designated from each one of those entities and to file a report on an annual basis with the CFPB essentially putting themselves on the CFPB's map.

But what they're asking them to report is whether or not they've had any sort of consumer protection violations, whether it be from a settlement, a consent decree, some sort of order from the court. But they're creating this because they're calling it a repeat offender registry. So they want to know if there's been previous violations in the past. And even if you haven't violated, they still want you to do the registry and have someone that's going to attest to doing that. They also are looking for another registry when it relates to documents. So this could be your buyers ordering your retail installment agreement. But  if it's waiving certain rights that the consumers have, then they're also asking that that be filed with the CFPB and they're going to make that publicly available to other regulators and potentially to plaintiff's attorneys and that sort of thing. So this could be another issue for the independent dealers in particular the buy here, pay here dealers.
The FTC has also been proposing different rules as it relates to the auto industry and also in general industry. So one of the things that they're that they're trying to get rid of is what they considered to be junk fees or these, these add on fees that really provide no no value whatsoever and they've come up with rules in general industry, but they've also come up with rules specifically to the auto industry and they are looking at the way that vehicles are advertised, for example, and, and how you have to list out the price and what sort of additional fees can be tacked onto that and how that's going to be marketed. They're also looking at any sort of aftermarket products that you might be offering, such as a service contract. And they're looking at disclosures that you have to make when it comes to any sort of necessary add ons. And they're also looking to potentially require that things like these add on products that might be offered, that they're also listed on your website and that they have the price of those. Because one of the things that they're very interested to know is whether or not the same prices are being offered to everybody. And the FTC has been taking enforcement actions. And so if some of the state Attorney General's, but they've been looking at things like the markup on interest rates. And they've also been looking at the markups on these aftermarket products and seeing whether or not, you know, all ethnic groups are essentially being offered the same price for, you know, whether it be a markup on an interest rate of these voluntary protection products. So they're looking at these additional rules that one relates to advertising. For example, they're looking also to have a very specific methodology when it comes to the sales process and when you can talk about the price, when you can talk about financing, when you can talk about add on products and it's going to be a very tailored sort of process where there's going to be date and time stamps on these forms that you're going to have to use and you start thinking about this and you think about how this could potentially just totally change the way that you're that you're trying to sell cars and it could really slow down the process on top of that. So, that's a proposed rule. It hasn't been passed yet. There certainly comments that were made to the proposed rule by the national associations and the state associations to and they're pushing back on that they that rule might also be challenged if it does get past for procedural issues but I'll leave that to be, but just understand that both the CFPB & the FTC are taking very aggressive approaches in both enforcement actions and rulemaking. And they are focusing on the auto industry as part of their enforcement actions right now. So just understand that dealerships right now are in the crosshairs of some of these regulators.

Zach: So, on that same note, talk about safety recalls, non-proper disclosure for dealers. Is this another big focus for enforcement coming forward?

Adam: Yeah, so there was there was one notable case from just a couple of months ago, but 36 state attorney generals had announced a settlement with a national used car provider over safety recalls so from on a, on a national level, when it comes to safety recalls, this was more something that the, the new vehicle dealers were more focused on. But now with this new settlement with these 36 state attorney generals, and this was a, this was a seven figure settlement by the way. But essentially what had happened is that the state attorney generals were looking at some of the representations that were being made about vehicles. You know, this is a good vehicle, it's reliable, that sort of thing. But some of these vehicles were also being sold with open safety recalls. And because of it, the state attorney generals were trying to reconcile that and say, look, you can't make these types of representations and also sell vehicles with open safety recalls. So now, as it relates to that there really should be with every independent dealer, they really should be adopting everything that they can to make sure that this is very transparent. So they should have a policy that they really go through with their own personnel about how to find a safety recall. How does that get disclosed to the consumer, there should be a form that's being utilized and you know, of course if you can get the safety recall fixed, that should be something that's necessary. But really with this, this settlement that happened, you know, one of the requirements was that, hey, there needs to be a formal disclosure that's made that's really telling the consumer that there might be a safety recall on this vehicle. There is in fact one that's in place. So that's definitely something that when you're, when you're looking through your paperwork, you should be looking to see if that's one of the tools that you have in the arsenal and make sure that anyone that's going through that F&I process that.
They really understand that they've got to be utilizing that form and making the proper disclosures.

Zach: So Adam, if you were a used car dealer thinking about the upcoming June deadline, what advice would you have to get started and move toward FTC safeguard compliance?

Adam: I would say two things: don't wait. You need to get started right now and contact someone by complying that when we, when we talk to dealers, it's very much an educational sort of process and we take you through the steps of what has to happen long before we ever even start talking about what the, what the solutions are for that. So what I would suggest is to go to our website, go to www.complynet.com and there's an area for scheduling a meeting. So just go to the contact schedule meeting with us and we'll be more than happy to take you through what those actual requirements are and what sort of things that we can do, to potentially help.

Zach: So lastly, Adam What's coming down the pipeline for ComplyNet in 2023?

Adam: Well, I'll tell you it has been, you know, it's, it's unfortunate for the dealers because there's just been so much regulatory action that's been happening, but I think that a lot of dealers are starting to wake up and realize that they need Help. So we've been working with a lot of dealers, you know, we're a 29 year old company. We've been, we work with thousands of dealers already across the country, but we've, we've been forging a lot of new relationships and we hope that we're going to gain some more. But, one of the great things that we have is that we have a platform, we have a process and we have the right people, everyone we hire comes from the auto industry. They're all former compliance people, and we also train them on our system, but like I said, we have a platform and we have this awesome compliance platform that has a new user interface that's going to be coming out that we're super, super excited about. It really takes everyone through exactly what it's taking to truly be compliant with our various programs and we cover a number of things we cover of course privacy and safeguards, but we also have programs for things like sales, finance and advertising, human resources and for those dealerships that have service centers. We also have a very robust environmental health and safety program.

Zach:  Wow! A lot of knowledge for this episode. A lot of interesting compliance hints and tips for dealerships. Thank you so much for being on the podcast today adam.

Adam: Oh, you're welcome. Thank you so much for having us and invite us back anytime.