Remaining compliant as regs change

Dealership finance and insurance managers rely on a network of outside partners to ensure compliance with new regulations and to stay informed about changes that may be coming. Among those partners: F&I trainers, dealership auditors and software providers.

Eric Schmitz, senior vice president of compliance at KPA Services, of Lafayette, Colo., said his company's 350 dealership-focused employees constantly monitor and research regulations.

For example, he and his staff monitor state and federal government websites that list and discuss current, pending and proposed regulations. They also draw on partnerships with law firms around the country that represent dealers and dealerships to help KPA design, reinforce and update compliance training programs for dealerships.

"In the F&I department, your biggest risk is probably a lawsuit," said Schmitz. "Behind lawsuits, you could get a government action against you."

While it makes good legal sense for dealerships to retrain employees whenever laws change or new laws are implemented, that's not always practical, Schmitz said.

Most dealers provide compliance updates for their staffs during regularly scheduled online training, Schmitz said.

KPA, a provider of compliance audit software, services and training to dealerships and other businesses, emails regulation-change notices to affected dealers. The company's field staff also will train managers, if necessary, during audits.

One emerging regulation that has begun showing up in KPA research is the California Consumer Privacy Act.

The law gives California consumers more control over their personal data and how it's used. For example, it gives California residents the right to know what personal data is being collected about them and whether that data is sold or disclosed, and to whom. They also have the right to request that a business delete any personal information about a consumer that was collected from that consumer.

The law takes effect Jan. 1, but the state has until July 1 to issue detailed rules for enforcing it. KPA's privacy classes and some customer information security courses will be modified for California dealerships in January and again in July, Schmitz said.

While the impact has not yet spread beyond California, it could. KPA will modify training materials for dealers in other states if those states adopt versions of the law or elements that are the same or similar to it, he said.

"It's starting in California but likely to spread to other states," Schmitz predicted.

Meanwhile, other states have their own concerns.

In Michigan, for instance, dealerships are undergoing "frequent" unannounced state audits, said Marissa Hunt, corporate controller at LaFontaine Automotive Group, of Highland, Mich.

Since about mid-May, state auditors visited six of the group's 17 Michigan dealerships. Those auditors have the authority to examine every aspect of a Michigan dealership's business, including its F&I operations. During one dealership audit, for example, the regulators took issue with the placement of required signage where customer service orders are written.

KPA, which counts LaFontaine Automotive among its clients, conducts quarterly audits at the group's dealerships during which it examines, among other things, how well the group adheres to F&I compliance standards.

For example, one standard calls for screening customers before a sale against a list of people identified by the federal government as terrorists, drug dealers and others deemed as threats to the U.S., so KPA checks the records to determine whether dealership personnel are doing so properly.

Immediately after each KPA audit, LaFontaine managers discuss the results and how each F&I manager can improve performance.

"It's important to the LaFontaine family [the group's owners] that we inspect what we expect," Hunt said.

The state audits have led to a mutual give-and-take between the dealership group and KPA. LaFontaine makes KPA aware of what state regulators are focusing on, while KPA helps LaFontaine stay fully compliant.

As a result, during LaFontaine's next round of quarterly audits with KPA, the two companies plan a deep dive into the Application for Michigan Title and Registration/Statement of Vehicle Sale, also called Form RD-108. Among the items required on the form are the temporary registration numbers and issuer names, Hunt said.

"When the state of Michigan comes in to audit our dealership, they always look specifically to make sure that a temporary registration number and an issuer name is located on the form," Hunt said. "So it's very important to us to make sure that these heavily audited lines on that form — specifically because we know it's a hot issue — are completed."
LaFontaine Automotive ranks No. 57 on Automotive News' list of the top 150 dealership groups based in the U.S. with retail sales of 16,909 new vehicles in 2018.

Jim Ganther, CEO of Mosaic Compliance Services, in Tampa, Fla., said he keeps his dealership clients up to speed through a continuous, Web-based compliance training program for dealerships that he created 12 years ago.

Each year, Mosaic creates online modules that update previously trained F&I managers on new and revised compliance laws and test them on their general knowledge, Ganther said.

The company also creates modules for immediate release when necessary.

For example, in December 2017, there were changes in the interpretation of the Military Lending Act, which previously had not applied to automotive finance.

"We had a module out" to dealerships in January 2018, said Ganther, an attorney who makes sure the company's training content is legally accurate.

Though Mosaic does not provide legal services for dealers, Ganther credits his membership in the National Association of Dealer Counsel with helping him stay current with changing compliance regulations.

The membership affords him a subscription to "Spot Delivery," a monthly newsletter for dealerships and finance companies published by Hudson Cook, a law firm with main offices in Hanover, Md., that specializes in financial services. It also gives him access to the expertise of the association's 600 member attorneys, he said.

One thing that Ganther is keeping his eye on is a proposed revision to the Federal Trade Commission's Safeguards Rule. Among other things, the proposal would require dealerships to appoint a chief information security officer, known as a CISO.

Though many large dealership groups have such a position, whether the individual holds that exact title or not, small dealerships that sell, say, 40 new vehicles a month, do not, Ganther said.

He said a staff CISO could cost a dealer $120,000 to $150,000 a year. Even the expense of hiring a part-time CISO could be "significant," he said.

He added: "Not many dealers are aware" of the proposed changes.